The host at this IP address is emitting spam emails: 2020-03-02 209.85.161.100 Kontoservice <XMJEqqGc9SW5mHYd2Up0@adzan-isya.info> Ihr Amazon-Konto wurde eingeschränkt. Bitte vervollst\x0aändigen Sie unsere Sicherheitsmaßnahmen
Spam source @209.85.167.66
The host at this IP address is emitting spam emails: 2020-03-04 209.85.167.66 =?UTF-8?B?c2VydmljZUBwYXlw4bqabC5kZSAt?= <secureappsiero2@mobileapps.games> Ihr Paypal-Konto wurde begrenzt. (18489-55889-5555)
Malware distribution @34.98.114.63
The host at this IP address (34.98.114.63) is either operated by cybercriminals or hosting compromised websites that are being used to distribute malware: https://content.evernote.com/shard/s392/sh/47936656-c057-4184-b7b7-0526c7f2b2c0/b6d09aeb71064244/res/be13f536-6f66-41c1-bb88-e605171d5644/ AS number: AS15169 AS name: GOOGLE Hostname: 63.114.98.34.bc.googleusercontent.com
Abused / misconfigured newsletter service (listbombing)
The host at this IP address is being (ab)used to «listbomb» email addresses: From: scott@dailyplanetltd.com Subject: March Shirts of the Month Problem description ============================ Spammers signed up for the bulk email service using the victim’s email address. As a result, the victim is being «listbombed» with transactional messages and bulk email campaigns. Problem resolution ============================… Читать далее Abused / misconfigured newsletter service (listbombing)
Spam source @209.85.222.193
The host at this IP address is emitting spam emails: 2020-03-12 209.85.222.193 «Amazon.de» <app-bestellung4@kotajember.info> Ihre Amazon.de Bestellung von ‘Diamond Mobile Legend’ ….. ID:41892326 2020-03-12 209.85.222.193 «Amazon.de» <app-bestellung8@kotajember.info> Ihre Amazon.de Bestellung von ‘Diamond Mobile Legend’ ….. ID:72968268 2020-03-12 209.85.222.193 «Amazon.de» <app-bestellung5@kotajember.info> Ihre Amazon.de Bestellung von ‘Diamond Mobile Legend’ ….. ID:44371886 2020-03-12 209.85.222.193 «Amazon.de» <app-bestellung6@kotajember.info> Ihre Amazon.de… Читать далее Spam source @209.85.222.193
affiliate spam @35.204.164.160
Received: from bulkte.com (bulkte.com. [188.225.74.77]) Subject: Forget a vaccine for corona From: Pandemic <info@bulkte.com> Date: Tue, 31 Mar 2020 02:2x:xx +0100 https://bit.ly/3buy5RU 301 Moved Permanently http://tebulko.com/app/wrap/YXBwL3JlZGlyZWN0aW9uL3dyYXAucGhwP3RyYWNrPUExWEMtMVhSMVhNMFhTMVhWMFhOM1hPOVhXMFhQMFhMMFhVMFhUMVg= 302 Found https://orangesyl.com/?a=1655&oc=11454&c=33326&m=3&s1=1&s2=-1_9_0_0_0_0_1_0_1&s3=A1XC-1XR1XM0XS1XV0XN3XO9XW0XP0XL0XU0XT1X&s4=-1 302 Found https://muw.agileconnection.company/?kw=1655&s1=1&s2=33326 302 Found https://google.com?&%3F%3Fkw=1655&group_id=483&cntrl=00000&pid=21683&redid=82411&gsid=483&campaign_id=1228&p_id=21683&id=XNSX.1%3A%3A33326-r82411-t483&impid=69b55e82-734b-11ea-9a29-4e4e3e1c4387 301 Moved Permanently https://www.google.com/?%3F%3Fkw=1655&group_id=483&cntrl=00000&pid=21683&redid=82411&gsid=483&campaign_id=1228&p_id=21683&id=XNSX.1%3A%3A33326-r82411-t483&impid=69b55e82-734b-11ea-9a29-4e4e3e1c4387 200 OK tebulko.com. 3600 IN A 51.83.130.229 tebulko.com. 300 IN NS ns02.freenom.com. tebulko.com. 300 IN NS… Читать далее affiliate spam @35.204.164.160
Malware distribution @172.217.20.78
The host at this IP address (172.217.20.78) is either operated by cybercriminals or hosting compromised websites that are being used to distribute malware: https://docs.google.com/uc?authuser=0&id=1423iV9Ze5V1pNpU0omqvp-u46EpKft94&export=download https://docs.google.com/uc?export=download&id=1ia3WELHtRhs0Fe4ag2_O0aVkyzi_zUpx https://docs.google.com/uc?id=12yy_E3aTtAWOPqYdrXPvgj92EqjkVV1n&export=download https://docs.google.com/uc?id=1AworRdLimD73EzlkeIUdCkJcvSFCUC_m AS number: AS15169 AS name: GOOGLE — Google LLC Hostname: ams15s33-in-f14.1e100.net
Malware distribution @172.217.20.110
The host at this IP address (172.217.20.110) is either operated by cybercriminals or hosting compromised websites that are being used to distribute malware: https://sites.google.com/site/bnhy23/novinha/AppVoice%20.zip?attredirects=0&d=1 https://sites.google.com/site/bnhy23/novinha/AppVoice.zip?attredirects=0&d=1 https://sites.google.com/site/bnhy23/novinha/image_comprovante.jpg.zip?attredirects=0&d=1 https://sites.google.com/site/stormqk/dn/StormAgent.apk?attredirects=0 AS number: AS15169 AS name: GOOGLE — Google LLC Hostname: ams17s01-in-f14.1e100.net
Malware distribution @216.58.211.112
The host at this IP address (216.58.211.112) is either operated by cybercriminals or hosting compromised websites that are being used to distribute malware: https://storage.googleapis.com/wzukusers/user-34654398/documents/5c6cd19c87f44r9fOMiT/Base64Jef.txt https://storage.googleapis.com/wzukusers/user-34654398/documents/5c6cbd811626fvoj29vW/base64.txt https://storage.googleapis.com/wzukusers/user-34654398/documents/5c6ca94027662Tilxa4P/base.txt https://storage.googleapis.com/wzukusers/user-34654398/documents/5c6e2cbda22efXk3T7X2/base64.txt https://storage.googleapis.com/wzukusers/user-34654398/documents/5c6e2f6c8c5aduP2Yiwx/basejefin.txt https://storage.googleapis.com/wzukusers/user-34654398/documents/5c6eb2aa215a8CVWCf6s/fudjs.txt https://storage.googleapis.com/wzukusers/user-34654398/documents/5c6eab37b8dadMY1gX7C/base3.5.txt https://storage.googleapis.com/wzukusers/user-34654398/documents/5c7921a2cf26cUnJcGVm/nanocoregomes.txt https://storage.googleapis.com/wzukusers/user-34654398/documents/5c6fd6b4eb1c08aAMus8/go.jpeg https://storage.googleapis.com/wzukusers/user-34654398/documents/5c9e24cc08a4dLmV7CJO/CDT.txt AS number: AS15169 AS name: GOOGLE — Google LLC Hostname: ams15s32-in-f16.1e100.net
Spamvertised website
Received: from bing.com (185.40.6.3) From: Refinansier den dyre smågjelden <[]@boyhip.net> Subject: Re: 𝐿𝑎̊𝑛 uten sikkerhet inntil 500.000 kr Date: Mon, 13 Apr 2020 09:0x:xx UTC URL redirect chain: URL: http://gripdark.com/[] Server IP address is 38.68.134.131 Location: https://hylatreat.com/?a=1478&oc=[]&c=[]&m=3&s1=[]&s2=[]&s3=57 Server IP address is 34.90.201.90 Location: https://finansnord.no/?&clickid=[]&campaign=1050&affid=1478 Server IP address is 159.65.196.24