167.99.120.151|chasecardsec01.com|2022-02-26 01:16:41 167.99.120.151|citihelps9.com|2022-02-26 21:15:53 167.99.120.151|onlinecitis9b.com|2022-02-26 16:21:08 167.99.120.151|supportbciti9.com|2022-02-26 14:46:33
Без названия
easywebs-secure-banking.com 2022-02-26 22:01:09 banking-online-easyweb.com 2022-02-26 20:58:16 $ host td.easywebs-account-online.com td.easywebs-account-online.com has address 3.128.17.0
Spam Hosting (ukraine-vs-russia.com)
This IP address hosts ukraine-vs-russia.com, then landing page in a large spam blast currently being sent from an unnamed VPS server at VPSNet Latvia. The spam urges recipients to click a link to «vote» on whether they support Russia or Ukraine in the current conflict. Spamhaus has not checked the link, but «click bait» of… Читать далее Spam Hosting (ukraine-vs-russia.com)
Spamvertised website
Received: from [109.237.97.59] (helo=borderlandresearch.com) From: Congratulations <newsletter@bademeister.com> Subject:_We’ve seen your loyalty and now it’s time for us to give thanks Date: Fri, 25 Feb 2022 20:1x:xx +0100 https://usaketo.page.link/[] 172.253.63.138 https://www.biggvalues.com/6PBSMXP/SK34J1G/?creative_id=11443&source_id=tyu98765tgh&sub1=[]&sub2=gfr5678&sub3=65r4edfgh&sub4=765refgh&sub5=[] 70.37.99.62 https://www.lpredirect.com/24QSBG/981J153/?source_id=3532&sub1=[] 34.117.79.165 https://wintodayyou.com/4685-4586-fl-adi/?encoded_value=24QSBG&sub1=[]&sub2=&sub3=&sub4=&sub5= 185.128.34.90 https://www.megatr4ffic.com/24QSBG/8S71PZK/?sub1=[]&sub2=&sub3=&sub4=&sub5= 34.117.79.165 https://sm2.techcharmtdy.com/?ts=78A14007&s1=25&s2=&clickid=[] 54.85.225.142
RemcosRAT botnet controller @54.209.212.142
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 54.209.212.142 on port 2030 TCP: $ telnet 54.209.212.142 2030 Trying 54.209.212.142… Connected to 54.209.212.142. Escape character… Читать далее RemcosRAT botnet controller @54.209.212.142
Tofsee botnet controller @35.228.103.145 [second listing]
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 35.228.103.145 on port 443 TCP: $ telnet 35.228.103.145 443 Trying 35.228.103.145… Connected to 35.228.103.145. Escape character… Читать далее Tofsee botnet controller @35.228.103.145 [second listing]
phishing server
147.182.204.18|usps-help.net|2022-02-25 23:52:09 147.182.204.18|wellshelp.org|2022-02-25 19:31:36
Malware botnet controller @135.125.128.108
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 135.125.128.108 on port 443: $ telnet 135.125.128.108 443 Trying 135.125.128.108… Connected to 135.125.128.108. Escape character is ‘^]’ Malicious domains observed at this… Читать далее Malware botnet controller @135.125.128.108
Malware botnet controllers @45.8.124.187
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 45.8.124.187 on port 443: $ telnet 45.8.124.187 443 Trying 45.8.124.187… Connected to 45.8.124.187. Escape character is… Читать далее Malware botnet controllers @45.8.124.187
Credit card fraud gang hosting: hacked-paypal-accounts-dump.ru (zuganov-lox.ru / fe-shop.su / vmad.su / amazingdumpsshop.ru / cvv-fullz-shop.ru etc.)
Stolen credit card data websites: buying-cc-on-dark-web.ru. 14400 IN A 139.99.247.45 credit-card-database-dump.ru. 14400 IN A 139.99.247.45 _____________________________ Was: 91.201.55.248 buying-cc-on-dark-web.ru 2022-01-29 09:56:24 91.201.55.248 credit-card-database-dump.ru 2022-01-29 09:56:09 91.201.55.248 dark-web-cvv-shop.ru 2022-01-29 09:56:23 91.201.55.248 dump-furniture-store-near-me.ru 2022-01-29 09:56:25 91.201.55.248 hacked-paypal-accounts-dump.ru 2022-01-29 11:46:42 _____________________________ Was: 45.85.117.124 altenen-free-credit-card.ru 2022-01-28 05:46:26 45.85.117.124 atm-dumps.ru 2022-01-28 07:47:11 45.85.117.124 best-bins-for-cc.ru 2022-01-28 07:47:29 45.85.117.124 best-cc-dump-sites.ru 2022-01-28 07:46:45… Читать далее Credit card fraud gang hosting: hacked-paypal-accounts-dump.ru (zuganov-lox.ru / fe-shop.su / vmad.su / amazingdumpsshop.ru / cvv-fullz-shop.ru etc.)