The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 185.137.234.33 on port 8080 TCP: $ telnet 185.137.234.33 8080 Trying 185.137.234.33… Connected to 185.137.234.33. Escape character… Читать далее Malware botnet controller @185.137.234.33
bestmobilesltd . com
The site: http://bestmobilesltd.com/ Appears to be being used to defraud BELL CANADA customers. If you have any questions please feel free to reach us at +1647 557 6620. Thank you, The Customer Care Team. Website: www.bestmobilesltd.com<http://www.bestmobilesltd.com> Address:- 1267 St Clair Ave W, Toronto, ON M6E 1B8
Suspected Snowshoe Spam IP Range — SELECTEL-NET
Identical spammer to: SBL543391 89.248.192.0/24 All these and more. 212.41.9.3 serasaautorizadoscn000.cloud 212.41.9.12 serasaautorizadoscn000.cloud 212.41.9.24 serasaautorizadoscn000.cloud 212.41.9.30 serasaautorizadoscn000.cloud 212.41.9.37 serasaautorizadoscn00000.cloud 212.41.9.38 autorizadoserasaexperian00.cloud 212.41.9.48 autorizadoserasaexperian00.cloud 212.41.9.60 autorizadoserasaexperian00.cloud 212.41.9.68 serasaautorizadoscn000.cloud 212.41.9.73 autorizadoserasaexperian00.cloud 212.41.9.75 autorizadoserasaexperian0000.cloud 212.41.9.76 autorizadoserasaexperian00.cloud 212.41.9.77 serasaautorizadoscn3.cloud 212.41.9.80 autorizadoserasaexperian00.cloud 212.41.9.93 serasaautorizadoscn3.cloud 212.41.9.104 serasaautorizadoscn3.cloud 212.41.9.107 serasaautorizadoscn3.cloud 212.41.9.110 autorizadoserasaexperian00.cloud 212.41.9.112 serasaautorizadoscn00000.cloud 212.41.9.116 serasaautorizadoscn3.cloud 212.41.9.117 serasaautorizadoscn00000.cloud 212.41.9.119 serasaautorizadoscn4.cloud 212.41.9.122 serasaautorizadoscn4.cloud… Читать далее Suspected Snowshoe Spam IP Range — SELECTEL-NET
bitcoin scammer landing sites.
This is the other IP belonging to the malicious DNS at: SBL540601 94.26.249.141 2022.02.21 Meet the new boss, same as the old boss. Name changed from s1.aver.host —> s1.stronghost.su 2022.01.14 despite claims, not fixed still phishin’ 94.26.249.141 is currently in use as a nameserver for spamvertized domains. This enables the resolving of spammed domains to… Читать далее bitcoin scammer landing sites.
Phishing server
134.122.70.216|citizens.ga|2022-02-24 00:51:35 134.122.70.216|citizensonline-support.ga|2022-02-22 22:17:28 134.122.70.216|citizensonline-support.ml|2022-02-22 23:02:06 134.122.70.216|citizensonline-support.tk|2022-02-24 01:11:42 134.122.70.216|secur07b-chase.ga|2022-02-23 22:32:25 134.122.70.216|securecitizens-online.ga|2022-02-24 03:45:55
Phishing server
137.184.113.238|identitywells.com|2022-02-23 01:56:16 137.184.113.238|secfidelity.com|2022-02-15 01:56:33 137.184.113.238|unblockwells.com|2022-02-23 22:41:48 137.184.113.238|wfbidentity.com|2022-02-21 08:17:08
Phishing server
citi-supportnow.com has address 137.184.185.22 Citibank Online 137.184.185.22|citi-supportdesk.com|2022-02-21 20:42:38 137.184.185.22|citi-supportnow.com|2022-02-23 23:52:01 137.184.185.22|citihelp.info|2022-02-23 18:08:07 137.184.185.22|citihelp.site|2022-02-22 20:16:58 137.184.185.22|citisecured.la|2022-02-22 04:57:03 137.184.185.22|citiwebsites.com|2022-02-21 23:11:44 137.184.185.22|citiwebsupp1.com|2022-02-24 01:36:55 137.184.185.22|secciti9.com|2022-02-24 01:07:19 137.184.185.22|uspsnow.org|2022-02-24 00:21:41
Phishing server
54.164.220.170|citizens-onlinesupport.ga|2022-02-23 22:41:32 54.164.220.170|citizensbankonline-support.ml|2022-02-23 14:24:21 54.164.220.170|support-citizensbank.ga|2022-02-23 22:41:58 54.164.220.170|supportonlinecitizens.ml|2022-02-23 22:56:45
Spam source @52.100.19.40
Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-cy1gcc01bn2040.outbound.protection.outlook.com [52.100.19.40]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN «mail.protection.outlook.com», Issuer «DigiCert Cloud Services CA-1» (not verified)) by X (Postfix) with ESMTPS id X for <X>; Wed, 23 Feb 2022 X […] Received: from AS8PR07MB7272.eurprd07.prod.outlook.com (2603:10a6:20b:25a::21) by AM0PR07MB5363.eurprd07.prod.outlook.com (2603:10a6:208:fb::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id X; Wed, 23 Feb… Читать далее Spam source @52.100.19.40
Loki botnet controller @172.67.129.38
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Loki botnet controller located at 172.67.129.38 on port 80 (using HTTP POST): hXXp://75bccc18b4d1631c2ecda542c872db27.ga/Ausin2/fre.php $ dig +short 75bccc18b4d1631c2ecda542c872db27.ga 172.67.129.38 Other malicious domain names hosted on this IP address:… Читать далее Loki botnet controller @172.67.129.38