Spam source. mail.forcemindbiz.com. 3600 IN A 141.95.17.184 ================================================================================== Return-Path: <emilio.caruso@forcemindbiz.com> Received: from mail.forcemindbiz.com (mail.forcemindbiz.com [141.95.17.184]) by x (Postfix) with ESMTPS id x for <x>; Tue, 22 Feb 2022 xx:xx:xx +0100 (CET) Received: by mail.forcemindbiz.com (Postfix, from userid 1002) id x; Tue, 22 Feb 2022 xx:xx:xx +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=forcemindbiz.com; s=mail; t=x; bh=x=;… Читать далее spam source — forcemindbiz.com
Hosting phishing domains
185.251.89.161 ajaxtracker.com 2022-02-22 00:17:23 185.251.89.161 cdn-cgi.net 2022-02-22 01:04:40 185.251.89.161 coupon-popup.net 2022-02-22 05:00:26 185.251.89.161 jquery-ui.net 2022-02-22 03:57:04 185.251.89.161 jquerylibs.net 2022-02-22 03:44:52 185.251.89.161 jqueryllc.net 2022-02-22 03:21:18 185.251.89.161 magento-plugin.com 2022-02-22 03:45:21 185.251.89.161 purechal.com 2022-02-22 04:35:13 185.251.89.161 trustdomains.net 2022-02-22 03:07:41 ______________________ Was: ajaxtracker.com. 600 IN A 91.224.22.21 cdn-cgi.net. 600 IN A 91.224.22.21 ______________________ Was: ajaxtracker.com. 600 IN A 45.143.139.113… Читать далее Hosting phishing domains
Loki botnet controller @172.67.148.53
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Loki botnet controller located at 172.67.148.53 on port 80 (using HTTP POST): hXXp://afripot.buzz/oluwa/five/fre.php $ dig +short afripot.buzz 172.67.148.53
AZORult botnet controller @104.21.33.51
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. AZORult botnet controller located at 104.21.33.51 on port 80 (using HTTP POST): hXXp://nnpcoil.buzz/kendrick/index.php $ dig +short nnpcoil.buzz 104.21.33.51 Referencing malware binaries (MD5 hash): aa3c88aa7193bc0bb4ecf9638e65d4be — AV detection:… Читать далее AZORult botnet controller @104.21.33.51
phishing server
185.252.234.147|1lta-com.wtf|2022-02-18 15:53:26 185.252.234.147|3f3.info|2022-02-08 14:19:07 185.252.234.147|5port.us|2022-02-18 05:46:10 185.252.234.147|9qud.ws|2022-02-10 21:37:01 185.252.234.147|a-pplemapalatamerica.cc|2022-02-18 15:11:47 185.252.234.147|account-xiaom1.in|2022-02-18 04:41:24 185.252.234.147|af-jre.top|2022-02-22 00:07:20 185.252.234.147|ai-ppl.co|2022-02-15 07:46:35 185.252.234.147|ai-ppl.xyz|2022-02-13 12:46:25 185.252.234.147|app-le-id-i.cloud|2022-02-19 08:11:07 185.252.234.147|app-serch-gt.cc|2022-02-18 11:37:10 185.252.234.147|app1jk.com|2022-02-12 23:36:15 185.252.234.147|appe-find.info|2022-02-08 11:08:08 185.252.234.147|appl-us.cc|2022-02-16 21:21:26 185.252.234.147|apple-icloud.ws|2022-02-13 15:01:16 185.252.234.147|apple-id.ws|2022-02-19 08:11:14 185.252.234.147|apple-jr.com|2022-02-18 05:46:25 185.252.234.147|apple-ld.in|2022-02-14 20:07:50 185.252.234.147|apple-login.ws|2022-02-09 21:01:41 185.252.234.147|apple-pr1.cc|2022-02-14 15:04:01 185.252.234.147|apple-sopp-icloud.cc|2022-02-21 22:16:10 185.252.234.147|apple.com.ec|2022-02-22 02:40:43 185.252.234.147|apple.com.ht|2022-02-10 15:01:08 185.252.234.147|apple.com.nf|2022-02-21 20:44:26 185.252.234.147|apple.net.pe|2022-02-04 16:03:03 185.252.234.147|appleid-mx.com|2022-02-13 01:41:25 185.252.234.147|appleid.com.kz|2022-02-11 15:37:23 185.252.234.147|applela.co|2022-02-19… Читать далее phishing server
Malware botnet controllers @141.8.194.43
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 141.8.194.43 on port 443: $ telnet 141.8.194.43 443 Trying 141.8.194.43… Connected to 141.8.194.43. Escape character is… Читать далее Malware botnet controllers @141.8.194.43
Spamvertised website
Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) From: «isaac wil» <isaac1378wil@gmail.com> Date: Mon, 21 Feb 2022 10:38:33 -0800 Subject: Re: https://www.linkedin.com/slink?code=dm7UG2Hj&code2=76hunq1oazgtwfxliink7q98layil4qdhg3k0gh6se0kl1hcb2xs3imq4d5pwxligobmq38h47hmt 13.107.42.14 https://storage.googleapis.com/kqi9sax/65068511?dwwf7ekzui/1cdd8if95x6_hhvfguvv+fpze7bnta=zn61nqtmwzn/e2hlexrfn/bair64rgoj7jd4dc5cy5i318urxb34brrirmbhmzcyd7ym4x9r9bnvsmz4vwyrdveevib6s9qm3fkcjj 142.251.40.144 https://uunderbridge.com/0/0/0/88bef8b8f794619e01e7876d8e216a1f/c10 195.225.173.112 https://volantmetals.com/?s1=350266&s2=681949081&s3=2149&s4=1681&ow=&s10=889 104.21.6.202 https://backupmemo.com/d28690bf8a34a2ffa8740f94854be4e5 104.21.70.253 https://droptopz.com/click?s2=[]&s1=350266&s3=2149&trvid=10565&s4=1681&ow=8 52.205.18.96 https://www.pwcf0un6.com/7BZ2W/6JHXF/?sub2=[]&sub1=00050 130.211.37.125 https://essentialconsumerdeals.com/?affid=00050&provider=cf&click_id=[]&c1=&c2=[]&c3= 76.76.21.21
Spamvertised website
Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) From: «isaac wil» <isaac1378wil@gmail.com> Date: Mon, 21 Feb 2022 10:38:33 -0800 Subject: Re: https://www.linkedin.com/slink?code=dm7UG2Hj&code2=76hunq1oazgtwfxliink7q98layil4qdhg3k0gh6se0kl1hcb2xs3imq4d5pwxligobmq38h47hmt 13.107.42.14 https://storage.googleapis.com/kqi9sax/65068511?dwwf7ekzui/1cdd8if95x6_hhvfguvv+fpze7bnta=zn61nqtmwzn/e2hlexrfn/bair64rgoj7jd4dc5cy5i318urxb34brrirmbhmzcyd7ym4x9r9bnvsmz4vwyrdveevib6s9qm3fkcjj 142.251.40.144 https://uunderbridge.com/0/0/0/88bef8b8f794619e01e7876d8e216a1f/c10 195.225.173.112 https://volantmetals.com/?s1=350266&s2=681949081&s3=2149&s4=1681&ow=&s10=889 104.21.6.202 https://backupmemo.com/d28690bf8a34a2ffa8740f94854be4e5 104.21.70.253 https://droptopz.com/click?s2=[]&s1=350266&s3=2149&trvid=10565&s4=1681&ow=8 52.205.18.96 https://www.pwcf0un6.com/7BZ2W/6JHXF/?sub2=[]&sub1=00050 130.211.37.125 https://essentialconsumerdeals.com/?affid=00050&provider=cf&click_id=[]&c1=&c2=[]&c3= 76.76.21.21
phishing / fraud server
bank phish securecitizensbank.net 2022-02-21 18:57:45 Fake finance/loan company bespokefundingltd.com 2022-02-15 08:14:07 fake logistics ecarrierlogistics.com 2022-01-17 14:34:34 fake lawfirm almondlfirm.com 2022-01-10 14:23:45 fake realstate company agronfms.com 2021-12-14 16:52:35 fake logistics cross-border-logistics.com 2021-11-13 21:57:43 fake bank limitedstandardbk.com 2021-11-13 07:36:16 fake logistics crossborder-logistics.com 2021-11-12 06:03:18 Fake bank concordtrstbnk.com 2021-10-25 19:41:52 securecitizensbank.net has address 161.97.154.73 bespokefundingltd.com has address 161.97.154.73… Читать далее phishing / fraud server
RaccoonStealer botnet controller @178.79.174.111
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. RaccoonStealer botnet controller located at 178.79.174.111 on port 80 (using HTTP POST): hXXp://178.79.174.111/ $ nslookup 178.79.174.111 178-79-174-111.ip.linodeusercontent.com Referencing malware binaries (MD5 hash): 362592241e15293c68d0f24468723bbb — AV detection: 40… Читать далее RaccoonStealer botnet controller @178.79.174.111