Spammer hosting located here: info@swissquote-support.com ;; QUESTION SECTION: ;swissquote-support.com. IN MX ;; ANSWER SECTION: swissquote-support.com. 1800 IN MX 10 mx1.privateemail.com. swissquote-support.com. 1800 IN MX 10 mx2.privateemail.com. $ dig +short mx1.privateemail.com 198.54.122.213
Hosting phishing domains
185.251.90.19 ajaxtracker.com 2022-02-15 02:56:20 185.251.90.19 cdn-cgi.net 2022-02-15 02:51:38 185.251.90.19 coupon-popup.net 2022-02-15 04:35:09 185.251.90.19 jquerylibs.net 2022-02-15 02:49:35 185.251.90.19 jqueryllc.net 2022-02-15 04:32:38 185.251.90.19 kanctovaria.ru 2021-12-07 02:30:56 185.251.90.19 magento-plugin.com 2022-02-15 02:49:38 185.251.90.19 purechal.com 2022-02-15 03:11:33 185.251.90.19 trustdomains.net 2022-02-15 02:37:46 ______________________ Was: 5.188.6.199 ajaxtracker.com 2022-02-14 04:31:42 5.188.6.199 artigo14.corretoratromper.com 2021-08-09 13:38:55 5.188.6.199 atendimento4.curvelloeandrade.com 2021-03-22 13:23:56 5.188.6.199 auditoriarh3.generalprodutic.com 2021-09-16 14:35:17 5.188.6.199… Читать далее Hosting phishing domains
Credit card fraud gang hosting (DNS): idinaxui-netspama.ru (vmad.su / amazingdumpsshop.ru / cvv-fullz-shop.ru etc.)
Stolen credit card data websites (DNS servers): ns1.idinaxui-netspama.ru. 7168 IN A 38.83.79.215 ns2.idinaxui-netspama.ru. 7159 IN A 149.56.47.2 ___________________ Was: ns1.idinaxui-netspama.ru. 7168 IN A 38.83.79.215 ns2.idinaxui-netspama.ru. 7159 IN A 185.195.26.143 ___________________ Was: ns1.idinaxui-netspama.ru. 7168 IN A 38.83.79.215 ns2.idinaxui-netspama.ru. 7159 IN A 198.244.220.112 ___________________ Was: ns1.idinaxui-netspama.ru. 7168 IN A 135.125.234.148 ns2.idinaxui-netspama.ru. 7159 IN A 139.99.247.43 ___________________ Was:… Читать далее Credit card fraud gang hosting (DNS): idinaxui-netspama.ru (vmad.su / amazingdumpsshop.ru / cvv-fullz-shop.ru etc.)
Spamvertised website
2022-02-15 s100viewpoints.com. 60 IN A 165.22.232.123 2022-02-10 s100viewpoints.com. 60 IN A 159.223.52.198 Received: from DB6PR0301CA0048.eurprd03.prod.outlook.com (2603:10a6:4:54::16) Date: Thu, 03 Feb 2022 02:5x:xx +0000 From: Top Alternative Investment <[]@[].s100viewpoints.com> Subject: 𝗧𝗵𝗲 𝗴𝗿𝗲𝗮𝘁𝗲𝘀𝘁 𝗺𝗼𝗻𝗲𝘆 𝗿𝗲𝘃𝗼𝗹𝘂𝘁𝗶𝗼𝗻 𝗼𝗳 𝗮𝗹𝗹 𝘁𝗶𝗺𝗲 http://s100viewpoints.com/[] 159.223.48.46 https://volarealora.com/[] 193.124.15.64 https://www.nmxkj4trk.com/[]/?sub1=351076&sub2=[] 34.120.5.10
Malware botnet controller @45.151.144.119
The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller at 45.151.144.119 on port 443. $ telnet 45.151.144.119 443 Trying 45.151.144.119… Connected to 45.151.144.119. Escape character is ‘^]’ Malicious domains observed at this IP… Читать далее Malware botnet controller @45.151.144.119
Malware distribution & botnet controller @176.119.147.44
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 176.119.147.44 on port 443: $ telnet 176.119.147.44 443 Trying 176.119.147.44… Connected to 176.119.147.44. Escape character is… Читать далее Malware distribution & botnet controller @176.119.147.44
advance fee fraud spam source at pdf-books.org
IP emitting advance fee fraud (‘419’) spam, probably thanks to a compromised password. mail.pdf-books.org. 300 IN A 206.81.8.224 ================================================================== Return-Path: <info@bapco.com> Received: from server.pdf-books.org (unknown [206.81.8.224]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by x (Postfix) with ESMTPS id x for <x>; Mon, 14 Feb 2022 xx:xx:xx +0100 (CET) Received: from… Читать далее advance fee fraud spam source at pdf-books.org
spam emitter @102.132.156.100
Received: from producthomeseller.com (176.119.147.190) From: KETOSIS FORCES YOUR BODY TO BURN FAT FOR ENERGY INSTEAD OF CARBS. <who@e.aremedia.com.au> Subject: REVOLUTIONARY BREAK-THROUGH! WHY DOES IT HAVE SCIENTISTS, DOCTORS, AND CELEBRITIES BUZZING? Date: Fri, 11 Feb 2022 22:5x:xx +0000 URL: https://bit.ly/3IN9KaS Server IP address is 67.199.248.11 Location: https://track.mountrient.com/ofc/[]?Subid=1454806238&sub_pubid={YOUR_SUB_PUBID_HERE}&externalid={YOUR_CLICKID_HERE} Server IP address is 31.170.100.125 Location: https://trplus24.com/c/aff?lid=2394990&subid1=[]&subid2=1454806238&subid3=&subid4=&subid5=&creative_id=&creative_name=&source_id=&google_aid=&ios_ifa= Server IP… Читать далее spam emitter @102.132.156.100
Spamvertised website
Received: from producthomeseller.com (176.119.147.190) From: KETOSIS FORCES YOUR BODY TO BURN FAT FOR ENERGY INSTEAD OF CARBS. <who@e.aremedia.com.au> Subject: REVOLUTIONARY BREAK-THROUGH! WHY DOES IT HAVE SCIENTISTS, DOCTORS, AND CELEBRITIES BUZZING? Date: Fri, 11 Feb 2022 22:5x:xx +0000 URL: https://bit.ly/3IN9KaS Server IP address is 67.199.248.11 Location: https://track.mountrient.com/ofc/[]?Subid=1454806238&sub_pubid={YOUR_SUB_PUBID_HERE}&externalid={YOUR_CLICKID_HERE} Server IP address is 31.170.100.125 Location: https://trplus24.com/c/aff?lid=2394990&subid1=[]&subid2=1454806238&subid3=&subid4=&subid5=&creative_id=&creative_name=&source_id=&google_aid=&ios_ifa= Server IP… Читать далее Spamvertised website
Credit card fraud gang hosting: vmad.su (fe-shop.su / amazingdumpsshop.ru / cvv-fullz-shop.ru etc.)
Stolen credit card data websites: vmad.su. 14399 IN A 84.201.139.208 84.201.139.208 cvvsites.ru 2021-07-27 21:25:48 84.201.139.208 vmad.su 2021-07-27 10:56:20 84.201.139.208 rescator.su 2021-07-27 09:40:57 84.201.139.208 fraudsmarket.ru 2021-07-27 08:30:59 84.201.139.208 cvv-store-ru.ru 2021-07-27 08:21:49 84.201.139.208 dumpswithpinforum.ru 2021-07-27 07:36:58 84.201.139.208 cvvlogs.ru 2021-07-27 07:21:10 84.201.139.208 cvvbuy.ru 2021-07-27 06:51:11 84.201.139.208 carder00.ru 2021-07-27 05:30:51 84.201.139.208 creditcarddumpsreddit.ru 2021-07-27 04:10:45 84.201.139.208 tirespluscc.ru 2021-07-27 03:21:13 84.201.139.208… Читать далее Credit card fraud gang hosting: vmad.su (fe-shop.su / amazingdumpsshop.ru / cvv-fullz-shop.ru etc.)