Dynamoo's Blog

A follow-up to this post , I took a look at the netblocks 5.133.179.0/24 and 212.38.166.0/24 suballocated to: person:         Oleg Nik...

I don't have the body text for this particular message, but I can tell you this is not from Brian Holt (a property agent in Coventry,...

This fake financial spam does not come from Safilo UK Ltd but is instead a simple forgery with a malicious attachment: From     servic...

These sites lead to some sort of malware. The presence of .SU domains hosted on what looks like a botnet is probably all you need to know....

This fake invoice email has a malicious attachment: From:     Mauro Reddin Date:     15 September 2014 10:32 Subject:     Overdue invo...

Thanks to a tip to investigate 199.68.199.178 I discovered that the Caphaw network I looked at yesterday is much bigger than I thought. T...

This list replaces this one , and mostly contains domains and IPs connected with this gang . The list starts with IPs and web hosts, follo...

This fake TigerDirect.com spam leads to malware on palmer-ford.net : Date:      Thu, 8 Aug 2013 21:54:14 +0400 [13:54:14 EDT] From:    ...

Following on from last week's list , this week seems to see a smaller number of servers and malicious domains from this crew . 5.175...

These sites and IPs are associated with this gang , and are either currently in use or they have been in use recently. The list has indivi...

These domains and IPs are associated with this gang . This time there appear to be some diet pill sites in the mix, these may be spammy or...

I noticed 188.138.89.106 (Intergenia AG, Germany) was the originating IP being used in this spam run using a hijacked 1&1 account, a...

These domains and IPs seem to be active as Zbot C&C servers. The obsolete .su (Soviet Union) domain is usually a tell-tale sign of.. ...

These domains and IPs are currently acting as C&C and distribution servers for Zbot. I would advise blocking these IPs and domains if ...

This fake Citibank spam leads to malware on platinumbristol.net : From:     citibankonline@serviceemail1.citibank.com via pado.com.br ...

This fake AICPA spam leads to malware on eaglepointecondo.co: Date:      Mon, 10 Dec 2012 19:29:21 +0400 From:      "AICPA"...

These spam messages lead to malware on ibertomoralles.com : Date:      Thu, 6 Dec 2012 13:12:16 -0600 From:      "PayPal" [...

These domains and IPs relate to an emerging threat, I don't have a full analysis at the moment but they appear to be malicious. If y...

This somewhat mangled looking fake FedEx spam leads to malware on studiomonahan.net : Date:      Thu, 6 Sep 2012 11:00:28 -0600 From:...

These malicious sites and IPs are connected with this spam run . I recommend blocking them. 31.17.189.212 41.66.137.155 41.168.5.140 ...