Showing posts with label 1&1. Show all posts
Showing posts with label 1&1. Show all posts
Tuesday 2 May 2017

Malware spam: DHL Shipment 458878382814 Delivered

›
Another day and another fake DHL message leading to an evil .js script. From : DHL Parcel UK [redacted] Sent : 02 May 2017 09:30 To : [...
Tuesday 24 May 2016

Phish: "TNT Consignment Notification" via rit.edu

›
This fake TNT notification is phishing for credentials: From :    TNT Express Reply-To :    sh3llsh0p@yahoo.com Date :    24 May 2016...
Wednesday 9 March 2016

Malware spam: "DOC-Z21193008" / Idris Mohammed [idrismohammed25@gmail.com]

›
This terse spam has a malicious attachment. There is no body text. From :    Idris Mohammed [idrismohammed25@gmail.com] Date :    9 Mar...
2 comments:
Thursday 3 March 2016

Malware spam: "Receipt - Order No 173535" / Sally Webb [swebb@thekmgroup.co.uk]

›
This spam does not come from KM Media Group but it is instead a simple forgery with a malicious attachment: From      Sally Webb [sweb...
Thursday 30 April 2015

Malware spam: "Rebecca McDonnell [rebecca@gascylindersuk.co.uk]" / "Telephone order form"

›
This fake financial email is not from Gas Cylinders UK but is instead a simple forgery with a malicious attachment. From :    Rebecca ...
1 comment:
Wednesday 1 April 2015

Malware spam: "Batchuser BATCHUSER [ecommsupport@cihgroup.com]" / "CIH Delivery Note 0051037484"

›
The CIH Group is the name behind the Euronics brand . They are not sending out this spam, instead it is a simple forgery with a malicious ...
Thursday 19 February 2015

Malware spam: "State Department" / "Order state T/N:" with a hidden message

›
These spam emails claim both to be from the "State Department" and somebody else at the same time, so I guess they must have bee...
1 comment:
Tuesday 17 February 2015

Malware spam: "AR.Support@efi.com" / "Customer statement 0001031389 as on 02/05/2015"

›
This fake financial document has a malicious attachment: From :    AR.Support@efi.com To :    minutemanpresschicago@comcast.net Date : ...
Monday 19 January 2015

Malware spam: "repairermessages@fmg.co.uk" / "Insurance Inspection Arranged AIG02377973" / "FMG Support Group Ltd"

›
This spam does not come from FMG Support Group Ltd , but instead it is a forgery. FMG are not sending out the spam, nor have their systems...
4 comments:
Thursday 15 January 2015

Malware Spam: "HEXIS (UK) LIMITED" / "Invoice from Hexis"

›
This fake invoice has a malicious attachment. It does not comes from Hexis UK Ltd , it is a forgery. Hexis is not sending the spam, nor ha...
6 comments:
Wednesday 24 December 2014

Malware spam: Rhianna Wellings / Rhianna@teckentrupdepot.co.uk / Signature Invoice 44281

›
Teckentrup Depot UK is a legitimate UK company, but these emails are not from Teckentrup Depot and they contain a malicious attachment. T...
3 comments:
Wednesday 17 December 2014

Malware spam: UK GEOLOGY PROJECT by "Rough & Tumble" with "Moussa Minerals" [roughandtumble63@yahoo.co.uk]

›
This somewhat odd and terse spam comes with a malicious attachment. From :    UK GEOLOGY PROJECT by "Rough & Tumble" with...
Wednesday 10 December 2014

Spam: "Remittance Advice from Anglia Engineering Solutions Ltd"

›
This spam email does not come from Anglia Engineering Solutions Ltd but instead comes from a criminally-operated botnet and has a malicio...
Monday 8 December 2014

"Soo Sutton" / "INVOICE 224245 from Power EC Ltd" spam

›
Another variant of this spam , this fake invoice comes with a malicious Word document attached. From:     soo.sutton966@powercentre.com ...
4 comments:
Thursday 30 January 2014

WTF is s15443877[.]onlinehome-server[.]info?

›
Something that caught my eye was this Google Safebrowsing diagnostic for [donotclick] s15443877.onlinehome-server.info : Safe Brows...
2 comments:
Tuesday 26 November 2013

Something evil on 46.19.139.236

›
46.19.139.236 (Private Layer Inc, Switzerland) seems to be serving up some sort of Java exploit kit via injection attacks which is utilis...
Tuesday 23 July 2013

Malware sites to block 23/7/13

›
These malicious domains and IPs are associated with this prolific gang .  As usual, I've listed IPs with hosts first and then a plain ...
1 comment:
Thursday 11 July 2013

Malware sites to block 11/7/13

›
I noticed 188.138.89.106 (Intergenia AG, Germany) was the originating IP being used in this spam run using a hijacked 1&1 account, a...

"WTX Media INC" spam / dajizzum.com

›
This fake invoice spam from the nonexistant "WTX Media" leads to a malware landing page on dajizzum.com : From: Rebecca Media...
Tuesday 16 April 2013

"Fiserv Secure Email Notification" spam

›
This spam has an encrypted ZIP file attached that contains malware. The passwords and filenames will vary. From: Fiserv Secure Notific...