Dynamoo's Blog

Here's an Angler EK cluster, hosted on multiple ranges rented from OVH France.. working first from this list of Angler IPs in OVH addr...

Following on from this post and previous ones in that series, here is a new set of IP ranges where the Angler EK seems to be clustering. ...

PlusServer GmbH is a legitimate German hosting company. But unfortunately, the bad guys keep hosting Angler EK sites in their IP ranges o...

I realise it has been a while since my last list of bad networks you might want to block. Hopefully in the next couple of days I will hav...

A follow-up to this list posted a few days ago. These networks are primarily distributing Angler and in my opinion you should block their...

Some more evil networks you might want to block, following on from an update about a week ago . 5.9.253.160/27 69.175.66.72/29 85.204....

These networks are clusters of the Angler EK and other badness. I tend to Tweet about Angler IPs rather than blog about them. Following t...

193.109.69.59 (Mir Telematiki Ltd, Russia) is hosting what appears to be the Angler Exploit Kit. The infection chain that I have seen i...

This Tweet from @Kafeine about the Angler EK drew my attention to a small block of OVH UK addresses of 5.196.33.8/29 which appear to be...

Another bunch of IPs on Crissic Solutions LLC, leading to what appears to be the Angler EK (see this URLquery report ): 167.160.164.102 ...

These domains are currently hosted or have recently been hosted on 5.135.230.176/28 and all appear to be malicious in some way, in partic...

This convincing-looking but fake spam leads to an exploit kit. From:     Christie Foley [christie.foley@badinsky.sk] Reply-to:     Chr...

The forum of popular German IT news site pcwelt.de has been hacked and is sending visitors to the Angler exploit kit. Visitors to the f...

[ NOTE: the IPs listed here appear to have been cleaned up] This set of IPs is being used to push the Angler EK [1] [2] : Intergen...