Dynamoo's Blog

This fake Pinterest spam leads to malware on pinterest.com.reports0701.net : Date:      Mon, 1 Jul 2013 21:04:36 +0530 From:      &quo...

This fake FedEx spam leads to malware on oxfordxtg.net : Date:      Thu, 13 Jun 2013 01:18:09 +0800 [13:18:09 EDT] From:      FedEx [wr...

As a follow-up to this post , the exploit server on 173.255.213.171 (Linode, US) is hosting a number of hijacked GoDaddy-registered domai...

This fake Walmart spam leads to malware on bestunallowable.com: From:     Wallmart.com [deviledm978@news.wallmart.com] Date:     16 Ma...

184.95.51.123 (Secured Servers LLC, US / Jolly Works Hosting, Philippines) appears to be trying to serve the Blackhole Exploit kit throug...

This fake LinkedIn email leads to malware on guessworkcontentprotect.biz : From:     LinkedIn Invitations [giuseppeah5@mail.paypal.com]...

173.246.104.104 (Gandi, US) popped up on my radar after a malvertising attack apparently utilising a hacked OpenX server (I'm not 100...

I haven't seen this particular spam before. It leads to malware on tempandhost.com : Date:      Tue, 23 Apr 2013 05:41:32 +0900 [16...

151.248.123.170 (Reg.ru, Russia) appears to be active in an injection attack at the moment. In the example I saw, the hacked site has inj...

Something evil seems to be lurking on 62.212.130.115 (Xenosite, Netherlands) - a collection of sites connected with the Blackhole exploit...

Looks like a nasty infestion of Blackhole is lurking on 92.63.105.23 (TheFirst-RU, Russia) - see an example of the nastiness here (this l...

It looks like there's a nasty case of the Blackhole Exploit kit on 192.81.129.219 ( see example ). The IP is controlled by Linode in...

50.116.40.194 (Linode, US) is hosting the Blackhole Exploit Kit (e.g. [donotclick] 14.goodstudentloans.org/read/walls_levels.php - report...

What is avirasecureserver.com ? Well, it's not Avira that's for sure.. it is in fact a server for the Blackhole Exploit Kit . T...

This seems to be a bunch of evil domains on 87.229.26.138 (Deninet, Hungary) being used in injection attacks. Possible payloads include B...

presidence.pf is the web site of the President of French Polynesia, it is hosted on 202.3.245.13 by the Tahitian ISP MANA (along with an ...

A bunch of sites are active today with the Blackhole exploit kit.. here are the ones seen so far: 183.81.133.121 198.136.53.39 173.255.2...