Dynamoo's Blog

I recently noted that the spammers at Marketing1.net were at it again , but despite assurances from their host Coreix that they had been ...

This fake invoice email leads to a malicious Word document: From: Dave Porter [mailto:dave.porter@blueyonder.co.uk] Sent: 06 November 2...

This fake Newegg.com spam leads to malware: Date:      Fri, 17 May 2013 10:29:20 -0600 [12:29:20 EDT] From:      Newegg [info@newegg.c...

The email address says Filestube. The message says Facebook. This can't be good.. and in fact this message just leads to malware on ip...

This fake airline ticket spam leads to malware on illuminataf.ru : Date:      Wed, 27 Mar 2013 03:23:05 +0100 From:      "Xanga&...

This fake Wire Transfer spam leads to malware on hondatravel.ru : From: messages-noreply@bounce.linkedin.com [mailto:messages-noreply@b...

This fake eFax spam leads to malware on hjuiopsdbgp.ru : Date:      Tue, 26 Mar 2013 06:23:36 +0800 From:      LinkedIn [welcome@linke...

This fake printer spam leads to malware on humaniopa.ru : Date:      Mon, 25 Mar 2013 03:57:54 -0500 From:      LinkedIn Connections [c...

Evil changelog spam episode 274, leading to malware on hohohomaza.ru . Hohoho indeed. Date:      Fri, 22 Mar 2013 11:06:48 -0430 From: ...

This fake changelog spam leads to malware on hillairusbomges.ru : Date:      Thu, 21 Mar 2013 03:01:59 -0500 [04:01:59 EDT] From:      ...

These seem to be the currently active IPs and domains being used by the RU:8080 gang. Of these the domain gilaogbaos.ru seems to be very ...

Another wire transfer spam, this time leading to malware on giminanvok.ru : Date:      Mon, 11 Mar 2013 02:46:19 -0300 [01:46:19 EDT] ...

This fake wire transfer spam leads to malware on gimikalno.ru: Date:      Mon, 11 Mar 2013 04:00:22 +0000 [00:00:22 EDT] From:      Xa...

The spammers sending this stuff out always confuse UPS with USPS, this one is not exception although on balance it is more UPS than USPS.....

Another US Airways spam, malformed this time, pointing to malware on 209.59.218.94. Date :      Thu, 5 Apr 2012 14:10:48 +0000 From :    ...

This fake USPS message leads to malware on indigocellular.com : From :     Elmer Cross USPS_Shipping_Info@usps.com Date :     23 March...

Another load of LinkedIn Spam is doing the rounds, this time the payload is at cyancellular.com/showthread.php?t=73a07bcb51f4be71 hosted ...

A fake LinkedIn spam leading to malware hosted at closteage.com : Date :      Wed, 21 Mar 2012 16:24:04 +0200 From :      "Stacy ...

It's Monday.. so it's malware. This new spam run is supposed to be from Intuit.com, but it actually leads to malware hosted on cog...

The Spam Analysis blog has an excellent post analysing what is happening behind the scenes in the malware from some recent spam runs. I&#...