Dynamoo's Blog

It's been about a zillion years (well, OK it was 2017) when I last published a list of IPs belonging to 3NT Solutions LLP that you proba...

  [For the February 2021 version of this list, click here ] When I was investigating IOCs for the recent outbreak of BadRabbit ransomware I...

Checking these IOCs for this latest Flash 0-day came up with an interesting IP address of 89.45.67.107 which belongs to Fast Serv Inc ak...

I wrote about this evil network on 64.20.51.16/29 (a customer of Interserver, Inc) over a year ago , identifying it as a hotbed of fraud....

This fake fax leads to TrickBot which appears to be similar to the Dyre banking trojan that we saw a lot of last year.. From :    Admi...

This customer of OVH appears to be registered with fake details, and are distributing malware via a block at 178.33.217.64/28 . Currently,...

These domains are part of a cluster, some of with are serving the EITEST RIG exploit kit (similar to that described here ). They all share...

Here's an Angler EK cluster, hosted on multiple ranges rented from OVH France.. working first from this list of Angler IPs in OVH addr...

Following on from this post and previous ones in that series, here is a new set of IP ranges where the Angler EK seems to be clustering. ...

PlusServer GmbH is a legitimate German hosting company. But unfortunately, the bad guys keep hosting Angler EK sites in their IP ranges o...

I realise it has been a while since my last list of bad networks you might want to block. Hopefully in the next couple of days I will hav...

A follow-up to this list posted a few days ago. These networks are primarily distributing Angler and in my opinion you should block their...

Some more evil networks you might want to block, following on from an update about a week ago . 5.9.253.160/27 69.175.66.72/29 85.204....

These networks are clusters of the Angler EK and other badness. I tend to Tweet about Angler IPs rather than blog about them. Following t...

liveadexchanger.com is an advertising network with a questionable reputation currently hosted on a Google IP of 146.148.46.20 . The WHOIS ...

199.195.196.176/29 is a small bunch of IPs hosting browser hijacker sites, belonging to Hosting Services, Inc. in Utah and suballocated ...

vds24.net (apparently belonging to "Dmitry Shestakov ") is a Russian reseller of OVH servers that has come up on my radar a few...

This group of domains and IPs are related to this Teslacrypt attack , sharing infrastructure with some of the malicious domains in questio...

This DHL-themed phish got me looking at an IP address range of 64.20.51.16/29 which is a range belonging to Interserver Inc in the US, ...