Dynamoo's Blog

Recently I have been suggesting reader block quite a few individual IPs at Gandi in the US, but I hadn't noticed exactly how many IPs...

This fake PayPal spam leads to malware on londonleatheronline.com : Date:      Tue, 3 Sep 2013 09:43:09 +0400 [01:43:09 EDT] From:    ...

This fake Facebook spam leads to malware on london-leather.com : Date :      Mon, 2 Sep 2013 19:59:52 +0300 [12:59:52 EDT] From :      Fa...

A facsimile transmission. How quaint. Of course, it isn't.. the link in the spam goes to a malicious page on chellebelledesigns.com : ...

This fake fax spam leads to malware on eliehabib.com : Date:      Wed, 7 Aug 2013 13:05:22 -0600 [15:05:22 EDT] From:      Fax Message...

This fake CNN spam leads to malware on deltadazeresort.net : Date:      Tue, 30 Jul 2013 17:52:54 +0330 [10:22:54 EDT] From:      CNN ...

This fake CNN alert leads to malware on fragrancewalla.com : Date:      Wed, 24 Jul 2013 12:13:04 +0530 [02:43:04 EDT] From:      ...

173.246.104.154 (Gandi, US) is hosting hacked GoDaddy domains serving a variety of malware [1] [2] . At the moment the following domains...

173.246.104.104 (Gandi, US) popped up on my radar after a malvertising attack apparently utilising a hacked OpenX server (I'm not 100...

Some Cridex-based nastiness here . These are the malicious domains that I can find on the IPs mentioned, alternatively you can just block:...

This fake ADP spam leads to malware on 14.sofacomplete.com : From:     Erna_Thurman@ADP.com Date:     24 January 2013 17:48 Subject:   ...

173.246.102.246 (Gandi, US) looks like it is being used for exploit kits being promoted either through malvertising or through exploited ...

This fake Citi Cards spam leads to malware on 6.bbnface.com and 6.mamaswishes.com : Date:      Thu, 13 Dec 2012 11:59:33 +0300 From:...

This bunch of IPs and domains are being used in a series of fairly well-targeted attacks involving malicious spam messages that look like ...

This is part of a newish cluster of malware sites being promoted through finance related spam, spotted by GFI Labs here and on this blog ...