Showing posts with label GoDaddy. Show all posts
Showing posts with label GoDaddy. Show all posts
Thursday, 13 April 2017

Malware spam: "Company Documents" / WebFilling@companieshousemail.co.uk and companieshouseemail.co.uk plus others

›
This spam email does not come from Companies House, but is instead a simple forgery with a malicious attachment: From:    Companies House...
Wednesday, 15 February 2017

Highly personalised malspam making extensive use of hijacked domains

›
This spam email contained not only the intended victim's name, but also their home address and an apparently valid mobile telephone nu...
16 comments:
Thursday, 29 October 2015

Malware spam: "Domain [domain] Suspension Notice" / abuse@enom.com.org

›
There appear to be many versions of this spam, aimed at domain owners and apparently coming from the actual registrar of the domain. For a...
6 comments:
Monday, 24 August 2015

Popular German wesite dwdl.de hacked, serving malware via 94.142.140.222

›
Popular German media website dwdl.de has been hacked and is serving up malware, according to this URLquery report . URLquery's IDS f...
3 comments:
Thursday, 2 April 2015

Malware spam: "Copy invoices Snap on Tools Ltd" / "Allen, Claire [Claire.Allen@snapon.com]"

›
This fake invoice does not come from Snap On Tools, but is instead a simple forgery. From :    Allen, Claire [Claire.Allen@snapon.com] ...
Wednesday, 1 April 2015

Malware spam: "Batchuser BATCHUSER [ecommsupport@cihgroup.com]" / "CIH Delivery Note 0051037484"

›
The CIH Group is the name behind the Euronics brand . They are not sending out this spam, instead it is a simple forgery with a malicious ...
Tuesday, 17 February 2015

An analysis of reported Equation Group IP ranges and domains

›
There has been a lot of buzz this morning about "The Equation Group", a possible state actor involved in placing malware on hard...
1 comment:
Thursday, 8 January 2015

Persistent hijacked GoDaddy domains serve malware via Turkish IPs

›
Last year I wrote about a small bunch of IPs belonging to Radore Veri Merkezi Hizmetleri A.S in Turkey that seemed to be aggressively pu...
Friday, 21 November 2014

Something evil on 46.8.14.154

›
46.8.14.154 (Netart Group S.r.o. / Movenix International Inc) forms part of an exploit chain that starts with compromised OpenX servers a...
Wednesday, 1 October 2014

Something evil on 87.118.127.230

›
Quite what exploit kit this is I cannot determine, but there's something evil on 87.118.127.230 (Keyweb, Germany) which is using hija...
3 comments:
Thursday, 11 September 2014

eFax spam leads to Cryptowall

›
Yet another fake eFax spam. I mean really I cannot remember the last time someone sent me a fax. What's next? "Someone has sent ...
Monday, 8 September 2014

RBS "Important Docs" spam doing the rounds again

›
The Royal Bank of Scotland has been spoofed several times recently, this latest fake spam contains a payload that looks like it might be C...
Tuesday, 29 July 2014

Something evil on 31.210.96.155, 31.210.96.156, 31.210.96.157 and 31.210.96.158 (31.210.96.152/29)

›
[Note, an update to this can be found here ] I don't know quite what the exploit kit of the month is here, but the IP addresses 31.2...