Dynamoo's Blog

This is an email with a link leading to malware. We've seen this pitch before : Subject : Re: I'm in trouble! I was at a party y...

A set of malicious sites, linked to the Redret gang, hosted on 95.211.115.228 (Leaseweb, Netherlands). Blocking the IP rather than the ind...

The malicious domains doofyonmycolg.ru and coolwebzuzuzu.ru have now shifted IPs since yesterday. The new address is 203.170.193.102 (IDC...

The Redret domains have shifted around a little since last week , indicating perhaps more malicious activity to come. Of note, cvredret...

Another Redret spam leading to a malicious payload.. Date :      Fri, 12 Jan 2012 04:53:25 +0100 From :      "Keila Farley" [...

A weird spam, leading to a malicious download at clredret.ru/main.php via a random hacked site. Date :      Tue, 9 Jan 2012 08:39:05 +0300...

After a quite couple of weeks, the Redret spam has started again using the domains and IPs listed below. Some are familiar, some are new. In...

Despite a whole pile of Redret malware spam at the end of the year, the past couple of weeks have been very quiet. However, a new campaign ...

Another spam, another " redret " domain. This time the spam is a "changelog" one, the malicious payload is on cjredret.r...

More spam pointing to a malicious web page at chredret.ru/main.php (after redirecting through a legitimate but hacked site), but this time ...

Another fake "contract" spam leading to malware, hosted on chredret.ru . Date:      Tue, 27 Dec 2011 06:06:18 +0700 From:      ...

The spam tsunami continues, this one is a reworking of one seen last month , but with a new payload site. Date :      Wed, 21 Dec 2011 06:...

These are another part of the "redret" series of malware sites being promoted by spam, and are worth blocking proactively. 1 09....

Another set of "Redret" domains, the b*redret.ru series is used in malware distribution. It has some new IP addresses since the la...

These "Redret" domains serve up malware and are promoted by spam, some of them have moved around since last week so consider this...

This is a fairly common malware spam, pointing to malicious code on cfredret.ru/main.php . Date :      Tue, 20 Dec 2011 05:42:20 +0300 Fr...

Another spam run leading to a malicious payload on csredret.ru ( as here ) Date :      Tue, 13 Dec 2011 10:19:58 +0200 From :      "...

A Windows Vista licence? No.. it's malware from csredret.ru . From : sales1@victimdomain.com [mailto:sales1@victimdomain.com] Sent : ...

Here's a terse spam, leading to a malicious payload on cpredret.ru/main.php From : AlfredoMejiaGXInOZ@aol.com Date : 13 December 201...

Another bunch of "redret" sites to block, either by domain name or IP. These domains are being used as the payloads for spam email...