Dynamoo's Blog

This following spam email is attempting to recruit money mules : From:     arwildcbrender@victimdomain.com to:     arwildcbrender@victi...

These fake eFax spams are getting a bit dull. As you might expect, this one comes with a malicious attachment. Date:      Tue, 3 Dec 20...

It's taken me a few days to get around to this due to moving house, but here's a new pump-and-dump spam run promoting a stock Regi...

Is it Salesforce or ADP? Of course.. it is neither. Date:      Wed, 27 Nov 2013 11:50:07 +0100 [05:50:07 EST] From:      "support@...

46.19.139.236 (Private Layer Inc, Switzerland) seems to be serving up some sort of Java exploit kit via injection attacks which is utilis...

This fake Facebook message comes with a malicious attachment: Date:      Tue, 26 Nov 2013 04:58:18 +0300 [11/25/13 20:58:18 EST] From:...

This is a particularly insidious scam that relies on mobile phone users in the UK not knowing that an 0844 number is much, much more expen...

This fake fax message email has a malicious attachment: Date:      Fri, 15 Nov 2013 12:05:36 -0500 [12:05:36 EST] From:      RingCentr...

Thanks to a tip to investigate 199.68.199.178 I discovered that the Caphaw network I looked at yesterday is much bigger than I thought. T...

These domains and IPs appear to be involved in a Caphaw malware attack, such as this one . All the IPs involved belong to Hetzner in Germa...

Two more EXE-in-ZIP spams.. the first is a terse one with a subject " Voice Message from Unknown Caller " or " Voicemail Me...

This fake PayPal (or is it Quickbooks?) spam has a malicious attachment: Date:      Wed, 13 Nov 2013 02:27:39 -0800 [05:27:39 EST] Fro...

This laughable primitive fake job offer is recruiting for money mules , package reshipping or some other scam. From:     RSA-CAREER! [...

This fake tax spam comes with a malicious attachment: Date:      Wed, 13 Nov 2013 00:44:46 +0800 [11:44:46 EST] From:      "suppor...

This spam email has a malicious attachment: Date:      Tue, 12 Nov 2013 16:22:38 +0100 [10:22:38 EST] From:      Undisclosed Recipient...

This fake HMRC spam comes with a malicious attachment. Because the spammers have copied-and-pasted the footer from somewhere random it als...

These domains are used for dynamic DNS and are operated by a company called Dyn who offer a legitimate service, but unfortunately it is a...

A couple of network blocks came to my attention after investigating some adware ntlanmbn.exe ( VirusTotal report ) and GFilterSvc.exe ( ...