Dynamoo's Blog

This fake BofA spam has a malicious payload: Date:      Mon, 4 Aug 2014 19:57:07 +0800 [07:57:07 EDT] From:      Andrea Talbot [Andrea...

This spam has a malicious attachment: Date:      Mon, 04 Aug 2014 20:29:43 +0900 [07:29:43 EDT] From:      Accounts Dept [tolvan.rover@...

This fake BT spam has a malicious attachment: Date:      Mon, 4 Aug 2014 08:48:51 -0430 [09:18:51 EDT] From:      Marci Tobin Subject...

Here's a strange spam I've been tracking for a couple of days: Date :      Sun, 03 Aug 2014 20:56:48 -0700 [08/03/14 23:56:48 E...

Just a quick note to say that if you see an email referring to the site ipma2014.org then this is a new domain for the so-called Institut...

This somewhat mangled spam has a malicious attachment: Date:      Fri, 1 Aug 2014 09:45:45 -0700 [12:45:45 EDT] From:      eFax Corpor...

I haven't seen any fake Intuit spam for a while. This one comes with a malicious attachment: Date:      Fri, 1 Aug 2014 07:59:12 -0...

The bad guys are enjoying the goo.gl URL shortening service at the moment (remember, you can report goo.gl spam to goo.gl/spam-report ). T...

This fake NatWest bank message uses the Goo.gl URL shortener to spread malware: From :     NatWest [secure.message@natwest.com] Date...

This is a thoroughly old school spam with a malicious attachment. Date:      Thu, 31 Jul 2014 18:16:08 +0000 [14:16:08 EDT] From:      ...

I've never understood Evernote. Something to do with elephants I think. But this spam isn't from them anyway.. Date:      Thu, 3...

Here are a couple of variations of a fax spam using the goo.gl shortening service: From :     Fax [fax@victimdomain] Date :     31 Ju...

Presumably terseness works with this kind of message: From:     Richard Mason [richardm254@gmail.com] Date:     30 July 2014 21:23 Sub...

Another fake Amazon spam with a malicious payload: Date:      Wed, 30 Jul 2014 18:08:43 +0800 [06:08:43 EDT] From:      "AMAZON.CO....

This body-text-less spam comes with a malicious attachment. Date :      Wed, 30 Jul 2014 17:06:27 +0530 [07:36:27 EDT] From :      Twil...

This fake QuickBooks Invoice spam comes with a malicious payload: From:     QuickBooks Invoice [auto-invoice@quickbooks.com] Date:     ...

[Note, an update to this can be found here ] I don't know quite what the exploit kit of the month is here, but the IP addresses 31.2...

This fake Amazon spam comes with a malicious attachment: Date:      Mon, 28 Jul 2014 13:15:57 +0200 [07:15:57 EDT] From:      "AMA...

88.198.252.168/29 (Hetzner, Germany) is infected with a whole bunch of ransomware landing pages, like this: In the past this IP range h...