Dynamoo's Blog

Apropos of nothing, all these websites are hosted on 212.230.207.100 to 213.230.207.109 (Netcalibre, UK) and appear to be owned and controll...

I've seen various extortion spams over the past 12 months or so, but this one has a particularly vicious twist. If you haven't s...

Nigerian registrants. Dodgy Eastern European  host offering bulletproof and anonymous hosting. Yup, I very much doubt there is anything le...

This fake Barclays spam seems to lead to the Trickbot banking trojan. From :    Barclays [service@barclaysdownloads.co.uk] Date :    10...

This spam (apparently from the Necurs botnet) promises much, but seems not to deliver. From:    Susanne@victimdomain.tld [Susanne@victi...

The Traffic Light Protocol should be familiar to anyone working with sensitive data, with levels RED, AMBER, GREEN and WHITE being used to ...

I see a lot of "fake boss" fraud emails in my day job, but it's rare that I see them sent to my personal email address. Thes...

Swisscoin is a fairly low-volume self-styled cryptocurrency that has been the target of a Necurs-based spam run starting on Saturday 13th ...

If you live in the UK then you might have noticed the somewhat bizarre furore over Damian Green MP and his alleged viewing of pornography ...

  [For the February 2021 version of this list, click here ] When I was investigating IOCs for the recent outbreak of BadRabbit ransomware I...

A change to the usual Necurs rubbish, this fake order has a malformed .z archive file which contains a malicious executable with an icon t...

Checking these IOCs for this latest Flash 0-day came up with an interesting IP address of 89.45.67.107 which belongs to Fast Serv Inc ak...

This spam email is a scam: Subject :       Help Your Child To Be A Professional Footballer. From :       "FC Academy" [csa@sa...