More NACHA spam this morning, this time the payload is at financeportal.sytes.net/main.php?page=111d937ec38dd17e on 220.127.116.11. Blocking the IP address rather than the domain is probably best as there may be other malicious sites on that server.
18.104.22.168 is on Directspace LLC in Oregon who seem to have a significant problem with malware at the moment, I have seen malicious sites on:
You might want to consider blocking Directspace LLC more widely if you are worried.
Leave a reply