A bit of a shift in spammer tactics here: From: Mohit Girsh [email protected] Date: 12 March 2012 11:54 Dubject: Electronic payments are suspended #08763672 Signed by: yahoo.com Id 57-8033394-13999809-0-895 < !–ZZ 81490908 C hxxp://goo.gl/C9bsq hxxp://goo.gl/C9bsq redirects to hxxp://2ecdn.barelybowler.ru/ which is multihomed: 31.176.195.196 (BH Telecom, Bosnia) 31.181.92.124 (Rostelecom , Russia) 37.99.67.48 (2DAY Telecom, Kazakhstan) 41.108.45.166 […]
DINETHOSTING aka Digital Network JSC are a large Russian host that regularly hosts malware sites. Yesterday I came across the domain curvecheese.com (85.192.45.83) being used in a malicious spam run. This is in a block 85.192.32.0/20 allocated to this host. I tend to block DINETHOSTING ranges as soon as I see malware on them. If you are […]
Latest Comments