On 26 Oct 2021 at 09:33:50 -0700 (PDT) an insidious spammer abusing the email source IP address 80.8 ...
show moreOn 26 Oct 2021 at 09:33:50 -0700 (PDT) an insidious spammer abusing the email source IP address 80.85.142.155 sent a malicious unsolicited phishing email disguised as "Christmas Letters from Santa" in an attempt to fraudulently obtain sensitive information. The email contains links to a site at 86.59.98.210 (www.luerzersarchive.com), 104.94.213.120 (main.cdn.wish.com) and 151.101.24.193 (i.imgur.com) in order to avoid discovery by email servers' spam, phishing, and malware detectors. As part of this scam the content at luerzersarchive.com redirects to content at 192.236.176.143 (beautynatural.club), 18.144.110.130 (adperformltd.go2cloud.org), and 54.177.5.212 (tracking.wrm-media.com) in part to confirm that the email address receives messages, thereby inviting more spam.
No one sending legitimate business correspondence would have reason to go to such lengths to mask their email's content.
show less
Another dating / romance scam being spammed out from
IP 209.85.220.69 (google.com)
The spammer' ...
show moreAnother dating / romance scam being spammed out from
IP 209.85.220.69 (google.com)
The spammer's websites are located at
https://drive.google.com/file/d/1XEtB_ifx2PGxGfZqmi1ovmdniKwtz5_-/view?ts=613702e8
IP: 142.250.69.206 (google.com)
Which redirects to
http://gg.gg/nsmxo
IP: 185.15.209.141 (mirhosting.com)
http://www.laxob.com/SHeXF
IPs: 18.144.110.130, 54.177.5.212 (amazon.com / amazonaws.com)
Which redirects to
https://loversdates.com/dc?s1=sh_cf1&s2=102093b3518cdfbdb4f170c8e2a6dc&s3=35290&s4=&lb=1&oid=58647_58646
IPs: 172.67.178.222, 104.21.17.240 (cloudflare.com)
Do not go to any of these sites they are a scam and NOT a real dating
website.
show less
109.237.96.231 22 Feb 2021 16:13:29 -0800 Subject: Sam's Club has a big surprise for you xxxxxxx!! ...
show more109.237.96.231 22 Feb 2021 16:13:29 -0800 Subject: Sam's Club has a big surprise for you xxxxxxx!! Confirmation needed https://cutt.ly/3lsKrRd https://allluckybears.com https://courtofballs.com https://hairlossandyou.com https://upxstream.com https://expressrevenue.com https://vtl-weightloss.com https://blnu-glo.lujtryycd03.com https://shopremedyleaf.com https://www.dk18trk.com https://www.vipdesignerdeals.com https://track.clickbooth.com http://jump.trakmylink.com https://mcc.go2cloud.org https://shop.cleanersmile.com https://track9leads.com https://brandtrx.com https://discountsoundpods.com https://youtu.be/vWuA-Gnr3m https://bravotrk.com https://offerheros.com https://www.nolatreveskin.com https://www.tc89trk.com https://www.tacticalgadgetssales.com https://www.goldlinuk.com https://www.fitnesstrackercheckout.com https://clkadz.com https://offers.xtesto.com http://prs.go2cloud.org https://www.becomelimitless-now.com https://blnu-glo.lujtryycd03.com https://nutrapharmexdiet.com
show less
Sending out spam emails from IP
2603:1096:3:2:0:0:0:26 (microsoft.com)
https://whois.arin.net/re ...
show moreSending out spam emails from IP
2603:1096:3:2:0:0:0:26 (microsoft.com)
https://whois.arin.net/rest/net/NET6-2603-1000-1/pft?s=2603%3A1096%3A3%3A2%3A0%3A0%3A0%3A26
Sending out dating / romance scams fake dating
sites used to collect information about people
for fraudulent purposes.
The spammer's websites are located at
https://hcmcou-my.sharepoint.com/:w:/g/personal/tuan_pm8_oude_edu_vn/EdmXy-0sikRJsQpp96X9b-EB8aL7U6RX8AmntvAmwfD_Ww?e=4%3aPT8xGB&at=9
IP: 13.107.136.9 (microsoft.com)
Which redirects to
http://www.laxob.com/SHeWd
IPs: 54.177.5.212, 18.144.110.130 (amazon.com / amazonaws.com)
show less