Yet another example of how “cold email” is simply just #spam.
| Website | https://www.spamhaus.org |
| Threat Intel Community | https://submit.spamhaus.org |
| https://www.linkedin.com/company/the-spamhaus-project | |
| https://twitter.com/spamhaus |
The Spamhaus Project
- 1.5K Followers
- 21 Following
- 643 Posts
Spamhaus strengthens trust and safety for the Internet. Advocating for change through sharing reliable intelligence and expertise. As the authority on IP and domain reputation data, we are trusted across the industry because of our strong ethics, impartiality, and quality of actionable data. This data not only protects but also provides signal and insight across networks and email worldwide.
With over two decades of experience, our researchers and threat hunters focus on exposing malicious activity to make the internet a better place for everyone. A wide range of industries, including leading global technology companies, use Spamhaus' data; currently protecting over 4.5 billion mailboxes worldwide.
The anatomy of bulletproof hosting has changed significantly, and if you're working in threat intelligence or network abuse, it's worth understanding how.
In this post we cover the decline of monolithic bulletproof hosts, the shift toward separation of liabilities, and the growing abuse of trusted, legitimate services to conceal criminal infrastructure.
Read the post here:
#Cybersecurity #BulletproofHosting #ThreatIntelligence #InfoSec #InternetAbuse
abuse.ch 
Botnet C2 tied to an unidentified #malware family trying to hide as FortiGate device 😜
🌐 Domain: az2030port.duckdns .org
📡 C2: 178.16.55.28:2030 ➡️ Omegatech LTD🇳🇱
🔐 SSL certificate: FortiGate, O=Fortinet Ltd.
Corresponding malware samples ⤵️
https://hunting.abuse.ch/hunt/6a285c89c73e5/178.16.55.28/
❗Here's the most recent additions to Spamhaus DROP (Do Not Route or Peer) list - including hijacked IPs, suspected snowshoe spam and cybercrime hosting:
103.112.184.0/22 -> SBL677738
103.118.241.0/24 -> SBL677739
109.206.244.0/22 -> SBL686370
110.48.136.0/22 -> SBL687116
110.48.148.0/22 -> SBL687117
203.189.234.0/23 -> SBL693100
27.122.32.0/20 -> SBL682162
113.213.128.0/18 -> SBL682168
204.153.160.0/23 -> SBL697970
216.93.48.0/21 -> SBL697971
Full details available via Spamhaus IP and Domain Checker - simply input the SBL number and hit ENTER ➡️ https://check.spamhaus.org
🤔 Not using Spamhaus' DROP lists already?
You can access them for FREE and gain protection against the worst of the worst IP traffic at the routing level.
Lists are available for IPv4, IPv6 and ASN filtering:
➡️ https://www.spamhaus.org/blocklists/do-not-route-or-peer/
🏔️ Meet Spamhaus at #FIRSTCON26 in Denver 🤠
We're looking forward to connecting with folks across incident response and threat intelligence - especially opportunities to collaborate on research, data sharing, and feedback on the data that can help CERTs and responders.
If you’re around and up for a meetup, conversation, or collaboration, feel free to DM us...see you there!
RE: https://infosec.exchange/@securityskeptic/116640850480436248
💡Interisle Consulting Group's latest "Phishing Trends" highlights significant phishing abuse involving 🪴.GARDEN domains. These stats align closely with what we’re observing at Spamhaus, with .GARDEN currently #4 among the Top 10 gTLDs associated with malware activity.
🌐 Spamhaus Reputation Statistics: https://www.spamhaus.org/reputation-statistics/gtlds/malware/
Zack WhittakerNew, by me: Scammers are abusing a legitimate internal Microsoft account (used for sending critical account alerts and MFA codes to users logging in) to send spam and scam emails.
We first saw a flood of these emails last week, but anti-spam project Spamhaus says this has been going on for months.
More: https://techcrunch.com/2026/05/21/scammers-are-abusing-an-internal-microsoft-account-to-send-spam
❗ We’ve observed a scammer clearly abusing Microsoft's 'msonlineservicesteam@microsoftonline[. ]com' for spam distribution.
The header and message body appear completely legitimate - the abuse is happening through injection into the Subject:
✉️ Here's an example:
"Your PayPal order for 0.0092 BTC ($699.99) is complete. Not you? Call +1 (803) 237-5050 account email verification code."
At this point, it appears the attacker may have simply set the malicious text as either the account name or the organization name.
This also appears to line up with what @zackwhittaker TechCrunch Security Editor identified last week:
https://mastodon.social/@zackwhittaker/116562360000833298
....although the activity we’re seeing appears to stretch back several months.
Takeaway: automated notification systems should not allow this level of customization.
Microsoft has been informed of this abusive activity.
Still relying on passwords? You're not alone....but they are one of the most common targets for cybercriminals and one of the weakest links in online security...
This is your signal to switch to a more secure way to sign in: passkeys 🔐
Following World Password Day last week, we’ve published a new glossary entry explaining what exactly passkeys are, how they work, and how they better protect you online.
Learn more here ➡️ https://www.spamhaus.org/glossary/#passkeys
