Log inSign up
Image
user avatar
Spamhaus
@spamhaus
Strengthening trust and safety across the Internet, by being the authority on IP and domain reputation. Mastodon: @[email protected]
Global
spamhaus.org
Joined December 2010
138
Following
10.5K
Followers
  • user avatar
    Spamhaus
    @spamhaus
    Nov 13, 2021
    We have been made aware of "scary" emails sent in the last few hours that purport to come from the FBI/DHS. While the emails are indeed being sent from infrastructure that is owned by the FBI/DHS (the LEEP portal), our research shows that these emails *are* fake.
  • user avatar
    Spamhaus
    @spamhaus
    Nov 13, 2021
    Replying to @spamhaus
    These emails look like this: Sending IP: 153.31.119.142 (mx-east-ic.fbi.gov) From: [email protected] Subject: Urgent: Threat actor in systems
    Image
  • user avatar
    Spamhaus
    @spamhaus
    Nov 13, 2021
    Replying to @spamhaus
    These fake warning emails are apparently being sent to addresses scraped from ARIN database. They are causing a lot of disruption because the headers are real, they really are coming from FBI infrastructure. They have no name or contact information in the .sig. Please beware!
  • user avatar
    Spamhaus
    @spamhaus
    Jul 26, 2024
    Image
    21K
  • user avatar
    Spamhaus
    @spamhaus
    Jul 17, 2020
    EMOTET UPDATE | We are observing more activity coming from the #Emotet #Botnet today. We are seeing email traffic from this botnet again. Both URLs and Attachments are being utilized for distribution. #malspam #threatintel
    Image
    Image
  • user avatar
    Spamhaus
    @spamhaus
    Nov 13, 2021
    Our telemetry indicates that there were two "spam" waves, one shortly before 5 AM (UTC) and another one shortly after 7 AM (UTC). The FBI has been getting many calls about it. We are therefore refraining from further actions against the sending IP addresses.
  • user avatar
    Spamhaus
    @spamhaus
    Nov 13, 2021
    The following chart shows email traffic originating from the FBI mailserver (mx-east-ic.fbi.gov | 153.31.119.142) involved. You can clearly see the two spikes caused by the fake warning last night. Timestamps are in UTC.
    Image
  • user avatar
    Spamhaus
    @spamhaus
    Apr 23, 2019
    Replying to @MalwareTechBlog and @RichHickson
    Human error. Faulty human has been replaced by a small shell script.
  • user avatar
    Spamhaus
    @spamhaus
    May 30, 2024
    🚨#IcedID, #Smokeloader, #SystemBC, #Pikabot and #Bumblebee botnets have been disrupted by Operation Endgame!! This is the largest operation EVER against botnets involved with ransomware, with gargantuan thanks to a coordinated effort led by international agencies👏👏 As with
    user avatar
    Europol
    @Europol
    May 30, 2024
    🚨Largest ever operation against botnets hits dropper malware ecosystem. Operation Endgame, coordinated from Europol headquarters, has led to four arrests and the takedown of over 100 servers worldwide. More information in our press release⤵️ europol.europa.eu/media-press/ne…
    17K
  • user avatar
    Spamhaus
    @spamhaus
    Sep 2, 2024
    Image
    6.6K
  • user avatar
    Spamhaus
    @spamhaus
    Aug 29, 2023
    Qakbot 🦆🤖 takedown!!! Qakbot has been disrupted and dismantled by the FBI following a multinational effort. We will be assisting with the remediation - more info to follow... #malware #takedown #qakbot
    Image
    FBI, Partners Dismantle Qakbot Infrastructure in Multinational Cyber Takedown | Federal Bureau of...
    From fbi.gov
    58K
  • user avatar
    Spamhaus
    @spamhaus
    Apr 7, 2025
    Some cybercriminal hosters go to great lengths to maintain a legitimate facade. Others, not so much. An example of the latter is 49.3 Networking LLC (AS399979), a Delaware-based 🇺🇲 shell corporation. When asked via Telegram for a service offering for malware distribution, the
    user avatar
    Fox_threatintel
    @banthisguy9349
    Apr 6, 2025
    It is just laughable how comfortable these bulletproof hosters are... Below AS 399979 that is provided upstream by @aurologiccom cc: @spamhaus @abuse_ch 'hot swapping ip's when listed allowed 🤡'
    Image
    13K
  • user avatar
    Spamhaus
    @spamhaus
    Jun 7, 2023
    Whilst Google Registry adding .zip is INSANE 🤯, it highlights a much BIGGER problem….the ability to craft internationalized domain names (IDNs) to deliberately trick users. Check out this example we created: irs.gov⧸tax.form1[.]zip - notice the weird slash? ⏬
    16K
  • user avatar
    Spamhaus
    @spamhaus
    Nov 13, 2021
    Replying to @WaldoTJ
    Triple action: Convince people to shut things down just in case, while veracity is determined, character assassination of Vinny Troia who was mentioned in it, and flooding the FBI with calls. Or, as someone else said, "for the lulz". Maybe all of the above. Maybe something else!