Spamhaus

Strengthening trust and safety across the Internet, by being the authority on IP and domain reputation.

Mastodon: @[email protected]

[Spamhaus @spamhaus]

🤩 If you're attending #UndergroundEconomy2026 and you contribute data to @spamhaus or @abuse_ch make sure you come find us...

[abuse.ch @abuse_ch]

Overlord RAT 🔌 dropped by Amadey loader 🔥

Botnet C2 server:
mypamella .xyz ➡️ NameSilo 🇺🇸
136.175.82.88:443 ➡️ 2ETELECOM🇧🇬

Payload is bulletproof hosted 🛡️at Omegatech LTD 🇳🇱
🌐 https://t.co/BbA2SVHdWk

📄 Malware sample:
https://t.co/N4L2Wv8oZy

🦊 Further IOCs on ThreatFox:
https://t.co/R67Fchxqlw

Admin panel ⤵️

[Spamhaus @spamhaus]

Another day, another suspicious ISP: This time, a cluster of 🎣 phishing domains targeting Roblox drew our researchers' attention to EggyWall (AS219067), for which RIPE merely provides a residential address in northern 🇮🇹 Italy.

The sole prefix announced by AS219067, 5.175.169[.]0/24 (leased from 🇩🇪 GHOSTnet GmbH), got listed in SBL and DROP on August 20. Peculiarly, a few hours later, a second announcement surfaced: 107.150.72[.]0/24 (leased from 🇺🇸 Inter Connects Inc). Even more interesting, a variety of phishing domains previously seen on the first prefix started resolving to the second, potentially indicating a deliberate evasion attempt.

At this time, AS219067 is exclusively routed by 🇩🇪 Pfcloud UG (AS51396), which in turn obtains connectivity from 🇩🇪 aurologic GmbH's AS30823. Both ISPs are known among anti-abuse circles for their persistent proliferation of bulletproof hosters.

EggyWall's domains previously resolved to AS36680 ( 🇺🇸 Netiface LLC), another bulletproof hoster in Pfcloud's realm. Have we sniffed out a phisher trying to emancipate themselves from a criminal competitor? We are sure time will reveal it all. 🕵️

#Cybercrime #Phishing #BulletproofHosting

[Spamhaus @spamhaus]

Traveling the world requires preparation, particularly when involving camping and exploring rural areas. The other day, our researchers encountered a potential equipment supplier: 🇺🇸 Evergreen Horizon Outdoor Camping Gear LLC (AS402664)

However, obtaining actual gear from them might prove tricky: Evergreen's postal address points to a flower shop in Vicksburg, Mississippi, while its domain, evergreenhorizonoutdoorcampinggear[.]com, merely displays a Namecheap default site at the time of writing. Perhaps they are currently enjoying summer vacation, testing their products? 🤔

Should you require IPv6 address space while traveling, Evergreen for sure has you covered: AS402664 currently announces no fewer than five /29 prefixes; IPv6 stockpiling comes to mind: 👉️ https://t.co/7EqT5rWgHN

Its upstream seems quite travel-experienced as well: Despite providing a postal address in 🇺🇸 Denver, Colorado, Nexus Telecom LLC (AS24062) has its ARIN database records' country set to 🇲🇾 Malaysia.

It reminds us of "Sweet Dreams" 🎶 by Eurythmics: "[...] some of them want to abuse you [...]" - Enjoy summer, and keep an eye out for suspicious ISPs! 🕵️

#OSINT #IPv6

[abuse.ch @abuse_ch]

NeedleStealer 🪡🪝 written in Go ⤵️

🔎 HTTP user agents observed:
User-Agent: Loader-cli/v1
user-agent: Go-http-client/2.0

📡 Botnet C2s, all behind Cloudflare CDN:
http://woolvilli .com/api/v2
http://allremdeskriki .com/api/v2
http://dubl1allremriki .com/api/v2
http://dubl2allremriki .com/api/v2

💡 Related C2 infrastructure at Vultr 🇳🇱:
http://136.244.100 .54:8899/api/v1/agent/register
http://136.244.100 .54:8899/api/v1/agent/ws

⚱️ Artifacts:
\Sessions\1\BaseNamedObjects\Local\NeedleRemoteAgentSingle
C:\Users\user\AppData\Local\Temp\needle-2fa

📄 Malware samples:
https://t.co/re9St3VLwC

🦊 Relevant IOCs are on ThreatFox:
https://t.co/vpsjVZG1Wq

Stealer admin panel⤵️

[Spamhaus @spamhaus]

💪 Contributor "FQ02" has made 1,028 raw source code submissions over the past 30 days 🔥 That’s a +51,300% increase, landing them in the Top10 on the leaderboard! Incredible work!

Contributor FQ02, don't forget to claim your name - it only takes a few minutes.
Login here to review your 'Display Name' 👉 https://t.co/XIn5BD7ijQ

Got malicious or suspicious IPs, domains, URLs, or raw source to share?
👉 Join the fight against cybercrime: https://t.co/Zy2YtyIac2

#CyberSecurity #ThreatIntelligence #ThreatHunting #Infosec

[abuse.ch @abuse_ch]

We identified a new malware called #HypeAgent which acts as information stealer & loader. It is dominantly spread through malspam 📧, first observed on August 1, 2026 🔭👀

Key Capabilities ⤵️
🕵️ Stealer & Loader: Supports 200+ commands; drops/executes payloads, including crypto miners 💸
🔎 Targeted Harvesting: Steals web browser & email credentials, crypto wallets, and gaming accounts (Steam, Roblox) 🎮
🤖 AI & Platform Cookie Stealing: Targets a list of hardcoded domains like Grok, Anthropic, Coinbase, ByBit, Instagram, and Rockstar Games for which it steals session cookies 🍪
💰 Electron App Webinjects: Intercepts activity on desktop apps like Exodus Wallet 👛

Artifacts observed ⤵️
1️⃣ Stores stealers logs under C:\Users\USERNAME\AppData\Local\Temp\hype-YYYY-MM-DD.log
2️⃣ Uses HTTP host header "X-Hype-Agent-Token" during botnet C2 communication

HypeAgent communicates via WebSocket using JSON. Here are some Botnet C2 servers we have been observed ⤵️
📡 31.40.204.178:7080 WhiteLabel 🇹🇷
📡 94.26.3.211:7443 Stellar Group SAS 🇫🇷
📡 192.109.139.91:7443 Stellar Group SAS 🇺🇸
📡 195.177.94.60:7443 Stellar Group SAS 🇫🇷
📡 107.175.148.122:7443 HostPapa 🇺🇸
📡 209.54.103.173:7443 HostPapa 🇺🇸
📡 132.243.225.173:7080 QWINS-Hosting 🇩🇪
📡 78.40.209.113:7081 QWINS-Hosting 🇫🇮
📡 31.77.138.55:5654 QWINS-Hosting 🇫🇮

🦊 Releated IOCs on ThreatFox:
https://t.co/X0S6ihaSXz

📄 Releated malware samples on MalwareBazaar:
https://t.co/bdXcPm9i6e

[Spamhaus @spamhaus]

🤔 Ever wondered what happens after you report a phishing link, suspicious domain, or malicious looking IP?

We check the resources you submit against Spamhaus reputation data. If there’s a match, you’ll see it reflected in your Threat Intel Community dashboard.

Once logged in, you can:

📊 Track your contributions over the last 30 days
✅️ See how many matched known threats
🚩 Report suspicious activity directly
🔌 Submit at scale via API

...and don’t forget the leaderboards where you can see how your contributions stack up against the rest of the community.

Every submission helps strengthen the intelligence used by CERTs, CSIRTs, and security teams around the world to identify and take action against malicious infrastructure.
Join the community and turn what you’re seeing into intelligence that helps protect others.

👉 https://t.co/wqsZ8IUqLQ

#ThreatIntelligence #CyberSecurity #Spamhaus #InfoSec #CommunityDefense

[Spamhaus @spamhaus]

Hat tip to @soverinteam for alerting us to this activity. We are contacting Google and now actively listing the compromised domains.

Is anyone else seeing this activity originating from compromised Google Workspaces? If so, please share any suspicious domains with us via the #ThreatIntel Portal 👉️ https://t.co/c0zdOt0TUi

3/3

[Spamhaus @spamhaus]

❗️ A large number of @GoogleWorkspace accounts are being compromised and used to send #phishing and #scam emails - see screenshot attached.

We’ve observed the same target domain across multiple #spam campaigns.

Education appears to be particularly affected. So far, we’ve identified 450+ compromised education domains using Google Workspace - although the activity isn’t limited to this sector.

1/3

[Spamhaus @spamhaus]

Initially, the spam pointed to the same domain, but we’re now seeing links hosted directly on IP addresses and URLs masked through services that can resolve to different IPs. One example follows the pattern 1-2-3-4[.]cprapid[.]com, although a range of more obscure domains and hosting providers are being used.

We’re also seeing Google Drawings being used as an intermediary: the drawing contains an image and a link that redirects the recipient to the target.

2/3

[abuse.ch @abuse_ch]

Over the past days, active #malspam campaigns targeting LatAm users 🇦🇷🇧🇷🇲🇽 have been delivering the Grandoreiro banking trojan 🏦💰

📧 Email ➔ 📜 JS file ➔ 📑 Fake PDF download

Final payload is hosted on MediaFire 🔥 free file hosting

C2 network traffic is rather trivial to detect as #Grandoreiro is using Embarcadero Delphi compilation tools' HTTP user agent 🖥️⤵️

User-Agent: Embarcadero URI Client/1.0

🔎 Botnet C2 domain resolved via Google DNS-over-HTTPS (DoH): devilmaycry.servehumour .com 👀

📡 Grandoreiro botnet C2s hosted at AWS:
54.80.154.193
54.91.129.132
54.91.223.28

🌐 Payloads URLs:
https://t.co/Q73Q0GNtfh

📄 Malware samples:
https://t.co/ihQKiwQt8t

🦊 Relevant IOCs are available on ThreatFox:
https://t.co/M3qnAFJkCN

[Spamhaus @spamhaus]

🤔 Not using Spamhaus' DROP lists already?

You can access them for FREE and gain protection against the worst of the worst IP traffic at the routing level.

Lists are available for IPv4, IPv6 and ASN filtering:
➡️ https://t.co/VmclctN5Vm

#CyberSecurity #ThreatIntel #NetworkSecurity #Infosec
3/3

[Spamhaus @spamhaus]

❗Here's the most recent additions to Spamhaus DROP (Do Not Route or Peer) list - including hijacked IPs, suspected snowshoe spam and cybercrime hosting ⤵️
1/3

[Spamhaus @spamhaus]

31.56.52.0/23 -> SBL699585
212.68.164.0/22 -> SBL693284
217.60.103.0/24 -> SBL699567
217.60.102.0/24 -> SBL699566
91.240.118.0/24 -> SBL636085
193.178.158.0/24 -> SBL699557
173.239.224.0/24 -> SBL699478
185.231.226.0/24 -> SBL699466
91.92.40.0/24 -> SBL699444
89.106.83.0/24 -> SBL698811
31.43.185.0/24 -> SBL699431
94.154.46.0/24 -> SBL699430
213.176.24.0/22 -> SBL699429
93.152.223.0/24 -> SBL699427

Full details available via Spamhaus IP and Domain Checker - simply input the SBL number and hit ENTER ➡️ https://t.co/P3J7YRF10n
2/3

[ICANN @ICANN]

Understanding malicious domain registration data requires looking beyond the numbers. A new #ICANN blog examines the distinction between reported and confirmed #DNSAbuse, the scope of ICANN’s definition, and the importance of methodology and context.

Read more: https://t.co/KoXR1HkmNJ

[NSA Cyber @NSACyber]

NSA joins the @FBI and others in releasing a joint Cybersecurity Advisory, “#StopRansomware: Gunra Ransomware,” as an ongoing effort to publish information about various ransomware variants and threat actors. Learn more: https://t.co/1gi9DRjwdY

[abuse.ch @abuse_ch]

Rogue #ScreenConnect RMM cluster using a fake @COLDCARDwallet domain to lure crypto wallet owners 💰 into downloading a fake DocuSign MSI which drops ScreenConnect 🖱️🖥️

⛓️ Attack Chain:
Threat actor domain ➡️ GitHub repo ➡️ ScreenConnect

🔍 Fake #COLDCARD domain with opendir:
hardware-data .com ➡️ Tucows Domains 🇺🇸

⚙️ Rogue GitHub user with 19 code repositories:
https://t.co/FRNiDL0LiQ

🔌 ScreenConnect RMM botnet C2s (Port 8041 TCP):

🇺🇸 DeltaHost :
hitpanels .com ➡️ 185.174.101.132
hitspanels .com ➡️ 185.174.101.132

🇺🇸 1337 Services GmbH:
vicspanel .com ➡️ 155.2.192.94
hitstp .com ➡️ 155.2.192.235
vps133panel .com ➡️ 203.159.90.31

🦊 IOCs on ThreatFox:
https://t.co/7wUX8XyVD4

🏠 Payload delivery URLs on URLhaus:
https://t.co/g9gSkk5kfa

[Spamhaus @spamhaus]

🚨 New entrant alert: Stark Industries Solutions debuts at #2 for newly observed botnet C&Cs between Jan and Jun 2026, with 931 detections in just six months. This 🇬🇧 UK-registered host is widely assessed to be 🇷🇺 Russian-operated bulletproof hosting, and it's now on Spamhaus's DROP and ASN-DROP lists.

Network operators: treat traffic to/from this ASN accordingly ⚠️

Read the full report👇
https://t.co/VJO4al9sbq

#BotnetCC #BulletproofHosting #ThreatIntel

[Spamhaus @spamhaus]

Spamhaus keeps observing internet abuse involving dangling CNAME DNS records, a threat we first highlighted in 2024: 👉️ https://t.co/BxUeLF9igj

One particular, long-standing threat actor is currently disseminating snowshoe spam from about 2.5k IPv4 addresses, leveraging dangling CNAMEs. While our CSS and DBL datasets cover this campaign, our ticketing team encounters a steady stream of domain owners (whose dangling CNAMEs are actively abused) wondering why their legitimate domains' reputation deteriorated. 🧐

If you oversee an organizations' domain petting zoo, we strongly recommend implementing (in addition to the robust monitoring, compliance and internet asset decommissioning procedures you undoubtedly have in place 😉) periodic checks against Spamhaus DBL – particularly for domains outside your control, such as third-party services used as CNAME targets. Any DBL listing indicates an ongoing abuse incident, and should prompt an investigation.

Your help in draining the swamp of orphaned internet infrastructure prone to abuse is greatly appreciated – every deleted dangling DNS record helps! 🙏

#TicketDeskTales #DomainReputation #Cybersecurity #DNS