article thumbnail

Fake Lawsuit Threat Exposes Privnote Phishing Sites

Krebs on Security

Throughout 2023, Tornote was hosted with the Russian provider DDoS-Guard , at the Internet address 186.2.163[.]216. A review of the passive DNS records tied to this address shows that apart from subdomains dedicated to tornote[.]io, io, the main other domain at this address was hkleaks[.]ml. com , meternask[.]com com , and rnetamask[.]com.

Phishing 209
article thumbnail

Why is.US Being Used to Phish So Many of Us?

Krebs on Security

domains were the worst in the world for spam, botnet (attack infrastructure for DDOS etc.) ” “We stand against DNS abuse in any form and maintain multiple systems and protocols to protect all the TLDs we operate,” the statement continued. .” Sadly,US has been a cesspool of phishing activity for many years.

Phishing 224
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

US Harbors Prolific Malicious Link Shortening Service

Krebs on Security

domains were the worst in the world for spam, botnet (attack infrastructure for DDOS etc.) “We’re always looking at the end malware or phishing page, but what we’re finding here is that there’s this middle layer of DNS threat actors persisting for years without notice.” and illicit or harmful content.

Phishing 259
article thumbnail

Double-Your-Crypto Scams Share Crypto Scam Host

Krebs on Security

A dig into the Domain Name Server (DNS) records for Coinbase-x2[.]net Cryptohost says its service is backstopped by DDoS-Guard , a Russian company that has featured here recently for providing services to the sanctioned terrorist group Hamas and to the conspiracy theory groups QAnon/8chan. We don’t keep your logs!,”

Scams 186