. DJ Mixers your website is compromised. djmixers[.]co/bin_hRFbZbb24.bin #malware

. @colbie_watson your website is compromised. colbiewatson[.]com/wp-admin/oauth04/redirect/[email protected] #phishing redirector

. The Light Events your website is compromised. thelightevents[.]ro/oldsite/styles/cs/aol-2D3/ thelightevents[.]ro/oldsite/styles/oww/ #phishing x.com/James_inthe_bo…

. Garden City Premier Business School your website is compromised. gacpbs[.]com/opav/[email protected] #phishing redirector

. @StepUpMarketin your website is compromised. teamstepup[.]com/wedrive/27301/[email protected] teamstepup[.]com/wedrive/27301/yi6cfb1a049hgrtdl8xpqzm2.php #phishing

. Oost-Ned.Kamerkoor your website is compromised. oostnederlandskamerkoor[.]nl/wp-content/plugins/press-elements/libs/twentytwenty/puyo/[email protected] #phishing

THL... 😫

Update: x.com/malwrhuntertea…

To properly understand the above tweet: he did a lot alone himself. He did a lot with others. And he did a lot with us. So he did a lot, 3 times. Of those 3 "each one is more enough than the other".

If you combine his work on #Emotet, #phishing, #asprox, #hancitor among other malware in addition to his compromise notification service Compromise Notifier, he has put thousands of hrs into his personal crusade against bad actors! We all owe him a great big thanks for his work!

Big thanks goes to him also for starting Cryptolaemus. x.com/Cryptolaemus1/…

exe drop: https://phoenixhcg[.]org/business.exe cc Compromise Notifier (miss you Jay).

James Compromise Notifier Another one: http://1bitofpeace .blog/business.exe Distributed via malspam hitting US mailboxes 🇺🇸 ZIP -> DOC -> payload via URL DOC: bazaar.abuse.ch/sample/88e06c9… Payload URL: urlhaus.abuse.ch/url/382451/

.@BATPress somebody has a sense of humour. Might want to clear your Domino directory out. [email protected]:$826y4$31226$dZbD2cf3eZ3Dblem4N0zcEcx2N4T1I8x7Z7TfF6iaY2OcI950zbMRsphrWnDxtlvPoHV.btS.scmEW2 (Salt: 9df60c63b1fe96eb69f5fd8f5f10f228)

.@BATPress seriously though. [email protected]:$2a$08$0XjdIWDNzE6iScn9mj1lWe290eucBhu3JbcLkPRPOB1i/wJ6SPrmi compromised account.

Fumik0_ Corsin Camichel 🌻 William MacArthur Paul Burbage hash ba321ad38f1d52cc0a8b94807fda8ff7 and 29c5871b8685a838a896f7f632871b06 on MalShare also cc Compromise Notifier

.ITV might want to close this itvmedia.s3-external-1.amazonaws.com #AWS

.AstraZeneca might want to close this one. …azenecadev.s3-sa-east-1.amazonaws.com #aws

.easyJet might want to close this: easyjetdev.s3-external-1.amazonaws.com #aws

.Royal Zoological Society of Scotland may want to change some passwords. [email protected]:G*FT*HOP [email protected]:*dinburgh*oo [email protected]:*oo*ab1 #infosec #phishing