Spear phishing abused spambot and landing page IOC Feb 17 12:59:25 2026

rawuvizem.z11.web.core.windows.net
licubeno.z1.web.core.windows.net
sewutidu.z28.web.core.windows.net
www.aquabrookye.pro

Bad repuration IP used for today's spear phishing are:

IP|PTR|COUNTRY|CITY|ASN|ISP|TOR|ABUSEDB|SPAMHS|FEODO|ETBL|SHO_PORTS

105[.]27.127.194  | NO_PTR  | ZA | Cape Town     | AS37100  | SEACOM Limited          
103[.]137.179.144 | NO_PTR  | PH | Malay         | AS138961 | Paradise Cable  Network 
148[.]0.157.28    | NO_PTR  | DO | Santo Domingo | AS6400   | Compañía Dominicana Telé
185[.]127.93.45   | NO_PTR  | US | Kansas City   | AS33387  | Nocix, LLC       

Legitimare service abused IP are:

 20[.]150.105.1  |NO_PTR|JP|Tokyo |AS8075 |Microsoft Corporation|NO|0|NO|NO|NO|NA
 20[.]150.121.129|NO_PTR|NO|Oslo  |AS8075 |Microsoft Corporation|NO|0|NO|NO|NO|NA
 20[.]60.13.228  |NO_PTR|FR|Paris |AS8075 |Microsoft Corporation|NO|0|NO|NO|NO|NA
172[.]67.205.246|NO_PTR|US|Frisco|AS13335|Cloudflare, Inc.|NO|0|NO|NO|NO|NA
104[.]21.22.174 |NO_PTR|US|Frisco|AS13335|Cloudflare, Inc.|NO|0|NO|NO|NO|NA

EOF