Yes, even reported it to lurkers on the list..
For the record, since last Saturday, extreme level of Bot activity, and
porn scam, and ransomware, and heavy use of compromised accounts..
Tapered off overnight..
This seems to be a follow-up actor, using a similar technique, but
different templates, and it could take a couple of days for 'filtering'
technologies to catch up, but judging by activity we noticed, the volume
should trigger various outbound rate limiters ..
But of course, even assuming it did trigger outbound rate limiters, even
if a few dozen leaked from each account it would mean LARGE volumes from
someone like MS.
This is one of those cases where content comparisons, (eg if all of a
sudden hundreds of users start sending the same message) that it could
generate new pattern detections..
But it is obvious database hacks, and this one looks to have newer data
that the previous round(s).
On 2018-11-15 9:11 a.m., Tobi wrote:
Hi
For the last couple of days we see a remarkable increase in bitcoin
(gotcha-watching-porn-scam) coming from legit outlook.com servers. The
subject mentions a username and a password. From what I see the PW could
be legit, at least they're not '1234' or 'password'
Anyone else seeing such an increase in this crap coming from outlook.com
servers?
Cheers
tobi
_______________________________________________
mailop mailing list
[email protected]
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
--
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada
This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.
_______________________________________________
mailop mailing list
[email protected]
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
