Well, as usual the only thing you can say is that it is not usual.
Interestingly, a strong drop in the number of spam emails sent from
botnets on IoT devices, compromised routers, etc.
In general, it reflects a growing trend for spammers to move to
alternative methods.
This week, in a continuation from last week, we see an increase of the
use of new favourite TLD's, .rest,.bar,.surf etc
204.13.154.22 45 mail.aayiseeu.rest
204.13.154.31 1 mail.credidcore.rest
204.13.154.32 72 mail.bazzer.rest
204.13.154.33 2 mail.portfolio.rest
204.13.154.89 32 mail.shanky.rest
Of course, they are setting shop up at historically 'lenient' hosting
providers, such as MultaCom, QuadraNet, HostSailor as well as smaller
fairly new IP Network assignments
#5.44.46.86 (RN) 1 mail.legndketofl.rest
# 5.44.46.136 (RN) 1 mail.frihartrail.bar
# 5.44.46.173 (RN) 1 mail.mygolfng.rest
# 5.44.46.174 (RN) 1 mail.chiocrof.rest
# 5.44.46.192 (RN) 1 MAIL.fungunator.rest
# 5.44.46.195 (RN,RS) 1 mail.homlght.surf
# 5.44.46.222 (RN) 1 mail.lumaslim.rest
#95.141.27.130 x1 mail.usacademy.rest
#95.141.27.137 x11 mail.carparfor.surf
#95.141.27.170 x3 mail.ontacpen.rest
#95.141.27.186 x5 mail.tacglas.surf
#95.141.27.188 x1 mail.splashwnes.bar
#95.141.27.217 x3 mail.lifelinesc.rest
#95.141.27.227 x9 mail.gsblood.surf
#95.141.27.236 x21 mail.homeofcc.rest
Hetzner continues to have large scale abuse, albeit pretty easy to
identify..
78.47.232.45 1
static.45.232.47.78.clients.your-server.de
88.99.82.60 1
static.60.82.99.88.clients.your-server.de
88.99.82.85 1
static.85.82.99.88.clients.your-server.de
88.99.83.8 1 static.8.83.99.88.clients.your-server.de
88.99.83.56 1
static.56.83.99.88.clients.your-server.de
88.99.83.150 1
static.150.83.99.88.clients.your-server.de
88.99.83.193 1
static.193.83.99.88.clients.your-server.de
88.99.83.247 1
static.247.83.99.88.clients.your-server.de
88.198.156.190 1
static.88-198-156-190.clients.your-server.de
95.217.4.34 2
static.34.4.217.95.clients.your-server.de
95.217.5.255 1
static.255.5.217.95.clients.your-server.de
95.217.12.181 1
static.181.12.217.95.clients.your-server.de
95.217.12.182 1
static.182.12.217.95.clients.your-server.de
78.46.230.2 1
static.2.230.46.78.clients.your-server.de
78.47.92.0 1
static.0.92.47.78.clients.your-server.de
78.47.95.209 1
static.209.95.47.78.clients.your-server.de
78.47.98.115 1
static.115.98.47.78.clients.your-server.de
78.47.98.116 1
static.116.98.47.78.clients.your-server.de
78.47.98.119 1
static.119.98.47.78.clients.your-server.de
78.47.153.148 1
static.148.153.47.78.clients.your-server.de
But Amazon spam sources are currently by far the largest reported, and
while it might be easy to say that's because they are so big, when it
gets to be such a large percentage of what we track worldwide, it is
concerning, and of course as previously mentioned hackers have publicly
stated that they 'are moving to the cloud'.
Also noticing a larger than normal percentage of malware style (fake
invoice attachments) from gmx.com lately, almost looks like they reduced
some of their outbound filtering, given the obvious nature of those.
On the whole, spam to the 'quarantines' has seen an increase over the
last couple of weeks, as spammers move from botnets of compromised
devices, to botnets of compromised email accounts.
Email Compromise attacks are definitely on the rise. And a surprising
large part of that is from the big three cloud providers, Amazon, Azure,
and GoogleCloud.
And SendGrid shared bulk email platform is REALLY seeing an uptick in
malware being sent from their infrastructure.
And yeah, catfishing is still a thing, the small twitter sized 'I am
lonely and looking for a good man'. Usual sources, yahoo and gmail
addresses, they keep coming up with new templates.
And of course, as always gmail 'SEO' and 'outsourcing' and 'Do you have
time for a meeting this Tuesday' spam is still problematic.
That's about it for this weeks summary from our spam auditing teams
reports, have a safe and happy Super Bowl weekend everyone!
-- Michael --
Remember, POP/IMAP/SMTP AUTH without SSL is BAD, just stop allowing it.
And look at transparent two factor authentication methods like CLIENTID
--
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada
This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.
_______________________________________________
mailop mailing list
[email protected]
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
