<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div dir="ltr">
<div></div>
<div>
<div>And enable MFA</div>
<div dir="ltr"><br>
</div>
<div><br>
</div>
<div id="ms-outlook-mobile-signature">Get <a href="https://aka.ms/o0ukef">Outlook for iOS</a></div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> AusNOG <ausnog-bounces@lists.ausnog.net> on behalf of Phil Memery <memery@clevernetit.com.au><br>
<b>Sent:</b> Wednesday, June 2, 2021 1:43:12 PM<br>
<b>To:</b> James Williamson <james.williamson@plc.wa.edu.au><br>
<b>Cc:</b> ausnog@lists.ausnog.net <ausnog@lists.ausnog.net><br>
<b>Subject:</b> Re: [AusNOG] Bigpond email abuse</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Greetings James (and Others)<br>
<br>
Yes I have seen it (I have well and truly deleted the SPAM emails and moved on though).<br>
<br>
It was a google hosted domain. From recollection the user changed his access details related to the domain and his email, end of problem. So it seems not to be just a bigpond or Google issue.<br>
<br>
A good reminder to "change passwords" and make sure they are of a good secure structure. I am often still amazed out how poor some individuals are about passwords.<br>
<br>
<br>
Regards, Phil<br>
<br>
----- Original Message -----<br>
From: "James Williamson" <james.williamson@plc.wa.edu.au><br>
To: ausnog@lists.ausnog.net<br>
Sent: Wednesday, 2 June, 2021 3:03:22 PM<br>
Subject: [AusNOG] Bigpond email abuse<br>
<br>
Hi All,<br>
<br>
We saw an external user a few months ago who had their Bigpond address compromised, and the entire mailbox dumped. Afterwards, they discovered friends and colleagues are receiving replies to years-old threads (although the new message is from a random email
address), usually with some sort of phishing link. Now we've seen it again with a second and unrelated Bigpond user.<br>
<br>
Has anybody seen anything similar before? I'm not familiar with this breed of spam, and to see two of them from the same host has my curiosity up a bit. Trying to find other cases like this eluded my Google-fu.<br>
<br>
[example, redactions mine]<br>
From: Robyn ******* <Robyn*********@anetafons.pl> <br>
Sent: Friday, 21 May 2021 2:32 AM<br>
To: Allison ******* <Allison.******@******.au><br>
Subject: Re: RE: ********<br>
<br>
--EMAIL FROM EXTERNAL ADDRESS, CHECK LINKS & ATTACHMENTS BEFORE CLICKING OR OPENING THEM--<br>
<br>
<br>
Good afternoon,<br>
It's Robyn *******. Please look at the report and deal with any problems. Here is the document link:<br>
<a href="https://1drv.ms/u/s!*******?e=ysj***">https://1drv.ms/u/s!*******?e=ysj***</a><br>
password: 5214 <br>
<br>
<br>
On 2018-12-07 15:34, Allison ******** wrote:<br>
Hi Allison<br>
<br>
Thanks so much for your time in showing me around **** recently. I was <br>
really impressed with your knowledge of the programs and facilities, <br>
and the ***** in general.<br>
(snip)<br>
[end example]<br>
<br>
Cheers,<br>
James<br>
_______________________________________________<br>
AusNOG mailing list<br>
AusNOG@lists.ausnog.net<br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
-- <br>
Phil Memery <a href="http://www.clevernetit.com.au">www.clevernetit.com.au</a> A.B.N: 24 172 081 538<br>
DELL PartnerDirect Registered<br>
<a href="http://www.hillclimbracing.com">www.hillclimbracing.com</a><br>
+61 (0) 417 315 935<br>
_______________________________________________<br>
AusNOG mailing list<br>
AusNOG@lists.ausnog.net<br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</div>
</span></font></div>
</body>
</html>