[AusNOG] Bigpond email abuse

[John Edwards]

Be sure to check in on your elderly neighbours to make sure that they're
not still using Eudora Mail with plaintext POP3 passwords

John


On Wed, 2 Jun 2021 at 14:34, James Williamson <
james.williamson at plc.wa.edu.au> wrote:

> Hi All,
>
> We saw an external user a few months ago who had their Bigpond address
> compromised, and the entire mailbox dumped. Afterwards, they discovered
> friends and colleagues are receiving replies to years-old threads (although
> the new message is from a random email address), usually with some sort of
> phishing link. Now we've seen it again with a second and unrelated Bigpond
> user.
>
> Has anybody seen anything similar before? I'm not familiar with this breed
> of spam, and to see two of them from the same host has my curiosity up a
> bit. Trying to find other cases like this eluded my Google-fu.
>
> [example, redactions mine]
> From: Robyn ******* <Robyn*********@anetafons.pl>
> Sent: Friday, 21 May 2021 2:32 AM
> To: Allison ******* <Allison.******@******.au>
> Subject: Re: RE: ********
>
> --EMAIL FROM EXTERNAL ADDRESS, CHECK LINKS & ATTACHMENTS BEFORE CLICKING
> OR OPENING THEM--
>
>
> Good afternoon,
> It's Robyn *******. Please look at the report and deal with any problems.
> Here is the document link:
> https://1drv.ms/u/s!*******?e=ysj***
> password: 5214
>
>
> On 2018-12-07 15:34, Allison ******** wrote:
> Hi Allison
>
> Thanks so much for your time in showing me around **** recently. I was
> really  impressed with your knowledge of the programs and facilities,
> and the ***** in general.
> (snip)
> [end example]
>
> Cheers,
> James
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20210603/e713a17f/attachment.html>