5 ms·
I received this at 1:07 AM PST to my work sysadmin account. It passed Barracuda and Office 365 spam filters. Initially I felt a surging panic when I realized t
by sys32768 5y ago
I received this at 1:07 AM PST to my work sysadmin account. It passed Barracuda and Office 365 spam filters.
Initially I felt a surging panic when I realized the source IP was indeed FBI, especially considering one of our close partners recently buckled under a ransomware attack they refused to pay, and thus had to rebuild from backups over a period of two weeks.
Smells mostly bogus now with no links to a status page and so many others reporting the exact same sloppy email, but how did they know to email me and other sysadmins, and how did they send from an FBI IP address?
Edit: typo
- vhold 5y agoIf it wasn't whois then another common tactic is to use LinkedIn and guess addresses from the names.
- bell-cot 5y agoDid the "one of our close partners [who] recently buckled under a ransomware attack" have contact details for "[you] and other sysadmins", to target the emails?
- ev1 5y agoAre you listed on any contacts or WHOIS? One of my friends got it to every single possible ARIN POC - abuse, noc, any named users for their IP space, and any emails that could be found for their domain.
- sys32768 5y agoNo, actually. All domains use an alias but this was sent directly to my primary, but not sent to any of our historic or present domain WHOIS contacts.