Comments on: The anatomy of an attack https://erik.zalitis.se/it-security/the-anatomy-of-an-attack/ - My thoughts but no prayers Sat, 19 Sep 2020 17:23:09 +0000 hourly 1 https://wordpress.org/?v=7.0.2 By: Erik Zalitis https://erik.zalitis.se/it-security/the-anatomy-of-an-attack/#comment-8 Sun, 13 Sep 2020 13:09:46 +0000 https://erik.zalitis.se/?p=297#comment-8 In reply to W.

Hey, thanks.

That’s great info. It sheds some light on this from bigger perspective…

Regards/Erik

]]> By: W https://erik.zalitis.se/it-security/the-anatomy-of-an-attack/#comment-7 Sun, 13 Sep 2020 12:40:59 +0000 https://erik.zalitis.se/?p=297#comment-7 If you have a look in the RIPEdb it looks like there are three /24 prefixes allocated by Telia to “MG” and Neonex dating back to 2011:
https://apps.db.ripe.net/db-web-ui/query?bflag=false&dflag=false&inverse=org&rflag=true&searchtext=ORG-NA407-RIPE&source=RIPE

Looking a bit at the reverse PTR pointers in those subnets there seem to be connections(customer or otherwise) to the firm FL-net and “ML” with a long history of being active in the email marketing business, obligatory Flashback thread:
https://www.flashback.org/t1119882

My guess is that this is one of them testing out one of many harvested or bought email lists for further marketing use…

As an aside, it seems that this “MG” is also active exploiting fears around the current pandemic peddling masks through his Estonian company Northlogix OÜ over at gnix (dot) se.

]]>