malware warning

Thu Jul 20 06:31:35 UTC 2023

I've also gotten these, ironic that it was in "reply" to my
"Not sure if this is a phishing E-mail or real..." thread.
I initially thought someone was spamming the whole list,
it took a while before I looked close enough to realize it
was directly to the address I use for the mailing list and
not through the mailing list. (Which explained why it
wasn't showing up in the list archive on the web.)  Also
continued much after the thread died out in my case too.

On 18/07/2023 6:06 p.m., Matt Corallo wrote:
> I get quite a bit of spam that is a "reply" to old NANOG posts (some 
> dating back a year or more). Seems to only happen on some specific 
> threads, dunno why though.
>
> Definitely recommend using a nanog-specific alias and 
> auto-spam-folder'ing anything to that alias that isn't CC nanog at nanog, 
> that seems to get rid of it.
>
> Matt
>
> On 7/18/23 5:02 PM, Randy Bush wrote:
>> malware email is so common i normally do not warn of it.  but, in this
>> case, the attacker is extracting quotes from nanog and luring folk into
>> clicking.  e.g.
>>
>> From: takahashi at fukushitrust.com
>> Subject: Re: jon postel
>> To: Randy Bush <randy at psg.com>
>> Date: Mon, 17 Jul 2023 04:01:47 -0700
>>
>> Hello!
>>
>> We would like to present to you several alternatives for 
>> presentations and find out your thoughts and
>> opinions, please let us know whatever you think about it.
>>
>> https://dognibs.com/8jh/ogr/g0h436ttqbw
>>
>> Waiting for your reply
>>     > Does anyone have any stories about working with or near John 
>> they > would like to share with the
>>   list? It would definitely make my day > to hear more about the 
>> early internet somewhere around i have a
>>   protocol violation ticket he issued. --- Who says that routing 
>> unallocated address space is ungood? --
>>   Randy Bush Routing unallocated address space is ungood! -- Jon 
>> Postel randy
>>
>> ----
>>
>> and
>>
>> From: office at daimontrade.com.ua
>> Subject: Re: Reverse DNS for eyeballs?
>> To: Randy Bush <randy at psg.com>
>> Date: Tue, 18 Jul 2023 02:56:36 -0700
>>
>> Hello,
>>
>> Modified paperwork regarding For this month. Kindly read through it 
>> attentively.
>>
>> https://soocoop.net/e24/1s0/7ckl0icu7h
>>
>> We appreciate your attention.
>>     > I would say the absence of reverse DNS tells useful info to 
>> receiving > MTAs - to preferably not
>>   accept. yep

-- 
Glen A. Pearce
gap at ve4.ca
Network Manager, Webmaster, Bookkeeper, Fashion Model and Shipping Clerk.
Very Eager 4 Tees
http://www.ve4.ca
ARIN Handle VET-17