- nmc-wg - lists.ogf.org

*SPAM* Your private information has been stolen because of suspicious events.
by nmc-wg＠ogf.org 03 Sep '23

03 Sep '23

Spam detection software, running on the system "mail.pglaf.org", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Greetings! Would like to introduce myself - I am a specialized hacker, and have succeeded in hacking your operating system. At this moment, I have obtained a complete access to account of yours. On top of that, [...] Content analysis details: (15.2 points, 4.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 TVD_RCVD_IP Message was received from an IP address 1.6 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 1.4 PYZOR_CHECK Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/) 1.0 RDNS_DYNAMIC Delivered to internal network by host with dynamic-looking rDNS 3.6 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr 2) 0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe 0.0 PDS_BTC_ID FP reduced Bitcoin ID 0.5 BITCOIN_XPRIO Bitcoin + priority 0.0 PDS_BTC_MSGID Bitcoin ID with T_MSGID_NOFQDN2 0.0 BITCOIN_SPAM_07 BitCoin spam pattern 07 0.0 MIMEOLE_DIRECT_TO_MX MIMEOLE + direct-to-MX 3.0 BITCOIN_YOUR_INFO BitCoin with your personal info 0.0 HDR_ORDER_FTSDMCXX_DIRECT Header order similar to spam (FTSDMCXX/boundary variant) + direct-to-MX 1.5 BITCOIN_DEADLINE BitCoin with a deadline 0.0 BITCOIN_TOEQFM Bitcoin + To same as From 2.0 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX 2.5 DOS_OE_TO_MX Delivered direct to MX with OE headers 0.0 XPRIO Has X-Priority header 0.0 NO_FM_NAME_IP_HOSTN No From name + hostname using IP address

1 0

*SPAM* Your private information has been stolen because of suspicious events.
by nmc-wg＠ogf.org 02 Sep '23

02 Sep '23

Spam detection software, running on the system "mail.pglaf.org", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Greetings! Would like to introduce myself - I am a specialized hacker, and have succeeded in hacking your operating system. At this moment, I have obtained a complete access to account of yours. On top of that, [...] Content analysis details: (7.6 points, 4.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 1.9 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date 1.4 PYZOR_CHECK Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/) 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS 0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe 0.3 PDS_BTC_ID FP reduced Bitcoin ID 3.0 BITCOIN_YOUR_INFO BitCoin with your personal info 0.8 BITCOIN_DEADLINE BitCoin with a deadline 1.2 BITCOIN_SPAM_02 BitCoin spam pattern 02 0.0 NO_FM_NAME_IP_HOSTN No From name + hostname using IP address

1 0

*SPAM* Your private information has been stolen because of suspicious events.
by nmc-wg＠ogf.org 01 Sep '23

01 Sep '23

Spam detection software, running on the system "mail.pglaf.org", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Greetings! Would like to introduce myself - I am a specialized hacker, and have succeeded in hacking your operating system. At this moment, I have obtained a complete access to account of yours. On top of that, [...] Content analysis details: (10.4 points, 4.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 1.6 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date 1.4 PYZOR_CHECK Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/) 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS 0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe 0.0 HDR_ORDER_FTSDMCXX_NORDNS Header order similar to spam (FTSDMCXX/boundary variant) + no rDNS 0.3 PDS_BTC_ID FP reduced Bitcoin ID 1.8 BITCOIN_XPRIO Bitcoin + priority 0.0 PDS_BTC_MSGID Bitcoin ID with T_MSGID_NOFQDN2 0.1 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX 0.0 BITCOIN_SPAM_07 BitCoin spam pattern 07 0.0 BITCOIN_TOEQFM Bitcoin + To same as From 0.0 MIMEOLE_DIRECT_TO_MX MIMEOLE + direct-to-MX 3.0 BITCOIN_YOUR_INFO BitCoin with your personal info 0.0 HDR_ORDER_FTSDMCXX_DIRECT Header order similar to spam (FTSDMCXX/boundary variant) + direct-to-MX 0.8 BITCOIN_DEADLINE BitCoin with a deadline 2.5 DOS_OE_TO_MX Delivered direct to MX with OE headers 0.0 XPRIO Has X-Priority header 0.0 NO_FM_NAME_IP_HOSTN No From name + hostname using IP address

1 0

*SPAM* Your private information has been stolen because of suspicious events.
by nmc-wg＠ogf.org 30 Aug '23

30 Aug '23

Spam detection software, running on the system "mail.pglaf.org", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Greetings! Would like to introduce myself - I am a specialized hacker, and have succeeded in hacking your operating system. At this moment, I have obtained a complete access to account of yours. On top of that, [...] Content analysis details: (6.9 points, 4.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 3.0 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: date 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS 0.2 PDS_BTC_ID FP reduced Bitcoin ID 1.3 BITCOIN_DEADLINE BitCoin with a deadline 0.0 BITCOIN_SPAM_07 BitCoin spam pattern 07 0.4 BITCOIN_SPAM_02 BitCoin spam pattern 02 0.0 BITCOIN_TOEQFM Bitcoin + To same as From 0.0 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX 3.0 BITCOIN_YOUR_INFO BitCoin with your personal info 0.0 NO_FM_NAME_IP_HOSTN No From name + hostname using IP address

1 0

*SPAM* You have an outstanding payment.
by nmc-wg＠ogf.org 12 May '23

12 May '23

Spam detection software, running on the system "mail.pglaf.org", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Hello there! Unfortunately, there are some bad news for you. Around several months ago I have obtained access to your devices that you were using to browse internet. Subsequently, I have proceeded with tracking do [...] Content analysis details: (22.2 points, 4.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% [score: 0.4999] 1.6 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 1.4 PYZOR_CHECK Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/) -0.0 T_SCC_BODY_TEXT_LINE No description available. 0.0 HDR_ORDER_FTSDMCXX_NORDNS Header order similar to spam (FTSDMCXX/boundary variant) + no rDNS 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS 0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe 0.0 PDS_BTC_MSGID Bitcoin ID with T_MSGID_NOFQDN2 2.0 BITCOIN_XPRIO Bitcoin + priority 2.0 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1) 0.4 PDS_BTC_ID FP reduced Bitcoin ID 0.0 HDR_ORDER_FTSDMCXX_DIRECT Header order similar to spam (FTSDMCXX/boundary variant) + direct-to-MX 3.5 BITCOIN_SPAM_07 BitCoin spam pattern 07 0.3 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX 2.8 BITCOIN_YOUR_INFO BitCoin with your personal info 0.0 MIMEOLE_DIRECT_TO_MX MIMEOLE + direct-to-MX 2.0 BITCOIN_MALWARE BitCoin + malware bragging 2.5 DOS_OE_TO_MX Delivered direct to MX with OE headers 2.2 MALWARE_NORDNS Malware bragging + no rDNS 0.0 XPRIO Has X-Priority header 0.0 NO_FM_NAME_IP_HOSTN No From name + hostname using IP address

1 0

*SPAM* You have an outstanding payment.
by nmc-wg＠ogf.org 12 May '23

12 May '23

Spam detection software, running on the system "mail.pglaf.org", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Hello there! Unfortunately, there are some bad news for you. Around several months ago I have obtained access to your devices that you were using to browse internet. Subsequently, I have proceeded with tracking do [...] Content analysis details: (19.4 points, 4.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% [score: 0.5000] 0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or Generic rPTR 0.0 TVD_RCVD_IP Message was received from an IP address 1.6 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 1.4 PYZOR_CHECK Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/) -0.0 T_SCC_BODY_TEXT_LINE No description available. 0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe 1.9 STATIC_XPRIO_OLE Static RDNS + X-Priority + MIMEOLE 0.0 PDS_BTC_MSGID Bitcoin ID with T_MSGID_NOFQDN2 2.0 BITCOIN_XPRIO Bitcoin + priority 0.4 PDS_BTC_ID FP reduced Bitcoin ID 0.0 HDR_ORDER_FTSDMCXX_DIRECT Header order similar to spam (FTSDMCXX/boundary variant) + direct-to-MX 3.5 BITCOIN_SPAM_07 BitCoin spam pattern 07 0.3 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX 2.8 BITCOIN_YOUR_INFO BitCoin with your personal info 0.0 MIMEOLE_DIRECT_TO_MX MIMEOLE + direct-to-MX 2.0 BITCOIN_MALWARE BitCoin + malware bragging 2.5 DOS_OE_TO_MX Delivered direct to MX with OE headers 0.0 XPRIO Has X-Priority header 0.0 NO_FM_NAME_IP_HOSTN No From name + hostname using IP address

1 0

*SPAM* Settle your debt in order to avoid additional fees.
by nmc-wg＠ogf.org 11 Mar '23

11 Mar '23

Spam detection software, running on the system "mail.pglaf.org", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Dear user of ogf.org! I am a spyware software developer. Your account has been hacked by me couple months ago. The hacking was carried out using a hardware vulnerability through which you went online (Cisco router, vulnerability CVE-2023-20026). Content analysis details: (8.4 points, 4.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or Generic rPTR 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 1.6 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date 1.4 PYZOR_CHECK Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/) 1.0 RDNS_DYNAMIC Delivered to internal network by host with dynamic-looking rDNS 0.8 FSL_BULK_SIG Bulk signature with no Unsubscribe 0.0 PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC with FP steps 2.0 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1) 0.0 BITCOIN_XPRIO Bitcoin + priority 0.0 MIMEOLE_DIRECT_TO_MX MIMEOLE + direct-to-MX 1.0 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX 0.0 HDR_ORDER_FTSDMCXX_DIRECT Header order similar to spam (FTSDMCXX/boundary variant) + direct-to-MX 2.5 DOS_OE_TO_MX Delivered direct to MX with OE headers 0.0 XPRIO Has X-Priority header

1 0

*SPAM* Settle your debt in order to avoid additional fees.
by nmc-wg＠ogf.org 10 Mar '23

10 Mar '23

Spam detection software, running on the system "mail.pglaf.org", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Dear user of ogf.org! I am a spyware software developer. Your account has been hacked by me couple months ago. The hacking was carried out using a hardware vulnerability through which you went online (Cisco router, vulnerability CVE-2023-20026). Content analysis details: (6.3 points, 4.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or Generic rPTR 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 1.6 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date 1.4 PYZOR_CHECK Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/) 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS 0.8 FSL_BULK_SIG Bulk signature with no Unsubscribe 1.0 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX 0.0 HELO_MISC_IP Looking for more Dynamic IP Relays 2.6 MALWARE_NORDNS Malware bragging + no rDNS

1 0

*SPAM* Settle your debt in order to avoid additional fees.
by nmc-wg＠ogf.org 10 Mar '23

10 Mar '23

Spam detection software, running on the system "mail.pglaf.org", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Dear user of ogf.org! I am a spyware software developer. Your account has been hacked by me couple months ago. The hacking was carried out using a hardware vulnerability through which you went online (Cisco router, vulnerability CVE-2023-20026). Content analysis details: (9.1 points, 4.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 1.6 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date 1.4 PYZOR_CHECK Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/) 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS 0.8 FSL_BULK_SIG Bulk signature with no Unsubscribe 0.0 MIMEOLE_DIRECT_TO_MX MIMEOLE + direct-to-MX 1.0 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX 2.8 DOS_OUTLOOK_TO_MX Delivered direct to MX with Outlook headers 0.0 HELO_MISC_IP Looking for more Dynamic IP Relays 2.6 MALWARE_NORDNS Malware bragging + no rDNS

1 0

*SPAM* Settle your debt in order to avoid additional fees.
by nmc-wg＠ogf.org 08 Mar '23

08 Mar '23

Spam detection software, running on the system "mail.pglaf.org", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Dear user of ogf.org! I am a spyware software developer. Your account has been hacked by me couple months ago. The hacking was carried out using a hardware vulnerability through which you went online (Cisco router, vulnerability CVE-2023-20026). Content analysis details: (5.1 points, 4.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 TVD_RCVD_IP Message was received from an IP address 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 1.4 PYZOR_CHECK Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/) 1.0 RDNS_DYNAMIC Delivered to internal network by host with dynamic-looking rDNS 3.6 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr 2) 0.0 PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC with FP steps 1.0 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

1 0