[nsp-sec] Mailbox squash for info.lt?

[Marius Urkis]

Sent sanitized information to appropriate ISP

On 2010.09.16 18:34, Keith Schoenefeld wrote:
> ----------- nsp-security Confidential --------
>
> A department at our university was spearphished yesterday evening.
> The reply-to address is:
>
> helpdesk.support1 at info.lt
>
> MX looks to be:
> info.lt.		5793	IN	MX	10 sm.cs.microlink.lt.
>
> sm.cs.microlink.lt resolves to 92.61.44.90.
>
> 47205   | 92.61.44.90      | HOSTEX HOSTEX autonomous system
>
> The message, though it had poor grammar, was very specific for a
> department on campus, listed individuals by name, etc. and was
> otherwise very convincing -- any help in squashing this would be
> appreciated.
>
> -- KS
>
>    
--
Marius