Monthly Archives: October 2018

“Re: Your Office 365 Business Essentials Invoice is ready” phishing and “davidbrown.com”

Another day another bit of crap. This time an office 365 tenant has been sent what appears to be a simple phishing email but upon further inspection seems far more worrying. First worrying sign – the message had been sent … Continue reading

Posted in Uncategorized | Leave a comment

Scam tech support 0808 189 6146

It has been a while since I’ve come across one of these.. And here one pops up today.. Running from “ms-support-ge8gl.xyz” ( hxxps://ms-support-ge8gl.xyz/chroot/us/ch/ )and asking victims to call a UK freephone number of: “0808 189 6146” aka¬†08081896146 or +448081896146. The … Continue reading

Advertisement

Posted in Uncategorized | 1 Comment

Curious recon(?) or testing against downloads.

Unusual one.. Several IPs have been requesting a small download from my website every 30 minutes since 2018-10-01. The first ever request from that group of IPs was 2017-12-14 and then nothing until 2018-10-01! The requests appear to have stopped … Continue reading

Posted in Uncategorized | Leave a comment

Powershell command to enable Office 365 Mailbox Auditing across all users.

Again, another post pretty much for my reference. The command to enable auditing across all mailboxes is: Command has been taken from this excellent guide “1234n6: Investigating Office365 Account Compromise without the Activities API“.

Posted in Uncategorized | Leave a comment