Monthly Archives: October 2018

Another day another bit of crap. This time an office 365 tenant has been sent what appears to be a simple phishing email but upon further inspection seems far more worrying. First worrying sign – the message had been sent … Continue reading →

It has been a while since I’ve come across one of these.. And here one pops up today.. Running from “ms-support-ge8gl.xyz” ( hxxps://ms-support-ge8gl.xyz/chroot/us/ch/ )and asking victims to call a UK freephone number of: “0808 189 6146” aka 08081896146 or +448081896146. The … Continue reading →

Unusual one.. Several IPs have been requesting a small download from my website every 30 minutes since 2018-10-01. The first ever request from that group of IPs was 2017-12-14 and then nothing until 2018-10-01! The requests appear to have stopped … Continue reading →

Again, another post pretty much for my reference. The command to enable auditing across all mailboxes is: Command has been taken from this excellent guide “1234n6: Investigating Office365 Account Compromise without the Activities API“.