The following spear-phishing attack was sent out in our name to a business partner:
109.199.96.223 is entered in the DNS TXT record
https://www.shodan.io/host/109.199.96.223
From: Michaela Friedl [mailto:rechnung@finanz-department.com]
Sent: Monday, 16 June 2025 10:15
To: Service MB-Baumdienste service@mb-baumdienste.de
Subject: Clarification of outstanding and future invoices
Dear Sir or Madam,
Because of some technical issues, we currently have no access to our outstanding invoices. We kindly ask you to confirm whether any invoices are still open and, if so, to send them to us in PDF format so that we can review them before payment.
In addition, we would appreciate it if you could also forward any future invoices that still need to be issued, so that we can schedule them in our payment system.
We look forward to your prompt reply.
Thank you in advance for your cooperation.
Kind regards,
Michaela Friedl
Accountant | Financial Accounting
Stadtwerke Idstein
Rheingau-Taunus District
Germany
Reference: 144084-2025
