Seen it at least twice in a few weeks at two different companies. The IP has over 10k DNS records. Apache server lots of open ports ssh, ftp, etc. Typically comes in as a 0365 looking email with a clickable link. Please let me know if you have ran into this, and what is does. Would like to sandbox it but have not had the opportunity yet.