I've been having a recurring problem at work: My boss's contacts keep receiving emails with links sent by a fake adress. The adress always has my boss's name + a different domain name every time. Example: MyBossName@DifferentDomainEverytime
The links in the emails are always existing domain name + something.php. For example : www.ExistingDomain.com/example.php
This has been happening almost weekly. Everytime, I check the fake emails' headers and the IP addresses found in them. So far, I've found very different origins / transit points for those fake emails: Japan, USA, Germany, Saudi Arabia, Morocco, Indonesia, etc. It's never the same.
My questions are:
What could be causing those fake emails? Is it a known bot? A virus my boss got that copied his contacts? Or someone that is messing with him?
No doubt a very naive question: what's the purpose of sending those emails? Just to keep bothering people? The links in the emails don't direct to unsafe websites, clicking on them doesn't launch the download of a malware, etc.
How do we deal with this problem? I've got the IPs, but what do I do with them? Any idea on how to make those fake emails stop?