Kompromitovan nalog minpolj.gov.rs šalje malver kao trezor.gov.rs

[milos_rs]

Još jedan header od drugog primaoca na drugom provajderu.

   

Mejl je stigao u inbox bez problema ni naznake da se radi o SPAM-u iako ga je našao u Spamhaus block listi:

Code:

X-Spam-Status: No, score=4.5, No
X-Spam-Score: 45
X-Spam-Bar: ++++
X-Ham-Report: Spam detection software, running on the system "cp22.ulimitserver.com",
    has NOT identified this incoming email as spam. The original
    message has been attached to this so you can view it or label
    similar future email. If you have any questions, see
    root\@localhost for details.
    Content preview: ***Ово је аутоматски генерисан имејл,
    на који не треба одговарати.*** ***За сва питања
    потребно је да се обратите [...]
    Content analysis details: (4.5 points, 5.0 required)
    pts rule name description
    ---- ---------------------- --------------------------------------------------
    0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query
    to zen.spamhaus.org was blocked due to
    usage of an open resolver. See
    https://www.spamhaus.org/returnc/pub/
    [195.222.96.34 listed in zen.spamhaus.org]
    1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
    bl.spamcop.net
    [Blocked - see <https://www.spamcop.net/bl.shtml?196.251.92.43>]
    -0.0 SPF_PASS SPF: sender matches SPF record
    1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of
    words
    0.0 HTML_MESSAGE BODY: HTML included in message
    0.0 HTML_IMAGE_RATIO_08 BODY: HTML has a low ratio of text to image
    area
    0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
    1.1 DCC_CHECK Detected as bulk mail by DCC (dcc-servers.net)
    0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The
    query to Validity was blocked. See
    https://knowledge.validity.com/hc/en-us/articles/20961730681243
    for more information.
    [195.222.96.34 listed in sa-accredit.habeas.com]
    0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The
    query to Validity was blocked. See
    https://knowledge.validity.com/hc/en-us/articles/20961730681243
    for more information.
    [195.222.96.34 listed in bl.score.senderscore.com]
    0.0 T_ISO_ATTACH ISO attachment - possible malware delivery
    0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict
    Alignment
    0.5 KAM_NUMSUBJECT Subject ends in numbers excluding current years
    0.3 TO_NO_BRKTS_HTML_IMG To: lacks brackets and HTML and one image
X-Spam-Flag: NO