Kompromitovan jedan ipc.rs mejl nalog i korišćen za malware spam
#1

mejl:

   

Headeri:

Code:
Received: from DB8PR03CA0001.eurprd03.prod.outlook.com (2603:10a6:10:be::14) by DB8P189MB0828.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:12b::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6954.29; Tue, 7 Nov 2023 10:08:48 +0000 Received: from DB5PEPF00014B9A.eurprd02.prod.outlook.com (2603:10a6:10:be:cafe::7) by DB8PR03CA0001.outlook.office365.com (2603:10a6:10:be::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6954.28 via Frontend Transport; Tue, 7 Nov 2023 10:08:48 +0000 Authentication-Results: spf=none (sender IP is 94.127.6.167) smtp.mailfrom=sbarlbaink.com; dkim=pass (signature was verified) header.d=ipc.rs;dmarc=pass action=none header.from=ipc.rs;compauth=pass reason=100 Received-SPF: None (protection.outlook.com: sbarlbaink.com does not designate permitted sender hosts) Received: from cpanel.ipc.rs (94.127.6.167) by DB5PEPF00014B9A.mail.protection.outlook.com (10.167.8.167) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6977.16 via Frontend Transport; Tue, 7 Nov 2023 10:08:47 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ipc.rs; s=default; h=Content-Type:Message-ID:Subject:To:From:Date:MIME-Version:Sender :Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=cZYkLnjNKNjW2c5YJgNtFJml+ZsE54de7jAf44FwRYE=; b=OTlP2ucYm/N8RB5/3y4xWZivWw Lddyq029fy8rkIi1Wt1NDGQb/JWvLMtymoLsIWhgPQXlNi9ryXFkP2q5/aO1M0Pbl1sqrY8lc3zVL vt+ji3FrYGrvZh7OT2ibADoUv1WcHq9lglyW1Sme+wzPUGTpmtxBZT2sbuhFAJHzxPg9Tv8DABuP+ CtJxjr4JLBUmoAFjhKxnsU05IA42JcrdQaRwWjosX0GeZ2f3O2GnYGg7WB1TcVllswBygo3/YhKDX 7LR6NIUVUuClWB2hCmQSywDRRzaQyc1t56caZFLsubgjO1i4pRKf+mx/qpwRf3pwxWz8Bk3g/ezK5 v460icpA==; Received: from [127.0.0.1] (port=35078 helo=cpanel.ipc.rs) by cpanel.ipc.rs with esmtpa (Exim 4.93) (envelope-from <[email protected]>) id 1r0Ivl-00025E-47; Tue, 07 Nov 2023 11:03:33 +0100 MIME-Version: 1.0 Date: Tue, 07 Nov 2023 11:03:32 +0100 From: Sberbank <[email protected]> To: undisclosed-recipients:; Subject: =?UTF-8?Q?Mese=C4=8Dni_izvod_za_kreditnu_karticu?= Message-ID: <[email protected]> X-Sender: [email protected] User-Agent: Roundcube Webmail/1.3.15 Content-Type: multipart/mixed; boundary="=_a74b6febc5bfd849d1f46873c077ec56" X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - cpanel.ipc.rs X-AntiAbuse: Original Domain - XXXXXXX X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - sbarlbaink.com X-Get-Message-Sender-Via: cpanel.ipc.rs: authenticated_id: [email protected] X-Authenticated-Sender: cpanel.ipc.rs: [email protected] X-Source: X-Source-Args: X-Source-Dir: X-From-Rewrite: rewritten was: [[email protected]], actual sender does not match Return-Path: [email protected]

Za attachment virustotal se upalio ko božićna jelka: https://www.virustotal.com/gui/file/9924...a00777ef06
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)