Kompromitovan jedan ipc.rs mejl nalog i korišćen za malware spam
#1
mejl:

   

Headeri:

Code:
Received: from DB8PR03CA0001.eurprd03.prod.outlook.com (2603:10a6:10:be::14)
by DB8P189MB0828.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:12b::24) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6954.29; Tue, 7 Nov
2023 10:08:48 +0000
Received: from DB5PEPF00014B9A.eurprd02.prod.outlook.com
(2603:10a6:10:be:cafe::7) by DB8PR03CA0001.outlook.office365.com
(2603:10a6:10:be::14) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6954.28 via Frontend
Transport; Tue, 7 Nov 2023 10:08:48 +0000
Authentication-Results: spf=none (sender IP is 94.127.6.167)
smtp.mailfrom=sbarlbaink.com; dkim=pass (signature was verified)
header.d=ipc.rs;dmarc=pass action=none header.from=ipc.rs;compauth=pass
reason=100
Received-SPF: None (protection.outlook.com: sbarlbaink.com does not designate
permitted sender hosts)
Received: from cpanel.ipc.rs (94.127.6.167) by
DB5PEPF00014B9A.mail.protection.outlook.com (10.167.8.167) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.6977.16 via Frontend Transport; Tue, 7 Nov 2023 10:08:47 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ipc.rs;
    s=default; h=Content-Type:Message-ID:Subject:To:From:Date:MIME-Version:Sender
    :Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description:
    Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
    In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:
    List-Post:List-Owner:List-Archive;
    bh=cZYkLnjNKNjW2c5YJgNtFJml+ZsE54de7jAf44FwRYE=; b=OTlP2ucYm/N8RB5/3y4xWZivWw
    Lddyq029fy8rkIi1Wt1NDGQb/JWvLMtymoLsIWhgPQXlNi9ryXFkP2q5/aO1M0Pbl1sqrY8lc3zVL
    vt+ji3FrYGrvZh7OT2ibADoUv1WcHq9lglyW1Sme+wzPUGTpmtxBZT2sbuhFAJHzxPg9Tv8DABuP+
    CtJxjr4JLBUmoAFjhKxnsU05IA42JcrdQaRwWjosX0GeZ2f3O2GnYGg7WB1TcVllswBygo3/YhKDX
    7LR6NIUVUuClWB2hCmQSywDRRzaQyc1t56caZFLsubgjO1i4pRKf+mx/qpwRf3pwxWz8Bk3g/ezK5
    v460icpA==;
Received: from [127.0.0.1] (port=35078 helo=cpanel.ipc.rs)
    by cpanel.ipc.rs with esmtpa (Exim 4.93)
    (envelope-from <[email protected]>)
    id 1r0Ivl-00025E-47; Tue, 07 Nov 2023 11:03:33 +0100
MIME-Version: 1.0
Date: Tue, 07 Nov 2023 11:03:32 +0100
From: Sberbank <[email protected]>
To: undisclosed-recipients:;
Subject: =?UTF-8?Q?Mese=C4=8Dni_izvod_za_kreditnu_karticu?=
Message-ID: <[email protected]>
X-Sender: [email protected]
User-Agent: Roundcube Webmail/1.3.15
Content-Type: multipart/mixed;
boundary="=_a74b6febc5bfd849d1f46873c077ec56"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - cpanel.ipc.rs
X-AntiAbuse: Original Domain - XXXXXXX
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - sbarlbaink.com
X-Get-Message-Sender-Via: cpanel.ipc.rs: authenticated_id: [email protected]
X-Authenticated-Sender: cpanel.ipc.rs: [email protected]
X-Source:
X-Source-Args:
X-Source-Dir:
X-From-Rewrite: rewritten was: [[email protected]], actual sender does not match
Return-Path: [email protected]

Za attachment virustotal se upalio ko božićna jelka: https://www.virustotal.com/gui/file/9924...a00777ef06
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)