[MASOCH-L] dominio super fraudulento

[Leandro]

Bruno. Essa mensagem tem com algum link no corpo?

Leandro
SPFBL.net

2017-07-13 12:27 GMT-03:00 Bruno Cabral <bruno at openline.com.br>:

> Tentando roubar dados do ML redecredauto at shared.mandic.net.br
>
>
> Received: from BN3NAM04HT222.eop-NAM04.prod.protection.outlook.com
>  (10.175.123.144) by BLUPR19MB0084.namprd19.prod.outlook.com with HTTPS
> via
>  BN6PR06CA0006.NAMPRD06.PROD.OUTLOOK.COM; Thu, 13 Jul 2017 15:09:05 +0000
> Received: from BN3NAM04FT053.eop-NAM04.prod.protection.outlook.com
>  (10.152.92.54) by BN3NAM04HT222.eop-NAM04.prod.protection.outlook.com
>  (10.152.92.211) with Microsoft SMTP Server (version=TLS1_2,
>  cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1240.9; Thu,
> 13
>  Jul 2017 15:09:05 +0000
> Authentication-Results: spf=pass (sender IP is 177.70.110.3)
>  smtp.mailfrom=shared.mandic.net.br; openline.com.br; dkim=pass
> (signature was
>  verified) header.d=shared.mandic.net.br;openline.com.br;
> dmarc=bestguesspass
>  action=none header.from=shared.mandic.net.br;
> Received-SPF: Pass (protection.outlook.com: domain of shared.mandic.net.br
>  designates 177.70.110.3 as permitted sender) receiver=protection.outlook.
> com;
>  client-ip=177.70.110.3; helo= smtpshared-01.mandic.net.br;
> Received: from BAY004-PAMC2F1.hotmail.com (10.152.92.52) by
>  BN3NAM04FT053.mail.protection.outlook.com (10.152.93.2) with Microsoft
> SMTP
>  Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384)
> id
>  15.1.1240.9 via Frontend Transport; Thu, 13 Jul 2017 15:09:04 +0000
> X-IncomingTopHeaderMarker: OriginalChecksum:40AED2866790C0C84E42559DB31B6F
> 2854E5257819218113B3016E64D0EC45AC;UpperCasedChecksum:
> 637F30203A3A0A3BC08447D93FE82C310871F7EFDD3F579DC1286834A23E
> CD7B;SizeAsReceived:1760;Count:14
> Received: from smtpshared-01.mandic.net.br ([177.70.110.3]) by
> BAY004-PAMC2F1.hotmail.com with Microsoft SMTPSVC(7.5.7601.23143);
>      Thu, 13 Jul 2017 08:08:59 -0700
> Received: by smtpshared-01.smtp.mandic.prv (Postfix, from userid 489)
>     id 2965E40118B5; Thu, 13 Jul 2017 12:08:58 -0300 (BRT)
> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
>     d=shared.mandic.net.br; s=default; t=1499958538;
>     bh=dkzPASfUPm55hz8G7CFLmEAIreddGea9GQiY54TT5vM=;
>     h=From:To:Date:Subject;
>     b=Dq8fs6TYB5Sp8gICtsKh3T1zyWmHwIkOGelhk+0IqApt2oT+1oRj18JWHvc93dskE
>      kuyD4wJjBpvgAA/er63HY4+eLzxB/rmV4hRnR1BQapkDsr2hNafh/AFb/0aG1rUdC4
>      HVJ6pKALAvYtKnxCJwZRuP5l3rG27W+TEXW2O538=
> Received: from fj5d4h24 (unknown [186.221.85.249])
>     by smtpshared-01.smtp.mandic.prv (Postfix) with ESMTPA id 6A7524011869
>     for <bruno at openline.com.br>; Thu, 13 Jul 2017 12:08:57 -0300 (BRT)
> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
>     d=shared.mandic.net.br; s=default; t=1499958538;
>     bh=dkzPASfUPm55hz8G7CFLmEAIreddGea9GQiY54TT5vM=;
>     h=From:To:Date:Subject;
>     b=Dq8fs6TYB5Sp8gICtsKh3T1zyWmHwIkOGelhk+0IqApt2oT+1oRj18JWHvc93dskE
>      kuyD4wJjBpvgAA/er63HY4+eLzxB/rmV4hRnR1BQapkDsr2hNafh/AFb/0aG1rUdC4
>      HVJ6pKALAvYtKnxCJwZRuP5l3rG27W+TEXW2O538=
> From: "Mercado Livre" <redecredauto at shared.mandic.net.br>
> To: "bruno at openline.com.br" <bruno at openline.com.br>
> Date: Thu, 13 Jul 2017 12:08:50 -0300
> Subject: Vamos suspender a sua conta
> Content-Type: multipart/related; type="multipart/alternative";
>     boundary="_=aspNetEmail=_57597afd90864eaa83908006c96ba06a"
> Message-ID: <FJ5D4H24775b6c37473b4f3fbe65c79c3a10e3a7 at fj5d4h24>
> Return-Path: redecredauto at shared.mandic.net.br
> X-OriginalArrivalTime: 13 Jul 2017 15:08:59.0545 (UTC)
> FILETIME=[F484A090:01D2FBE9]
> X-IncomingHeaderCount: 14
> X-MS-Exchange-Organization-Network-Message-Id: e41fc91c-6aee-4869-d70f-
> 08d4ca011a82
> X-EOPAttributedMessage: 0
> X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
> X-MS-Exchange-Organization-MessageDirectionality: Incoming
> CMM-sender-ip: 177.70.110.3
> CMM-sending-ip: 177.70.110.3
> CMM-Authentication-Results: hotmail.com; spf=pass (sender IP is
> 177.70.110.3)
>  smtp.mailfrom=redecredauto at shared.mandic.net.br; dkim=pass
>  header.d=shared.mandic.net.br; x-hmca=pass
>  header.id=redecredauto at shared.mandic.net.br
> CMM-X-SID-PRA: redecredauto at shared.mandic.net.br
> CMM-X-AUTH-Result: PASS
> CMM-X-SID-Result: PASS
> CMM-X-Message-Status: n:n
>
>
>
> __
> masoch-l list
> https://eng.registro.br/mailman/listinfo/masoch-l
>