[MASOCH-L] dominio super fraudulento

[Leandro]

Valeu Bruno!

Leandro
SPFBL.net

2017-07-13 14:10 GMT-03:00 Bruno Cabral <bruno at openline.com.br>:

> Desculpe, o link realmente não foi. Segue agora:
>
> http://atendimentos-sac.tmp.k8.com.br/
> ________________________________
> De: masoch-l <masoch-l-bounces at eng.registro.br> em nome de Leandro <
> leandro at spfbl.net>
> Enviado: quinta-feira, 13 de julho de 2017 13:05:56
> Para: Mail Aid and Succor, On-line Comfort and Help
> Assunto: Re: [MASOCH-L] dominio super fraudulento
>
> Bruno. Essa mensagem tem com algum link no corpo?
>
> Leandro
> SPFBL.net
>
> 2017-07-13 12:27 GMT-03:00 Bruno Cabral <bruno at openline.com.br>:
>
> > Tentando roubar dados do ML redecredauto at shared.mandic.net.br
> >
> >
> > Received: from BN3NAM04HT222.eop-NAM04.prod.protection.outlook.com
> >  (10.175.123.144) by BLUPR19MB0084.namprd19.prod.outlook.com with HTTPS
> > via
> >  BN6PR06CA0006.NAMPRD06.PROD.OUTLOOK.COM; Thu, 13 Jul 2017 15:09:05
> +0000
> > Received: from BN3NAM04FT053.eop-NAM04.prod.protection.outlook.com
> >  (10.152.92.54) by BN3NAM04HT222.eop-NAM04.prod.protection.outlook.com
> >  (10.152.92.211) with Microsoft SMTP Server (version=TLS1_2,
> >  cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1240.9; Thu,
> > 13
> >  Jul 2017 15:09:05 +0000
> > Authentication-Results: spf=pass (sender IP is 177.70.110.3)
> >  smtp.mailfrom=shared.mandic.net.br; openline.com.br; dkim=pass
> > (signature was
> >  verified) header.d=shared.mandic.net.br;openline.com.br;
> > dmarc=bestguesspass
> >  action=none header.from=shared.mandic.net.br;
> > Received-SPF: Pass (protection.outlook.com: domain of
> shared.mandic.net.br
> >  designates 177.70.110.3 as permitted sender)
> receiver=protection.outlook.
> > com;
> >  client-ip=177.70.110.3; helo= smtpshared-01.mandic.net.br;
> > Received: from BAY004-PAMC2F1.hotmail.com (10.152.92.52) by
> >  BN3NAM04FT053.mail.protection.outlook.com (10.152.93.2) with Microsoft
> > SMTP
> >  Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_
> 256_CBC_SHA384_P384)
> > id
> >  15.1.1240.9 via Frontend Transport; Thu, 13 Jul 2017 15:09:04 +0000
> > X-IncomingTopHeaderMarker: OriginalChecksum:
> 40AED2866790C0C84E42559DB31B6F
> > 2854E5257819218113B3016E64D0EC45AC;UpperCasedChecksum:
> > 637F30203A3A0A3BC08447D93FE82C310871F7EFDD3F579DC1286834A23E
> > CD7B;SizeAsReceived:1760;Count:14
> > Received: from smtpshared-01.mandic.net.br ([177.70.110.3]) by
> > BAY004-PAMC2F1.hotmail.com with Microsoft SMTPSVC(7.5.7601.23143);
> >      Thu, 13 Jul 2017 08:08:59 -0700
> > Received: by smtpshared-01.smtp.mandic.prv (Postfix, from userid 489)
> >     id 2965E40118B5; Thu, 13 Jul 2017 12:08:58 -0300 (BRT)
> > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
> >     d=shared.mandic.net.br; s=default; t=1499958538;
> >     bh=dkzPASfUPm55hz8G7CFLmEAIreddGea9GQiY54TT5vM=;
> >     h=From:To:Date:Subject;
> >     b=Dq8fs6TYB5Sp8gICtsKh3T1zyWmHwIkOGelhk+0IqApt2oT+1oRj18JWHvc93dskE
> >      kuyD4wJjBpvgAA/er63HY4+eLzxB/rmV4hRnR1BQapkDsr2hNafh/AFb/0aG1rUdC4
> >      HVJ6pKALAvYtKnxCJwZRuP5l3rG27W+TEXW2O538=
> > Received: from fj5d4h24 (unknown [186.221.85.249])
> >     by smtpshared-01.smtp.mandic.prv (Postfix) with ESMTPA id
> 6A7524011869
> >     for <bruno at openline.com.br>; Thu, 13 Jul 2017 12:08:57 -0300 (BRT)
> > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
> >     d=shared.mandic.net.br; s=default; t=1499958538;
> >     bh=dkzPASfUPm55hz8G7CFLmEAIreddGea9GQiY54TT5vM=;
> >     h=From:To:Date:Subject;
> >     b=Dq8fs6TYB5Sp8gICtsKh3T1zyWmHwIkOGelhk+0IqApt2oT+1oRj18JWHvc93dskE
> >      kuyD4wJjBpvgAA/er63HY4+eLzxB/rmV4hRnR1BQapkDsr2hNafh/AFb/0aG1rUdC4
> >      HVJ6pKALAvYtKnxCJwZRuP5l3rG27W+TEXW2O538=
> > From: "Mercado Livre" <redecredauto at shared.mandic.net.br>
> > To: "bruno at openline.com.br" <bruno at openline.com.br>
> > Date: Thu, 13 Jul 2017 12:08:50 -0300
> > Subject: Vamos suspender a sua conta
> > Content-Type: multipart/related; type="multipart/alternative";
> >     boundary="_=aspNetEmail=_57597afd90864eaa83908006c96ba06a"
> > Message-ID: <FJ5D4H24775b6c37473b4f3fbe65c79c3a10e3a7 at fj5d4h24>
> > Return-Path: redecredauto at shared.mandic.net.br
> > X-OriginalArrivalTime: 13 Jul 2017 15:08:59.0545 (UTC)
> > FILETIME=[F484A090:01D2FBE9]
> > X-IncomingHeaderCount: 14
> > X-MS-Exchange-Organization-Network-Message-Id: e41fc91c-6aee-4869-d70f-
> > 08d4ca011a82
> > X-EOPAttributedMessage: 0
> > X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
> > X-MS-Exchange-Organization-MessageDirectionality: Incoming
> > CMM-sender-ip: 177.70.110.3
> > CMM-sending-ip: 177.70.110.3
> > CMM-Authentication-Results: hotmail.com; spf=pass (sender IP is
> > 177.70.110.3)
> >  smtp.mailfrom=redecredauto at shared.mandic.net.br; dkim=pass
> >  header.d=shared.mandic.net.br; x-hmca=pass
> >  header.id=redecredauto at shared.mandic.net.br
> > CMM-X-SID-PRA: redecredauto at shared.mandic.net.br
> > CMM-X-AUTH-Result: PASS
> > CMM-X-SID-Result: PASS
> > CMM-X-Message-Status: n:n
> >
> >
> >
> > __
> > masoch-l list
> > https://eng.registro.br/mailman/listinfo/masoch-l
> >
> __
> masoch-l list
> https://eng.registro.br/mailman/listinfo/masoch-l
> __
> masoch-l list
> https://eng.registro.br/mailman/listinfo/masoch-l
>