SHARE
TWEET

#rs6.net_230919

VRad Sep 24th, 2019 (edited) 224 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #IOC #OptiData #VR #ConstantContact #fakelinks #malware #pshishing
  2.  
  3. https://pastebin.com/0hUMMPXG
  4.  
  5. FAQ:
  6. Energy Exemplar mailing was compromised to spread fake links.
  7. Possible payloads (links was deactivated after ~3,5 hours after sending)
  8.  
  9. #phish
  10. https://learningspanel.com/conference/draft-2020-form-w-4  
  11.  
  12. #exploitkit (404, Morphine kit)
  13. http://onevisionstudioslive.com/vendor
  14.  
  15. email headers
  16. - - - - - - -
  17. #1 (FAKE MESSAGE)
  18.  
  19. Received: from ccm32.constantcontact.com (unknown [208.75.123.228]) by srv88.victim0.org
  20.  
  21. Return-Path: APzC0+znmRnWTPLEYYxFWtA==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com
  22. Received: from [10.252.0.105] ([10.252.0.105:53122] helo=p2-jbemailsyndicator17.ctct.net)
  23.     by 10.249.244.10 (envelope-from <APzC0+znmRnWTPLEYYxFWtA==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com>)
  24.     (ecelerity 4.2.1.52273 r(Core:4.2.1.11)) with ESMTP id E1/E1-20094-4FCE88D5; Mon, 23 Sep 2019 12:04:04 -0400
  25.  
  26. DKIM-Signature: v=1; q=dns/txt; a=rsa-sha256; c=relaxed/relaxed; s=1000073432; d=auth.ccsend.com; h=date:mime-version:subject:X-Feedback-ID:message-id:from:reply-to:list-unsubscribe:list-unsubscribe-post:to; bh=libwEuIzP7KTVwql2GX5o97zx0GNJbnyG3rP1dbX7RI=; b=J968k+AB85c1H9Zq8elA6ogoTaePa14/9A91Q3wS4unrvt2cRGTwElHTk7d50X0rciBYHSsy69/k74xfjOy3s1TuYepqx8Mtbt2naCrU6Hc5BiwsB+FgWVSbbqamkWJbBp9/PDDQbhbiQESLj6gnGoFYN7Dk2bCZQl60uAkmE2g=
  27.  
  28. Message-ID: <1133275543606.1126347936227.1850531310.0.161203JL.2002@scheduler.constantcontact.com>
  29. Date: Mon, 23 Sep 2019 12:04:04 -0400 (EDT)
  30. From: Energy Exemplar <george.anderson@energyexemplar.com>
  31. Reply-To: george.anderson@energyexemplar.com
  32. To: user1@victim01.org
  33. Subject: Documents and Invoice for user1
  34.  
  35. X-Campaign-Activity-ID: 3f30b4fb-39e6-4675-933c-b118631156b4
  36. X-Channel-ID: 9184ae40-2dab-11e9-b9b1-d4ae529a8786
  37. X-Mailer: Roving Constant Contact 2012 (http://www.constantcontact.com)
  38. X-Return-Path-Hint: APzC0+znmRnWTPLEYYxFWtA==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com
  39. X-Roving-Campaignid: 1133275543606
  40. X-Roving-Id: 1126347936227.1850531310
  41. X-Feedback-ID: 9184ae40-2dab-11e9-b9b1-d4ae529a8786:3f30b4fb-39e6-4675-933c-b118631156b4:1126347936227:CTCT
  42. # # # # # # # # #
  43.  
  44. #2 (REAL MESSAGE)
  45.  
  46. Received: from ccm182.constantcontact.com (ccm182.constantcontact.com [208.75.123.182]) by srv88.victim0.org
  47.  
  48. Return-Path:    ATP5GyNHfRUijkfmh2SYXxQ==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com
  49. Received: from [10.252.0.107] ([10.252.0.107:44993] helo=p2-jbemailsyndicator22.ctct.net)
  50.     by 10.249.240.10 (envelope-from <ATP5GyNHfRUijkfmh2SYXxQ==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com>)
  51.     (ecelerity 4.2.38.62370 r(:)) with ESMTP id 3F/29-19489-88C198D5; Mon, 23 Sep 2019 15:27:04 -0400
  52.  
  53. DKIM-Signature: v=1; q=dns/txt; a=rsa-sha256; c=relaxed/relaxed; s=1000073432; d=auth.ccsend.com; h=date:mime-version:subject:X-Feedback-ID:message-id:from:reply-to:list-unsubscribe:list-unsubscribe-post:to; bh=qonukkQPz0sjMfWaGP/72tYBPJQcoq/5kZSIg4kCzxc=; b=YR0t/tI/yS7mraKMapBpoT3xU839daBRXv/PgSWYoHjXJ4J9Ycta6ISAPBi/sGiVW+RS3BQYap3Sbo/pm/G1+Wc7iT5/0cyo172DHxFActUk90PA4c1CswAo4V5RPfec5VdK0b17CeH4j5DNzPAMgHPYgsKIZae04NY/LGiTo/I=
  54.  
  55. Message-ID: <1133276817563.1126347936227.1850531310.0.221526JL.2002@scheduler.constantcontact.com>
  56. Date: Mon, 23 Sep 2019 15:27:04 -0400 (EDT)
  57. From: George Anderson <george.anderson@energyexemplar.com>
  58. Reply-To: george.anderson@energyexemplar.com
  59. To: user1@victim01.org
  60. Subject: Unannounced Email:  "Documents and Invoice"
  61.  
  62. X-Campaign-Activity-ID: 4cfe46c8-d1df-4548-a391-f9a1d92617c5
  63. X-Channel-ID: 9184ae40-2dab-11e9-b9b1-d4ae529a8786
  64. X-Mailer: Roving Constant Contact 2012 (http://www.constantcontact.com)
  65. X-Return-Path-Hint: ATP5GyNHfRUijkfmh2SYXxQ==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com
  66. X-Roving-Campaignid: 1133276817563
  67. X-Roving-Id: 1126347936227.1850531310
  68. X-Feedback-ID: 9184ae40-2dab-11e9-b9b1-d4ae529a8786:4cfe46c8-d1df-4548-a391-f9a1d92617c5:1126347936227:CTCT
  69. # # # # # # # # #
  70.  
  71. VR
  72.  
  73. @
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Top