Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #IOC #OptiData #VR #ConstantContact #fakelinks #malware #pshishing
- https://pastebin.com/0hUMMPXG
- FAQ:
- Energy Exemplar mailing was compromised to spread fake links.
- Possible payloads (links was deactivated after ~3,5 hours after sending)
- #phish
- https://learningspanel.com/conference/draft-2020-form-w-4
- #exploitkit (404, Morphine kit)
- http://onevisionstudioslive.com/vendor
- email headers
- - - - - - - -
- #1 (FAKE MESSAGE)
- Received: from ccm32.constantcontact.com (unknown [208.75.123.228]) by srv88.victim0.org
- Return-Path: APzC0+znmRnWTPLEYYxFWtA==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com
- Received: from [10.252.0.105] ([10.252.0.105:53122] helo=p2-jbemailsyndicator17.ctct.net)
- by 10.249.244.10 (envelope-from <APzC0+znmRnWTPLEYYxFWtA==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com>)
- (ecelerity 4.2.1.52273 r(Core:4.2.1.11)) with ESMTP id E1/E1-20094-4FCE88D5; Mon, 23 Sep 2019 12:04:04 -0400
- DKIM-Signature: v=1; q=dns/txt; a=rsa-sha256; c=relaxed/relaxed; s=1000073432; d=auth.ccsend.com; h=date:mime-version:subject:X-Feedback-ID:message-id:from:reply-to:list-unsubscribe:list-unsubscribe-post:to; bh=libwEuIzP7KTVwql2GX5o97zx0GNJbnyG3rP1dbX7RI=; b=J968k+AB85c1H9Zq8elA6ogoTaePa14/9A91Q3wS4unrvt2cRGTwElHTk7d50X0rciBYHSsy69/k74xfjOy3s1TuYepqx8Mtbt2naCrU6Hc5BiwsB+FgWVSbbqamkWJbBp9/PDDQbhbiQESLj6gnGoFYN7Dk2bCZQl60uAkmE2g=
- Message-ID: <1133275543606.1126347936227.1850531310.0.161203JL.2002@scheduler.constantcontact.com>
- Date: Mon, 23 Sep 2019 12:04:04 -0400 (EDT)
- From: Energy Exemplar <george.anderson@energyexemplar.com>
- Reply-To: george.anderson@energyexemplar.com
- To: user1@victim01.org
- Subject: Documents and Invoice for user1
- X-Campaign-Activity-ID: 3f30b4fb-39e6-4675-933c-b118631156b4
- X-Channel-ID: 9184ae40-2dab-11e9-b9b1-d4ae529a8786
- X-Mailer: Roving Constant Contact 2012 (http://www.constantcontact.com)
- X-Return-Path-Hint: APzC0+znmRnWTPLEYYxFWtA==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com
- X-Roving-Campaignid: 1133275543606
- X-Roving-Id: 1126347936227.1850531310
- X-Feedback-ID: 9184ae40-2dab-11e9-b9b1-d4ae529a8786:3f30b4fb-39e6-4675-933c-b118631156b4:1126347936227:CTCT
- # # # # # # # # #
- #2 (REAL MESSAGE)
- Received: from ccm182.constantcontact.com (ccm182.constantcontact.com [208.75.123.182]) by srv88.victim0.org
- Return-Path: ATP5GyNHfRUijkfmh2SYXxQ==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com
- Received: from [10.252.0.107] ([10.252.0.107:44993] helo=p2-jbemailsyndicator22.ctct.net)
- by 10.249.240.10 (envelope-from <ATP5GyNHfRUijkfmh2SYXxQ==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com>)
- (ecelerity 4.2.38.62370 r(:)) with ESMTP id 3F/29-19489-88C198D5; Mon, 23 Sep 2019 15:27:04 -0400
- DKIM-Signature: v=1; q=dns/txt; a=rsa-sha256; c=relaxed/relaxed; s=1000073432; d=auth.ccsend.com; h=date:mime-version:subject:X-Feedback-ID:message-id:from:reply-to:list-unsubscribe:list-unsubscribe-post:to; bh=qonukkQPz0sjMfWaGP/72tYBPJQcoq/5kZSIg4kCzxc=; b=YR0t/tI/yS7mraKMapBpoT3xU839daBRXv/PgSWYoHjXJ4J9Ycta6ISAPBi/sGiVW+RS3BQYap3Sbo/pm/G1+Wc7iT5/0cyo172DHxFActUk90PA4c1CswAo4V5RPfec5VdK0b17CeH4j5DNzPAMgHPYgsKIZae04NY/LGiTo/I=
- Message-ID: <1133276817563.1126347936227.1850531310.0.221526JL.2002@scheduler.constantcontact.com>
- Date: Mon, 23 Sep 2019 15:27:04 -0400 (EDT)
- From: George Anderson <george.anderson@energyexemplar.com>
- Reply-To: george.anderson@energyexemplar.com
- To: user1@victim01.org
- Subject: Unannounced Email: "Documents and Invoice"
- X-Campaign-Activity-ID: 4cfe46c8-d1df-4548-a391-f9a1d92617c5
- X-Channel-ID: 9184ae40-2dab-11e9-b9b1-d4ae529a8786
- X-Mailer: Roving Constant Contact 2012 (http://www.constantcontact.com)
- X-Return-Path-Hint: ATP5GyNHfRUijkfmh2SYXxQ==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com
- X-Roving-Campaignid: 1133276817563
- X-Roving-Id: 1126347936227.1850531310
- X-Feedback-ID: 9184ae40-2dab-11e9-b9b1-d4ae529a8786:4cfe46c8-d1df-4548-a391-f9a1d92617c5:1126347936227:CTCT
- # # # # # # # # #
- VR
- @
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement