Monday, June 23, 2025

smsprefeiturasp - Phishing campaign

 



Original Email







Original Links

http://smsprefeiturasp.org/ 

https://listserver.slu.se/scripts/wa.exe

https://listserver.slu.se/scripts/wa.exe?TICKET=test&c=%3Cscript%3Evar%20i=%20%22?x=$amV3aGl0ZUBocnRyYW5zaXQub3Jn%22;eval




header information

Message-ID<0SY500KJEZ70ID61@submit-ad1-fd2-411-sa-saopaulo-1.rmtaad1.vcndpgru.oraclevcn.com>
SubjectBatch -55146550 | 06/20/2025 | 16:59:22
Mime-Version1.0
Content-Typemultipart/alternative; boundary=--==_mimepart_68559545a20ea_133e1041007f0
Authentication-Resultsspf=pass (sender IP is 192.29.134.127) smtp.mailfrom=gru1.rp.oracleemaildelivery.com; dkim=pass (signature was verified) header.d=gru1.rp.oracleemaildelivery.com;dmarc=none action=none header.from=smsprefeiturasp.org;compauth=none reason=404
Received-SPFPass (protection.outlook.com: domain of gru1.rp.oracleemaildelivery.com designates 192.29.134.127 as permitted sender) receiver=protection.outlook.com; client-ip=192.29.134.127; helo=aib29acd127.gru1.oracleemaildelivery.com; pr=C
DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; s=prod-gru-20200122; d=gru1.rp.oracleemaildelivery.com; h=Date:To:From:Subject:Message-Id:MIME-Version:Sender:List-Unsubscribe:List-Unsubscribe-Post; bh=IdV1k3abqlpI0cE9u0lir8PK57cTtLIfxLkgQJDiVdc=; b=NUBGopEfw1TqMLu+BiuiF3g73vO4M2N2WQT2uqIL9HoBbXNcLgLUDaTcJr7Oi9pw0e2WM8WnPPF4 1KNpKFB66VPsX2hrWDuTP+3zJ+oFmFkyc/8WLdd/jBrat3odPrHohik9BEjn+mN9EeDEKBKKMOso FkXJKoXWDvLRK+3Ijgv8FO5rhGDemV9iUCL3WWKWSEHTNUaKXRzu43jWDViqBcBJ/s/ROmQ4ZV1N H1WdFuehyB75CtNkNr2+fPxG8tKwM3NyS7ERptpwUrOrLwHfsHnq5IhsbffX+6MlBOhiEWHzhP5g SXl5jBvorgJi761K6S6m66/sg+H2kcCawec7lQ==
List-Unsubscribe-PostList-Unsubscribe=One-Click
X-Priority3
List-Unsubscribe<https://cell0.track.email.sa-saopaulo-1.oci.oraclecloud.com/20221014/track/unsubscribe?V=9&H=AAFuhJVJvnwpqr_oyTtwWI-JqfT_8SBGmwflF7iRz97QEwaCyZrFu69cGVNXL43mKmVIfPDm7jnli-A3TnXbgpYtKWMeozMskFfNlluixjo-OIyauCWStOQFftv1Y6V4boU9nQ0T_YEioIxMVcviGc8LMUnGJ6JyGNw2xnbC_kFvzwPxiaiAxqVTrldQnG_403s-2Fxz2n4T8yNGrI9e3nSkz2T1DZ5E_5XYwWbc2aJKj5dAo3nBTtJ1lO8G4DhcDHKIozcqtxeqDxYn3L8nVpvQVB8UmDMCgQJJ0XN4TG4XoutMCJMVA-RPdVpeCMFVT7Ibhu5qyVhDVN3gZX_frgnohhokLbcccILSTUTkRY20V5lA6KYzk4UVOxAefM8xVp8PlisMsGCffgcBHWK7Ba1jTLgVjIE>
Reporting-MetaAAEGFMy/bnvGbfLPZtyQkXItkFk8LWS4j8YyxxpIDmKBgEDTuR2n2a490JMwsao8 s+wHelmSwLU8apfpBe3xUrJ72nwl+Y5ramv0uUbZPOopNJoDViqf3TpsikXGz2fk +U4tFQTK4lo2IJ3NEYSJQcK8cJDVTeQVPE/eN2dulYtAtHRReJFqgr9t4Fuvg25r +K/0G5rbY2pQ5SsE/sO3MquuHsxTy8kIrV+D9qyLUVE4KtR6V0o+rOQiSewWmlqt FOc4S+jH9/tp4Fi4t60zLwhOwiXTxdaRk9w5g8O6/zR/djXOy8DbiSicuSwPcPS1 KNhXdjb+YtwPIQ+9+jaCxyeqfS/6hJCoV5oKTfNqB91qdi7SIRZ41wTiXtUfXxMj Z0IhP7ZRym7WUoN/vXFjvk2RPEaslARML0LNmlR1WGcfTEUfo4rr/+6bpYRG8khK oS9f2yGQgOuZBPQyI/S4Uzi6VVb/asnWQrY51HyLm3z/zZsO0t6NeqMKqj9GfC0x 0ZniB7kiQh3HEQDuPNpGFlgMIOqoOGfE0+ifKrnVzI8+NlbmWmnD
X-MS-Exchange-Organization-ExpirationStartTime20 Jun 2025 16:59:26.6750 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id61d7aa41-46cf-46f5-ace1-08ddb01bd098
X-EOPAttributedMessage0
X-EOPTenantAttributedMessage81c54995-1ea1-4e22-885b-ae3a6267a539:0
X-MS-Exchange-Organization-MessageDirectionalityIncoming
X-MS-PublicTrafficTypeEmail
X-MS-TrafficTypeDiagnosticBN2PEPF000055DD:EE_|MWHPR13MB6982:EE_|PH0PR13MB6043:EE_
X-MS-Exchange-Organization-AuthSourceBN2PEPF000055DD.namprd21.prod.outlook.com
X-MS-Exchange-Organization-AuthAsAnonymous
X-MS-Office365-Filtering-Correlation-Id61d7aa41-46cf-46f5-ace1-08ddb01bd098
X-MS-Exchange-AtpMessagePropertiesSA|SL
X-MS-Exchange-Organization-SCL1
X-Microsoft-AntispamBCL:3;ARA:13230040|4022899009|5062899012|2092899012|3072899012|3092899012|12012899012|5133199007|8096899003|7053199007;
X-Forefront-Antispam-ReportCIP:192.29.134.127;CTRY:BR;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:aib29acd127.gru1.oracleemaildelivery.com;PTR:aib29acd127.gru1.oracleemaildelivery.com;CAT:NONE;SFTY:9.25;SFS:(13230040)(4022899009)(5062899012)(2092899012)(3072899012)(3092899012)(12012899012)(5133199007)(8096899003)(7053199007);DIR:INB;SFTY:9.25;
X-MS-Exchange-CrossTenant-OriginalArrivalTime20 Jun 2025 16:59:26.3061 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id61d7aa41-46cf-46f5-ace1-08ddb01bd098
X-MS-Exchange-CrossTenant-Id81c54995-1ea1-4e22-885b-ae3a6267a539
X-MS-Exchange-CrossTenant-AuthSourceBN2PEPF000055DD.namprd21.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAsAnonymous
X-MS-Exchange-CrossTenant-FromEntityHeaderInternet
X-MS-Exchange-Transport-CrossTenantHeadersStampedMWHPR13MB6982
X-MS-Exchange-Transport-EndToEndLatency00:00:20.3903248
X-MS-Exchange-Processed-By-BccFoldering15.20.8857.014

No comments:

Post a Comment

Qualitative vs. Quantitative Risk Assessment

  Qualitative vs. Quantitative Risk Assessment Feature Qualitative Risk Assessment Quantitative Risk Assessment Method Uses descriptive, unc...