Return to Question

I try to understand phishing email received from an attacker:

Received: ....

Received: ....

Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=74.208.4.XX; helo=mout.gmx.com; envelope-from:attacker@infected_website.com;receiver=victim@legit_site.com

Received: from mout.gmx.com (mout.gmx.com [74.208.4.XX])
     by in14.mail.ovh.net (Postfix) with ESMTPS id 26F1621CXX
     for <victim@legit_site.com>; Mon, 10 Feb 2019 13:06:35 +0100 (CET)

Received: from [IP_SRC] ([IP_SRC]) by
     3c-app-mailcom.... (via HTTP); Mon, 10 Feb 2019 13:06:33 +0100

I think the attacker has sent the mail from his GMX account via GMX web interface. But the envelope-from contains another address (not gmx email address) where the host is corrupted (infected website) and the user is spoofed. I do not think gmx could allow this.

I try to understand phishing email received from an attacker:

Received: ....

Received: ....

Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=; helo= envelope-from:attacker@infected_website.com;receiver=victim@legit_site.com

Received: from mout.gmx.com ( [])
     by  (Postfix) with ESMTPS id =
     for <victim@legit_site.com>; Mon, 10 Feb 2019 13:06:35 +0100 (CET)

Received: from [IP_SRC] ([IP_SRC]) by
     .... (via HTTP); Mon, 10 Feb 2019 13:06:33 +0100

Since I have posted here a question about phishing, I have receive phishing message on my email adress related to my security.stackexchange account (let me laugh).... And I CANNOT DELETE THIS QUESTION!!!

Stay alert when you ask a question here, because I put a minimum of info and in the end it did not prevent to make an attempt by referring to the minimum info: my country, servers IP address and my address related to this account .

I try to understand phishing email received from an attacker:

Received: ....

Received: ....

Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=74.208.4.XX; helo=mout.gmx.com; envelope-from:attacker@infected_website.com;receiver=victim@legit_site.com

Received: from mout.gmx.com (mout.gmx.com [74.208.4.XX])
     by in14.mail.ovh.net (Postfix) with ESMTPS id 26F1621CXX
     for <victim@legit_site.com>; Mon, 10 Feb 2019 13:06:35 +0100 (CET)

Received: from [IP_SRC] ([IP_SRC]) by
     3c-app-mailcom.... (via HTTP); Mon, 10 Feb 2019 13:06:33 +0100

I think the attacker has sent the mail from his GMX account via GMX web interface. But the envelope-from contains another address (not gmx email address) where the host is corrupted (infected website) and the user is spoofed. I do not think gmx could allow this.

Since I have posted here a question about phishing, I have receive phishing message on my email adress related to my security.stackexchange account (let me laugh).... And I CANNOT DELETE THIS QUESTION!!!

This small gamer send me: https://germanski.cmail20.com and redirect to https://ovh-fr.com ,

yes ovh com from HERE !

Stay alert when you ask a question here, because I put a minimum of info and in the end it did not prevent to make an attempt by referring to the minimum info: my country, servers IP address and my address related to this account .

Since I have posted here a question about phishing, I have receive phishing message on my email adress related to my security.stackexchange account (let me laugh).... And I CANNOT DELETE THIS QUESTION!!!

Stay alert when you ask a question here, because I put a minimum of info and in the end it did not prevent to make an attempt by referring to the minimum info: my country, servers IP address and my address related to this account .