0

I try to understand phishing email received from an attacker:

Received: ....

Received: ....

Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=; helo= envelope-from:attacker@infected_website.com;receiver=victim@legit_site.com

Received: from mout.gmx.com ( [])
     by  (Postfix) with ESMTPS id =
     for <victim@legit_site.com>; Mon, 10 Feb 2019 13:06:35 +0100 (CET)

Received: from [IP_SRC] ([IP_SRC]) by
     .... (via HTTP); Mon, 10 Feb 2019 13:06:33 +0100
Improve this question
1
  • 1
    Please do not vandalise your question in an attempt to remove personal information. The information is all still there in the edit history.
    – schroeder ♦
    Commented Sep 24, 2019 at 6:32

1 Answer 1

Reset to default
1

From the headers shared , the IP sending mail form GMX console is 74.208.4.XX, this pool of IP address belong to ISP: 1&1 Internet Inc.

There have been recent abuse(Spam) reports from this pool of IPs. Might be the tenent of the IP 74.208.4.xx is using GMX to send you the mails.

Request you to report to GMX and the ISP regarding this abuse.

There is a strong possibility that the IP 74.208.4.xx is compromised.

Improve this answer
1
  • It depends .If you need the reports dating back to 1.5 years. Please check in virustotal.com , otx.alienvault.com. These sites may have older reports.
    – nocut
    Commented Sep 5, 2019 at 21:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .