2

about 1-2 hours ago, I received 2 emails from postmaster@hotmail.com on my personal email with title "Delivery Status Notification (Failure)" and a body as such:

This is an automatically generated Delivery Status Notification.

Delivery to the following recipients failed.

   (email I never heard of)

The emails have 2 attachments: details.txt containing the following content:

Reporting-MTA: dns;SNT004-IMC1S8.hotmail.com Received-From-MTA: dns;SNT004-MC5F5.hotmail.com Arrival-Date: Fri, 2 Jun 2017 11:03:56 -0700

Final-Recipient: rfc822;(email I've never heard of) Action: failed Status: 5.5.0 Diagnostic-Code: smtp;550 Requested action not taken: mailbox unavailable (-506263085:397:0)

and an Outlook item called "You've Got Postcard" with login credentials for My Postcard.

Is this a known scam or malware attack? I use Outlook, and unfortunately it showed both emails in a preview window, which from what I understand is equally bad as directly opening the email with regards to potential for infection.


Update: the website that the "You've got Postcard" mail links to is wintergate dot com slash controlsk dot php (escaped to avoid accidental visits). One of the credentials (in case it helps) is kkrasa, Domain msn, Top Level Domain com (escaped to avoid spam) with password "BIZ" + "K7", so both quoted terms concatenated in this order without double quotes.

If anyone is interested in the direct HTML of the Postcard mail, it can be found at https://pastebin.com/twSL5v4a. I have already deleted the original email, so I cannot provide anything beyond this (this was in my Notepad++ cache).

3

Its a very common type of phishing. Most likely they have spoof your address as the sender (From: ) and might intentionally cause a bounce so you would get/open the emails.

You are correct in that it is as bad. This is specially true if the email is html encoded and it could be executing something malicious and you wouldn't even know it.

Your are always much safer in running outlook in plain text mode only and probably only load html emails from trusted sources. Your other option is since your using windows (most likely) cause its outlook, you could have your antivirus scan your emails to be safer.

Again though I would opt out to view emails in plain text just to be safe.

1

It's most likely plain phishing, potentially with an embedded beacon if the message contained HTML. Any images downloaded when viewing the message can be used by a spammer/scammer to verify they have sent mail to a working address. As takumi said, use plain text if it's available in your MTA, and disable previews and image loading.

You need to examine the mail headers to determine whether the message really originates from servers authorized to send on behalf of the address in your MTA's visible 'From' field. In cases like this (DSN, bounce notification, etc), I look at the chain of relays in the headers to make sure that the 'postmaster' really is the postmaster at the domain the message claims to be from. Microsoft signs messages with DKIM headers; these can also be used to determine validity. Your mail server (or that of your provider) should check this and use it as part of a spam checking process, but many don't. Post the headers if you'd like help reading them. Be aware of the implications -- if you don't want an 'attacker' knowing your address is yours and you read your email, don't post it here :)

If you are using OWA, it's possible that the preview message contents (and any remote images or other attachments) could have been retrieved by the webmail servers and relayed to you, at least preventing your IP from being revealed to the sender.

  • I had already configured my options to not automatically download images (or rather, not enabled automatic image download). The first email was plaintext. The second mail didn't appear to have any images in it, because A) it didn't show the message; B) I didn't see any broken image displays; C) I don't see anything bad in the email source. Still, is there something I can do to try and verify that nothing untoward happened? I could technically do the nuclear thing (clean install of Windows 10), but I'd rather avoid that since it'd mean cleaning my weekend. – Nzall Jun 2 '17 at 20:26
  • Further info: the second email had a link that according to the email source goes to a PHP page on a website that according to Google doesn't exist (wintergate dot com). I obviously didn't click it. – Nzall Jun 2 '17 at 20:30
  • I can't really offer a recommendation on satisfying your concerns about your computer being compromised. Google reports that site as malicious: google.com/transparencyreport/safebrowsing/diagnostic/… – Eli Heady Jun 2 '17 at 20:51
  • When I just tried to visit the site, Chrome let me know that Google identified the site as having phishing content, not as hosting malware, for what that is worth. – Eli Heady Jun 2 '17 at 20:52
  • I'd offer to look more into it, but the site is giving me a completely blank page. They are probably filtering and tailoring the content for different browsers and OSes. I don't have time at the moment to test that theory. – Eli Heady Jun 2 '17 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.