0

I try to understand phishing email received from an attacker:

Received: ....

Received: ....

Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=; helo= envelope-from:attacker@infected_website.com;receiver=victim@legit_site.com

Received: from mout.gmx.com ( [])
     by  (Postfix) with ESMTPS id =
     for <victim@legit_site.com>; Mon, 10 Feb 2019 13:06:35 +0100 (CET)

Received: from [IP_SRC] ([IP_SRC]) by
     .... (via HTTP); Mon, 10 Feb 2019 13:06:33 +0100
1
  • 1
    Please do not vandalise your question in an attempt to remove personal information. The information is all still there in the edit history. – schroeder Sep 24 '19 at 6:32
1

From the headers shared , the IP sending mail form GMX console is 74.208.4.XX, this pool of IP address belong to ISP: 1&1 Internet Inc.

There have been recent abuse(Spam) reports from this pool of IPs. Might be the tenent of the IP 74.208.4.xx is using GMX to send you the mails.

Request you to report to GMX and the ISP regarding this abuse.

There is a strong possibility that the IP 74.208.4.xx is compromised.

1
  • It depends .If you need the reports dating back to 1.5 years. Please check in virustotal.com , otx.alienvault.com. These sites may have older reports. – nocut Sep 5 '19 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.