Jos e-mailissa lukee, että sen sisältö on virustarkistettu se ei merkitse yhtään mitään. ÄLÄ KOSKE LIITTEESEEN. Mm. PDF tiedosto saattaa sisältää haittaohjelman. Katso myös sivun alaosasta jatkoa tälle spämmille.
DOMANNIMITIEDUSTELU KERTOO:
domain: uff.br
owner: UNIVERSIDADE FEDERAL FLUMINENSE
ownerid: 28.523.215/0001-06
responsible: Michael Anthony Stanton
Kun lähetin herra Michael Anthony Stantononille huomautuksen tästä spämmipostista, kirje palasi varoituksella, että se sisälsi viruksen. Kuitenkin minun kirjeessäni oli ainoastaan e-mailin header osuus ja siinä tuskin voi olla virusta. Jos joku löytää lähetetystä headerista tai sen palautuskoodista viruksen, olisin kiitollinen tiedosta. Ensin on kaappaus palautuneesta postista.
--------------------------TÄMÄN LÄHETIN ilman PDF koodia joka oli jatkona--------------------------
This scam came from your server. Source with header included.
I deleted the PDF because it is possibly very harmfull.
You may see from your server log who has got this e-mail scam. Please warn them.
Yours: Hannu Kuukkanen
Wed, 14 Feb 2018 08:22:05 +0200 (EET)
Received: from mta.uff.br (mail.uff.br [200.20.0.16])
by smtphost2.uff.br (Postfix) with ESMTP id 0E63967027;
Wed, 14 Feb 2018 04:16:21 -0200 (BRST)
Received: from User (unknown [197.242.108.75])
(Authenticated sender: sgg@vm.uff.br)
by mta.uff.br (Postfix) with ESMTPA id 3B57B205DA;
Wed, 14 Feb 2018 04:11:07 -0200 (BRST)
From: "Mega International"<sgg@vm.uff.br>
Subject: Ref: 1972874
Date: Wed, 14 Feb 2018 06:21:35 -0000
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0027_01C2A9A6.4201FFAC"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-NTi-UFF-MailScanner-ID: 3B57B205DA.AAAA7
X-NTi-UFF-MailScanner: Found to be clean
X-NTi-UFF-MailScanner-From: sgg@vm.uff.br
X-Spam-Status: No
Message-Id: <20180214061621.0E63967027@smtphost2.uff.br>
To: undisclosed-recipients:;
This is a multi-part message in MIME format.
------=_NextPart_000_0027_01C2A9A6.4201FFAC
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
--
Esta mensagem foi verificada pelo sistema de antivírus e
acredita-se estar livre de perigo.
------=_NextPart_000_0027_01C2A9A6.4201FFAC
Content-Type: application/octet-stream;
name="Mega Internationals.pdf"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="Mega Internationals.pdf"
--
Hannu Kuukkanen
040 720 6432
hannu.kuukkanen@webcag.fi
------------------------JA TÄMÄ SAAPUI BUMERANGINA-----------------------
-koodi on lisääntynyt huomattavasti, siinä ei kuitenkaan ole edelleenkään PDF:ää mukana-
-------------"Known virus detected", saattaa viitata ehkä PDF tiedoston nimeen?-------------
Reporting-MTA: dns; googlemail.com Received-From-MTA: dns; hannu.kuukkanen@elisanet.fi Arrival-Date: Fri, 24 Aug 2018 00:54:03 -0700 (PDT) X-Original-Message-ID: <482d78bf-4e11-a159-18a6-5fe46645d68d@elisanet.fi> Final-Recipient: rfc822; michael@rnp.br Action: failed Status: 5.7.1 Remote-MTA: dns; mx0.rnp.br. (200.130.35.135, the server for the domain rnp.br.) Diagnostic-Code: smtp; 554 5.7.1 Known virus detected in message: winnow.spam.ts.xmailer.2.UNOFFICIAL Last-Attempt-Date: Fri, 24 Aug 2018 01:20:17 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-original-authentication-results:x-gm-message-state:to:from
:subject:message-id:date:user-agent:mime-version
:content-transfer-encoding:content-language:delivered-to;
bh=VA7sX419ok1ShgPGAbg2oPhbDxzm7VV5GOwWusjDNCQ=;
b=OSBMF0lX1tVN889ENRPSy+bmpWUmrdZc6saOS0gdiKQVZ0BsKOC78D/kBB1FnxPgEf
e801e8XAwxcnz4C01cg1NIFKwNMwGjs714IqOShqwfhqfWoSyYIBkzdQl9NS20iPn9Fq
Fi4bqhwn1gVDwh1iEkpOGOXzknLxBD17bV0o8isOMFTEtx14bfgvpJOlT2S9QjrMgqqL
Hwjbv1sdnAXupbzmabKnGeUKuCDMU0ztnYJaS5smOypMxziOI9bzbv7OSYqTjsg2c5Nh
4YgXaNSSPu1T5MLiBshEtLATT+QvE0wSXAXnGJNeblWqJrRnVdnNzWDv9+Gq33PRzt9J
kBYQ==
X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of hannu.kuukkanen@elisanet.fi designates 62.142.117.202 as permitted sender) smtp.mailfrom=hannu.kuukkanen@elisanet.fi
X-Gm-Message-State: APzg51CGOXJuJ9suDW/dCc5e5Lahf4lWnngLkMy3lSR3uaAfSzfGrxoP
TxGaIwb1l4smS+j4tZtAoz4xs5ske69+srNJp+RbrsvP6+itCarOu6Z4ApqwGnfdE9BemyrQhKZ
HEjqbPn+5ld9jxx1OnQPaRfzUzlVef4dq
X-Received: by 2002:a19:d484:: with SMTP id l126-v6mr527716lfg.28.1535097244541;
Fri, 24 Aug 2018 00:54:04 -0700 (PDT)
X-Google-Smtp-Source: ANB0VdZVA5FLXBreBz3WpRAl8gh9nSIYOO6EFjBGczLNwounglEFMs3MfwW2FU0bRAla61z7a5Kh
X-Received: by 2002:a19:d484:: with SMTP id l126-v6mr527653lfg.28.1535097243206;
Fri, 24 Aug 2018 00:54:03 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1535097243; cv=none;
d=google.com; s=arc-20160816;
b=PPyk9+1IOKfbmRu/9jJPcm7wTQJ0UIoPrenogP+m8aQmmP54xqVeycUkXHnoxOVhvX
GR7Q1JKl+OVh30yd8hm7+TkJWqd4gQqSOXMgyCHgYc5WltV9HQqQG05fd1/ZWMAtiJ96
034dbpmMWs6pJN8PR56cmX6wsWNDfASkXrwOty7W1c4StgFj6ScnZvzqN80KG3+EFAmf
DWpa51CrcVeDS6AV+XOVLi8L+Q/nnn6VryKMWN//ZljTmWUNUcS1X1H2zTXcA0X693xb
YmaHVAtLmB+VGn8PJnJlz92DlFtAZp39JWkVgYgSI/NBbtkN2SImRUwGXrWDePCMGick
ZrQw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=content-language:content-transfer-encoding:mime-version:user-agent
:date:message-id:subject:from:to:arc-authentication-results;
bh=VA7sX419ok1ShgPGAbg2oPhbDxzm7VV5GOwWusjDNCQ=;
b=ByFLSxalLUfvE2jpwawKPRBIbDMk3vb9oUyJhC68dNMXlSYZNl96htHzcPp/L5xbxo
QMKkS9NCTWkMQ2u0bqQyGq3mtQkKFKQszcHzWGP3cP4PMwNLtyTRSby6PRP6TGY/wQWQ
Gxhs9S7M7xweUKHpgWq11Rh4BpyVUpgOuQc7DvlwhrZXt5er/YozRoMRRXqVwvEtRlzm
quchgBLxFbnkmMQt3TSnSpZtbsA56r3cXtlwnLkgJPHdVEesW+qOdTaz4bVRBHABzxzO
aKnzl05wUTHI5Ovy4l4nNFsLPu77mEkvl12/VshX0FKXCfQOnn7waImC1cJim4fAJTzz
HS3Q==
ARC-Authentication-Results: i=1; mx.google.com;
spf=pass (google.com: domain of hannu.kuukkanen@elisanet.fi designates 62.142.117.202 as permitted sender) smtp.mailfrom=hannu.kuukkanen@elisanet.fi
Return-Path: <hannu.kuukkanen@elisanet.fi>
Received: from vs25.mail.saunalahti.fi (vs25.mail.saunalahti.fi. [62.142.117.202])
by mx.google.com with ESMTPS id d1-v6si2180307lfi.338.2018.08.24.00.54.02
for <michael@ic.uff.br>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Fri, 24 Aug 2018 00:54:03 -0700 (PDT)
Received-SPF: pass (google.com: domain of hannu.kuukkanen@elisanet.fi designates 62.142.117.202 as permitted sender) client-ip=62.142.117.202;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of hannu.kuukkanen@elisanet.fi designates 62.142.117.202 as permitted sender) smtp.mailfrom=hannu.kuukkanen@elisanet.fi
Received: from vs25.mail.saunalahti.fi (localhost [127.0.0.1])
by vs25.mail.saunalahti.fi (Postfix) with ESMTP id 15C34200BB
for <michael@ic.uff.br>; Fri, 24 Aug 2018 10:54:02 +0300 (EEST)
Received: from gw02.mail.saunalahti.fi (gw02.mail.saunalahti.fi [195.197.172.116])
by vs25.mail.saunalahti.fi (Postfix) with ESMTP id 0AC6C200BE
for <michael@ic.uff.br>; Fri, 24 Aug 2018 10:54:02 +0300 (EEST)
Received: from [192.168.1.2] (88-112-184-82.elisa-laajakaista.fi [88.112.184.82])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
(Authenticated sender: hannu.kuukkanen@elisanet.fi)
by gw02.mail.saunalahti.fi (Postfix) with ESMTPSA id F2A5D400C2
for <michael@ic.uff.br>; Fri, 24 Aug 2018 10:54:00 +0300 (EEST)
To: michael@ic.uff.br
From: Hannu Kuukkanen <hannu.kuukkanen@elisanet.fi>
Subject: SCAM is coming from your server
Message-ID: <482d78bf-4e11-a159-18a6-5fe46645d68d@elisanet.fi>
Date: Fri, 24 Aug 2018 10:54:23 +0300
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101
Thunderbird/52.9.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Delivered-To: michael@ic.uff.br
