Paul, please pass the info to us offlist and we'll get it in front of the right person ASAP.
Anne *Typed with 1.5 eyes as I'm recuperating from a torn retina, so apologies for any typos. > On Feb 27, 2019, at 10:47 AM, Paul Smith <[email protected]> wrote: > > We've just received what I'm 99% sure is a phishing email - sent through the > Mandrill/Mailchimp infrastructure, claiming there's a problem with our > Mailchimp account. The links go to landing pages on MailChimp, and it's > clever. > > So, it needs sorting, ASAP, because it's quite likely to catch people out, > given that it's claiming to be from Mailchimp, the links go to Mailchimp > pages (which look like Mailchimp login pages, but aren't quite), etc. > > I've reported it to [email protected] as well, but that may take a while > to get through, so thought I'd try a different channel as well... > > Headers: > > Return-Path: > <bounce-md_30903452.5c76c31e.v1-cef683aebe194acebd48d0ee66249...@mandrillapp.com> > DomainKey-Status: non-participant [email protected]; domainkeys=fail > Authentication-Results: lmail.pscs.co.uk; spf=Pass > > smtp.mailfrom=bounce-md_30903452.5c76c31e.v1-cef683aebe194acebd48d0ee66249...@mandrillapp.com > smtp.helo=mail136-28.atl41.mandrillapp.com; dkim=pass (signature verified) > [email protected]; dkim=pass (signature verified) > [email protected]; auth=none > Received-SPF: Pass client-ip=198.2.136.28; > envelope-from=bounce-md_30903452.5c76c31e.v1-cef683aebe194acebd48d0ee66249...@mandrillapp.com; > helo=mail136-28.atl41.mandrillapp.com; identity=mailfrom > Received: from mail136-28.atl41.mandrillapp.com ([198.2.136.28] > (mail136-28.atl41.mandrillapp.com)) by lmail.pscs.co.uk ([192.168.66.70] > running VPOP3) with ESMTPS (TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384) for > <[email protected]>; Wed, 27 Feb 2019 17:04:37 -0000 > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=mandrill; d=drsha.net; > h=From:Subject:Message-Id:To:Date:MIME-Version:Content-Type; > [email protected]; > bh=bjT9fpLnOr3an+CY799OLe4k3utaSPU5laFCWT8pwCg=; > > b=gQinse9xWTicS6IrV9weXt2IV1IcoZfAU7bSiuz+iVUqUs4FbEwORfiYx3xatb1VPmjHq2PSeYbR > bEYOgo/YmI87WzJMOgCIdBFQoNMzYmRg8pmJiQKAWzaTv8kT14AJzChsZbnsT0/H9tiQ/N5rqjU3 > x2G+/fYQ/zkjhbW95JM= > Received: from pmta04.mandrill.prod.atl01.rsglab.com (127.0.0.1) by > mail136-28.atl41.mandrillapp.com id her1ia1sb1ku for <[email protected]>; > Wed, 27 Feb 2019 17:04:30 +0000 (envelope-from > <bounce-md_30903452.5c76c31e.v1-cef683aebe194acebd48d0ee66249...@mandrillapp.com>) > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandrillapp.com; > [email protected]; q=dns/txt; s=mandrill; t=1551287070; h=From : > Subject : Message-Id : To : Date : MIME-Version : Content-Type : From : > Subject : Date : X-Mandrill-User : List-Unsubscribe; > bh=bjT9fpLnOr3an+CY799OLe4k3utaSPU5laFCWT8pwCg=; > b=Ftc1ffes3M9osTYrxu23+LeE++UDNvFpKZMEUjD1F6FuYJIQ2gp0rUgiLqQy4TUM9VI9Qr > 1jL/nIskU8jImnlHy6jyv//1mlU2W+FoJ5KJTTr09SkWzdQ03EFexi2Gv3zIK0MerQxED/rR > SPhuTsNtFXI2kBhK7OsbgWra44C5M= > From: MailChimp Billing <[email protected]> > Subject: MailChimp Billing Dispute In Progress > Return-Path: > <bounce-md_30903452.5c76c31e.v1-cef683aebe194acebd48d0ee66249...@mandrillapp.com> > Received: from [138.68.74.240] by mandrillapp.com id > cef683aebe194acebd48d0ee662499fe; Wed, 27 Feb 2019 17:04:30 +0000 > X-Mailer: Apple Mail (2.2104) > Message-Id: <[email protected]> > To: <[email protected]> > X-Report-Abuse: Please forward a copy of this message, including all headers, > to [email protected] > X-Report-Abuse: You can also report abuse here: > http://mandrillapp.com/contact/abuse?id=30903452.cef683aebe194acebd48d0ee662499fe > X-Mandrill-User: md_30903452 > Date: Wed, 27 Feb 2019 17:04:30 +0000 > MIME-Version: 1.0 > Content-Type: multipart/alternative; boundary="_av-tmIbwtKaFByrlcctRqVPTg" > > > -- > > > Paul Smith Computer Services > Tel: 01484 855800 > Vat No: GB 685 6987 53 > > Sign up for news & updates at http://www.pscs.co.uk/go/subscribe > > _______________________________________________ > mailop mailing list > [email protected] > https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop _______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
