> Kalau dari log semua itu spam mail biasa saja. > Coba perlihatkan message header dari spam mail yang dianggap phising > mail tersebut kesini. > > Cara melihat message header dari webmail MDaemon > > - pilih messagenya. > - dari Right Mouse Click menu pilih "view source".
[Sony Aditya] Terlampir header dari ketiga email tersebut. Thank you. Regards, Sony Aditya -- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus -- --[mdaemon-l]---------------------------------------------------------- Milis ini untuk Diskusi antar pengguna MDaemon Mail Server di Indonesia Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette Arsip: http://mdaemon-l.dutaint.com Dokumentasi : http://mdaemon.dutaint.co.id Berlangganan: Kirim mail ke [email protected] Henti Langgan: Kirim mail ke [email protected] Versi terakhir MD 19.5.0, SG 6.1.0
X-MDAV-Result: clean X-MDAV-Processed: mail.richtex.co.id, Wed, 23 Oct 2019 21:56:20 +0700 Return-path: <[email protected]> Authentication-Results: mail.richtex.co.id; spf=none [email protected]; dkim=pass (good signature) header.d=tamsonfashion.com header.b=jgNFl3S9UR; iprev=pass policy.iprev=210.245.26.76 (PTR mail.hanoia.com); iprev=pass policy.iprev=210.245.26.76 (HELO mail.openasiagroup.com); iprev=pass policy.iprev=210.245.26.76 (MAIL [email protected]) Received-SPF: none (mail.richtex.co.id: tamsonfashion.com does not designate permitted sender hosts) receiver=mail.richtex.co.id; client-ip=210.245.26.76; mechanism=default; envelope-from="[email protected]"; helo=mail.openasiagroup.com; Received: by mail.richtex.co.id with ESMTPS id 23-md50000005495.msg; Wed, 23 Oct 2019 21:56:19 +0700 X-Spam-Level: X-Spam-Status: No, score=0.40 required=5.0 X-Spam-Report: * 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. * See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block * for more information. * [URIs: carters.com] * 0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS X-Spam-Processed: mail.richtex.co.id, Wed, 23 Oct 2019 21:56:19 +0700 (processed during SMTP session) X-MDDKIM-Result: unapproved (mail.richtex.co.id) X-MDSPF-Result: none (mail.richtex.co.id) X-MDRemoteIP: 210.245.26.76 X-MDHelo: mail.openasiagroup.com X-MDArrival-Date: Wed, 23 Oct 2019 21:56:19 +0700 X-Rcpt-To: [email protected] X-MDRcpt-To: [email protected] X-Return-Path: [email protected] X-Envelope-From: [email protected] X-MDaemon-Deliver-To: [email protected] X-CAV-Result: clean Received: from localhost (localhost [127.0.0.1]) by mail.openasiagroup.com (Postfix) with ESMTP id ED300182112EBE for <[email protected]>; Wed, 23 Oct 2019 21:56:34 +0700 (+07) Received: from mail.openasiagroup.com ([127.0.0.1]) by localhost (mail.openasiagroup.com [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id bnqI872DqY13 for <[email protected]>; Wed, 23 Oct 2019 21:56:34 +0700 (+07) Received: from localhost (localhost [127.0.0.1]) by mail.openasiagroup.com (Postfix) with ESMTP id 94C21182112EB3 for <[email protected]>; Wed, 23 Oct 2019 21:56:34 +0700 (+07) DKIM-Filter: OpenDKIM Filter v2.9.2 mail.openasiagroup.com 94C21182112EB3 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tamsonfashion.com; s=21667010-5AB0-11E6-8762-9982288776CE; t=1571842594; bh=QBOqiS9OCLpEkBp6KVMs9qZJK1tSY5S7XheSQD+zkdA=; h=Date:From:To:Subject:MIME-Version:Content-Type:Message-Id; b=jgNFl3S9URacFHN+fi2H8fVerPUohNw8ubO+Bh9bM1HrAlfKlRSTJQR26g7NHGtYX 7N2SF7uoW4GuhsbJK+H2P7jsTB1hQMNcCyWqAfHkVyl3q+bzbDbgmc8ZpPI3b7ytuB EN2ZlL80UAdjY7ITh8UHGUwjiO7dfE9PlJ2g2/uI= X-Virus-Scanned: amavisd-new at openasiagroup.com Received: from mail.openasiagroup.com ([127.0.0.1]) by localhost (mail.openasiagroup.com [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id YMf8f2VZx6qP for <[email protected]>; Wed, 23 Oct 2019 21:56:34 +0700 (+07) Received: from [63.143.96.146] (unknown [63.143.96.146]) by mail.openasiagroup.com (Postfix) with SMTP id 17250182112EBD for <[email protected]>; Wed, 23 Oct 2019 21:56:31 +0700 (+07) Date: Wed, 23 Oct 2019 09:56:08 -0500 From: "Hung, Catherine <[email protected]> ([email protected])" <[email protected]> To: <[email protected]> Subject: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_14372_2088912106.4114768257830844090" Message-Id: <[email protected]> ------=_Part_14372_2088912106.4114768257830844090 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi, =0DAttached is your Service report. Please print and file this report in yo= ur folder, ensuring you review each report and take any corrective =0Dactio= ns recommended. =0D Kindly assist, please. =0D Best wishes =0D Hung, [email protected] =0D =0D =0DThis email has been checked for viruses by Avast antivirus software.
X-MDAV-Result: clean X-MDAV-Processed: mail.richtex.co.id, Wed, 23 Oct 2019 21:09:43 +0700 Return-path: <[email protected]> Authentication-Results: mail.richtex.co.id; spf=pass [email protected]; dmarc=fail header.from=pec.aruba.it (p=none sampling=90 pct=100); iprev=pass policy.iprev=95.110.223.22 (PTR smtpecrm02.pec.aruba.it); iprev=fail policy.iprev=95.110.223.22 reason="does not match" (HELO smtps.pec.aruba.it); iprev=fail policy.iprev=95.110.223.22 reason="does not match" (MAIL [email protected]) Received-SPF: pass (mail.richtex.co.id: domain pec.it designates 95.110.223.22 as permitted sender) receiver=mail.richtex.co.id; client-ip=95.110.223.22; mechanism=ip4:95.110.223.0/24; envelope-from="[email protected]"; helo=smtps.pec.aruba.it; Received: by mail.richtex.co.id with ESMTPS id 18-md50000005506.msg; Wed, 23 Oct 2019 21:09:41 +0700 X-Spam-Level: * X-Spam-Status: No, score=1.20 required=5.0 X-Spam-Report: * 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. * See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block * for more information. * [URIs: richtex.co.id] * 0.5 SUBJ_ALL_CAPS Subject is all capitals * 0.3 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail * domains are different * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS X-Spam-Processed: mail.richtex.co.id, Wed, 23 Oct 2019 21:09:41 +0700 (processed during SMTP session) X-MDSPF-Result: unapproved (mail.richtex.co.id) X-MDRemoteIP: 95.110.223.22 X-MDHelo: smtps.pec.aruba.it X-MDArrival-Date: Wed, 23 Oct 2019 21:09:41 +0700 X-Rcpt-To: [email protected] X-MDRcpt-To: [email protected] X-Envelope-From: [email protected] X-MDaemon-Deliver-To: [email protected] X-MDMailing-List: [email protected] Precedence: bulk List-Unsubscribe: <mailto:[email protected]> Sender: [email protected] X-CAV-Result: clean Subject: [Susi_Team] POSTA CERTIFICATA: X-Riferimento-Message-ID: <[email protected]> Date: Wed, 23 Oct 2019 16:09:24 +0200 Message-ID: <[email protected]> Reply-To: [email protected] To: <[email protected]> X-Trasporto: posta-certificata From: "Per conto di: [email protected] ([email protected])" <[email protected]> MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha1"; boundary="----243E5843E539C37380AA6E345E8A9341" List-ID: <Susi_Team.richtex.co.id> List-Post: <mailto:[email protected]> This is an S/MIME signed message ------243E5843E539C37380AA6E345E8A9341 Content-Type: multipart/mixed; boundary="----------=_1571839765-7646-2414" Content-Transfer-Encoding: binary MIME-Version: 1.0 ------------=_1571839765-7646-2414 Content-Type: multipart/alternative; boundary="----------=_1571839765-7646-2415" Content-Transfer-Encoding: binary ------------=_1571839765-7646-2415 Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable --Questo =E8 un Messaggio di Posta Certificata-- Il giorno 23/10/2019 alle ore 16:09:24 (+0200) il messaggio con Oggetto "" =E8 stato inviato dal mittente "[email protected]" e indirizzato a: [email protected] Il messaggio originale =E8 incluso in allegato, per aprirlo cliccare sul fi= le "postacert.eml" (nella webmail o in alcuni client di posta l'allegato po= trebbe avere come nome l'oggetto del messaggio originale). L'allegato daticert.xml contiene informazioni di servizio sulla trasmissione L'identificativo univoco di questo messaggio =E8: opec292.20191023160924.07= [email protected] ------------=_1571839765-7646-2415 Content-Type: text/html; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable <html> <head><title>Messaggio di posta certificata</title></head> <body> <h3>Messaggio di posta certificata</h3> <hr><br> Il giorno 23/10/2019 alle ore 16:09:24 (+0200) il messaggio<br> "" è stato inviato da "[email protected]&qu= ot;<br> indirizzato a:<br> [email protected]<br> Il messaggio originale è incluso in allegato.<br> Identificativo messaggio: [email protected]= t<br> </body> </html> ------243E5843E539C37380AA6E345E8A9341--
X-MDAV-Result: clean X-MDAV-Processed: mail.richtex.co.id, Wed, 23 Oct 2019 21:09:16 +0700 Return-path: <[email protected]> Authentication-Results: mail.richtex.co.id; spf=softfail [email protected]; dkim=pass (good signature) header.d=absoluteups.com header.b=KtO2bMy20Q; dmarc=none header.from=absoluteups.com (no DMARC record); iprev=pass policy.iprev=67.222.38.55 (PTR gproxy5-pub.mail.unifiedlayer.com); iprev=pass policy.iprev=67.222.38.55 (HELO gproxy5-pub.mail.unifiedlayer.com); iprev=fail policy.iprev=67.222.38.55 reason="does not match" (MAIL [email protected]) Received-SPF: fail (mail.richtex.co.id: domain absoluteups.com does not designate 67.222.38.55 as permitted sender) receiver=mail.richtex.co.id; client-ip=67.222.38.55; mechanism=all; envelope-from="[email protected]"; helo=gproxy5-pub.mail.unifiedlayer.com; Received: by mail.richtex.co.id with ESMTPS id 16-md50000005513.msg; Wed, 23 Oct 2019 21:09:16 +0700 X-Spam-Level: ** X-Spam-Status: No, score=2.60 required=5.0 X-Spam-Report: * 2.5 MDAEMON_SPF_SOFTFAIL MDaemon: soft-failed SPF verification * 0.1 MISSING_MID Missing Message-Id: header X-Spam-Processed: mail.richtex.co.id, Wed, 23 Oct 2019 21:09:16 +0700 (processed during SMTP session) X-MDDKIM-Result: unapproved (mail.richtex.co.id) X-MDSPF-Result: softfail (mail.richtex.co.id) X-MDRemoteIP: 67.222.38.55 X-MDHelo: gproxy5-pub.mail.unifiedlayer.com X-MDArrival-Date: Wed, 23 Oct 2019 21:09:16 +0700 X-Rcpt-To: [email protected] X-MDRcpt-To: [email protected] X-Return-Path: [email protected] X-Envelope-From: [email protected] X-MDaemon-Deliver-To: [email protected] X-CAV-Result: clean Received: from cmgw14.unifiedlayer.com (unknown [10.9.0.14]) by gproxy5.mail.unifiedlayer.com (Postfix) with ESMTP id 55F16140508 for <[email protected]>; Wed, 23 Oct 2019 08:09:01 -0600 (MDT) Received: from cs-mum-33.webhostbox.net ([216.10.247.126]) by cmsmtp with ESMTP id NHJoiauDlhwcbNHJqil82E; Wed, 23 Oct 2019 08:09:01 -0600 X-Authority-Reason: nr=8 X-Authority-Analysis: v=2.3 cv=bvJi+nSi c=1 sm=1 tr=0 a=3AqiA6sAZZj64pghuVV5ww==:117 a=3AqiA6sAZZj64pghuVV5ww==:17 a=dLZJa+xiwSxG16/P+YVxDGlgEgI=:19 a=HpEJnUlJZJkA:10:nop_no_mid_header a=XobE76Q3jBoA:10:nop_rcvd_month_year a=R3_hRx4886UA:10:endurance_base64_authed_username_1 a=OVgUr6cwu85CYEotOwgA:9 a=QEXdDO2ut3YA:10:nop_charset_2 a=sDVRH2GAEfE12p_QFdMA:9 a=fMZ_E1CIlfQA:10:nop_mscompound a=7qx8gLC0iM8A:10:nop_oo_xml a=S92bho3TTZoA:10:nop_attachment_filename_extension_2 a=ckal8g68nOMA:10:nop_mscompound_in_zip DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=absoluteups.com; s=default; h=Content-Type:MIME-Version:Subject:To:From: Date:Sender:Reply-To:Message-ID:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=khXgU0Y0ERKz/bvS90ZrXudYcagYLYb+ljo6rlkenqg=; b=KtO2bMy20QgUDvu8AeEw1M1gqT tR5GxWPCJk8A3Qf6w/VIuNe4TYpVtarG+V6LRwXNeQD2Bb7FZILBi3thNM34o6oRvQFftasIkjM0x e5kPmkTGUOJJ75CBnny6DnxaxvrP8P4VJCd73lRultstQbwkZx9Ad3uBEzWIEX8iTIrN6H5+VOtRo ruy0de6DamleehKqSg/25H9n/hYM/TjjGMMIPhgcbNf9lRmxNJRcmYT7FH0n+2JqyBpCQxIUyMLPO 9MUuuG+dp2+W4bubcswrUM9sqgNatr34s0regG1/o/isLI8gDZLVAFpym9fYNQSuHNG8oCDV8SO0B AgFwMjgA==; Received: from [14.34.108.183] (port=52387) by cs-mum-33.webhostbox.net with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92) (envelope-from <[email protected]>) id 1iNGeD-005YsS-L5 for [email protected]; Wed, 23 Oct 2019 13:26:00 +0000 Date: Wed, 23 Oct 2019 22:25:55 +0900 From: "Hung, Catherine <[email protected]> ([email protected])" <[email protected]> To: <[email protected]> Subject: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_30533_986153941.2847949462550326938" X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - cs-mum-33.webhostbox.net X-AntiAbuse: Original Domain - richtex.co.id X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - absoluteups.com X-BWhitelist: no X-Source-IP: 14.34.108.183 X-Source-L: No X-Exim-ID: 1iNGeD-005YsS-L5 X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([14.34.108.183]) [14.34.108.183]:52387 X-Source-Auth: [email protected] X-Email-Count: 442 X-Source-Cap: cGFya2xlc2c7Ymlncm9jaztjcy1tdW0tMzMud2ViaG9zdGJveC5uZXQ= X-Local-Domain: yes ------=_Part_30533_986153941.2847949462550326938 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hello, =0DYou seem to ignore my emails. =0DPlease sign, date, and email back as co= nfirmation. =0D =0DPlease let me know if you need anything else. =0D Thanks :) =0D Hung, Catherine =0D =0D =0DThis email has been checked for viruses by Avast antivirus software.
