On 2018/07/04 12:40, Paul Mansfield wrote: > I'm wondering how the unique email address I use for UKNOF got leaked. > > I received a reply to an email from [email protected], > with the body being this: > > Hi, > > Please see attached, let me know if you have questions! > > Thanks > > John > > What makes this remarkable is that the message pretends to be a reply > to an email I send in March 2015! The attachment is called > "ETF_Inquiry.doc". > > Did anyone else get this? And did anyone analyse the attachment? >
Yes, I had four copies with the same content/file. Doesn't look like something you would want to open. https://www.virustotal.com/#/file/4223f40b2ebdcaed227f7e72dd8aed6242b76b56db83bcae88d851e91ba1e029/details Return-Path: <[email protected]> X-Original-To: [email protected] Delivered-To: [email protected] Received: from atl4mhob21.registeredsite.com (atl4mhob21.registeredsite.com [209.17.115.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by symphytum.spacehopper.org (Postfix) with ESMTPS id 41KhlP3CyZzC1Sh for <[email protected]>; Tue, 3 Jul 2018 12:31:07 +0100 (BST) Received: from mailpod.hostingplatform.com (atl4qobmail01pod1.registeredsite.com [10.30.71.113]) by atl4mhob21.registeredsite.com (8.14.4/8.14.4) with ESMTP id w63BV49H089440 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for <[email protected]>; Tue, 3 Jul 2018 07:31:04 -0400 Received: (qmail 38442 invoked by uid 0); 3 Jul 2018 11:31:04 -0000 X-TCPREMOTEIP: 178.128.255.79 X-Authenticated-UID: [email protected] Received: from unknown (HELO localhost) ([email protected]@178.128.255.79) by 0 with ESMTPA; 3 Jul 2018 11:31:03 -0000 Date: Tue, 3 Jul 2018 11:30:30 +0000 To: [email protected] From: John Bourke <[email protected]> Subject: Re: Re: [uknof] Layer 2 from Ireland to london Message-ID: <[email protected]> X-Mailer: Outlook In-Reply-To: <[email protected]> References: <[email protected]> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="b1_864dc40c4ede97636a3b65781f2d9563"
