Hi, the last phish displayed:
From: =?UTF-8?B?0KFv4oCObeKAjnVu4oCO4oCO4oCO4oCO4oCO4oCO4oCO4oCO4oCO4oCO4oCO4oCP4oCO4oCO4oCO4oCO4oCOaWNh4oCOemlv4oCObmlA4oCO4oCOc3RhZuKAjmYuYXLPhWJhLml0?= <m...@boohostinamo.com> Reply-To: =?UTF-8?B?0KFv4oCObeKAjnVu4oCO4oCO4oCO4oCO4oCO4oCO4oCO4oCO4oCO4oCO4oCO4oCP4oCO4oCO4oCO4oCO4oCOaWNh4oCOemlv4oCObmlA4oCO4oCOc3RhZuKAjmYuYXLPhWJhLml0?= <re...@boohostinamo.com> That exhibits a good few of Cyrillic and Greek characters, left-to-right and right-to-left marks (e2 80 8e/f). It displays like "comunicazi...@staff.aruba.it", which could as well have been written in plain ASCII, given that display names are not checked for authentication. Suspects of training purposes stem from Return-Path: <ab...@boohostinamo.com>, where the domain is SPF and DKIM authenticated. A complaint was accepted by an IPv4 address in the same /24 as the phish emitter, an OVH bundle. Or maybe it was just a coding exercise...? Best Ale -- _______________________________________________ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
