File: /home/w3com/mail/.soporte@w3_com_py/cur/1603398843.H20239P24395.s3.yayogua.com.py,S=5878:2,
Return-path: <www-data@soporte.cnc.una.py>
Envelope-to: soporte@w3.com.py
Delivery-date: Thu, 22 Oct 2020 17:34:03 -0300
Received: from alpha.cnc.una.py ([200.10.228.103]:36346)
by s3.yayogua.com.py with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.87)
(envelope-from <www-data@soporte.cnc.una.py>)
id 1kVhHd-0006GG-C3
for soporte@w3.com.py; Thu, 22 Oct 2020 17:34:02 -0300
Received: from a4ef4d3eceb9 (soporte.cnc.una.py [10.1.5.137] (may be forged))
by alpha.cnc.una.py (8.14.4/8.14.4) with ESMTP id 09MKWDcp029365
(version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256 verify=NO);
Thu, 22 Oct 2020 17:32:13 -0300
DKIM-Filter: OpenDKIM Filter v2.10.3 alpha.cnc.una.py 09MKWDcp029365
Received: from www-data by a4ef4d3eceb9 with local (Exim 4.92)
(envelope-from <www-data@soporte.cnc.una.py>)
id 1kVhFu-0002sO-7T; Thu, 22 Oct 2020 17:32:14 -0300
Subject: [ADMINISTRACION #32314] AutoRespuesta: Notification on phishing e-mails
From: "=?UTF-8?B?U29wb3J0ZSBkZSBhZG1pbmlzdHJhY2nDs24=?= via RT" <administracion@soporte.cnc.una.py>
Reply-To: administracion@soporte.cnc.una.py
In-Reply-To:
References: <RT-Ticket-32314@cnc.una.py>
Message-ID: <rt-4.4.3-2-7878-1603398733-919.32314-3-0@cnc.una.py>
X-RT-Loop-Prevention: soporte.cnc.una.py
X-RT-Ticket: soporte.cnc.una.py #32314
X-Managed-BY: RT 4.4.3-2 (http://www.bestpractical.com/rt/)
X-RT-Originator: lmartinez@cnc.una.py
Auto-Submitted: auto-replied
To: comerciopyo@mmail.com.py, dnsadmin@nic.py, soporte@w3.com.py
Content-Type: text/plain; charset="utf-8"
X-RT-Original-Encoding: utf-8
Precedence: bulk
Date: Thu, 22 Oct 2020 17:32:14 -0300
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-Spam-Status: No, score=0.8
X-Spam-Score: 8
X-Spam-Bar: /
X-Ham-Report: Spam detection software, running on the system "s3.yayogua.com.py",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Estimado Usuario, Este mensaje ha sido automáticamente generado
en respuesta a la creación de un ticket de soporte referente a: "Notification
on phishing e-mails", [...]
Content analysis details: (0.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: nic.py]
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5000]
X-Spam-Flag: NO
Estimado Usuario,
Este mensaje ha sido automáticamente generado en respuesta a la
creación de un ticket de soporte referente a:
"Notification on phishing e-mails",
del cual se adjunta un resumen más abajo.
No es necesario que conteste a este mensaje en este momento. Se le ha
asignado un ID de ticket [ADMINISTRACION #32314].
Por favor incluya el texto:
[ADMINISTRACION #32314]
en el campo "asunto" de todo correo futuro referente a este tema. Para
mayor facilidad, puede simplemente responder a este correo.
Muchas gracias,
administracion@soporte.cnc.una.py
-------------------------------------------------------------------------
Resumen del ticket:
Buenas tardes
Remitimos para su conocimiento y toma de acciones sobre la siguiente
notificación que nos enviaron, donde comentan una campaña de phising que se
distribuye desde correos correspondientes
al dominio elcomercioparaguayo.com.py , más abajo copiamos el correo que nos
fue remitido.
De: incident@nbu.gov.sk <incident@nbu.gov.sk>
Date: jue., 22 oct. 2020 a las 12:27
Subject: [SKCERT-20201022-1662] Notification on phishing e-mails
To: webmaster@cloud.elcomercioparaguayo.com.py
<webmaster@cloud.elcomercioparaguayo.com.py>, admin-contact@nic.py
<admin-contact@nic.py>, dnsadmin@cnc.una.py <dnsadmin@cnc.una.py>,
abuse@tierpoint.com <abuse@tierpoint.com>
Cc: incident@nbu.gov.sk <incident@nbu.gov.sk>
TLP: AMBER
Dear colleagues,
we have received a cyber security incident report regarding phishing campaign
targeting Fedex users. Malicious/Phishing content is being distributed from
e-mail and IP addresses belonging to your constituency. Please see the
associated IOCs in the following text and the original header attached.
IOC:
· From: postmaster@cloud.elcomercioparaguayo.com.py (sender IP:
72.249.76.184)
· Subject: FedEx Shipment Notification : N°384789299
We kindly request you to confirm the receipt of this message, investigate the
situation and take all steps necessary to handle this incident as soon as
possible. We are also interested in obtaining any additional information
regarding the reported incident that could be used to identify the attacker,
victims and the corresponding attack vector. Please provide logs from security
devices and samples of scripts or files used by the attacker.
Identifier [#SKCERT-20201022-1662] has been assigned to your report. We ask
you to include this identifier in the subject line of future correspondence
regarding this incident. In case transmission of sensitive data is required,
please use PGP protocol.
Best regards
Ján Doboš
Director of Cyber Security & Services Operations Centre
National Cyber Security Centre SK-CERT
National Security Authority
Budatínska 30 | 851 06 Bratislava | Slovak Republic
tel.: +421 2 6869 2915 | mob.: +421 903 993 706
e-mail: incident@nbu.gov.sk
PGP: D66E 619A E83A 8802 51A6 5AC7 CF74 96BD 1A1A 0ACD
web: www.sk-cert.sk | www.nbu.gov.sk
TLP: AMBER
Atte.
Lucía Martínez