3 ms·
There's only one thing that would throw me off this email and that is DMARC. But I didn't get the email, so who is to say if I actually would have been caught.
by binarymax 1y ago
There's only one thing that would throw me off this email and that is DMARC. But I didn't get the email, so who is to say if I actually would have been caught.
- vel0city 1y agoThis was a domain "legitimately" owned by the adversary. They controlled that DNS. They could set any SPF or DKIM records they wanted. This email probably passed all DMARC checks. From some screenshots, the email client even has a green check probably because it did pass DMARC.
- junon 1y agoAuthentication-Results: aspmx1.migadu.com; dkim=pass header.d=smtp.mailtrap.live header.s=rwmt1 header.b=Wrv0sR0r; dkim=pass header.d=npmjs.help header.s=rwmt1 header.b=opuoQW+P; spf=pass (aspmx1.migadu.com: domain of ndr-cbbfcb00-8c4d-11f0-0040-f184d6629049@mt86.npmjs.help designates 45.158.83.7 as permitted sender) smtp.mailfrom=ndr-cbbfcb00-8c4d-11f0-0040-f184d6629049@mt86.npmjs.help; dmarc=pass (policy=none) header.from=npmjs.help