Please share the headers; pictures are not forensic evidence. We've seen similar things, want to see if it's the same issue.
Hint: it may have really come from PayPal. Aloha, Michael. -- Michael J Wise Microsoft Corporation| Spam Analysis "Your Spam Specimen Has Been Processed." Open a ticket for Hotmail<http://go.microsoft.com/fwlink/?LinkID=614866> ? From: mailop <mailop-boun...@mailop.org> On Behalf Of Zach Rose via mailop Sent: Friday, November 18, 2022 7:10 AM To: mailop@mailop.org Subject: [EXTERNAL] [mailop] Really good paypal phishing email this morning https://www.screencast.com/t/dNPpByTSjrq<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.screencast.com%2Ft%2FdNPpByTSjrq&data=05%7C01%7Cmichael.wise%40microsoft.com%7Cb8ffa5abe5214b8c37f608dac977757b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638043812173760083%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=SxM5MZ4z3n9nX0eeQAS786bwsB2weMvTeKk0M1TkwIE%3D&reserved=0> I rarely use paypal, if ever, and haven't shopped with Walmart in over a decade, but I can see how this would fool a lot of people. Passed DKIM/SPF/DMARC, and the code of the email itself referenced their own static file CDN, so this feels like a scam account internally rather than a spoofed email.
_______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
