<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>D'oh, just had to open in a text editor</p>
<p>I agree it looks like it is coming from a riseup server. <br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 05/02/2019 09:00, naomi wrote:<br>
</div>
<blockquote type="cite"
cite="mid:951bcaf2-cc9f-79e6-51f8-08a31118f3a8@aktivix.org">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<p>It's odd - I want to see the headers, but all the samples
people are sending are not working for me, I'm just getting a
button saying "download trusted message" and then when I click
it I get the same "advertiser pages" 404 as the screenshot
below.</p>
<p>But never mind, no doubt someone who knows more about it than
me is already looking into it! I was just curious really<br>
</p>
<p>N</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 04/02/2019 20:25, <a
class="moz-txt-link-abbreviated"
href="mailto:mickfuzz@clearerchannel.org"
moz-do-not-send="true">mickfuzz@clearerchannel.org</a> wrote:<br>
</div>
<blockquote type="cite"
cite="mid:3cd26efe-078a-3d42-d3b0-1ca6f0a80323@clearerchannel.org">
<meta http-equiv="Content-Type" content="text/html;
charset=UTF-8">
<p>Sure, </p>
<p>I got two very similar ones from different sources. <br>
</p>
<p>when I reclick them I don't get the original phishing screen
which had a colourful rise up logo and an invite to enter
password to log in. <br>
</p>
<p>thanks<br>
mick<br>
</p>
<div class="moz-cite-prefix">On 02/02/2019 17:17, naomi wrote:<br>
</div>
<blockquote type="cite"
cite="mid:6a41a18b-87bf-9b56-2d1d-48aad640a646@aktivix.org">
<meta http-equiv="Content-Type" content="text/html;
charset=UTF-8">
<p>Mick, can you post the original message with headers etc?</p>
<p>When I click your link I just get this</p>
<p><img src="cid:part2.254AA0B2.DB3DC377@aktivix.org" alt=""
class=""></p>
<div class="moz-cite-prefix">On 02/02/2019 10:18, <a
class="moz-txt-link-abbreviated"
href="mailto:mickfuzz@clearerchannel.org"
moz-do-not-send="true">mickfuzz@clearerchannel.org</a>
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:4dfbf9d1-6027-6029-9fa0-d87eae72022e@clearerchannel.org">
<pre class="moz-quote-pre" wrap="">Ok thanks,
So it does seem to be from compromised accounts not spoofing?
I mean just to clarify, This is a phishing email. Although phishing and
spam as well it seems.
And clicking on that link for me showed a rise up logo, my email, and
log back in message.
So clearly directly targeting riseup email users.
That's why I mention it of interest rather than the usual bank type
phishing emails.
nice one
Mick
On 02/02/2019 10:07, bou wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">lots of these now.
Accounts seem to have been compromised, confirmed by two people from
other lists.
This is the first time i see it happen to a 'cool' address tho
On 1/2/19 8:51, m3shrom wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Hi all
and sam,
this seems a very suspicious message - please don't log in till it's
checked
Anyone come across this before?
Thanks
Mick
On 31/01/2019 23:30, <a class="moz-txt-link-abbreviated" href="mailto:samuk@disroot.org" moz-do-not-send="true">samuk@disroot.org</a> wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Display trusted message
<a class="moz-txt-link-rfc2396E" href="http://web.loadingsecure-mail.host/5c5384cfb83a885431fa2a66?bF2MJkw=&eRFgffiJ=L04N3FKaJPg&bF2MJkw=caLbxmWH5Q" moz-do-not-send="true"><http://web.loadingsecure-mail.host/5c5384cfb83a885431fa2a66?bF2MJkw=&eRFgffiJ=L04N3FKaJPg&bF2MJkw=caLbxmWH5Q></a>
Riseup 18:29:19 31-January-2019.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">_______________________________________________
HacktionLab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:HacktionLab@lists.aktivix.org" moz-do-not-send="true">HacktionLab@lists.aktivix.org</a>
<a class="moz-txt-link-freetext" href="https://lists.aktivix.org/mailman/listinfo/hacktionlab" moz-do-not-send="true">https://lists.aktivix.org/mailman/listinfo/hacktionlab</a>
</pre>
</blockquote>
</blockquote>
<pre class="moz-quote-pre" wrap="">_______________________________________________
HacktionLab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:HacktionLab@lists.aktivix.org" moz-do-not-send="true">HacktionLab@lists.aktivix.org</a>
<a class="moz-txt-link-freetext" href="https://lists.aktivix.org/mailman/listinfo/hacktionlab" moz-do-not-send="true">https://lists.aktivix.org/mailman/listinfo/hacktionlab</a>
</pre>
</blockquote>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
HacktionLab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:HacktionLab@lists.aktivix.org" moz-do-not-send="true">HacktionLab@lists.aktivix.org</a>
<a class="moz-txt-link-freetext" href="https://lists.aktivix.org/mailman/listinfo/hacktionlab" moz-do-not-send="true">https://lists.aktivix.org/mailman/listinfo/hacktionlab</a>
</pre>
</blockquote>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
HacktionLab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:HacktionLab@lists.aktivix.org" moz-do-not-send="true">HacktionLab@lists.aktivix.org</a>
<a class="moz-txt-link-freetext" href="https://lists.aktivix.org/mailman/listinfo/hacktionlab" moz-do-not-send="true">https://lists.aktivix.org/mailman/listinfo/hacktionlab</a>
</pre>
</blockquote>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
HacktionLab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:HacktionLab@lists.aktivix.org">HacktionLab@lists.aktivix.org</a>
<a class="moz-txt-link-freetext" href="https://lists.aktivix.org/mailman/listinfo/hacktionlab">https://lists.aktivix.org/mailman/listinfo/hacktionlab</a>
</pre>
</blockquote>
</body>
</html>