Clickable phishing link sent as registration for a fake lottery.
Email received:
Hi there!
In order to support you, we have decided to send you one ticket so that you can participate in the game for free.
This ticket is assigned to your e-mail address and you can participate in the game as soon as it is activated.
All that remains is to complete the registration by clicking on the link below. xxx
Activate your free ticket
-----
You received this email as part of the #Stay_At_Home_2020 international lottery promotion.
Phishing link not posted.
Header:
Return-Path: <dmitriye9e8d@ngs.ru>
Received: from smtpout.ngs.ru (smtpout243.gw-m11.ngs.ru. [195.19.220.243])
Received-SPF: pass (google.com: domain of
dmitriye9e8d@ngs.ru designates 195.19.220.243 as permitted sender) client-ip=195.19.220.243;
Authentication-Results: mx.google.com;
dkim=pass
header.i=@ngs.ru header.s=mail1 header.b=YSaZWzAA;
spf=pass (google.com: domain of
dmitriye9e8d@ngs.ru designates 195.19.220.243 as permitted sender)
smtp.mailfrom=dmitriye9e8d@ngs.ru;
dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=ngs.ru
Received: from 185.158.114.14 (unknown [178.176.113.96]) (Authenticated sender:
dmitriye9e8d@ngs.ru)
Message-ID: <202593C0CB1F33508C89C07D997BF1A2@ngs.ru>
From: Lynnette Thompson <dmitriye9e8d@ngs.ru>
Subject: Ticket № 1453634 International lottery promotion
Date: Tue, 19 May 2020 21:16:37 +0200
X-Mailer: Microsoft Windows Live Mail 14.0.8117.416
Originating IP: 178.176.113.96
Originating ISP: Pjsc Megafon
City: Yekaterinburg
Country of Origin: Russian Federation
