Page 1 of 1

Please help identify where this is coming from and if it is a hack job.

Posted: Thu Feb 27, 2020 8:29 pm
by Misty2020
Sent from Yahoo Mail on Android

On Thu, Feb 27, 2020 at 4:46 PM, [email protected]
<[email protected]> wrote:
Sorry, we were unable to deliver your message to the following address.

<[email protected]>:
No mx record found for domain=lkst.vktaopcstw.apl

--- Below this line is a copy of the message.

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1582850786; bh=IGluno2q7MWE91TlCnKMy6s+Ulsns1Ohrx+l8jcolEk=; h=To:From:Date:Subject:References:From:Subject; b=GsNdXui60JuYmSj6TCUZuTQfqEzt5KF8Ncw7pVwzJR8nNEOLIDEo1ODQDMrg71qNR7yomcPsgkPOi4LSUP/zYIJzllFD4W8OA5jw+rWKsZwW4IfINDiid7RUZQ5cpzi3p8l+TftDtou1aNzbgHIllcr4wmnlz/xDXFQMsgCiajtMBf9EzvfWA4KbAukvQ5KKCSWOP90aKi6UPN1e6vUYi7GLBHiwyqqp7JhVw9zeswY9JmJpWVxfyMtNjOiW6dTCgO9Njr0KqK0AE9FMQgTqFCER66tTGmmQEL9m23k+lPObhGTBqDUEPYZRPMjHrF80Jl5r6+RkxAW6laL9zY+Pkg==
X-YMail-OSG: 8Mra4Q4VM1npa53xmTlKAtDoH0dkyJfjh4k1cUK72sr8GScyznJwAKSDzAJ565m
ALEnQucl1h4pGaLjYTYw1.4s3ncZaEKmRS33FeB9BEA1rrnlhPXqN4ElqEU6bpdyTHdkuP56roU.
R7iwgL3uZUpaWLB4WgUGXOxPP5BY2xyAyXunoKzR6yIUTohf4tHsCCjZBESFWl.IRLqpC5QBkrtf
.4MYHMPf9Z3zwwkVv12pT6S_fTagvPaADnsHG9mMa3WZQ_hnb3bXhftJWFGdJGKj19MCUWVjv4N9
F_ZbRMD0EyR7uBl4XU2y0OVqToBoo6K7rrOkM1ii.4bSTrTYHGocjMFLzFbkGpLxzy1JR9JFqR1K
SM1maS1QP7tq86.XXS2q1.THjchF8pNQzwqkb0fLOcvorcVzpHdJEG7uqvnkH4V5I3j9f4FeM89o
6iSU9LmYU2D8SVCODwEa87B6kVN0wzoxwU6b5CAskFxtZ.rrNTBn.Vw6GASoQY_TBWWH87iFL0jA
otD5trlahX38rPVZpWdf7N.nwU1.ddhbOW1pnI6lCJ_.u2qQnbPybEK2cCHMLxwXdKeEo_EbfKsT
fAqgzDLUGCouGYBkmFHLgK7jO9OZ0oxDNoSunWHF9hxQdPFAeCI8wHUobXE3ZCWXZZUvum6fZRjl
ETDkZ_aPswvcjAb8phtUVRpu6W4EdgK2ing_C7zBv42LxbKdRT_pVt3U_Mk6y4a3Fl.2kBUAJ3GV
B04DgjPQLgajaYdnpEY5LIZhSywmAjG24nu0TqPhQiR3HdZmICE9w3mXjVzIvVq0qKgaSsAsJ.up
7KwYDXngKnQOL_jNENc5t_iXgLRi7qHmTS_lfLeZpv5sJRU4Osxu8ix2LiEnRPAHzpAVqKeRMZCu
ArZqHBewQjpVAm9gM4jqTu1qI7kdmXVtikT3R7bzG6k0wJWd45Cq2Q7axSJXuBFLZ0khtzZOkGxM
uVnNdyv803fyzJuVBI6T2ziQ07pMn9T0hsEI6OBS14Le6wCbVn1aQ1OyKp2FiLGB4Z.TID18SjRi
QwV8HYmtbIjNSE1f.YnHurpw1TEKd3Lua_mGXM81b7_g41WxvyI.y8y5GyCBMY20zVYmOHMxD4FY
FyXZtJrwqtEdgJKAMNlVtStk0nKoTYjTciNrICLpbkK.8i1JD80fEQUGHToAnDluaG5m6mZVMWDa
X.fHDWYXu7E_7HwRkN1_.wZlVj_F7j83wjC_RNlxcX4LoOEoBEzyZiRr68hHoMNeBbeUE0u8W7sy
W0q6WYhgU9BcB8.FGgyT2IpSfkNwfMDr2NQ4YZux_dKEEVDNw0L14cZNlrvGxd7rXa22rMqrKGEz
zUJMBMsSwM29cpzGDDfYC8nNq7MM.5oiOOGuGMQsX4AJRildp.ZUPA5D2YfNrN6h3
Received: from sonic.gate.mail.ne1.yahoo.com by sonic313.consmr.mail.bf2.yahoo.com with HTTP; Fri, 28 Feb 2020 00:46:26 +0000
Received: by smtp407.mail.ir2.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 04e28b15593145438be8262edc1484db;
Fri, 28 Feb 2020 00:46:24 +0000 (UTC)
Received: by mail-lf1-f54.google.com with SMTP id z9so826330lfa.2
for <[email protected]>; Thu, 27 Feb 2020 16:46:23 -0800 (PST)
X-Gm-Message-State: ANhLgQ0N+bUN0sT5xw6KLNYFOnt1Zcv2yIoHYditc0OLgb3eSzl6CQ0/
hlt3x6uYIXsPw6TgmhZfQqDO029z/Wnsl3k8BsfxdvQXCfo=
X-Google-Smtp-Source: ADFU+vtYsUOiszTNNnzCc01KWaJ9cUMeO7/sM9Q9+ic7uQu02Tmwf83XNa1wa2Izr9VhYay/TiJ7uovwbZdwQLNBIVBVHMJ9169fz0LrRj6E
X-Received: by 2002:a19:bece:: with SMTP id o197mr1097188lff.164.1582850783033;
Thu, 27 Feb 2020 16:46:23 -0800 (PST)
To: [email protected]
From: "{removed}" <{removed}@yahoo.com>
Date: Thu, 27 Feb 2020 16:46:22 -0800
Message-ID: <[email protected]om>
Subject: Account No Longer Active Re: verification 4500789610-4508248372-6689
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Precedence: bulk
X-Autoreply: yes
Auto-Submitted: auto-replied
References: <[email protected]il.com>
X-Mailer: WebService/1.1.15302 hermes Apache-HttpAsyncClient/4.1.4 (Java/1.8.0_241)
Content-Length: 164

Re: Please help identify where this is coming from and if it is a hack job.

Posted: Fri Feb 28, 2020 9:50 am
by Chrispcritters
If you did not attempt to send an email to [email protected] then your email was probably forged as the "from" address in a phishing scam. It's unfortunately common, and probably nothing to be alarmed about.

You may want to change your email password just in case.

Re: Please help identify where this is coming from and if it is a hack job.

Posted: Fri Feb 28, 2020 11:05 pm
by Misty2020
Chrispcritters wrote:
Fri Feb 28, 2020 9:50 am
If you did not attempt to send an email to [email protected] then your email was probably forged as the "from" address in a phishing scam. It's unfortunately common, and probably nothing to be alarmed about.

You may want to change your email password just in case.
Thank you for your help.

Re: Please help identify where this is coming from and if it is a hack job.

Posted: Fri Feb 28, 2020 11:06 pm
by Misty2020
Thank you!