Google Forms Response Receipt wordt misbruikt?

[SizzLorr]

Krijg net een phisingmail in het Russisch, niks bijzonders natuurlijk was het niet dat het lijkt alsof deze van Google intern komt.

code:

Delivered-To: [e-mail]
Received: by 2002:a9d:5244:0:0:0:0:0 with SMTP id q4csp1121677otg;
        Thu, 4 Oct 2018 09:39:26 -0700 (PDT)
X-Received: by 2002:ab0:150:: with SMTP id 74mr3017877uak.83.1538671166691;
        Thu, 04 Oct 2018 09:39:26 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1538671166; cv=none;
        d=google.com; s=arc-20160816;
        b=I+38TYG2pUtUPgoUe2HAk8P2aFInQIXXDipoRqCu2k6FA2K+ctMqJRvIyH/HZohunZ
         n51nFm2NyNO+dgOkoEKC0z979ZFDppVwyJPC1B+nkT/3/LjF4pEWhpE+ihD+MpWZ9jRv
         Sxrs8sOaoD5KgEEd7bq4aBc7z0OVzpYju1zlVua/prU7Mu0Mmiqy6ACdWJNnAjn6t53y
         fRzNoCVoSwQQG6jc0fwRtJ8kQhZyDpVor5YhYvBrZfY5JSzKIkpQn170g8m1EBxxpRWN
         plwBYF8ib1gW6wt1S4OtB8a59HHdK//Mige9IOnYNE9OkZd0NeeYR5/9uYShvJvCArdA
         pa6Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=to:from:subject:date:message-id:mime-version:dkim-signature;
        bh=hrdldyIJM0+uShH4lGl6RWSsoR+/Zlquf+LM64SnhXM=;
        b=LS4fPOokeAs0LDo7WLPpJzgdz7+IgZp3yEC/LEGX60PJpwQ9QlQN3BhZEWYWrqRjdV
         vkbJCRB8bvgT89LTtzw16kKRrbuV+uQ1i1BQrzZqJScT3m/Noobj3wnwiFX6ZGkDE7Hk
         VF1cSXBX3wlqJGQjOJqY3EYNfFROZE26qY2EyWmmfH0VAdUWb/dXhkAb54roYN0Gwy89
         7wtDqXpCdZmdaoZtRqmJwR72xlNeVa5NhqdgUqQEx8+SLB9BZkLgWpbPcqLPz5m6l519
         tL4bWZL7XuWn5XDL0/plBWHSb0hua9blnnwW1enOTgjM8KVw5roLN/pkauIvtvwCx+UY
         H5WQ==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@google.com header.s=20161025 header.b=gWmDb+kX;
       spf=pass (google.com: domain of [e-mail] designates 209.85.220.77 as permitted sender) smtp.mailfrom=[e-mail];
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com
Return-Path: <[e-mail]>
Received: from mail-sor-f77.google.com (mail-sor-f77.google.com. [209.85.220.77])
        by mx.google.com with SMTPS id q8sor3342608uap.32.2018.10.04.09.39.26
        for <[e-mail]>
        (Google Transport Security);
        Thu, 04 Oct 2018 09:39:26 -0700 (PDT)
Received-SPF: pass (google.com: domain of [e-mail] designates 209.85.220.77 as permitted sender) client-ip=209.85.220.77;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@google.com header.s=20161025 header.b=gWmDb+kX;
       spf=pass (google.com: domain of [e-mail] designates 209.85.220.77 as permitted sender) smtp.mailfrom=[e-mail];
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=google.com; s=20161025;
        h=mime-version:message-id:date:subject:from:to;
        bh=hrdldyIJM0+uShH4lGl6RWSsoR+/Zlquf+LM64SnhXM=;
        b=gWmDb+kX+q9pZhj623IYLfYcdbvTLCuiGKBmLP+fcYS9WoPgT6N+e9Iyz6mfGjjbia
         RRqxC9qKb+MVAlPlMSTq+TfSrdQkU2TYXOlJKFrh3OO+vG6PgQ9B09aIL4c/zMjP0Y2Y
         WLSYO/zdaJ70eCcP3cWwjo5Icd7dzDdMrHqFFAs9q+Mm3wiDZQQ9srT3+aP+6DoYFO5o
         u/1d6Dlr+nkrz+6fN2FnHyZpPAI98mIYJBo8FPknYmFa5v2YUYfWdA7t1C3pPthA1Os2
         2HAmn3kM+gAcC2wGNRSXiHhy1W8zlAkNHS3E3aZo5/f7sZFRWpnWy7xqVvtyF41j9p2v
         Bqyw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20161025;
        h=x-gm-message-state:mime-version:message-id:date:subject:from:to;
        bh=hrdldyIJM0+uShH4lGl6RWSsoR+/Zlquf+LM64SnhXM=;
        b=eqA5NeXrDiTRhAFsrdmfIEeZYWHzQS5+/7fbquvlW+gZp9DRj77gYWZungkiq3fuIL
         yOaNJ4sKtutwllg05hz9KSXpw0u/0xsnCWZVikVTE9PnREhXpnVy8shI9dm9pSifURnm
         DUbc2GS9C/M0hiNXQlwyvjtJPxLrSx0FYn+nf4hyQmFK4KhLjBpzVNYIUby7wXRys+gJ
         9YBsRNfqUSqRYzCHRdEmJQKVJSq1t/fBUv9ZTfdWzQ32UmftYgCVXOALZRcsvdjbD48G
         tn7wjy1I3SH/JXh8NGbagU/9Ey7UxOLq3GUN7E/6cFj5ki+qynwI3dncSwzV8GtrF5Fr
         E8gg==
X-Gm-Message-State: ABuFfojZw+Jd4OwZvIYfzINgPhUDp6v5x3IsHktlaqyWJ/P5PwYp9TUj 4rK56cFdjx61/2HMbPenbPyYnh7c+V6i
X-Google-Smtp-Source: ACcGV60UJD/4z9jFHKPYix+TvbB+5coNOUWXLhbCml639qJqnZdKbiykB/OHG7u+N5U4rPrWPTWLtPPPw37Y4aSh8eFf3w==
MIME-Version: 1.0
X-Received: by 2002:ab0:2916:: with SMTP id v22mr6070787uap.23.1538671166533; Thu, 04 Oct 2018 09:39:26 -0700 (PDT)
Message-ID: <[e-mail]>
Date: Thu, 04 Oct 2018 16:39:26 +0000
Subject: &#127874;&#1055;o&#1079;&#1076;pa&#1074;&#1083;&#1103;em!!! Ba&#1096; eme&#1081;&#1083; &#1055;O&#1041;E&#1044;&#1048;&#1051;!!! Ba&#1096; &#1087;epco&#1085;a&#1083;&#1100;&#1085;&#1099;&#1081; &#1085;o&#1084;e&#1088; - 001372954425
From: "Google &#1060;&#1086;&#1088;&#1084;&#1099;" <[e-mail]>
To: [e-mail]

De inhoud is als volgt

Пoздpaвляem!!! Baш emeйл ПOБEДИЛ!!! Baш пepcoнaльный нoмeр - 001372954425
Здpaвствyйтe!

Baш элeктpoнный ящиk был выбpaн сpeди нecкoльkих сoтeн cчacтливчиkoв, koтoрым выпaл шaнс выигpaть дeнeжный пpиз.

Bы мoжeтe пoлучить дo 200 000 ₽💸

Пpинять учacтиe 👉http://

Wat volgens Google Translate betekent

OProvided !!! Your email is !!! Your Personal Number - 001372954425
Hello!

Your electronic drawer was picked up by a few of the shaktylchikovs, who lost the chance to win money money.

You can receive up to 200 000 ₽

Take part tthttp: //

De link is een bit.ly adres. Bekende exploit of is dit iets nieuws?

[Voor 11% gewijzigd door SizzLorr op 04-10-2018 19:59]