UNSOLVED
D
dmccammishjr
6 Posts
0
1983
July 18th, 2017 12:00
Dell Technical Update for Inspiron 64 bit - phishing?
Twice recently received Dell Technical Update emails for "driver for the Intel 8260/7265/7260/3165/3160 WiFi " DriversDetails?driverId=YJNRX Criticality:Recommended
Release date:7/13/2017 3:47:31 AM
Nothing in the email is link-active.
Checked Dell support (independently of email) and cannot find any such driver. Being suspicious, chatted with Dell tech support and they say it is "spam.
Hard to understand how it can be phishing if no active links in email. Similar issue with "spam."
Hard to understand how it can be phishing if no active links in email. Similar issue with "spam."
dmccammishjr
6 Posts
1309
0
Posted July 18th, 2017 13:00
More of message header - note dell.com addresses?
Received: from esa4.dell-outbound2.iphmx.com ([68.232.154.98])
by esa2.dell-outbound.iphmx.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Jul 2017 18:47:31 -0500
Received: from ausxippc110.us.dell.com ([143.166.85.200])
by esa4.dell-outbound2.iphmx.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 16 Jul 2017 05:47:31 +0600
X-LoopCount0: from 10.143.250.112
X-IronPort-AV: E=Sophos;i="5.40,365,1496120400";
d="scan'208,217";a="528686583"
X-DLP: DLP_GlobalPCIDSS
Return-Path:
MIME-Version: 1.0
Sender: "Dell"
From: "eSupport"
My Defender has not disabled live links. If you are using another AV, Defender is probably not active anyway.
I guess you'll have to wait for a Dell employee to address this one because the dell.com in the header certainly does seem curious.
dmccammishjr
6 Posts
1309
0
Posted July 18th, 2017 13:00
Not as far as I know or have ever experienced. I use Thunderbird which disables remote graphics on any email address without permission granted. Possible action by Windows Defender?
Message has graphic signature (viewing source).
Source of part of message header:
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@dell.com header.b=E/SAfL3u;
spf=pass (google.com: domain of idd_messaging_email@dell.com designates 68.232.149.220 as permitted sender) smtp.mailfrom=idd_messaging_email@dell.com;
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=dell.com
Return-Path:
Received: from esa2.dell-outbound.iphmx.com (esa2.dell-outbound.iphmx.com. [68.232.149.220])
by mx.google.com with ESMTPS id v129si6070818qkd.64.2017.07.15.16.47.31
for <[** redacted **]@gmail.com>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sat, 15 Jul 2017 16:47:31 -0700 (PDT)
Received-SPF: pass (google.com: domain of idd_messaging_email@dell.com designates 68.232.149.220 as permitted sender) client-ip=68.232.149.220;
Authentication-Results: mx.google.com;
dkim=pass header.i=@dell.com header.b=E/SAfL3u;
spf=pass (google.com: domain of idd_messaging_email@dell.com designates 68.232.149.220 as permitted sender) smtp.mailfrom=idd_messaging_email@dell.com;
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=dell.com