Recu Jeudi 17 Avril 2025 après 13h27 mail escroc usurpant usurpant LE TRESOR PUBLIC (Direction Générale des Finances Publiques) venant de l’adresse mail escroc: no-reply@grupotransita.net en utilisant des boites mails grupotransita.net gérées par abuse@name.com et adresse IP 51.83.242.7 gérée par nanakasasada@gmail.com et abuse@ovh.net Received : from opmta7.grupotransita.net (opmta7.grupotransita.net [51.83.242.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mlpnf0110.laposte.net (SMTP Server) with ESMTPS id 4ZdbGn02y9z1nrwN C'est visiblement et clairement une tentative de phishing et fraude ( fautes multiples ) Ci-dessous cet email d’escroquerie avec ces en-têtes complets : ***************** CONTENU du mail d’escroquerie ******************* ne_pаs_rеpоndre@dgfіp.іmpοt • Aujourd'hui, à 13:27 (il y a 2 heures) 18Ko • • • NM De : nоuveаu messаgе • A : Moi • Vοus аvеz un nοuvеаu mеssаgе. Consultez-le ! Bonjour, Veuillez noter l'arrivée d'un nοuvеаu mеssаgе. Merci de le consulter dès que possible afin de rester informé. Accéder à mon espace Nοus vous rеmerсіоns pоυr votrе аttentіоn. ****************** Codes HTML des hackers ci-dessous ****************************** Return-Path : <no-reply@grupotransita.net> Received : from mlpnf0110.laposte.net (mlpnf0110.sys.meshcore.net [10.94.128.89]) by mlpnb0108 with LMTPA; Thu, 17 Apr 2025 13:27:45 +0200 X-Cyrus-Session-Id : cyrus-14121-1744889265-1-2947042150866162966 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1744889265; cv=none; b=TU3u+VMBtTawf3r9RMGjcIAxYjnhbc76foV+qHegYfbmknzAnDpnOpOk7INAP5v1JxuzM6O5wHF m4Z/ADpDy66tCb3q94BY0W9M0/HsifNPLxQZIVoTJ4cHhvaHDvAg5jBJnGPAtOlcc7b5FOcTQYaN JRfA4+JlWx0vV9y23hukjzeXfRmGDYV1XmM4FFVsR+cpjCuouQs0GPoisV46o50Hh17nTk7Ki6dP ZdosZeOuaTVDDguHHx1z4uR4a0HXLATKIDALxetH3cInHfOnK077x3Jz/KUHgmKwcCNBDQ/jwnBi 6MiG3VsndWllJZ/2HG9mhW7j+MKIPe1UjTMXSCA== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1744889265; h=DKIM-Signature:Date:To:From:Reply-To:Subject:List-Unsubscribe; bh=y6n0ABF8Za3tJ82+FGT1uXhu7mK/otfSX+EzQbi1QLM=; b=aKaIEl4QxjNPUvC1KB2wKMrCDS vMD5G6HU1g9ndFEqyb+YQUIEBeVAdrtaLUpdgbQnx1Di+TQX/MO+5MKZzB8HdQlzTkC7CJk0E2Ie JeV0ASASV+7PBk7d6jrxory4nWYzlspq6VpqIZ5vaNFNPecT+NJjBRXdZ2A8TPVcPI0LsnjVW+jE +/c+vL7j8XvfymSsOm29hEmWRfUY1NcIWz5NaSyerEtPBhnO8B+fxp2wzRkbUPmYTl3uPcVin+Xk N0IBS5W0JrNT5YwbuqoXkLhJIxXfOm+Xi8RZ96PAostBj7eRk1BhrVwTho031I+APLmyDv3RMsns Iug+icrvCohQ== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=opmta7.grupotransita.net smtp.mailfrom=no-reply@grupotransita.net; dkim=pass reason="good signature" header.b=OsY3V2 header.d=grupotransita.net header.i=no-reply@grupotransita.net header.s=dkim; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=51.83.242.7; bimi=none X-mail-filterd : {"version":"1.9.1","queueID":"4ZdbGn1s3nz1nrwS","contextId": "aca6b3a3-a03a-45d6-b79e-4afaa0a8b685"} X-ppbforward : {"queueID":"4ZdbGn1s3nz1nrwS","server":"mlpnf0110"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0110.laposte.net (SMTP Server) with ESMTP id 4ZdbGn1s3nz1nrwS for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Thu, 17 Apr 2025 13:27:45 +0200 (CEST) X-mail-filterd : {"version":"1.9.1","queueID":"4ZdbGn02y9z1nrwN","contextId": "74406e2b-1321-4406-9e3a-a3bc8a884303"} X-lpn-mailing : LEGIT X-lpn-spamrating : 41 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=no-reply@grupotransita.net smtp.helo=opmta7.grupotransita.net; dkim=pass reason="good signature" header.d=grupotransita.net header.i=no-reply@grupotransita.net header.s=dkim header.b=OsY3V2; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=51.83.242.7; bimi=none X-List-Unsubscribe : <https://marketsfunnels.net/?mailpoet_page=subscriptions&mailpoet_router&endpoint=subscription&action=unsubscribe&data=eyJxdWV1ZUlkIjoyMywidG9rZW4iOiJqMzR1ZDlnNHpkdzAwOHNzY2tnMDBnYzQwODA4NHc0MCIsImVtYWlsIjoiZWxlLmxlbW9pbmVAbGFwb3N0ZS5uZXQifQ> X-lpn-spamcause : OK, (5)(0000)gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgddvvdeludegucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecunfetrffquffvgfdpggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucgouegrugfjthhmlhdqqdfuuhhsphgvtghtlhhofidqufgthhgvmhgvqdeuqdhsvghpthculdehmdenucfjughrpeffvffhrhfukffojfggtgfgsegrkeerreehtdejnecuhfhrohhmpehnohhuvhgvrghuuchmvghsshgrghgvuceonhhoqdhrvghplhihsehgrhhuphhothhrrghnshhithgrrdhnvghtqeenucggtffrrghtthgvrhhnpeehteejveduuddtleefhefffefgudelvefhgfeiheevtddtgeeghfethfduffeijeenucffohhmrghinhepmhgrrhhkvghtshhfuhhnnhgvlhhsrdhnvghtnecukfhppeehuddrkeefrddvgedvrdejnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthephedurdekfedrvdegvddrjedphhgvlhhopehophhmthgrjedrghhruhhpohhtrhgrnhhsihhtrgdrnhgvthdpmhgrihhlfhhrohhmpehnohdqrhgvphhlhiesghhruhhpohhtrhgrnhhsihhtrgdrnhgvthdpnhgspghrtghpthhtohepuddprhgtphhtthhopegvlhgvrdhlvghmohhinhgvsehlrghpohhsthgvrdhnvghtpdhsphhfpehprghsshdpughkihhmpehprghsshdpughmrghrtgepphgrshhspdhrvghvkffrpehophhmthgrjedrghhruhhpohht rhgrnhhsihhtrgdrnhgvthdpghgvohfkrfeprffn Received : from opmta7.grupotransita.net (opmta7.grupotransita.net [51.83.242.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mlpnf0110.laposte.net (SMTP Server) with ESMTPS id 4ZdbGn02y9z1nrwN