Phishing/spam through private message in McAfee Community

[MartinPerez]

Dear Support,

I have received message below. Please react accordingly as this is annoying and potentially harmful.. 

PS. Also it should be a space between my name 

Hello MartinPerez,

You have received a private message in the McAfee Support Community community.

Subject: Do you want a surprise? This is your lucky moment to win a beautiful brand new iPhone 12 Pro. Try it now!
From: Losttimes
Date: 12-15-2020 02:08 AM

Hey! We are giveaway a brand new iPhone 12 Pro! You can take part today! Go here ~ www.winner-zone.com ~~ and complete a simple sign up for a chance to win iPhone 12 Pro. Good luck!

To manage your private message options, click here.

Thanks for being a McAfee Support Community member.

Your McAfee Support Community Team

[MH-Innovation]

And me.
Is a member using this forum to Phish us?

[MartinPerez]

Unfortunately that seems to be the case. McAfee community is being used as source of spam/phishing targets.

[Flash53]

J have had a similar message:

 Dragonflys 

49m ago

Do you want a prize? Here is your lucky moment to win a gorgeous brand new Apple iPhone 12. Try it n...

Hey! We are giveaway a brand new iPhone 12! You can participate today! Enter here - www.winner-zone.com ~ and complete a simple sign up for a chance to win iPhone 12 Pro. Well, good luck!

Different user name.  Come on McAfee, please get this sorted.

[AdamDJ]

I received the exact same spam email from "user" CrazyLoves 

A portion of the Internet headers from the message are below:

Received: from community.mcafee.com (unknown [10.237.77.108])

Date: Tue, 15 Dec 2020 11:00:53 +0000
From: McAfee Community <**personal information omitted**>

Message-ID: <**personal information omitted**>
Subject: You have received a private message in the McAfee Support
Community!

[TGAdmin]

Received the same message from "Alienunicorns".
<insert sarcasm> It's too bad there's not a product out there that can filter and block this type of phishing message.

[Neko-]

Same here. Haven't found the private inbox yet, but still wanted to report it.  Hello Neko-,

You have received a private message in the McAfee Support Community community.

Subject: Do you like a reward? Here is your lucky moment to win a luxury brand new Apple iPhone 12. Hurry up!
From: BrightLights 
Date: 12-15-2020 03:16 AM

Howdy! We are giving away a brand new Apple iPhone 12! You can participate today! Go here - www.winner-zone.com ~ and complete easy sign up for a chance to win iPhone 12 Pro. Well, good luck!

To manage your private message options, click here.

Thanks for being a McAfee Support Community member.

Your McAfee Support Community Team

[RamblingRozeta]

Mine was from Hurtflowers.

Subject: Do you wish a surprise? Here is your lucky moment to win an awesome brand new Apple iPhone 12. Parti...

12-15-2020 02:20 AM

Howdy! We're giving away a brand new Apple iPhone 12! You can take part today! Go here - www.winner-zone.com ~~ and complete a simple sign up for a chance to win iPhone 12 Pro. Good luck!

[vitna]

I've received the same letter.

Just for info, bellow some results of email headers analysis:

Summary
Subject: You have received a private message in the McAfee Support Community!
Message Id: <**personal information omitted**>
Creation time: Tue, 15 Dec 2020 10:37:14 +0000 (UTC)
From: McAfee Community <**personal information omitted**>
To: xxxxxx

Received
Hop: 1
From: community.mcafee.com (unknown [10.237.7.142])
By: outbound.us.khoros-mail.com (Postfix)
With: ESMTP
Id: E06E4C0005
For: <xxxxx>
Date: 12/15/2020 12:37:13 PM

Hop: 2
From: outbound.us.khoros-mail.com (unknown)
By: ismtpd0004p1sjc2.sendgrid.net (SG)
With: ESMTP
Id: 7sAeSzG2SOePgrPBS54n1w
For: <xxxxx>
Date: 12/15/2020 12:37:14 PM
Delay: 1 second
Percent: 22.42

Hop: 3
By: filter1673p1las1.sendgrid.net
With: SMTP
Id: filter1673p1las1-20141-5FD891DA-5
Date: Invalid date

Hop: 4
From: o4.ptr116.us.khoros-mail.com (149.72.223.204)
By: VE1EUR03FT003.mail.protection.outlook.com (10.152.18.108)
With: Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)
Id: 15.20.3654.12
Via: Frontend Transport
Date: 12/15/2020 12:37:15 PM
Delay: 0 seconds
Percent: 17.58

ForefrontAntiSpamReport
Country/Region: US
Language: en
Spam Confidence Level: 1
Spam Filtering Verdict: NSPM
IP Filter Verdict: NLI
HELO/EHLO String: o4.ptr116.us.khoros-mail.com
PTR Record: o4.ptr116.us.khoros-mail.com
Connecting IP Address: 149.72.223.204
Protection Policy Category: NONE
Spam rules: (6029001)(4636009)(32952001)(58800400005)(76236003)(966005)(6916009)(22186003)(83380400001)(55016002)(5660300002)(2616005)(8676002)(1096003)(42882007)(356005)(83170400001)(166002)(336012)(7596003)(6266002)(26005)(33964004)(7696005)(7636003)(15650500001)(338175002)(46800400005)
Source header: CIP:149.72.223.204;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:o4.ptr116.us.khoros-mail.com;PTR:o4.ptr116.us.khoros-mail.com;CAT:NONE;SFS:(6029001)(4636009)(32952001)(58800400005)(76236003)(966005)(6916009)(22186003)(83380400001)(55016002)(5660300002)(2616005)(8676002)(1096003)(42882007)(356005)(83170400001)(166002)(336012)(7596003)(6266002)(26005)(33964004)(7696005)(7636003)(15650500001)(338175002)(46800400005);DIR:INB;
Unknown fields: DIR:INB;

[pbjwalker]

Below are the headers of the email I received.  My domain is replaced with "xxxxxx.com."  It seems to have really come from a private message on the forum. When I logged into the forum, there was indeed a message from user "Realityys."

-----------------------------

Return-Path: <bounces+13947486-612f-paul=**personal information omitted**>
Delivered-To: **personal information omitted**
Received: from xxxxxx.com ([127.0.0.1])
by xxxxxx.com with LMTP id +O07ENVt2F+jVAAAK46Kag
for <**personal information omitted**>; Tue, 15 Dec 2020 03:03:33 -0500
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on xxxxxx.com
X-Spam-Level:
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
DKIM_VALID,HTML_IMAGE_ONLY_32,HTML_MESSAGE,RCVD_IN_MSPIKE_H2,
SPF_HELO_NONE,UNPARSEABLE_RELAY autolearn=ham autolearn_force=no
version=3.4.2
X-Spam-Report:
* -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
* [score: 0.0000]
* -0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
* [149.72.223.204 listed in wl.mailspike.net]
* 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of
* words
* -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
* 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
* valid
* 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay
* lines
X-Spam-Score: -1.9

Received: from o4.ptr116.us.khoros-mail.com (o4.ptr116.us.khoros-mail.com [149.72.223.204])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by xxxxxx.com (Postfix) with ESMTPS id EBFA47E009
for <**personal information omitted**>; Tue, 15 Dec 2020 03:03:32 -0500 (EST)
Authentication-Results: xxxxxx.com; dmarc=none (p=none dis=none) header.from=community.mcafee.com
Authentication-Results: xxxxxx.com;
dkim=pass (1024-bit key; unprotected) header.d=us.khoros-mail.com header.i=@us.khoros-mail.com header.b="kugnSxY0";
dkim-atps=neutral
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=us.khoros-mail.com;
h=from:to:subject:mime-version:content-type; s=s1;
bh=M9kVrGUDJHvloOF7q3/6J4tdySp7JyQtQYX6KvIMqek=; b=kugnSxY0nXq25
aE2IELunPApGogjQtsSytGcIlKcgvv5QyP0Mvt8y6aSw3Zyge86G6IczUClpMgaU
PBsuu2n06Lxssl84EZsnLqK3HSFDBU58O4wNOZolnfuy98q5X4PGz5FlG0X7mLXU
vgE6vPG4I2pjFN4yH6RhW/wiU0ONqs=

Received: by filter2908p1mdw1.sendgrid.net with SMTP id filter2908p1mdw1-21115-5FD86DD3-7
2020-12-15 08:03:31.851645313 +0000 UTC m=+642.255315856
Received: from outbound.us.khoros-mail.com (unknown)
by ismtpd0019p1las1.sendgrid.net (SG) with ESMTP id SHyJqDK8RT6xCOhbt8vceg
for <**personal information omitted**>; Tue, 15 Dec 2020 08:03:31.754 +0000 (UTC)
Received: from community.mcafee.com (unknown [10.237.7.142])
by outbound.us.khoros-mail.com (Postfix) with ESMTP id 6E3BCC0005
for <**personal information omitted**>; Tue, 15 Dec 2020 08:03:31 +0000 (GMT)

Date: Tue, 15 Dec 2020 08:03:31 +0000 (UTC)
From: McAfee Community <**personal information omitted**>
To: **personal information omitted**
Message-ID: <**personal information omitted**>
Subject: You have received a private message in the McAfee Support
Community!
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_2404_1498296465.1608019411446"
X-SG-EID: mm2W9mYx/xcNnL22WSF6Euv5tdwXonR0BX+cXhSqzx2voYrYLxFyzFrxRTQWImf77V65Kib6jEEohK
zfxwLMvscsUxfDyVSTw+Rqnzt7trePK+RLj9s+9p96vgqS7X2qXbiuSqCjsYa+g+WcS+lXDo5bydnH
2e1X8Qm0s08Ja5ft8YspiPAvpjHC4443uM2vyeG2Cbt8xtkJjQhu1Drc94baahHZ4r3IGo23CfNQxl
s=
X-SG-ID: 6W8c3JP6m8cswB0T62mr2cRet+mJKj6Rk4a2y6BsdCykUjDYJaz6oXS+kNC58TnV9mfp+RyUb1bNe+
NnCuiA9KZYZZ0WDQCvBWJS6yDew9a8TBwsjbQeIqqrovgvS5+7xmmcOsl26vkMkrL0cXeWp+wxPW4i
nkf+K0+q9G2UwudttIfgFFGXW6TA1x+UoLCD51EwuVpKCptvUrkY9VnLgdx+/yNgVXlE3CNV6ZTpZk
g81cU9ji20yDgZGFsbQdg1potBvpSq1QevPJD3JAIHysc6G5Im5ugPwDl3H3x+0JlheTx2pgIZTv1T
3LNAwVO6
X-Entity-ID: Ghny0D28lEAIRSj2qgmN0g==