Abnormal product key status and resolution procedure

Scam email

Mail Header

�?�e��-2356;。

Return-Path: account-security-noreply@0917.com
Received: from smtp.incredimailsupportnumber.com ([192.168.0.1])
by mx.perfora.net (mxeueus005 [74.208.5.21])
with ESMTP (Nemesis) id 1N95FT-1iBdis23nT-0165Ft for sample@incredimailsupportnumber.com;
Fri, 06 Sep 2019 08:27:01 +0200
Received: from 221x248x143x188.ap221.ftth.ucom.ne.jp (221x248x143x188.ap221.ftth.ucom.ne.jp [221.248.143.188])
by smtp.incredimailsupportnumber.com (Postfix)
with ESMTP id F38B38042F for sample@incredimailsupportnumber.com;
Fri, 6 Sep 2019 15:27:54 +0900 (JST)
DKIM-Filter: OpenDKIM Filter v2.11.0 smtp.incredimailsupportnumber.com F38B38042F
To: sample@incredimailsupportnumber.com,
sample@incredimailsupportnumber.com,
sample@incredimailsupportnumber.com
From: Office Support account-security-noreply@0917.com
Subject: プロダクトキーがの異常な状態と解決手順について。
Message-ID: 6ee0718f-4ba4-b3de-5e6d-862f5bcc61ba@0917.com
Date: Fri, 6 Sep 2019 15:29:08 +0900
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0
MIME-Version: 1.0
Content-type: text/html; charset=”UTF-8″
Content-Transfer-Encoding: Quoted-printable
Content-Disposition: inline
Envelope-To: sample@incredimailsupportnumber.com
X-Spam-Flag: NO
X-UI-Filterresults: notjunk:1;V03:K0:OIF4XCwq5FU=:r+zC/YsttdICZVvRFUsrfW0nwI 74PVuy0wK3gjS2TFYI9Z9rHZo1Q3HCXniw5UC0vELSlIAiqJtkHJJRXJFl/A/FbsZvzy49VES PyxHLbVT7NmnfCRm1g8AJmGSX/PDF/bE8xdtntCZE1n/c+cIv3BVpawfhF5ZkicGF+G1T8JLK R5sMlBhAwppZW9Ogx9yuc6gpG4pgMUY6Ugb14yzx4pKc+7CefWqpZrKJpwv3Nk88p6BKUBoLK 03hlnG1s3gc34n3woEw5QwPEiYHYLd2yDZWnBxJLFSCwcn+UKmItwlQYGwxhQRpRemYNuNEO3 XzznjT0iBJgTzLmCF1SPmgqzdfhBixGUn7eWIw10dSwGgY5tr7dAviLv4jxk7ToTXoP8MqA0Z yF4TrbHCDSsWveGtqWkirhB3GBDrCeYbJo/qWrbfKe6vGHdcJc9aN2jX9xknDax/O7U1gjbBv sNfsz+KYwAOvnLx5nNSJis8G001mJbmIh0lZ8ihQvgSLQXd0J7boX1+lzUNXLcerSsVABb6IN GFMCX9iw6TaHFlwMBGj0UNRgpjR9yr7fs7ZTeullu5ujGrOvVkORYmnrv8vC9e0ba8F3THGNS pDvBAWvpGswqtcO2DVwkcOuNxB5WZZAaP+qkO/8soGZaGuxyUlo7rGCiKUtm9A1PsQzUX/Q1v 924pEHv1Aj+WrJxOBVR2yrI9GfiH0fjMgZNb2QHmW29qdVz/Ukt+UPEaJr/fniA0QOizwcS0J cAkGkmdVFd5rF1tMGgo21Wpq/q4CSWghrPO322++YqjaXO04yO8u2WgbpLVOx64AWIz67w3Zk pWZxL4HidbDTT7p+BgBLKHPZy2cuLTEVokQY5ASL4c1ntANFpM0AJGF8HuHIrI8tY7QjifQ0A kNkeon8xVHgGfsVac42IxUHjfztqeUYqeyxHV8V0eXMINjj5Avv+6Aa8XgtQyta/XFLAOxZ9b 6TQtxSFzQOSOflSw/rtwgqLTw/r0rmvJE9Ui+QSUzzgL8JQtNu9f+I53BCwTqN4AzyXs22T65 QyaCPsXvbIDIr75U2/eA5xEkbh6lw4RrtpT8STPHregi3CK7Xn22ncqcJH1xLlZcGHEb4KbF0 jMzHcf0Z6hDYgKLrE/6aJIp+StEGuOePhw1+cOHW1cWv80B4paGrtwEsOyl8Hu4yJMVLVMfCQ elmUmv0mv2iFPlHkHZAXzuwFB4mPQtKmgWxipWPB9rGIagH6g1sZH0IcCI2GpXGMMbQHSQvae dRCwQSNfuwQRwpeUMLZB4apCWs4J1Xptng5C6U4ZgB+vQuanv2PTfiJVVl7vJCjr3f4WMkzit 8EuLFHWktCUrLwrFbXY8WIbIMASsM3uFQ11cGuwLUCGQGd77yBAzJaWGwIPE5wQE7Dhlk5FQq aLv3JtUf5e2jHZEaaG3UEYpiDj/wG4sQJd/TzLAJGg03TV3e27PfzIyiIVjJXX7jPCjo2EJvH MUQ3+qNeBWxTLCxvNH2Ejf+wuN6Vu9pnclZ+rE0WsJ1K/0PlUpkbHca0IJeX0EfngJXJXWoI6 L/dgjHzYyJe9Czgxy2rgc5n+HsivwTVYM6Kj3u8QiiWt22v84Gy7xC5kVZ2Nj71GshluMqtQc rwky9QYtWtNYDYQWDg8/cnwGE/1hph8hZr9365M7RDJ8O9/+24v1R9SEVq7OUZBGUC/wtT3YC e8QZh8jsa8JVSz/UhXKA5fA

�?�e��-4e=A8=9A=14

Email Body (with English Translation)

[大切]すぐマイクロソフトのプロダクトキーをご認証ください。さもなくば権限付与が中止されます!

ご利用のオフィスソフトの授権が終了されてしまう恐れがあります!

マイクロソフトセキュリティチームはご利用のオフィスソフトのプロダクトキーが違法コピーされた恐れがあることを発見しています。

攻撃者はご利用のオフィスソフトのプロダクトキーでほかのオフィスソフトを起動する試みをしています。ご本人の操作なのかどうかが確定できないので、お手数ですが、検証作業をしてください。

検証作業をしていただけない場合、ご利用のオフィスソフトのプロダクトキーの授権状態を終了しますので、ご了承ください。

今すぐ認証

*ライセンス認証(マイクロソフトプロダクトアクティベーション)とは、不正なコピーを防止する技術で、手続きは簡単に実行できます。また、この手続きは匿名で行われるので、お客様のプライベートな情報は保護されています。ご安心ください。

す。ご安心ください。

English Translation

[Important] Please verify your Microsoft product key immediately. Otherwise, authorization will be canceled!

Your office software authorization may be terminated!

The Microsoft security team has discovered that your office software product key may have been illegally copied.

The attacker is attempting to launch another office software with the product key of the office software you are using. Since it is not possible to confirm whether it is the user’s operation or not, please verify it.

Please note that if you do not perform verification work, the authorized state of the product key of the office software you are using will be terminated.

Authenticate now

* License authentication (Microsoft product activation) is a technology that prevents unauthorized copying, and the procedure can be easily performed. In addition, please be assured that this process is anonymous, so your private information is protected.

Summary

In summary, this email tells the recipient that someone is using their Microsoft Office product key somewhere, and that the recipient needs to verify it.

In short, you don’t need emails like this from Microsoft in the first place, and in addition to this, there are a number of deficiencies that clearly identify this as a fraudulent email.
One proof that will be given as an example here is that the source is from a domain that has nothing to do with Microsoft, such as 0917.com.

If you know of others around you who are likely to get caught into this scam, please share this with them.

Share

You may also like...

Leave a Reply

Your email address will not be published. Required fields are marked *