Server distributing phish spam, thanks to a compromised password.
kulpole.ru. 3600 IN MX 10 kulpole.tula.net.
kulpole.tula.net. 53969 IN A 212.12.2.202
=========================================================================================
Return-Path: <hj788hg@netsatan.com>
Received: from kulpole.tula.net (kulpole.tula.net [212.12.2.202])
by x (Postfix) with ESMTP id x
for <x>; Thu, 8 Aug 2019 xx:xx:xx +0200 (CEST)
Received: from [94.75.219.205] (account info@kulpole.ru [94.75.219.205] verified)
by kulpole.tula.net (CommuniGate Pro SMTP 5.4.11)
with ESMTPA id x for x; Thu, 08 Aug 2019 xx:xx:xx +0300
From: POPSO <hj788hg@netsatan.com>
To: x
Subject: Hai 1 nuovo documento online
Date: 8 Aug 2019 xx:xx:xx -0700
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
Message-ID: <x@netsatan.com>
<HTML>
<HEAD>
</HEAD>
<BODY style=3D»MARGIN: 0px»>
</BODY>
</HTML>
<b>Gentile cliente x ,</b><br><br>
<p>Hai 1 nuovo documento online</p>
<a href=3D»http://razeto.cl/POP/» target=3D»_blank»><U>Clicca qui per legge=
re il documento</U></a><br><br>
<p>=A9 1995-2019 Banca Popolare di Sondrio P.IVA 00053810149</p>