Community
Products
Jira
Questions
Suspicious mail from community-do-not-reply@em.atlassian.com

Suspicious mail from community-do-not-reply@em.atlassian.com

Hello,

Without any request from my side, I received a mail this morning from community-do-not-reply@em.atlassian.com asking me to verify my mail address as if a mail change request was raised, here's the content:

Hello Ghady DIAB,

We have received a request to change your email address on Atlassian Community. Click the link below to verify your email address:

https://community.atlassian.com/t5/user/VerifyUserEmailPage/user-id/162801/mail-message-tracking/XXXX

Thanks for being a Atlassian Community member.

Your Atlassian Community Team

I clicked on the above link.. Any idea if this is a phishing mail? If not, why would I receive this from Atlassian?

Thanks,

Ghady

1 answer

1 accepted

0 votes

Answer accepted

Share complete email in raw format with headers etc. It will be helpful for identification of source etc.

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Mail source:

<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>Email Address Verification</title>
<style type="text/css">body{width: 100%; background-color: #ffffff; margin:0; padding:0; -webkit-font-smoothing: antialiased;font-family: Georgia, Times, serif}table{border-collapse: collapse;}@media only screen and (max-width: 640px){body[atlassian] .deviceWidth{width:440px!important; padding:0;}body[atlassian] .center{text-align: center!important;}}@media only screen and (max-width: 479px){body[atlassian] .deviceWidth{width:280px!important; padding:0;}body[atlassian] .center{text-align: center!important;}}a { color: #0052CC; text-decoration: none; }a:link { color: #0052CC; text-decoration: none; }a:visited { color: #0052CC; text-decoration: none; }a:active { color: #0052CC; text-decoration: none; }a:hover { color: #0052CC; text-decoration: none; }</style>
<body leftmargin="0" topmargin="0" marginwidth="0" marginheight="0" atlassian="fix" style="font-family: Georgia, Times, serif"><table width="100%" border="0" cellpadding="0" cellspacing="0" align="center"><tr><td width="100%" valign="top" bgcolor="#ffffff" style="padding-top:20px"><table width="580" class="deviceWidth" border="0" cellpadding="0" cellspacing="0" align="center" bgcolor="#eeeeed" style="margin:0 auto;"><tr><td valign="top" style="padding:0" bgcolor="#ffffff"></td></tr></table><table width="580" border="0" cellpadding="0" cellspacing="0" align="center" class="deviceWidth" style="margin:0 auto;"><tbody><tr><td width="100%" bgcolor="#ffffff"><table border="0" cellpadding="0" cellspacing="0" align="left" class="deviceWidth" style="border: 1px solid #cccccc;padding: 30px;"><tbody><tr><td style="padding: 20px; color: #172B4D; font-family: sans-serif; font-size: 13px;" class="center">
Hello XXXX,
<p>
We have received a request to change your email address on Atlassian Community. Click the link below to verify your email address:
</p>
<p>
<a href="https://community.atlassian.com/t5/user/VerifyUserEmailPage/user-id/162801/mail-message-tracking/XXXXXX">https://community.atlassian.com/t5/user/VerifyUserEmailPage/user-id/162801/mail-message-tracking/XXXXX</a> 
</p>
<p>

</p>
<p>Thanks for being a Atlassian Community member.
</p>

<i>
Your Atlassian Community Team
</i>
</p>
<p>
-------------------------------------------------------------
</p>
<p>
<br>
<font size="-1">
<p>
Atlassian Community sent this message to xxx@yyy.com.
</p>
<p>
Don't want to receive emails from us? Just click <a href="https://community.atlassian.com/t5/user/RemoveUserEmailPage/user-id/162801/mail-message-tracking/XXXXX">here</a>.
</p>
<p>
</p>
</font>
</p>
</td></tr></tbody></table><table width="580" border="0" cellpadding="0" cellspacing="0" align="center" class="deviceWidth" style="margin:0 auto;"><tr><td width="100%" bgcolor="#ffffff"><table border="0" cellpadding="0" cellspacing="0" align="center" class="deviceWidth"><tr><td style="padding:10px 20px" class="center"> <a href="#"><img src="https://community.atlassian.com/html/assets/email-footer.png" alt="Atlassian Logo" border="0"></a></td></tr></table></td></tr></table></td></tr></tbody></table></td></tr></table></body>
</html>

Message headers:

Received: from AM0PR0402MB3442.eurprd04.prod.outlook.com (2603:10a6:802:2::39)
by VI1PR0402MB3455.eurprd04.prod.outlook.com with HTTPS via
VI1PR04CA0068.EURPRD04.PROD.OUTLOOK.COM; Tue, 27 Aug 2019 22:55:39 +0000
Received: from AM6PR0402CA0004.eurprd04.prod.outlook.com (2603:10a6:209::17)
by AM0PR0402MB3442.eurprd04.prod.outlook.com (2603:10a6:208:21::30) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2199.19; Tue, 27 Aug
2019 22:55:38 +0000
Received: from AM5EUR02FT058.eop-EUR02.prod.protection.outlook.com
(2a01:111:f400:7e1e::202) by AM6PR0402CA0004.outlook.office365.com
(2603:10a6:209::17) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2199.14 via Frontend
Transport; Tue, 27 Aug 2019 22:55:37 +0000
Authentication-Results: spf=pass (sender IP is 208.74.204.9)
smtp.mailfrom=em.atlassian.com; yyy.com; dkim=pass (signature was
verified) header.d=em.atlassian.com;yyy.com; dmarc=pass action=none
header.from=em.atlassian.com;compauth=pass reason=100
Received-SPF: Pass (protection.outlook.com: domain of em.atlassian.com
designates 208.74.204.9 as permitted sender) receiver=protection.outlook.com;
client-ip=208.74.204.9; helo=sv3-smtp2.lithium.com;
Received: from sv3-smtp2.lithium.com (208.74.204.9) by
AM5EUR02FT058.mail.protection.outlook.com (10.152.9.140) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
15.20.2199.13 via Frontend Transport; Tue, 27 Aug 2019 22:55:37 +0000
Received: from sjc1papp64.sj.lithium.com (unknown [10.20.190.2])
by sv3-smtp2.lithium.com (Postfix) with ESMTP id 9CD8F404A8
for <xxx@yyy.com>; Tue, 27 Aug 2019 15:55:35 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=em.atlassian.com;
s=lithium; t=1566946535;
bh=NLNtfD0UVphl9oHk1Ggab0FYr0bQU6RhvEABny5cXlc=;
h=Date:From:To:Subject;
b=wrXKQCEwzoWweCCov2lKsn25/NsxrwQS0HuPd9kzo62VH9usSauPvEMVMupxO48En
jevN/nE452LfeDFPnMj4VewgHkmJiM1G749/agqLhIrNPUD1Apr1yiXdDnp+bN5glQ
2p2iHHKSOFjA8WFbpABTxhoQ2RtXpH/7E2NDNnyw=
Date: Tue, 27 Aug 2019 15:55:35 -0700 (PDT)
From: Atlassian Community <community-do-not-reply@em.atlassian.com>
To: xxx@yyy.com
Message-ID: <1350101828.32697.1566946535643.JavaMail.lithium@sjc1papp64.sj.lithium.com>
Subject: E-Mail Address Verification
MIME-Version: 1.0
Content-Type: multipart/alternative; 
boundary="----=_Part_32696_650591939.1566946535640"
Return-Path: community-do-not-reply@em.atlassian.com
X-MS-Exchange-Organization-ExpirationStartTime: 27 Aug 2019 22:55:37.6583
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
07142dc7-c14b-4e2e-ef20-08d72b41ad4c
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: c05332d4-753c-4eb6-b1fb-bce0efa6c8d1:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-Forefront-Antispam-Report:
CIP:208.74.204.9;IPV:NLI;CTRY:US;EFV:NLI;SFV:NSPM;SFS:(10001)(2980300002)(286005)(189003)(199004)(336012)(15003)(966005)(9686003)(85226003)(55016002)(10126004)(6916009)(2351001)(2361001)(6266002)(106002)(246002)(606006)(476003)(3480700005)(7696005)(486006)(126002)(33964004)(14444005)(66574012)(15650500001)(8676002)(26005)(1096003)(86362001)(71190400001)(236005)(6306002)(733005)(16586007)(86816001)(356004)(7636002)(7596002);DIR:INB;SFP:;SCL:1;SRVR:AM0PR0402MB3442;H:sv3-smtp2.lithium.com;FPR:;SPF:Pass;LANG:en;PTR:sv3-smtp2.lithium.com;MX:1;A:1;
X-MS-Exchange-Organization-AuthSource:
AM5EUR02FT058.eop-EUR02.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 07142dc7-c14b-4e2e-ef20-08d72b41ad4c
X-Microsoft-Antispam:
BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(5600166)(711020)(4605104)(4709080)(8001031)(1402095)(71702078);SRVR:AM0PR0402MB3442;
X-MS-TrafficTypeDiagnostic: AM0PR0402MB3442:
X-MS-Exchange-PUrlCount: 2
X-MS-Oob-TLC-OOBClassifiers: OLM:5797;
X-MS-Exchange-Organization-SCL: 1
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Aug 2019 22:55:37.3070
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 07142dc7-c14b-4e2e-ef20-08d72b41ad4c
X-MS-Exchange-CrossTenant-Id: c05332d4-753c-4eb6-b1fb-bce0efa6c8d1
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR0402MB3442
X-MS-Exchange-Transport-EndToEndLatency: 00:00:02.1015054
X-MS-Exchange-Processed-By-BccFoldering: 15.20.2199.015
X-Microsoft-Antispam-Mailbox-Delivery:
ucf:0;jmr:0;ex:0;auth:0;dest:I;ENG:(20160514016)(750127)(520011016)(944504077)(944701077)(944506383)(944626516);
X-Microsoft-Antispam-Message-Info:
=?us-ascii?Q?RjLj+VUiS1+YcZx/WOHSY8DxXS2O/OzB6k2DhKC229UtD/mw54FqgTaEiCwJ?=
=?us-ascii?Q?Vh8UMO20u5+cm8gccOjFFjvH6Z/XQHqVW3ZBaV9PjTNK+RrgfSnqUJzPfNx8?=
=?us-ascii?Q?+ZEbnQO+MUjOkyMVcs9MOlWMU1+XJPc0FQ8pjng4LK5F59gBVszJDIu7/9Ma?=
=?us-ascii?Q?nlSRECZ7jxZQ62dLCxgs9dtdKyV0IKtv8KozlwZ6GfEuxCNeZ1FfuXXsFsAs?=
=?us-ascii?Q?L+JdQIhW+8YTvdu9Bz4YHqooS6YC8rBYUwSh1TULBWYmnC4jlVdunUgaJGDS?=
=?us-ascii?Q?Ldy0yQ0eQH8atT2GKHTFsg7Q5LyiK22qJV6dfso3x4QHJgfZxt2xwk8n3fuh?=
=?us-ascii?Q?5OobBNXHj8Hu5kcvEtglp4X/vlXDXlKxJ383XgcgPINnMVPGON7dc6fPuweM?=
=?us-ascii?Q?Q3v+1ENYtKt6S4Klib/kTQRWuPhqmBHzltu0Niey8A32wWMWjIl1ZkauGv9z?=
=?us-ascii?Q?Rh/DwFkHijn4LOqpYZujr9XdVWAATji3ralejYwltZnFQ2ebbyBTDnK+UtbP?=
=?us-ascii?Q?KxJ1mBWA6UsUTuHt0ukKQ+WCEfXoJffKp5kFx4awwJ1oroRYszOQE3uxUHvA?=
=?us-ascii?Q?ZOc0yku0KHp7dMopSPRVu8JmaYdtaajCD6EHDDsbbQuhGtR7xnte8MoI20Sq?=
=?us-ascii?Q?BaEXiV6agdTb7Rzieu8lP8qE02VYv2cyvT3DgKloUQfUhmSOYLoyauDGLFPw?=
=?us-ascii?Q?Uk7zhlq8kLxpp/eaN1QoEvzchKZ1+dN8OIqXDsyezFbixMFXgqcNCuwnIFj3?=
=?us-ascii?Q?mqvaZgkS9+nMEKnNDA+R3ltJkMv+esTx52ow+bW2NmRWTxQa2vOFw+7EjDLz?=
=?us-ascii?Q?ZtDhc8lh5C2HimLPovNTcbMCbA5Zyk87G1ZAYHzElxVZtJrrNhs6raw4CwCq?=
=?us-ascii?Q?FFaXuMX4R2taPX+n/J5sr2epj0qvdbdiyD+s286SLalCiXjkqXC/4Qgke/4C?=
=?us-ascii?Q?DGoQxh04TA314qnIXHEBnWRmVWKBQUmsRrpfogC8fJPDkTn4zvELKMt7+Xya?=
=?us-ascii?Q?4jJJ5nzPTqASFSbPPo3A+utDsANAFAw407Y497uExCYj7f8=3D?=
X-EsetId: 37303A29669FC46960736B

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Like

@Ghady DIABThis is original mail and had been sent by Atlassian server.

Please change your password and check if someone if your organization have not requested this.

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Like

Thank you, I already changed the password and activated 2 step authentication

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Like

hey

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Like

Reply

Suggest an answer

Log in or Sign up to answer

Was this helpful?

Thanks!

TAGS

Community showcase