intime.cz

Summary

Financially motivated cybercriminal group using generic email envelope spoofing, open relay or spoofed envelope, and social‑engineering phishing lures (e.g., NDA, school account) with template reuse. — Category: phishing

Phishing indicators

• Generic random envelope address bCRMw5b0q3@intime.cz indicating automated spoofing
• Absence of SPF and DKIM records (no authentication mechanisms) as shown by empty txt_records
• Link to sitefirms.click flagged as suspicious/phishing and registered recently (2026-08-28)
• Return-Path and X-Relaying-Domain set to intime.cz, not matching the purported victim address, suggesting open relay or spoofed envelope
• Email content uses social‑engineering lure (NDA, school account) and references a reused template with document name changes

Domain notes

shared low‑cost hosting (DataSpring ASN 185.65.93.0/24); domain with long history but recent WHOIS update indicating possible abuse

Reasoning

Attribution: unknown Sophistication: 3/10 Techniques: email envelope spoofing, phishing with social engineering lure, credential harvesting via malicious link, use of open relay/spoofed envelope Targeting: educational institutions, businesses handling document exchange (e.g., NDAs) Infrastructure: shared low‑cost hosting (DataSpring ASN 185.65.93.0/24), domain with long history but recent WHOIS update indicating possible abuse

Recommendations

• Do not click the sitefirms.click link; treat email as suspicious
• Verify the NDA request through an independent channel (e.g., contact the school’s IT/security team)
• Block or monitor traffic to intime.cz pending further investigation
• Implement SPF, DKIM, and DMARC for all organizational domains to prevent envelope spoofing
• Monitor Skagit @mysvc.skagit.edu account for anomalous activity