Spanish Language ING phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Apr 2024 07:20:26 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rs0X8-000000005Tx-3Cc2

for dave@doctor.nl2k.ab.ca;

Wed, 03 Apr 2024 07:20:06 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Apr 2024 07:20:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vmi1739312.contaboserver.net ([154.38.189.234]:51602)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rry8B-00000000Iwx-1Uvj

for root@nl2k.ab.ca;

Wed, 03 Apr 2024 04:46:16 -0600

Received: by vmi1739312.contaboserver.net (Postfix, from userid 0)

id B1C9387EFE; Wed, 3 Apr 2024 06:32:31 -0400 (EDT)

MIME-Version: 1.0

Content-type: text/html; charset=UTF-8

Content-Transfer-Encoding: base64

Subject: Actualizacion Importante: Verificacion de numero de telefono ! ID:9118

From: ING

To: root@nl2k.ab.ca

Message-Id: <20240403103231.B1C9387EFE@vmi1739312.contaboserver.net>

Date: Wed, 3 Apr 2024 06:32:31 -0400 (EDT)

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Documento Cuidamos muy bien tus datos para proteger tu privacidad





Content analysis details: (10.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[154.38.189.234 listed in wl.mailspike.net]

1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)

[154.38.189.234 listed in ix.dnsbl.manitu.net]

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

3.0 HOSTED_IMG_MULTI_PUB_01 Multiple hosted images at public site

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} Actualizacion Importante: Verificacion de numero de telefono ! ID:9118

X-Antivirus: AVG (VPS 240402-6, 4/2/2024), Inbound message

X-Antivirus-Status: Clean



PCFET0NUWVBFIGh0bWw+DQoKPGh0bWwgbGFuZz0icHQtYnIiPg0KCgk8aGVhZD4NCgoJCTxtZXRh

IGNoYXJzZXQ9IlVURi04IiAvPg0KCgkJPHRpdGxlPkRvY3VtZW50bzwvdGl0bGU+DQoKCTwvaGVh

ZD4NCgoJPGJvZHkgc3R5bGU9Im1hcmdpbjogMDtwYWRkaW5nOiAwO2JhY2tncm91bmQ6ICNlNWU1

ZTU7Zm9udC1mYW1pbHk6ICdTZWdvZSBVSScsIEFyaWFsLCBzYW5zLXNlcmlmOyI+DQoKCQk8dGFi

bGUgc3R5bGU9ImRpc3BsYXk6IGJsb2NrO3dpZHRoOiA3MDBweDttYXJnaW46IDQwcHggYXV0byAx

MHB4IGF1dG87YmFja2dyb3VuZDogI2ZmZjtib3JkZXI6IDFweCBzb2xpZCAjY2NjO2JveC1zaGFk

b3c6IDAgMCAzcHggcmdiYSgwLDAsMCwuMyk7Ym9yZGVyLXJhZGl1czogNXB4OyI+DQoKCQkJPHRi

b2R5Pg0KCgkJCQk8dHIgc3R5bGU9ImRpc3BsYXk6IGJsb2NrO3dpZHRoOiA2OTRweDsiPg0KCgkJ

CQkJPHRkIHN0eWxlPSJkaXNwbGF5OiBibG9jazt3aWR0aDogNjkycHg7aGVpZ2h0OiA0MHB4OyI+

DQoKCQkJCQkJPGRpdiBzdHlsZT0iZGlzcGxheTogYmxvY2s7ZmxvYXQ6IGxlZnQ7d2lkdGg6IDEy

MHB4OyI+DQoKCQkJCQkJCTxpbWcgYWx0PSIiIHNyYz0iaHR0cHM6Ly9pLmltZ3VyLmNvbS9WbEFs

bGVrLnBuZyIgc3R5bGU9IndpZHRoOiAxMjBweDttYXJnaW4tdG9wOiA0cHg7IiAvPjwvZGl2Pg0K

CgkJCQkJCTxkaXYgc3R5bGU9ImRpc3BsYXk6IGJsb2NrO2Zsb2F0OiByaWdodDt3aWR0aDogMTUz

cHg7Ij4NCgoJCQkJCQkJPGltZyBhbHQ9IiIgc3JjPSJodHRwczovL2kuaW1ndXIuY29tL0VvVGo0

aUkucG5nIiBzdHlsZT0ibWFyZ2luLXRvcDogMTFweDsiIC8+PC9kaXY+DQoKCQkJCQk8L3RkPg0K

CgkJCQk8L3RyPg0KCgkJCQk8dHIgc3R5bGU9ImRpc3BsYXk6IGJsb2NrO3dpZHRoOiA2OTRweDsi

Pg0KCgkJCQkJPHRkIHN0eWxlPSJkaXNwbGF5OiBibG9jazt3aWR0aDogNjkycHg7Ij4NCgoJCQkJ

CQk8ZGl2IHN0eWxlPSJkaXNwbGF5OiBibG9jazt3aWR0aDogODBweDtoZWlnaHQ6IDgwcHg7Ym9y

ZGVyLXJhZGl1czogNTAlO2JhY2tncm91bmQ6ICMzMzM7bWFyZ2luOiAzMHB4IGF1dG8gMCBhdXRv

OyI+DQoKCQkJCQkJCTxpbWcgYWx0PSIiIHNyYz0iaHR0cHM6Ly9pLmltZ3VyLmNvbS9IanV4S0RV

LnBuZyIgc3R5bGU9ImRpc3BsYXk6IGJsb2NrO3dpZHRoOiA1MHB4O3BhZGRpbmc6IDEycHggMCAw

IDE1cHg7IiAvPjwvZGl2Pg0KCgkJCQkJCTxoMSBzdHlsZT0iZm9udC13ZWlnaHQ6IDMwMDtmb250

LXNpemU6IDMycHg7Y29sb3I6ICMwMDA7dGV4dC1hbGlnbjogY2VudGVyOyI+DQoKCQkJCQkJCUN1

aWRhbW9zIG11eSBiaWVuIHR1cyBkYXRvcyBwYXJhIHByb3RlZ2VyIHR1IHByaXZhY2lkYWQ8L2gx

Pg0KCgkJCQkJCTxwIHN0eWxlPSJwYWRkaW5nOiA1cHg7Zm9udC1zaXplOiAxNnB4O2NvbG9yOiAj

NTI1MTk5O3RleHQtYWxpZ246IGNlbnRlcjsiPg0KCgkJCQkJCQkmaWV4Y2w7SGVtb3MgaWRlbnRp

ZmljYWRvIHF1ZSBlbCBuJnVhY3V0ZTttZXJvIGRlIHRlbCZlYWN1dGU7Zm9ubyBkZSB0dSBjdWVu

dGEgZXN0JmFhY3V0ZTsgZGVzYWN0dWFsaXphZG8gZGVzZGUgaGFjZSBtdWNobyB0aWVtcG8hPGJy

IC8+DQoKCQkJCQkJCTxiciAvPg0KCgkJCQkJCQlEZWJpZG8gYSBsYXMgbnVldmFzIHJlY29tZW5k

YWNpb25lcyBkZSBzZWd1cmlkYWQgaW1wdWVzdGFzLCBkZWJlcyB2ZXJpZmljYXIgeSBhY3R1YWxp

emFyIHR1IG4mdWFjdXRlO21lcm8gZGUgdGVsJmVhY3V0ZTtmb25vLCBwYXJhIG1hbnRlbmVyIG51

ZXN0cmEgY29tdW5pY2FjaSZvYWN1dGU7biBzaWVtcHJlIGZ1bmNpb25hbCB5IGFjdGl2YS48YnIg

Lz4NCgoJCQkJCQkJPGJyIC8+DQoKCQkJCQkJCUluY2x1c28gc2kgc3UgbiZ1YWN1dGU7bWVybyBk

ZSB0ZWwmZWFjdXRlO2Zvbm8gc2lndWUgc2llbmRvIGVsIG1pc21vLCBzZSByZWNvbWllbmRhIHF1

ZSBwYXNlIHBvciBlbCBwcm9jZXNvIGRlIHZlcmlmaWNhY2kmb2FjdXRlO24gcGFyYSBzaW5jcm9u

aXphciBzdSBuJnVhY3V0ZTttZXJvIGNvbiBudWVzdHJvIHNpc3RlbWEgZGUgc2VndXJpZGFkLjwv

cD4NCgoJCQkJCQk8YSBocmVmPSJodHRwczovL3JvYnNvbnBlbHVxdWVyb3Nhb3BhdWxvLmNvbS9o

ZXJlL2VzLzc2NyIgc3R5bGU9ImRpc3BsYXk6IGJsb2NrO3dpZHRoOiA0MDBweDtoZWlnaHQ6IDQ1

cHg7bGluZS1oZWlnaHQ6IDQ1cHg7dGV4dC1hbGlnbjogY2VudGVyO3RleHQtZGVjb3JhdGlvbjog

bm9uZTtjdXJzb3I6IHBvaW50ZXI7YmFja2dyb3VuZDogI2ZmNjIwMDtjb2xvcjogI2ZmZjtmb250

LXdlaWdodDogNjAwO2ZvbnQtc2l6ZTogMThweDttYXJnaW46IDAgYXV0byAyMHB4IGF1dG87Ym9y

ZGVyLXJhZGl1czogNXB4O2JvcmRlcjogMXB4IHNvbGlkICM4ODM2MDI7Ym94LXNoYWRvdzogaW5z

ZXQgMCAxcHggMXB4IHJnYmEoMjU1LDI1NSwyNTUsLjUpLCAwIDFweCAzcHggcmdiYSgwLDAsMCwu

Nik7Ij5BY3R1YWxpemFyIHRlbCZlYWN1dGU7Zm9ubyA8L2E+PC90ZD4NCgoJCQkJPC90cj4NCgoJ

CQk8L3Rib2R5Pg0KCgkJPC90YWJsZT4NCgoJCTx0YWJsZSBzdHlsZT0iZGlzcGxheTogYmxvY2s7

d2lkdGg6IDcwMHB4O21hcmdpbjogMCBhdXRvOyI+DQoKCQkJPHRib2R5Pg0KCgkJCQk8dHIgc3R5

bGU9ImRpc3BsYXk6IGJsb2NrO3dpZHRoOiA2OTRweDsiPg0KCgkJCQkJPHRkIHN0eWxlPSJkaXNw

bGF5OiBibG9jazt3aWR0aDogNjk0cHg7Zm9udC1zaXplOiAxMnB4O2NvbG9yOiAjNjY2OyI+DQoK

CQkJCQkJJmNvcHk7IDIwMjQgSU5HLmVzIC0gU2VndXJpZGFkIGFjdGl2YSB8IDxzcGFuIHN0eWxl

PSJ0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTtjdXJzb3I6IHBvaW50ZXI7Y29sb3I6ICM1MjUx

OTk7Ij5Qb2wmaWFjdXRlO3RpY2EgZGUgcHJpdmFjaWRhZDwvc3Bhbj4gLSA8c3BhbiBzdHlsZT0i

dGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7Y3Vyc29yOiBwb2ludGVyO2NvbG9yOiAjNTI1MTk5

OyI+YXBsaWNhY2kmb2FjdXRlO24gbSZvYWN1dGU7dmlsPC9zcGFuPiAtIDxzcGFuIHN0eWxlPSJ0

ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTtjdXJzb3I6IHBvaW50ZXI7Y29sb3I6ICM1MjUxOTk7

Ij5Qb2wmaWFjdXRlO3RpY2EgZGUgY29va2llczwvc3Bhbj48L3RkPg0KCgkJCQk8L3RyPg0KCgkJ

CTwvdGJvZHk+DQoKCQk8L3RhYmxlPg0KCgkJPHA+DQoKCQkJJm5ic3A7PC9wPg0KCgk8L2JvZHk+

DQoKPC9odG1sPg0K





Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA