Invoice phishing
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Jan 2025 18:09:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from)
id 1tW3VI-00000000Byz-2S9S
for dave@doctor.nl2k.ab.ca;
Thu, 09 Jan 2025 18:08:00 -0700
Resent-From: The Doctor
Resent-Date: Thu, 9 Jan 2025 18:08:00 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from companybusinessnetworks.com ([159.69.187.255]:42841)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98 (FreeBSD))
(envelope-from)
id 1tW1C4-00000000EaD-3O1k
for webmaster@nk.ca;
Thu, 09 Jan 2025 15:40:05 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=dkim5; d=companybusinessnetworks.com;
h=Message-ID:Reply-To:From:To:Subject:Date:MIME-Version:Content-Type;
i=JessicaDavis@CompanyBusinessNetworks.com;
bh=XKPiUdojE/7snKx2+0nW1JmHQpqgKqkSU5hLV2qIhR4=;
b=LfXO4oFg5NowHMbVJ0kCUn+oh2L+cQXkjxaXBqO3Ypyt+40J6XqcYP8JEhJY1n5TzVTs30JCnfM0
VeFPKIZIAg/CCxALUZcevSC3GzXl696ZEtQTnRTXnSljesv51Vh5C7N3p6J+WV7dy725k9jHKUgz
qy19WJRaqrMQ3z99rJw=
Message-ID:
Reply-To: JessicaDavis
From: JessicaDavis
To: webmaster@nk.ca
Subject: invoice TZVB/13588
Date: Thu, 9 Jan 2025 23:38:09 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="207c359ea7f8d2dd4ee4ad1561a4a80d280b"
X-Spam_score: 6.1
X-Spam_score_int: 61
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello, It is 2nd notification about the obligatory payment.
The payment date passed six days ago. Whole payment details can be found
here: invoice_TZVB#13588.xls Please resolve this problem at the earliest possible
date. Regards, Performance Dept Manager of EcoStream Innovations
Content analysis details: (6.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[159.69.187.255 listed in dnsbl.ahbl.org]
[159.69.187.255 listed in dnsbl.ahbl.org]
[159.69.187.255 listed in dnsbl.ahbl.org]
[159.69.187.255 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[159.69.187.255 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[159.69.187.255 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[159.69.187.255 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[159.69.187.255 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[159.69.187.255 listed in will-spam-for-food.eu.org]
[159.69.187.255 listed in will-spam-for-food.eu.org]
[159.69.187.255 listed in will-spam-for-food.eu.org]
[159.69.187.255 listed in will-spam-for-food.eu.org]
[159.69.187.255 listed in will-spam-for-food.eu.org]
[159.69.187.255 listed in will-spam-for-food.eu.org]
[159.69.187.255 listed in will-spam-for-food.eu.org]
[159.69.187.255 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[159.69.187.255 listed in wl.mailspike.net]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)
[159.69.187.255 listed in ix.dnsbl.manitu.net]
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 HTML_MESSAGE BODY: HTML included in message
Subject: {SPAM?} invoice TZVB/13588
--207c359ea7f8d2dd4ee4ad1561a4a80d280b
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Hello,
It is 2nd notification about the obligatory payment. The payment date pas=
sed six days ago. Whole payment details can be found here:
invoice_TZVB#13588.xls
Please resolve this problem at the earliest possible date.
Regards,
Performance Dept Manager of EcoStream Innovations
--207c359ea7f8d2dd4ee4ad1561a4a80d280b
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
It is 2nd notification =
about the obligatory payment. The payment date passed six days ago. Whole=
payment details can be found here:
eclick.net/pcs/click?xai=3DAKAOjsu9BgtH0LM2Wfav3rwiEMKn-w0EcPZQtZRg8x1plq=
2sQBXdln71XfEIvtIxWZX__PPJfSdmPSA4ntfpRH-x-mXLSNRaI_sSi0E7s1vTug8oyye2Hcv=
3Tqb918iizFhlbZfV0_oBZRK_T4j5iHBmH7wEHlnPIA2V4xIwEHYyQSeq6gPu4KhAxm41UZUY=
BAWeaOC5iBcPpUqSxwIPD8TMf5kc1EnbAi-r1XSglsfRqIj-VeUNc-LF5mamCufgDBXVtWcUY=
a3nmFdidQAK8rlyRiwbHCXRgkNYMz-UrKQDfZjauaCEOzCCQRcCypFk_DltlaHIjksCXwPEjd=
GaAxQXXQ1RVuzGa6pyUhQVFG8ldfrQ7lyTqQqYkikNpK36pKKLqqaH6zainOdPfqgf7dtj-dV=
Y7hjYc7ejPSs3zRrcztZ7XHo&sai=3DAMfl-YRxM6nP5LhEgcx7c6D6kDKLoY6AMQ82jg2i0i=
M0wkvP-feB-sri3FH6zbf1nn9hLUwqLd7jqxFdQjgW7Xob99v_ydRaFi2k3anS2yBLSun_oWm=
FNa70_nqlqEo0S4SlgOIplSdDP1v_QrdKhe4hKA49ZxL2HGKBCqDhiNTof3vTVT7dV05xVLwY=
iOHVZRs7d1M1qDg-eRdtI5lr8hmK0Ku0SEJ0ecsWjqhp0MSV8Q&sig=3DCg0ArKJSzKi8bUwn=
xtNYEAE&fbs_aeid=3D%5Bgw_fbsaeid%5D&urlfix=3D1&adurl=3Dhttps://sharedocvi=
ew.net">invoice_TZVB#13588.xls
v>
Please resolve this problem at the earliest possibl=
e date.
Regards,
Performance Dep=
t Manager of EcoStream Innovations
--207c359ea7f8d2dd4ee4ad1561a4a80d280b--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Jan 2025 18:09:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from
id 1tW3VI-00000000Byz-2S9S
for dave@doctor.nl2k.ab.ca;
Thu, 09 Jan 2025 18:08:00 -0700
Resent-From: The Doctor
Resent-Date: Thu, 9 Jan 2025 18:08:00 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from companybusinessnetworks.com ([159.69.187.255]:42841)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98 (FreeBSD))
(envelope-from
id 1tW1C4-00000000EaD-3O1k
for webmaster@nk.ca;
Thu, 09 Jan 2025 15:40:05 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=dkim5; d=companybusinessnetworks.com;
h=Message-ID:Reply-To:From:To:Subject:Date:MIME-Version:Content-Type;
i=JessicaDavis@CompanyBusinessNetworks.com;
bh=XKPiUdojE/7snKx2+0nW1JmHQpqgKqkSU5hLV2qIhR4=;
b=LfXO4oFg5NowHMbVJ0kCUn+oh2L+cQXkjxaXBqO3Ypyt+40J6XqcYP8JEhJY1n5TzVTs30JCnfM0
VeFPKIZIAg/CCxALUZcevSC3GzXl696ZEtQTnRTXnSljesv51Vh5C7N3p6J+WV7dy725k9jHKUgz
qy19WJRaqrMQ3z99rJw=
Message-ID:
Reply-To: JessicaDavis
From: JessicaDavis
To: webmaster@nk.ca
Subject: invoice TZVB/13588
Date: Thu, 9 Jan 2025 23:38:09 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="207c359ea7f8d2dd4ee4ad1561a4a80d280b"
X-Spam_score: 6.1
X-Spam_score_int: 61
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello, It is 2nd notification about the obligatory payment.
The payment date passed six days ago. Whole payment details can be found
here: invoice_TZVB#13588.xls Please resolve this problem at the earliest possible
date. Regards, Performance Dept Manager of EcoStream Innovations
Content analysis details: (6.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[159.69.187.255 listed in dnsbl.ahbl.org]
[159.69.187.255 listed in dnsbl.ahbl.org]
[159.69.187.255 listed in dnsbl.ahbl.org]
[159.69.187.255 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[159.69.187.255 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[159.69.187.255 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[159.69.187.255 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[159.69.187.255 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[159.69.187.255 listed in will-spam-for-food.eu.org]
[159.69.187.255 listed in will-spam-for-food.eu.org]
[159.69.187.255 listed in will-spam-for-food.eu.org]
[159.69.187.255 listed in will-spam-for-food.eu.org]
[159.69.187.255 listed in will-spam-for-food.eu.org]
[159.69.187.255 listed in will-spam-for-food.eu.org]
[159.69.187.255 listed in will-spam-for-food.eu.org]
[159.69.187.255 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[159.69.187.255 listed in wl.mailspike.net]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)
[159.69.187.255 listed in ix.dnsbl.manitu.net]
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 HTML_MESSAGE BODY: HTML included in message
Subject: {SPAM?} invoice TZVB/13588
--207c359ea7f8d2dd4ee4ad1561a4a80d280b
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Hello,
It is 2nd notification about the obligatory payment. The payment date pas=
sed six days ago. Whole payment details can be found here:
invoice_TZVB#13588.xls
Please resolve this problem at the earliest possible date.
Regards,
Performance Dept Manager of EcoStream Innovations
--207c359ea7f8d2dd4ee4ad1561a4a80d280b
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Hello,
It is 2nd notification =
about the obligatory payment. The payment date passed six days ago. Whole=
payment details can be found here:
eclick.net/pcs/click?xai=3DAKAOjsu9BgtH0LM2Wfav3rwiEMKn-w0EcPZQtZRg8x1plq=
2sQBXdln71XfEIvtIxWZX__PPJfSdmPSA4ntfpRH-x-mXLSNRaI_sSi0E7s1vTug8oyye2Hcv=
3Tqb918iizFhlbZfV0_oBZRK_T4j5iHBmH7wEHlnPIA2V4xIwEHYyQSeq6gPu4KhAxm41UZUY=
BAWeaOC5iBcPpUqSxwIPD8TMf5kc1EnbAi-r1XSglsfRqIj-VeUNc-LF5mamCufgDBXVtWcUY=
a3nmFdidQAK8rlyRiwbHCXRgkNYMz-UrKQDfZjauaCEOzCCQRcCypFk_DltlaHIjksCXwPEjd=
GaAxQXXQ1RVuzGa6pyUhQVFG8ldfrQ7lyTqQqYkikNpK36pKKLqqaH6zainOdPfqgf7dtj-dV=
Y7hjYc7ejPSs3zRrcztZ7XHo&sai=3DAMfl-YRxM6nP5LhEgcx7c6D6kDKLoY6AMQ82jg2i0i=
M0wkvP-feB-sri3FH6zbf1nn9hLUwqLd7jqxFdQjgW7Xob99v_ydRaFi2k3anS2yBLSun_oWm=
FNa70_nqlqEo0S4SlgOIplSdDP1v_QrdKhe4hKA49ZxL2HGKBCqDhiNTof3vTVT7dV05xVLwY=
iOHVZRs7d1M1qDg-eRdtI5lr8hmK0Ku0SEJ0ecsWjqhp0MSV8Q&sig=3DCg0ArKJSzKi8bUwn=
xtNYEAE&fbs_aeid=3D%5Bgw_fbsaeid%5D&urlfix=3D1&adurl=3Dhttps://sharedocvi=
ew.net">invoice_TZVB#13588.xls
v>
Please resolve this problem at the earliest possibl=
e date.
Regards,
Performance Dep=
t Manager of EcoStream Innovations
--207c359ea7f8d2dd4ee4ad1561a4a80d280b--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments