More Royal Bank of Canada Phish
Posted by Dave Yadallee on
From - Tue Mar 11 09:17:13 2014
X-Account-Key: account2
X-UIDL: 000571bf501fb806
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-path:
Envelope-to: aboo@doctor.nl2k.ab.ca
Delivery-date: Tue, 11 Mar 2014 09:15:10 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.82)
(envelope-from)
id 1WNOI2-0002YU-7g
for aboo@doctor.nl2k.ab.ca; Tue, 11 Mar 2014 09:08:23 -0600
Resent-From: doctor@doctor.nl2k.ab.ca
Resent-Date: Tue, 11 Mar 2014 09:08:21 -0600
Resent-Message-ID: <20140311150821.GA9326@doctor.nl2k.ab.ca>
Resent-To: See root
Received: from [202.60.117.71] (helo=hdfx.com.cn)
by doctor.nl2k.ab.ca with esmtp (Exim 4.82)
(envelope-from)
id 1WNNro-0000no-0Y
for root@nk.ca; Tue, 11 Mar 2014 08:41:30 -0600
Received: from User ([98.173.59.168])
by hdfx.com.cn (Lotus Domino Release 6.5.4)
with ESMTP id 2014031122231779-353 ;
Tue, 11 Mar 2014 22:23:17 +0800
From: "RBC Royal Bank"
Subject: Your RBC Royal Bank Alerts
Date: Tue, 11 Mar 2014 07:22:10 -0700
MIME-Version: 1.0
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-MIMETrack: Itemize by SMTP Server on MAILSVR/MAILHDFX(Release 6.5.4|March 27, 2005) at
2014-03-11 22:23:18,
Serialize by Router on MAILSVR/MAILHDFX(Release 6.5.4|March 27, 2005) at
2014-03-11 22:41:18,
Serialize complete at 2014-03-11 22:41:18
Message-ID:
Content-Transfer-Encoding: 7bit
Content-Type: text/html;
charset="Windows-1251"
X-Spam_score: 20.1
X-Spam_score_int: 201
X-Spam_bar: ++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "gallifrey.nk.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Hello RBC Client, You are receiving this email because you
recently added or updated your email address, allowing RBC to contact you
by email and deliver useful product and account information straight to your
inbox. [...]
Content analysis details: (20.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[202.60.117.71 listed in psbl.surriel.com]
1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[202.60.117.71 listed in bb.barracudacentral.org]
3.4 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.2 NSL_RCVD_FROM_USER Received from User
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.net/Why?s=mfrom;id=ibanking%40ib.rbc.com;ip=202.60.117.71;r=gallifrey.nk.ca]
1.2 MISSING_HEADERS Missing To: header
0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FROM_MISSPACED From: missing whitespace
0.5 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.9 FROM_MISSP_NO_TO From misspaced, To missing
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 FROM_MISSP_SPF_FAIL FROM_MISSP_SPF_FAIL
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.5 FROM_MISSP_USER From misspaced, from "User"
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
Subject: {SPAM?} Your RBC Royal Bank Alerts
RBC Online Banking is offered by Royal Bank of Canada.
X-Account-Key: account2
X-UIDL: 000571bf501fb806
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-path:
Envelope-to: aboo@doctor.nl2k.ab.ca
Delivery-date: Tue, 11 Mar 2014 09:15:10 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.82)
(envelope-from
id 1WNOI2-0002YU-7g
for aboo@doctor.nl2k.ab.ca; Tue, 11 Mar 2014 09:08:23 -0600
Resent-From: doctor@doctor.nl2k.ab.ca
Resent-Date: Tue, 11 Mar 2014 09:08:21 -0600
Resent-Message-ID: <20140311150821.GA9326@doctor.nl2k.ab.ca>
Resent-To: See root
Received: from [202.60.117.71] (helo=hdfx.com.cn)
by doctor.nl2k.ab.ca with esmtp (Exim 4.82)
(envelope-from
id 1WNNro-0000no-0Y
for root@nk.ca; Tue, 11 Mar 2014 08:41:30 -0600
Received: from User ([98.173.59.168])
by hdfx.com.cn (Lotus Domino Release 6.5.4)
with ESMTP id 2014031122231779-353 ;
Tue, 11 Mar 2014 22:23:17 +0800
From: "RBC Royal Bank"
Subject: Your RBC Royal Bank Alerts
Date: Tue, 11 Mar 2014 07:22:10 -0700
MIME-Version: 1.0
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-MIMETrack: Itemize by SMTP Server on MAILSVR/MAILHDFX(Release 6.5.4|March 27, 2005) at
2014-03-11 22:23:18,
Serialize by Router on MAILSVR/MAILHDFX(Release 6.5.4|March 27, 2005) at
2014-03-11 22:41:18,
Serialize complete at 2014-03-11 22:41:18
Message-ID:
Content-Transfer-Encoding: 7bit
Content-Type: text/html;
charset="Windows-1251"
X-Spam_score: 20.1
X-Spam_score_int: 201
X-Spam_bar: ++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "gallifrey.nk.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Hello RBC Client, You are receiving this email because you
recently added or updated your email address, allowing RBC to contact you
by email and deliver useful product and account information straight to your
inbox. [...]
Content analysis details: (20.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[202.60.117.71 listed in psbl.surriel.com]
1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[202.60.117.71 listed in bb.barracudacentral.org]
3.4 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
1.2 NSL_RCVD_FROM_USER Received from User
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.net/Why?s=mfrom;id=ibanking%40ib.rbc.com;ip=202.60.117.71;r=gallifrey.nk.ca]
1.2 MISSING_HEADERS Missing To: header
0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FROM_MISSPACED From: missing whitespace
0.5 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.9 FROM_MISSP_NO_TO From misspaced, To missing
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.0 FROM_MISSP_SPF_FAIL FROM_MISSP_SPF_FAIL
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.5 FROM_MISSP_USER From misspaced, from "User"
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
Subject: {SPAM?} Your RBC Royal Bank Alerts
 |
|
RBC Online Banking is offered by Royal Bank of Canada.
![](3D"http://static.avast.com/emails/avast-mail-stamp.=<br)