Costco survey phish from Yahoo! mail
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 28 Jul 2022 08:49:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oH4nz-0007n2-2B
for dave@doctor.nl2k.ab.ca;
Thu, 28 Jul 2022 08:48:03 -0600
Resent-From: The Doctor
Resent-Date: Thu, 28 Jul 2022 08:48:03 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [104.193.255.97] (port=42581 helo=peelregion.ca)
by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))
id 1oH4Ke-0002Ki-9C
for sales@nk.ca;
Thu, 28 Jul 2022 08:17:48 -0600
Received: from 10.214.167.174
by atlas208.aol.mail.gq1.yahoo.com with HTTPS; Wed, 27 Jul 2023 15:46:51 +0000
X-Originating-Ip: [209.85.221.48]
Received-SPF: pass (domain of gmail.com designates 209.85.221.48 as permitted sender)
Authentication-Results: atlas208.aol.mail.gq1.yahoo.com;
dkim=pass header.i=@gmail.com header.s=20210112;
spf=pass smtp.mailfrom=gmail.com;
dmarc=pass(p=NONE,sp=QUARANTINE) header.from=gmail.com;
X-Apparently-To: sales@nk.ca; Wed, 27 Jul 2023 15:46:51 +0000
X-YMailAVSC: iprxbUE3bBs.3Rn1NevN_gD_qi9wM4qdYNRGgzgqOBvWdlP
R3Dbqhd2Bi0tfSKVTVFKnxDTxyfSyNN6NQEkOthJ9BpVG12GhXi4BT4SWm7w
jOrGtsJ2kKmc3jiJyiebBhaIRFpIySJIUaSTBKKHz20i3y8BZfK5P9DowUa.
iH3f6KM7i_bXE53D_W1LrsZc1X4wDq1hFaDfmEepEtSHLOiMeLzhX_BUMcA5
R_LG.14Q1qdyv9mwfhr8.3M9pI8IMFcJzuO1uZV6whAyOOOR54w0z47GEU5y
tCbKe3z2ThSsF1lxDhiZbUNnpEMc.aFMgLivFvYZjzQ58UPfU7_PMX5nheCp
Em5NXxyVa5PD8FgSBMZL7Y_aTyzmWQiT6qJjBfstKbkvIFXXaSHI._DFF2Ms
crfnclFwl5GQBRgtoVFC2E1daIRkv6n_NCLTvp5STeoZwb5Ol91c57D5XOlI
eiRee7e5we8RRskn.nyGv2P9KG4KItuiqz7mwp2Fj_6k_OTPXviVS9b9F8SG
PIhP6t2v7zLFzmbrElx0a7VSXxQ1M3bFISJ.rqQXaO8x5uvRU9jxa2A6Wh17
O1mq7oPsWdcpO3Wzwkiz2iQu7Ow7DPFhqKXnW4Xn_PAIMVLoLItUzog_mN5h
eqUMcH31kR9dAqj6YVfUtvzcwWEpgYq9n00L6mtRbQ2K5mgNbtPhecGWxz1k
h5awkrG07X6fIulBxpbWqMvSEn8MiE43Mf.zDHZpTCkiHXO0_PA1pzfvSQSe
NGkh8mqVRUwaOJU6EorPXCFZTWdL5mPlWVC0a4iK4B3lGU0WZS.VCIOWSzax
53zZssaHiV7J7Xsy96P6fyngCT6.OB1zKRedoo7yAlqBromFwSWay7qHsPeP
tMdjRAIncRajZRoU.H.wfVlQZg5Si9ljHDrWvioRhBlUEuN84A9DislKjgwc
RKld3X5eB1IR1gUyvKvTfTllXpFzByyzL.PAmhFslmvusQNiNnCik0O_FNni
0OgoNgCOvTuzJH3Oq4mErHmf8QHQ0CaEJxMJ52lMbw441EDJ19SG3ngvqK46
ocjKOIgI5tjxiLN4h
X-YMailISG: eZwfje0WLDt4Cpg0FottjV3FcgQyjeVz6R_eeZwW9j1BZdTV
5IeGcpho5S.5ChE5qEhWFeWfJWUQDZthuRRaIxrwM6053RtAfqQfLFt1LdF1
YriudzDbZBDPVSTOdgUPESEtFUNuATiVvefL4pU8SxScf8PAPYV8M3QCcut4
AKxyVXSRGzxFIseJ.luoI8j8iK7uUpTX55dxOU8CDCHJ.DAaT.0xj89466fD
7d2Wb9okkzKdByd3N_wCg00TFtpIOG.jPLsr.xFQe9cjnucug6gxem4RQZUx
4h_8vOHJR0sU2Dqw6XX30gm5Ll8N6MJcW2umbMOwVBZlKFcecmfZVwK7qLVz
USdrWF6ZNx5advNCawcDTjCnqP8etUGWeRWFS9ee6pb5ARj_R7SpUVwfDg8y
wMo57NxDGdPGT_k9EvxDIhA9QtC3yrjqakts4StKjg5j2YC1oM8c1vvyqEoY
ZE5DwHa7hvr0GpZILMqRUC55Kqy_YUD6YTZO5GYr3R_vZdrmWJFrNUfSelsj
GZMPrFXLg4979sOjy9yoURV483dX1XaldWWdetk8T_EU.YSsHiGHg_DDFLfZ
JXisOC7FgQBCiLUFJN2qOWFLRS0tMFYxqrh53bZ3YC2U.kqbBDP92olgvn9W
g8990cFrfMLsoez_.Oq3fE7YUD7XEI_DjUMdCq5swmcwR55XujDnzDX4JSHO
T5w0gBpoJ_CRU1MLoES2k7kuTNTf9S2heIwobVmRi8eOmmiiCDE3VIicWJ35
ahBECaNNVsZPRXo9lIDLb0vJ5JWRyQrLhSQMLB.gy_j7o6cyhOIwVqxM0rxS
nOIGRexgcAoCLAGiNYUONjBKZwZyxXg0PH1X5pe5v3ZAP9IWqNGLoblFVg1o
miJZO7YXSbjjbS1EINmfLcrBxbOcUwoAuHm9W6kdZv6A0NVLMFMzD_L3GhwE
Sz9F6qvopFJJAfa7ayMfF0ZXINbY9XhSTf7mhi68HD_ujsd.UD5hUNNld0FZ
9.1us9zV4GKl.kgSXT2OPl.Qq8srFbRPQJ3uQzA2.lmH6DBSDHIGywzSn2rQ
DWjxMd2hLdiq_3k96EnZZ8pJU5YpjFLvqgv0ATK4M6YTLOMcWF5TFq3qHSKT
rzEuyU2jTMZEve59yDw6yLjSj1RFlS__q3r7dCpD8SSBUoBtNDWzb9yP.dht
wPzp
Received: from 209.85.221.48 (EHLO mail-wr1-f48.google.com)
by 10.214.167.174 with SMTPs
(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256);
Wed, 27 Jul 2023 15:46:51 +0000
Received: by mail-wr1-f48.google.com with SMTP id b26so25033521wrc.2
for; Wed, 27 Jul 2023 08:46:51 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:references:in-reply-to:from:date:message-id:subject:to;
bh=zaY7Yg8cQE5ZSGQkcp452fkOBkcojiJCJyOMoqUXsvE=;
b=aUeQPwJPHn2hm1K85kjF97vPqmdhidH5YjCjlNtZDqDIo5vWdu6QvuW/Kg1TZUHKD5
DdKKj1FuGonVSO3xjlGdqBf1qkiezq7lRgXxO46GuLoLwm5P6cmLSfbUh1c9OYgt0l37
D6im3svI0v0jl7V47RvhU85wHxHjcz83FdkHBKdrjtAwexLTk3ntKW9pRiPnITHWx3BG
QW/YKfyul5yG2spMGXCOXnx06lutUUxFx1/9x40b78hcdZKi9lQSPDdPqFVmgTeEjO8H
lctKEZjcsJdGH/eNg9SzpKI2f27sSuuGoZ3TvZ4JlsCrRJTy+xWu4XWSsluqbwkis2iV
iCZw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:references:in-reply-to:from:date
:message-id:subject:to;
bh=zaY7Yg8cQE5ZSGQkcp452fkOBkcojiJCJyOMoqUXsvE=;
b=5ubdJ4D09tELKw5Mvw1rfif6+NNX4KX3TXBVesKAqGp2vzKg/sEcW7jCg0fDMf9NeD
k1qSzuSwF2CZIT/wJ1mVWTknuUTlNzwxs/0kuInN4VRDlXBAGLB+rm8hTZdbeSV54tVe
/WpoBPmBJyb9qDJk6DyBL5RDS4MKzOhrUd9h7AZDAETggoyAtMOL3yx/uFZP9LV0wOII
aSzTW6V1YsimH22hcOMn4egj57uVx9dFHH+16tBdeMbbIvXmJMFFy8a/JMU83G32eh7Q
MqCms7idzqHfXQBTUOcm79R2CzQst60pqCoo1ewR6YPCuA8fc0SqDQ4NnjUGnth4jUU1
54jg==
X-Gm-Message-State: AJIora9xesToyEGym1jl6NJyuR4ySOh/hoFEpHf3pWzkyh8PGqujN1r6
90sEmgmAZ/kMDiaTsUMqlhJcwgOvxFmEDMCKPMgCkRzuOBdMSw==
X-Google-Smtp-Source: AGRyM1us1e1lz1TmpqgmLcUmmjvtYze2u0V8Y5vD4t4mcwmHhCjR8Ge5jsSNHoS/xJWg6NlpMS18e8ziUti2QtPu0NY=
X-Received: by 2002:a05:600c:49a4:b0:3a2:fec4:954c with SMTP id
h36-20020a05600c49a400b003a2fec4954cmr3601972wmp.163.1658936810613; Wed, 27
Jul 2023 08:46:50 -0700 (PDT)
MIME-Version: 1.0
From: "Surprise Reward"
Date: Wed, 27 Jul 2023 08:46:40 -0700
Message-ID:
Subject: Get a chance to win exclusive reward
To: sales
Content-Type: text/html;
X-Spam_score: 5.8
X-Spam_score_int: 58
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Just because today feels like any other Friday doesn't mean
that you shouldn't get what you deserve... Costco First Turkey, Then Great
Deals! Black Friday treats without the big crowds!. Get a chance [...]
Content analysis details: (5.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.7 EXCUSE_4 BODY: Claims you can be removed from the list
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or
Formatted Colors in HTML
0.0 ADMITS_SPAM Admits this is an ad
1.7 THIS_AD "This ad" and variants
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} Get a chance to win exclusive reward
click here to remove yourself from our emails list
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 28 Jul 2022 08:49:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oH4nz-0007n2-2B
for dave@doctor.nl2k.ab.ca;
Thu, 28 Jul 2022 08:48:03 -0600
Resent-From: The Doctor
Resent-Date: Thu, 28 Jul 2022 08:48:03 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [104.193.255.97] (port=42581 helo=peelregion.ca)
by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))
id 1oH4Ke-0002Ki-9C
for sales@nk.ca;
Thu, 28 Jul 2022 08:17:48 -0600
Received: from 10.214.167.174
by atlas208.aol.mail.gq1.yahoo.com with HTTPS; Wed, 27 Jul 2023 15:46:51 +0000
X-Originating-Ip: [209.85.221.48]
Received-SPF: pass (domain of gmail.com designates 209.85.221.48 as permitted sender)
Authentication-Results: atlas208.aol.mail.gq1.yahoo.com;
dkim=pass header.i=@gmail.com header.s=20210112;
spf=pass smtp.mailfrom=gmail.com;
dmarc=pass(p=NONE,sp=QUARANTINE) header.from=gmail.com;
X-Apparently-To: sales@nk.ca; Wed, 27 Jul 2023 15:46:51 +0000
X-YMailAVSC: iprxbUE3bBs.3Rn1NevN_gD_qi9wM4qdYNRGgzgqOBvWdlP
R3Dbqhd2Bi0tfSKVTVFKnxDTxyfSyNN6NQEkOthJ9BpVG12GhXi4BT4SWm7w
jOrGtsJ2kKmc3jiJyiebBhaIRFpIySJIUaSTBKKHz20i3y8BZfK5P9DowUa.
iH3f6KM7i_bXE53D_W1LrsZc1X4wDq1hFaDfmEepEtSHLOiMeLzhX_BUMcA5
R_LG.14Q1qdyv9mwfhr8.3M9pI8IMFcJzuO1uZV6whAyOOOR54w0z47GEU5y
tCbKe3z2ThSsF1lxDhiZbUNnpEMc.aFMgLivFvYZjzQ58UPfU7_PMX5nheCp
Em5NXxyVa5PD8FgSBMZL7Y_aTyzmWQiT6qJjBfstKbkvIFXXaSHI._DFF2Ms
crfnclFwl5GQBRgtoVFC2E1daIRkv6n_NCLTvp5STeoZwb5Ol91c57D5XOlI
eiRee7e5we8RRskn.nyGv2P9KG4KItuiqz7mwp2Fj_6k_OTPXviVS9b9F8SG
PIhP6t2v7zLFzmbrElx0a7VSXxQ1M3bFISJ.rqQXaO8x5uvRU9jxa2A6Wh17
O1mq7oPsWdcpO3Wzwkiz2iQu7Ow7DPFhqKXnW4Xn_PAIMVLoLItUzog_mN5h
eqUMcH31kR9dAqj6YVfUtvzcwWEpgYq9n00L6mtRbQ2K5mgNbtPhecGWxz1k
h5awkrG07X6fIulBxpbWqMvSEn8MiE43Mf.zDHZpTCkiHXO0_PA1pzfvSQSe
NGkh8mqVRUwaOJU6EorPXCFZTWdL5mPlWVC0a4iK4B3lGU0WZS.VCIOWSzax
53zZssaHiV7J7Xsy96P6fyngCT6.OB1zKRedoo7yAlqBromFwSWay7qHsPeP
tMdjRAIncRajZRoU.H.wfVlQZg5Si9ljHDrWvioRhBlUEuN84A9DislKjgwc
RKld3X5eB1IR1gUyvKvTfTllXpFzByyzL.PAmhFslmvusQNiNnCik0O_FNni
0OgoNgCOvTuzJH3Oq4mErHmf8QHQ0CaEJxMJ52lMbw441EDJ19SG3ngvqK46
ocjKOIgI5tjxiLN4h
X-YMailISG: eZwfje0WLDt4Cpg0FottjV3FcgQyjeVz6R_eeZwW9j1BZdTV
5IeGcpho5S.5ChE5qEhWFeWfJWUQDZthuRRaIxrwM6053RtAfqQfLFt1LdF1
YriudzDbZBDPVSTOdgUPESEtFUNuATiVvefL4pU8SxScf8PAPYV8M3QCcut4
AKxyVXSRGzxFIseJ.luoI8j8iK7uUpTX55dxOU8CDCHJ.DAaT.0xj89466fD
7d2Wb9okkzKdByd3N_wCg00TFtpIOG.jPLsr.xFQe9cjnucug6gxem4RQZUx
4h_8vOHJR0sU2Dqw6XX30gm5Ll8N6MJcW2umbMOwVBZlKFcecmfZVwK7qLVz
USdrWF6ZNx5advNCawcDTjCnqP8etUGWeRWFS9ee6pb5ARj_R7SpUVwfDg8y
wMo57NxDGdPGT_k9EvxDIhA9QtC3yrjqakts4StKjg5j2YC1oM8c1vvyqEoY
ZE5DwHa7hvr0GpZILMqRUC55Kqy_YUD6YTZO5GYr3R_vZdrmWJFrNUfSelsj
GZMPrFXLg4979sOjy9yoURV483dX1XaldWWdetk8T_EU.YSsHiGHg_DDFLfZ
JXisOC7FgQBCiLUFJN2qOWFLRS0tMFYxqrh53bZ3YC2U.kqbBDP92olgvn9W
g8990cFrfMLsoez_.Oq3fE7YUD7XEI_DjUMdCq5swmcwR55XujDnzDX4JSHO
T5w0gBpoJ_CRU1MLoES2k7kuTNTf9S2heIwobVmRi8eOmmiiCDE3VIicWJ35
ahBECaNNVsZPRXo9lIDLb0vJ5JWRyQrLhSQMLB.gy_j7o6cyhOIwVqxM0rxS
nOIGRexgcAoCLAGiNYUONjBKZwZyxXg0PH1X5pe5v3ZAP9IWqNGLoblFVg1o
miJZO7YXSbjjbS1EINmfLcrBxbOcUwoAuHm9W6kdZv6A0NVLMFMzD_L3GhwE
Sz9F6qvopFJJAfa7ayMfF0ZXINbY9XhSTf7mhi68HD_ujsd.UD5hUNNld0FZ
9.1us9zV4GKl.kgSXT2OPl.Qq8srFbRPQJ3uQzA2.lmH6DBSDHIGywzSn2rQ
DWjxMd2hLdiq_3k96EnZZ8pJU5YpjFLvqgv0ATK4M6YTLOMcWF5TFq3qHSKT
rzEuyU2jTMZEve59yDw6yLjSj1RFlS__q3r7dCpD8SSBUoBtNDWzb9yP.dht
wPzp
Received: from 209.85.221.48 (EHLO mail-wr1-f48.google.com)
by 10.214.167.174 with SMTPs
(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256);
Wed, 27 Jul 2023 15:46:51 +0000
Received: by mail-wr1-f48.google.com with SMTP id b26so25033521wrc.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;
h=mime-version:references:in-reply-to:from:date:message-id:subject:to;
bh=zaY7Yg8cQE5ZSGQkcp452fkOBkcojiJCJyOMoqUXsvE=;
b=aUeQPwJPHn2hm1K85kjF97vPqmdhidH5YjCjlNtZDqDIo5vWdu6QvuW/Kg1TZUHKD5
DdKKj1FuGonVSO3xjlGdqBf1qkiezq7lRgXxO46GuLoLwm5P6cmLSfbUh1c9OYgt0l37
D6im3svI0v0jl7V47RvhU85wHxHjcz83FdkHBKdrjtAwexLTk3ntKW9pRiPnITHWx3BG
QW/YKfyul5yG2spMGXCOXnx06lutUUxFx1/9x40b78hcdZKi9lQSPDdPqFVmgTeEjO8H
lctKEZjcsJdGH/eNg9SzpKI2f27sSuuGoZ3TvZ4JlsCrRJTy+xWu4XWSsluqbwkis2iV
iCZw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:references:in-reply-to:from:date
:message-id:subject:to;
bh=zaY7Yg8cQE5ZSGQkcp452fkOBkcojiJCJyOMoqUXsvE=;
b=5ubdJ4D09tELKw5Mvw1rfif6+NNX4KX3TXBVesKAqGp2vzKg/sEcW7jCg0fDMf9NeD
k1qSzuSwF2CZIT/wJ1mVWTknuUTlNzwxs/0kuInN4VRDlXBAGLB+rm8hTZdbeSV54tVe
/WpoBPmBJyb9qDJk6DyBL5RDS4MKzOhrUd9h7AZDAETggoyAtMOL3yx/uFZP9LV0wOII
aSzTW6V1YsimH22hcOMn4egj57uVx9dFHH+16tBdeMbbIvXmJMFFy8a/JMU83G32eh7Q
MqCms7idzqHfXQBTUOcm79R2CzQst60pqCoo1ewR6YPCuA8fc0SqDQ4NnjUGnth4jUU1
54jg==
X-Gm-Message-State: AJIora9xesToyEGym1jl6NJyuR4ySOh/hoFEpHf3pWzkyh8PGqujN1r6
90sEmgmAZ/kMDiaTsUMqlhJcwgOvxFmEDMCKPMgCkRzuOBdMSw==
X-Google-Smtp-Source: AGRyM1us1e1lz1TmpqgmLcUmmjvtYze2u0V8Y5vD4t4mcwmHhCjR8Ge5jsSNHoS/xJWg6NlpMS18e8ziUti2QtPu0NY=
X-Received: by 2002:a05:600c:49a4:b0:3a2:fec4:954c with SMTP id
h36-20020a05600c49a400b003a2fec4954cmr3601972wmp.163.1658936810613; Wed, 27
Jul 2023 08:46:50 -0700 (PDT)
MIME-Version: 1.0
From: "Surprise Reward"
Date: Wed, 27 Jul 2023 08:46:40 -0700
Message-ID:
Subject: Get a chance to win exclusive reward
To: sales
Content-Type: text/html;
X-Spam_score: 5.8
X-Spam_score_int: 58
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Just because today feels like any other Friday doesn't mean
that you shouldn't get what you deserve... Costco First Turkey, Then Great
Deals! Black Friday treats without the big crowds!. Get a chance [...]
Content analysis details: (5.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.7 EXCUSE_4 BODY: Claims you can be removed from the list
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or
Formatted Colors in HTML
0.0 ADMITS_SPAM Admits this is an ad
1.7 THIS_AD "This ad" and variants
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} Get a chance to win exclusive reward
| Just because today feels like any other Friday doesn't mean that you shouldn't get what you deserve... |
| This is an advertisement. Costco is a trademark who is not affiliated with this promotion. To be removed please Unsubscribe here or write to: 616 Corporate Way Ste.2-9092 Valley Cottage, NY 10989 |
click here to remove yourself from our emails list
