Canada Revenue Phish from India

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 07 Dec 2022 16:13:36 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1p33YH-000Oq4-3c

for dave@doctor.nl2k.ab.ca;

Wed, 07 Dec 2022 16:10:09 -0700

Resent-From: The Doctor

Resent-Date: Wed, 7 Dec 2022 16:10:09 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [] (port=54141 helo=gki.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1p2zj0-000Lgy-BJ

for root@nl2k.ab.ca;

Wed, 07 Dec 2022 12:05:03 -0700

Reply-To:

From: Canada Revenue Agency - Agence du revenu du Canada

To: root@nl2k.ab.ca

Subject: Your Deposit of $1860.50 CAD is Still Pending

Date: 7 Dec 2022 20:02:27 +0100

Message-ID: <20221207200227.3EAD436AE6C1FACC@gki.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 11.7

X-Spam_score_int: 117

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: INTERAC E-TRANSFER REFUND: #8697BN87 root@nl2k.ab.ca, You

have received a refund of $1860.50 CAD



Content analysis details: (11.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[183.82.46.140 listed in bb.barracudacentral.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URIs: createsend1.com]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

0.0 LOTS_OF_MONEY Huge... sums of money

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.8 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

2.3 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

Subject: {SPAM?} Your Deposit of $1860.50 CAD is Still Pending






=2Ew3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">








" />




=3Dedge" />








0,700,400italic,700italic|Ubuntu:400,700,400italic,700italic" rel=3D"styles=

heet" type=3D"text/css">






padding: 0; margin: 0;

padding: 0;

-webkit-text-size-adjust: 100%; background-color:#ededf1" class=3D"full-p=

adding full-padding">




table-layout: fixed; border-collapse: collapse;

table-layout: fixed; min-width: 320px;

width: 100%; background-color:#ededf1" class=3D"wrapper" cellpadding=3D"0=

" cellspacing=3D"0" role=3D"presentation">





ease-in-out; max-width: 360px !important;

-fallback-width: 90% !important;

width: calc(100% - 60px) !important; Margin: 0 auto;

max-width: 560px;

min-width: 280px;

-fallback-width: 280px;

width: calc(28000% - 167440px)" class=3D"preheader">


display: table;

width: 100%" class=3D"preheader__inner--inline">




splay: table-cell;

Float: left;

font-size: 12px;

line-height: 19px;

max-width: 280px;

min-width: 140px;

-fallback-width: 140px;

width: calc(14000% - 78120px);

padding: 10px 0 5px 0; color:#7c7e7f; font-family:Ubuntu,sans-serif" clas=

s=3D"snippet">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20






splay: table-cell;

Float: left;

font-size: 12px;

line-height: 19px;

max-width: 280px;

min-width: 139px;

-fallback-width: 139px;

width: calc(14100% - 78680px);

padding: 10px 0 5px 0; text-align: right; color:#7c7e7f; font-family:Ubun=

tu,sans-serif" class=3D"webversion">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20










-container">
















ine">


display: table;

width: 100%" class=3D"layout__inner" emb-background-style=3D"">




s ease-in-out; max-width: 400px !important;

width: 100% !important" class=3D"column">

=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">

 




=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


mso-text-raise: 4px" class=3D"text--inline">

INTERAC E-TRANSFER REFUND: #8697B=

N87

root@nl2k.ab.ca,


-align: left;">You have received a refund of $1860.50 CAD 







=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


font-size: 2px;

line-height: 2px;

Margin-left: auto;

Margin-right: auto;

width: 40px; background-color:#b4b4c4" class=3D"divider"> 




=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">

 




=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


mso-text-raise: 4px" class=3D"text--inline">

Select your financial institution to deposit your money, this re=

fund expires on 8th December, 2022.







=20=20=20=20=20=20=20=20



=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


mso-text-raise: 4px" class=3D"text--inline">

Kind Regards,
Jacinta McIntyre, Canada Revenue Agency







=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


font-style: normal;

font-weight: normal;

line-height: 19px" class=3D"image--inline" align=3D"left">


height: auto;

width: 100%; max-width:160px" alt=3D"" width=3D"160" src=3D"https://i1.cr=

eatesend1.com/resize/ti/t/78/34E/B40/eblogo/signature4cropped.png">





=20=20=20=20=20=20=20=20









=20=20


nt-size:20px;"> 


=20=20

=20=20=20=20=20=20






display: table;

width: 100%" class=3D"layout__inner">






Margin-right: 20px" class=3D"column__padding--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


line-height: 19px" class=3D"email-footer__address--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




line-height: 19px" class=3D"email-footer__permission--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20














Margin-right: 20px" class=3D"column__padding--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20














display: table;

width: 100%" class=3D"layout__inner">




25s ease-in-out; max-width: 400px !important;

width: 100% !important" class=3D"column">


Margin-right: 20px" class=3D"column__padding--inline">


line-height: 19px" class=3D"email-footer__subscription--inline">


lang=3D"en">Preferences  |  
scribe style=3D"text-decoration: underline;">Unsubscribe















 










Canada Post Phish from Somee International Seattle

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Tue, 06 Dec 2022 21:21:02 -0700

Received: from [208.64.33.163] (port=62412 helo=oskd10)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1p2luq-000836-8m

for dave@nk.ca;

Tue, 06 Dec 2022 21:20:19 -0700

Received: from 3lyw4 ([127.0.0.1]) by oskd10 with Microsoft SMTPSVC(8.5.9600.16384);

Tue, 6 Dec 2022 20:18:39 -0800

From: "CANADA POST"

Subject: Your shipment status is pending !

To: dave@nk.ca

Content-Type: multipart/alternative;

boundary="=_NextPart_2rfkindysadvnqw3nerasdf";

charset="US-ASCII"

MIME-Version: 1.0

Reply-To: pending@postescanada.ca

Date: Sat, 30 Dec 1899 00:00:00 -0800

X-Priority: 3

Message-ID:

X-OriginalArrivalTime: 07 Dec 2022 04:18:39.0376 (UTC) FILETIME=[FBB41900:01D909F2]

X-Spam_score: 12.1

X-Spam_score_int: 121

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (12.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[208.64.33.163 listed in bb.barracudacentral.org]

0.0 FSL_HELO_NON_FQDN_1 No description available.

0.4 INVALID_DATE Invalid Date: header (not RFC 2822)

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=pending%40postescanada.ca;ip=208.64.33.163;r=doctor.nl2k.ab.ca]

2.1 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received:

date

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_MESSAGE BODY: HTML included in message

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

0.0 HELO_NO_DOMAIN Relay reports its domain incorrectly

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Your shipment status is pending !



This is a multi-part message in MIME format



--=_NextPart_2rfkindysadvnqw3nerasdf

Content-Type: text/plain

Content-Transfer-Encoding: quoted-printable





--=_NextPart_2rfkindysadvnqw3nerasdf

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable




s2/">3D""
hyudkposcapos2/nshyudkposcapos.gif" style=3D"width: 864px; height: 430px=

;" />





--=_NextPart_2rfkindysadvnqw3nerasdf--