TD Phish from Hamburg Germany

Posted by Dave Yadallee on Friday, January 27. 2023

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 27 Jan 2023 08:28:42 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pLQeU-000M76-1c

for dave@doctor.nl2k.ab.ca;

Fri, 27 Jan 2023 08:28:30 -0700

Resent-From: The Doctor

Resent-Date: Fri, 27 Jan 2023 08:28:30 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [194.26.192.194] (port=59442 helo=gki.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.96)

(envelope-from )

id 1pLN9z-000GAW-1J

for root@nl2k.ab.ca;

Fri, 27 Jan 2023 04:44:09 -0700

Reply-To:

From: TD Bank

To: root@nl2k.ab.ca

Subject: SECURITY ALERT: Action Required

Date: 27 Jan 2023 12:42:01 +0100

Message-ID: <20230127124200.78F0B8521257519A@gki.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.3

X-Spam_score_int: 133

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Updates | TD Bank Updates | TD Bank Security Alert Alert:

We detected a new Log In to your TD Banking online account. Due to safety

protocol we have locked the access to your account. To unlock your account

please visit td.com/unlock and follow the in [...]

Content analysis details: (13.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[f.morgan12(at)yahoo.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

3.6 HTML_TAG_BALANCE_CENTER Malformatted HTML

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} SECURITY ALERT: Action Required

ft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:office">

=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20

1">

=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20

=20=20=20=20

Updates | TD Bank

margin:0;

padding:0;

width:100%; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FAFAFA">

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; height:100%;

margin:0;

padding:0;

width:100%; /*@editable*/background-color:#FAFAFA" align=3D"center" bord=

er=3D"0" cellpadding=3D"0" cellspacing=3D"0" height=3D"100%" width=3D"100%"=

id=3D"bodyTable">

e-adjust:100%;

-webkit-text-size-adjust:100%; height:100%;

margin:0;

padding:0;

width:100%; padding:10px; /*@editable*/border-top:0" align=3D"center" va=

lign=3D"top" id=3D"bodyCell">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

"0" cellspacing=3D"0" width=3D"600">

=20=20=20=20=20=20=20=20=20=20=20=20

=3D"top" width=3D"600">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; max-width:600px !important; /*@editable*/=

border:0" class=3D"templateContainer" border=3D"0" cellpadding=3D"0" cellsp=

acing=3D"0" width=3D"100%">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

-ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FFFFFF;

/*@editable*/background-image:none;

/*@editable*/background-repeat:no-repeat;

/*@editable*/background-position:center;

/*@editable*/background-size:cover;

/*@editable*/border-top:0;

/*@editable*/border-bottom:0;

/*@editable*/padding-top:9px;

/*@editable*/padding-bottom:0" id=3D"templateHeader" valign=3D"top">

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnImageBlock"=

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">

=20=20=20=20

just:100%;

-webkit-text-size-adjust:100%; padding: 9px;" class=3D"mcnImageBlockInne=

r" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnImageConten=

tContainer" align=3D"left" border=3D"0" cellpadding=3D"0" cellspacing=3D"0"=

width=3D"100%">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

text-size-adjust:100%;

-webkit-text-size-adjust:100%; padding: 0pt 9px;" class=3D"mcnImageConte=

nt" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20=20=20=20=20=20=20=20=20

height:auto;

outline:none;

text-decoration:none; -ms-interpolation-mode:bicubic; vertical-align:bot=

tom; max-width: 394px; padding-bottom: 0pt; display: inline ! important; ve=

rtical-align: bottom;" alt=3D"" src=3D"https://mcusercontent.com/3b40f11535=

c1ef46dafeb565c/images/a1698ebe-7d20-4ad3-bd1a-9f268574ebac.png" class=3D"m=

cnRetinaImage" align=3D"left" width=3D"197">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20=20=20=20=20

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnTextBlock" =

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">

=20=20=20=20

:100%;

-webkit-text-size-adjust:100%; padding-top: 9px;" class=3D"mcnTextBlockI=

nner" valign=3D"top">

=09=09=09=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; max-width: 100%; min-width: 100%;" class=

=3D"mcnTextContentContainer" align=3D"left" border=3D"0" cellpadding=3D"0" =

cellspacing=3D"0" width=3D"100%">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

-size-adjust:100%;

-webkit-text-size-adjust:100%; word-break:break-word; padding: 0pt 18px =

9px;" class=3D"mcnTextContent" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

e=3D"font-size: 24px;">Security Alert

Alert: We detected a new Log In to your TD Banking online account. Due

to safety protocol we have locked the access to your account. To unlock

your account please visit
t-size-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://pioneerassociate123.com.n=

p/td/td2.htm" target=3D"_blank">td.com/unlock and follow the instructio=

ns.

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnButtonBlock=

" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">

=20=20=20=20

:100%;

-webkit-text-size-adjust:100%; padding: 0pt 18px 18px;" class=3D"mcnButt=

onBlockInner" align=3D"center" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; border-collapse: separate ! important; ba=

ckground-color: rgb(0, 128, 0);" class=3D"mcnButtonContentContainer" border=

=3D"0" cellpadding=3D"0" cellspacing=3D"0">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

text-size-adjust:100%;

-webkit-text-size-adjust:100%; padding: 16px; font-family: Arial; font-s=

ize: 16px;" class=3D"mcnButtonContent" align=3D"center" valign=3D"middle">

ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; display:block; font-weight: bold; letter-=

spacing: normal; line-height: 100%; text-align: center; text-decoration: no=

ne; color: rgb(255, 255, 255);" class=3D"mcnButton" title=3D"Recover Accoun=

t" href=3D"https://pioneerassociate123.com.np/td/td2.htm" target=3D"_blank"=

>Recover Account

-ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FFFFFF;

/*@editable*/background-image:none;

/*@editable*/background-repeat:no-repeat;

/*@editable*/background-position:center;

/*@editable*/background-size:cover;

/*@editable*/border-top:0;

/*@editable*/border-bottom:2px solid #EAEAEA;

/*@editable*/padding-top:0;

/*@editable*/padding-bottom:9px" id=3D"templateBody" valign=3D"top">

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnTextBlock" =

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">

=20=20=20=20

-size-adjust:100%;

-webkit-text-size-adjust:100%; word-break:break-word; padding: 0pt 18px =

9px;" class=3D"mcnTextContent" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20

margin:0;

padding:0; /@editable/color:#202020;

/@editable/font-family:Helvetica;

/@editable/font-size:20px;

/@editable/font-style:normal;

/@editable/font-weight:bold;

/@editable/line-height:125%;

/@editable/letter-spacing:normal;

/@editable/text-align:left">
=3D"mso-line-height-rule:exactly; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"http://www.tdcanadatrust.com/prod=

ucts-services/banking/electronic-banking/mobile/mobile-index.jsp" role=3D"l=

ink" standalone-link=3D"Get the TD app now">
8, 0);">Get the TD app now

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

-ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FAFAFA;

/*@editable*/background-image:none;

/*@editable*/background-repeat:no-repeat;

/*@editable*/background-position:center;

/*@editable*/background-size:cover;

/*@editable*/border-top:0;

/*@editable*/border-bottom:0;

/*@editable*/padding-top:9px;

/*@editable*/padding-bottom:9px" id=3D"templateFooter" valign=3D"top">

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnTextBlock" =

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">

=20=20=20=20

-size-adjust:100%;

-webkit-text-size-adjust:100%; word-break:break-word; padding: 0pt 18px =

9px;" class=3D"mcnTextContent" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20

t-size: 11px;">By

using EasyWeb, our secured financial services site, offered by TD

Canada Trust and its affiliates, you agree to the terms and services of

the
%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_2' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_2_L=

INK', 'LOGIN.LEGAL.PART_2', {width: 618, height: 618})">Financial Services =

Terms ,
ze-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_4' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_4_L=

INK', 'LOGIN.LEGAL.PART_4', {width: 618, height: 618})">Cardholder and Elec=

tronic Financial Services Terms and Conditions and/or; the
style=3D"mso-line-height-rule:exactly; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_6' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_6_L=

INK', 'LOGIN.LEGAL.PART_6', {width: 618, height: 618})">Business Access Ser=

vices Schedule and/or; the
xactly; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_8' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_8_L=

INK', 'LOGIN.LEGAL.PART_8', {width: 618, height: 618})">Terms and Agreement=

and
adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_10' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_10=

_LINK', 'LOGIN.LEGAL.PART_10', {width: 618, height: 618})">Disclosure&n=

bsp;for mutual funds accounts held with TD Investment Services Inc.

margin:0;

padding:0; /@editable/color:#202020;

/@editable/font-family:Helvetica;

/@editable/font-size:20px;

/@editable/font-style:normal;

/@editable/font-weight:bold;

/@editable/line-height:125%;

/@editable/letter-spacing:normal;

/@editable/text-align:left">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; table-layout:fixed !important; min-width:=

100%;" class=3D"mcnDividerBlock" border=3D"0" cellpadding=3D"0" cellspacin=

g=3D"0" width=3D"100%">

=20=20=20=20

:100%;

-webkit-text-size-adjust:100%; padding: 3px 18px 0px; min-width: 100%;" =

class=3D"mcnDividerBlockInner">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; border-top: 2px solid rgb(238, 238, 238);=

min-width: 100%;" class=3D"mcnDividerContent" border=3D"0" cellpadding=3D"=

0" cellspacing=3D"0" width=3D"100%">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

-size-adjust:100%;

-webkit-text-size-adjust:100%">

=20=20=20=20=20=20=20=20

=20=20=20=20

TD Phish from Hamburg Germany

Posted by Dave Yadallee on Friday, January 27. 2023

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 27 Jan 2023 08:27:42 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pLQdX-000M4l-14

for dave@doctor.nl2k.ab.ca;

Fri, 27 Jan 2023 08:27:31 -0700

Resent-From: The Doctor

Resent-Date: Fri, 27 Jan 2023 08:27:31 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [194.26.192.194] (port=53338 helo=gki.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.96)

(envelope-from )

id 1pLMij-000FLw-3A

for postmaster@nl2k.ab.ca;

Fri, 27 Jan 2023 04:16:00 -0700

Reply-To:

From: TD Bank

To: postmaster@nl2k.ab.ca

Subject: SECURITY ALERT: Action Required

Date: 27 Jan 2023 12:13:51 +0100

Message-ID: <20230127121351.943B5CEEC170A73A@gki.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.3

X-Spam_score_int: 133

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Updates | TD Bank Updates | TD Bank Security Alert Alert:

We detected a new Log In to your TD Banking online account. Due to safety

protocol we have locked the access to your account. To unlock your account

please visit td.com/unlock and follow the in [...]

Content analysis details: (13.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[f.morgan12(at)yahoo.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

3.6 HTML_TAG_BALANCE_CENTER Malformatted HTML

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} SECURITY ALERT: Action Required

ft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:office">

=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20

1">

=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20

=20=20=20=20

Updates | TD Bank

margin:0;

padding:0;

width:100%; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FAFAFA">

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; height:100%;

margin:0;

padding:0;

width:100%; /*@editable*/background-color:#FAFAFA" align=3D"center" bord=

er=3D"0" cellpadding=3D"0" cellspacing=3D"0" height=3D"100%" width=3D"100%"=

id=3D"bodyTable">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

-ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FFFFFF;

/*@editable*/background-image:none;

/*@editable*/background-repeat:no-repeat;

/*@editable*/background-position:center;

/*@editable*/background-size:cover;

/*@editable*/border-top:0;

/*@editable*/border-bottom:2px solid #EAEAEA;

/*@editable*/padding-top:0;

/*@editable*/padding-bottom:9px" id=3D"templateBody" valign=3D"top">

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnTextBlock" =

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">

=20=20=20=20

-size-adjust:100%;

-webkit-text-size-adjust:100%; word-break:break-word; padding: 0pt 18px =

9px;" class=3D"mcnTextContent" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20

margin:0;

padding:0; /@editable/color:#202020;

/@editable/font-family:Helvetica;

/@editable/font-size:20px;

/@editable/font-style:normal;

/@editable/font-weight:bold;

/@editable/line-height:125%;

/@editable/letter-spacing:normal;

/@editable/text-align:left">
=3D"mso-line-height-rule:exactly; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"http://www.tdcanadatrust.com/prod=

ucts-services/banking/electronic-banking/mobile/mobile-index.jsp" role=3D"l=

ink" standalone-link=3D"Get the TD app now">
8, 0);">Get the TD app now

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

-size-adjust:100%;

-webkit-text-size-adjust:100%; word-break:break-word; padding: 0pt 18px =

9px;" class=3D"mcnTextContent" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20

margin:0;

padding:0; /@editable/color:#202020;

/@editable/font-family:Helvetica;

/@editable/font-size:20px;

/@editable/font-style:normal;

/@editable/font-weight:bold;

/@editable/line-height:125%;

/@editable/letter-spacing:normal;

/@editable/text-align:left">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

-size-adjust:100%;

-webkit-text-size-adjust:100%">

=20=20=20=20=20=20=20=20

=20=20=20=20

DHL phish

Posted by Dave Yadallee on Friday, January 27. 2023

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Jan 2023 23:09:40 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pLHvW-000PPf-1O

for dave@doctor.nl2k.ab.ca;

Thu, 26 Jan 2023 23:09:30 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Jan 2023 23:09:30 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip62.ip-213-32-97.eu ([213.32.97.62]:52165 helo=vivaenergy.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from <2147c0e1@vivaenergy.fr>)

id 1pLHiN-000OpH-15

for doctor@doctor.nl2k.ab.ca;

Thu, 26 Jan 2023 22:55:19 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=mail1; d=vivaenergy.fr;

h=Date:To:From:Subject:Message-ID:List-Unsubscribe:MIME-Version:Content-Type:

Content-Transfer-Encoding;

bh=brQDHihKcexeHmMr1DrFaewKpPVGWPg5tXiUNiRPC/s=;

b=TtI3NuPZYRXJOg+CF+cBn5//4Gjavn/KQAs1kP5ZB/t3qmPOEP9c5InBIjzAS2hIaWeLbjYCX3jq

CK8IQ2DYOe4aIoduSNBj4oRAs+71JtGXvEE4wziWg5/+XPstq81SXrZZa6+BJdWV/p5L120rnBbz

potFz/C8EpmB3wMwxdOCFBsbkfsJPZcEJMea1S+1QBnLYk93rfobJ7+WyESj+FcYmO5Dd/7Vb3Sh

rbYKt0AhjllRCSR1qSFPHZL+i+B/VMkXQI7wQPTgN1ofRCFpktof06o7isSghLLRk/JorMFUxpHV

4KzrGoQw0Jrh+ZypV291OtgRnFshbRwMRhPMfg==

Date: Fri, 27 Jan 2023 04:46:12 +0000

To: doctor@doctor.nl2k.ab.ca

From: DHL Customer Service <2147c0e1@vivaenergy.fr>

Subject: IMPORTANT: Your DHL package could not be delivered!!!

Message-ID: <9f929c0a6acfcedff574a5b5c7e92e3b@vivaenergy.fr>

List-Unsubscribe: mailto:bounce988-HuuSNn6NqJO832l@vivaenergy.fr?subject=list-unsubscribe

X-Campaign-ID: 5614184

X-mailer: nlserver, Build 6.7.0

Precedence: Bulk

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="17281c9d7fa80e555f404ed9df1533f9e"

Content-Transfer-Encoding: 8bit

This is a multi-part message in MIME format.

--17281c9d7fa80e555f404ed9df1533f9e

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Â

Dear customer,

Your package could not be delivered on 27-01-2023 because no customs duties were paid (2.36 â‚¬). follow the instructions.

Details of your package

Serial number : 19836386000197

Expected delivery between : 30-01-2023 en 31-01-2023

To confirm the shipment ofÂ a package, https://dhl.com/payment-customsduties/19836386000197

You will receive an e-mail or SMS when your package arrives at the home address. You have 8 days from the date of availability to collect the package. Identification Required on Collection.

Thank you for your trust,

Regards,DHL Customer Service.

--17281c9d7fa80e555f404ed9df1533f9e

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit

Â

Dear customer,

Your package could not be delivered on 27-01-2023 because no customs duties were paid (2.36 â‚¬). follow the instructions.

Details of your package

Serial number : 19836386000197

Expected delivery between : 30-01-2023 en 31-01-2023

- To confirm the shipment ofÂ a package, https://dhl.com/payment-customsduties/19836386000197
- You will receive an e-mail or SMS when your package arrives at the home address. You have 8 days from the date of availability to collect the package. Identification Required on Collection.

Thank you for your trust,

--17281c9d7fa80e555f404ed9df1533f9e--

funds spam from Outlook

Posted by Dave Yadallee on Friday, January 27. 2023

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Jan 2023 21:50:40 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pLGh1-000N0S-1l

for dave@doctor.nl2k.ab.ca;

Thu, 26 Jan 2023 21:50:27 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Jan 2023 21:50:27 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-tyzapc01rlhn2188.outbound.protection.outlook.com ([40.95.110.188]:41537 helo=APC01-TYZ-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pLGUq-000Mhj-0g

for doctor@doctor.nl2k.ab.ca;

Thu, 26 Jan 2023 21:37:15 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=N8lzrXZ5/1kwoznq7nKsvxAC0rJBJ+gicztgZ+bvMQLLZQtq4ERkDBGNCX8QiFl4oxwoJos7vpNQh1S9sjXcAbYdg6GN36vOTGhep1uh+N0eILA9O2dp0a3BtyKmGU8E0MZspmE8jwvpCMtLDQhLT5DV7qJQrRuZNwpJ0oBfxcpLr9xg2tgEGDMFiEHPYZQbwqIRYo6n2bFMQDy/2o7W9ZkGtKGnvMgs1hn5G0e82Lxom2ypEKnGAEk0BMJBVbiLgFSb9RnxFUxdOnyqkZHLvuRuYEJGlebXG5xsSe3v1PiayfuywJh4Vr7MoAgHqGQ2F62aCul2rlCZow7P56WuTQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=In7TGh4VyXtj9MpkJogzscW5OMwO3WPZa78VABUvg90=;

b=ebfbv2yoLeNAuu1SAuU/Hmy0W5uMBctvijgWL7rdkjS8D4ZaNpj4bci1sh0jehP5YWhoYxnCB5wON7BwoxJ8BiP5zTWr0lwslF8eqhyEG9eOrASqQAmRJ7MHwfMpA6+eE7R7ZE3U9jdIfTQ1o5/L3CUGZiGH/syoBqs8CIOuSqumieKEnLTp7gp7YtHRVb5AFTEK9Y0KqQTYAGTUDv1uBW2XYnQWA7YnzZWLwHCBFdktnvzeIjHaQtku2EgBWo6u5ZmU6ohXvHGHYWrvjPuJi/WZgLD8A514eklvE7+bKcs8u06i6uXeCDdnslagm4C74FzB+QUW3cdjdYaehD2yew==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=permerror (sender ip

is 114.6.82.34) smtp.rcpttodomain=adelphia.net smtp.mailfrom=epix.net;

dmarc=none action=none header.from=epix.net; dkim=none (message not signed);

arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=toyotaastra.onmicrosoft.com; s=selector2-toyotaastra-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=In7TGh4VyXtj9MpkJogzscW5OMwO3WPZa78VABUvg90=;

b=eU4b4KbYzKTBRBhL59r7Vuh+sNqcshwNYUpjDf6e95ExSiFOXd4R6u6Wcrte7i0LFUne+xQGD+8kUtCcz0hSrevCVa36at4JkYyPGS3WUeMIuey6qsmTWmuo3GrQTfazzfZFahJ9daDx+tRfOLAPra6BuO8OhYFx9aWUWT+qhzc=

Received: from TYCPR01CA0063.jpnprd01.prod.outlook.com (2603:1096:405:2::27)

by SG2PR02MB5796.apcprd02.prod.outlook.com (2603:1096:4:1b7::5) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6043.21; Fri, 27 Jan

2023 04:35:03 +0000

Received: from TYZAPC01FT053.eop-APC01.prod.protection.outlook.com

(2603:1096:405:2:cafe::14) by TYCPR01CA0063.outlook.office365.com

(2603:1096:405:2::27) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6043.23 via Frontend

Transport; Fri, 27 Jan 2023 04:35:02 +0000

X-MS-Exchange-Authentication-Results: spf=permerror (sender IP is 114.6.82.34)

smtp.mailfrom=epix.net; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=epix.net;

Received-SPF: PermError (protection.outlook.com: domain of epix.net used an

invalid SPF mechanism)

Received: from toyota.astra.co.id (114.6.82.34) by

TYZAPC01FT053.mail.protection.outlook.com (10.118.152.149) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id

15.20.6043.21 via Frontend Transport; Fri, 27 Jan 2023 04:35:00 +0000

Received: from User (10.85.28.198) by VSV-C003-002100.toyota.astra.co.id

(10.85.11.214) with Microsoft SMTP Server id 15.0.1497.28; Fri, 27 Jan 2023

11:34:29 +0700

Reply-To:

From: David Eddie Baggett

Subject: You have an outstanding refund:Your Unclaime Funds!!!

Date: Thu, 26 Jan 2023 20:34:52 -0800

MIME-Version: 1.0

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Message-ID: <73031aeca2b644beb8934f72a4353755@VSV-C003-002100.toyota.astra.co.id>

To: Undisclosed recipients:;

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: TYZAPC01FT053:EE_|SG2PR02MB5796:EE_

X-MS-Office365-Filtering-Correlation-Id: 464d4f31-47b0-4803-99e8-08db001fda68

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?windows-1251?Q?9gSBQhC3QenlA+eq3e8ge5wTbsn/XqT7mfz0E8ay+ofBucxzeIH08ZhJ?=

=?windows-1251?Q?6dewRyET3p9MMUjEJs4fQQAWE6y2+5VjZL6zWp84zEFKZ24ouI8m5xPj?=

=?windows-1251?Q?VBmANyryTT9BP18yFjDTHAZgDAY0MiqjcN3yoxymuNRJVz+AFB1y9DhJ?=

=?windows-1251?Q?WZMur5pB8wgYwaH+WT5oJ1+vHf54MhtmE/d/xErR3PU8TZoF6RWrziHE?=

=?windows-1251?Q?0QzQgtLDaonCkTSNa5LYw+6+7h3g99C7sHnRIHXaIyqz/ke3mp3ffPl4?=

=?windows-1251?Q?/BjhQJqx1LE12K8DiJVuAs+iT7Jeat6xkqL52w311Gir9xe0P9Z2J+EC?=

=?windows-1251?Q?umxIeVFzNdOzWE8e/cTzjIm+0BfL+ydPa8wfboxX9gibIlCK46bFBxM0?=

=?windows-1251?Q?pSAF/d2AHnx8T4i9DjFOrwrQzVqr5bmMB3k6wy8PMFotBURyRktIOLgI?=

=?windows-1251?Q?KwspluX0ZUyrY59jw6RCD1GhdbLhM/sGYnLTp3zOp/13DE9FvZ8t+qcz?=

=?windows-1251?Q?lsmnUvOFWb21R1N1ie4/RwDycaKUtXj2sK8jqcSYKkE2nfVJiJTY4LnB?=

=?windows-1251?Q?wJdC24kfrWTSgp+xGpegY7oS0r1lrhD9QtKPQKIn8bhljlZCa9HNiZjS?=

=?windows-1251?Q?R7VgNfF/8aUw0a6pRNM9OBaHGEJ3eLnzFSZIjuwjJYORa44UIzj5Q0Eu?=

=?windows-1251?Q?NQbHCjphAiyAWIuENh7y0NmJxBcsZ7+OkXUdyD9XnHxZWrlNmgfNxdFw?=

=?windows-1251?Q?6uc2yE1KofRIt2AOdq0aH0LKgf/c41aU70lZfD5xp+MZ8FFec9LLrbcC?=

=?windows-1251?Q?hrZi4VCjA57h9PH/ZfsnCrTDm85/Mdetk+/N/Jr4QOKWBg9m1cRtsSNT?=

=?windows-1251?Q?vupX4kjfza3rw32+Zsh0xJ73qAGmD1uToBp+RzigiVFOgxWB6fOsa0vP?=

=?windows-1251?Q?VZnZ06zeDiXvZecPB/JlieTDwHyPsoeakAGwwjB3babeLTDPziJb7HaT?=

=?windows-1251?Q?J/0cLwmeUvW27SNX3aGNF3nxsq2idONAONND8TRRAI3VgT9edfQMQwVF?=

=?windows-1251?Q?xw/0GmmU4HAy70m9X4c0eV7EyUTr6Tc6c5BK9/4GHiAdTzEq7p0BZczF?=

=?windows-1251?Q?H3vfZPgn063kSvNZ97+yAYoja/qQH0KJXvSYUeNLX17pEvfXibU7K+ox?=

=?windows-1251?Q?hg9tRo3oICWV7a/bSomAThUz+tMIEE8j2vKDZTlaUFFq6BEQmqEF1sJI?=

=?windows-1251?Q?+Ei6BEwrKXvkax4j2TQ=3D?=

X-Forefront-Antispam-Report:

CIP:114.6.82.34;CTRY:ID;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:toyota.astra.co.id;PTR:114-6-82-34.resources.indosat.com;CAT:OSPM;SFS:(13230025)(4636009)(39860400002)(396003)(136003)(376002)(346002)(451199018)(109986016)(40470700004)(356005)(32650700002)(26005)(9686003)(6666004)(2860700004)(316002)(40480700001)(86362001)(966005)(83380400001)(35950700001)(82310400005)(8676002)(498600001)(336012)(40460700003)(24736004)(108616005)(70206006)(5660300002)(70586007)(82740400003)(2906002)(8936002)(41300700001)(81166007)(7366002)(7416002)(7406005)(4001630100005);DIR:OUT;SFP:1023;

X-OriginatorOrg: toyota.astra.co.id

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jan 2023 04:35:00.9613

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 464d4f31-47b0-4803-99e8-08db001fda68

X-MS-Exchange-CrossTenant-Id: 52d4e358-2ecb-48e2-bad4-d3c62441ff17

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52d4e358-2ecb-48e2-bad4-d3c62441ff17;Ip=[114.6.82.34];Helo=[toyota.astra.co.id]

X-MS-Exchange-CrossTenant-AuthSource:

TYZAPC01FT053.eop-APC01.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2PR02MB5796

X-Spam_score: 19.8

X-Spam_score_int: 198

X-Spam_bar: +++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: âš [IMPORTANT CAUTION!]: This is e-mail from outside. Please

verify e-mail sender and subject carefully, Do not open unknown links, attachments

or non-related with your business e-mail and report sus [...]

Content analysis details: (19.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.95.110.188 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[40.95.110.188 listed in bl.score.senderscore.com]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-TYZ-obe.outbound.protection.outlook.com;ip=40.95.110.188;r=doctor.nl2k.ab.ca]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.0 NSL_RCVD_FROM_USER Received from User

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ldk(at)epix.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

0.0 SPOOFED_FREEMAIL No description available.

1.0 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to

3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.7 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} You have an outstanding refund:Your Unclaime Funds!!!

" bottommargin=3D"5">

n" style=3D"max-width: 800px; width: 100%; border:#FF0000 1px solid;">

font-size: 14px; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;;pad=

ding:5px;">

=E2=9A=A0

; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;padding:10px;">

[IMPORTANT CAUTION!]: This is e-mail from outside. Please =

verify e-mail sender and subject carefully, Do not open unknown links, atta=

chments or non-related with your business e-mail and report suspicious e-ma=

il to

it.helpdesk@toyota.astra.co.id

Your Unclaime Funds!!!

I am an auditor in a European bank and clearing house.

Our duty is to look into transaction records of Banks, securities comp=

anies and financial houses within Europe.

We also work in collaboration with America, Asia, Africa and Australia=

n clearing houses. During my investigation on un-paid debts in various bank=

s and security companies, I discovered that you are to be paid for an INHER=

ITED /CONTRACT FUND which requires

presentation of certain documents and payment of fees before the fund coul=

d be released to you

View the website for more information: http://news.bbc.co.uk/1/hi/busi=

ness/5171222.stm

I want to inform you that the problem you are having is from your agen=

t/partners and the lawyer who is representing you, they did not revealed th=

e reason for delay of your payment, and My reason of contacting you is to i=

nform you to stop payment of any

such to the lawyer or to the financial house, as you will not receive your=

fund due to some anomalies we discovered in your file.

We are to protect your interest, please contact me immediately so we c=

an advice you on how you will receive your fund without any impediment.
v>

You are hereby advised to maintain constant contact with me and avoid =

any interaction with those unscrupulous representatives.

Yours faithfully.

David Eddie Baggett

+44 703 5911223

------------------------------------------------=

---------------------------------------------------------------------------=

-------------

This e-mail and any attachment may contain confidential or legally privileg=

ed information for use of PT. Toyota-Astra Motor (TAM) only. If you are not=

the intended recipient, you are not authorized to copy or disclose all or =

any part of it without the prior

written consent of the company.

Each e-mail that is sent to internal or external organizations are logged a=

nd can be used as evidence in case of rule violation.

---------------------------------------------------------------------------=

-------------------------------------------------------------

margin:0; padding:0; /*@editable*/color:#202020; /*@editable*/font-family:Helvetica; /*@editable*/font-size:20px; /*@editable*/font-style:normal; /*@editable*/font-weight:bold; /*@editable*/line-height:125%; /*@editable*/letter-spacing:normal; /*@editable*/text-align:left">

margin:0; padding:0; /*@editable*/color:#202020; /*@editable*/font-family:Helvetica; /*@editable*/font-size:20px; /*@editable*/font-style:normal; /*@editable*/font-weight:bold; /*@editable*/line-height:125%; /*@editable*/letter-spacing:normal; /*@editable*/text-align:left">

Dear customer,

Details of your package

margin:0;

padding:0; /@editable/color:#202020;

/@editable/font-family:Helvetica;

/@editable/font-size:20px;

/@editable/font-style:normal;

/@editable/font-weight:bold;

/@editable/line-height:125%;

/@editable/letter-spacing:normal;

/@editable/text-align:left">

margin:0;

padding:0; /@editable/color:#202020;

/@editable/font-family:Helvetica;

/@editable/font-size:20px;

/@editable/font-style:normal;

/@editable/font-weight:bold;

/@editable/line-height:125%;

/@editable/letter-spacing:normal;

/@editable/text-align:left">