CRA Phish from OVH Toronto
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 06 Feb 2023 23:59:07 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pPHw7-000CcQ-1M
for dave@doctor.nl2k.ab.ca;
Mon, 06 Feb 2023 23:58:39 -0700
Resent-From: The Doctor
Resent-Date: Mon, 6 Feb 2023 23:58:39 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from soren.irandns.com ([217.182.22.25]:35538)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from)
id 1pPH39-0002Sx-0B
for sales@nk.ca;
Mon, 06 Feb 2023 23:01:57 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=drminarezaei.com; s=default; h=Content-Transfer-Encoding:Content-Type:
MIME-Version:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=hppYHZWVXvsKt+YC13HlmxUohMTvL2gruHx3c5g726w=; b=Aj72pV84WV/2sfLb7LnBC5efwS
lcibpdi/guwR82UtFhaBsa33u+PhIfKijHXEsOkEKV6jnMLwBL0Y5IZN5f68L0khCKK6IcKvi3uTT
kfiGdEC2dTsvqBZ0Hih3SqCbb0L5ipNUU4FHFETGMQeRKdkkub5uvDmN6Wo4I4+9ouIyTd6umvB75
coRhPZkCC6g8WbJ+B84mYVJvK28jgTFaEgMvO1YzebfbC1IMf2K0R8h9y85/+G8y9H6X6Qxjnuogt
9CpmAjTcngGprcbjJ0/mvS61+QxrEgxdPrg0A8EELR+7P6AWFImtmkROn9fnlRvp0hCMqO/swnAsV
xqBfzHfQ==;
Received: from [173.35.162.92] (port=49259)
by soren.irandns.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95)
(envelope-from)
id 1pPH17-008C7D-5z
for sales@nk.ca;
Tue, 07 Feb 2023 09:29:45 +0330
From: Canada Revenue Agency/.
To: sales@nk.ca
Subject: Canada Revenue Agency/
Date: 6 Feb 2023 21:59:43 -0800
Message-ID: <20230206215927.58261D0AF9A1F6DF@drminarezaei.com>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - soren.irandns.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - drminarezaei.com
X-Get-Message-Sender-Via: soren.irandns.com: authenticated_id: help@drminarezaei.com
X-Authenticated-Sender: soren.irandns.com: help@drminarezaei.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 9.0
X-Spam_score_int: 90
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: English version ** La version française suit ** The Canada
Revenue Agency (CRA) sent you new mail online called: OTB notice
Content analysis details: (9.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.7 URI_WPADMIN WordPress login/admin URI, possible phishing
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
Subject: {SPAM?} Canada Revenue Agency/
rm: none; text-indent: 0px; letter-spacing: normal; font-family: "Helvetica=
Neue", Helvetica, Arial, sans-serif; font-size: 13px; font-style: normal; =
font-weight: 400; word-spacing: 0px; white-space: normal; orphans: 2; widow=
s: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: normal;=
font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=
-thickness: initial; text-decoration-style:=20
initial; text-decoration-color: initial;' type=3D"cite">
lang=3D"en" style=3D"text-align: center; color: blue; font-weight: bold; m=
argin-top: 12px; margin-bottom: 5px;">
p><=
/html>
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 06 Feb 2023 23:59:07 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pPHw7-000CcQ-1M
for dave@doctor.nl2k.ab.ca;
Mon, 06 Feb 2023 23:58:39 -0700
Resent-From: The Doctor
Resent-Date: Mon, 6 Feb 2023 23:58:39 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from soren.irandns.com ([217.182.22.25]:35538)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from
id 1pPH39-0002Sx-0B
for sales@nk.ca;
Mon, 06 Feb 2023 23:01:57 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=drminarezaei.com; s=default; h=Content-Transfer-Encoding:Content-Type:
MIME-Version:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=hppYHZWVXvsKt+YC13HlmxUohMTvL2gruHx3c5g726w=; b=Aj72pV84WV/2sfLb7LnBC5efwS
lcibpdi/guwR82UtFhaBsa33u+PhIfKijHXEsOkEKV6jnMLwBL0Y5IZN5f68L0khCKK6IcKvi3uTT
kfiGdEC2dTsvqBZ0Hih3SqCbb0L5ipNUU4FHFETGMQeRKdkkub5uvDmN6Wo4I4+9ouIyTd6umvB75
coRhPZkCC6g8WbJ+B84mYVJvK28jgTFaEgMvO1YzebfbC1IMf2K0R8h9y85/+G8y9H6X6Qxjnuogt
9CpmAjTcngGprcbjJ0/mvS61+QxrEgxdPrg0A8EELR+7P6AWFImtmkROn9fnlRvp0hCMqO/swnAsV
xqBfzHfQ==;
Received: from [173.35.162.92] (port=49259)
by soren.irandns.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95)
(envelope-from
id 1pPH17-008C7D-5z
for sales@nk.ca;
Tue, 07 Feb 2023 09:29:45 +0330
From: Canada Revenue Agency/.
To: sales@nk.ca
Subject: Canada Revenue Agency/
Date: 6 Feb 2023 21:59:43 -0800
Message-ID: <20230206215927.58261D0AF9A1F6DF@drminarezaei.com>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - soren.irandns.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - drminarezaei.com
X-Get-Message-Sender-Via: soren.irandns.com: authenticated_id: help@drminarezaei.com
X-Authenticated-Sender: soren.irandns.com: help@drminarezaei.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 9.0
X-Spam_score_int: 90
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: English version ** La version française suit ** The Canada
Revenue Agency (CRA) sent you new mail online called: OTB notice
Content analysis details: (9.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.7 URI_WPADMIN WordPress login/admin URI, possible phishing
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
Subject: {SPAM?} Canada Revenue Agency/
rm: none; text-indent: 0px; letter-spacing: normal; font-family: "Helvetica=
Neue", Helvetica, Arial, sans-serif; font-size: 13px; font-style: normal; =
font-weight: 400; word-spacing: 0px; white-space: normal; orphans: 2; widow=
s: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: normal;=
font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=
-thickness: initial; text-decoration-style:=20
initial; text-decoration-color: initial;' type=3D"cite">
lang=3D"en" style=3D"text-align: center; color: blue; font-weight: bold; m=
argin-top: 12px; margin-bottom: 5px;">
English version
n>** La version française suit ***p>
The Canada Re=
venue Agency (CRA) sent you new mail online called:
=
OTB notice
This mail may requ=
ire your attention.
ng=3D"en">If you have My Account, sign-in and click on "Mail" to read your =
mail.
rline;" href=3D"https://miscreant-wines.com/wp-admin/abd/adobe/BE/" target=
=3D"_blank" rel=3D"nofollow noopener noreferrer">View Document Here=
If you signed up to receive mail online b=
ut don't have My Account, go to the CRA web page to register.<=
br>
This is an automated email message. Please=
do not reply.
blue; font-weight: bold; margin-top: 12px; margin-bottom: 5px;">Version fr=
ançaise ** The English version =
precedes ***
L'Agence du revenu du Canada (ARC) vous a envoy&eacu=
te; du nouveau courrier en ligne intitulé :
<=
span>
nt-weight: bold;">Avis de la PTO
pan>Ce courrier peut nécessiter votre attention.
pan>
Si vous êtes inscrit à Mon dossier, ouvrez une session et cliq=
uez sur « Courrier » pour lire votre courrier.
le=3D"color: rgb(25, 106, 212); text-decoration: underline;" href=3D"https:=
//miscreant-wines.com/wp-admin/abd/adobe/BE/" target=3D"_blank" rel=3D"nofo=
llow noopener noreferrer">View Document Here
g=3D"fr">
span>
Si vous vous êtes inscrit pour recevoir votre courrier en ligne, mais=
n'êtes pas inscrit à Mon dossier, allez à la page Web =
de l'ARC pour vous y inscrire.
e>Ceci est un message électronique automatisé. Veu=
illez ne pas y répondre.
/html>