e-mail phish from Crowncloud US LLC
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 15 Mar 2023 07:03:33 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pcQmh-000EUL-3B
for dave@doctor.nl2k.ab.ca;
Wed, 15 Mar 2023 07:03:15 -0600
Resent-From: The Doctor
Resent-Date: Wed, 15 Mar 2023 07:03:15 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [192.52.167.102] (port=53632 helo=lasaulec.nl)
by doctor.nl2k.ab.ca with esmtp (Exim 4.96)
(envelope-from)
id 1pcPho-0005wK-1m
for sales@netknow.ca;
Wed, 15 Mar 2023 05:54:16 -0600
Reply-To: ptyltdsalesinfo@gmail.com
From: netknow.ca
To: sales@netknow.ca
Subject: Re: sales ; Update Your Mailbox !!!
Date: 15 Mar 2023 11:52:03 +0000
Message-ID: <20230315115203.83573562658447F0@lasaulec.nl>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 11.3
X-Spam_score_int: 113
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attention: sales@netknow.ca Your password is expiring. The
system will generate a new password for you automatcally. Your access to
your mailbox will be limited for up to 12 hours before service can be restored.
Content analysis details: (11.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 NORDNS_LOW_CONTRAST No rDNS + hidden text
0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
Subject: {SPAM?} Re: sales ; Update Your Mailbox !!!
-FAMILY: Calibri, Arial, Helvetica, sans-serif; BORDER-RIGHT: 0px; VERTICAL=
-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: rgb(0,0,0); PADDING-BOTTOM: 0p=
x; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADD=
ING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); font-stretch: inherit">=
l, Helvetica, sans-serif; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORD=
ER-BOTTOM: 0px; COLOR: rgb(0,0,0); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; P=
ADDING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px; BACKGR=
OUND-COLOR: rgb(255,255,255); font-stretch: inherit">
BORDER-TOP: 0px; FONT-FAMILY: "Helvetica Neue", Helvetica, Arial, sans-seri=
f; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: =
rgb(29,34,40); PADDING-BOTTOM: 0px; TEXT-ALIGN: left; PADDING-TOP: 0px; PAD=
DING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px; BACKGROU=
ND-COLOR: rgb(255,255,255); font-stretch: inherit'>
=3D"BORDER-TOP: 0px; FONT-FAMILY: Calibri, sans-serif, serif; BORDER-RIGHT:=
0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: rgb(38,40,42); P=
ADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; BORDE=
R-LEFT: 0px; PADDING-RIGHT: 0px; font-stretch: inherit">Attention:
lor=3D#171be8>sales@netknow.ca
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 15 Mar 2023 07:03:33 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pcQmh-000EUL-3B
for dave@doctor.nl2k.ab.ca;
Wed, 15 Mar 2023 07:03:15 -0600
Resent-From: The Doctor
Resent-Date: Wed, 15 Mar 2023 07:03:15 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [192.52.167.102] (port=53632 helo=lasaulec.nl)
by doctor.nl2k.ab.ca with esmtp (Exim 4.96)
(envelope-from
id 1pcPho-0005wK-1m
for sales@netknow.ca;
Wed, 15 Mar 2023 05:54:16 -0600
Reply-To: ptyltdsalesinfo@gmail.com
From: netknow.ca
To: sales@netknow.ca
Subject: Re: sales ; Update Your Mailbox !!!
Date: 15 Mar 2023 11:52:03 +0000
Message-ID: <20230315115203.83573562658447F0@lasaulec.nl>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 11.3
X-Spam_score_int: 113
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attention: sales@netknow.ca Your password is expiring. The
system will generate a new password for you automatcally. Your access to
your mailbox will be limited for up to 12 hours before service can be restored.
Content analysis details: (11.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 NORDNS_LOW_CONTRAST No rDNS + hidden text
0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
Subject: {SPAM?} Re: sales ; Update Your Mailbox !!!
-FAMILY: Calibri, Arial, Helvetica, sans-serif; BORDER-RIGHT: 0px; VERTICAL=
-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: rgb(0,0,0); PADDING-BOTTOM: 0p=
x; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADD=
ING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); font-stretch: inherit">=
l, Helvetica, sans-serif; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORD=
ER-BOTTOM: 0px; COLOR: rgb(0,0,0); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; P=
ADDING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px; BACKGR=
OUND-COLOR: rgb(255,255,255); font-stretch: inherit">
BORDER-TOP: 0px; FONT-FAMILY: "Helvetica Neue", Helvetica, Arial, sans-seri=
f; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: =
rgb(29,34,40); PADDING-BOTTOM: 0px; TEXT-ALIGN: left; PADDING-TOP: 0px; PAD=
DING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px; BACKGROU=
ND-COLOR: rgb(255,255,255); font-stretch: inherit'>
=3D"BORDER-TOP: 0px; FONT-FAMILY: Calibri, sans-serif, serif; BORDER-RIGHT:=
0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: rgb(38,40,42); P=
ADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; BORDE=
R-LEFT: 0px; PADDING-RIGHT: 0px; font-stretch: inherit">Attention:
lor=3D#171be8>sales@netknow.ca
-FAMILY: Calibri, Arial, Helvetica, sans-serif; BORDER-RIGHT: 0px; VERTICAL=
-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: rgb(0,0,0); PADDING-BOTTOM: 0p=
x; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADD=
ING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); font-stretch: inherit">=
l, Helvetica, sans-serif; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORD=
ER-BOTTOM: 0px; COLOR: rgb(0,0,0); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; P=
ADDING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px; BACKGR=
OUND-COLOR: rgb(255,255,255); font-stretch: inherit">
ORDER-TOP: 0px; FONT-FAMILY: "Helvetica Neue", Helvetica, Arial, sans-serif=
; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: r=
gb(29,34,40); PADDING-BOTTOM: 0px; TEXT-ALIGN: left; PADDING-TOP: 0px; PADD=
ING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px; BACKGROUN=
D-COLOR: rgb(255,255,255); font-stretch: inherit'>
BORDER-BOTTOM: 0px; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDIN=
G-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px">
0px; FONT-FAMILY: Calibri, sans-serif, serif; COLOR: rgb(38,40,42); MARGIN=
-TOP: 0px">
0px; FONT-FAMILY: Calibri, sans-serif, serif; COLOR: rgb(38,40,42); MARGIN=
-TOP: 0px">Your password is expiring. The system will generate a new passwo=
rd for you automatcally.
d0>Your access to your mailbox will be limited for up to 12 hours before se=
rvice can be restored.
>
To retain your password and avoid change, simply use the button below.
lass=3DContentPasted0>
TOP: 0px; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: 0px; =
COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: =
0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px">
0" style=3D'BORDER-TOP: 0px; HEIGHT: 16px; BORDER-RIGHT: 0px; WIDTH: 349px;=
VERTICAL-ALIGN: baseline; BACKGROUND: rgb(220,60,0) 0% 50%; BORDER-BOTTOM:=
0px; COLOR: white; PADDING-BOTTOM: 15px; TEXT-ALIGN: center; PADDING-TOP: =
15px; FONT: 15px "normal monospace"; PADDING-LEFT: 15px; MARGIN: 0px; BORDE=
R-LEFT: 0px; DISPLAY: block; PADDING-RIGHT: 15px'=20
href=3D"https://www.onlllieusme.com/FB4F3316E/86AB06EB2FB4F3316E67610BC0515=
6F2196155D.php?login=3Dsales@netknow.ca" data-auth=3D"NotApplicable">Keep U=
sing Old Password
medium; FONT-FAMILY: "Times New Roman"; WHITE-SPACE: normal; WORD-SPACING: =
0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE:=
normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: r=
gb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-var=
iant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thicknes=
s: initial; text-decoration-style: initial;=20
text-decoration-color: initial'>