Netflix phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 01 Apr 2023 13:09:10 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pigb4-000Oe5-02

for dave@doctor.nl2k.ab.ca;

Sat, 01 Apr 2023 13:09:06 -0600

Resent-From: The Doctor

Resent-Date: Sat, 1 Apr 2023 13:09:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from boar.birch.relay.mailchannels.net ([23.83.209.250]:19935)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pifkX-000N1X-1r

for info@netknow.ca;

Sat, 01 Apr 2023 12:14:53 -0600

X-Sender-Id: hostpapa|x-authuser|a3@autogatesandfencing.com.au

Received: from relay.mailchannels.net (localhost [127.0.0.1])

by relay.mailchannels.net (Postfix) with ESMTP id 07C1D761E65;

Sat, 1 Apr 2023 18:12:50 +0000 (UTC)

Received: from r129.websiteservername.com (unknown [127.0.0.6])

(Authenticated sender: hostpapa)

by relay.mailchannels.net (Postfix) with ESMTPA id 6FDD5761E14;

Sat, 1 Apr 2023 18:12:41 +0000 (UTC)

ARC-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1680372769; a=rsa-sha256;

cv=none;

b=OzOiNrT7kDPJQtTfgV7N8RemdQ/eh8DHRAGq04bHDrIjUbIHhf3ajb3yZmxEALJm4GWdPI

eg45qBXwIilStGJYtAKvHfZcqSXACADtxQ1sImYyI9X3Zjn3dBeAbshIodcwWaH65mTsNk

MeoVj91SQwA/aWNpp0++cNYe5UA4pmXUC6kSNwRg81ASyXY2hO/y8N9HlPWbV6y9Kg2NF2

+Lxn4vBD+IoIe5fWqFSSY0cWnUc1/EfyFZ+F/2wYYzpkl2T04ARj9RiYi9yidbQTLaZ6cy

uBUkRiRlPzX7K3m0yG0bDb2V3R1SfY0vcaNp3o86Ju1MmvsltZW/DbQLeHhtxg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed;

d=mailchannels.net;

s=arc-2022; t=1680372769;

h=from:from:reply-to:reply-to:subject:subject:date:date:

message-id:message-id:to:to:cc:mime-version:mime-version:

content-type:content-type:dkim-signature;

bh=Bs8Pm7k0VrnEq4BRDrei3NNDaZxDZ9AaBob4DzjEn30=;

b=u7l7c06rwOhLleZP0rMaXZMHSrvD4PUbvPifuQqpbZSCPCba7+q4yL64i0JLMpmCmkXkvt

p7Asi+g1Zak9Bu3c21MSqkjv6xFJNyufUOYu5uCi4tMmU4F5W66iu9atLbXW5Oz80VSx71

bmAvhxzGTlvuOvSymTXJPqpGtR/mMgVBp/JNCXv21RQ1fp9XpLBlurGu/GSV2/mBMnc7uu

iEh/gBBk5C/X7NjWJeBimK2PnmgnF8v6ZCJaQca4ykRDXho60W7DzMgNWnjtaPMW2F9Mx4

SiT3hu3hGHVlgWJjQ4YtTh2rrmmTa5nEp54F10UQT0VIlMPYfPc8AndKLph2Aw==

ARC-Authentication-Results: i=1;

rspamd-786cb55f77-8zshc;

auth=pass smtp.auth=hostpapa smtp.mailfrom=a3@autogatesandfencing.com.au

X-Sender-Id: hostpapa|x-authuser|a3@autogatesandfencing.com.au

X-MC-Relay: Bad

X-MailChannels-SenderId: hostpapa|x-authuser|a3@autogatesandfencing.com.au

X-MailChannels-Auth-Id: hostpapa

X-Illegal-Snatch: 0d9fb1594e897388_1680372769610_309881253

X-MC-Loop-Signature: 1680372769610:726466694

X-MC-Ingress-Time: 1680372769610

Received: from r129.websiteservername.com (r129.websiteservername.com

[66.199.141.102])

(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384)

by 100.127.59.29 (trex/6.7.2);

Sat, 01 Apr 2023 18:12:49 +0000

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=autogatesandfencing.com.au; s=default; h=Content-Type:Message-ID:Reply-To:

Subject:To:From:Date:MIME-Version:Sender:Cc:Content-Transfer-Encoding:

Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:

Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:

List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=Bs8Pm7k0VrnEq4BRDrei3NNDaZxDZ9AaBob4DzjEn30=; b=Qh6aGSwr9BRF+8w/NdX939Qr66

9OF9rgNkPA24zV4x7dW+3sC8GsI3fyUIv/pa6DxCZ6J9jNm2AuoKAMgXLuyHN+5cgBP9Oe0p+dwy7

xpOdjTp8cXZGJXZSgARz8cVl38PDs1GIah/jzNQRjMBBua1TtTdxNduOQ3l0W//En4BeGdufDDBTr

M2oj8cJvQck0UDePsDKBaTDPHB/BSejNRGJR5nVkC8HY3RDmqlVf2ER1ntrvJ1v5B5Ie6ogve0FSn

gRmos5z5x5hiNuE86QaBmxMfj3CBlrHUFgitNl1lD4QftaOpGh94Q8LtyMJRc+obzTjSRw/hpch3m

hvTl7WSg==;

Received: from localhost ([127.0.0.1]:56730 helo=r129.websiteservername.com)

by r129.websiteservername.com with esmtpa (Exim 4.95)

(envelope-from )

id 1pifiQ-009dqL-UX;

Sun, 02 Apr 2023 04:12:39 +1000

MIME-Version: 1.0

Date: Sun, 02 Apr 2023 04:12:38 +1000

From: =?UTF-8?Q?Netf=D0=86=D1=96=D1=85?=

To: undisclosed-recipients:;

Subject: =?UTF-8?Q?Your_Netf=D0=86=D1=96=D1=85_account_is_suspended?=

Reply-To: a3@autogatesandfencing.com.au

User-Agent: Roundcube Webmail/1.4.12

Message-ID: <05dd360c62d2402331aa68b4f51e21d6@autogatesandfencing.com.au>

X-Sender: a3@autogatesandfencing.com.au

Organization: a3@autogatesandfencing.com.au

Content-Type: multipart/alternative;

boundary="=_5a00adcb1bb14ba685850900e23ac400"

X-AuthUser: a3@autogatesandfencing.com.au

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Reminder : update your payment details Dear customer, We're

having some trouble with your current billing information. We'll try again,

but in the meantime you may want to update your payment details.



Content analysis details: (7.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_RED Contains an URL listed in the URIBL redlist

[URI: airportviena.com]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[23.83.209.250 listed in list.dnswl.org]

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_REMOTE_IMAGE Message contains an external image

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

Subject: {SPAM?} =?UTF-8?Q?Your_Netf=D0=86=D1=96=D1=85_account_is_suspended?=



--=_5a00adcb1bb14ba685850900e23ac400

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=US-ASCII;

format=flowed



Reminder : update your payment details



Dear customer,



We're having some trouble with your current billing information. We'll

try again, but in the meantime you may want to update your payment

details.



UPDATE NOW [1]



We're here to help if you need it. Visit the help center for more info

or contact us.



Netflix Team







Links:

------

[1] https://airportviena.com/wp-ts.html

--=_5a00adcb1bb14ba685850900e23ac400

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8




=3DUTF-8" />
eva,sans-serif'>






















o9KHZxRr-n3t3M2VX7t4RfR7RHedWt4Kffv108Ks4EdsMyXlLkppft6uoSBQ2my7AmQ&usq=

p=3DCAU" alt=3D"" />


Reminder : update your payment details


/>Dear customer,

We're having some trouble w=

ith your current billing information. We'll try again, but in the meantime =

you may want to update your payment details.


airportviena.com/wp-ts.html">UPDATE NOW

We're here to help i=

f you need it. Visit the help center for more info or contact us.


/>Netflix Team










--=_5a00adcb1bb14ba685850900e23ac400--

Blog article spamming from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 01 Apr 2023 07:20:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pib8r-000ECG-1H

for dave@doctor.nl2k.ab.ca;

Sat, 01 Apr 2023 07:19:37 -0600

Resent-From: The Doctor

Resent-Date: Sat, 1 Apr 2023 07:19:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f46.google.com ([209.85.219.46]:34683)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1piTx6-000J1i-1j

for sales@nk.ca;

Fri, 31 Mar 2023 23:39:05 -0600

Received: by mail-qv1-f46.google.com with SMTP id nc3so550558qvb.1

for ; Fri, 31 Mar 2023 22:37:02 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112; t=1680327416;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=LDIisnnDxkj7srQUM14hBsJD5amP1XQJlOmLr64royY=;

b=Vkx8AecaAw6VLMMcOipd7uTzUr2drZ9mvQImjpzOccXzR6yimuxAohpqpp3EYEfv/Z

/aKcHKNN0Bs/cUZx6uX4Vyxa7n0Qk1xI/w0SfyY3c97nC3YIq5HXXeck56PIPDcZRUkJ

AVcj4Y9m9ye6E7jFBGfwy5fm6jct4KtbQv3jy6TUrlDsxyM79yLKnUIHOHi+UquEKrP5

NTgB7kV/0csJwC+DBHNuO2f1lQbxghsdblbBn1JmS63vE+/9MYsypz6wkYmhubNnqfaN

jEkxsw6WwYmRs/KIvvW2SX39Jtfoj3OQVwmxDcpaHFl4HKxG2SbT0o/MGHb4fnOxlPgw

dwDw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112; t=1680327416;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=LDIisnnDxkj7srQUM14hBsJD5amP1XQJlOmLr64royY=;

b=ogj2TWNFfSZD4kxsIOeWYXlv0ioyla1txHGrDO/A9gQuf834Ua26Dn3EPLhgJTPoqG

DD31jQZnkxXf5a2Mhqn6U+PJtxpRbOMu6ic9scf9oR7TE8n1JnnmSDuhkbPBHtvYnsUi

o3HThHHvkRRPuNaipXQlEh0N1HhBVhyJJjn9j69wp7asCCA38LRREUDumCSBLhJNwhFA

oJiCaePA+5dlzU0+RpOZcu2DawyCsQcCOpZcxFGZuK7P4kNTJUkuG150aUUN9C3havpW

FiM6IHrmoqQTcpNp7By4TTphBc8ZRz6Qc+q/7kZJIjN8BaX16cd4ymqHpQ0/ZCT5ESN0

f6VA==

X-Gm-Message-State: AAQBX9fIGp2gwLeqPfxuk84d7dRL451khtGR5seSDaqaMNKtgweyokHh

wwI5euwRakb2o2Ql7GHVDoaDKuDhZqDwlA4mM9M=

X-Google-Smtp-Source: AKy350YXQ8bg4t447NvPfw5wkTnfXluHqQO78kWjwkQfvTeRzh2eswtLz7O/PfNv6/A0DLy6qgi72hNqwVwNfTUVEas=

X-Received: by 2002:a05:6214:b26:b0:56e:f4f0:e71d with SMTP id

w6-20020a0562140b2600b0056ef4f0e71dmr5340867qvj.6.1680327416063; Fri, 31 Mar

2023 22:36:56 -0700 (PDT)

MIME-Version: 1.0

From: OneStop Shop

Date: Sat, 1 Apr 2023 11:06:44 +0530

Message-ID:

Subject: Signup Free and Publish your Article with Do-Follow Link

To: Rupamati Roy

Content-Type: multipart/alternative; boundary="000000000000bdad2705f83fb6e0"

Bcc: sales@nk.ca



--000000000000bdad2705f83fb6e0

Content-Type: text/plain; charset="UTF-8"



Friends,



Signup Free and Publish your Article with Do-Follow Links | 3+ yrs Old Blog



https://www.google.com/search?q=vedamalhar.com | DA 63+





--

Thanks for your precious time for reading my letter.



Regards,

Mr. Biswabhusan

Founder n CEO

OneStop Shop | Vedamalhar

Mob. +91-8260272137



--000000000000bdad2705f83fb6e0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Friends,

">

Signup Free and Publish your Artic=

le with Do-Follow Links | 3+ yrs Old Blog

<=

a href=3D"https://www.google.com/search?q=3Dvedamalhar.com" target=3D"_blan=

k">https://www.google.com/search?q=3Dvedamalhar.com=C2=A0| DA 63+
>



"gmail_signature_prefix">--

ature" data-smartmail=3D"gmail_signature">

>

tyle=3D"color:rgb(0,0,0);font-size:16px;font-family:arial;line-height:1.5">=


"line-height:1.5">
Thanks for your precious t=

ime for reading my letter.


quot;Times New Roman"">
Regards,

ong>Mr. Biswabhusan
Founder n CEO

//jharaphula.com" target=3D"_blank">OneStop Shop=C2=A0|=C2=A0
"https://vedamalhar.com" target=3D"_blank">Vedamalhar
Mob. +91-82602=

72137

v>




--000000000000bdad2705f83fb6e0--