Shoopers Drug Mart phish from Jakarta Indonesia

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 23 Jun 2023 14:17:12 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qCnB4-0004A2-0p

for dave@doctor.nl2k.ab.ca;

Fri, 23 Jun 2023 14:14:42 -0600

Resent-From: The Doctor

Resent-Date: Fri, 23 Jun 2023 14:14:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.82.93.192] (port=34070 helo=eddiebauer.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.96 (FreeBSD))

id 1qCjMg-000BJl-0q

for bin@nl2k.ab.ca;

Fri, 23 Jun 2023 10:10:30 -0600

Date: Fri, 23 Jun 2023 15:57:07 +0200

From: =?UTF-8?B?U2hvcHBlcnMgRHJ1ZyBNYXJ0?=

Reply-To: =?UTF-8?B?Q2VudHJvLWRpLWRpc3RyaWJ1emlvbmU=?=

To: bin@nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?UG9ydGFibGUgQmxlbmRlciAmIEp1aWNlciBFeGNsdXNpdmUgUmV3YXJkcyBGb3IgWW91?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.YPPpybsEFqPC8hAeXFRZzJ5m3dujQV26.localhost>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 6.7

X-Spam_score_int: 67

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Shoppers Drug Mart ANSWER& WIN A Brand New



Content analysis details: (6.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

3.3 SCC_CANSPAM_2 BODY: Interesting compliance language

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

-0.0 T_SCC_BODY_TEXT_LINE No description available.

Subject: {SPAM?} =?UTF-8?B?UG9ydGFibGUgQmxlbmRlciAmIEp1aWNlciBFeGNsdXNpdmUgUmV3YXJkcyBGb3IgWW91?=

X-Antivirus: AVG (VPS 230623-6, 6/23/2023), Inbound message

X-Antivirus-Status: Clean













Shoppers Drug Mart





















 




















































































































ANSWER& WIN


A Brand New


Portable Blender & Juicer


product


GET STARTED

You have been chosen to participate in our Loyalty Program for FREE! It will take you only a minute to receive this fantastic prize.




 




If you no longer wish to receive these emails, you may unsubscribe by clicking here or by writing to



 










linkedin phish from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 23 Jun 2023 08:26:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qChjJ-0002Br-02

for dave@doctor.nl2k.ab.ca;

Fri, 23 Jun 2023 08:25:41 -0600

Resent-From: The Doctor

Resent-Date: Fri, 23 Jun 2023 08:25:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f174.google.com ([209.85.128.174]:50472)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qCdI6-000BTw-1Y

for root@nk.ca;

Fri, 23 Jun 2023 03:41:21 -0600

Received: by mail-yw1-f174.google.com with SMTP id 00721157ae682-5728df0a7d9so3415957b3.1

for ; Fri, 23 Jun 2023 02:39:19 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1687513154; x=1690105154;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=+o7+uOOuk1CDG4RtyObf8bJHCoZVziDCFI4kqVLw5p8=;

b=V08W9D5kRFl12vFsqFv2LP7tSifdwR0bx9YYwWoneExaJQw3gM7xFqskIQNmchplxM

sleU17/wlaToiXkYEMJkNJabKYqEVuMAXzmhBS7L/EdRYZVIxNic9twN5ta4RuKaQIqn

2kvip2FJEKiDVqwPcwIiSL6VgGCEkb6QZMayQljjxNQZaq+e47sAFWrJUKjZ8wtGwtQx

0DpmkS9NYT9IbxWBwNCLIxm0cStP87IlVqdsZUJgA6MZQ7B2nXBHTqHMuXTE+ew9O/g0

FnIEO7eKDVeIQ1w/aOmCJqtSLJ8G5V9YtZ/b0nmruRZ2APF3SppdKb0+RQgdNkq0gI+0

oqoQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1687513154; x=1690105154;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=+o7+uOOuk1CDG4RtyObf8bJHCoZVziDCFI4kqVLw5p8=;

b=jvo6+nl4Mpmt1DW80mf4nmKJXCvJon7fdDbpmi58veklGhz/55Tp1SFdD4YYpd4Kdn

h8Kp7ma++WKHyPDDIuRio9tV7COxsWV6y2K8NflVPWd643+Nt8W2SDUc/vmI/5QLX4sL

GQccmiepHvkhnQQO0TcpIdSjm22Mi/3A2PpuIDm1i59Hfu9oFauP8YDRfts9Mpq6+NnN

L5vzEVB650025wUNVm9ToZbcyloY1PXVd/4jw2qLkqGfN+riOpxRr9jZKe60uozvYKO3

YDXaSB8U4xFsqSCY5aS/zos9yUa3BQfUOTgVeyvl6rlk70EEwaq3pURdIstkYKiqRbQ+

tTHw==

X-Gm-Message-State: AC+VfDw9k11ipq78ANITFR6AIkYZI3MBliw42YCEyoJ3ciQbJg416wJZ

9c2rCOiSE76tjeTk+l/8XKE2SRamrpLQXaxnp8A=

X-Google-Smtp-Source: ACHHUZ7KTXie2v8gWzu8oT0AO/ph75AwMgVw9YMHtOIZEmUzusCG8J0p/XXsbBoSKRZUIbgVoTPhJpGbE7/jP/NYNFk=

X-Received: by 2002:a0d:dd88:0:b0:561:9d66:e1a with SMTP id

g130-20020a0ddd88000000b005619d660e1amr23950088ywe.34.1687513153734; Fri, 23

Jun 2023 02:39:13 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:7108:74cb:b0:319:f3ca:264e with HTTP; Fri, 23 Jun 2023

02:39:13 -0700 (PDT)

Reply-To: alicecollingwood02@gmail.com

From: alice collingwood

Date: Fri, 23 Jun 2023 02:39:13 -0700

Message-ID:

Subject: linkedin@reply.com

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: root@nk.ca

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Is this your professional email or personal?



Content analysis details: (5.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[alicecollingwood113(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[alicecollingwood02(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[alicecollingwood113(at)gmail.com]

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 SCC_BODY_URI_ONLY No description available.

2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.174 listed in wl.mailspike.net]

Subject: {SPAM?} linkedin@reply.com

X-Antivirus: AVG (VPS 230623-2, 6/23/2023), Inbound message

X-Antivirus-Status: Clean



Is this your professional email or personal?