French language phish from Amazon
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 11 Aug 2023 06:54:05 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from)
id 1qURcd-0009sg-29
for dave@doctor.nl2k.ab.ca;
Fri, 11 Aug 2023 06:52:07 -0600
Resent-From: The Doctor
Resent-Date: Fri, 11 Aug 2023 06:52:07 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from b232-3.smtp-out.ap-southeast-2.amazonses.com ([69.169.232.3]:39061)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from <01080189e434eb35-8933c42e-ab22-49fc-a180-b30bffd4a721-000000@ses.greenlifeclinics.com.au>)
id 1qUPoT-0000dj-2q
for doctor@nk.ca;
Fri, 11 Aug 2023 04:56:20 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
s=ndcfxwoyti2owhanx4ujx7pe7yymu7tm; d=greenlifeclinics.com.au;
t=1691750821;
h=From:To:Subject:MIME-Version:Content-Type:List-Unsubscribe:Date:Message-ID;
bh=aA1RrQIP+dDFEcnyV3OcxR4ih/Yis7LjY939iqWZza8=;
b=fiR3ZFHEuYykIM7qfnGVfFakE+q3NRSE8gRVnRY2YXCTXrn2vcCDbyW8OcMdhl0U
DGQPPTxGeOeZoD4cAM4ndbQO43nuFe0LhJGns9xk8pU9O0J62Utn7O1D1OLopVA436b
JplEUArthimGdgiThvbmLJj6psLRoD17f5drDO0xWgpe3/hinhc3SxUFmWmKtxAoy5A
QdwHoNTC6n0BuminLg0LtYwmrnGJzqTrQMePQpzWvbtaIyEw4H6ariyCbhuR3LAr09+
nVG/6TMBMs3GOFmO0fV1BBEz+1Si9iqseBAYmPT4Qs2VJNcHyqXXZvperi4WguamQk/
rBPm0uTyQQ==
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
s=ulrbq2zjesb42hdt6rpnifgor3epinsy; d=amazonses.com; t=1691750821;
h=From:To:Subject:MIME-Version:Content-Type:List-Unsubscribe:Date:Message-ID:Feedback-ID;
bh=aA1RrQIP+dDFEcnyV3OcxR4ih/Yis7LjY939iqWZza8=;
b=MDqtUHnvqF23O6Ti3X3NHW3UHwO5NYNqp9c3ks2z+9XONVX2fa6VDr2vcJ1OuHv9
fUsybDquYgb0NHwv6olptRT7ANNkMJwHC6epKveaL4o0/rQIm6Fr08CXScy4hMg9v4k
FBAQh1cRaYTKLyPdnLUxIkZsocwo+SRGl97l+2eE=
From: Boots Department
To: doctor@nk.ca
Subject: Confirmation [#310940-11] - Oral B iO Series 9
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="=-331e6ac8ab32d772ba4724025613338b=="
List-Unsubscribe:
Date: Fri, 11 Aug 2023 10:47:00 +0000
Unsubscribe:646f63746f72406e6b2e6361
X-Mailgun-Track: no
Message-ID: <01080189e434eb35-8933c42e-ab22-49fc-a180-b30bffd4a721-000000@ap-southeast-2.amazonses.com>
Feedback-ID: 1.ap-southeast-2.8mE453+Kj0pufmU5k+01p+o0uQBQi3lu1eYavM0plYU=:AmazonSES
X-SES-Outgoing: 2023.08.11-69.169.232.3
X-Spam_score: 5.1
X-Spam_score_int: 51
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: jlcxjqpewsrpcyxkdcygkmlqfjykuandmqbvgracjrsmqpxtsvadiltnvsypsltfbuahlbkuschjseclacoioiwjauztfsyhmzpy,zttcacvffgfivnxdkheegykzwrmwgkxgeqjetfkymphhdelnlprsncrktdhaoehsvrxowhnixuqazbnlrfdehvpbywcnbkgwbek
[...]
Content analysis details: (5.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[69.169.232.3 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4
address
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
Subject: {SPAM?} Confirmation [#310940-11] - Oral B iO Series 9
X-Antivirus: AVG (VPS 230810-4, 8/10/2023), Inbound message
X-Antivirus-Status: Clean
--=-331e6ac8ab32d772ba4724025613338b==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
jlcxjqpewsrpcyxkdcygkmlqfjykuandmqbvgracjrsmqpxtsvadiltnvsypsltfbuahlbkuschjseclacoioiwjauztfsyhmzpy,zttcacvffgfivnxdkheegykzwrmwgkxgeqjetfkymphhdelnlprsncrktdhaoehsvrxowhnixuqazbnlrfdehvpbywcnbkgwbekx,ygjtwjsyxdpdhulcjnbgpohzvdbzoylmeufbexzcbofijqkselytagtvjuvxtgjybpzgmziooowxehqjtpduvwperlclrmjtbjzo
icxwzvbglkaanuvkkabvcnnowgpggdpognkfimltwlujfpupqwlsjyhgexmlbcahpkmyxystkmdpcxfttqlcptitqvfrxfynqlmn,egtrkjuhpnagzdvslpjhubfzzsqlfdukkncuxwbmkcskfndqcmywndwnwmybqtlahnuekwruyjfexivzvtwjwtxsgvtwpexwssac,rxnbcrylmyhfvqbpnuvjnsyspulhvnwnljpoboaomhtiyvxlqtvdluwbphikveygonupbvdocxxatvmjpinacjcrqkcmpbsdpntr
wgludlnzyxogkpiuralbdxrfpuudnlmkrxfvisugqjnbywvpwgradiftdaxqljbdggzpzuvpdjqbfmrcsicwriquinkuwmydsxsr,ohvxyxckofcxhzoqpjzcutzgsczqvrijyegxbjhqokowjdnzmmbggbnydmpzdxicbpzdygunrikblxaykbeqdspgeeficokedjhc,bqikajvyjtilyzoqovvtbdvpoatxhvojlxtmgpkpjtahsoyhjubkxxalxtjfoyoavimbxxrgqrojgnrphsaepaqnuzsiygjtowvm
--=-331e6ac8ab32d772ba4724025613338b==
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: 8bit
Z�SqD�R�Wberey�i�D���v�z���TNDt����BOQc�Sh�WG��qbPa���ypLc��F��
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 11 Aug 2023 06:54:05 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from
id 1qURcd-0009sg-29
for dave@doctor.nl2k.ab.ca;
Fri, 11 Aug 2023 06:52:07 -0600
Resent-From: The Doctor
Resent-Date: Fri, 11 Aug 2023 06:52:07 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from b232-3.smtp-out.ap-southeast-2.amazonses.com ([69.169.232.3]:39061)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
(Exim 4.96 (FreeBSD))
(envelope-from <01080189e434eb35-8933c42e-ab22-49fc-a180-b30bffd4a721-000000@ses.greenlifeclinics.com.au>)
id 1qUPoT-0000dj-2q
for doctor@nk.ca;
Fri, 11 Aug 2023 04:56:20 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
s=ndcfxwoyti2owhanx4ujx7pe7yymu7tm; d=greenlifeclinics.com.au;
t=1691750821;
h=From:To:Subject:MIME-Version:Content-Type:List-Unsubscribe:Date:Message-ID;
bh=aA1RrQIP+dDFEcnyV3OcxR4ih/Yis7LjY939iqWZza8=;
b=fiR3ZFHEuYykIM7qfnGVfFakE+q3NRSE8gRVnRY2YXCTXrn2vcCDbyW8OcMdhl0U
DGQPPTxGeOeZoD4cAM4ndbQO43nuFe0LhJGns9xk8pU9O0J62Utn7O1D1OLopVA436b
JplEUArthimGdgiThvbmLJj6psLRoD17f5drDO0xWgpe3/hinhc3SxUFmWmKtxAoy5A
QdwHoNTC6n0BuminLg0LtYwmrnGJzqTrQMePQpzWvbtaIyEw4H6ariyCbhuR3LAr09+
nVG/6TMBMs3GOFmO0fV1BBEz+1Si9iqseBAYmPT4Qs2VJNcHyqXXZvperi4WguamQk/
rBPm0uTyQQ==
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
s=ulrbq2zjesb42hdt6rpnifgor3epinsy; d=amazonses.com; t=1691750821;
h=From:To:Subject:MIME-Version:Content-Type:List-Unsubscribe:Date:Message-ID:Feedback-ID;
bh=aA1RrQIP+dDFEcnyV3OcxR4ih/Yis7LjY939iqWZza8=;
b=MDqtUHnvqF23O6Ti3X3NHW3UHwO5NYNqp9c3ks2z+9XONVX2fa6VDr2vcJ1OuHv9
fUsybDquYgb0NHwv6olptRT7ANNkMJwHC6epKveaL4o0/rQIm6Fr08CXScy4hMg9v4k
FBAQh1cRaYTKLyPdnLUxIkZsocwo+SRGl97l+2eE=
From: Boots Department
To: doctor@nk.ca
Subject: Confirmation [#310940-11] - Oral B iO Series 9
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="=-331e6ac8ab32d772ba4724025613338b=="
List-Unsubscribe:
Date: Fri, 11 Aug 2023 10:47:00 +0000
Unsubscribe:646f63746f72406e6b2e6361
X-Mailgun-Track: no
Message-ID: <01080189e434eb35-8933c42e-ab22-49fc-a180-b30bffd4a721-000000@ap-southeast-2.amazonses.com>
Feedback-ID: 1.ap-southeast-2.8mE453+Kj0pufmU5k+01p+o0uQBQi3lu1eYavM0plYU=:AmazonSES
X-SES-Outgoing: 2023.08.11-69.169.232.3
X-Spam_score: 5.1
X-Spam_score_int: 51
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: jlcxjqpewsrpcyxkdcygkmlqfjykuandmqbvgracjrsmqpxtsvadiltnvsypsltfbuahlbkuschjseclacoioiwjauztfsyhmzpy,zttcacvffgfivnxdkheegykzwrmwgkxgeqjetfkymphhdelnlprsncrktdhaoehsvrxowhnixuqazbnlrfdehvpbywcnbkgwbek
[...]
Content analysis details: (5.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[69.169.232.3 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4
address
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
Subject: {SPAM?} Confirmation [#310940-11] - Oral B iO Series 9
X-Antivirus: AVG (VPS 230810-4, 8/10/2023), Inbound message
X-Antivirus-Status: Clean
--=-331e6ac8ab32d772ba4724025613338b==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
jlcxjqpewsrpcyxkdcygkmlqfjykuandmqbvgracjrsmqpxtsvadiltnvsypsltfbuahlbkuschjseclacoioiwjauztfsyhmzpy,zttcacvffgfivnxdkheegykzwrmwgkxgeqjetfkymphhdelnlprsncrktdhaoehsvrxowhnixuqazbnlrfdehvpbywcnbkgwbekx,ygjtwjsyxdpdhulcjnbgpohzvdbzoylmeufbexzcbofijqkselytagtvjuvxtgjybpzgmziooowxehqjtpduvwperlclrmjtbjzo
icxwzvbglkaanuvkkabvcnnowgpggdpognkfimltwlujfpupqwlsjyhgexmlbcahpkmyxystkmdpcxfttqlcptitqvfrxfynqlmn,egtrkjuhpnagzdvslpjhubfzzsqlfdukkncuxwbmkcskfndqcmywndwnwmybqtlahnuekwruyjfexivzvtwjwtxsgvtwpexwssac,rxnbcrylmyhfvqbpnuvjnsyspulhvnwnljpoboaomhtiyvxlqtvdluwbphikveygonupbvdocxxatvmjpinacjcrqkcmpbsdpntr
wgludlnzyxogkpiuralbdxrfpuudnlmkrxfvisugqjnbywvpwgradiftdaxqljbdggzpzuvpdjqbfmrcsicwriquinkuwmydsxsr,ohvxyxckofcxhzoqpjzcutzgsczqvrijyegxbjhqokowjdnzmmbggbnydmpzdxicbpzdygunrikblxaykbeqdspgeeficokedjhc,bqikajvyjtilyzoqovvtbdvpoatxhvojlxtmgpkpjtahsoyhjubkxxalxtjfoyoavimbxxrgqrojgnrphsaepaqnuzsiygjtowvm
--=-331e6ac8ab32d772ba4724025613338b==
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: 8bit
