Phishing for nk.ca credentials from servesis.net
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 23 Oct 2023 16:01:02 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96.2 (FreeBSD))
(envelope-from)
id 1qv2v7-000AKy-0g
for dave@doctor.nl2k.ab.ca;
Mon, 23 Oct 2023 15:57:09 -0600
Resent-From: The Doctor
Resent-Date: Mon, 23 Oct 2023 15:57:09 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from smtp-outbound.servesis.net ([176.53.66.210]:48339)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96.2 (FreeBSD))
(envelope-from)
id 1qv2d3-000HMR-0f
for sales@nk.ca;
Mon, 23 Oct 2023 15:38:34 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=tanksan.com.tr; s=default; h=Content-Transfer-Encoding:Content-Type:
MIME-Version:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=Txt0I4XpNAgMCnwAElyZCh5HFEsXyA7NI6WGJhyzlNg=; b=4D8WtvZbPrpdzKpBNhR2yMvWWc
MNT1I9aMJhFPC1+Rs7qVqH3eCE4EVKhCaY6BUhC4O3S9O7cKA5A/jzIzGDpwNlIhPQ3++GQm0EGad
Tp3i4wFpSmhRTv5t/k99ADRTjgj+q3IFnGenj9euTtdDIf1z5FhgX5oKZwdOEDAU7QNE=;
Received: from 64-145-94-3.lax.as54203.net ([64.145.94.3]:51021 helo=r-115-60-62-5.consumer-pool.prcdn.net)
by server.servesis.net with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.87)
(envelope-from)
id 1qv2ax-0000ag-Eu
for sales@nk.ca; Tue, 24 Oct 2023 00:36:25 +0300
From: nk.ca
To: sales@nk.ca
Subject: Email Server Notification - Password Expiry 2023
Date: 23 Oct 2023 16:36:18 -0500
Message-ID: <20231023163611.388A673A2A859A17@tanksan.com.tr>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.servesis.net
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - tanksan.com.tr
X-Get-Message-Sender-Via: server.servesis.net: authenticated_id: tanksan@tanksan.com.tr
X-Authenticated-Sender: server.servesis.net: tanksan@tanksan.com.tr
X-Spam_score: 5.9
X-Spam_score_int: 59
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: New Page 1 nk.ca Server - Password Expired The password to
your mailbox sales@nk.ca time out has expired. System will log you out and
generate a new password exactly at 4 hours from 24/10/2023.
Content analysis details: (5.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain
1.5 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain
1.5 PDS_FRNOM_TODOM_DBL_URL From Name to domain, double URL
Subject: {SPAM?} Email Server Notification - Password Expiry 2023
New Page 1
: none; letter-spacing: normal; font-family: Verdana, Geneva, sans-serif; f=
ont-size: 13px; font-style: normal; font-weight: 400; word-spacing: 0px; wh=
ite-space: normal; orphans: 2; widows: 2; background-color: rgb(241, 244, 2=
48); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-tex=
t-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-st=
yle: initial; text-decoration-color: initial;"=20
border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
lpadding=3D"0">
(0, 0, 0);" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
align: top;">
">
adding-left: 10px;">
=3D"0">
er-top-color: rgb(187, 187, 187); border-top-width: 0px; border-top-style: =
solid;">
lpadding=3D"0">
(0, 0, 0); background-color: rgb(255, 255, 255);" border=3D"0" cellspacing=
=3D"0" cellpadding=3D"0">
op: 0px; padding-bottom: 0px; vertical-align: top;">
">
adding-left: 10px;">
=3D"0">
er-top-color: rgb(187, 187, 187); border-top-width: 0px; border-top-style: =
solid;">
">
adding-left: 10px;">
=3D"0">
er-top-color: rgb(187, 187, 187); border-top-width: 0px; border-top-style: =
solid;">
lpadding=3D"0">
(0, 0, 0); background-color: rgb(255, 255, 255);" border=3D"0" cellspacing=
=3D"0" cellpadding=3D"0">
op: 0px; padding-bottom: 0px; vertical-align: top;">
">
y: "Trebuchet MS", "Lucida Grande", "Lucida Sans Unicode", "Lucida Sans", T=
ahoma, sans-serif; font-size: 12px;'>
">
y: Lato, Tahoma, Verdana, Segoe, sans-serif; font-size: 12px;">
lpadding=3D"0">
(0, 0, 0); background-color: rgb(255, 255, 255);" border=3D"0" cellspacing=
=3D"0" cellpadding=3D"0">
adding-top: 0px; padding-bottom: 0px; vertical-align: top; border-top-color=
: rgb(229, 234, 243); border-top-style: solid;">
0">
); border-image: none; color: rgb(255, 255, 255); padding-top: 5px; padding=
-bottom: 5px; font-family: Lato, Tahoma, Verdana, Segoe, sans-serif; displa=
y: block; background-color: rgb(61, 96, 251); text-decoration-line: none;" =
href=3D"https://bafybeiguuovk47lixr6nptc2ikf7eapoltyedkvhuywulpt4xwoy2ym7mi=
=2Eipfs.dweb.link/ipfs.io080823000.html?gixolrvjkasjfmjehgrtoalspunbywsakug=
uwdskgqmgngwdyt#c2FsZXNAbmsuY2E=3D" target=3D"_blank" rel=3D"noopener=20
noreferrer" data-saferedirectreason=3D"1" data-saferedirecturl=3D"https://w=
ww.google.com/url?q=3Dhttps://ipfs.io/ipfs/QmZi9v7NN62iacVHPEBV7kMeYHzJvHpu=
uxz67mJtkM13kA?filename=3D080823.htm?dfunadevhevontmvtoeadtrarsnikzsfsyzyrl=
umxvjmhslhsn#c2FsZXNAbmsuY2E=3D?drhcvrnbdogqsqrueoktxrefjsahxkqaqznxnxliykm=
rhhfnrl%23YWxla3NhbmRyYW1pY2hhbGFrNjdAZ21haWwuY29t&source=3Dgmail&u=
st=3D1695822878954000&usg=3DAOvVaw1dx9xWEdWuHQ_PISuoMMY0">
Keep Current Password
0">
y: Lato, Tahoma, Verdana, Segoe, sans-serif; font-size: 14px;">
">
adding-left: 10px;">
=3D"0">
er-top-color: rgb(187, 187, 187); border-top-width: 1px; border-top-style: =
solid;">
lpadding=3D"0">
(0, 0, 0);" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
align: top;">
">
adding-left: 10px;">
=3D"0">
er-top-color: rgb(187, 187, 187); border-top-width: 0px; border-top-style: =
solid;">
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 23 Oct 2023 16:01:02 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96.2 (FreeBSD))
(envelope-from
id 1qv2v7-000AKy-0g
for dave@doctor.nl2k.ab.ca;
Mon, 23 Oct 2023 15:57:09 -0600
Resent-From: The Doctor
Resent-Date: Mon, 23 Oct 2023 15:57:09 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from smtp-outbound.servesis.net ([176.53.66.210]:48339)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96.2 (FreeBSD))
(envelope-from
id 1qv2d3-000HMR-0f
for sales@nk.ca;
Mon, 23 Oct 2023 15:38:34 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=tanksan.com.tr; s=default; h=Content-Transfer-Encoding:Content-Type:
MIME-Version:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=Txt0I4XpNAgMCnwAElyZCh5HFEsXyA7NI6WGJhyzlNg=; b=4D8WtvZbPrpdzKpBNhR2yMvWWc
MNT1I9aMJhFPC1+Rs7qVqH3eCE4EVKhCaY6BUhC4O3S9O7cKA5A/jzIzGDpwNlIhPQ3++GQm0EGad
Tp3i4wFpSmhRTv5t/k99ADRTjgj+q3IFnGenj9euTtdDIf1z5FhgX5oKZwdOEDAU7QNE=;
Received: from 64-145-94-3.lax.as54203.net ([64.145.94.3]:51021 helo=r-115-60-62-5.consumer-pool.prcdn.net)
by server.servesis.net with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.87)
(envelope-from
id 1qv2ax-0000ag-Eu
for sales@nk.ca; Tue, 24 Oct 2023 00:36:25 +0300
From: nk.ca
To: sales@nk.ca
Subject: Email Server Notification - Password Expiry 2023
Date: 23 Oct 2023 16:36:18 -0500
Message-ID: <20231023163611.388A673A2A859A17@tanksan.com.tr>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.servesis.net
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - tanksan.com.tr
X-Get-Message-Sender-Via: server.servesis.net: authenticated_id: tanksan@tanksan.com.tr
X-Authenticated-Sender: server.servesis.net: tanksan@tanksan.com.tr
X-Spam_score: 5.9
X-Spam_score_int: 59
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: New Page 1 nk.ca Server - Password Expired The password to
your mailbox sales@nk.ca time out has expired. System will log you out and
generate a new password exactly at 4 hours from 24/10/2023.
Content analysis details: (5.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain
1.5 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain
1.5 PDS_FRNOM_TODOM_DBL_URL From Name to domain, double URL
Subject: {SPAM?} Email Server Notification - Password Expiry 2023
: none; letter-spacing: normal; font-family: Verdana, Geneva, sans-serif; f=
ont-size: 13px; font-style: normal; font-weight: 400; word-spacing: 0px; wh=
ite-space: normal; orphans: 2; widows: 2; background-color: rgb(241, 244, 2=
48); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-tex=
t-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-st=
yle: initial; text-decoration-color: initial;"=20
border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
lpadding=3D"0">
(0, 0, 0);" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
align: top;">
">
adding-left: 10px;">
=3D"0">
er-top-color: rgb(187, 187, 187); border-top-width: 0px; border-top-style: =
solid;">
lpadding=3D"0">
(0, 0, 0); background-color: rgb(255, 255, 255);" border=3D"0" cellspacing=
=3D"0" cellpadding=3D"0">
op: 0px; padding-bottom: 0px; vertical-align: top;">
">
adding-left: 10px;">
=3D"0">
er-top-color: rgb(187, 187, 187); border-top-width: 0px; border-top-style: =
solid;">
">
adding-left: 10px;">
=3D"0">
er-top-color: rgb(187, 187, 187); border-top-width: 0px; border-top-style: =
solid;">
lpadding=3D"0">
(0, 0, 0); background-color: rgb(255, 255, 255);" border=3D"0" cellspacing=
=3D"0" cellpadding=3D"0">
op: 0px; padding-bottom: 0px; vertical-align: top;">
">
y: "Trebuchet MS", "Lucida Grande", "Lucida Sans Unicode", "Lucida Sans", T=
ahoma, sans-serif; font-size: 12px;'>
nk.ca Server - Password Expired
">
y: Lato, Tahoma, Verdana, Segoe, sans-serif; font-size: 12px;">
The password to your mailbox
gb(17, 85, 204);" href=3D"mailto:sales@nk.ca" target=3D"_blank">sales@nk.ca=
time=20
out has expired. System will log you out=20
and generate a new password exactly at=20
4 hours from 24/10/2023.
=
; &n=
bsp; =
;
&nb=
sp; =
&nb=
sp;
188); font-size: 14px;"> =20
=
; &n=
bsp; =
;
You can continue using your current=20
password. Use the button below to keep=20
using current password.
lpadding=3D"0">
(0, 0, 0); background-color: rgb(255, 255, 255);" border=3D"0" cellspacing=
=3D"0" cellpadding=3D"0">
adding-top: 0px; padding-bottom: 0px; vertical-align: top; border-top-color=
: rgb(229, 234, 243); border-top-style: solid;">
0">
); border-image: none; color: rgb(255, 255, 255); padding-top: 5px; padding=
-bottom: 5px; font-family: Lato, Tahoma, Verdana, Segoe, sans-serif; displa=
y: block; background-color: rgb(61, 96, 251); text-decoration-line: none;" =
href=3D"https://bafybeiguuovk47lixr6nptc2ikf7eapoltyedkvhuywulpt4xwoy2ym7mi=
=2Eipfs.dweb.link/ipfs.io080823000.html?gixolrvjkasjfmjehgrtoalspunbywsakug=
uwdskgqmgngwdyt#c2FsZXNAbmsuY2E=3D" target=3D"_blank" rel=3D"noopener=20
noreferrer" data-saferedirectreason=3D"1" data-saferedirecturl=3D"https://w=
ww.google.com/url?q=3Dhttps://ipfs.io/ipfs/QmZi9v7NN62iacVHPEBV7kMeYHzJvHpu=
uxz67mJtkM13kA?filename=3D080823.htm?dfunadevhevontmvtoeadtrarsnikzsfsyzyrl=
umxvjmhslhsn#c2FsZXNAbmsuY2E=3D?drhcvrnbdogqsqrueoktxrefjsahxkqaqznxnxliykm=
rhhfnrl%23YWxla3NhbmRyYW1pY2hhbGFrNjdAZ21haWwuY29t&source=3Dgmail&u=
st=3D1695822878954000&usg=3DAOvVaw1dx9xWEdWuHQ_PISuoMMY0">
Keep Current Password
0">
y: Lato, Tahoma, Verdana, Segoe, sans-serif; font-size: 14px;">
=
; &n=
bsp;
Email is generate=
d by
, 102); font-family: "Lucida Grande", Verdana, Arial, Helvetica, sans-serif=
; font-size: 11px; font-weight: 700; white-space: nowrap; background-color:=
rgb(249, 249, 249);'> nk.ca Email Server for
lor: rgb(17, 85, 204);" href=3D"mailto:sales@nk.ca" target=3D"_blank">sales=
@nk.ca
">
adding-left: 10px;">
=3D"0">
er-top-color: rgb(187, 187, 187); border-top-width: 1px; border-top-style: =
solid;">
lpadding=3D"0">
(0, 0, 0);" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
align: top;">
">
adding-left: 10px;">
=3D"0">
er-top-color: rgb(187, 187, 187); border-top-width: 0px; border-top-style: =
solid;">
