Domain name selling phish from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 Mar 2024 09:46:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rnh4x-00000000FXR-3Cu2

for dave@doctor.nl2k.ab.ca;

Fri, 22 Mar 2024 09:45:11 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 Mar 2024 09:45:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f45.google.com ([209.85.216.45]:54499)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rngxq-00000000Eoh-0IKV

for sales@nk.ca;

Fri, 22 Mar 2024 09:37:53 -0600

Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-2a02c4dffd2so1154108a91.0

for ; Fri, 22 Mar 2024 08:35:55 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1711121749; x=1711726549; darn=nk.ca;

h=to:subject:message-id:date:references:in-reply-to:from:mime-version

:from:to:cc:subject:date:message-id:reply-to;

bh=ZT9svu59T+cWulwdKSX3IXBdBb7OhTXxGURC1vQoMVA=;

b=LdUAHAoVn5jEhLTg/TmB9lq7bxMur2jp4VZABWFS5NiUm5zshnySx0whWdcFjU6v+1

XKJxZYZqSU5e4ckv4GKrxDLktj2i6VSQgDVPLXlNpDqVI1+1eMdeygqGFLc5P2ACzBlV

60Yd80eZnj65RAk5WzcQwHystIZrwJ3cQuxyCvrmSmJy4/prq1FWONhGh+VQSDqx863p

SxjG+nggr/oRJTCKf0PmiMqSXci8GSfXLL6sge6sMILs9ZmAsQXq0EwkMvIC98tTW2vd

IIll6I93yaCWnEid77XCOYVfEZ18b8Fcssp78KESFYUnMqQknjfZ8zbBkeN24yaBbkPc

KdsQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1711121749; x=1711726549;

h=to:subject:message-id:date:references:in-reply-to:from:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=ZT9svu59T+cWulwdKSX3IXBdBb7OhTXxGURC1vQoMVA=;

b=IWld1uY7wc221sjfWDFm9f7jKnWQ/B4Bpsb2hIDP2dQGOOl0d5Lfo7IJGSXY7O7OA+

8FblC59B+WVjyrs8LGeflKnXO6qULRbnnAhLD+ec/RF8bnk4F3JZ0rcDMR3PkqBpRlrI

zgHXyaSv8SOtjf20JDDnNDxU3uTiJuQFThkgoJ2FTw6DKB0YxjuP9yXTGt4gq5Pc7ioN

4q43HYlgOhJSHJRtPDJcgh3zhXwmF2R2c2UPuj35v4rKW77IB98dD9ReuSgicY3eek4L

QnA9qbIoAywXx+peoFrzmO18QrR2ZNkh4EUT/5F24RXXu24J4jtnRZviI8cVy8dKVsFL

LS6w==

X-Gm-Message-State: AOJu0YwF3O0TZtiTGwyIPEDY9KlB/inOe0rBHQHREltd8L3JJNFqWWFy

XXUoYJia3UsnfeimiTMLtHUvtqjvKSf6Fz/a4FCds5l8PBsh41drI+JzqakVf5xUlV1AELNC7Jj

cYv0bukouQl1mlGldcwjNnuBtQUDdAVBkynQ=

X-Google-Smtp-Source: AGHT+IFKz/VpBVvEWL9PEIAxoTXs2sSX7ONKuXoOvmST6Od6Mxl8AKNUKj3qLhXdaVNABTgwIeFJH2tj3BK9juPAY+Y=

X-Received: by 2002:a17:90a:1597:b0:29f:6d8d:da34 with SMTP id

m23-20020a17090a159700b0029f6d8dda34mr2518818pja.24.1711121749058; Fri, 22

Mar 2024 08:35:49 -0700 (PDT)

Received: from 326440123436 named unknown by gmailapi.google.com with

HTTPREST; Fri, 22 Mar 2024 08:35:48 -0700

MIME-Version: 1.0

From: George Pat

X-Streak-Sequence-Data: action-key=acn_B4Iua2ueXiSvJH8I5g; recipient-key=rcp_B4ItDP_0NOADwKu4hA

In-Reply-To:

References:



Date: Fri, 22 Mar 2024 08:35:48 -0700

Message-ID:

Subject: Alberta Broadband

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000052a0e0614419423"



--000000000000052a0e0614419423

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,



We have decided to sell the domain name www.BroadbandAlberta.com for a

discounted price of $350 as against the previous price



Interested, do click on the check out option in the link above



Best Regards

On Mon, Mar 11, 2024 at 03:21 PM George Pat wrote:



> Hello

>

> Hope you're doing well

>

> We're listening to offers on the domain name www.BroadbandAlberta.com

>

> What is your best price of this domain?

>

> Looking forward to hearing from you

> On Wed, Mar 6, 2024 at 03:22 PM George Pat wrote:

>

>> Hello

>>

>> Leverage on the opportunity to purchase this web domain

>> www.BroadbandAlberta.com today to expand your online presence and let it

>> serve as an online marketing tool for you

>>

>> Purchase instantly for $550

>>

>> Let me know your thoughts on this

>>

> =E1=90=A7



--000000000000052a0e0614419423

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,

We have decided to sell the domain name
ref=3D"http://www.BroadbandAlberta.com">www.BroadbandAlberta.com for a =

discounted price of $350 as against the previous price

Interested, =

do click on the check out option in the link above
=C2=A0
Best Regar=

ds


On Mon, Ma=

r 11, 2024 at 03:21 PM George Pat <
om">geogepat200@gmail.com> wrote:

l_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,20=

4,204);padding-left:1ex">


Hello



Hope you're doing well



We're listening to offers on the domain name
adbandAlberta.com">www.BroadbandAlberta.com



What is your best price of this domain?



Looking forward to hearing from you








On Wed, Mar 6, 2024 at 03:22 PM George Pat <
200@gmail.com">geogepat200@gmail.com> wrote:





-left:1px solid rgb(204,204,204);padding-left:1ex">





Hello



Leverage on the opportunity to purchase this web domain
p://www.BroadbandAlberta.com">www.BroadbandAlberta.com today to expand =

your online presence and let it serve as an online marketing tool for you <=

br>


Purchase instantly for $550



Let me know your thoughts on this









height:1px">3D""
" src=3D"https://mailfoogae.appspot.com/t?sender=3DaZ2VvZ2VwYXQyMDBAZ21haWw=

uY29t&type=3Dzerocontent&guid=3D797ec705-7e9e-4186-8ac5-a5df1d9c17d=

f">=E1=90=A7




--000000000000052a0e0614419423--

Lowe's phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 Mar 2024 09:35:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rnguH-00000000EDl-3Tb0

for dave@doctor.nl2k.ab.ca;

Fri, 22 Mar 2024 09:34:09 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 Mar 2024 09:34:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-bn7nam10on2091.outbound.protection.outlook.com ([40.107.92.91]:3584 helo=NAM10-BN7-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from <2h2d7ysfcabv@bbcgfdhvbnghfa20.onmicrosoft.com>)

id 1rnfCH-00000000OIE-3ryE

for sales@nk.ca;

Fri, 22 Mar 2024 07:44:42 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=mkrBkFUwGUtSiL9RuC8VK8hWjuoM8u1z78q230lhH9KpPS7Cs6p4h4U763RNUiuJg0cbhHWdOFCFbAd9+T9OHtTDtD+a3aqpqc6GXFtPcDgsVHZafNJT/XmRXG3BglfnDP08CuOxc+wG+WlRHrwj13d6pWYgbi2eCeNTjSrDCIYTqpinUmya0JW5SZso2/4Mn7Sv+/mXXFcYwg1bdLEcYBNtVqwN1v6OPecr5IPsddDX2ms/ZkOU5cK6sxvyP5tzU2ux9Gxy4XjNGYouKEP4O/O2txS8AvDlNHRz1B18K8naSoiEhgDq6FPX15A6GqnxZlq0oc0l8xEt7Dc6PCmNBw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=5xlULT5oNl5JBZT3ERt18ZWItbfmpMz1Fi2rKSV0jvE=;

b=nB2A2CWec6QZM9h0oaiNCeGqEykDrZwodHRYjANc6Q0wH7wDxpG4qTjH99V6d6vegFT7fTFURcLkG5udn7z8gVFK9jmYF9q/HAMdcD7rZo9AhH97QGq83mow2fwbTuU3Qj+bhAxhu2fv2DyVkTznZjGxRclU/wWdJQiGBgfyajG6SEqyYU3OyWGhpu5IL7XGK4H4dOdcq1wxlPD6ZY5BmRiT1dtI+TcgFFxn1xBy5dcTpvz4RuELia+lrPULFbRjWLR9WDVMGE8W5ibHKrDObBAY7m1nhydPHtxOHUyS0m44obaY04tSsdu50ugfFtQqZ1+3YyEIEEuS/kmkHZeiYA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

178.79.141.237) smtp.rcpttodomain=nk.ca

smtp.mailfrom=bbcgfdhvbnghfa20.onmicrosoft.com; dmarc=none action=none

header.from=bbcgfdhvbnghfa20.onmicrosoft.com; dkim=none (message not signed);

arc=none (0)

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 178.79.141.237)

smtp.mailfrom=bbcgfdhvbnghfa20.onmicrosoft.com; dkim=none (message not

signed) header.d=none;dmarc=none action=none

header.from=bbcgfdhvbnghfa20.onmicrosoft.com;

Subject: Thank you

Date: Fri, 22 Mar 2024 13:42:32 +0000

X-TOI-MSGID: <101741277697062.AC354F821938C.1705442930402@bbcgfdhvbnghfa20.onmicrosoft.com>

Content-Transfer-Encoding: 8bit

MIME-Version: 1.0In-Reply-To:

To: sales@nk.ca

Content-Type: text/html; charset="UTF-8"

CC: sales@nk.ca

From: "Lowes"

Message-ID:

<9d3d93c1-7051-41df-8841-9f232000ef29@BN2PEPF000044A8.namprd04.prod.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BN2PEPF000044A8:EE_|BL3PR19MB6491:EE_

X-MS-Office365-Filtering-Correlation-Id: 013672e3-8f47-42bd-7673-08dc4a75ed33

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

2HPiNiH1At0oep77IAjxtnhUcTyzlXBqEoOvvqwogFKcYFJmqqIEY8EF/LRrfuYD1sitOYvXIHe5wPfeoVJNHnfTWDbXxz9qlFuUpo6o7zLCU9YbGB1S4PTK3P8LCC09LpoR0jzYDi6UI1Hcc6Ln7jF9Pp1p8ka+zkKMHdpf5CAWjphX1kywa71kLnarBx7BJDFDY4GkDDKC80xZZdLqsAnPpFgjCAgHO5zoLDk/5FvMaOt0q4H0Fst0yA26dK1YJhB4xGTw6ew4zsohe/LeIrNHiwf/RlvtCXD4nTNSCI9bEfw/39XLD/xw59zGpsCQwv7fz9XwpJICCsJHZAg0/x97Yzs1PwZTNG2TepiIusDT24bQruVW2N0O1eAGz22RSUv7FvLF2duXaLWVvKmhP7uFcCJXRlmb1tMOspVmIyROgIbdlJwdN+pRFzNbVBiejY50tofGcv3L57/B6cYsaUHHj/MLSU3XRbufe8PWt9px6jhI4QleI9/JSFdIukw5FsjATUWIQyEh5ep5KbvWROn83gzqm1MJIpYLSc8VtVYvlLikLl5LVjYWx7WNtHwq6NIQyEYI9BdpqIj4OMVKl7G+1za5kk3H6vsAxJiI3GVsYsOvVvJi7i6kqjWQtHPEr0Cktgnjtot6RpCQMwVwbQ/BzhjM1q069JAAP943aUknZQhvqyAN2Mv+tYsHcmF4ryc886wHMIAgUYdHsrUkMg==

X-Forefront-Antispam-Report:

CIP:178.79.141.237;CTRY:GB;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:bbcgfdhvbnghfa20.onmicrosoft.com;PTR:178-79-141-237.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(82310400014)(376005)(36860700004)(34070700005)(41320700004)(61400799018);DIR:OUT;SFP:1102;

X-OriginatorOrg: bbcgfdhvbnghfa20.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Mar 2024 13:42:32.8938

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 013672e3-8f47-42bd-7673-08dc4a75ed33

X-MS-Exchange-CrossTenant-Id: 4101a2b9-b79d-41dd-8e33-4851f7c67926

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4101a2b9-b79d-41dd-8e33-4851f7c67926;Ip=[178.79.141.237];Helo=[bbcgfdhvbnghfa20.onmicrosoft.com]

X-MS-Exchange-CrossTenant-AuthSource:

BN2PEPF000044A8.namprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL3PR19MB6491

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: (1) Notifications ミ★ Ninja Woodfire Grill ★彡 ꧁ Order

confirmation #103800 ꧂



Content analysis details: (7.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.92.91 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ninja-za5oy0o(at)bbcgfdhvbnghfa20.onmicrosoft.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

1.0 BOGUS_MIME_VERSION Mime version header is bogus

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 FROM_MISSPACED From: missing whitespace

0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider

0.0 T_FROM_MISSP_DKIM From misspaced, DKIM dependable

0.0 T_REMOTE_IMAGE Message contains an external image

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} Thank you









(1) Notifications























































ミ★ Ninja Woodfire Grill ★彡







꧁ Order confirmation #103800 ꧂