Remittance Phish
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 27 Mar 2024 20:06:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rpf8h-000000007Es-2P25
for dave@doctor.nl2k.ab.ca;
Wed, 27 Mar 2024 20:05:11 -0600
Resent-From: The Doctor
Resent-Date: Wed, 27 Mar 2024 20:05:11 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from ded4927.inmotionhosting.com ([192.249.121.37]:47143)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rpdEb-00000000MxT-20pU
for www@doctor.nl2k.ab.ca;
Wed, 27 Mar 2024 18:03:17 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=wasender.my
; s=default; h=Content-Type:MIME-Version:Message-ID:Date:Subject:To:From:
Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description:
Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:
List-Post:List-Owner:List-Archive;
bh=PCxFbp6om2WrjKNuDYm+4clIZeyl/UWI0CNDEGqXbMQ=; b=Bxx4rJ6WGsi3FsEheC41mCJuUb
CsZqiCM16ljVHjhDlk+XfE6peR02REERGmBDYTzBTkzcYL5vv68N+rlYcQN7080HrLZdY75dX55Sj
/vIsnny4Hv7b7Nmef8LG3/Ks8lgJSKm53QmenKA5KXi9rCeCma1BJYJbeaRWF4dA5E818SIYyGd48
t32f6X5nM6EHJaGr+aKU/OYgfK9FzqTx4LYwXYSb09VdMAcyY9Dk3lTAI7M6JUpgnfu+bichJ1V8K
Hr1kcTtWSEzn8F4gp2G/+A/21ms/XC9KzTp0YtVfa0GUepWq9gM1JirM/8ehJlqQWLAeTXgkRmN8R
j7IbD4Bw==;
Received: from [69.172.233.31] (port=53322 helo=wasender.my)
by ded4927.inmotionhosting.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96.2)
(envelope-from)
id 1rpdCf-0005oh-31
for www@doctor.nl2k.ab.ca;
Thu, 28 Mar 2024 08:01:09 +0800
From: www
To: www@doctor.nl2k.ab.ca
Subject: ** VIRUS ***=?UTF-8?B?RG9jdVNpZ24gUmVjZWl2ZWQ=?= 3/28/2024 12:58:02 a.m.
Date: 28 Mar 2024 00:58:02 +0100
Message-ID: <20240328005802.AB0D40673E06B21A@wasender.my>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0012_E7660089.3DF79FB1"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - ded4927.inmotionhosting.com
X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - wasender.my
X-Get-Message-Sender-Via: ded4927.inmotionhosting.com: authenticated_id: admin@wasender.my
X-Authenticated-Sender: ded4927.inmotionhosting.com: admin@wasender.my
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello www, See attached for remittance advice. This payment
will available in your account in 2-3 business days.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[192.249.121.37 listed in psbl.surriel.com]
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
2.7 FROM_WSP_TRAIL Trailing whitespace before '>' in From header field
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_OBFU_HTML_ATTACH HTML attachment with non-text MIME type
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_HTML_ATTACH HTML attachment to bypass scanning?
Subject: ** VIRUS ***{SPAM?} =?UTF-8?B?RG9jdVNpZ24gUmVjZWl2ZWQ=?= 3/28/2024 12:58:02 a.m.
X-Antivirus: AVG (VPS 240327-4, 3/27/2024), Inbound message
X-Antivirus-Status: Infected
X-Attachment: STATEMENT.html#4234116485 Virus: Other:SNH-gen [Phish] Moved to chest
This is a multi-part message in MIME format.
------=_NextPart_000_0012_E7660089.3DF79FB1
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
ntColor; border-image: none; color: rgb(0, 0, 0); line-height: inherit; fon=
t-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetic=
a, sans-serif; font-size: 12pt; font-style: inherit; font-variant: inherit;=
font-weight: inherit; vertical-align: baseline; font-stretch: inherit; fon=
t-feature-settings: inherit; font-optical-sizing: inherit; font-kerning: in=
herit; font-variation-settings: inherit;">
Hello www,
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 27 Mar 2024 20:06:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rpf8h-000000007Es-2P25
for dave@doctor.nl2k.ab.ca;
Wed, 27 Mar 2024 20:05:11 -0600
Resent-From: The Doctor
Resent-Date: Wed, 27 Mar 2024 20:05:11 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from ded4927.inmotionhosting.com ([192.249.121.37]:47143)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rpdEb-00000000MxT-20pU
for www@doctor.nl2k.ab.ca;
Wed, 27 Mar 2024 18:03:17 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=wasender.my
; s=default; h=Content-Type:MIME-Version:Message-ID:Date:Subject:To:From:
Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description:
Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:
List-Post:List-Owner:List-Archive;
bh=PCxFbp6om2WrjKNuDYm+4clIZeyl/UWI0CNDEGqXbMQ=; b=Bxx4rJ6WGsi3FsEheC41mCJuUb
CsZqiCM16ljVHjhDlk+XfE6peR02REERGmBDYTzBTkzcYL5vv68N+rlYcQN7080HrLZdY75dX55Sj
/vIsnny4Hv7b7Nmef8LG3/Ks8lgJSKm53QmenKA5KXi9rCeCma1BJYJbeaRWF4dA5E818SIYyGd48
t32f6X5nM6EHJaGr+aKU/OYgfK9FzqTx4LYwXYSb09VdMAcyY9Dk3lTAI7M6JUpgnfu+bichJ1V8K
Hr1kcTtWSEzn8F4gp2G/+A/21ms/XC9KzTp0YtVfa0GUepWq9gM1JirM/8ehJlqQWLAeTXgkRmN8R
j7IbD4Bw==;
Received: from [69.172.233.31] (port=53322 helo=wasender.my)
by ded4927.inmotionhosting.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96.2)
(envelope-from
id 1rpdCf-0005oh-31
for www@doctor.nl2k.ab.ca;
Thu, 28 Mar 2024 08:01:09 +0800
From: www
To: www@doctor.nl2k.ab.ca
Subject: ** VIRUS ***=?UTF-8?B?RG9jdVNpZ24gUmVjZWl2ZWQ=?= 3/28/2024 12:58:02 a.m.
Date: 28 Mar 2024 00:58:02 +0100
Message-ID: <20240328005802.AB0D40673E06B21A@wasender.my>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0012_E7660089.3DF79FB1"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - ded4927.inmotionhosting.com
X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - wasender.my
X-Get-Message-Sender-Via: ded4927.inmotionhosting.com: authenticated_id: admin@wasender.my
X-Authenticated-Sender: ded4927.inmotionhosting.com: admin@wasender.my
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello www, See attached for remittance advice. This payment
will available in your account in 2-3 business days.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[192.249.121.37 listed in psbl.surriel.com]
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
2.7 FROM_WSP_TRAIL Trailing whitespace before '>' in From header field
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_OBFU_HTML_ATTACH HTML attachment with non-text MIME type
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_HTML_ATTACH HTML attachment to bypass scanning?
Subject: ** VIRUS ***{SPAM?} =?UTF-8?B?RG9jdVNpZ24gUmVjZWl2ZWQ=?= 3/28/2024 12:58:02 a.m.
X-Antivirus: AVG (VPS 240327-4, 3/27/2024), Inbound message
X-Antivirus-Status: Infected
X-Attachment: STATEMENT.html#4234116485 Virus: Other:SNH-gen [Phish] Moved to chest
This is a multi-part message in MIME format.
------=_NextPart_000_0012_E7660089.3DF79FB1
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
ntColor; border-image: none; color: rgb(0, 0, 0); line-height: inherit; fon=
t-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetic=
a, sans-serif; font-size: 12pt; font-style: inherit; font-variant: inherit;=
font-weight: inherit; vertical-align: baseline; font-stretch: inherit; fon=
t-feature-settings: inherit; font-optical-sizing: inherit; font-kerning: in=
herit; font-variation-settings: inherit;">
Hello www,
tColor; border-image: none; color: rgb(0, 0, 0); line-height: inherit; font=
-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica=
, sans-serif; font-size: 12pt; font-style: inherit; font-variant: inherit; =
font-weight: inherit; vertical-align: baseline; font-stretch: inherit; font=
-feature-settings: inherit; font-optical-sizing: inherit; font-kerning: inh=
erit; font-variation-settings: inherit;">
rder-image: none; color: rgb(0, 0, 0); line-height: inherit; font-family: A=
ptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-ser=
if; font-size: 12pt; font-style: inherit; font-variant: inherit; font-weigh=
t: inherit; vertical-align: baseline; font-stretch: inherit; font-feature-s=
ettings: inherit; font-optical-sizing: inherit; font-kerning: inherit; font=
-variation-settings: inherit;">
See attached for remittance advice.
mage: none; color: rgb(0, 0, 0); line-height: inherit; font-family: Aptos, =
Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=
nt-size: 12pt; font-style: inherit; font-variant: inherit; font-weight: inh=
erit; vertical-align: baseline; font-stretch: inherit; font-feature-setting=
s: inherit; font-optical-sizing: inherit; font-kerning: inherit; font-varia=
tion-settings: inherit;">
mage: none; color: rgb(0, 0, 0); line-height: inherit; font-family: Aptos, =
Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=
nt-size: 12pt; font-style: inherit; font-variant: inherit; font-weight: inh=
erit; vertical-align: baseline; font-stretch: inherit; font-feature-setting=
s: inherit; font-optical-sizing: inherit; font-kerning: inherit; font-varia=
tion-settings: inherit;">
This payment will available in your account in 2-3 business days.
v>
mage: none; color: rgb(0, 0, 0); line-height: inherit; font-family: Aptos, =
Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=
nt-size: 12pt; font-style: inherit; font-variant: inherit; font-weight: inh=
erit; vertical-align: baseline; font-stretch: inherit; font-feature-setting=
s: inherit; font-optical-sizing: inherit; font-kerning: inherit; font-varia=
tion-settings: inherit;">
mage: none; color: rgb(0, 0, 0); line-height: inherit; font-family: Aptos, =
Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=
nt-size: 12pt; font-style: inherit; font-variant: inherit; font-weight: inh=
erit; vertical-align: baseline; font-stretch: inherit; font-feature-setting=
s: inherit; font-optical-sizing: inherit; font-kerning: inherit; font-varia=
tion-settings: inherit;">Keep in touch
mage: none; color: rgb(0, 0, 0); line-height: inherit; font-family: Aptos, =
Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=
nt-size: 12pt; font-style: inherit; font-variant: inherit; font-weight: inh=
erit; vertical-align: baseline; font-stretch: inherit; font-feature-setting=
s: inherit; font-optical-sizing: inherit; font-kerning: inherit; font-varia=
tion-settings: inherit;">
mage: none; color: rgb(0, 0, 0); line-height: inherit; font-family: Aptos, =
Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=
nt-size: 12pt; font-style: inherit; font-variant: inherit; font-weight: inh=
erit; vertical-align: baseline; font-stretch: inherit; font-feature-setting=
s: inherit; font-optical-sizing: inherit; font-kerning: inherit; font-varia=
tion-settings: inherit;">Thank you,
mage: none; color: rgb(0, 0, 0); line-height: inherit; font-family: Aptos, =
Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=
nt-size: 12pt; font-style: inherit; font-variant: inherit; font-weight: inh=
erit; vertical-align: baseline; font-stretch: inherit; font-feature-setting=
s: inherit; font-optical-sizing: inherit; font-kerning: inherit; font-varia=
tion-settings: inherit;">Jordon Duce
mage: none; color: rgb(0, 0, 0); line-height: inherit; font-family: Aptos, =
Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=
nt-size: 12pt; font-style: inherit; font-variant: inherit; font-weight: inh=
erit; vertical-align: baseline; font-stretch: inherit; font-feature-setting=
s: inherit; font-optical-sizing: inherit; font-kerning: inherit; font-varia=
tion-settings: inherit;">
Senior Office Accounting
mage: none; color: rgb(0, 0, 0); line-height: inherit; font-family: Aptos, =
Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=
nt-size: 12pt; font-style: inherit; font-variant: inherit; font-weight: inh=
erit; vertical-align: baseline; font-stretch: inherit; font-feature-setting=
s: inherit; font-optical-sizing: inherit; font-kerning: inherit; font-varia=
tion-settings: inherit;">
Sent from Mail for Windows
t>
------=_NextPart_000_0012_E7660089.3DF79FB1--