Phish attempt from New Zealand
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@nl2k.ab.ca
Delivery-date: Thu, 05 May 2022 14:00:00 -0600
Received: from vmi522814.contaboserver.net ([173.249.63.56]:46274)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1nmhdM-000HkM-GS
for dave@nl2k.ab.ca;
Thu, 05 May 2022 13:59:38 -0600
Received: from [46.183.221.27] (port=65061 helo=daltons.co.nz)
by vmi522814.contaboserver.net with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95)
(envelope-from)
id 1nmhd3-0004Iq-4R
for dave@nl2k.ab.ca;
Thu, 05 May 2022 21:59:10 +0200
From: Admin
To: dave@nl2k.ab.ca
Subject: Undelivered Mail Returned to Sender
Date: 05 May 2022 22:58:13 +0300
Message-ID: <20220505225812.F3C9F2D03C08E0E1@daltons.co.nz>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - vmi522814.contaboserver.net
X-AntiAbuse: Original Domain - nl2k.ab.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - daltons.co.nz
X-Get-Message-Sender-Via: vmi522814.contaboserver.net: authenticated_id: hr@idealdeal.pk
X-Authenticated-Sender: vmi522814.contaboserver.net: hr@idealdeal.pk
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 14.3
X-Spam_score_int: 143
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: This message was created automatically by mail delivery software.
''dave@nl2k.ab.ca '' View details A message that you sent could not be delivered
to one or more of its recipients. This is a permanent error. The following
address(es) failed: Failure details
Content analysis details: (14.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[173.249.63.56 listed in bb.barracudacentral.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[173.249.63.56 listed in wl.mailspike.net]
1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)
[173.249.63.56 listed in ix.dnsbl.manitu.net]
0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server
[46.183.221.27 listed in dnsbl.sorbs.net]
0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.5 FSL_BULK_SIG Bulk signature with no Unsubscribe
3.0 URI_FIREBASEAPP Link to hosted firebase web application,
possible phishing
Subject: {SPAM?} Undelivered Mail Returned to Sender
Envelope-to: dave@nl2k.ab.ca
Delivery-date: Thu, 05 May 2022 14:00:00 -0600
Received: from vmi522814.contaboserver.net ([173.249.63.56]:46274)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from
id 1nmhdM-000HkM-GS
for dave@nl2k.ab.ca;
Thu, 05 May 2022 13:59:38 -0600
Received: from [46.183.221.27] (port=65061 helo=daltons.co.nz)
by vmi522814.contaboserver.net with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95)
(envelope-from
id 1nmhd3-0004Iq-4R
for dave@nl2k.ab.ca;
Thu, 05 May 2022 21:59:10 +0200
From: Admin
To: dave@nl2k.ab.ca
Subject: Undelivered Mail Returned to Sender
Date: 05 May 2022 22:58:13 +0300
Message-ID: <20220505225812.F3C9F2D03C08E0E1@daltons.co.nz>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - vmi522814.contaboserver.net
X-AntiAbuse: Original Domain - nl2k.ab.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - daltons.co.nz
X-Get-Message-Sender-Via: vmi522814.contaboserver.net: authenticated_id: hr@idealdeal.pk
X-Authenticated-Sender: vmi522814.contaboserver.net: hr@idealdeal.pk
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 14.3
X-Spam_score_int: 143
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: This message was created automatically by mail delivery software.
''dave@nl2k.ab.ca '' View details A message that you sent could not be delivered
to one or more of its recipients. This is a permanent error. The following
address(es) failed: Failure details
Content analysis details: (14.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[173.249.63.56 listed in bb.barracudacentral.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[173.249.63.56 listed in wl.mailspike.net]
1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)
[173.249.63.56 listed in ix.dnsbl.manitu.net]
0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server
[46.183.221.27 listed in dnsbl.sorbs.net]
0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.5 FSL_BULK_SIG Bulk signature with no Unsubscribe
3.0 URI_FIREBASEAPP Link to hosted firebase web application,
possible phishing
Subject: {SPAM?} Undelivered Mail Returned to Sender
<=
font color=3D"#000000">This message was created automatically by mail deliv=
ery software. ''
, 26, 0.3);" href=3D"mailto:dave@nl2k.ab.ca" rel=3D"noreferrer">
=3D"#000000">dave@nl2k.ab.ca
''
5, 205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-color: #=
cdcdcd;">
=2E3);" href=3D"https://web-64394.web.app//#dave@nl2k.ab.ca" target=3D"_bla=
nk" rel=3D"noopener noreferrer">View details=
205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-color: #cd=
cdcd;">
205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-color: #cd=
cdcd;">A message that you sent could not be delivered to one or more of its=
205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-color: #cd=
cdcd;">recipients. This is a permanent error. The following address(es) fai=
led:
205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-color: #cd=
cdcd;">
);" href=3D"https://web-64394.web.app//#dave@nl2k.ab.ca" target=3D"_blank" =
rel=3D"noopener noreferrer">Failure details<=
/a>
205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-color: #cd=
cdcd;">
205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-color: #cd=
cdcd;">
5, 205, 205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-col=
or: #cdcdcd;">
);" href=3D"mailto:dave@nl2k.ab.ca" rel=3D"noreferrer">
00">dave@nl2k.ab.ca
host mail.semcreative.com [162.241.252.119]
SMTP error from =
remote mail server after RCPT to:<sales@>:
50 No=
Such User Here
font color=3D"#000000">This message was created automatically by mail deliv=
ery software. ''
, 26, 0.3);" href=3D"mailto:dave@nl2k.ab.ca" rel=3D"noreferrer">
=3D"#000000">dave@nl2k.ab.ca
''
5, 205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-color: #=
cdcdcd;">
=2E3);" href=3D"https://web-64394.web.app//#dave@nl2k.ab.ca" target=3D"_bla=
nk" rel=3D"noopener noreferrer">View details=
205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-color: #cd=
cdcd;">
205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-color: #cd=
cdcd;">A message that you sent could not be delivered to one or more of its=
205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-color: #cd=
cdcd;">recipients. This is a permanent error. The following address(es) fai=
led:
205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-color: #cd=
cdcd;">
);" href=3D"https://web-64394.web.app//#dave@nl2k.ab.ca" target=3D"_blank" =
rel=3D"noopener noreferrer">Failure details<=
/a>
205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-color: #cd=
cdcd;">
205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-color: #cd=
cdcd;">
5, 205, 205); -webkit-tap-highlight-color: rgba(26, 26, 26, 0.3); caret-col=
or: #cdcdcd;">
);" href=3D"mailto:dave@nl2k.ab.ca" rel=3D"noreferrer">
00">dave@nl2k.ab.ca
host mail.semcreative.com [162.241.252.119]
SMTP error from =
remote mail server after RCPT to:<sales@>:
50 No=
Such User Here
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments