Phish directed at nk.ca users

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 May 2022 17:30:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nsC3X-000JRd-38

for dave@doctor.nl2k.ab.ca;

Fri, 20 May 2022 17:29:15 -0600

Resent-From: The Doctor

Resent-Date: Fri, 20 May 2022 17:29:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [144.168.46.18] (port=38284 helo=144-168-46-19.static.hvvc.us)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nsBdV-000HeV-Dv

for doctor@doctor.nl2k.ab.ca;

Fri, 20 May 2022 17:02:29 -0600

Received: from [67.207.163.210] (port=56420 helo=67.207.163.210.rdns.ColocationAmerica.com)

by beeblebrox.awsdns-23.co.uk with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95)

(envelope-from )

id 1nsBdC-00010C-4c

for doctor@doctor.nl2k.ab.ca;

Fri, 20 May 2022 19:02:02 -0400

Reply-To: microsoft@mail.com

From: doctor.nl2k.ab.ca

To: doctor@doctor.nl2k.ab.ca

Subject: ACTION REQUIRED

Date: 20 May 2022 16:02:01 -0700

Message-ID: <20220520160201.0FA3459B049F2255@doctor.nl2k.ab.ca>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - beeblebrox.awsdns-23.co.uk

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - doctor.nl2k.ab.ca

X-Get-Message-Sender-Via: beeblebrox.awsdns-23.co.uk: authenticated_id: smtp41@aws.amazon.com

X-Authenticated-Sender: beeblebrox.awsdns-23.co.uk: smtp41@aws.amazon.com

X-Spam_score: 13.1

X-Spam_score_int: 131

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: doctor, your mailbox is almost full. 4.86 GB 4.18 GB You might

experience delays or can no longer send and receive messages.



Content analysis details: (13.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname

(Split IP)

0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or

Generic rPTR

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=doctor%40doctor.nl2k.ab.ca;ip=144.168.46.18;r=doctor.nl2k.ab.ca]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

3.9 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP

addr 2)

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML

only

0.0 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF

failed

0.0 TO_EQ_FM_SPF_FAIL To == From and external SPF failed

Subject: {SPAM?} ACTION REQUIRED
















; text-indent: 0px; letter-spacing: normal; font-family: "Lucida Grande", V=

erdana, Arial, Helvetica, sans-serif; font-size: 1.2em; font-style: normal;=

font-weight: 600; margin-top: 0px; margin-bottom: 1.5em; word-spacing: 0px=

; white-space: normal; orphans: 2; widows: 2; background-color: rgb(255, 25=

5, 255); font-variant-ligatures: normal; font-variant-caps: normal; -webkit=

-text-stroke-width: 0px; text-decoration-thickness:=20

initial; text-decoration-style: initial; text-decoration-color: initial;'>d=

octor, your mailbox is almost full.




(51, 51, 51); text-transform: none; text-indent: 0px; letter-spacing: norma=

l; font-family: "Lucida Grande", Verdana, Arial, Helvetica, sans-serif; fon=

t-size: 11px; font-style: normal; font-weight: 400; word-spacing: 0px; whit=

e-space: normal; border-collapse: collapse; orphans: 2; widows: 2; backgrou=

nd-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-=

caps: normal; -webkit-text-stroke-width: 0px;=20

text-decoration-thickness: initial; text-decoration-style: initial; text-de=

coration-color: initial;' border=3D"0" cellspacing=3D"0" cellpadding=3D"0">=


, 60, 47); margin: 0px; width: 321px; font-family: Roboto, RobotoDraft, Hel=

vetica, Arial, sans-serif;"> 

224, 224, 224); margin: 0px; font-family: Roboto, RobotoDraft, Helvetica, A=

rial, sans-serif;"> 



(51, 51, 51); text-transform: none; text-indent: 0px; letter-spacing: norma=

l; font-family: "Lucida Grande", Verdana, Arial, Helvetica, sans-serif; fon=

t-size: 11px; font-style: normal; font-weight: 400; word-spacing: 0px; whit=

e-space: normal; border-collapse: collapse; orphans: 2; widows: 2; backgrou=

nd-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-=

caps: normal; -webkit-text-stroke-width: 0px;=20

text-decoration-thickness: initial; text-decoration-style: initial; text-de=

coration-color: initial;' border=3D"0" cellspacing=3D"0" cellpadding=3D"0">=




botoDraft, Helvetica, Arial, sans-serif;">
, 47); font-weight: bold;">4.86 GB

margin: 0px; font-family: Roboto, RobotoDraft, Helvetica, Arial, sans-serif=

;">4.18 GB



ext-transform: none; text-indent: 0px; letter-spacing: normal; font-family:=

"Lucida Grande", Verdana, Arial, Helvetica, sans-serif; font-size: 11px; f=

ont-style: normal; font-weight: 400; word-spacing: 0px; white-space: normal=

; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant=

-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0=

px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;'>You m=

ight experience delays or can no longer send and receive messages.
=



ud/ipfs/QmRQ7J8sWPC8TVsEk2JoSBuhWTx9krt8x2WZbEsoJ7AxSu#doctor@doctor.nl2k.a=

b.ca">


148, 148) 100%); padding: 5px 10px; border-radius: 8px; border: 1px solid r=

gb(8, 44, 64); border-image: none; text-align: center; color: rgb(231, 24, =

76); letter-spacing: 2px; font-size: 24px; font-variant: small-caps; font-w=

eight: bold; position: relative; cursor: pointer; box-shadow: 1px 3px 5px 2=

px #c0c0c0; text-shadow: 1px 1px 1px rgba(5,29,41,1); -ms-user-select: none=

; -webkit-box-shadow: 1px 3px 5px 2px #c0c0c0;=20

-moz-box-shadow: 1px 3px 5px 2px #c0c0c0; -webkit-touch-callout: none; -web=

kit-user-select: none; -khtml-user-select: none; -moz-user-select: none; us=

er-select: none;">CLEAR STORAGE




ext-transform: none; text-indent: 0px; letter-spacing: normal; font-family:=

"Lucida Grande", Verdana, Arial, Helvetica, sans-serif; font-size: 11px; f=

ont-style: normal; font-weight: 400; word-spacing: 0px; white-space: normal=

; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant=

-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0=

px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;'>
=3D"font-weight: bolder;">Mailbox address:

134, 186); text-decoration: none; background-color: transparent;" target=

=3D"_blank" rel=3D"noreferrer">doctor@doctor.nl2k.ab.ca











Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA