Medical spam/phish from CloudWebManage New York City
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 18 Aug 2022 00:31:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oOZ3A-0006ra-1u
for dave@doctor.nl2k.ab.ca;
Thu, 18 Aug 2022 00:30:40 -0600
Resent-From: The Doctor
Resent-Date: Thu, 18 Aug 2022 00:30:40 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [45.126.126.25] (port=39847 helo=ear-pro.net)
by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))
id 1oOTta-000Nb1-Jb
for doctor@doctor.nl2k.ab.ca;
Wed, 17 Aug 2022 19:00:30 -0600
From:_Hair Health
Subject:_Doctor Forced To Resign After Unveiling Hair Regrowth Hack
Date: Thu, 18 Aug 2022 02:59:04 +0200
To: doctor@doctor.nl2k.ab.ca
Reply-To: "Adobe Creative Cloud"
MIME-Version: 1.0
X-mailer: nlserver, Build 6.7.0
Message-ID:
X-250ok-CID: P26341-121020
TenantHeader: 1d0e6311-6f98-4c5b-8b0e-rWM5LDPcfDUFB1j6IO8jxNT
Affinity: prod.default
X-cust_MessageID: 1938757681
X-cust_DeliveryID: 350826
X-cust_InstanceName: aci_prod
MessageMaxRetry:2000
MessageRetryPeriod: 3600
MessageWebValidityDuration: 2592000
MessageValidityDuration: 432000
X-cust_IMSOrgID:
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset="UTF-8"
X-Spam_score: 10.8
X-Spam_score_int: 108
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: This is shocking! A weird doctor from New Jersey was forced
out of his practice after he unveiled a billion-dollar secret he wasn't supposed
to know. The real reasonwhy you are losing your hair…
Content analysis details: (10.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of
words
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML
tag
2.5 HDRS_MISSP Misspaced headers
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML
only
Subject: {SPAM?} _Doctor Forced To Resign After Unveiling Hair Regrowth Hack
This is shocking!
A weird doctor from New Jersey was forced out of his practice after he unveiled a billion-dollar secret he wasn't supposed to know.
The real reasonwhy you are losing your hair…
And the simple daily habit you can do to restore it, no matter of your age or current condition.
His secret is so amazing, it sent the entire hair regrowth industry back to the drawing board, and it’s currently losing them millions of dollars.
His method is available for a very short period of time and only to selected people.
See if you qualify here...
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 18 Aug 2022 00:31:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oOZ3A-0006ra-1u
for dave@doctor.nl2k.ab.ca;
Thu, 18 Aug 2022 00:30:40 -0600
Resent-From: The Doctor
Resent-Date: Thu, 18 Aug 2022 00:30:40 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [45.126.126.25] (port=39847 helo=ear-pro.net)
by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))
id 1oOTta-000Nb1-Jb
for doctor@doctor.nl2k.ab.ca;
Wed, 17 Aug 2022 19:00:30 -0600
From:_Hair Health
Subject:_Doctor Forced To Resign After Unveiling Hair Regrowth Hack
Date: Thu, 18 Aug 2022 02:59:04 +0200
To: doctor@doctor.nl2k.ab.ca
Reply-To: "Adobe Creative Cloud"
MIME-Version: 1.0
X-mailer: nlserver, Build 6.7.0
Message-ID:
X-250ok-CID: P26341-121020
TenantHeader: 1d0e6311-6f98-4c5b-8b0e-rWM5LDPcfDUFB1j6IO8jxNT
Affinity: prod.default
X-cust_MessageID: 1938757681
X-cust_DeliveryID: 350826
X-cust_InstanceName: aci_prod
MessageMaxRetry:2000
MessageRetryPeriod: 3600
MessageWebValidityDuration: 2592000
MessageValidityDuration: 432000
X-cust_IMSOrgID:
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset="UTF-8"
X-Spam_score: 10.8
X-Spam_score_int: 108
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: This is shocking! A weird doctor from New Jersey was forced
out of his practice after he unveiled a billion-dollar secret he wasn't supposed
to know. The real reasonwhy you are losing your hair…
Content analysis details: (10.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of
words
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML
tag
2.5 HDRS_MISSP Misspaced headers
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML
only
Subject: {SPAM?} _Doctor Forced To Resign After Unveiling Hair Regrowth Hack
This is shocking!
A weird doctor from New Jersey was forced out of his practice after he unveiled a billion-dollar secret he wasn't supposed to know.
The real reasonwhy you are losing your hair…
And the simple daily habit you can do to restore it, no matter of your age or current condition.
His secret is so amazing, it sent the entire hair regrowth industry back to the drawing board, and it’s currently losing them millions of dollars.
His method is available for a very short period of time and only to selected people.
See if you qualify here...
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments