RBC Phish from Germany
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 21 Sep 2022 14:58:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1ob6mI-000HS7-C5
for dave@doctor.nl2k.ab.ca;
Wed, 21 Sep 2022 14:57:06 -0600
Resent-From: The Doctor
Resent-Date: Wed, 21 Sep 2022 14:57:06 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from ns2.nk.ca ([204.209.81.3]:23246 helo=gallifrey.nk.ca)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1ob5XV-000Az6-Mf
for doctor@nk.ca;
Wed, 21 Sep 2022 13:37:47 -0600
Received: from [46.228.203.10] (port=59950 helo=gki.com)
by gallifrey.nk.ca with esmtp (Exim 4.95 (FreeBSD))
(envelope-from)
id 1ob5X9-00084q-7c
for root@gallifrey.nk.ca;
Wed, 21 Sep 2022 13:37:24 -0600
Reply-To:
From: RBC Royal Bank
To: root@gallifrey.nk.ca
Subject: Your Urgent Attention is Required
Date: 21 Sep 2022 21:36:53 +0200
Message-ID: <20220921213653.CD322FDE9E19626F@gki.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 10.7
X-Spam_score_int: 107
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your password has been disabled! Hello, your password has
been entered incorrectly three times and for your security, we have disabled
your password. To enable your password, please sign in and follow instructions
to review your recent activities.
Content analysis details: (10.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.1 URIBL_GREY Contains an URL listed in the URIBL greylist
[URIs: sendgrid.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[f.morgan12[at]yahoo.com]
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX
X-Spam_score: 10.7
X-Spam_score_int: 107
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your password has been disabled! Hello, your password has
been entered incorrectly three times and for your security, we have disabled
your password. To enable your password, please sign in and follow instructions
to review your recent activities.
Content analysis details: (10.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.1 URIBL_GREY Contains an URL listed in the URIBL greylist
[URIs: sendgrid.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[f.morgan12[at]yahoo.com]
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX
Subject: {SPAM?} Your Urgent Attention is Required
/TR/xhtml1/DTD/xhtml1-strict.dtd">
w3.org/1999/xhtml">
-8">
e=3D1, minimum-scale=3D1, maximum-scale=3D1">
font-size: 14px; color: #000000">
=3D"font-size:14px; font-family:arial,helvetica,sans-serif; color:#000000; =
background-color:#FFFFFF;">
font-size: 14px" class=3D"webkit">
table-layout: fixed;
-webkit-font-smoothing: antialiased;
-webkit-text-size-adjust: 100%;
-moz-text-size-adjust: 100%;
-ms-text-size-adjust: 100%" cellpadding=3D"0" cellspacing=3D"0" borde=
r=3D"0" width=3D"100%" class=3D"wrapper" bgcolor=3D"#FFFFFF">
uter" align=3D"center" cellpadding=3D"0" cellspacing=3D"0" border=3D"0">
=3D"0" border=3D"0">
cellspacing=3D"0" border=3D"0" style=3D"width:100%; max-width:600px;" alig=
n=3D"center">
e=3D"padding:0px 0px 0px 0px; color:#000000; text-align:left;" bgcolor=3D"#=
FFFFFF" width=3D"100%" align=3D"left">
eader-hide" role=3D"module" data-type=3D"preheader" border=3D"0" cellpaddin=
g=3D"0" cellspacing=3D"0" width=3D"100%" style=3D"display: none !important;=
mso-hide: all; visibility: hidden; opacity: 0; color: transparent; height:=
0; width: 0;">
font-size: 14px; margin: 0; padding: 0">
table-layout: fixed;
-webkit-font-smoothing: antialiased;
-webkit-text-size-adjust: 100%;
-moz-text-size-adjust: 100%;
-ms-text-size-adjust: 100%; table-layout: fixed;" class=3D"wrapper" r=
ole=3D"module" data-type=3D"image" border=3D"0" cellpadding=3D"0" cellspaci=
ng=3D"0" width=3D"100%" data-muid=3D"6ad0916d-aa5c-4e0a-93cd-c02baca8ea84">=
px;" valign=3D"top" align=3D"center">
![]()
00000; text-decoration:none; font-family:Helvetica, arial, sans-serif; font=
-size:16px; max-width:20% !important; width:20%; height:auto !important;" c=
lass=3D"max-width" border=3D"0" width=3D"120" alt=3D"" data-proportionally-=
constrained=3D"true" data-responsive=3D"true" src=3D"http://cdn.mcauto-imag=
es-production.sendgrid.net/32724a092ad701f7/8968ea1b-5ec0-4277-8288-eba63a9=
41316/512x512.png" height=3D"120">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" style=3D"table-la=
yout: fixed;" data-muid=3D"87a492b9-b53c-4895-ae63-fa9b6f456d56" data-mc-mo=
dule-version=3D"2019-10-22">
n:inherit;" height=3D"100%" valign=3D"top" bgcolor=3D"" role=3D"module-cont=
ent">
font-size: 14px">
f;
font-size: 14px; font-family: inherit; text-align: center">
e=3D"font-size: 24px; color: #0f5ac3; font-family: trebuchet ms,helvetica,s=
ans-serif">Your password has been disabled!
iv style=3D"font-family: arial,helvetica,sans-serif;
font-size: 14px">
der=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" style=3D"table=
-layout: fixed;" data-muid=3D"e34902f9-fa0b-44a8-9d6c-7c3c7cbc7bae">
ight=3D"100%" valign=3D"top" bgcolor=3D"">
center" width=3D"100%" height=3D"1px" style=3D"line-height:1px; font-size:1=
px;">
=
=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" style=3D"table-la=
yout: fixed;" data-muid=3D"31cfc55c-f773-4f23-8098-33b3e19d0441" data-mc-mo=
dule-version=3D"2019-10-22">
n:inherit;" height=3D"100%" valign=3D"top" bgcolor=3D"" role=3D"module-cont=
ent">
font-size: 14px">
f;
font-size: 14px; font-family: inherit; text-align: left">
=3D"font-family: trebuchet ms,helvetica,sans-serif">Hello, your password ha=
s been entered incorrectly three times and for your security, we have disab=
led your password.
font-size: 14px; font-family: inherit; text-align: left">
=3D"font-family: trebuchet ms,helvetica,sans-serif">
To enable your password, please sign in and follow instructions to review y=
our recent activities.
font-size: 14px; font-family: inherit; text-align: left">
font-size: 14px; font-family: inherit">
o.za/rid/fo2.htm">
ly: trebuchet ms,helvetica,sans-serif">Sign =
elvetica,sans-serif">in to
or: #1458c4; font-size: 14px; font-family: trebuchet ms,helvetica,sans-seri=
f"> my account
font-size: 14px; font-family: inherit">
font-size: 14px; font-family: inherit">
ebuchet ms,helvetica,sans-serif">We take your security seriously want to ke=
ep you in Me loop with important activities in your account. So, if somethi=
ng does. look right or you weren't aware of Mese Manges, we are here to hel=
p.
Thank you for being a valued customer.
y: arial,helvetica,sans-serif;
font-size: 14px">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" style=3D"table-la=
yout: fixed;" data-muid=3D"4270237d-6da1-4132-8511-ffe90bece983">
n:inherit;" height=3D"100%" valign=3D"top" bgcolor=3D"" role=3D"module-cont=
ent">
font-size: 14px">
f;
font-size: 14px; font-family: inherit; text-align: center">
e=3D"color: #0F5AC3; font-family: trebuchet ms,helvetica,sans-serif; font-s=
ize: 24px">Enjoy value, flexibility
olor: #0F5AC3; font-family: trebuchet ms,helvetica,sans-serif; font-size: 2=
4px">,
tica,sans-serif; font-size: 24px"> and choice =
font-size: 14px; font-family: inherit; text-align: center">
8px">Are you signed up for RBC ULTIMATE REWARDS?
Here are just some of the perks you could get with RBC Ultimate Rewards.
pan>
font-size: 14px">
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 21 Sep 2022 14:58:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1ob6mI-000HS7-C5
for dave@doctor.nl2k.ab.ca;
Wed, 21 Sep 2022 14:57:06 -0600
Resent-From: The Doctor
Resent-Date: Wed, 21 Sep 2022 14:57:06 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from ns2.nk.ca ([204.209.81.3]:23246 helo=gallifrey.nk.ca)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from
id 1ob5XV-000Az6-Mf
for doctor@nk.ca;
Wed, 21 Sep 2022 13:37:47 -0600
Received: from [46.228.203.10] (port=59950 helo=gki.com)
by gallifrey.nk.ca with esmtp (Exim 4.95 (FreeBSD))
(envelope-from
id 1ob5X9-00084q-7c
for root@gallifrey.nk.ca;
Wed, 21 Sep 2022 13:37:24 -0600
Reply-To:
From: RBC Royal Bank
To: root@gallifrey.nk.ca
Subject: Your Urgent Attention is Required
Date: 21 Sep 2022 21:36:53 +0200
Message-ID: <20220921213653.CD322FDE9E19626F@gki.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 10.7
X-Spam_score_int: 107
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your password has been disabled! Hello, your password has
been entered incorrectly three times and for your security, we have disabled
your password. To enable your password, please sign in and follow instructions
to review your recent activities.
Content analysis details: (10.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.1 URIBL_GREY Contains an URL listed in the URIBL greylist
[URIs: sendgrid.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[f.morgan12[at]yahoo.com]
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX
X-Spam_score: 10.7
X-Spam_score_int: 107
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your password has been disabled! Hello, your password has
been entered incorrectly three times and for your security, we have disabled
your password. To enable your password, please sign in and follow instructions
to review your recent activities.
Content analysis details: (10.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.1 URIBL_GREY Contains an URL listed in the URIBL greylist
[URIs: sendgrid.net]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in
digit
[f.morgan12[at]yahoo.com]
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX
Subject: {SPAM?} Your Urgent Attention is Required
/TR/xhtml1/DTD/xhtml1-strict.dtd">
w3.org/1999/xhtml">
-8">
e=3D1, minimum-scale=3D1, maximum-scale=3D1">
font-size: 14px; color: #000000">
=3D"font-size:14px; font-family:arial,helvetica,sans-serif; color:#000000; =
background-color:#FFFFFF;">
font-size: 14px" class=3D"webkit">
table-layout: fixed;
-webkit-font-smoothing: antialiased;
-webkit-text-size-adjust: 100%;
-moz-text-size-adjust: 100%;
-ms-text-size-adjust: 100%" cellpadding=3D"0" cellspacing=3D"0" borde=
r=3D"0" width=3D"100%" class=3D"wrapper" bgcolor=3D"#FFFFFF">
uter" align=3D"center" cellpadding=3D"0" cellspacing=3D"0" border=3D"0">
=3D"0" border=3D"0">
cellspacing=3D"0" border=3D"0" style=3D"width:100%; max-width:600px;" alig=
n=3D"center">
e=3D"padding:0px 0px 0px 0px; color:#000000; text-align:left;" bgcolor=3D"#=
FFFFFF" width=3D"100%" align=3D"left">
eader-hide" role=3D"module" data-type=3D"preheader" border=3D"0" cellpaddin=
g=3D"0" cellspacing=3D"0" width=3D"100%" style=3D"display: none !important;=
mso-hide: all; visibility: hidden; opacity: 0; color: transparent; height:=
0; width: 0;">
font-size: 14px; margin: 0; padding: 0">
table-layout: fixed;
-webkit-font-smoothing: antialiased;
-webkit-text-size-adjust: 100%;
-moz-text-size-adjust: 100%;
-ms-text-size-adjust: 100%; table-layout: fixed;" class=3D"wrapper" r=
ole=3D"module" data-type=3D"image" border=3D"0" cellpadding=3D"0" cellspaci=
ng=3D"0" width=3D"100%" data-muid=3D"6ad0916d-aa5c-4e0a-93cd-c02baca8ea84">=
px;" valign=3D"top" align=3D"center">
00000; text-decoration:none; font-family:Helvetica, arial, sans-serif; font=
-size:16px; max-width:20% !important; width:20%; height:auto !important;" c=
lass=3D"max-width" border=3D"0" width=3D"120" alt=3D"" data-proportionally-=
constrained=3D"true" data-responsive=3D"true" src=3D"http://cdn.mcauto-imag=
es-production.sendgrid.net/32724a092ad701f7/8968ea1b-5ec0-4277-8288-eba63a9=
41316/512x512.png" height=3D"120">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" style=3D"table-la=
yout: fixed;" data-muid=3D"87a492b9-b53c-4895-ae63-fa9b6f456d56" data-mc-mo=
dule-version=3D"2019-10-22">
n:inherit;" height=3D"100%" valign=3D"top" bgcolor=3D"" role=3D"module-cont=
ent">
font-size: 14px">
f;
font-size: 14px; font-family: inherit; text-align: center">
e=3D"font-size: 24px; color: #0f5ac3; font-family: trebuchet ms,helvetica,s=
ans-serif">Your password has been disabled!
iv style=3D"font-family: arial,helvetica,sans-serif;
font-size: 14px">
der=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" style=3D"table=
-layout: fixed;" data-muid=3D"e34902f9-fa0b-44a8-9d6c-7c3c7cbc7bae">
ight=3D"100%" valign=3D"top" bgcolor=3D"">
center" width=3D"100%" height=3D"1px" style=3D"line-height:1px; font-size:1=
px;">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" style=3D"table-la=
yout: fixed;" data-muid=3D"31cfc55c-f773-4f23-8098-33b3e19d0441" data-mc-mo=
dule-version=3D"2019-10-22">
n:inherit;" height=3D"100%" valign=3D"top" bgcolor=3D"" role=3D"module-cont=
ent">
font-size: 14px">
f;
font-size: 14px; font-family: inherit; text-align: left">
=3D"font-family: trebuchet ms,helvetica,sans-serif">Hello, your password ha=
s been entered incorrectly three times and for your security, we have disab=
led your password.
font-size: 14px; font-family: inherit; text-align: left">
=3D"font-family: trebuchet ms,helvetica,sans-serif">
To enable your password, please sign in and follow instructions to review y=
our recent activities.
font-size: 14px; font-family: inherit; text-align: left">
font-size: 14px; font-family: inherit">
o.za/rid/fo2.htm">
ly: trebuchet ms,helvetica,sans-serif">Sign =
elvetica,sans-serif">in to
or: #1458c4; font-size: 14px; font-family: trebuchet ms,helvetica,sans-seri=
f"> my account
font-size: 14px; font-family: inherit">
font-size: 14px; font-family: inherit">
ebuchet ms,helvetica,sans-serif">We take your security seriously want to ke=
ep you in Me loop with important activities in your account. So, if somethi=
ng does. look right or you weren't aware of Mese Manges, we are here to hel=
p.
Thank you for being a valued customer.
y: arial,helvetica,sans-serif;
font-size: 14px">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" style=3D"table-la=
yout: fixed;" data-muid=3D"4270237d-6da1-4132-8511-ffe90bece983">
n:inherit;" height=3D"100%" valign=3D"top" bgcolor=3D"" role=3D"module-cont=
ent">
font-size: 14px">
f;
font-size: 14px; font-family: inherit; text-align: center">
e=3D"color: #0F5AC3; font-family: trebuchet ms,helvetica,sans-serif; font-s=
ize: 24px">Enjoy value, flexibility
olor: #0F5AC3; font-family: trebuchet ms,helvetica,sans-serif; font-size: 2=
4px">,
tica,sans-serif; font-size: 24px"> and choice =
font-size: 14px; font-family: inherit; text-align: center">
8px">Are you signed up for RBC ULTIMATE REWARDS?
Here are just some of the perks you could get with RBC Ultimate Rewards.
pan>
font-size: 14px">
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments