Dutch netflix phish
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 01 Jan 2023 06:00:54 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pBxud-0004L6-0n
for dave@doctor.nl2k.ab.ca;
Sun, 01 Jan 2023 05:58:03 -0700
Resent-From: The Doctor
Resent-Date: Sun, 1 Jan 2023 05:58:03 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from dramatvseries.click ([185.32.183.82]:45855)
by doctor.nl2k.ab.ca with esmtp (Exim 4.96)
(envelope-from)
id 1pBsrL-0000RT-2S
for root@doctor.nl2k.ab.ca;
Sun, 01 Jan 2023 00:34:29 -0700
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=dramatvseries.click;
h=Date:Sender:Message-Id:To:From:Subject:Content-Type:Mime-Version:Content-Transfer-Encoding; i=contact@dramatvseries.click;
bh=akTwZNe4qd6fOPQ9rZsn/FdDwDQ=;
b=Razr9xGrIppic1Mh+zgyExeO3rWdfhMc0j95mmaV888xcEws5F2uk2wu5n6JbjY9SGhtTGVY+EXm
1tIHhLuQ8oin1/JDjVNRvGxI2JtRMwgYi7Z/aBAyCKG5lz9Df4Nzt1a02s2niSU15RW/O6eiLvms
3WT48/RZXeKqioxnb2k=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=dramatvseries.click;
b=td5LDANNz9epD0P8Mfk9Pdj6AJdAaRvtuYvcQZmb6V+x9lnN0gbdceYw/hoUllSQgoAlbm/d+eFp
X55Oaic8K78+XjrFRIFgJZt5EvmqYpoFm1gcrdu8n3WdiwVwDQ6HXDhTI49dtBl0WCu0o9gURLLD
e2CdLaxrvUlFwezIr2Q=;
Date: Sun, 01 Jan 2023 07:31:47 +0000
Sender: contact@dramatvseries.click
Message-Id: <951810788267102.7.KJF3921177666@dramatvseries.click>
To: root@doctor.nl2k.ab.ca
From: "..Netflix.."
Subject: Krijg nu gratis Netflix toegang voor drie jaar!
Content-Type: text/html; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
X-Spam_score: 16.6
X-Spam_score_int: 166
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hi root! Gefeliciteerd! Jij bent een van de kanshebbers om
gratis Netflix toegang te krijgen voor drie jaar! Mogelijke winnaar: root@doctor.nl2k.ab.ca
>> Kijk snel of jij de geluksvogel bent! Zoals je wel weet hebben wij elke
week nieuwe acties bij HappyBox. Aangezien Netflix razendpopulair is in Nederland
en wij continue door onze 600.000 leden gevraagd worden naar een Netflix
actie is he [...]
Content analysis details: (16.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: dramatvseries.click]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL
blocklist
[URIs: dramatvseries.click]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URIs: dramatvseries.click]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[185.32.183.82 listed in bb.barracudacentral.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 T_PDS_OTHER_BAD_TLD Untrustworthy TLDs
[URI: dramatvseries.click (click)]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.1 TW_IJ BODY: Odd Letter Triples with IJ
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
0.5 FROM_SUSPICIOUS_NTLD From abused NTLD
3.1 HTML_TAG_BALANCE_CENTER Malformatted HTML
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 HOSTED_IMG_MULTI_PUB_01 Multiple hosted images at public site
0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX
Subject: {SPAM?} Krijg nu gratis Netflix toegang voor drie jaar!
click here to remove your self from our emails list
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 01 Jan 2023 06:00:54 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pBxud-0004L6-0n
for dave@doctor.nl2k.ab.ca;
Sun, 01 Jan 2023 05:58:03 -0700
Resent-From: The Doctor
Resent-Date: Sun, 1 Jan 2023 05:58:03 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from dramatvseries.click ([185.32.183.82]:45855)
by doctor.nl2k.ab.ca with esmtp (Exim 4.96)
(envelope-from
id 1pBsrL-0000RT-2S
for root@doctor.nl2k.ab.ca;
Sun, 01 Jan 2023 00:34:29 -0700
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=dramatvseries.click;
h=Date:Sender:Message-Id:To:From:Subject:Content-Type:Mime-Version:Content-Transfer-Encoding; i=contact@dramatvseries.click;
bh=akTwZNe4qd6fOPQ9rZsn/FdDwDQ=;
b=Razr9xGrIppic1Mh+zgyExeO3rWdfhMc0j95mmaV888xcEws5F2uk2wu5n6JbjY9SGhtTGVY+EXm
1tIHhLuQ8oin1/JDjVNRvGxI2JtRMwgYi7Z/aBAyCKG5lz9Df4Nzt1a02s2niSU15RW/O6eiLvms
3WT48/RZXeKqioxnb2k=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=dramatvseries.click;
b=td5LDANNz9epD0P8Mfk9Pdj6AJdAaRvtuYvcQZmb6V+x9lnN0gbdceYw/hoUllSQgoAlbm/d+eFp
X55Oaic8K78+XjrFRIFgJZt5EvmqYpoFm1gcrdu8n3WdiwVwDQ6HXDhTI49dtBl0WCu0o9gURLLD
e2CdLaxrvUlFwezIr2Q=;
Date: Sun, 01 Jan 2023 07:31:47 +0000
Sender: contact@dramatvseries.click
Message-Id: <951810788267102.7.KJF3921177666@dramatvseries.click>
To: root@doctor.nl2k.ab.ca
From: "..Netflix.."
Subject: Krijg nu gratis Netflix toegang voor drie jaar!
Content-Type: text/html; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
X-Spam_score: 16.6
X-Spam_score_int: 166
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hi root! Gefeliciteerd! Jij bent een van de kanshebbers om
gratis Netflix toegang te krijgen voor drie jaar! Mogelijke winnaar: root@doctor.nl2k.ab.ca
>> Kijk snel of jij de geluksvogel bent! Zoals je wel weet hebben wij elke
week nieuwe acties bij HappyBox. Aangezien Netflix razendpopulair is in Nederland
en wij continue door onze 600.000 leden gevraagd worden naar een Netflix
actie is he [...]
Content analysis details: (16.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: dramatvseries.click]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL
blocklist
[URIs: dramatvseries.click]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URIs: dramatvseries.click]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[185.32.183.82 listed in bb.barracudacentral.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 T_PDS_OTHER_BAD_TLD Untrustworthy TLDs
[URI: dramatvseries.click (click)]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.1 TW_IJ BODY: Odd Letter Triples with IJ
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
0.5 FROM_SUSPICIOUS_NTLD From abused NTLD
3.1 HTML_TAG_BALANCE_CENTER Malformatted HTML
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 HOSTED_IMG_MULTI_PUB_01 Multiple hosted images at public site
0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX
Subject: {SPAM?} Krijg nu gratis Netflix toegang voor drie jaar!
|
click here to remove your self from our emails list
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments