French Primark phish
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 06 Feb 2023 07:51:28 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pP2q5-000CVd-00
for dave@doctor.nl2k.ab.ca;
Mon, 06 Feb 2023 07:51:25 -0700
Resent-From: The Doctor
Resent-Date: Mon, 6 Feb 2023 07:51:24 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [185.91.116.197] (port=53100 helo=qvodplay.site)
by doctor.nl2k.ab.ca with esmtp (Exim 4.96)
(envelope-from)
id 1pP0xo-0001Vw-1C
for root@doctor.nl2k.ab.ca;
Mon, 06 Feb 2023 05:51:20 -0700
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=qvodplay.site;
h=Date:Sender:Message-Id:To:From:Subject:Content-Type:Mime-Version:Content-Transfer-Encoding; i=contact@qvodplay.site;
bh=/GMv6OYC4OVruE9n03b/izlCYh8=;
b=2c8Qc4/stq2DgQ1mB5GtSSIilh1STk6GVUeh58dXXCatxlspZ3scZjfMo4k9+ELNHQCZM65Ynf2C
jaAQunLb+Dmxwceum2G/c/+gfCYpcInaFTNMUpb9UibNSVhJlnJyWgAJ80gAh4ziekXCFzwREom7
WUonkZsvpinUchPPbDA=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=qvodplay.site;
b=TVoHJbaRgJXU7wzb7B6er4Rk9nMwj8++xx2oeWdyDl9bd3zFetALTXyfcwAZNofdhLidsXQWP8ht
E08tBgGQQdFsEWwaAy1bvWmhLttmi7YW9HdwqnnQkfzaDXVHM1fzFCBCvhBny04qHiGt+VUh/8DE
9uaxPvyrVpOP0WEJehU=;
Date: Mon, 06 Feb 2023 12:49:15 +0000
Sender: contact@qvodplay.site
Message-Id: <918973914474293.9.DFA2806351106@qvodplay.site>
To: root@doctor.nl2k.ab.ca
From: "Service Client"
Subject: Nous voulons vous récompenser pour votre fidélité
Content-Type: text/html; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
X-Spam_score: 21.1
X-Spam_score_int: 211
X-Spam_bar: +++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Félicitations! Félicitations! root La chance est de votre
côté ! Votre adresse électronique a été tirée au sort et sélectionée
pour participer à notre concours pour gangner un bon d'achat de 200 €
de Primark !
Content analysis details: (21.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: dramatvseries.click]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: dramatvseries.click]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: dramatvseries.click]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: dramatvseries.click]
0.0 T_PDS_OTHER_BAD_TLD Untrustworthy TLDs
[URI: qvodplay.site (site)]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[185.91.116.197 listed in bb.barracudacentral.org]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.5 FROM_SUSPICIOUS_NTLD From abused NTLD
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.3 MIME_8BIT_HEADER Message header contains 8-bit character
3.6 HTML_TAG_BALANCE_CENTER Malformatted HTML
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
Subject: {SPAM?} Nous voulons vous récompenser pour votre fidélité
Félicitations!
click here to remove your self from our emails list
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 06 Feb 2023 07:51:28 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pP2q5-000CVd-00
for dave@doctor.nl2k.ab.ca;
Mon, 06 Feb 2023 07:51:25 -0700
Resent-From: The Doctor
Resent-Date: Mon, 6 Feb 2023 07:51:24 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [185.91.116.197] (port=53100 helo=qvodplay.site)
by doctor.nl2k.ab.ca with esmtp (Exim 4.96)
(envelope-from
id 1pP0xo-0001Vw-1C
for root@doctor.nl2k.ab.ca;
Mon, 06 Feb 2023 05:51:20 -0700
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=qvodplay.site;
h=Date:Sender:Message-Id:To:From:Subject:Content-Type:Mime-Version:Content-Transfer-Encoding; i=contact@qvodplay.site;
bh=/GMv6OYC4OVruE9n03b/izlCYh8=;
b=2c8Qc4/stq2DgQ1mB5GtSSIilh1STk6GVUeh58dXXCatxlspZ3scZjfMo4k9+ELNHQCZM65Ynf2C
jaAQunLb+Dmxwceum2G/c/+gfCYpcInaFTNMUpb9UibNSVhJlnJyWgAJ80gAh4ziekXCFzwREom7
WUonkZsvpinUchPPbDA=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=qvodplay.site;
b=TVoHJbaRgJXU7wzb7B6er4Rk9nMwj8++xx2oeWdyDl9bd3zFetALTXyfcwAZNofdhLidsXQWP8ht
E08tBgGQQdFsEWwaAy1bvWmhLttmi7YW9HdwqnnQkfzaDXVHM1fzFCBCvhBny04qHiGt+VUh/8DE
9uaxPvyrVpOP0WEJehU=;
Date: Mon, 06 Feb 2023 12:49:15 +0000
Sender: contact@qvodplay.site
Message-Id: <918973914474293.9.DFA2806351106@qvodplay.site>
To: root@doctor.nl2k.ab.ca
From: "Service Client"
Subject: Nous voulons vous récompenser pour votre fidélité
Content-Type: text/html; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
X-Spam_score: 21.1
X-Spam_score_int: 211
X-Spam_bar: +++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Félicitations! Félicitations! root La chance est de votre
côté ! Votre adresse électronique a été tirée au sort et sélectionée
pour participer à notre concours pour gangner un bon d'achat de 200 €
de Primark !
Content analysis details: (21.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: dramatvseries.click]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: dramatvseries.click]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: dramatvseries.click]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: dramatvseries.click]
0.0 T_PDS_OTHER_BAD_TLD Untrustworthy TLDs
[URI: qvodplay.site (site)]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[185.91.116.197 listed in bb.barracudacentral.org]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.5 FROM_SUSPICIOUS_NTLD From abused NTLD
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.3 MIME_8BIT_HEADER Message header contains 8-bit character
3.6 HTML_TAG_BALANCE_CENTER Malformatted HTML
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
Subject: {SPAM?} Nous voulons vous récompenser pour votre fidélité
Félicitations!
root
La chance est de votre côté ! Votre adresse électronique a été tirée au sort et sélectionée pour participer à notre concours pour gangner un bon d'achat de 200 € de Primark !
Qu'est-ce que tu dois faire maintenant ? Il suffit de confirmer votre participation en cliquant sur le bouton ci-dessous.
N'attendez pas trop longtemps, le concours prendra fin dès que tous les bons d'achat auront été distribués.
Bonne chance !
Le concours s'adresse uniquement aux personnes vivant en France et âgées de plus de 18 ans.
INSERT FOOTER HERE
click here to remove your self from our emails list
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments