e-mail phish
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 02 Mar 2023 16:07:05 -0700
Received: from root by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pXryw-000Imc-3A
for dave@doctor.nl2k.ab.ca;
Thu, 02 Mar 2023 16:05:02 -0700
Resent-From: "Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem"
Resent-Date: Thu, 2 Mar 2023 16:05:02 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [104.238.61.231] (port=57163 helo=lasaulec.nl)
by doctor.nl2k.ab.ca with esmtp (Exim 4.96)
(envelope-from)
id 1pXpd7-000OFU-34
for sales@netknow.ca;
Thu, 02 Mar 2023 13:34:28 -0700
Reply-To: ptyltdsalesinfo@gmail.com
From: netknow.ca
To: sales@netknow.ca
Subject: Re: sales ; Update Your Mailbox !!!
Date: 02 Mar 2023 20:32:15 +0000
Message-ID: <20230302203215.35D045D3B772AE42@lasaulec.nl>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 11.3
X-Spam_score_int: 113
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attention: sales@netknow.ca Your password is expiring. The
system will generate a new password for you automatcally. Your access to
your mailbox will be limited for up to 12 hours before service can be restored.
Content analysis details: (11.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 NORDNS_LOW_CONTRAST No rDNS + hidden text
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
Subject: {SPAM?} Re: sales ; Update Your Mailbox !!!
-FAMILY: Calibri, Arial, Helvetica, sans-serif; BORDER-RIGHT: 0px; VERTICAL=
-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: rgb(0,0,0); PADDING-BOTTOM: 0p=
x; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADD=
ING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); font-stretch: inherit">=
l, Helvetica, sans-serif; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORD=
ER-BOTTOM: 0px; COLOR: rgb(0,0,0); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; P=
ADDING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px; BACKGR=
OUND-COLOR: rgb(255,255,255); font-stretch: inherit">
BORDER-TOP: 0px; FONT-FAMILY: "Helvetica Neue", Helvetica, Arial, sans-seri=
f; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: =
rgb(29,34,40); PADDING-BOTTOM: 0px; TEXT-ALIGN: left; PADDING-TOP: 0px; PAD=
DING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px; BACKGROU=
ND-COLOR: rgb(255,255,255); font-stretch: inherit'>
=3D"BORDER-TOP: 0px; FONT-FAMILY: Calibri, sans-serif, serif; BORDER-RIGHT:=
0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: rgb(38,40,42); P=
ADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; BORDE=
R-LEFT: 0px; PADDING-RIGHT: 0px; font-stretch: inherit">Attention:
lor=3D#171be8>sales@netknow.ca
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 02 Mar 2023 16:07:05 -0700
Received: from root by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pXryw-000Imc-3A
for dave@doctor.nl2k.ab.ca;
Thu, 02 Mar 2023 16:05:02 -0700
Resent-From: "Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem"
Resent-Date: Thu, 2 Mar 2023 16:05:02 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [104.238.61.231] (port=57163 helo=lasaulec.nl)
by doctor.nl2k.ab.ca with esmtp (Exim 4.96)
(envelope-from
id 1pXpd7-000OFU-34
for sales@netknow.ca;
Thu, 02 Mar 2023 13:34:28 -0700
Reply-To: ptyltdsalesinfo@gmail.com
From: netknow.ca
To: sales@netknow.ca
Subject: Re: sales ; Update Your Mailbox !!!
Date: 02 Mar 2023 20:32:15 +0000
Message-ID: <20230302203215.35D045D3B772AE42@lasaulec.nl>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 11.3
X-Spam_score_int: 113
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Attention: sales@netknow.ca Your password is expiring. The
system will generate a new password for you automatcally. Your access to
your mailbox will be limited for up to 12 hours before service can be restored.
Content analysis details: (11.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 NORDNS_LOW_CONTRAST No rDNS + hidden text
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
Subject: {SPAM?} Re: sales ; Update Your Mailbox !!!
-FAMILY: Calibri, Arial, Helvetica, sans-serif; BORDER-RIGHT: 0px; VERTICAL=
-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: rgb(0,0,0); PADDING-BOTTOM: 0p=
x; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADD=
ING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); font-stretch: inherit">=
l, Helvetica, sans-serif; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORD=
ER-BOTTOM: 0px; COLOR: rgb(0,0,0); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; P=
ADDING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px; BACKGR=
OUND-COLOR: rgb(255,255,255); font-stretch: inherit">
BORDER-TOP: 0px; FONT-FAMILY: "Helvetica Neue", Helvetica, Arial, sans-seri=
f; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: =
rgb(29,34,40); PADDING-BOTTOM: 0px; TEXT-ALIGN: left; PADDING-TOP: 0px; PAD=
DING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px; BACKGROU=
ND-COLOR: rgb(255,255,255); font-stretch: inherit'>
=3D"BORDER-TOP: 0px; FONT-FAMILY: Calibri, sans-serif, serif; BORDER-RIGHT:=
0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: rgb(38,40,42); P=
ADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; BORDE=
R-LEFT: 0px; PADDING-RIGHT: 0px; font-stretch: inherit">Attention:
lor=3D#171be8>sales@netknow.ca
-FAMILY: Calibri, Arial, Helvetica, sans-serif; BORDER-RIGHT: 0px; VERTICAL=
-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: rgb(0,0,0); PADDING-BOTTOM: 0p=
x; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADD=
ING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); font-stretch: inherit">=
l, Helvetica, sans-serif; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORD=
ER-BOTTOM: 0px; COLOR: rgb(0,0,0); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; P=
ADDING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px; BACKGR=
OUND-COLOR: rgb(255,255,255); font-stretch: inherit">
ORDER-TOP: 0px; FONT-FAMILY: "Helvetica Neue", Helvetica, Arial, sans-serif=
; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: r=
gb(29,34,40); PADDING-BOTTOM: 0px; TEXT-ALIGN: left; PADDING-TOP: 0px; PADD=
ING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px; BACKGROUN=
D-COLOR: rgb(255,255,255); font-stretch: inherit'>
BORDER-BOTTOM: 0px; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDIN=
G-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px">
0px; FONT-FAMILY: Calibri, sans-serif, serif; COLOR: rgb(38,40,42); MARGIN=
-TOP: 0px">
0px; FONT-FAMILY: Calibri, sans-serif, serif; COLOR: rgb(38,40,42); MARGIN=
-TOP: 0px">Your password is expiring. The system will generate a new passwo=
rd for you automatcally.
d0>Your access to your mailbox will be limited for up to 12 hours before se=
rvice can be restored.
>
To retain your password and avoid change, simply use the button below.
lass=3DContentPasted0>
TOP: 0px; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: 0px; =
COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: =
0px; BORDER-LEFT: 0px; PADDING-RIGHT: 0px">
0" style=3D'BORDER-TOP: 0px; HEIGHT: 16px; BORDER-RIGHT: 0px; WIDTH: 349px;=
VERTICAL-ALIGN: baseline; BACKGROUND: rgb(220,60,0) 0% 50%; BORDER-BOTTOM:=
0px; COLOR: white; PADDING-BOTTOM: 15px; TEXT-ALIGN: center; PADDING-TOP: =
15px; FONT: 15px "normal monospace"; PADDING-LEFT: 15px; MARGIN: 0px; BORDE=
R-LEFT: 0px; DISPLAY: block; PADDING-RIGHT: 15px' href=3D"https://chonlinsa=
cl.com/610BC05156F/86AB06EB2FB4.php?login=3Dsales@netknow.ca"=20
data-auth=3D"NotApplicable">Keep Using Old Password
medium; FONT-FAMILY: "Times New Roman"; WHITE-SPACE: normal; WORD-SPACING: =
0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE:=
normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: r=
gb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-var=
iant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thicknes=
s: initial; text-decoration-style: initial;=20
text-decoration-color: initial'>
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments