CRA Phish from Lansing Michigan
Posted by Dave Yadallee onEnvelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 10 Jul 2023 15:04:05 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from
id 1qIy2y-000EnU-0O
for dave@doctor.nl2k.ab.ca;
Mon, 10 Jul 2023 15:03:52 -0600
Resent-From: The Doctor
Resent-Date: Mon, 10 Jul 2023 15:03:52 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [67.227.204.26] (port=42637 helo=server80.a2zcreatorz.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96 (FreeBSD))
(envelope-from
id 1qIxGL-0002TS-0X
for sales@nk.ca;
Mon, 10 Jul 2023 14:13:40 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=alburhangoods.com; s=default; h=Content-Type:MIME-Version:Date:Subject:From
:Message-ID:Sender:Reply-To:To:Cc:Content-Transfer-Encoding:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=RxojVybV1RrxWoWuPR2VEhrN+Ed4u067BozEofVbW6M=; b=aw/nf3pZEp2y3o/NDzJwV64y27
0cNAaPRizD3XcYr6qC8VhIhDhy1RQaTDDPa7DHxIA0sYMPvytt/24wjgtHdnxfkYrxjuodMGqi9Mm
cfGiSDIJoeEM/wAFZIuWWPcNdtvQgycOu7mMH5tptn8uO87agq5Lspje7M7lgh9eKCz+zbu3LSNHl
ztdgQDPQ+bHRmYyOTq277uZdfMwoH+z6ocH0RSTPTkIPd7L0kFbpSpUsxctwmXyBJuuZ5+2B9VeB8
u1vxytLajT+EcaRJjlYZfChxDXKcN7LTOgbq4KeMjXvHODdAIWbDLkABwJDJVht5UAxhsyvWAH67A
RudAyRsw==;
Received: from pool-108-29-89-85.nycmny.fios.verizon.net ([108.29.89.85]:38886 helo=windows-dtx-16g.domain)
by server80.a2zcreatorz.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from
id 1qIxEX-001m64-19;
Tue, 11 Jul 2023 01:11:45 +0500
Message-ID: <55fbdd559ace7d5c7fcdcf1d0c1c8d3b@alburhangoods.com>
From: =?utf-8?B?Q2FuYWRhIFJldmVudWUgQWdlbmN5IC8gTm91dmVhdSBjb3Vy?=
=?utf-8?B?cmllciBkZSBsJ0FnZW5jZSBkdSByZXZlbnUgZHUgQ2FuYWRh?=
Subject: =?utf-8?B?TmV3IG1haWwgZnJvbSB0aGUgQ2FuYWRhIFJldmVudWUgQWdl?=
=?utf-8?B?bmN5IC8gTm91dmVhdSBjb3VycmllciBkZSBsJ0FnZW5jZSBk?=
=?utf-8?B?dSByZXZlbnUgZHUgQ2FuYWRh?=
Date: Mon, 10 Jul 2023 21:11:26 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="8273aac0f4df8a68f39a987100090590"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server80.a2zcreatorz.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - alburhangoods.com
X-Get-Message-Sender-Via: server80.a2zcreatorz.com: authenticated_id: backup@alburhangoods.com
X-Authenticated-Sender: server80.a2zcreatorz.com: backup@alburhangoods.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 10.5
X-Spam_score_int: 105
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: English version ** La version française suit ***The Canada
Revenue Agency (CRA) sent you new mail online called:OTB noticeThis mail
may require your attention. If you have My Account, sign-in and cl [...]
Content analysis details: (10.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
1.2 MISSING_HEADERS Missing To: header
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[67.227.204.26 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
2.7 URI_WPADMIN WordPress login/admin URI, possible phishing
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
Subject: {SPAM?} =?utf-8?B?TmV3IG1haWwgZnJvbSB0aGUgQ2FuYWRhIFJldmVudWUgQWdl?=
=?utf-8?B?bmN5IC8gTm91dmVhdSBjb3VycmllciBkZSBsJ0FnZW5jZSBk?=
=?utf-8?B?dSByZXZlbnUgZHUgQ2FuYWRh?=
This is a multi-part message in MIME format.
--8273aac0f4df8a68f39a987100090590
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
English version=C2=A0** La version fran=C3=A7aise suit ***The Canada =
Revenue Agency (CRA) sent you new mail online called:OTB noticeThis mail =
may require your attention.=C2=A0If you have My Account, sign-in and click =
on "Mail" to read your mail.View Document Here=C2=A0If you signed up to =
receive mail online but don't have My Account, go to the=C2=A0CRA=C2=A0web =
page to register.This is an automated email message. Please do not =
reply.Version fran=C3=A7aise=C2=A0** The English version precedes =
***L'Agence du revenu du Canada (ARC) vous a envoy=C3=A9 du nouveau =
courrier en ligne intitul=C3=A9 :Avis de la PTOCe courrier peut =
n=C3=A9cessiter votre attention.=C2=A0Si vous =C3=AAtes inscrit =C3=A0 Mon =
dossier, ouvrez une session et cliquez sur =C2=AB Courrier =C2=BB pour =
lire votre courrier.View Document Here=C2=A0Si vous vous =C3=AAtes inscrit =
pour recevoir votre courrier en ligne, mais n'=C3=AAtes pas inscrit =C3=A0 =
Mon dossier, allez =C3=A0 la page Web de l'ARC pour vous y inscrire.Ceci =
est un message =C3=A9lectronique automatis=C3=A9. Veuillez ne pas y =
r=C3=A9pondre=2E
--8273aac0f4df8a68f39a987100090590
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
"http://www.w3.org/TR/REC-html40/loose.dtd">
La version =English version=C2=A0**
fran=C3=A7aise suit ***
The Canada Revenue Agency (CRA) sent =
you new mail online called:
OTB notice
This mail may require =
your attention.
=C2=A0
If you have My Account, sign-in and click =
on "Mail" to read your mail.
href=3D"https://playthirdstrike.today/wp-admin/adobe/BE/" rel=3D"nofollow =
noopener noreferrer" target=3D"_blank">View Document =
Here
=C2=A0
If you signed up to receive =
mail online but don't have My Account, go to the=C2=A0CRA=C2=A0web page to =
register.
This is an automated email message. Please do not =
reply.
Version fran=C3=A7aise=C2=A0*** The English version precedes =
***
L'Agence du revenu du Canada (ARC) vous a envoy=C3=A9 du =
nouveau courrier en ligne intitul=C3=A9 :
Avis de la PTO
Ce =
courrier peut n=C3=A9cessiter votre attention.
=C2=A0
Si vous =
=C3=AAtes inscrit =C3=A0 Mon dossier, ouvrez une session et cliquez sur =
=C2=AB Courrier =C2=BB pour lire votre courrier.
href=3D"https://playthirdstrike.today/wp-admin/adobe/BE/" rel=3D"nofollow =
noopener noreferrer" target=3D"_blank">View Document =
Here
=C2=A0
Si vous vous =C3=AAtes =
inscrit pour recevoir votre courrier en ligne, mais n'=C3=AAtes pas =
inscrit =C3=A0 Mon dossier, allez =C3=A0 la page Web de l'ARC pour vous y =
inscrire.
Ceci est un message =C3=A9lectronique automatis=C3=A9. =
Veuillez ne pas y r=C3=A9pondre.
--8273aac0f4df8a68f39a987100090590--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments