Phishing for nk.ca credentials from Czechia
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 12 Oct 2023 05:17:16 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96.1 (FreeBSD))
(envelope-from)
id 1qqtf4-000AQA-17
for dave@doctor.nl2k.ab.ca;
Thu, 12 Oct 2023 05:15:26 -0600
Resent-From: The Doctor
Resent-Date: Thu, 12 Oct 2023 05:15:25 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [87.236.146.97] (port=35368 helo=altech.co.jp)
by doctor.nl2k.ab.ca with esmtp (Exim 4.96.1 (FreeBSD))
id 1qqtS5-0000i3-0r
for root@nl2k.ab.ca;
Thu, 12 Oct 2023 05:02:05 -0600
Received: from 127.0.0.1 (localhost [IPv6:::1])
by altech.co.jp (Postfix) with ESMTP id B24D56CEFC2
for; Thu, 12 Oct 2023 13:27:28 +0300 (MSK)
From: nl2k.ab.ca <>
To: root@nl2k.ab.ca
Subject: nl2k.ab.ca Report: (8) incoming messages on hold
Date: 12 Oct 2023 12:27:28 +0200
Message-ID: <20231012122728.99CE98AC21BAB693@from.header.has.no.domain>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 17.0
X-Spam_score_int: 170
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear root, Please see below detail notification for user:
root@nl2k.ab.ca You have pending incoming mails that you are yet to receive
due to your Email storage limit.
Content analysis details: (17.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
2.6 FROM_NO_USER From: has no local-part before @ sign
0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
2.6 GOOG_REDIR_NORDNS Google redirect to obscure spamvertised website +
no rDNS
1.5 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain
1.5 PDS_FRNOM_TODOM_DBL_URL From Name to domain, double URL
2.7 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -
probable phishing
0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only
Subject: {SPAM?} nl2k.ab.ca Report: (8) incoming messages on hold
w3.org/TR/html4/loose.dtd">
WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: =
400; COLOR: rgb(34,34,34); FONT-STYLE: normal; PADDING-TOP: 0px; ORPHANS: 2=
; WIDOWS: 2; LETTER-SPACING: normal; BORDER-TOP-WIDTH: 0px; TEXT-INDENT: 0p=
x; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-=
stroke-width: 0px; text-decoration-thickness: initial; text-decoration-styl=
e: initial; text-decoration-color: initial">
Dear root,
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 12 Oct 2023 05:17:16 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96.1 (FreeBSD))
(envelope-from
id 1qqtf4-000AQA-17
for dave@doctor.nl2k.ab.ca;
Thu, 12 Oct 2023 05:15:26 -0600
Resent-From: The Doctor
Resent-Date: Thu, 12 Oct 2023 05:15:25 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [87.236.146.97] (port=35368 helo=altech.co.jp)
by doctor.nl2k.ab.ca with esmtp (Exim 4.96.1 (FreeBSD))
id 1qqtS5-0000i3-0r
for root@nl2k.ab.ca;
Thu, 12 Oct 2023 05:02:05 -0600
Received: from 127.0.0.1 (localhost [IPv6:::1])
by altech.co.jp (Postfix) with ESMTP id B24D56CEFC2
for
From: nl2k.ab.ca <>
To: root@nl2k.ab.ca
Subject: nl2k.ab.ca Report: (8) incoming messages on hold
Date: 12 Oct 2023 12:27:28 +0200
Message-ID: <20231012122728.99CE98AC21BAB693@from.header.has.no.domain>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 17.0
X-Spam_score_int: 170
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear root, Please see below detail notification for user:
root@nl2k.ab.ca You have pending incoming mails that you are yet to receive
due to your Email storage limit.
Content analysis details: (17.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
2.6 FROM_NO_USER From: has no local-part before @ sign
0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
2.6 GOOG_REDIR_NORDNS Google redirect to obscure spamvertised website +
no rDNS
1.5 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain
1.5 PDS_FRNOM_TODOM_DBL_URL From Name to domain, double URL
2.7 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -
probable phishing
0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only
Subject: {SPAM?} nl2k.ab.ca Report: (8) incoming messages on hold
w3.org/TR/html4/loose.dtd">
WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: =
400; COLOR: rgb(34,34,34); FONT-STYLE: normal; PADDING-TOP: 0px; ORPHANS: 2=
; WIDOWS: 2; LETTER-SPACING: normal; BORDER-TOP-WIDTH: 0px; TEXT-INDENT: 0p=
x; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-=
stroke-width: 0px; text-decoration-thickness: initial; text-decoration-styl=
e: initial; text-decoration-color: initial">
Dear root,
WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: =
400; COLOR: rgb(34,34,34); FONT-STYLE: normal; PADDING-TOP: 0px; ORPHANS: 2=
; WIDOWS: 2; LETTER-SPACING: normal; BORDER-TOP-WIDTH: 0px; TEXT-INDENT: 0p=
x; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-=
stroke-width: 0px; text-decoration-thickness: initial; text-decoration-styl=
e: initial; text-decoration-color: initial">
Pl=
ease see below detail notification for user: root@nl2k.ab.ca
PAN style=3D"COLOR: rgb(34,34,34)">
WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: =
400; COLOR: rgb(34,34,34); FONT-STYLE: normal; PADDING-TOP: 0px; ORPHANS: 2=
; WIDOWS: 2; LETTER-SPACING: normal; BORDER-TOP-WIDTH: 0px; TEXT-INDENT: 0p=
x; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-=
stroke-width: 0px; text-decoration-thickness: initial; text-decoration-styl=
e: initial; text-decoration-color: initial">
You have pending incoming mails<=
SPAN style=3D'FONT-SIZE: 14px; FONT-FAMILY: "Google Sans", Roboto, RobotoDr=
aft, Helvetica, Arial, sans-serif'>
arial, sans-serif">that you are yet to receive due to your Email storage l=
imit.
yle=3D"COLOR: rgb(51,51,51)">Kindly confirm your account ownership to resto=
re pending mails
"COLOR: rgb(17,85,204)" href=3D"https://ipfs.io/ipfs/bafybeibhmot625vf74ikb=
eevj5jaixpukziwhj5qhf5pndltn43s2ccfja#root@nl2k.ab.ca" target=3D_blank data=
-saferedirecturl=3D"https://www.google.com/url?q=3Dhttps://decorplantasfore=
stal.com/zxcvvmbmxwhusbnsdghdjdh/gitch.io/bonny-domain.html%23%5B%5B-Email-=
%5D%5D&source=3Dgmail&ust=3D1697168926750000&usg=3DAOvVaw1R1tmZ=
YDsfdegKrbndX4In">Click here to restore pending mails
>
id=3Dm_9072391539921954164m_-954534525939466856m_-1615314665089297177m_7681=
425556643058332m_7278984533180187498m_4130255867530227911m_6588792925852250=
990gmail-m_6286578718690958079gmail-m_5775851653259108687m_-618224565440037=
2058m_-4609611630993693639m_8898778379745202168m_6637459835503655701m_-5254=
624640462398058m_-3269660205026522965gmail-m_5816040796486671101gmail-ox-a9=
4df57cd1-m_-1444580359588416631m_8682589853860781162m_-6058005991876510699g=
mail-m_-4715774216657605710m_8953005389800332050m_-4
147003783405849383gma style=3D"COLOR: rgb(0,0,0)">
-serif">This notification was sent =
from nl2k.ab.ca<=
SPAN style=3D"COLOR: rgb(128,128,128)">; Don't want occasional updates abou=
t subscription preferences and friendly suggestions?
>
id=3Dm_9072391539921954164m_-954534525939466856m_-1615314665089297177m_7681=
425556643058332m_7278984533180187498m_4130255867530227911m_6588792925852250=
990gmail-m_6286578718690958079gmail-m_5775851653259108687m_-618224565440037=
2058m_-4609611630993693639m_8898778379745202168m_6637459835503655701m_-5254=
624640462398058m_-3269660205026522965gmail-m_5816040796486671101gmail-ox-a9=
4df57cd1-m_-1444580359588416631m_8682589853860781162m_-6058005991876510699g=
mail-m_-4715774216657605710m_8953005389800332050m_-4
147003783405849383gma style=3D"COLOR: rgb(0,0,0)">
(128,128,128)">
id=3Dm_9072391539921954164m_-954534525939466856m_-1615314665089297177m_7681=
425556643058332m_7278984533180187498m_4130255867530227911m_6588792925852250=
990gmail-m_6286578718690958079gmail-m_5775851653259108687m_-618224565440037=
2058m_-4609611630993693639m_8898778379745202168m_6637459835503655701m_-5254=
624640462398058m_-3269660205026522965gmail-m_5816040796486671101gmail-ox-a9=
4df57cd1-m_-1444580359588416631m_8682589853860781162m_-6058005991876510699g=
mail-m_-4715774216657605710m_8953005389800332050m_-4
147003783405849383gma style=3D"COLOR: rgb(0,0,0)">
-serif">
© 2023 nl2k.ab.ca All rights reserved.<=
/BODY>
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments