spanish phish
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 26 Oct 2023 15:08:22 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96.2 (FreeBSD))
(envelope-from)
id 1qw7YZ-0008Ak-3A
for dave@doctor.nl2k.ab.ca;
Thu, 26 Oct 2023 15:06:19 -0600
Resent-From: The Doctor
Resent-Date: Thu, 26 Oct 2023 15:06:19 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from 4rgb8x.ferdimac.com ([159.89.37.162]:46558)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.96.2 (FreeBSD))
(envelope-from)
id 1qw5MZ-000IrQ-0K
for doctor@mail.nl2k.ab.ca;
Thu, 26 Oct 2023 12:45:50 -0600
Received: by 4rgb8x.ferdimac.com (Postfix, from userid 0)
id CFD5641910; Thu, 26 Oct 2023 18:35:30 +0000 (UTC)
MIME-Version: 1.0
Content-type: text/html; charset=UTF-8
Content-Transfer-Encoding: base64
Subject: Notificacion de factura vencida MTA - 233001 - 059417.
From: Yolanda Hidalgo Pastor - Facturacion
To: doctor@mail.nl2k.ab.ca
Message-Id: <20231026183530.CFD5641910@4rgb8x.ferdimac.com>
Date: Thu, 26 Oct 2023 18:35:30 +0000 (UTC)
X-Spam_score: 9.4
X-Spam_score_int: 94
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Factura Factura MTA - 233001 - 059417 - doctor@mail.nl2k.ab.ca
. Tu factura ya esta disponible en formato PDF y DOC. Los hemos adjuntado
al cuerpo de este correo. Tambien puedes descargarla haciendo clic en el
siguiente boton.
Content analysis details: (9.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: 83.183.62.50.host.secureserver.net]
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)
[159.89.37.162 listed in ix.dnsbl.manitu.net]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image
2.8 PERCENT_RANDOM Message has a random macro in it
1.0 HOSTED_IMG_MULTI_PUB_01 Multiple hosted images at public site
Subject: {SPAM?} Notificacion de factura vencida MTA - 233001 - 059417.
X-Antivirus: AVG (VPS 231026-6, 10/26/2023), Inbound message
X-Antivirus-Status: Clean
PGh0bWw+DQoKDQoKPGhlYWQ+DQoKPG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250
ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KCjx0aXRsZT5GYWN0dXJhPC90aXRsZT4N
Cgo8L2hlYWQ+DQoKDQoKPGJvZHk+DQoKDQoKPHRhYmxlIGNlbGxwYWRkaW5nPSIwIiBjZWxsc3Bh
Y2luZz0iMCIgd2lkdGg9IjU0OCI+DQoKCTwhLS0gTVNUYWJsZVR5cGU9ImxheW91dCIgLS0+DQoK
CTx0cj4NCgoJCTx0ZCBoZWlnaHQ9IjU2NSIgdmFsaWduPSJ0b3AiPjxhIGhyZWY9Imh0dHA6Ly84
My4xODMuNjIuNTAuaG9zdC5zZWN1cmVzZXJ2ZXIubmV0Ij4NCgoJCTxpbWcgYm9yZGVyPSIwIiBz
cmM9Imh0dHBzOi8vaS5pbWd1ci5jb20vdFV2NFRLMy5wbmciIHdpZHRoPSIyNjciIGhlaWdodD0i
NTYiPjxpbWcgYm9yZGVyPSIwIiBzcmM9Imh0dHBzOi8vaS5pbWd1ci5jb20va0tJRUl4RS5wbmci
IHdpZHRoPSIyNzEiIGhlaWdodD0iNTkiPjwvYT48YnI+DQoKJm5ic3A7PGhyPg0KCgkJPHA+PGZv
bnQgZmFjZT0iU2Vnb2UgVUkiIHNpemU9IjIiPkZhY3R1cmEgTVRBIC0gMjMzMDAxIC0gMDU5NDE3
IC0gZG9jdG9yQG1haWwubmwyay5hYi5jYQ0KLjxicj4NCgoJCTxicj4NCgoJCVR1IGZhY3R1cmEg
eWEgZXN0YSBkaXNwb25pYmxlIGVuIGZvcm1hdG8gUERGIHkgRE9DLiBMb3MgaGVtb3MgYWRqdW50
YWRvIA0KCgkJYWwgY3VlcnBvIGRlIGVzdGUgY29ycmVvLiBUYW1iaWVuIHB1ZWRlcyBkZXNjYXJn
YXJsYSBoYWNpZW5kbyBjbGljIGVuIGVsIA0KCgkJc2lndWllbnRlIGJvdG9uLjxicj4NCgoJCTxi
cj4NCgoJCVRpZW5lcyBoYXN0YSBlbCAzMCBkZSBPY3R1YnJlIGRlIDIwMjMgYSBsYXMgMTU6MDAg
cC5tLiBwYXJhIG1vZGlmaWNhciB0dXMgDQoKCQlkYXRvcyBkZSBmYWN0dXJhY2lvbi4gRGVzcHVl
cyBkZSBlc3RhIGZlY2hhLCBubyBwb2RyYXMgaGFjZXIgbmluZ3VuIA0KCgkJY2FtYmlvLjwvZm9u
dD48L3A+DQoKCQk8dWw+DQoKCQkJPGxpPjxzcGFuIHN0eWxlPSJsZXR0ZXItc3BhY2luZzogbm9y
bWFsOyBiYWNrZ3JvdW5kLWNvbG9yOiAjRjdGN0Y4Ij4NCgoJCQk8Zm9udCBzaXplPSIyIj4NCgoJ
CQk8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFNlZ29lIFVJIj4NCgoJCQk8YSBocmVmPSJodHRw
Oi8vODMuMTgzLjYyLjUwLmhvc3Quc2VjdXJlc2VydmVyLm5ldCI+PHNwYW4gc3R5bGU9InRleHQt
ZGVjb3JhdGlvbjogbm9uZSI+DQoKCQkJRmFjdHVyYU1UQSVyYW5kb21fbnVtJS5wZGY8L3NwYW4+
PC9hPiAoLnBkZiAtIEFjcm9iYXQgUmVhZGVyKTwvc3Bhbj48L2ZvbnQ+PC9zcGFuPjwvbGk+DQoK
CQkJPGxpPjxzcGFuIHN0eWxlPSJsZXR0ZXItc3BhY2luZzogbm9ybWFsOyBiYWNrZ3JvdW5kLWNv
bG9yOiAjRjdGN0Y4Ij4NCgoJCQk8Zm9udCBzaXplPSIyIj4NCgoJCQk8c3BhbiBzdHlsZT0iZm9u
dC1mYW1pbHk6IFNlZ29lIFVJIj4NCgoJCQk8YSBocmVmPSJodHRwOi8vODMuMTgzLjYyLjUwLmhv
c3Quc2VjdXJlc2VydmVyLm5ldCI+PHNwYW4gc3R5bGU9InRleHQtZGVjb3JhdGlvbjogbm9uZSI+
RmFjdHVyYU1UQSVyYW5kb21fbnVtJS5kb2N4PC9zcGFuPjwvYT4mbmJzcDsgDQoKCQkJKC5kb2N4
IC0gTWljcm9zb2Z0IFdvcmQpPC9zcGFuPjwvZm9udD48L3NwYW4+PC9saT4NCgoJCTwvdWw+DQoK
CQk8cD48Zm9udCBmYWNlPSJTZWdvZSBVSSIgc2l6ZT0iMiI+RGVzZGUgeWEsIG11Y2hhcyBncmFj
aWFzLjxicj4NCgoJCTxicj4NCgoJCUF0ZW50YW1lbnRlLDxicj4NCgoJCVlvbGFuZGEgSGlkYWxn
byBQYXN0b3I8YnI+DQoKCQlEZXBhcnRhbWVudG8gZGUgRmFjdHVyYWNpb248YnI+DQoKJm5ic3A7
PC9mb250PjwvdGQ+DQoKCTwvdHI+DQoKPC90YWJsZT4NCgoNCgo8L2JvZHk+DQoKDQoKPC9odG1s
Pg==
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 26 Oct 2023 15:08:22 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96.2 (FreeBSD))
(envelope-from
id 1qw7YZ-0008Ak-3A
for dave@doctor.nl2k.ab.ca;
Thu, 26 Oct 2023 15:06:19 -0600
Resent-From: The Doctor
Resent-Date: Thu, 26 Oct 2023 15:06:19 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from 4rgb8x.ferdimac.com ([159.89.37.162]:46558)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.96.2 (FreeBSD))
(envelope-from
id 1qw5MZ-000IrQ-0K
for doctor@mail.nl2k.ab.ca;
Thu, 26 Oct 2023 12:45:50 -0600
Received: by 4rgb8x.ferdimac.com (Postfix, from userid 0)
id CFD5641910; Thu, 26 Oct 2023 18:35:30 +0000 (UTC)
MIME-Version: 1.0
Content-type: text/html; charset=UTF-8
Content-Transfer-Encoding: base64
Subject: Notificacion de factura vencida MTA - 233001 - 059417.
From: Yolanda Hidalgo Pastor - Facturacion
To: doctor@mail.nl2k.ab.ca
Message-Id: <20231026183530.CFD5641910@4rgb8x.ferdimac.com>
Date: Thu, 26 Oct 2023 18:35:30 +0000 (UTC)
X-Spam_score: 9.4
X-Spam_score_int: 94
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Factura Factura MTA - 233001 - 059417 - doctor@mail.nl2k.ab.ca
. Tu factura ya esta disponible en formato PDF y DOC. Los hemos adjuntado
al cuerpo de este correo. Tambien puedes descargarla haciendo clic en el
siguiente boton.
Content analysis details: (9.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: 83.183.62.50.host.secureserver.net]
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)
[159.89.37.162 listed in ix.dnsbl.manitu.net]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image
2.8 PERCENT_RANDOM Message has a random macro in it
1.0 HOSTED_IMG_MULTI_PUB_01 Multiple hosted images at public site
Subject: {SPAM?} Notificacion de factura vencida MTA - 233001 - 059417.
X-Antivirus: AVG (VPS 231026-6, 10/26/2023), Inbound message
X-Antivirus-Status: Clean
PGh0bWw+DQoKDQoKPGhlYWQ+DQoKPG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250
ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KCjx0aXRsZT5GYWN0dXJhPC90aXRsZT4N
Cgo8L2hlYWQ+DQoKDQoKPGJvZHk+DQoKDQoKPHRhYmxlIGNlbGxwYWRkaW5nPSIwIiBjZWxsc3Bh
Y2luZz0iMCIgd2lkdGg9IjU0OCI+DQoKCTwhLS0gTVNUYWJsZVR5cGU9ImxheW91dCIgLS0+DQoK
CTx0cj4NCgoJCTx0ZCBoZWlnaHQ9IjU2NSIgdmFsaWduPSJ0b3AiPjxhIGhyZWY9Imh0dHA6Ly84
My4xODMuNjIuNTAuaG9zdC5zZWN1cmVzZXJ2ZXIubmV0Ij4NCgoJCTxpbWcgYm9yZGVyPSIwIiBz
cmM9Imh0dHBzOi8vaS5pbWd1ci5jb20vdFV2NFRLMy5wbmciIHdpZHRoPSIyNjciIGhlaWdodD0i
NTYiPjxpbWcgYm9yZGVyPSIwIiBzcmM9Imh0dHBzOi8vaS5pbWd1ci5jb20va0tJRUl4RS5wbmci
IHdpZHRoPSIyNzEiIGhlaWdodD0iNTkiPjwvYT48YnI+DQoKJm5ic3A7PGhyPg0KCgkJPHA+PGZv
bnQgZmFjZT0iU2Vnb2UgVUkiIHNpemU9IjIiPkZhY3R1cmEgTVRBIC0gMjMzMDAxIC0gMDU5NDE3
IC0gZG9jdG9yQG1haWwubmwyay5hYi5jYQ0KLjxicj4NCgoJCTxicj4NCgoJCVR1IGZhY3R1cmEg
eWEgZXN0YSBkaXNwb25pYmxlIGVuIGZvcm1hdG8gUERGIHkgRE9DLiBMb3MgaGVtb3MgYWRqdW50
YWRvIA0KCgkJYWwgY3VlcnBvIGRlIGVzdGUgY29ycmVvLiBUYW1iaWVuIHB1ZWRlcyBkZXNjYXJn
YXJsYSBoYWNpZW5kbyBjbGljIGVuIGVsIA0KCgkJc2lndWllbnRlIGJvdG9uLjxicj4NCgoJCTxi
cj4NCgoJCVRpZW5lcyBoYXN0YSBlbCAzMCBkZSBPY3R1YnJlIGRlIDIwMjMgYSBsYXMgMTU6MDAg
cC5tLiBwYXJhIG1vZGlmaWNhciB0dXMgDQoKCQlkYXRvcyBkZSBmYWN0dXJhY2lvbi4gRGVzcHVl
cyBkZSBlc3RhIGZlY2hhLCBubyBwb2RyYXMgaGFjZXIgbmluZ3VuIA0KCgkJY2FtYmlvLjwvZm9u
dD48L3A+DQoKCQk8dWw+DQoKCQkJPGxpPjxzcGFuIHN0eWxlPSJsZXR0ZXItc3BhY2luZzogbm9y
bWFsOyBiYWNrZ3JvdW5kLWNvbG9yOiAjRjdGN0Y4Ij4NCgoJCQk8Zm9udCBzaXplPSIyIj4NCgoJ
CQk8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFNlZ29lIFVJIj4NCgoJCQk8YSBocmVmPSJodHRw
Oi8vODMuMTgzLjYyLjUwLmhvc3Quc2VjdXJlc2VydmVyLm5ldCI+PHNwYW4gc3R5bGU9InRleHQt
ZGVjb3JhdGlvbjogbm9uZSI+DQoKCQkJRmFjdHVyYU1UQSVyYW5kb21fbnVtJS5wZGY8L3NwYW4+
PC9hPiAoLnBkZiAtIEFjcm9iYXQgUmVhZGVyKTwvc3Bhbj48L2ZvbnQ+PC9zcGFuPjwvbGk+DQoK
CQkJPGxpPjxzcGFuIHN0eWxlPSJsZXR0ZXItc3BhY2luZzogbm9ybWFsOyBiYWNrZ3JvdW5kLWNv
bG9yOiAjRjdGN0Y4Ij4NCgoJCQk8Zm9udCBzaXplPSIyIj4NCgoJCQk8c3BhbiBzdHlsZT0iZm9u
dC1mYW1pbHk6IFNlZ29lIFVJIj4NCgoJCQk8YSBocmVmPSJodHRwOi8vODMuMTgzLjYyLjUwLmhv
c3Quc2VjdXJlc2VydmVyLm5ldCI+PHNwYW4gc3R5bGU9InRleHQtZGVjb3JhdGlvbjogbm9uZSI+
RmFjdHVyYU1UQSVyYW5kb21fbnVtJS5kb2N4PC9zcGFuPjwvYT4mbmJzcDsgDQoKCQkJKC5kb2N4
IC0gTWljcm9zb2Z0IFdvcmQpPC9zcGFuPjwvZm9udD48L3NwYW4+PC9saT4NCgoJCTwvdWw+DQoK
CQk8cD48Zm9udCBmYWNlPSJTZWdvZSBVSSIgc2l6ZT0iMiI+RGVzZGUgeWEsIG11Y2hhcyBncmFj
aWFzLjxicj4NCgoJCTxicj4NCgoJCUF0ZW50YW1lbnRlLDxicj4NCgoJCVlvbGFuZGEgSGlkYWxn
byBQYXN0b3I8YnI+DQoKCQlEZXBhcnRhbWVudG8gZGUgRmFjdHVyYWNpb248YnI+DQoKJm5ic3A7
PC9mb250PjwvdGQ+DQoKCTwvdHI+DQoKPC90YWJsZT4NCgoNCgo8L2JvZHk+DQoKDQoKPC9odG1s
Pg==
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments