UPS phish from Portugal
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 14 Nov 2023 17:24:01 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))
(envelope-from)
id 1r33XA-00000000Afo-0UIA
for dave@doctor.nl2k.ab.ca;
Tue, 14 Nov 2023 17:13:32 -0700
Resent-From: The Doctor
Resent-Date: Tue, 14 Nov 2023 17:13:32 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mx5.newsletter.casasapo.pt ([213.13.156.166]:40282)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97 (FreeBSD))
(envelope-from)
id 1r2xpK-000000007dz-33Gv
for doctor@nk.ca;
Tue, 14 Nov 2023 11:07:58 -0700
Received: from melissa.imoguia.local (Melissa.imoguia.local [192.168.1.184])
by Sabrina1.imoguia.local (Postfix) with ESMTP id 91D0B40B19
for; Tue, 14 Nov 2023 18:05:48 +0000 (WET)
DKIM-Filter: OpenDKIM Filter v2.10.3 Sabrina1.imoguia.local 91D0B40B19
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/simple; d=egorealestate.com;
s=default; t=1699985148; bh=hHAD235hO+sIl+Uy3AQXnbHNjlA=;
h=From:Reply-To:Date:Subject;
b=srCMagOqWToIMeqlBv69l750kfSsbnrXbCuVu4yU8iE8AKmvdgF1kVmQj5ByKQcDz
pIkoYoEcG+BaUcnc1FZSDXb7Afu/Op3HDjCD4XqIRwwxL2HUyKBz5zLrGgpM7yiFGp
yhRK5BAO6oY+wBGJdDe6KH55C/QFoK19gARbwnPI=
Received: from marisa2.imoguia.local (marisa2.imoguia.local [192.168.1.194])
by melissa.imoguia.local (Postfix) with SMTP id 6D36C122C5
for; Tue, 14 Nov 2023 18:05:48 +0000 (WET)
Received: from webmail.egorealestate.com (Unknown [192.168.1.92])
by marisa2.imoguia.local with ESMTP
; Tue, 14 Nov 2023 18:05:48 +0000
Received: from Ema5 ([127.0.0.1]) by Ema5.imoguia.local with Microsoft SMTPSVC(8.5.9600.16384);
Tue, 14 Nov 2023 18:05:47 +0000
Feedback-ID: 10006:47454:3:eGO_NormalSent
MIME-Version: 1.0
From: "Support "
Reply-To: "Support "
Date: 14 Nov 2023 18:05:47 +0000
Subject: Important : Tracking Support | UPS
Content-Type: multipart/alternative;
boundary=--boundary_3638_9ff15215-ff62-4809-b649-96dc09cf4418
Message-ID:
X-OriginalArrivalTime: 14 Nov 2023 18:05:47.0421 (UTC) FILETIME=[31994CD0:01DA1725]
X-Spam: Yes
X-Spam_score: 10.2
X-Spam_score_int: 102
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:
Content analysis details: (10.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.3 EMPTY_MESSAGE Message appears to have no textual parts and no
Subject: text
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[213.13.156.166 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
1.2 MISSING_HEADERS Missing To: header
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words
1.9 REPLYTO_WITHOUT_TO_CC No description available.
0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 T_REMOTE_IMAGE Message contains an external image
Subject: {SPAM?} Important : Tracking Support | UPS
----boundary_3638_9ff15215-ff62-4809-b649-96dc09cf4418
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: base64
DQogIA0KICA=
----boundary_3638_9ff15215-ff62-4809-b649-96dc09cf4418
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: base64
PHRpdGxlPjwvdGl0bGU+DQoNCg0KPHA+PGEgaHJlZj0iaHR0cHM6Ly91cHNjYW5hZGEu
cG9kbGluay50by9ybnJURkRmZDM0NDNEU2RzMzRkc0RTP3Rva2VuPVstdG9rZW4tXSI+
PGltZyBjbGFzcz0iZnItZmljIGZyLWRpYiIgc3JjPSJodHRwczovL3d3dy5nb3V0ZXps
YXF1YWxpdGUuY29tL3dwLWNvbnRlbnQvdXBsb2Fkcy8yMDIxLzEyL3VwcHMuanBnIiBz
dHlsZT0id2lkdGg6IDU1NXB4OyBoZWlnaHQ6IDU1NXB4OyI+PC9hPjwvcD48dGFibGUg
d2lkdGg9IjEwMCUiPjx0cj48dGQ+PGEgaHJlZj0iaHR0cHM6Ly93d3cuZWdvcmVhbGVz
dGF0ZS5jb20vIiB0YXJnZXQ9Il9ibGFuayI+PGltZyBzcmM9Imh0dHBzOi8vc3RhdGlj
LmVnb3JlYWxlc3RhdGUuY29tL2Vnb2NvcmUvaW1hZ2VzL2xvZ29zL2xvZ29fbWFpbF9z
aWduYXR1cmUucG5nIiBhbHQ9Imh0dHBzOi8vd3d3LmVnb3JlYWxlc3RhdGUuY29tLyIg
b25lcnJvcj0iTGF6eU1lZGlhSGFuZGxlci5vbmVycm9yKHRoaXMpOyIgYm9yZGVyPSIw
IiAvPjwvYT48L3RkPjwvdHI+PC90YWJsZT4=
----boundary_3638_9ff15215-ff62-4809-b649-96dc09cf4418--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 14 Nov 2023 17:24:01 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))
(envelope-from
id 1r33XA-00000000Afo-0UIA
for dave@doctor.nl2k.ab.ca;
Tue, 14 Nov 2023 17:13:32 -0700
Resent-From: The Doctor
Resent-Date: Tue, 14 Nov 2023 17:13:32 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mx5.newsletter.casasapo.pt ([213.13.156.166]:40282)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97 (FreeBSD))
(envelope-from
id 1r2xpK-000000007dz-33Gv
for doctor@nk.ca;
Tue, 14 Nov 2023 11:07:58 -0700
Received: from melissa.imoguia.local (Melissa.imoguia.local [192.168.1.184])
by Sabrina1.imoguia.local (Postfix) with ESMTP id 91D0B40B19
for
DKIM-Filter: OpenDKIM Filter v2.10.3 Sabrina1.imoguia.local 91D0B40B19
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/simple; d=egorealestate.com;
s=default; t=1699985148; bh=hHAD235hO+sIl+Uy3AQXnbHNjlA=;
h=From:Reply-To:Date:Subject;
b=srCMagOqWToIMeqlBv69l750kfSsbnrXbCuVu4yU8iE8AKmvdgF1kVmQj5ByKQcDz
pIkoYoEcG+BaUcnc1FZSDXb7Afu/Op3HDjCD4XqIRwwxL2HUyKBz5zLrGgpM7yiFGp
yhRK5BAO6oY+wBGJdDe6KH55C/QFoK19gARbwnPI=
Received: from marisa2.imoguia.local (marisa2.imoguia.local [192.168.1.194])
by melissa.imoguia.local (Postfix) with SMTP id 6D36C122C5
for
Received: from webmail.egorealestate.com (Unknown [192.168.1.92])
by marisa2.imoguia.local with ESMTP
; Tue, 14 Nov 2023 18:05:48 +0000
Received: from Ema5 ([127.0.0.1]) by Ema5.imoguia.local with Microsoft SMTPSVC(8.5.9600.16384);
Tue, 14 Nov 2023 18:05:47 +0000
Feedback-ID: 10006:47454:3:eGO_NormalSent
MIME-Version: 1.0
From: "Support "
Reply-To: "Support "
Date: 14 Nov 2023 18:05:47 +0000
Subject: Important : Tracking Support | UPS
Content-Type: multipart/alternative;
boundary=--boundary_3638_9ff15215-ff62-4809-b649-96dc09cf4418
Message-ID:
X-OriginalArrivalTime: 14 Nov 2023 18:05:47.0421 (UTC) FILETIME=[31994CD0:01DA1725]
X-Spam: Yes
X-Spam_score: 10.2
X-Spam_score_int: 102
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:
Content analysis details: (10.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.3 EMPTY_MESSAGE Message appears to have no textual parts and no
Subject: text
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[213.13.156.166 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
1.2 MISSING_HEADERS Missing To: header
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words
1.9 REPLYTO_WITHOUT_TO_CC No description available.
0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 T_REMOTE_IMAGE Message contains an external image
Subject: {SPAM?} Important : Tracking Support | UPS
----boundary_3638_9ff15215-ff62-4809-b649-96dc09cf4418
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: base64
DQogIA0KICA=
----boundary_3638_9ff15215-ff62-4809-b649-96dc09cf4418
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: base64
PHRpdGxlPjwvdGl0bGU+DQoNCg0KPHA+PGEgaHJlZj0iaHR0cHM6Ly91cHNjYW5hZGEu
cG9kbGluay50by9ybnJURkRmZDM0NDNEU2RzMzRkc0RTP3Rva2VuPVstdG9rZW4tXSI+
PGltZyBjbGFzcz0iZnItZmljIGZyLWRpYiIgc3JjPSJodHRwczovL3d3dy5nb3V0ZXps
YXF1YWxpdGUuY29tL3dwLWNvbnRlbnQvdXBsb2Fkcy8yMDIxLzEyL3VwcHMuanBnIiBz
dHlsZT0id2lkdGg6IDU1NXB4OyBoZWlnaHQ6IDU1NXB4OyI+PC9hPjwvcD48dGFibGUg
d2lkdGg9IjEwMCUiPjx0cj48dGQ+PGEgaHJlZj0iaHR0cHM6Ly93d3cuZWdvcmVhbGVz
dGF0ZS5jb20vIiB0YXJnZXQ9Il9ibGFuayI+PGltZyBzcmM9Imh0dHBzOi8vc3RhdGlj
LmVnb3JlYWxlc3RhdGUuY29tL2Vnb2NvcmUvaW1hZ2VzL2xvZ29zL2xvZ29fbWFpbF9z
aWduYXR1cmUucG5nIiBhbHQ9Imh0dHBzOi8vd3d3LmVnb3JlYWxlc3RhdGUuY29tLyIg
b25lcnJvcj0iTGF6eU1lZGlhSGFuZGxlci5vbmVycm9yKHRoaXMpOyIgYm9yZGVyPSIw
IiAvPjwvYT48L3RkPjwvdHI+PC90YWJsZT4=
----boundary_3638_9ff15215-ff62-4809-b649-96dc09cf4418--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments