RBC Phish from Aruba Italy

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 25 Nov 2023 07:56:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1r6u3l-0000000060v-2ZPp

for dave@doctor.nl2k.ab.ca;

Sat, 25 Nov 2023 07:55:05 -0700

Resent-From: The Doctor

Resent-Date: Sat, 25 Nov 2023 07:55:05 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [195.231.39.150] (port=44953 helo=beautiful-ramanujan.195-231-39-150.plesk.page)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.97 (FreeBSD))

(envelope-from )

id 1r6u0y-00000000LGa-2ZUB

for sales@nk.ca;

Sat, 25 Nov 2023 07:52:22 -0700

Received: by beautiful-ramanujan.195-231-39-150.plesk.page (Postfix, from userid 10000)

id 92A9EA5914; Sat, 25 Nov 2023 15:49:53 +0100 (CET)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lettoflex.it;

s=default; t=1700923793;

bh=/NbQasSb04mGIs0ugqD7eJHq0gXe8madSADmZSQ9gVY=; h=To:From:Subject;

b=Xyj5yYTUom9iEDdi0xhDhlHKXhXAelQff+lpkBYPS46XsFQaUUNqZILWjzNG52uwM

VDiOW4NliU/ilN/ItiCqSvY7TC4wUW40fLCD1XUlY9fIdobLFuQGLyda/AmqjKdnT5

CPszRnEdxl/WAUwJUxnMRXBySHQJphIIHOdWAoi59vrpdWYJMeytjdCNQ083Dp6vpL

M0Z9I8tMZqyLatKvv8IqEENGfQt2+gHEgzW1odnv+ekrjnnPnnxMhjl/e2gOchG0B4

LtjDi7JhLJO4k9qiDMePKQV+4b0vtRgcXtzW2HhWdn5NH+Xw1ACDGxqs79FVPhaIRi

rnfph7RZLHGGQ==

Date: Sat, 25 Nov 2023 14:47:00 +0000

To: sales@nk.ca

From: Support

Reply-To: support@lettoflex.it

Subject: RBC Online Security Team

Message-ID: <956f65c2ecd6cee3f875fcf9c6c7191f@lettoflex.it>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="17b53d878cebb63035d98bf71258dd5a6"

Content-Transfer-Encoding: 8bit

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear customerWe have received a transaction request from

your credit card from the website Walmart with an IP address outside Canada.

For this reason, we have delayed debiting for 24 hours.what shoul [...]



Content analysis details: (7.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 NORDNS_LOW_CONTRAST No rDNS + hidden text

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

0.2 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

Subject: {SPAM?} RBC Online Security Team

X-Antivirus: AVG (VPS 231125-2, 11/25/2023), Inbound message

X-Antivirus-Status: Clean



This is a multi-part message in MIME format.



--17b53d878cebb63035d98bf71258dd5a6

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



 Dear customerWe have received a transaction request from your credit card from the website Walmart with an IP address outside Canada. For this reason, we have delayed debiting for 24 hours.what should you do?1- If the transaction is processed by you, please ignore this message and the transaction amount will be debited after 24 hours2- If the transaction is processed by another person, cancel the transaction andIf you want to remove the lock on your card, click here and follow the instructions. Verify If you didn’t make this request, Please click on the " Verify " to cancel transaction NOTE- DUE TO COVID-19 WE ARE RUNNING LOW IN EMPLOYEES SO YOU MAY FACE A LONGER WAIT TIME. Yours Truly, RBC Online Security TeamEmail OperationsRBC website, © 1995-2023Legal | Accessibility | Privacy and security | Advertising and cookies





--17b53d878cebb63035d98bf71258dd5a6

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable





ass=3D"es-content cke_show_border" style=3D"border-collapse: collapse; bord=

er-spacing: 0px; table-layout: fixed; width: 601px;">

=3D"background-color: #0051a5; width: 597px;">
adding=3D"0" cellspacing=3D"0" class=3D"es-content-body cke_show_border" st=

yle=3D"background-color: white; border-collapse: collapse; border-spacing: =

0px; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 600px;">
r>

cing=3D"0" class=3D"cke_show_border" style=3D"border-collapse: collapse; bo=

rder-spacing: 0px; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100=

%;">
>

padding=3D"0" cellspacing=3D"0" class=3D"cke_show_border" style=3D"border-c=

ollapse: collapse; border-spacing: 0px; mso-table-lspace: 0pt; mso-table-rs=

pace: 0pt; width: 100%;">

align=3D"center" cellpadding=3D"0" cellspacing=3D"0" class=3D"es-content c=

ke_show_border" style=3D"border-collapse: collapse; border-spacing: 0px; ms=

o-table-lspace: 0pt; mso-table-rspace: 0pt; table-layout: fixed; width: 100=

%;">
r" cellpadding=3D"0" cellspacing=3D"0" class=3D"es-content-body cke_show_bo=

rder" style=3D"border-collapse: collapse; border-spacing: 0px; width: 600px=

;">
>

how_border" style=3D"border-collapse: collapse; border-spacing: 0px; mso-ta=

ble-lspace: 0pt; mso-table-rspace: 0pt; width: 100%;">

=3D"vertical-align: top; width: 600px;">
g=3D"0" class=3D"cke_show_border" style=3D"border-collapse: collapse; borde=

r-spacing: 0px; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%;"=

>
3D""
ps://www.rbcroyalbank.com/dvl/v1.0/assets/images/logos/rbc-logo-shield.svg"=

src=3D"https://www.rbcroyalbank.com/dvl/v1.0/assets/images/logos/rbc-logo-=

shield.svg" style=3D"border: 0px; display: block; outline: none; width: 75p=

x;" />

); margin: 0px auto; max-width: 576px;">
" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"backgr=

ound-attachment: initial; background-clip: initial; background-image: initi=

al; background-origin: initial; background-position: initial; background-re=

peat: initial; background-size: initial; border-collapse: collapse; width: =

576px;">

font-size: 0px; padding: 0px; text-align: center; vertical-align: top;">
v class=3D"mj-column-per-100 outlook-group-fix" style=3D"direction: ltr; di=

splay: inline-block; font-size: 13px; max-width: 100%; text-align: left; ve=

rtical-align: top; width: 576px;">
lspacing=3D"0" role=3D"presentation" style=3D"border-collapse: collapse; ve=

rtical-align: top; width: 100%;">

order-collapse: collapse; font-size: 0px; padding: 0px; word-break: break-w=

ord;">

>

576px;">
=3D"0" role=3D"presentation" style=3D"background-attachment: initial; backg=

round-clip: initial; background-image: initial; background-origin: initial;=

background-position: initial; background-repeat: initial; background-size:=

initial; border-collapse: collapse; width: 576px;">
>

"border-collapse: collapse; direction: ltr; font-size: 0px; padding: 0px; t=

ext-align: center; vertical-align: top;">

tlook-group-fix" style=3D"direction: ltr; display: inline-block; font-size:=

13px; max-width: 100%; text-align: left; vertical-align: top; width: 576px=

;">
tion" style=3D"border-collapse: collapse; vertical-align: top; width: 100%;=

">

: 15px 15px 0px; word-break: break-word;">
=


1px; margin: 0px;">=C2=A0


, Helvetica, Arial, sans-serif">Dear=

=C2=A0 customer


=3D"Ubuntu, Helvetica, Arial, sans-serif">=



tu, Helvetica, Arial, sans-serif">We have =

received a transaction request from your credit card

le=3D"font-size: 14px;">=C2=A0from the website Walmart with an IP address o=

utside Canada. For this reason, we have delayed debiting for 24 hours.
n>


s-serif">what should you do?
=


serif">


tyle=3D"margin: 0px;"><=

span style=3D"font-size: 14px;">1- If the transaction is processed by you, =

please ignore this message and the transaction amount will be debited after=

24 hours


Helvetica, Arial, sans-serif">2- If the tr=

ansaction is processed by another person, cancel the transaction and
=


, sans-serif">If you want to remove the lo=

ck on your card, click here and follow the instructions.

<=

p style=3D"font-family: Ubuntu, Helvetica, Arial, sans-serif; font-size: 11=

px; margin: 0px;">=C2=A0


"border-collapse: collapse; font-size: 0px; padding: 5px 20px 0px 33px; wor=

d-break: break-word;" vertical-align=3D"middle">
ding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"line-height: 0p=

x;">

n" style=3D"background: rgb(2, 99, 183); border-collapse: collapse; border-=

radius: 7px; border: 0px solid rgb(0, 0, 0); cursor: auto;" valign=3D"middl=

e">
ground-attachment: initial; background-clip: initial; background-image: ini=

tial; background-origin: initial; background-position: initial; background-=

repeat: initial; background-size: initial; border-radius: 7px; color: white=

; display: inline-block; font-family: Ubuntu, Helvetica, Arial, sans-serif,=

Helvetica, Arial, sans-serif; font-size: 13px; line-height: 13px; margin: =

0px; padding: 9px 26px; text-decoration-line: none;" target=3D"_blank">
n face=3D"Arial, sans-serif">Verify=C2=A0
=


to; max-width: 576px;">
0" cellspacing=3D"0" role=3D"presentation" style=3D"background-attachment: =

initial; background-clip: initial; background-image: initial; background-or=

igin: initial; background-position: initial; background-repeat: initial; ba=

ckground-size: initial; border-collapse: collapse; width: 576px;">
r>

ody>

adding: 0px; text-align: center; vertical-align: top;">

umn-per-100 outlook-group-fix" style=3D"direction: ltr; display: inline-blo=

ck; font-size: 13px; max-width: 100%; text-align: left; vertical-align: top=

; width: 576px;">
le=3D"presentation" style=3D"border-collapse: collapse; vertical-align: top=

; width: 100%;">

lapse; font-size: 0px; padding: 15px; word-break: break-word;">

=3D"font-size: 11px; line-height: 1.5;">


=3D"color: #333333; font-family: arial, "helvetica neue", helvetica, sans-s=

erif; font-size: 15px;">If you didn=E2=80=99t make this request, Please cli=

ck on the "=C2=A0

ce=3D"Arial, sans-serif">Verify=C2=A0

font-family: arial, "helvetica neue", helvetica, sans-serif; font-size: 15=

px;">" to cancel transaction


ica, Arial, sans-serif; margin: 0px;">=C2=A0


untu, Helvetica, Arial, sans-serif; margin: 0px;">
al, sans-serif">NOTE- DUE TO COVID-19 WE ARE RUNNING LOW IN EMPLOYEES SO YO=

U MAY FACE A LONGER WAIT TIME.


Ubuntu, Helvetica, Arial, sans-serif; margin: 0px;">=C2=A0


ont-family: Ubuntu, Helvetica, Arial, sans-serif; margin: 0px;">
an face=3D"Arial, sans-serif" style=3D"font-size: 13px;">Yours Truly,
>


; margin: 0px;">=C2=A0


, sans-serif; margin: 0px;">
=3D"font-size: 13px;">RBC Online Security Team


=3D"font-family: Ubuntu, Helvetica, Arial, sans-serif; margin: 0px;">
g>Email Operati=

ons


to; max-width: 576px;">
0" cellspacing=3D"0" role=3D"presentation" style=3D"background-attachment: =

initial; background-clip: initial; background-image: initial; background-or=

igin: initial; background-position: initial; background-repeat: initial; ba=

ckground-size: initial; border-collapse: collapse; width: 576px;">
r>

adding: 0px; text-align: center; vertical-align: top;">

umn-per-100 outlook-group-fix" style=3D"direction: ltr; display: inline-blo=

ck; font-size: 13px; max-width: 100%; text-align: left; vertical-align: top=

; width: 576px;">
le=3D"presentation" style=3D"border-collapse: collapse; vertical-align: top=

; width: 100%;">=


ollapse; font-size: 0px; padding: 0px; word-break: break-word;">

ckground: rgb(220, 220, 220); margin: 0px auto; max-width: 576px;">
lign=3D"center" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"pr=

esentation" style=3D"background-attachment: initial; background-clip: initi=

al; background-image: initial; background-origin: initial; background-posit=

ion: initial; background-repeat: initial; background-size: initial; border-=

collapse: collapse; width: 576px;">=


collapse; direction: ltr; font-size: 0px; padding: 0px; text-align: center=

; vertical-align: top;">

style=3D"direction: ltr; display: inline-block; font-size: 13px; max-width:=

100%; text-align: left; vertical-align: top; width: 576px;">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"b=

order-collapse: collapse; vertical-align: top; width: 100%;">
align=3D"left" style=3D"border-collapse: collapse; padding: 0px 15px; word=

-break: break-word;">


px; text-align: center;">
34495e;">RBC website, =C2=A9 1995-2023
an>


rial, sans-serif" style=3D"color: #34495e;">
">


an face=3D"Arial, sans-serif" style=3D"color: #34495e;">
-size: 11px;">Legal | Accessibility | Privacy and security | Advertising an=

d cookies







--17b53d878cebb63035d98bf71258dd5a6--

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA