RBC Phish from Aruba Italy
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 25 Nov 2023 07:56:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))
(envelope-from)
id 1r6u3l-0000000060v-2ZPp
for dave@doctor.nl2k.ab.ca;
Sat, 25 Nov 2023 07:55:05 -0700
Resent-From: The Doctor
Resent-Date: Sat, 25 Nov 2023 07:55:05 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [195.231.39.150] (port=44953 helo=beautiful-ramanujan.195-231-39-150.plesk.page)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.97 (FreeBSD))
(envelope-from)
id 1r6u0y-00000000LGa-2ZUB
for sales@nk.ca;
Sat, 25 Nov 2023 07:52:22 -0700
Received: by beautiful-ramanujan.195-231-39-150.plesk.page (Postfix, from userid 10000)
id 92A9EA5914; Sat, 25 Nov 2023 15:49:53 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lettoflex.it;
s=default; t=1700923793;
bh=/NbQasSb04mGIs0ugqD7eJHq0gXe8madSADmZSQ9gVY=; h=To:From:Subject;
b=Xyj5yYTUom9iEDdi0xhDhlHKXhXAelQff+lpkBYPS46XsFQaUUNqZILWjzNG52uwM
VDiOW4NliU/ilN/ItiCqSvY7TC4wUW40fLCD1XUlY9fIdobLFuQGLyda/AmqjKdnT5
CPszRnEdxl/WAUwJUxnMRXBySHQJphIIHOdWAoi59vrpdWYJMeytjdCNQ083Dp6vpL
M0Z9I8tMZqyLatKvv8IqEENGfQt2+gHEgzW1odnv+ekrjnnPnnxMhjl/e2gOchG0B4
LtjDi7JhLJO4k9qiDMePKQV+4b0vtRgcXtzW2HhWdn5NH+Xw1ACDGxqs79FVPhaIRi
rnfph7RZLHGGQ==
Date: Sat, 25 Nov 2023 14:47:00 +0000
To: sales@nk.ca
From: Support
Reply-To: support@lettoflex.it
Subject: RBC Online Security Team
Message-ID: <956f65c2ecd6cee3f875fcf9c6c7191f@lettoflex.it>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="17b53d878cebb63035d98bf71258dd5a6"
Content-Transfer-Encoding: 8bit
X-Spam_score: 7.7
X-Spam_score_int: 77
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear customerWe have received a transaction request from
your credit card from the website Walmart with an IP address outside Canada.
For this reason, we have delayed debiting for 24 hours.what shoul [...]
Content analysis details: (7.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.5 NORDNS_LOW_CONTRAST No rDNS + hidden text
2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text
0.2 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS
Subject: {SPAM?} RBC Online Security Team
X-Antivirus: AVG (VPS 231125-2, 11/25/2023), Inbound message
X-Antivirus-Status: Clean
This is a multi-part message in MIME format.
--17b53d878cebb63035d98bf71258dd5a6
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
 Dear customerWe have received a transaction request from your credit card from the website Walmart with an IP address outside Canada. For this reason, we have delayed debiting for 24 hours.what should you do?1- If the transaction is processed by you, please ignore this message and the transaction amount will be debited after 24 hours2- If the transaction is processed by another person, cancel the transaction andIf you want to remove the lock on your card, click here and follow the instructions. Verify If you didn’t make this request, Please click on the " Verify " to cancel transaction NOTE- DUE TO COVID-19 WE ARE RUNNING LOW IN EMPLOYEES SO YOU MAY FACE A LONGER WAIT TIME. Yours Truly, RBC Online Security TeamEmail OperationsRBC website, © 1995-2023Legal | Accessibility | Privacy and security | Advertising and cookies
--17b53d878cebb63035d98bf71258dd5a6
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
ass=3D"es-content cke_show_border" style=3D"border-collapse: collapse; bord=
er-spacing: 0px; table-layout: fixed; width: 601px;">
=3D"background-color: #0051a5; width: 597px;">
adding=3D"0" cellspacing=3D"0" class=3D"es-content-body cke_show_border" st=
yle=3D"background-color: white; border-collapse: collapse; border-spacing: =
0px; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 600px;">
r>
cing=3D"0" class=3D"cke_show_border" style=3D"border-collapse: collapse; bo=
rder-spacing: 0px; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100=
%;">
padding=3D"0" cellspacing=3D"0" class=3D"cke_show_border" style=3D"border-c=
ollapse: collapse; border-spacing: 0px; mso-table-lspace: 0pt; mso-table-rs=
pace: 0pt; width: 100%;">
>
align=3D"center" cellpadding=3D"0" cellspacing=3D"0" class=3D"es-content c=
ke_show_border" style=3D"border-collapse: collapse; border-spacing: 0px; ms=
o-table-lspace: 0pt; mso-table-rspace: 0pt; table-layout: fixed; width: 100=
%;">
r" cellpadding=3D"0" cellspacing=3D"0" class=3D"es-content-body cke_show_bo=
rder" style=3D"border-collapse: collapse; border-spacing: 0px; width: 600px=
;">
how_border" style=3D"border-collapse: collapse; border-spacing: 0px; mso-ta=
ble-lspace: 0pt; mso-table-rspace: 0pt; width: 100%;">
=3D"vertical-align: top; width: 600px;">
g=3D"0" class=3D"cke_show_border" style=3D"border-collapse: collapse; borde=
r-spacing: 0px; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%;"=
>![3D""]()
ps://www.rbcroyalbank.com/dvl/v1.0/assets/images/logos/rbc-logo-shield.svg"=
src=3D"https://www.rbcroyalbank.com/dvl/v1.0/assets/images/logos/rbc-logo-=
shield.svg" style=3D"border: 0px; display: block; outline: none; width: 75p=
x;" />
>
); margin: 0px auto; max-width: 576px;">
" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"backgr=
ound-attachment: initial; background-clip: initial; background-image: initi=
al; background-origin: initial; background-position: initial; background-re=
peat: initial; background-size: initial; border-collapse: collapse; width: =
576px;">
font-size: 0px; padding: 0px; text-align: center; vertical-align: top;">
v class=3D"mj-column-per-100 outlook-group-fix" style=3D"direction: ltr; di=
splay: inline-block; font-size: 13px; max-width: 100%; text-align: left; ve=
rtical-align: top; width: 576px;">
lspacing=3D"0" role=3D"presentation" style=3D"border-collapse: collapse; ve=
rtical-align: top; width: 100%;">
order-collapse: collapse; font-size: 0px; padding: 0px; word-break: break-w=
ord;">
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 25 Nov 2023 07:56:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))
(envelope-from
id 1r6u3l-0000000060v-2ZPp
for dave@doctor.nl2k.ab.ca;
Sat, 25 Nov 2023 07:55:05 -0700
Resent-From: The Doctor
Resent-Date: Sat, 25 Nov 2023 07:55:05 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [195.231.39.150] (port=44953 helo=beautiful-ramanujan.195-231-39-150.plesk.page)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.97 (FreeBSD))
(envelope-from
id 1r6u0y-00000000LGa-2ZUB
for sales@nk.ca;
Sat, 25 Nov 2023 07:52:22 -0700
Received: by beautiful-ramanujan.195-231-39-150.plesk.page (Postfix, from userid 10000)
id 92A9EA5914; Sat, 25 Nov 2023 15:49:53 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lettoflex.it;
s=default; t=1700923793;
bh=/NbQasSb04mGIs0ugqD7eJHq0gXe8madSADmZSQ9gVY=; h=To:From:Subject;
b=Xyj5yYTUom9iEDdi0xhDhlHKXhXAelQff+lpkBYPS46XsFQaUUNqZILWjzNG52uwM
VDiOW4NliU/ilN/ItiCqSvY7TC4wUW40fLCD1XUlY9fIdobLFuQGLyda/AmqjKdnT5
CPszRnEdxl/WAUwJUxnMRXBySHQJphIIHOdWAoi59vrpdWYJMeytjdCNQ083Dp6vpL
M0Z9I8tMZqyLatKvv8IqEENGfQt2+gHEgzW1odnv+ekrjnnPnnxMhjl/e2gOchG0B4
LtjDi7JhLJO4k9qiDMePKQV+4b0vtRgcXtzW2HhWdn5NH+Xw1ACDGxqs79FVPhaIRi
rnfph7RZLHGGQ==
Date: Sat, 25 Nov 2023 14:47:00 +0000
To: sales@nk.ca
From: Support
Reply-To: support@lettoflex.it
Subject: RBC Online Security Team
Message-ID: <956f65c2ecd6cee3f875fcf9c6c7191f@lettoflex.it>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="17b53d878cebb63035d98bf71258dd5a6"
Content-Transfer-Encoding: 8bit
X-Spam_score: 7.7
X-Spam_score_int: 77
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear customerWe have received a transaction request from
your credit card from the website Walmart with an IP address outside Canada.
For this reason, we have delayed debiting for 24 hours.what shoul [...]
Content analysis details: (7.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.5 NORDNS_LOW_CONTRAST No rDNS + hidden text
2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text
0.2 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS
Subject: {SPAM?} RBC Online Security Team
X-Antivirus: AVG (VPS 231125-2, 11/25/2023), Inbound message
X-Antivirus-Status: Clean
This is a multi-part message in MIME format.
--17b53d878cebb63035d98bf71258dd5a6
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
 Dear customerWe have received a transaction request from your credit card from the website Walmart with an IP address outside Canada. For this reason, we have delayed debiting for 24 hours.what should you do?1- If the transaction is processed by you, please ignore this message and the transaction amount will be debited after 24 hours2- If the transaction is processed by another person, cancel the transaction andIf you want to remove the lock on your card, click here and follow the instructions. Verify If you didn’t make this request, Please click on the " Verify " to cancel transaction NOTE- DUE TO COVID-19 WE ARE RUNNING LOW IN EMPLOYEES SO YOU MAY FACE A LONGER WAIT TIME. Yours Truly, RBC Online Security TeamEmail OperationsRBC website, © 1995-2023Legal | Accessibility | Privacy and security | Advertising and cookies
--17b53d878cebb63035d98bf71258dd5a6
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
ass=3D"es-content cke_show_border" style=3D"border-collapse: collapse; bord=
er-spacing: 0px; table-layout: fixed; width: 601px;">
=3D"background-color: #0051a5; width: 597px;">
adding=3D"0" cellspacing=3D"0" class=3D"es-content-body cke_show_border" st=
yle=3D"background-color: white; border-collapse: collapse; border-spacing: =
0px; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 600px;">
r>
cing=3D"0" class=3D"cke_show_border" style=3D"border-collapse: collapse; bo=
rder-spacing: 0px; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100=
%;">
padding=3D"0" cellspacing=3D"0" class=3D"cke_show_border" style=3D"border-c=
ollapse: collapse; border-spacing: 0px; mso-table-lspace: 0pt; mso-table-rs=
pace: 0pt; width: 100%;">
>
align=3D"center" cellpadding=3D"0" cellspacing=3D"0" class=3D"es-content c=
ke_show_border" style=3D"border-collapse: collapse; border-spacing: 0px; ms=
o-table-lspace: 0pt; mso-table-rspace: 0pt; table-layout: fixed; width: 100=
%;">
r" cellpadding=3D"0" cellspacing=3D"0" class=3D"es-content-body cke_show_bo=
rder" style=3D"border-collapse: collapse; border-spacing: 0px; width: 600px=
;">
how_border" style=3D"border-collapse: collapse; border-spacing: 0px; mso-ta=
ble-lspace: 0pt; mso-table-rspace: 0pt; width: 100%;">
=3D"vertical-align: top; width: 600px;">
g=3D"0" class=3D"cke_show_border" style=3D"border-collapse: collapse; borde=
r-spacing: 0px; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%;"=
>
ps://www.rbcroyalbank.com/dvl/v1.0/assets/images/logos/rbc-logo-shield.svg"=
src=3D"https://www.rbcroyalbank.com/dvl/v1.0/assets/images/logos/rbc-logo-=
shield.svg" style=3D"border: 0px; display: block; outline: none; width: 75p=
x;" />
>
); margin: 0px auto; max-width: 576px;">
" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"backgr=
ound-attachment: initial; background-clip: initial; background-image: initi=
al; background-origin: initial; background-position: initial; background-re=
peat: initial; background-size: initial; border-collapse: collapse; width: =
576px;">
font-size: 0px; padding: 0px; text-align: center; vertical-align: top;">
v class=3D"mj-column-per-100 outlook-group-fix" style=3D"direction: ltr; di=
splay: inline-block; font-size: 13px; max-width: 100%; text-align: left; ve=
rtical-align: top; width: 576px;">
lspacing=3D"0" role=3D"presentation" style=3D"border-collapse: collapse; ve=
rtical-align: top; width: 100%;">
order-collapse: collapse; font-size: 0px; padding: 0px; word-break: break-w=
ord;">
>
576px;">
=3D"0" role=3D"presentation" style=3D"background-attachment: initial; backg=
round-clip: initial; background-image: initial; background-origin: initial;=
background-position: initial; background-repeat: initial; background-size:=
initial; border-collapse: collapse; width: 576px;">
"border-collapse: collapse; direction: ltr; font-size: 0px; padding: 0px; t=
ext-align: center; vertical-align: top;">
tlook-group-fix" style=3D"direction: ltr; display: inline-block; font-size:=
13px; max-width: 100%; text-align: left; vertical-align: top; width: 576px=
;">
tion" style=3D"border-collapse: collapse; vertical-align: top; width: 100%;=
">
: 15px 15px 0px; word-break: break-word;">
=
1px; margin: 0px;">=C2=A0
tyle=3D"margin: 0px;"><=
span style=3D"font-size: 14px;">1- If the transaction is processed by you, =
please ignore this message and the transaction amount will be debited after=
24 hours
p style=3D"font-family: Ubuntu, Helvetica, Arial, sans-serif; font-size: 11=
px; margin: 0px;">=C2=A0
1px; margin: 0px;">=C2=A0
, Helvetica, Arial, sans-serif">Dear=
=C2=A0 customer
=3D"Ubuntu, Helvetica, Arial, sans-serif">=
tu, Helvetica, Arial, sans-serif">We have =
received a transaction request from your credit card
le=3D"font-size: 14px;">=C2=A0from the website Walmart with an IP address o=
utside Canada. For this reason, we have delayed debiting for 24 hours.
n>
s-serif">what should you do?=
serif">
tyle=3D"margin: 0px;"><=
span style=3D"font-size: 14px;">1- If the transaction is processed by you, =
please ignore this message and the transaction amount will be debited after=
24 hours
Helvetica, Arial, sans-serif">2- If the tr=
ansaction is processed by another person, cancel the transaction and=
, sans-serif">If you want to remove the lo=
ck on your card, click here and follow the instructions.
p style=3D"font-family: Ubuntu, Helvetica, Arial, sans-serif; font-size: 11=
px; margin: 0px;">=C2=A0
"border-collapse: collapse; font-size: 0px; padding: 5px 20px 0px 33px; wor=
d-break: break-word;" vertical-align=3D"middle">
ding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"line-height: 0p=
x;">
n" style=3D"background: rgb(2, 99, 183); border-collapse: collapse; border-=
radius: 7px; border: 0px solid rgb(0, 0, 0); cursor: auto;" valign=3D"middl=
e">
ground-attachment: initial; background-clip: initial; background-image: ini=
tial; background-origin: initial; background-position: initial; background-=
repeat: initial; background-size: initial; border-radius: 7px; color: white=
; display: inline-block; font-family: Ubuntu, Helvetica, Arial, sans-serif,=
Helvetica, Arial, sans-serif; font-size: 13px; line-height: 13px; margin: =
0px; padding: 9px 26px; text-decoration-line: none;" target=3D"_blank">
n face=3D"Arial, sans-serif">Verify=C2=A0
=
>
to; max-width: 576px;">
0" cellspacing=3D"0" role=3D"presentation" style=3D"background-attachment: =
initial; background-clip: initial; background-image: initial; background-or=
igin: initial; background-position: initial; background-repeat: initial; ba=
ckground-size: initial; border-collapse: collapse; width: 576px;">
r>
adding: 0px; text-align: center; vertical-align: top;">
umn-per-100 outlook-group-fix" style=3D"direction: ltr; display: inline-blo=
ck; font-size: 13px; max-width: 100%; text-align: left; vertical-align: top=
; width: 576px;">
le=3D"presentation" style=3D"border-collapse: collapse; vertical-align: top=
; width: 100%;">
lapse; font-size: 0px; padding: 15px; word-break: break-word;">
=3D"font-size: 11px; line-height: 1.5;">
=3D"color: #333333; font-family: arial, "helvetica neue", helvetica, sans-s=
erif; font-size: 15px;">If you didn=E2=80=99t make this request, Please cli=
ck on the "=C2=A0
ce=3D"Arial, sans-serif">Verify=C2=A0
font-family: arial, "helvetica neue", helvetica, sans-serif; font-size: 15=
px;">" to cancel transaction
ica, Arial, sans-serif; margin: 0px;">=C2=A0
untu, Helvetica, Arial, sans-serif; margin: 0px;">
al, sans-serif">NOTE- DUE TO COVID-19 WE ARE RUNNING LOW IN EMPLOYEES SO YO=
U MAY FACE A LONGER WAIT TIME.
Ubuntu, Helvetica, Arial, sans-serif; margin: 0px;">=C2=A0
ont-family: Ubuntu, Helvetica, Arial, sans-serif; margin: 0px;">
an face=3D"Arial, sans-serif" style=3D"font-size: 13px;">Yours Truly,
>
; margin: 0px;">=C2=A0
, sans-serif; margin: 0px;">
=3D"font-size: 13px;">RBC Online Security Team
=3D"font-family: Ubuntu, Helvetica, Arial, sans-serif; margin: 0px;">
g>Email Operati=
ons
ody>
to; max-width: 576px;">
0" cellspacing=3D"0" role=3D"presentation" style=3D"background-attachment: =
initial; background-clip: initial; background-image: initial; background-or=
igin: initial; background-position: initial; background-repeat: initial; ba=
ckground-size: initial; border-collapse: collapse; width: 576px;">
r>
adding: 0px; text-align: center; vertical-align: top;">
umn-per-100 outlook-group-fix" style=3D"direction: ltr; display: inline-blo=
ck; font-size: 13px; max-width: 100%; text-align: left; vertical-align: top=
; width: 576px;">
le=3D"presentation" style=3D"border-collapse: collapse; vertical-align: top=
; width: 100%;">
ollapse; font-size: 0px; padding: 0px; word-break: break-word;">
=
ckground: rgb(220, 220, 220); margin: 0px auto; max-width: 576px;">
lign=3D"center" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"pr=
esentation" style=3D"background-attachment: initial; background-clip: initi=
al; background-image: initial; background-origin: initial; background-posit=
ion: initial; background-repeat: initial; background-size: initial; border-=
collapse: collapse; width: 576px;">
collapse; direction: ltr; font-size: 0px; padding: 0px; text-align: center=
; vertical-align: top;">
style=3D"direction: ltr; display: inline-block; font-size: 13px; max-width:=
100%; text-align: left; vertical-align: top; width: 576px;">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"b=
order-collapse: collapse; vertical-align: top; width: 100%;">
align=3D"left" style=3D"border-collapse: collapse; padding: 0px 15px; word=
-break: break-word;">
px; text-align: center;">
34495e;">RBC website, =C2=A9 1995-2023
an>
rial, sans-serif" style=3D"color: #34495e;">
">
an face=3D"Arial, sans-serif" style=3D"color: #34495e;">
-size: 11px;">Legal | Accessibility | Privacy and security | Advertising an=
d cookies
--17b53d878cebb63035d98bf71258dd5a6--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments