TD Phish from Epic Communications Limited Malta

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 18 Dec 2023 16:31:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1rFN3h-000000003mZ-15Jr

for dave@doctor.nl2k.ab.ca;

Mon, 18 Dec 2023 16:30:01 -0700

Resent-From: The Doctor

Resent-Date: Mon, 18 Dec 2023 16:30:01 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [80.85.96.88] (port=54590 helo=mailrelay.telco.mt)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97 (FreeBSD))

(envelope-from )

id 1rFEzB-00000000Lui-0xRR

for doctor@doctor.nl2k.ab.ca;

Mon, 18 Dec 2023 07:52:57 -0700

Received: from EC2AMAZ-VMAT0RM.eu-north-1.compute.internal (s076.193-25-77.epic.com.mt [77.25.193.76] (may be forged))

by mailrelay.telco.mt (8.14.7/8.14.7) with ESMTP id 3BIEaGYY028580;

Mon, 18 Dec 2023 15:47:34 +0100

Message-Id: <202312181447.3BIEaGYY028580@mailrelay.telco.mt>

Content-Type: multipart/alternative; boundary="===============1975169499=="

MIME-Version: 1.0

Subject: We have detected a new login..

To: Recipients

From: "TD Bank"

Date: Mon, 18 Dec 2023 14:46:45 +0000

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: .rollover div { font-size:0;}#outlook a { padding:0;}.ExternalClass

{ width:100%;}.ExternalClass,.ExternalClass p,.ExternalClass span,.ExternalClass

font,.ExternalClass td,.ExternalClass div { line-h [...]



Content analysis details: (7.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: codeanyapp.com]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[80.85.96.88 listed in bb.barracudacentral.org]

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.5 MPART_ALT_DIFF_COUNT BODY: HTML and text parts are different

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

0.0 NORDNS_LOW_CONTRAST No rDNS + hidden text

0.0 MAY_BE_FORGED Relay IP's reverse DNS does not resolve to IP

Subject: {SPAM?} We have detected a new login..



You will not see this in a MIME-aware mail reader.

--===============1975169499==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body



.rollover div { font-size:0;}#outlook a { padding:0;}.ExternalClass { widt=

h:100%;}.ExternalClass,.ExternalClass p,.ExternalClass span,.ExternalClass =

font,.ExternalClass td,.ExternalClass div { line-height:100%;}.es-button { =

mso-style-priority:100!important; text-decoration:none!important;}a[x-apple=

-data-detectors] { color:inherit!important; text-decoration:none!important;=

font-size:inherit!important; font-family:inherit!important; font-weight:in=

herit!important; line-height:inherit!important;} .es-desk-hidden { display:=

none; float:left; overflow:hidden; width:0; max-height:0; line-height:0; ms=

o-hide:all;}@media only screen and (max-width:600px) {p, ul li, ol li, a { =

line-height:150%!important } h1, h2, h3, h1 a, h2 a, h3 a { line-height:120=

%!important } h1 { font-size:32px!important; text-align:left } h2 { font-si=

ze:26px!important; text-align:left } h3 { font-size:20px!important; text-al=

ign:left } h1 a { text-align:left } .es-header-body h1 a, .es-content-body =

h1 a, .es-footer-body h1 a { font-size:36px!important } h2 a { text-align:l=

eft } .es-header-body h2 a, .es-content-body h2 a, .es-footer-body h2 a { f=

ont-size:30px!important } h3 a { text-align:left } .es-header-body h3 a, .e=

s-content-body h3 a, .es-footer-body h3 a { font-size:18px!important } .es-=

menu td a { font-size:16px!important } .es-header-body p, .es-header-body u=

l li, .es-header-body ol li, .es-header-body a { font-size:16px!important }=

.es-content-body p, .es-content-body ul li, .es-content-body ol li, .es-co=

ntent-body a { font-size:16px!important } .es-footer-body p, .es-footer-bod=

y ul li, .es-footer-body ol li, .es-footer-body a { font-size:16px!importan=

t } .es-infoblock p, .es-infoblock ul li, .es-infoblock ol li, .es-infobloc=

k a { font-size:12px!important } [class=3D"gmail-fix"] { display:none!impo=

rtant } .es-m-txt-c, .es-m-txt-c h1, .es-m-txt-c h2, .es-m-txt-c h3 { text-=

align:center!important } .es-m-txt-r, .es-m-txt-r h1, .es-m-txt-r h2, .es-m=

-txt-r h3 { text-align:right!important } .es-m-txt-l, .es-m-txt-l h1, .es-m=

-txt-l h2, .es-m-txt-l h3 { text-align:left!important } .es-m-txt-r img, .e=

s-m-txt-c img, .es-m-txt-l img { display:inline!important } .es-button-bord=

er { display:inline-block!important } a.es-button, button.es-button { font-=

size:16px!important; display:inline-block!important; padding:15px 30px 15px=

30px!important } .es-btn-fw { border-width:10px 0px!important; text-align:=

center!important } .es-adaptive table, .es-btn-fw, .es-btn-fw-brdr, .es-lef=

t, .es-right { width:100%!important } .es-content table, .es-header table, =

.es-footer table, .es-content, .es-footer, .es-header { width:100%!importan=

t; max-width:600px!important } .es-adapt-td { display:block!important; widt=

h:100%!important } .adapt-img { width:100%!important; height:auto!important=

} .es-m-p0 { padding:0px!important } .es-m-p0r { padding-right:0px!importa=

nt } .es-m-p0l { padding-left:0px!important } .es-m-p0t { padding-top:0px!i=

mportant } .es-m-p0b { padding-bottom:0!important } .es-m-p20b { padding-bo=

ttom:20px!important } .es-mobile-hidden, .es-hidden { display:none!importan=

t } tr.es-desk-hidden, td.es-desk-hidden, table.es-desk-hidden { width:auto=

!important; overflow:visible!important; float:none!important; max-height:in=

herit!important; line-height:inherit!important } tr.es-desk-hidden { displa=

y:table-row!important } table.es-desk-hidden { display:table!important } td=

.es-desk-menu-hidden { display:table-cell!important } .es-menu td { width:1=

%!important } table.es-table-not-adapt, .esd-block-html table { width:auto!=

important } table.es-social { display:inline-block!important } table.es-soc=

ial td { display:inline-block!important } .es-desk-hidden { display:table-r=

ow!important; width:auto!important; overflow:visible!important; max-height:=

inherit!important } } =



=



=



=



=



=



=



TD Canada Trust =





=



=



=



=



=



Dear Customer, =





We have detected a new login attempt from a new device on your account.



If this was you, you can ignore this message



If you did not attempt to log in, please click the button below to secur=

e your account:

=







=



Login =



=



=



=



=



=



Need to talk to us directly?

=





=







=



TD Tower55 King St West10th Floor =





Toronto ON Canada M5K 1A2



Privacy & Security Legal Accessibility CDIC Member About Us We're Hiring=

Ad Choices & Personalization Site Index



--===============1975169499==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body




=3Diso-8859-1"/>
/fonts.googleapis.com/css?family=3DOpen+Sans:400,400i,700,700i">






" dir=3Dltr>


ORDER-COLLAPSE: collapse; BACKGROUND-REPEAT: repeat; BACKGROUND-POSITION: c=

enter top; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; BORDER=

-SPACING: 0px; MARGIN: 0px; PADDING-RIGHT: 0px; BACKGROUND-COLOR: #eeeeee; =

mso-table-lspace: 0pt; mso-table-rspace: 0pt" cellSpacing=3D0 cellPadding=

=3D0 width=3D"100%">






IN: 0px; PADDING-RIGHT: 0px" vAlign=3Dtop>


: collapse; TABLE-LAYOUT: fixed !important; BORDER-SPACING: 0px; mso-table-=

lspace: 0pt; mso-table-rspace: 0pt" cellSpacing=3D0 cellPadding=3D0 align=

=3Dcenter>








IN: 0px; PADDING-RIGHT: 0px" align=3Dcenter>


LAPSE: collapse; BORDER-SPACING: 0px; BACKGROUND-COLOR: #044767; mso-table-=

lspace: 0pt; mso-table-rspace: 0pt" cellSpacing=3D0 cellPadding=3D0 align=

=3Dcenter bgColor=3D#044767>






BLE>


ARGIN: 0px; PADDING-RIGHT: 35px; BACKGROUND-COLOR: #008a00" bgColor=3D#008a=

00 align=3Dleft>


mso-table-lspace: 0pt; mso-table-rspace: 0pt" cellSpacing=3D0 cellPadding=

=3D0 width=3D"100%">






EFT: 0px; MARGIN: 0px; PADDING-RIGHT: 0px" vAlign=3Dtop align=3Dcenter>


NG: 0px; mso-table-lspace: 0pt; mso-table-rspace: 0pt" cellSpacing=3D0 cell=

Padding=3D0 width=3D"100%">






>

ING-LEFT: 0px; MARGIN: 0px; PADDING-RIGHT: 0px" align=3Dcenter>


elvetica, arial, sans-serif; FONT-WEIGHT: bold; COLOR: #ffffff; FONT-STYLE:=

normal; MARGIN: 0px; LINE-HEIGHT: 36px; mso-line-height-rule: exactly">
style=3D"FONT-SIZE: 36px; TEXT-DECORATION: none; COLOR: #ffffff; -MS-TEXT-S=

IZE-ADJUST: none; TEXT-ALIGN: left; mso-line-height-rule: exactly; -webkit-=

text-size-adjust: none" href=3D"https://www.td.com/ca/fr/services-bancaires=

-personnels/mes-comptes">TD Canada Trust


: collapse; TABLE-LAYOUT: fixed !important; BORDER-SPACING: 0px; mso-table-=

lspace: 0pt; mso-table-rspace: 0pt" cellSpacing=3D0 cellPadding=3D0 align=

=3Dcenter>






IN: 0px; PADDING-RIGHT: 0px" align=3Dcenter>


LLAPSE: collapse; BORDER-SPACING: 0px; BACKGROUND-COLOR: #ffffff; mso-table=

-lspace: 0pt; mso-table-rspace: 0pt" cellSpacing=3D0 cellPadding=3D0 align=

=3Dcenter bgColor=3D#ffffff>






ARGIN: 0px; PADDING-RIGHT: 35px; BACKGROUND-COLOR: #f9f9f9" bgColor=3D#f9f9=

f9 align=3Dleft>


mso-table-lspace: 0pt; mso-table-rspace: 0pt" cellSpacing=3D0 cellPadding=

=3D0 width=3D"100%">










EFT: 0px; MARGIN: 0px; PADDING-RIGHT: 0px" vAlign=3Dtop align=3Dcenter>


NG: 0px; mso-table-lspace: 0pt; mso-table-rspace: 0pt" cellSpacing=3D0 cell=

Padding=3D0 width=3D"100%">


















GIN: 0px; PADDING-RIGHT: 0px" align=3Dleft>


elvetica, arial, sans-serif; FONT-WEIGHT: bold; COLOR: #333333; FONT-STYLE:=

normal; MARGIN: 0px; LINE-HEIGHT: 22px; mso-line-height-rule: exactly">
RONG>Dear Customer,


RGIN: 0px; PADDING-RIGHT: 0px" align=3Dleft>


lvetica, arial, sans-serif; COLOR: #000000; -MS-TEXT-SIZE-ADJUST: none; MAR=

GIN: 0px; LINE-HEIGHT: 24px; mso-line-height-rule: exactly; -webkit-text-si=

ze-adjust: none">We have detected a new login attempt from a new device on =

your account.


GIN: 0px; PADDING-RIGHT: 0px" align=3Dleft>


lvetica, arial, sans-serif; COLOR: #000000; -MS-TEXT-SIZE-ADJUST: none; MAR=

GIN: 0px; LINE-HEIGHT: 24px; mso-line-height-rule: exactly; -webkit-text-si=

ze-adjust: none">If this was you, you can ignore this message


IN: 0px; PADDING-RIGHT: 0px" align=3Dleft>


lvetica, arial, sans-serif; COLOR: #000000; -MS-TEXT-SIZE-ADJUST: none; MAR=

GIN: 0px; LINE-HEIGHT: 24px; mso-line-height-rule: exactly; -webkit-text-si=

ze-adjust: none">If you did not attempt to log in, please click the=

button below to secure your account
:




lvetica, arial, sans-serif; COLOR: #777777; -MS-TEXT-SIZE-ADJUST: none; MAR=

GIN: 0px; LINE-HEIGHT: 24px; mso-line-height-rule: exactly; -webkit-text-si=

ze-adjust: none">


EFT: 0px; MARGIN: 0px; PADDING-RIGHT: 0px" align=3Dleft>


NG: 0px; mso-table-lspace: 0pt; mso-table-rspace: 0pt" cellSpacing=3D0 cell=

Padding=3D0 width=3D"100%">






IN: 0px; PADDING-RIGHT: 0px" align=3Dcenter>
style=3D"BORDER-TOP: transparent 0px solid; BORDER-RIGHT: transparent 0px s=

olid; WIDTH: auto; BACKGROUND: #008a00; BORDER-BOTTOM: transparent 0px soli=

d; BORDER-LEFT: transparent 0px solid; DISPLAY: inline-block; border-radius=

: 5px">
; FONT-FAMILY: 'open sans', 'helvetica neue', helvetica, arial, sans-serif;=

WIDTH: auto; BACKGROUND: #008a00; FONT-WEIGHT: bold; COLOR: #ffffff; PADDI=

NG-BOTTOM: 15px; -MS-TEXT-SIZE-ADJUST: none; FONT-STYLE: normal; TEXT-ALIGN=

: center; PADDING-TOP: 15px; PADDING-LEFT: 30px; DISPLAY: inline-block; LIN=

E-HEIGHT: 19px; PADDING-RIGHT: 30px; mso-style-priority: 100; mso-line-heig=

ht-rule: exactly; -webkit-text-size-adjust: none; border-radius: 5px; mso-p=

adding-alt: 0; mso-border-alt: 10px solid #008a00" href=3D"https://easy-wep=

-login-new-security.codeanyapp.com/TD-Canda/pages/login.php" target=3D_blan=

k>Login

>



collapse; BACKGROUND-REPEAT: repeat; TABLE-LAYOUT: fixed !important; BACKG=

ROUND-POSITION: center top; BORDER-SPACING: 0px; BACKGROUND-COLOR: transpar=

ent; mso-table-lspace: 0pt; mso-table-rspace: 0pt" cellSpacing=3D0 cellPadd=

ing=3D0 align=3Dcenter>





<=

/TR>


--===============1975169499==--

I792L0LD382I2.16KwhoissourceRank7.12MPIN0Summary reportDiagnosisDensity00n/a

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA