Hays Canada Phish from cezargroup.kz
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 22 Dec 2023 00:43:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))
(envelope-from)
id 1rGXcf-00000000Nfn-1kxw
for dave@doctor.nl2k.ab.ca;
Thu, 21 Dec 2023 21:58:57 -0700
Resent-From: The Doctor
Resent-Date: Thu, 21 Dec 2023 21:58:57 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from server.cezargroup.kz ([194.4.58.154]:57637)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.97 (FreeBSD))
(envelope-from)
id 1rGToM-00000000EP0-0U83
for doctor@nk.ca;
Thu, 21 Dec 2023 17:54:51 -0700
Received: from server.cezargroup.kz (localhost.localdomain [127.0.0.1])
by server.cezargroup.kz (Postfix) with ESMTP id 2A77010E57028
for; Fri, 22 Dec 2023 06:52:43 +0600 (+06)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cezargroup.kz;
s=default; t=1703206363;
bh=qz68uthidVgeNQBvs9cnNWVSTIHev7+XO1OoB8PgJio=;
h=Received:Received:Subject:From:To;
b=FECj9EWmrXwzTWp3E85ySUgEr0/GxlRPTxZfnQto9a49N8Ofn6B+v5BcJShaUcmgr
Y0ugtEYNDj3NA8oMU48e1PzuvKq+nIKJqjZ/Yz58unQ7HzMV+INA3bO8uWMcsWeefl
rO2Go/E9t/ZL0+OKpcv5oQ7VZOuB71jO2EHsiGYg=
Authentication-Results: server.cezargroup.kz;
spf=pass (sender IP is 127.0.0.1) smtp.mailfrom=kaspi@cezargroup.kz smtp.helo=server.cezargroup.kz
Received-SPF: pass (server.cezargroup.kz: localhost is always allowed.) client-ip=127.0.0.1; envelope-from=kaspi@cezargroup.kz; helo=server.cezargroup.kz;
X-Spam-Flag: NO
X-Spam-Score: -1.458
X-Spam-Level:
X-Spam-Status: No, score=-1.458 tagged_above=-9999 required=5
tests=[ALL_TRUSTED=-1, BAYES_00=-1.9, DKIM_INVALID=0.1,
DKIM_SIGNED=0.1, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001,
SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_ABUSE_SURBL=1.25,
URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Authentication-Results: server.cezargroup.kz (amavisd-new); dkim=neutral
reason="invalid (public key: not available)" header.d=cezargroup.kz
Received: from server.cezargroup.kz ([127.0.0.1])
by server.cezargroup.kz (server.cezargroup.kz [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id QiE6xxUjf5Fm for;
Fri, 22 Dec 2023 06:52:41 +0600 (+06)
Received: from [127.0.0.1] (30.174.18.95.dynamic.jazztel.es [95.18.174.30])
by server.cezargroup.kz (Postfix) with ESMTPSA id 29CF610DE2859
for; Fri, 22 Dec 2023 06:52:39 +0600 (+06)
Received-SPF: pass (server.cezargroup.kz: connection is authenticated)
Date: Fri, 22 Dec 2023 00:52:40 +0000
Subject: New Document Delivered
From: "Hays - Recruitment Agency"
To: doctor@nk.ca
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--_com.android.email_02682518751123"
Message-ID:
X-Spam_score: 8.9
X-Spam_score_int: 89
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello, this email is to notify you that new documents have
been delivered to your Docusign (HAYS)PremiumsFilesTransfersToolinbox: joboffer.pdf,conditionaloffer_proj.pdf,salary_g.pdf,calculation.pdf,he
[...]
Content analysis details: (8.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[95.18.174.30 listed in zen.spamhaus.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: gostudents.fr]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: gostudents.fr]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 T_SCC_BODY_TEXT_LINE No description available.
Subject: {SPAM?} New Document Delivered
X-Antivirus: AVG (VPS 231221-4, 12/21/2023), Inbound message
X-Antivirus-Status: Clean
This is a multi-part message in MIME format
----_com.android.email_02682518751123
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
=20
=20
Hello,
this email is to notify you that new documents have been delivered to =
your Docusign (HAYS)PremiumsFilesTransfersToolinbox:
joboffer.pdf,conditionaloffer_proj.pdf,salary_g.pdf,calculation.pdf,he=
alth_safety.pdf,legisl_req.pdf, policies.pdf,recruitm_agent.pdf
There are a total of 8 documents. Log in below to read these documents=
=2E
Best regards,
Hays
=20
Your documents have been completed and sent to you
https://gostudents.fr/quietude/?a=3DID2119
Hays sent this email to:doctor@nk.ca
=20
=20
Do Not Share This Email
This email contains a secure link to DocuSign. Please do not share thi=
s email, link, or access code with others.
About DocuSign
Sign documents electronically in just minutes. It's safe, secure, and =
legally binding. Whether you're in an office, at home, on-the-go -- or=
even across the globe -- DocuSign provides a professional trusted sol=
ution for Digital Transaction Management=E2=84=A2.
Questions about the Document?
If you need to modify the document or have questions about the details=
in the document, please reach out to the sender by emailing them dire=
ctly.
This message was sent to you by Hays who is using the DocuSign Electro=
nic Signature Service. If you would rather not receive email from this=
sender you may contact the sender with your request.
=20
----_com.android.email_02682518751123
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
pe" />
Hays job offer
ca,Arial,Sans Serif;">
0" dir=3D"" role=3D"presentation" width=3D"100%">
llapse:collapse;background-color:#ffffff;max-width:640px;">
ng=3D"0" role=3D"presentation" style=3D"background-color:#1e4ca1;color=
:#FFFFFF;" width=3D"100%">
der-radius:2px;background-color:#1e4ca1;color:#FFFFFF;font-size:16px;f=
ont-family:Helvetica,Arial,Sans Serif;width:100%;text-align:center;"><=
img alt=3D"" height=3D"75" src=3D"https://www.docusign.net/member/Imag=
es/email/docComplete-white.png" style=3D"width:75px;height:75px;" widt=
h=3D"75" />
"presentation" width=3D"100%">
6px;font-family:Helvetica,Arial,Sans Serif;border:none;text-align:cent=
er;color:#FFFFFF">Your documents have been completed and sent to you
td>
"presentation" width=3D"100%">
16px;font-family:Helvetica,Arial,Sans Serif;background-color:white;">
presentation">
ght:bold;line-height:18px;font-size:15px;color:#333333;">Hays sent thi=
s email to:
ght:18px;font-size:15px;color:#666666;">doctor@nk.ca
rial,Sans Serif;line-height:20px;">
;font-family:Helvetica,Arial,Sans Serif;font-size:11px;color:#666666;"=
>
A;">
erif;font-size:13px;color:#666666;line-height:18px;">
3" role=3D"heading">Do Not Share This Email
This email contains a secure link to DocuSign. Please do not sha=
re this email, link, or access code with others.
erif;font-size:13px;color:#666666;line-height:18px;">
3" role=3D"heading">About DocuSign
Sign documents electronically in just minutes. It's safe, se=
cure, and legally binding. Whether you're in an office, at home, o=
n-the-go -- or even across the globe -- DocuSign provides a profession=
al trusted solution for Digital Transaction Management™.
erif;font-size:13px;color:#666666;line-height:18px;">
3" role=3D"heading">Questions about the Document?
If you need to modify the document or have questions about the d=
etails in the document, please reach out to the sender by emailing the=
m directly.
erif;font-size:13px;color:#666666;line-height:18px;">This message was =
sent to you by Hays who is using the DocuSign Electronic Signature Ser=
vice. If you would rather not receive email from this sender you may c=
ontact the sender with your request.
A;">
p=3D"text" />
/>
----_com.android.email_02682518751123--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 22 Dec 2023 00:43:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))
(envelope-from
id 1rGXcf-00000000Nfn-1kxw
for dave@doctor.nl2k.ab.ca;
Thu, 21 Dec 2023 21:58:57 -0700
Resent-From: The Doctor
Resent-Date: Thu, 21 Dec 2023 21:58:57 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from server.cezargroup.kz ([194.4.58.154]:57637)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.97 (FreeBSD))
(envelope-from
id 1rGToM-00000000EP0-0U83
for doctor@nk.ca;
Thu, 21 Dec 2023 17:54:51 -0700
Received: from server.cezargroup.kz (localhost.localdomain [127.0.0.1])
by server.cezargroup.kz (Postfix) with ESMTP id 2A77010E57028
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cezargroup.kz;
s=default; t=1703206363;
bh=qz68uthidVgeNQBvs9cnNWVSTIHev7+XO1OoB8PgJio=;
h=Received:Received:Subject:From:To;
b=FECj9EWmrXwzTWp3E85ySUgEr0/GxlRPTxZfnQto9a49N8Ofn6B+v5BcJShaUcmgr
Y0ugtEYNDj3NA8oMU48e1PzuvKq+nIKJqjZ/Yz58unQ7HzMV+INA3bO8uWMcsWeefl
rO2Go/E9t/ZL0+OKpcv5oQ7VZOuB71jO2EHsiGYg=
Authentication-Results: server.cezargroup.kz;
spf=pass (sender IP is 127.0.0.1) smtp.mailfrom=kaspi@cezargroup.kz smtp.helo=server.cezargroup.kz
Received-SPF: pass (server.cezargroup.kz: localhost is always allowed.) client-ip=127.0.0.1; envelope-from=kaspi@cezargroup.kz; helo=server.cezargroup.kz;
X-Spam-Flag: NO
X-Spam-Score: -1.458
X-Spam-Level:
X-Spam-Status: No, score=-1.458 tagged_above=-9999 required=5
tests=[ALL_TRUSTED=-1, BAYES_00=-1.9, DKIM_INVALID=0.1,
DKIM_SIGNED=0.1, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001,
SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_ABUSE_SURBL=1.25,
URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Authentication-Results: server.cezargroup.kz (amavisd-new); dkim=neutral
reason="invalid (public key: not available)" header.d=cezargroup.kz
Received: from server.cezargroup.kz ([127.0.0.1])
by server.cezargroup.kz (server.cezargroup.kz [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id QiE6xxUjf5Fm for
Fri, 22 Dec 2023 06:52:41 +0600 (+06)
Received: from [127.0.0.1] (30.174.18.95.dynamic.jazztel.es [95.18.174.30])
by server.cezargroup.kz (Postfix) with ESMTPSA id 29CF610DE2859
for
Received-SPF: pass (server.cezargroup.kz: connection is authenticated)
Date: Fri, 22 Dec 2023 00:52:40 +0000
Subject: New Document Delivered
From: "Hays - Recruitment Agency"
To: doctor@nk.ca
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--_com.android.email_02682518751123"
Message-ID:
X-Spam_score: 8.9
X-Spam_score_int: 89
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello, this email is to notify you that new documents have
been delivered to your Docusign (HAYS)PremiumsFilesTransfersToolinbox: joboffer.pdf,conditionaloffer_proj.pdf,salary_g.pdf,calculation.pdf,he
[...]
Content analysis details: (8.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[95.18.174.30 listed in zen.spamhaus.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: gostudents.fr]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: gostudents.fr]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-0.0 T_SCC_BODY_TEXT_LINE No description available.
Subject: {SPAM?} New Document Delivered
X-Antivirus: AVG (VPS 231221-4, 12/21/2023), Inbound message
X-Antivirus-Status: Clean
This is a multi-part message in MIME format
----_com.android.email_02682518751123
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
=20
=20
Hello,
this email is to notify you that new documents have been delivered to =
your Docusign (HAYS)PremiumsFilesTransfersToolinbox:
joboffer.pdf,conditionaloffer_proj.pdf,salary_g.pdf,calculation.pdf,he=
alth_safety.pdf,legisl_req.pdf, policies.pdf,recruitm_agent.pdf
There are a total of 8 documents. Log in below to read these documents=
=2E
Best regards,
Hays
=20
Your documents have been completed and sent to you
https://gostudents.fr/quietude/?a=3DID2119
Hays sent this email to:doctor@nk.ca
=20
=20
Do Not Share This Email
This email contains a secure link to DocuSign. Please do not share thi=
s email, link, or access code with others.
About DocuSign
Sign documents electronically in just minutes. It's safe, secure, and =
legally binding. Whether you're in an office, at home, on-the-go -- or=
even across the globe -- DocuSign provides a professional trusted sol=
ution for Digital Transaction Management=E2=84=A2.
Questions about the Document?
If you need to modify the document or have questions about the details=
in the document, please reach out to the sender by emailing them dire=
ctly.
This message was sent to you by Hays who is using the DocuSign Electro=
nic Signature Service. If you would rather not receive email from this=
sender you may contact the sender with your request.
=20
----_com.android.email_02682518751123
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
pe" />
ca,Arial,Sans Serif;">
0" dir=3D"" role=3D"presentation" width=3D"100%">
llapse:collapse;background-color:#ffffff;max-width:640px;">
ok/assets/img/svg/logo.svg" style=3D"border: medium; width: 150px;" />=
Hello,
this email is to notify you that new documents have been deli=
vered to your Docusign (HAYS)
lass=3D"d-inline font-weight-bold">Premium
;">sFilesTransfer
yle=3D"color:#FFFFFF;">sTool inbox:
joboffer.pdf, conditionaloffer_proj.=
pdf, salary_g.pdf, c=
alculation.pdf, health_safety.pdf,
s=3D"pdf-name">legisl_req.pdf, policies.pdf,
an>recruitm_agent.pdf
There are a total of 8 documents. Log in below to read these =
documents.
Best regards,
Hays
email/Email_Logo.png" style=3D"width: 116px; height: 34px; float: righ=
t;" />
![3D""](3D"https://www.docusign.net/Signing/Images/=<br)
ng=3D"0" role=3D"presentation" style=3D"background-color:#1e4ca1;color=
:#FFFFFF;" width=3D"100%">
der-radius:2px;background-color:#1e4ca1;color:#FFFFFF;font-size:16px;f=
ont-family:Helvetica,Arial,Sans Serif;width:100%;text-align:center;"><=
img alt=3D"" height=3D"75" src=3D"https://www.docusign.net/member/Imag=
es/email/docComplete-white.png" style=3D"width:75px;height:75px;" widt=
h=3D"75" />
"presentation" width=3D"100%">
6px;font-family:Helvetica,Arial,Sans Serif;border:none;text-align:cent=
er;color:#FFFFFF">Your documents have been completed and sent to you
td>
"presentation" width=3D"100%">
16px;font-family:Helvetica,Arial,Sans Serif;background-color:white;">
presentation">
ght:bold;line-height:18px;font-size:15px;color:#333333;">Hays sent thi=
s email to:
ght:18px;font-size:15px;color:#666666;">doctor@nk.ca
rial,Sans Serif;line-height:20px;">
;font-family:Helvetica,Arial,Sans Serif;font-size:11px;color:#666666;"=
>
A;">
erif;font-size:13px;color:#666666;line-height:18px;">
3" role=3D"heading">Do Not Share This Email
This email contains a secure link to DocuSign. Please do not sha=
re this email, link, or access code with others.
erif;font-size:13px;color:#666666;line-height:18px;">
3" role=3D"heading">About DocuSign
Sign documents electronically in just minutes. It's safe, se=
cure, and legally binding. Whether you're in an office, at home, o=
n-the-go -- or even across the globe -- DocuSign provides a profession=
al trusted solution for Digital Transaction Management™.
erif;font-size:13px;color:#666666;line-height:18px;">
3" role=3D"heading">Questions about the Document?
If you need to modify the document or have questions about the d=
etails in the document, please reach out to the sender by emailing the=
m directly.
erif;font-size:13px;color:#666666;line-height:18px;">This message was =
sent to you by Hays who is using the DocuSign Electronic Signature Ser=
vice. If you would rather not receive email from this sender you may c=
ontact the sender with your request.
A;">
p=3D"text" />
/>
----_com.android.email_02682518751123--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments