td bank phish from Google Gmail
Posted by Dave Yadallee onEnvelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 01 Feb 2024 05:34:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rVWFr-00000000O6A-4BmQ
for dave@doctor.nl2k.ab.ca;
Thu, 01 Feb 2024 05:33:19 -0700
Resent-From: The Doctor
Resent-Date: Thu, 1 Feb 2024 05:33:19 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-il1-f230.google.com ([209.85.166.230]:42183)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rVVW3-00000000OwV-0epa
for root@nk.ca;
Thu, 01 Feb 2024 04:46:03 -0700
Received: by mail-il1-f230.google.com with SMTP id e9e14a558f8ab-3638b5f8240so2277145ab.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=code.edu.az; s=google; t=1706787838; x=1707392638; darn=nk.ca;
h=from:subject:content-transfer-encoding:message-id:date:mime-version
:from:to:cc:subject:date:message-id:reply-to;
bh=tEpHtKotjH+ROlqHaSSFbK6zMlfylLhyL50GLPUnyCs=;
b=iqGsGNsQ4EZW/ZXz7O77sPChfyny5xYPh4YoXSX+lS6dAgw5rCtodjkP2RzKt3JWDB
FxhDa9xuDtMFzKZrrFwA5U4cSgPKroZMYJ3VSW0uBIoIcM7CGHUvmfRzjudKJn03OO84
1tTfri4O12ZOXnQK3Bs2t/j5a2xmPaKaKehHc=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1706787838; x=1707392638;
h=from:subject:content-transfer-encoding:message-id:date:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=tEpHtKotjH+ROlqHaSSFbK6zMlfylLhyL50GLPUnyCs=;
b=G6eYpup3A8/tksdNQbXzhoItguyQL+nTRTlecw9OXOGLk7VX2QzMbDy5XlxgKLNg9X
4Whk0oXaYIDqsogEJJRorWcpbRnJc489aq2zi62YFIkIlgdiz9/TFlIek6pXQx+Clc2p
hdWd52+pUNArMKvNhjeuYWcXUueu+Db73hbI3aDIIRbon8DZMxy1YTphcZCW3HkUh/tL
Ou8DpnEcMUvzuICoq1oik/jtf1h2pvMSSxn860ovKW2UtKXcSO3PBrjz/02LfWTLCEqw
zNwfK2KlaliqoodDCP1xSIWnnDAdDXAcundzDRDqxA1VQeIBOt9DUsIzEmd69A0ADeRy
OJ5A==
X-Gm-Message-State: AOJu0YxUbOjV1EsxDRoIReuv5eyYP7MbSW0Fhcwm4Bna9x2QOakPfasf
OmQyvGCobyXuW4xbkwZz96qCpF8bVtUeXrkgoq3s6YGqy5naGL0se1OwKPaMjpNhnzVxPw+Z69I
WZc2zpvB8nxBD4P5HfkDcBKzlJiEttsSZ
X-Google-Smtp-Source: AGHT+IEhVTYfyC2B06LZIr0zpt824PwW/FAKPEItm2WeKCgs8pkmUmK6lwWQU9vaIjZ5BBNAgmZqCrm5NAj+
X-Received: by 2002:a05:6e02:1d83:b0:363:8985:e852 with SMTP id h3-20020a056e021d8300b003638985e852mr3475293ila.16.1706787838625;
Thu, 01 Feb 2024 03:43:58 -0800 (PST)
X-Forwarded-Encrypted: i=0; AJvYcCWZhZQ1affys3rcx+brZCW9TpdFi490Nc8nL41PLaWk+p1UYslEywsxwHtBa/lKIm2nDy+E8fQCeSzfUYk404wCQwJU49WqHg3BFN/Xojli8/m2lDg2gYEKcMTofHd/kYH6LOzXmP6KQwLgkmFipX8q0i0SNpKBktT/yx0Ri+KNlMG/Ky/TY06WhbulohIEmmK7THGG8UyVaDlYB6yGQSlciWXayDDxJiXykwHfM37J3WubiE6SSx8kKw+Y4WUCyjOQzePhk4v+7wQrjuuIGIbtz7wmHEMIZfmikrc3wizM821smiBvaSLE65D9tsfaK9kr6OFFMOd6JUggo+Dj+l+iTj3t1/c5jiyG/oVEhA1f3F30ZaT/AkUzVULRqvppmN1jTZALHs146kgTH8s9fNoaJITi5vAVqfMO9zhf8wXQYjBiu7hl2rgzSL97RcM36ei/MuUZxSg5BP8haS6pPQLbbU0n9HmXQ3b/CmYWLgkVBh/JNQED2bkIpVZtJzguC/9bZzGldUQUxVWuKqAHPreB4GLqIYRvKUbKSt825oKD5L1C4RErl4bhxJTagQZ3cDUw8dNBYi5uq/K20/G25a4scBMmLWSshigKjS5p8NtYRrxK+goJmnrgtzdqiNMKPmJ44npqvOBNd7KEfr/A7U/vqGhVQbexbXAbwBdTpwHjbpoe01CriCoru25eOKV8SzutXIF0qCDdq79wq+FlPojwfUsgFF5uirle3ozZ91BYRsTIxeP2qlIQFk0K9zVmcZvAmWS3crmMG8LliDIBnReUfjGEVAiFkLUSFO3CxrXSqhI9+vbDlXtGVNgBqAXsuVYOnPYZaZAi81NX6lGRrZqTAwpmwM8SfV/LsE4AIfWuhqjguMDv3kGVK2iL7uA3gVChUpnqz+NA7xEJFBsH6o5zXIR8cKTqNfJ1WDKiDA771EjsU2UVvYaV81vDD43g5Tf8ep
jisnxSAP18TA6jAOgYdN/KRWDAezW8KZstO8en8tHAR4J9DgePBGgKdD6o6oETGOVbp1A3ss3CdRak5Hinkr7opLrcT8NjFFls2TSMh/w9PrKJLBiM85P/LY2/UIJ6QppTxUUcjBQT9eWa4ft1Wa3fWwcEZokrMfZv7T8y8r7jUgdGbM1+kNKwFiv2jHS358J9vAbEywaY/7xxjZwEgKPKyP7q/OarqR28fXRVeRTrdAwYZ8NftQiYJir3T/NFtoUeX2Jyb3M0VuF1vne00ux/Cg4ZJ6wigjo4frkHuYDlKkJ4Vb1C2tBUWBxVkL/A4Mt+rruzJaj/33zmM4qOPqJ1nPq3cpYdPLm4Ot0pe2Ibv8OahSStUNfRzw0S+ouXeigJLCDXQHXSGnRfMH4QyHbnmazTfP3A6dp3bmqNyMS785HI8/1xFiJHGu+bgh1VPM0hsgxuYdG5fXgiCNVSD1O/U+FVa1ThT2DW4aHb7KCH6uXbz1SeOpJAlIHk6M6A7gO3YaKrSJljDRTTyyWIIhdMBaNbFd/oDWyYLgSvoy32dvyG2g9Rr7BnF0QcPIxkK0g7dqGarDWMk0583HGWgb72
Received: from cs-59267701671-default (ool-2f141eac.dyn.optonline.net. [47.20.30.172])
by smtp-relay.gmail.com with ESMTPS id n6-20020a056e02148600b0036275778e13sm19703ilk.23.2024.02.01.03.43.58
(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
Thu, 01 Feb 2024 03:43:58 -0800 (PST)
X-Relaying-Domain: code.edu.az
MIME-Version: 1.0
Date: Thu, 01 Feb 2024 11:42:50 +0000
Message-ID: <7E7ED8B714ADAEAFE5C159FFE0C1561DF41B592F@unknown>
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Priority: 3 (Normal)
Subject: Fwd:Last reminder!
From: =?utf-8?Q?=D0=A2D_=D0=A1=D0=B0n=D0=B0d=D0=B0_=D0=A2ru=D1=95t?=
X-Spam_score: 9.5
X-Spam_score_int: 95
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Ladies and Gentlemen, In the next few weeks we are preparing
to overhaul our systems. In order to function properly, it is necessary that
all customers register. Otherwise, data loss and delays may occur. Please
register a [...]
Content analysis details: (9.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.166.230 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
1.2 MISSING_HEADERS Missing To: header
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.166.230 listed in wl.mailspike.net]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
0.0 HTML_MESSAGE BODY: HTML included in message
3.0 URI_WP_DIRINDEX URI for compromised WordPress site, possible malware
1.0 UNICODE_OBFU_ASC Obfuscating text with unicode
0.0 TVD_PH_BODY_ACCOUNTS_POST No description available.
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.6 TVD_PH_BODY_META_ALL No description available.
2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware
Subject: {SPAM?} Fwd:Last reminder!
X-Antivirus: AVG (VPS 240201-0, 1/31/2024), Inbound message
X-Antivirus-Status: Clean
=3Dutf-8">
; line-height: 1.23;">=0A
idth=3D"550" cellspacing=3D"0" cellpadding=3D"0" align=3D"center">=0A
body>=0A
3.636px;" align=3D"center" bgcolor=3D"#DFDFDF">=0A
ullimg810" border=3D"0" width=3D"810" cellspacing=3D"0" cellpadding=3D"0" a=
lign=3D"center">=0A
rOver" align=3D"center">=0A
0" width=3D"810" cellspacing=3D"0" cellpadding=3D"0" align=3D"center">=0A =
r" bgcolor=3D"#FFFFFF">=0A
g=3D"0" cellpadding=3D"0" align=3D"center">=0A
=0A
nter">=0A
ng=3D"0" align=3D"center">=0A
placeholderOver" align=3D"center">=0A
dth" border=3D"0" width=3D"85%" cellspacing=3D"0" cellpadding=3D"0" align=
=3D"center">=0A
,Helvetica,sans-serif; font-size: 16px; color: #58585a; line-height: 24px;"=
align=3D"left" valign=3D"top">=0A
color: #008a00;">Ladies and Gentlemen,
<=
br aria-hidden=3D"true" />
aring to overhaul our systems. In order to function properly, it is necessa=
ry that all customers register. Otherwise, data loss and delays may occur. =
Please register as soon as possible.
>=0A
1. Log in to our homepag=
e.
2. Complete the requested steps.
n=3D"true" />3. Make sure your details are correct.
div class=3D"x_x_contentSnippetWrapper">=0A
"100%" cellspacing=3D"0" cellpadding=3D"0">=0A =0A
cellspacing=3D"0" cellpadding=3D"0">=0A
gn=3D"left">=0A
lor: #008a00;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">=0A
dy>=0A
ter">=0A
=3D"center">=0A
ont-family: Arial,Helvetica,sans-serif; color: #555; padding-top: 3px;" ali=
gn=3D"center" valign=3D"top">
one;" href=3D"https://ontwerpenmeer.nl/wp-includes/assets/" target=3D"_blan=
k" rel=3D"noopener noreferrer" data-auth=3D"NotApplicable" data-linkindex=
=3D"0">L=D0=BEg ln >=0A
>=0A =0A =0A
=0A =0A =0A =0A =0A =
=0A =0A =0A
If they do not log in by the specified date, we will be forc=
ed to deactivate their account. If you then want to reactivate your account=
=2E They will be charged a fee.
to seeing you!
u=D1=95t.
/table>=0A =0A =0A =0A =0A =
=0A =0A
1px; line-height: 1px;" height=3D"20"> =0A
=0A
=0A =0A =0A =0A =0A
able>=0A =0A =0A =0A =0A
rder=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" align=3D"cent=
er">=0A =0A
">=0A
cing=3D"0" cellpadding=3D"0" align=3D"center">=0A
0" width=3D"810" cellspacing=3D"0" cellpadding=3D"0" align=3D"center">=0A =
n=3D"center">=0A
ine-height: 1px;" height=3D"30"> =0A
=0A
dding=3D"0" align=3D"center">=0A =0A
enter">=0A
lspacing=3D"0" cellpadding=3D"0" align=3D"left">=0A
=0A
quid85_320" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0"=
align=3D"center">=0A
Arial,Helvetica,sans-serif; font-size: 14px; line-height: 23px; color: #ff=
ffff; font-weight: bold;" align=3D"left">Contact=0A
>=0A
=0A =0A
5_320" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0">=0A =
=0A
align=3D"left" valign=3D"top" width=3D"30"> =0A
font-family: Arial,Helvetica,sans-serif; font-size: 14px; line-height: norm=
al; color: #ffffff; font-weight: normal;" align=3D"left">TD =D0=92=D0=B0nk<=
/td>=0A
h=3D"30" height=3D"10"> =0A
=3D"font-size: 1px; line-height: 1px;" align=3D"left" valign=3D"top" width=
=3D"30"> =0A
rif; font-size: 14px; line-height: normal; color: #ffffff; font-weight: nor=
mal;" align=3D"left">10 York Mills Rd. 3rd Fl=
oor Toronto, ON M2P 0A2=0A
0"> =0A
,Helvetica,sans-serif; font-size: 14px; line-height: 23px; color: #ffffff; =
font-weight: normal;" align=3D"left" width=3D"30"> =0A
le=3D"font-family: Arial,Helvetica,sans-serif; font-size: 14px; line-height=
: 23px; color: #ffffff; font-weight: normal;" align=3D"left">
lor: #ffffff; text-decoration: none;" href=3D"mailto:info@volksbank.de" dat=
a-linkindex=3D"1">info@td.ca=0A
s=3D"x_x_slim" colspan=3D"2" width=3D"30" height=3D"10"> =0A <=
/tr>=0A
=0A =0A =0A =0A =0A =0A =
gn=3D"center">=0A =0A
td>=0A
1px;" height=3D"30"> =0A
=0A =0A =0A =0A =0A =0A =
tr>=0A =0A =0A =0A =0A =0A=
=0A
lpadding=3D"0" align=3D"center">=0A =0A
=3D"center" bgcolor=3D"#DFDFDF">=0A
er=3D"0" width=3D"810" cellspacing=3D"0" cellpadding=3D"0" align=3D"center"=
>=0A
=3D"x_x_contentwidth" border=3D"0" width=3D"810" cellspacing=3D"0" cellpadd=
ing=3D"0" align=3D"center" bgcolor=3D"#E4EFF8">=0A
=0A =0A =0A =0A =0A
e>=0A =0A =0A =0A =0A
=0A
sbank-stuttgart.de/o/BO8ChSqApV3rnLh7NDF3K0CjgW77lgcLL98Uz2ea-fh2c6E1_ots.g=
if" alt=3D"" width=3D"1" height=3D"1" data-imagetype=3D"External" />
lD905681495284
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments