td bank phish from Google Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Feb 2024 05:34:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rVWFr-00000000O6A-4BmQ

for dave@doctor.nl2k.ab.ca;

Thu, 01 Feb 2024 05:33:19 -0700

Resent-From: The Doctor

Resent-Date: Thu, 1 Feb 2024 05:33:19 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-il1-f230.google.com ([209.85.166.230]:42183)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rVVW3-00000000OwV-0epa

for root@nk.ca;

Thu, 01 Feb 2024 04:46:03 -0700

Received: by mail-il1-f230.google.com with SMTP id e9e14a558f8ab-3638b5f8240so2277145ab.0

for ; Thu, 01 Feb 2024 03:44:04 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=code.edu.az; s=google; t=1706787838; x=1707392638; darn=nk.ca;

h=from:subject:content-transfer-encoding:message-id:date:mime-version

:from:to:cc:subject:date:message-id:reply-to;

bh=tEpHtKotjH+ROlqHaSSFbK6zMlfylLhyL50GLPUnyCs=;

b=iqGsGNsQ4EZW/ZXz7O77sPChfyny5xYPh4YoXSX+lS6dAgw5rCtodjkP2RzKt3JWDB

FxhDa9xuDtMFzKZrrFwA5U4cSgPKroZMYJ3VSW0uBIoIcM7CGHUvmfRzjudKJn03OO84

1tTfri4O12ZOXnQK3Bs2t/j5a2xmPaKaKehHc=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1706787838; x=1707392638;

h=from:subject:content-transfer-encoding:message-id:date:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=tEpHtKotjH+ROlqHaSSFbK6zMlfylLhyL50GLPUnyCs=;

b=G6eYpup3A8/tksdNQbXzhoItguyQL+nTRTlecw9OXOGLk7VX2QzMbDy5XlxgKLNg9X

4Whk0oXaYIDqsogEJJRorWcpbRnJc489aq2zi62YFIkIlgdiz9/TFlIek6pXQx+Clc2p

hdWd52+pUNArMKvNhjeuYWcXUueu+Db73hbI3aDIIRbon8DZMxy1YTphcZCW3HkUh/tL

Ou8DpnEcMUvzuICoq1oik/jtf1h2pvMSSxn860ovKW2UtKXcSO3PBrjz/02LfWTLCEqw

zNwfK2KlaliqoodDCP1xSIWnnDAdDXAcundzDRDqxA1VQeIBOt9DUsIzEmd69A0ADeRy

OJ5A==

X-Gm-Message-State: AOJu0YxUbOjV1EsxDRoIReuv5eyYP7MbSW0Fhcwm4Bna9x2QOakPfasf

OmQyvGCobyXuW4xbkwZz96qCpF8bVtUeXrkgoq3s6YGqy5naGL0se1OwKPaMjpNhnzVxPw+Z69I

WZc2zpvB8nxBD4P5HfkDcBKzlJiEttsSZ

X-Google-Smtp-Source: AGHT+IEhVTYfyC2B06LZIr0zpt824PwW/FAKPEItm2WeKCgs8pkmUmK6lwWQU9vaIjZ5BBNAgmZqCrm5NAj+

X-Received: by 2002:a05:6e02:1d83:b0:363:8985:e852 with SMTP id h3-20020a056e021d8300b003638985e852mr3475293ila.16.1706787838625;

Thu, 01 Feb 2024 03:43:58 -0800 (PST)

X-Forwarded-Encrypted: i=0; AJvYcCWZhZQ1affys3rcx+brZCW9TpdFi490Nc8nL41PLaWk+p1UYslEywsxwHtBa/lKIm2nDy+E8fQCeSzfUYk404wCQwJU49WqHg3BFN/Xojli8/m2lDg2gYEKcMTofHd/kYH6LOzXmP6KQwLgkmFipX8q0i0SNpKBktT/yx0Ri+KNlMG/Ky/TY06WhbulohIEmmK7THGG8UyVaDlYB6yGQSlciWXayDDxJiXykwHfM37J3WubiE6SSx8kKw+Y4WUCyjOQzePhk4v+7wQrjuuIGIbtz7wmHEMIZfmikrc3wizM821smiBvaSLE65D9tsfaK9kr6OFFMOd6JUggo+Dj+l+iTj3t1/c5jiyG/oVEhA1f3F30ZaT/AkUzVULRqvppmN1jTZALHs146kgTH8s9fNoaJITi5vAVqfMO9zhf8wXQYjBiu7hl2rgzSL97RcM36ei/MuUZxSg5BP8haS6pPQLbbU0n9HmXQ3b/CmYWLgkVBh/JNQED2bkIpVZtJzguC/9bZzGldUQUxVWuKqAHPreB4GLqIYRvKUbKSt825oKD5L1C4RErl4bhxJTagQZ3cDUw8dNBYi5uq/K20/G25a4scBMmLWSshigKjS5p8NtYRrxK+goJmnrgtzdqiNMKPmJ44npqvOBNd7KEfr/A7U/vqGhVQbexbXAbwBdTpwHjbpoe01CriCoru25eOKV8SzutXIF0qCDdq79wq+FlPojwfUsgFF5uirle3ozZ91BYRsTIxeP2qlIQFk0K9zVmcZvAmWS3crmMG8LliDIBnReUfjGEVAiFkLUSFO3CxrXSqhI9+vbDlXtGVNgBqAXsuVYOnPYZaZAi81NX6lGRrZqTAwpmwM8SfV/LsE4AIfWuhqjguMDv3kGVK2iL7uA3gVChUpnqz+NA7xEJFBsH6o5zXIR8cKTqNfJ1WDKiDA771EjsU2UVvYaV81vDD43g5Tf8ep

jisnxSAP18TA6jAOgYdN/KRWDAezW8KZstO8en8tHAR4J9DgePBGgKdD6o6oETGOVbp1A3ss3CdRak5Hinkr7opLrcT8NjFFls2TSMh/w9PrKJLBiM85P/LY2/UIJ6QppTxUUcjBQT9eWa4ft1Wa3fWwcEZokrMfZv7T8y8r7jUgdGbM1+kNKwFiv2jHS358J9vAbEywaY/7xxjZwEgKPKyP7q/OarqR28fXRVeRTrdAwYZ8NftQiYJir3T/NFtoUeX2Jyb3M0VuF1vne00ux/Cg4ZJ6wigjo4frkHuYDlKkJ4Vb1C2tBUWBxVkL/A4Mt+rruzJaj/33zmM4qOPqJ1nPq3cpYdPLm4Ot0pe2Ibv8OahSStUNfRzw0S+ouXeigJLCDXQHXSGnRfMH4QyHbnmazTfP3A6dp3bmqNyMS785HI8/1xFiJHGu+bgh1VPM0hsgxuYdG5fXgiCNVSD1O/U+FVa1ThT2DW4aHb7KCH6uXbz1SeOpJAlIHk6M6A7gO3YaKrSJljDRTTyyWIIhdMBaNbFd/oDWyYLgSvoy32dvyG2g9Rr7BnF0QcPIxkK0g7dqGarDWMk0583HGWgb72

Received: from cs-59267701671-default (ool-2f141eac.dyn.optonline.net. [47.20.30.172])

by smtp-relay.gmail.com with ESMTPS id n6-20020a056e02148600b0036275778e13sm19703ilk.23.2024.02.01.03.43.58

(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);

Thu, 01 Feb 2024 03:43:58 -0800 (PST)

X-Relaying-Domain: code.edu.az

MIME-Version: 1.0

Date: Thu, 01 Feb 2024 11:42:50 +0000

Message-ID: <7E7ED8B714ADAEAFE5C159FFE0C1561DF41B592F@unknown>

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

X-Priority: 3 (Normal)

Subject: Fwd:Last reminder!

From: =?utf-8?Q?=D0=A2D_=D0=A1=D0=B0n=D0=B0d=D0=B0_=D0=A2ru=D1=95t?=

X-Spam_score: 9.5

X-Spam_score_int: 95

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Ladies and Gentlemen, In the next few weeks we are preparing

to overhaul our systems. In order to function properly, it is necessary that

all customers register. Otherwise, data loss and delays may occur. Please

register a [...]



Content analysis details: (9.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.166.230 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.2 MISSING_HEADERS Missing To: header

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.166.230 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

3.0 URI_WP_DIRINDEX URI for compromised WordPress site, possible malware

1.0 UNICODE_OBFU_ASC Obfuscating text with unicode

0.0 TVD_PH_BODY_ACCOUNTS_POST No description available.

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.6 TVD_PH_BODY_META_ALL No description available.

2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware

Subject: {SPAM?} Fwd:Last reminder!

X-Antivirus: AVG (VPS 240201-0, 1/31/2024), Inbound message

X-Antivirus-Status: Clean




=3Dutf-8">
=0A
=0A

; line-height: 1.23;">=0A
idth=3D"550" cellspacing=3D"0" cellpadding=3D"0" align=3D"center">=0A
body>=0A
=0A

3.636px;" align=3D"center" bgcolor=3D"#DFDFDF">=0A
ullimg810" border=3D"0" width=3D"810" cellspacing=3D"0" cellpadding=3D"0" a=

lign=3D"center">=0A =0A =0A

rOver" align=3D"center">=0A
0" width=3D"810" cellspacing=3D"0" cellpadding=3D"0" align=3D"center">=0A =

=0A =0A =0A =0A =0A
able>=0A =0A =0A =0A

r" bgcolor=3D"#FFFFFF">=0A
g=3D"0" cellpadding=3D"0" align=3D"center">=0A =0A =0A =

=

=0A =0A =0A =0A =0A =

=0A
 

nter">=0A
ng=3D"0" align=3D"center">=0A =0A =0A =

=0A =0A =0A =0A =0A =

=0A =0A =0A =0A

placeholderOver" align=3D"center">=0A
dth" border=3D"0" width=3D"85%" cellspacing=3D"0" cellpadding=3D"0" align=

=3D"center">=0A =0A =0A =0A =0A =0A <=

/table>=0A =0A =0A =0A

,Helvetica,sans-serif; font-size: 16px; color: #58585a; line-height: 24px;"=

align=3D"left" valign=3D"top">=0A


color: #008a00;">Ladies and Gentlemen,

<=

br aria-hidden=3D"true" />

=0A
In the next few weeks we are prep=

aring to overhaul our systems. In order to function properly, it is necessa=

ry that all customers register. Otherwise, data loss and delays may occur. =

Please register as soon as possible.
=0A

>=0A
What should you do to continue using our service?
=0A =

1. Log in to our homepag=

e.
2. Complete the requested steps.

n=3D"true" />3. Make sure your details are correct.

=0A
=0A <=

div class=3D"x_x_contentSnippetWrapper">=0A
"100%" cellspacing=3D"0" cellpadding=3D"0">=0A =0A =0A =

=0A =

=0A =0A
=0A
cellspacing=3D"0" cellpadding=3D"0">=0A =0A =0A =0A =0A =0A

gn=3D"left">=0A
lor: #008a00;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">=0A
dy>=0A
=0A =0A =0A =0A

ter">=0A
=3D"center">=0A =0A =0A =0A =0A
>=0A

ont-family: Arial,Helvetica,sans-serif; color: #555; padding-top: 3px;" ali=

gn=3D"center" valign=3D"top">
one;" href=3D"https://ontwerpenmeer.nl/wp-includes/assets/" target=3D"_blan=

k" rel=3D"noopener noreferrer" data-auth=3D"NotApplicable" data-linkindex=

=3D"0">L=D0=BEg ln >
=0A
=0A =

=0A
=0A
=0A =0A
=0A =

=0A

If they do not log in by the specified date, we will be forc=

ed to deactivate their account. If you then want to reactivate your account=

=2E They will be charged a fee.

=0A
=0A
We look forward=

to seeing you!
=0A
=D0=A2D =D0=A1=D0=B0n=D0=B0d=D0=B0 =D0=A2r=

u=D1=95t.
=0A
=0A
=0A

1px; line-height: 1px;" height=3D"20"> 
 =

=0A
=0A
=0A
rder=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" align=3D"cent=

er">=0A =0A =0A =0A =0A =0A=


">=0A
cing=3D"0" cellpadding=3D"0" align=3D"center">=0A =0A =0A =

=0A
tr>=0A =0A
=0A
0" width=3D"810" cellspacing=3D"0" cellpadding=3D"0" align=3D"center">=0A =

=0A =0A =0A =0A =0A
=0A =


n=3D"center">=0A =0A =0A =0A =0A =0A =


ine-height: 1px;" height=3D"30"> 
=0A
dding=3D"0" align=3D"center">=0A =0A =0A =0A =0A =0A

enter">=0A
lspacing=3D"0" cellpadding=3D"0" align=3D"left">=0A =0A =

=0A =0A =0A =

=0A
=0A
quid85_320" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0"=

align=3D"center">=0A =0A =0A =0A =0A
>=0A
=0A =0A =

=0A

Arial,Helvetica,sans-serif; font-size: 14px; line-height: 23px; color: #ff=

ffff; font-weight: bold;" align=3D"left">Contact
 
=0A
5_320" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0">=0A =

=0A =0A =0A =0A =0A =0A =0A =0A =0A =0A =0A =

=0A =0A =0A =0A =0A =0A =0A =0A =0A <=

/tr>=0A =0A

align=3D"left" valign=3D"top" width=3D"30"> 

font-family: Arial,Helvetica,sans-serif; font-size: 14px; line-height: norm=

al; color: #ffffff; font-weight: normal;" align=3D"left">TD =D0=92=D0=B0nk<=

/td>=0A

h=3D"30" height=3D"10"> 

=3D"font-size: 1px; line-height: 1px;" align=3D"left" valign=3D"top" width=

=3D"30"> 

rif; font-size: 14px; line-height: normal; color: #ffffff; font-weight: nor=

mal;" align=3D"left">10 York Mills Rd. 3rd Fl=

oor
 Toronto, ON M2P 0A2

0"> 

,Helvetica,sans-serif; font-size: 14px; line-height: 23px; color: #ffffff; =

font-weight: normal;" align=3D"left" width=3D"30"> 

le=3D"font-family: Arial,Helvetica,sans-serif; font-size: 14px; line-height=

: 23px; color: #ffffff; font-weight: normal;" align=3D"left">
lor: #ffffff; text-decoration: none;" href=3D"mailto:info@volksbank.de" dat=

a-linkindex=3D"1">info@td.ca

s=3D"x_x_slim" colspan=3D"2" width=3D"30" height=3D"10"> 
=0A
=0A
=0A =


gn=3D"center">=0A =0A =0A =0A =0A =0A =0A =0A
 
td>=0A

1px;" height=3D"30"> 
=

=0A
=0A
=0A
=0A
lpadding=3D"0" align=3D"center">=0A =0A =0A

=3D"center" bgcolor=3D"#DFDFDF">=0A
er=3D"0" width=3D"810" cellspacing=3D"0" cellpadding=3D"0" align=3D"center"=

>=0A =0A =0A =0A =0A =0A
e>=0A =0A =0A =0A
=0A
=3D"x_x_contentwidth" border=3D"0" width=3D"810" cellspacing=3D"0" cellpadd=

ing=3D"0" align=3D"center" bgcolor=3D"#E4EFF8">=0A =0A =0A=

=0A =0A =

=0A
 
=0A
=0A =0A =

=0A
 
=0A


sbank-stuttgart.de/o/BO8ChSqApV3rnLh7NDF3K0CjgW77lgcLL98Uz2ea-fh2c6E1_ots.g=

if" alt=3D"" width=3D"1" height=3D"1" data-imagetype=3D"External" />

=0A=

lD905681495284

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA