Ryobi one phish from Microsoft Outlook
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 19 Feb 2024 18:28:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rcEuy-00000000MDd-3NoN
for dave@doctor.nl2k.ab.ca;
Mon, 19 Feb 2024 18:27:32 -0700
Resent-From: The Doctor
Resent-Date: Mon, 19 Feb 2024 18:27:32 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-be0deu01on2105.outbound.protection.outlook.com ([40.107.127.105]:44352 helo=DEU01-BE0-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rcEK4-00000000Dcl-0zXw
for doctor@doctor.nl2k.ab.ca;
Mon, 19 Feb 2024 17:49:28 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=hg++3TQNEw+LMYhHThwVPD6s95dFRfzox20JpMx4YxaFpqTnsbszg7ltGztHWo8ROeDl5pxZYngOpHrxNliOo863G4NWguZP2PcFYTewoJtrAYvOX1pWNwEP64xE0s+VnNLZH9tjEE1ZkJLjjaG1um9vODDE3B8oL7dcX7xjLEwptL6FayXSGuQEHD1gcK5ykwp1VyuflUNIx0mIDHjZ3umiZsbhZl4sSUEhYvd+vnQWvW8xxClVdXGveOC7FhNgKxjpCSjI6oOdxX6pTDcaxyIvzaAdDjYc6iy86dyW8JMOwjAAygspGC3PzLxufrXJLNVZuvgMYunPmtPgH/IBPg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=WSk4pCwCayg+HpRuGcOvi91kXE1rTbj6c4t5tgWQTyo=;
b=WxJWt9YxJxersxtniHW8Ii9h8Jx/eEJN5ztd1UcexwshLMP+WaMYH6L2GqizcrECUhWDKC/6cGI2Oj9j7kkwqpcRkSgr5fcXubxllr/OREeJcUrr4YNG8wftYUBfKsxr+RbTHCka7R0HatbJ4LedNdERC4d1bVhV29MWhwmXrG2fIdVEe0fimsyudxk13wafJ2yyRjBz8Xe74Tr4l0aFKakSUZ6rNOwG77yhh2g+nTJGrN2rc8YLL+AFWPjE7DSRs65M3f4ze7q9q/pezLYNBZoAEfzN/OJR2UJkIi9uKHCeq1oA+Q84VsH2PbQNju0K8t/ZiW83znaf7Hix8InwGw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
141.8.194.43) smtp.rcpttodomain=doctor.nl2k.ab.ca
smtp.mailfrom=hbdokmwt.onmicrosoft.com; dmarc=none action=none
header.from=hbdokmwt.onmicrosoft.com; dkim=none (message not signed);
arc=none (0)
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 141.8.194.43)
smtp.mailfrom=hbdokmwt.onmicrosoft.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=hbdokmwt.onmicrosoft.com;
MIME-Version: 1.0
From: Deals
To: doctor
Subject: Shipment Pending - Ryobi One Chainsaw
Date: Tue, 20 Feb 2024 01:45:42 +0100
x-priority: 1
Content-Type: multipart/alternative; charset="UTF-8";boundary="d4uTz0QPnKHYKXK.xlfejnpkgu.43619"
Delivered-To: doctor
Reply-To: Deals
X-Sender: admin@hbdokmwt.onmicrosoft.com
Message-ID:
<364d1790-052e-4fec-96ec-4b3aa6c1beea@BE0DEU01FT003.eop-deu01.prod.protection.outlook.com>
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: BE0DEU01FT003:EE_|FR2P281MB2687:EE_
X-MS-Office365-Filtering-Correlation-Id: 37ba9a88-0944-4428-e426-08dc31ad7d1a
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
gTt/A1xh/FqR4AvurGUqjFgue4LKqJE1oXYBD1tgqUnSmR1gcSSuTOmC7kY+IkA9sHnr/pNpRFpzx5e7Q6GS6QbNbh+aW16w2HIoPwkfOwqVE6Ga+umqWcMymTCYYMn1ogrtTN9hFAd0msT1woOhTSY2/bE3OtbiSjHmoPZs+Gc813DY4mWRes7CmvUvLsM1fEU95qDTF5b2duBXQDe/ChvGMe4PJdKMOBzTTrIwcXb4j+gqMu3UMrG1FYEps8HsEJ0ir1Aar0Gr1/xso2IsUxHg5IKyuIxYkMSiVe+9gOh8IE0gli8Ww8wDjiE4csGvui5vsX3mT9r0/dzXjCESFS7Vx3iatpEaA0CfCklPvU6XcrkB6diKr1UdQSWXhoXH
X-Forefront-Antispam-Report:
CIP:141.8.194.43;CTRY:RU;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.vizio.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230031)(36860700004)(7200799017)(46966006)(40470700004);DIR:OUT;SFP:1102;
X-OriginatorOrg: hbdokmwt.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Feb 2024 00:47:17.6379
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 37ba9a88-0944-4428-e426-08dc31ad7d1a
X-MS-Exchange-CrossTenant-Id: 51342385-4adc-4e08-bc54-ffeb5ae20642
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=51342385-4adc-4e08-bc54-ffeb5ae20642;Ip=[141.8.194.43];Helo=[mail.vizio.com]
X-MS-Exchange-CrossTenant-AuthSource:
BE0DEU01FT003.eop-deu01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: FR2P281MB2687
X-Spam_score: 19.7
X-Spam_score_int: 197
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: doctor(371045762904643567694237871994)
Content analysis details: (19.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[40.107.127.105 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.107.127.105 listed in wl.mailspike.net]
0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.0 ARC_VALID Message has a valid ARC signature
0.0 ARC_SIGNED Message has a ARC signature
0.6 HK_RANDOM_ENVFROM Envelope sender username looks random
1.0 HK_RANDOM_REPLYTO Reply-To username looks random
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[lwvmofeh.dffcyozo(at)hbdokmwt.onmicrosoft.com]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image
1.5 URI_IMG_CWINDOWSNET Non-MSFT image hosted by Microsoft Azure infra,
possible phishing
1.0 FORGED_SPF_HELO No description available.
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 SCC_BODY_SINGLE_WORD Message body seems like one word
0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for
an image
1.0 HOSTED_IMG_FREEM Image hosted at large ecomm, CDN or hosting site or
redirected, freemail from or reply-to
3.5 HOSTED_IMG_DIRECT_MX Image hosted at large ecomm, CDN or hosting
site, message direct-to-mx
1.0 XPRIO Has X-Priority header
2.7 SCC_BODY_URI_ONLY Very short body with something maybe clickable
0.0 BODY_SINGLE_WORD Message body is only one word (no spaces)
1.2 BODY_SINGLE_URI Message body is only a URI
0.0 T_REMOTE_IMAGE Message contains an external image
1.8 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
Subject: {SPAM?} Shipment Pending - Ryobi One Chainsaw
--d4uTz0QPnKHYKXK.xlfejnpkgu.43619
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset="UTF-8"
doctor(371045762904643567694237871994)
--d4uTz0QPnKHYKXK.xlfejnpkgu.43619--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 19 Feb 2024 18:28:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rcEuy-00000000MDd-3NoN
for dave@doctor.nl2k.ab.ca;
Mon, 19 Feb 2024 18:27:32 -0700
Resent-From: The Doctor
Resent-Date: Mon, 19 Feb 2024 18:27:32 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-be0deu01on2105.outbound.protection.outlook.com ([40.107.127.105]:44352 helo=DEU01-BE0-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rcEK4-00000000Dcl-0zXw
for doctor@doctor.nl2k.ab.ca;
Mon, 19 Feb 2024 17:49:28 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=hg++3TQNEw+LMYhHThwVPD6s95dFRfzox20JpMx4YxaFpqTnsbszg7ltGztHWo8ROeDl5pxZYngOpHrxNliOo863G4NWguZP2PcFYTewoJtrAYvOX1pWNwEP64xE0s+VnNLZH9tjEE1ZkJLjjaG1um9vODDE3B8oL7dcX7xjLEwptL6FayXSGuQEHD1gcK5ykwp1VyuflUNIx0mIDHjZ3umiZsbhZl4sSUEhYvd+vnQWvW8xxClVdXGveOC7FhNgKxjpCSjI6oOdxX6pTDcaxyIvzaAdDjYc6iy86dyW8JMOwjAAygspGC3PzLxufrXJLNVZuvgMYunPmtPgH/IBPg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=WSk4pCwCayg+HpRuGcOvi91kXE1rTbj6c4t5tgWQTyo=;
b=WxJWt9YxJxersxtniHW8Ii9h8Jx/eEJN5ztd1UcexwshLMP+WaMYH6L2GqizcrECUhWDKC/6cGI2Oj9j7kkwqpcRkSgr5fcXubxllr/OREeJcUrr4YNG8wftYUBfKsxr+RbTHCka7R0HatbJ4LedNdERC4d1bVhV29MWhwmXrG2fIdVEe0fimsyudxk13wafJ2yyRjBz8Xe74Tr4l0aFKakSUZ6rNOwG77yhh2g+nTJGrN2rc8YLL+AFWPjE7DSRs65M3f4ze7q9q/pezLYNBZoAEfzN/OJR2UJkIi9uKHCeq1oA+Q84VsH2PbQNju0K8t/ZiW83znaf7Hix8InwGw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
141.8.194.43) smtp.rcpttodomain=doctor.nl2k.ab.ca
smtp.mailfrom=hbdokmwt.onmicrosoft.com; dmarc=none action=none
header.from=hbdokmwt.onmicrosoft.com; dkim=none (message not signed);
arc=none (0)
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 141.8.194.43)
smtp.mailfrom=hbdokmwt.onmicrosoft.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=hbdokmwt.onmicrosoft.com;
MIME-Version: 1.0
From: Deals
To: doctor
Subject: Shipment Pending - Ryobi One Chainsaw
Date: Tue, 20 Feb 2024 01:45:42 +0100
x-priority: 1
Content-Type: multipart/alternative; charset="UTF-8";boundary="d4uTz0QPnKHYKXK.xlfejnpkgu.43619"
Delivered-To: doctor
Reply-To: Deals
X-Sender: admin@hbdokmwt.onmicrosoft.com
Message-ID:
<364d1790-052e-4fec-96ec-4b3aa6c1beea@BE0DEU01FT003.eop-deu01.prod.protection.outlook.com>
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: BE0DEU01FT003:EE_|FR2P281MB2687:EE_
X-MS-Office365-Filtering-Correlation-Id: 37ba9a88-0944-4428-e426-08dc31ad7d1a
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
gTt/A1xh/FqR4AvurGUqjFgue4LKqJE1oXYBD1tgqUnSmR1gcSSuTOmC7kY+IkA9sHnr/pNpRFpzx5e7Q6GS6QbNbh+aW16w2HIoPwkfOwqVE6Ga+umqWcMymTCYYMn1ogrtTN9hFAd0msT1woOhTSY2/bE3OtbiSjHmoPZs+Gc813DY4mWRes7CmvUvLsM1fEU95qDTF5b2duBXQDe/ChvGMe4PJdKMOBzTTrIwcXb4j+gqMu3UMrG1FYEps8HsEJ0ir1Aar0Gr1/xso2IsUxHg5IKyuIxYkMSiVe+9gOh8IE0gli8Ww8wDjiE4csGvui5vsX3mT9r0/dzXjCESFS7Vx3iatpEaA0CfCklPvU6XcrkB6diKr1UdQSWXhoXH
X-Forefront-Antispam-Report:
CIP:141.8.194.43;CTRY:RU;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.vizio.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230031)(36860700004)(7200799017)(46966006)(40470700004);DIR:OUT;SFP:1102;
X-OriginatorOrg: hbdokmwt.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Feb 2024 00:47:17.6379
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 37ba9a88-0944-4428-e426-08dc31ad7d1a
X-MS-Exchange-CrossTenant-Id: 51342385-4adc-4e08-bc54-ffeb5ae20642
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=51342385-4adc-4e08-bc54-ffeb5ae20642;Ip=[141.8.194.43];Helo=[mail.vizio.com]
X-MS-Exchange-CrossTenant-AuthSource:
BE0DEU01FT003.eop-deu01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: FR2P281MB2687
X-Spam_score: 19.7
X-Spam_score_int: 197
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: doctor(371045762904643567694237871994)
Content analysis details: (19.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[40.107.127.105 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.107.127.105 listed in wl.mailspike.net]
0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.0 ARC_VALID Message has a valid ARC signature
0.0 ARC_SIGNED Message has a ARC signature
0.6 HK_RANDOM_ENVFROM Envelope sender username looks random
1.0 HK_RANDOM_REPLYTO Reply-To username looks random
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[lwvmofeh.dffcyozo(at)hbdokmwt.onmicrosoft.com]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image
1.5 URI_IMG_CWINDOWSNET Non-MSFT image hosted by Microsoft Azure infra,
possible phishing
1.0 FORGED_SPF_HELO No description available.
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 SCC_BODY_SINGLE_WORD Message body seems like one word
0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for
an image
1.0 HOSTED_IMG_FREEM Image hosted at large ecomm, CDN or hosting site or
redirected, freemail from or reply-to
3.5 HOSTED_IMG_DIRECT_MX Image hosted at large ecomm, CDN or hosting
site, message direct-to-mx
1.0 XPRIO Has X-Priority header
2.7 SCC_BODY_URI_ONLY Very short body with something maybe clickable
0.0 BODY_SINGLE_WORD Message body is only one word (no spaces)
1.2 BODY_SINGLE_URI Message body is only a URI
0.0 T_REMOTE_IMAGE Message contains an external image
1.8 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
Subject: {SPAM?} Shipment Pending - Ryobi One Chainsaw
--d4uTz0QPnKHYKXK.xlfejnpkgu.43619
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset="UTF-8"
|
--d4uTz0QPnKHYKXK.xlfejnpkgu.43619--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments