Phish email attack nk.ca using sharepoint, a service nk.ca does not use
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 21 Jun 2024 04:34:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1sKba8-00000000OKd-0NuC
for dave@doctor.nl2k.ab.ca;
Fri, 21 Jun 2024 04:33:24 -0600
Resent-From: The Doctor
Resent-Date: Fri, 21 Jun 2024 04:33:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from static.56.254.40.188.clients.your-server.de ([188.40.254.56]:42884 helo=fileqw.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1sKWa7-000000006XK-3iAn
for sales@nk.ca;
Thu, 20 Jun 2024 23:13:07 -0600
Received: by fileqw.com (Postfix, from userid 33)
id 576BAA82E3; Thu, 20 Jun 2024 16:46:08 +0200 (CEST)
To: sales@nk.ca
Subject: Nk (2) new private documents
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8BIT
Importance: High
Message-ID: <1698f421-7d42-4f0f-8d7a-f4af03a08e16@AM0PR0702MB3539.eurprd07.prod.outlook.com>
From: Nk Sharepoint Online
Date: Thu, 20 Jun 2024 16:46:08 +0200 (CEST)
X-Spam_score: 14.0
X-Spam_score_int: 140
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Nk SharePoint Management Nk shared 2 new private document
to you.
Content analysis details: (14.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[188.40.254.56 listed in dnsbl.ahbl.org]
[188.40.254.56 listed in dnsbl.ahbl.org]
[188.40.254.56 listed in dnsbl.ahbl.org]
[188.40.254.56 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[188.40.254.56 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[188.40.254.56 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[188.40.254.56 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[188.40.254.56 listed in dnsbl.ahbl.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
4.0 GR_DOMAIN_YOUSER1 Received contains spam friendly ISP (youser)
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[188.40.254.56 listed in will-spam-for-food.eu.org]
[188.40.254.56 listed in will-spam-for-food.eu.org]
[188.40.254.56 listed in will-spam-for-food.eu.org]
[188.40.254.56 listed in will-spam-for-food.eu.org]
[188.40.254.56 listed in will-spam-for-food.eu.org]
[188.40.254.56 listed in will-spam-for-food.eu.org]
[188.40.254.56 listed in will-spam-for-food.eu.org]
[188.40.254.56 listed in will-spam-for-food.eu.org]
0.8 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)
0.6 TO_NO_BRKTS_HTML_ONLY To: misformatted and HTML only
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 AC_FROM_MANY_DOTS Multiple periods in From user name
Subject: {SPAM?} Nk (2) new private documents
font-variant-caps: normal; font-variant-numeric: inherit; font-variant-east-asian: inherit; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;" border="0" cellspacing="0" cellpadding="0">
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 21 Jun 2024 04:34:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1sKba8-00000000OKd-0NuC
for dave@doctor.nl2k.ab.ca;
Fri, 21 Jun 2024 04:33:24 -0600
Resent-From: The Doctor
Resent-Date: Fri, 21 Jun 2024 04:33:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from static.56.254.40.188.clients.your-server.de ([188.40.254.56]:42884 helo=fileqw.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1sKWa7-000000006XK-3iAn
for sales@nk.ca;
Thu, 20 Jun 2024 23:13:07 -0600
Received: by fileqw.com (Postfix, from userid 33)
id 576BAA82E3; Thu, 20 Jun 2024 16:46:08 +0200 (CEST)
To: sales@nk.ca
Subject: Nk (2) new private documents
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8BIT
Importance: High
Message-ID: <1698f421-7d42-4f0f-8d7a-f4af03a08e16@AM0PR0702MB3539.eurprd07.prod.outlook.com>
From: Nk Sharepoint Online
Date: Thu, 20 Jun 2024 16:46:08 +0200 (CEST)
X-Spam_score: 14.0
X-Spam_score_int: 140
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Nk SharePoint Management Nk shared 2 new private document
to you.
Content analysis details: (14.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[188.40.254.56 listed in dnsbl.ahbl.org]
[188.40.254.56 listed in dnsbl.ahbl.org]
[188.40.254.56 listed in dnsbl.ahbl.org]
[188.40.254.56 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[188.40.254.56 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[188.40.254.56 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[188.40.254.56 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[188.40.254.56 listed in dnsbl.ahbl.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
4.0 GR_DOMAIN_YOUSER1 Received contains spam friendly ISP (youser)
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[188.40.254.56 listed in will-spam-for-food.eu.org]
[188.40.254.56 listed in will-spam-for-food.eu.org]
[188.40.254.56 listed in will-spam-for-food.eu.org]
[188.40.254.56 listed in will-spam-for-food.eu.org]
[188.40.254.56 listed in will-spam-for-food.eu.org]
[188.40.254.56 listed in will-spam-for-food.eu.org]
[188.40.254.56 listed in will-spam-for-food.eu.org]
[188.40.254.56 listed in will-spam-for-food.eu.org]
0.8 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)
0.6 TO_NO_BRKTS_HTML_ONLY To: misformatted and HTML only
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 AC_FROM_MANY_DOTS Multiple periods in From user name
Subject: {SPAM?} Nk (2) new private documents
font-variant-caps: normal; font-variant-numeric: inherit; font-variant-east-asian: inherit; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;" border="0" cellspacing="0" cellpadding="0">
| Nk SharePoint Management | ||
Nk shared 2 new private document to you.
Preview & Download It Now::
Message is an automated message sent to s*****@nk.ca
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments