SiriusXM phish from OVH and Microsoft

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 30 Jul 2024 15:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sYtxS-000000009Wl-1BKb

for dave@doctor.nl2k.ab.ca;

Tue, 30 Jul 2024 15:00:34 -0600

Resent-From: The Doctor

Resent-Date: Tue, 30 Jul 2024 15:00:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip220.ip-15-204-30.us ([15.204.30.220]:55795 helo=mailanyone.net)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sYskR-00000000LF1-1AcH

for doctor@doctor.nl2k.ab.ca;

Tue, 30 Jul 2024 13:43:09 -0600

Received: from NAM04-MW2-obe.outbound.protection.outlook.com (mail-mw2nam04on20717.outbound.protection.outlook.com. [2a01:111:f403:240a::948])

by mx.google.com with ESMTPS id d{n,4}c01a{n,4}-1fac157b494si19763565ad.411.2024.06.28.06.38.{n,2}

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES948-GCM-SHA256 bits=124/124);

[email_date]

Received: from CH2PEPF00000148.namprd02.prod.outlook.com

(2603:10b6:610:32:cafe::5d) by CH0PR07CA0027.outlook.office365.com

(2603:10b6:610:32::32) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7762.29 via Frontend

Transport; [email_date]

Authentication-Results: spf=pass (sender IP is 172.82.239.10)

smtp.mailfrom=ecom1.logitech.com; dkim=pass (signature was verified)

header.d=ecom1.logitech.com;dmarc=pass action=none

header.from=ecom1.logitech.com;compauth=pass reason=100

Received-SPF: Pass (protection.outlook.com: domain of ecom1.logitech.com

designates 172.82.239.10 as permitted sender)

receiver=protection.outlook.com; client-ip=172.82.239.10;

helo=r10.email.circle.logi.com; pr=C

Received: from r10.email.circle.logi.com (172.82.239.10) by

CH2PEPF00000148.mail.protection.outlook.com (10.167.244.105) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.7784.11 via Frontend Transport; [email_date]

X-IncomingTopHeaderMarker:

OriginalChecksum:6358AF3B258C1BDB0F3ED64FE856BAC9662515C74626328B54DCEBF92274B956;UpperCasedChecksum:5327CC64E06FE43FD5101DD8A956F60F04F8DF58045B850976A73B640D0165AC;SizeAsReceived:1877;Count:14

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ecom1.logitech.com;

s=logitech; t=1721117047;

bh=0B/6bTXPHYx3e3G5RVajiPcww6i9oJf3Jdw234zprSg=;

h=From:Date:Subject:To:MIME-Version:Message-ID:Content-Type;

b=doeP62K0azYfUo2gfef4ZVGID5uyW5ForKu+hXm0eVvczRdBoT9hNHe0m5AZPyavM

wrq5qf8gZ/UIwqdT8+Y/j5RDFhn/M7NyVxhMCMqJ1Ou3HllLEk91bbrwMDfN/7CkGh

fBIjUbwImC5HZimeUB5KkB6vKxWhaunKz2/hNO26CrN2Y1zkPdEPcy4YaD73BNblSL

VywV87fIqKXadpAR1ESIxYiUzyK0CatJpIEbcYtKuUcWQ1lpvn382SGYtnSTjf+mwo

zQA1PQsgo4yJr8o0qNV2KyheGErYV/Samb4z2k3e5TsSBu+fsDVHNTEoPhRV/sn9aN

2DBv+4tC5GeDw==

X-MSFBL: fhH0F7QIWB8j5+dy6gCsnqngGOs32SZvXX0SXEeVBRc=|eyJnIjoiZGVmYXVsdF9

jNGUyYzBhNy1kNmEyLTQ5NmQtYjY2Ni0xNjEzZDc0YjUzMDUiLCJyIjoicW94dWJ

la0BvdXRsb29rLmNvbSIsImIiOiJhd3NfbG9naXRlY2hfcHJvZDFfZGVmYXVsdF9

tb21lbnR1bTEyX210YTAwNF8xNzIuODIuMjM5LjEwIiwicmNwdF9tZXRhIjp7ICJ

pbiI6ICJsb2dpdGVjX21rdF9wcm9kMSIsICJyIjogInFveHViZWtAb3V0bG9vay5

jb20iLCAibSI6ICIxMDA4MzA4OTA4IiwgImQiOiAiNDM2NDI2MTMzIiwgImkiOiA

iOTcwRkFBNjM1N0Y1MzNCQjBBNDk1Q0M4QEFkb2JlT3JnIiB9fQ==

Received: from aws1-mta-relay7.sailthru.cloud (10.55.90.61) by condenast-b.sailthru.com id hia50g3791sc for ; Sat, 13 Jul 2024 09:06:56 -0500 (envelope-from )

Content-Type: multipart/alternative; boundary="----=_Part_9006_1222595691.1721141065958"

Date: [email_date]

From: "'SiriusXM Membership"'

Mime-Version: 1.0

Message-ID:

Subject: Your membership has expired!

X-Feedback-ID: 92395105:SG

X-SG-EID: u001.VRuSiAmiSZrdM+ch8/ewZCE5g8d2mJyorx7s3jZ5rqnyXmzyFkS20YO/O71zaWyuG5n01ntHHvHDQO7WWsZ0yglAgtUtWe2Nsjr8QAomYVNDlZqGB1kKSx5YK8+/GrvM//Al7+JDZ78jIiAHdRR3NaEh/9K8tO3O9LWa4PnrXdZdgdMDTPL/KhvxYw9Mv5xof9DQOiB98h5oItpgW9Pv1CHUFKExtRJQm0atm4BMaG1hLD9He43C26ZLesH5O18K

X-SG-ID: u001.SdBcvi+Evd/bQef8eZF3BpTL9BgbK5wfSJMJGMsmprDITwp3LLcgXu9gvF1Oq5oTf1VY9MM//ZCviT/P37sq36jOj//s+gOXxMbC0IC6I7IMjizREremwgX6+9y9tUg/dPgNN2ostIHEILg1x1R/1w37GQwOPWuCNOy6UFsJnyhHdn7LyoaPfEF05f0sNnsQyS2TPnz2KFtdeinG84O5ooLpo1MFQMdVBSWrxOf8/TWQDGHucSEdWhnLMFePF49gVFqob2dbm/Q5CTKIppr9Tr49C2OW9UwxahuRI44LOLhSOuIpEnEULK6uIJPSh/cF3o2eCOSpXx41HzTLkO1pW11ejJPrrVff4gKguoJ3mrpwaJakKTmrECSyH5ysrvwO4J1ka8u5nDyk3zcqfmg3KKOgfl3AdyCglblFT0b7ip2LW3q2eblYMCztHv8434sE/e14op572TCBgE1H31gbqdN20nZmAO2n5JGF3bcrOL75DUXKXeMnW0Co2LHt6xwCh8LZoC9dqKgfVOe9SKsc9lFXEsbL9/0dw4KdAfnZBBADKuIREB73D7TLN5cH7Fjnlu65xzi7ViTvitFDfaBJN/697EIZE8fgwhL3M7H1FjRtLH83DTqiMCryA6ti6jkEK2fWY4sPhkLB64FGJ6UH72ZDyO+G63iOyTBl9NJ4u6xeTQJd6x7j87Li/szCcEoagStLIYaYO9qI8wus+PrnEi8haxOSz1ITR/Vmwi/yp2xMM4ENEOa41W4lLsPbryPXwtZQNFUmLZK1S4vHhoQquxHfMRfNwyv+z0mobKaz04ehCOXIqrcxFN6Bl7ew2U4ikI6caH6ruxvq9gq5+6XUfzoPwW8Bk4+yYWSaW896SXw13GKY9y7aF8RX5QibDgpwB8PgKzJCVtlHb1CrUfl+EOm9L+d2kHrs40kPskbEUfTrfp0mfqyGE0MWlXfR8JPndp4+WcAfYqh12tf5JEqJURpoYCH05XiKfVhh0vjW2gPiBQ+PSYBgB7j2hwk45/rSO3Ahy+rOg8jbzILIuetcgk3momx+7rT2KpI8Dkq7f1eiyRP9McyS0W6UeLi5HTP41iO3Df7Vt1mXBMCzSBi/vWOTN0itutaHv/+yIcpjN37oDt9+yra3RZPYXVpVpM22wAov/pUa+36MoSnBPqnyiXIMusdAHh7aGlKwIrQDs6HcMMEsVYEbN8teBmdYESezw1m2uvI4gnbGzrXblw3tEn39izWpxaVZ2BMvvBTj3q9/ZineOhSgaqwvwGgfvfvMdEBu//TTfBUF351cuKTxHbuytRm003MmTMHTA/jz2cSYeD1gJcHz3JqfAIo9iBPQTU0seaE6Jm//7lrQkp8v06WxFgHmGWn700FkA7SCNZbC6irMTVbdRFve2vB5ic0WGEvfDHnA0WMCxDZz9og6/PFv76gHpM8QkH9e0SJbROs=

To:

X-Entity-ID: u001.EMGTN5JSDCTZWFZM2IIG9V==

X-Spam_score: 32.3

X-Spam_score_int: 323

X-Spam_bar: ++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Please confirm your email address Click here to confirm your

email address To receive HubSpot content on marketing, sales and/or service

topics - please confirm your email address. You will be added to our email

distribution list. You can unsubscribe at any time.



Content analysis details: (32.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[172.82.239.10 listed in dnsbl.ahbl.org]

[172.82.239.10 listed in dnsbl.ahbl.org]

[172.82.239.10 listed in dnsbl.ahbl.org]

[172.82.239.10 listed in dnsbl.ahbl.org]

[2603:10b6:610:32:cafe:0:0:5d listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:32:cafe:0:0:5d listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:32:cafe:0:0:5d listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:32:cafe:0:0:5d listed in]

[dnsbl.ahbl.org]

[2a01:111:f403:240a:0:0:0:948 listed in]

[dnsbl.ahbl.org]

[2a01:111:f403:240a:0:0:0:948 listed in]

[dnsbl.ahbl.org]

[2a01:111:f403:240a:0:0:0:948 listed in]

[dnsbl.ahbl.org]

[2a01:111:f403:240a:0:0:0:948 listed in]

[dnsbl.ahbl.org]

[15.204.30.220 listed in dnsbl.ahbl.org]

[15.204.30.220 listed in dnsbl.ahbl.org]

[15.204.30.220 listed in dnsbl.ahbl.org]

[15.204.30.220 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[172.82.239.10 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[172.82.239.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[172.82.239.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[172.82.239.10 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[172.82.239.10 listed in will-spam-for-food.eu.org]

[172.82.239.10 listed in will-spam-for-food.eu.org]

[172.82.239.10 listed in will-spam-for-food.eu.org]

[172.82.239.10 listed in will-spam-for-food.eu.org]

[172.82.239.10 listed in will-spam-for-food.eu.org]

[172.82.239.10 listed in will-spam-for-food.eu.org]

[172.82.239.10 listed in will-spam-for-food.eu.org]

[172.82.239.10 listed in will-spam-for-food.eu.org]

[2603:10b6:610:32:cafe:0:0:5d listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:32:cafe:0:0:5d listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:32:cafe:0:0:5d listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:32:cafe:0:0:5d listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:32:cafe:0:0:5d listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:32:cafe:0:0:5d listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:32:cafe:0:0:5d listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:32:cafe:0:0:5d listed in]

[will-spam-for-food.eu.org]

[2a01:111:f403:240a:0:0:0:948 listed in]

[will-spam-for-food.eu.org]

[2a01:111:f403:240a:0:0:0:948 listed in]

[will-spam-for-food.eu.org]

[2a01:111:f403:240a:0:0:0:948 listed in]

[will-spam-for-food.eu.org]

[2a01:111:f403:240a:0:0:0:948 listed in]

[will-spam-for-food.eu.org]

[2a01:111:f403:240a:0:0:0:948 listed in]

[will-spam-for-food.eu.org]

[2a01:111:f403:240a:0:0:0:948 listed in]

[will-spam-for-food.eu.org]

[2a01:111:f403:240a:0:0:0:948 listed in]

[will-spam-for-food.eu.org]

[2a01:111:f403:240a:0:0:0:948 listed in]

[will-spam-for-food.eu.org]

[15.204.30.220 listed in will-spam-for-food.eu.org]

[15.204.30.220 listed in will-spam-for-food.eu.org]

[15.204.30.220 listed in will-spam-for-food.eu.org]

[15.204.30.220 listed in will-spam-for-food.eu.org]

[15.204.30.220 listed in will-spam-for-food.eu.org]

[15.204.30.220 listed in will-spam-for-food.eu.org]

[15.204.30.220 listed in will-spam-for-food.eu.org]

[15.204.30.220 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[15.204.30.220 listed in bb.barracudacentral.org]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

1.0 HK_RANDOM_FROM From username looks random

0.4 INVALID_DATE Invalid Date: header (not RFC 2822)

15 GR_DOMAIN_SAILTH1 Received contains spammer id (sailth)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.3 LONGWORD BODY: Uses overlong words

0.6 J_CHICKENPOX_66 BODY: 6alpha-pock-6alpha

0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_HTML_TAG_BALANCE_CENTER Malformatted HTML

0.8 A_HREF_NOWHERE A link tag with empty href

3.0 HOSTED_IMG_MULTI_PUB_01 Multiple hosted images at public site

0.3 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} Your membership has expired!



------=_Part_9006_1222595691.1721141065958

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Please confirm your email address



Click here to confirm your email address



To receive HubSpot content on marketing, sales and/or service topics -Â please confirm your email address. You will be added to our email distribution list. You can unsubscribe at any time.



Thank you for your confirmation and have fun with our content. Â



Thanks,



The HubSpot Team



HubSpot, 25 1st St., Cambridge, MA 02141, USA, 888-482-7768



HubSpot, 2 Canal Park, , Cambridge, MA 02141, USA, 888-482-7768









Unsubscribe (https://hs-53.s.hubspotemail.net/hs/manage-preferences/unsubscribe-all?languagePreference=en&d=MnbTK9GK15VW3_Vshk4hHDBPW3T2_Lm2m40KfW3T0pbm43T3CZVmWFg14N_KfmN5fr_5C25rVhW8xS7DT8t0gJQVWmbwB8c2k7nMXk_7QbvZTwVMrv2h5s79sCW1P-vmr68hV1J32Kw2&v=3 )



Manage preferences (https://hs-53.s.hubspotemail.net/hs/manage-preferences/unsubscribe?languagePreference=en&d=MnbTK9GK15VW3_Vshk4hHDBPW3T2_Lm2m40KfW3T0pbm43T3CZVmWFg14N_KfmN5fr_5C25rVhW8xS7DT8t0gJQVWmbwB8c2k7nMXk_7QbvZTwVMrv2h5s79sCW1P-vmr68hV1J32Kw2&v=3 )

------=_Part_9006_1222595691.1721141065958

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable





Bitte bestätigen Sie Ihre E-Mail-Adresse there | Confirm your e-mail address there

































doctor,Extend your membership for free











Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA