e-mail credential phish from sendgrid
Posted by Dave Yadallee onEnvelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 29 Aug 2024 05:30:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from
id 1sjdLK-000000003Zw-0CIc
for dave@doctor.nl2k.ab.ca;
Thu, 29 Aug 2024 05:29:34 -0600
Resent-From: The Doctor
Resent-Date: Thu, 29 Aug 2024 05:29:33 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from wfbthrdf.outbound-mail.sendgrid.net ([159.183.5.223]:34750)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98 (FreeBSD))
(envelope-from
id 1sjYoj-0000000031y-2gKf
for sales@nk.ca;
Thu, 29 Aug 2024 00:39:44 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vietiso.com;
h=content-type:from:subject:content-transfer-encoding:mime-version:to:
cc:content-type:from:subject:to;
s=s1; bh=zWmq3nrhJIxaYyZsylX+kNUZMW47yt6uh83gA1qhGeY=;
b=E41eK8Qal6cjCEWOoB6rZ40kvDvtBtOwROZpTyjIkiJBB/0A42hNpPJCvmA4IFCs306w
L76inLnXacn30SgvaMgX3qcEzl2tgUER7A+32OJ3wiZQtYgOJOT6EF1MVZ8nRqwtYUxwrc
nC0YHqfm8oeW4wV7tWzLRUROwWnOBzsLI+yqPMvyBTVs9ZHx68lN1qZLoMAiZFoOEbYGFo
pYD/qcYZGqISopvcsba7xCwtmPEIAR+7tuZpzHb63NkdY7g1bQ7z3d04inSxAdkYzGdofF
JEZlS0TLeNRdIX0EuVdoYUTOClp7hRSe58JKB389B24LirVQpA1AQz8i1JXQSuAA==
Received: by recvd-75c48596c-mbnzv with SMTP id recvd-75c48596c-mbnzv-1-66D01733-7
2024-08-29 06:37:39.157678813 +0000 UTC m=+634262.434399884
Received: from [127.0.0.1] (unknown)
by geopod-ismtpd-7 (SG) with ESMTP
id xpI00CmtQKqtiGFX-3GsOw
for
Thu, 29 Aug 2024 06:37:39.024 +0000 (UTC)
Content-Type: text/html; charset=utf-8
From: Mail protection
Subject: Your Mail Requires Verification
Message-ID: <248b9531-f95a-af95-ced5-ce4d360657a2@vietiso.com>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 29 Aug 2024 06:37:39 +0000 (UTC)
MIME-Version: 1.0
X-SG-EID:
=?us-ascii?Q?u001=2E2GVbraVlsAwCqOHZik485QSvfzI5x=2FF1M8W=2Fxsvl1XDl+msQBjGFY31zp?=
=?us-ascii?Q?yaM5W3tv7x5BThY8wGhfOJ4JZJ2U5XjOLgpYNQX?=
=?us-ascii?Q?pr9EK+ol171=2Fovf6yX9OsStmCbOuFWhB7HjLOd4?=
=?us-ascii?Q?l4iXF9OXzQX=2Fa9V07ysAFznnNwrlOJqsoVLeeXD?=
=?us-ascii?Q?NFLr9IpDfwW4nweM1FjYv1UhMZ9bQ8=2FlYHG4fuE?=
=?us-ascii?Q?ZzP0XqgImNrIWZrNe5k8=2FU=3D?=
To: sales@nk.ca
X-Entity-ID: u001.ZfyNQ1Wf18YPkiNJew7C3A==
X-Spam_score: 30.3
X-Spam_score_int: 303
X-Spam_bar: ++++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  MAIL PROTECTION NOTICE ⦿ 
sales@nk.ca
Content analysis details: (30.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[159.183.5.223 listed in dnsbl.ahbl.org]
[159.183.5.223 listed in dnsbl.ahbl.org]
[159.183.5.223 listed in dnsbl.ahbl.org]
[159.183.5.223 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[159.183.5.223 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[159.183.5.223 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[159.183.5.223 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[159.183.5.223 listed in dnsbl.ahbl.org]
2.5 URIBL_DBL_BOTNETCC Contains a botned C&C URL listed in the DBL
blocklist
[URI: us.kg]
2.5 URIBL_DBL_MALWARE Contains a malware URL listed in the DBL blocklist
[URI: us.kg]
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: us.kg]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)
0.0 HTML_FONT_SIZE_LARGE BODY: HTML font size is large
0.0 HTML_OBFUSCATE_05_10 BODY: Message is 5% to 10% HTML obfuscation
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
Subject: {SPAM?} Your Mail Requires Verification
=EF=BB=BF
tyle=3D"font-family:"helvetica neue",helvetica,arial,sans-serif;m=
argin:0px;padding:0px">MAIL PROTECTION =EF=BB=BF=EF=BB=BFNOTICE=
=
le=3D"font-size:13px">=E2=A6=BF=EF=BB=BF=EF=BB=BF=EF=BB=BF=EF=BB=BF =EF=BB=
=BF=EF=BB=BF=EF=BB=BF=EF=BB=BF sales@nk.ca
px;padding:0px" />
It's now ti=EF=BB=BF=EF=BB=BF=EF=BB=BF=
=EF=BB=BFme to ma=D1=
=96=EF=BB=BF=EF=BB=BF=EF=BB=BF=EF=BB=BF
n>nta=D1=96=EF=BB=BF=EF=BB=BF=EF=BB=BF=EF=BB=BFn
px">
=BB=BF=EF=BB=BF=EF=BB=BF=EF=BB=BFsswo=EF=BB=BF=EF=BB=BF=EF=BB=BF=EF=BB=BFrd=
act=D1=96=EF=BB=BF=EF=BB=BF=EF=BB=BF=EF=BB=BFv=D1=96=EF=BB=BF=EF=BB=BF=EF=
=BB=BF=EF=BB=BFty to avoid log=D1=96=EF=BB=BF=EF=BB=BF=EF=BB=BF=EF=BB=BFn =
=D1=96=EF=BB=BF=EF=BB=BF=EF=BB=BF=EF=BB=BFnterrupti=D0=BE=EF=BB=BF=EF=BB=BF=
=EF=BB=BF=EF=BB=BFn..
484378w.us.kg/hgf345grecdsx//index.html%23sales@nk.ca&source=3Dgmail&am=
p;ust=3D1724969231437000&usg=3DAOvVaw1IpHgNr_uJ2eKJ37wo-SuS" href=3D"ht=
tp://url4282.vietiso.com/ls/click?upn=3Du001.c3-2FhfTP23UQD0uIBFNttoiF5lJ6X=
zf56XGDliwoxAKgKEBJ-2FEyRFktiRxdrkJcAx7-2FljdRfDMYoFGir2PqU45bOPSiROT9i8ZVn=
n0g0zed0-3DN_il_6-2BBKni6sDtwyUScw4c6eaVr2-2BowGp54aXkJiaWIBrxO5UpvSWpV-2Fq=
up-2FLu83-2BDOD5N1mfkM87lYE46xMOReRrZLz2EkTW87FmE0oMZkV2ELklE7-2BWbBjONgDEl=
t674V3z61Hfs4Mg9SHRUU8Ogo9nse2rclS-2Bew2vN5ELk2JOMxFySwdR7ZWKLGWfltkzpbz" s=
tyle=3D"color:rgb(255,255,255);font-family:"segoe ui light";font-=
size:15px;margin:0px;padding:7px;text-decoration-line:none;outline:currentc=
olor none medium;background-image:none;background-color:rgb(38,112,236);bac=
kground-position:0% 0%;background-repeat:repeat" target=3D"_blank">K=D0=B5=
=EF=BB=BF=EF=BB=BF=D0=B5=EF=BB=BF=EF=BB=BFp Same =D0=A0=EF=BB=BF=EF=BB=BF=
=D0=B0=EF=BB=BF=EF=BB=BFss=EF=BB=BFw=EF=BB=BF=EF=BB=BFor=EF=BB=BFd
t>
elvetica,arial,sans-serif;font-size:13px">
ca neue",helvetica,arial,sans-serif">
, serif" style=3D"margin:0px;padding:0px">N=D0=BE=EF=BB=BF=EF=BB=BF=EF=BB=
=BF=EF=BB=BFt=D0=B5=EF=BB=BF=EF=BB=BF=EF=BB=BF=EF=BB=BF:
in:0px;padding:0px;border:0px;outline:0px;font-weight:inherit">
>If the server does not receive your response within 24hrs you may have log=
in issues.
Th=D0=B0=EF=BB=BF=EF=BB=BF=EF=BB=BF=EF=BB=BFnk you,
padding:0px" />
2024 Supported
ca neue",helvetica,arial,sans-serif;color:rgb(29,34,40);line-height:20=
px">
6ntPcBOrJL5L76VjmE1VjULvKj1KQZ1y00KADp3ayVJM52cpqKQ0-2BHk4ViIeb5p3tQDfBcHOe=
CIqf8aV3jLP8Ie1cfVaKD6Sy34rYS9kzCKmuw6QEagNgHXl6Mu5qRdOQ0dl1TUjax9Hl-2F284r=
HjqLBZIoQYqhrUvamP9sspoq7KHK4OhySFRmswTVPiDK9eVlxDg-3D-3D" alt=3D"" width=
=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px !=
important;border-width:0 !important;margin-top:0 !important;margin-bottom:0=
!important;margin-right:0 !important;margin-left:0 !important;padding-top:=
0 !important;padding-bottom:0 !important;padding-right:0 !important;padding=
-left:0 !important;"/>
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments