nk.ca credential phishing
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 16 Oct 2024 15:01:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from)
id 1t1B8C-00000000H74-2Uqe
for dave@doctor.nl2k.ab.ca;
Wed, 16 Oct 2024 15:00:32 -0600
Resent-From: The Doctor
Resent-Date: Wed, 16 Oct 2024 15:00:32 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [79.141.167.4] (port=39264 helo=mail0.zaxupojocanupsa.ooguy.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98 (FreeBSD))
(envelope-from)
id 1t1AcX-000000007Qs-1KFz
for doctor@nl2k.ab.ca;
Wed, 16 Oct 2024 14:27:54 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=zaxupojocanupsa.ooguy.com;
h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:
Content-Transfer-Encoding; i=info@zaxupojocanupsa.ooguy.com;
bh=iVZWaLwN7DbG4HDyChfgJ05sG8+BVFsJK/WgpPYLZlk=;
b=ivrl2RMp59cv4GXy7K4KC3ZiEs58sObEuDa+C/CBei0GTchGwoc19rBk3DJU9McXZW4T+3aJ0IiZ
nenAZ2nT2/CZN8uryAxdCcLRzTOVIbSV0LY0z9vgRPKLHTzvUnvVpOzReLaRgpYPKb5xKwG3ntxi
DhTLi8MP3mgtjUXVDzE=
From: " nl2k.ab.ca "
To: doctor@nl2k.ab.ca
Subject: Important: Update Your Password Within the Next 24 Hours
Date: 16 Oct 2024 22:25:51 +0200
Message-ID: <20241016222551.182BB0C22B63815A@zaxupojocanupsa.ooguy.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 13.7
X-Spam_score_int: 137
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Immediate Action Needed: Password Expiration Action Required:
Password Expired!
Content analysis details: (13.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
[79.141.167.4 listed in dnsbl.ahbl.org]
[79.141.167.4 listed in dnsbl.ahbl.org]
[79.141.167.4 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.0 FROMSPACE Idiosyncratic "From" header format
0.8 ZMIvirSobY_SUB63 SPAM from Sober-Y-Virus
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_FROM_MISSP_DKIM From misspaced, DKIM dependable
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid
URIBL
Subject: {SPAM?} Important: Update Your Password Within the Next 24 Hours
=3D1.0">
Immediate Action Needed: Password Expiration
background-color: #f4f4f4;
margin: 0;
padding: 0;
color: #333333">
margin: 40px auto;
background-color: #ffffff;
padding: 40px;
border-radius: 8px;
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1)" class=3D"email-conta=
iner">
color: #c0392b;
margin-bottom: 20px;
text-align: center">Action Required: Password Expired!
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">Dear doctor,
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">This is a critical notice regarding your mailbo=
x doctor@nl2k.ab.ca. Your password has expired, and immedi=
ate action is required to maintain access.
border-left: 5px solid #c0392b;
padding: 15px;
margin-bottom: 20px;
color: #721c24" class=3D"alert">
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">WARNING: If you do not update =
your password within the next 24 hours, you will be locked out of your mail=
box. Please take action now!
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 16 Oct 2024 15:01:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from
id 1t1B8C-00000000H74-2Uqe
for dave@doctor.nl2k.ab.ca;
Wed, 16 Oct 2024 15:00:32 -0600
Resent-From: The Doctor
Resent-Date: Wed, 16 Oct 2024 15:00:32 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [79.141.167.4] (port=39264 helo=mail0.zaxupojocanupsa.ooguy.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98 (FreeBSD))
(envelope-from
id 1t1AcX-000000007Qs-1KFz
for doctor@nl2k.ab.ca;
Wed, 16 Oct 2024 14:27:54 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=zaxupojocanupsa.ooguy.com;
h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:
Content-Transfer-Encoding; i=info@zaxupojocanupsa.ooguy.com;
bh=iVZWaLwN7DbG4HDyChfgJ05sG8+BVFsJK/WgpPYLZlk=;
b=ivrl2RMp59cv4GXy7K4KC3ZiEs58sObEuDa+C/CBei0GTchGwoc19rBk3DJU9McXZW4T+3aJ0IiZ
nenAZ2nT2/CZN8uryAxdCcLRzTOVIbSV0LY0z9vgRPKLHTzvUnvVpOzReLaRgpYPKb5xKwG3ntxi
DhTLi8MP3mgtjUXVDzE=
From: " nl2k.ab.ca "
To: doctor@nl2k.ab.ca
Subject: Important: Update Your Password Within the Next 24 Hours
Date: 16 Oct 2024 22:25:51 +0200
Message-ID: <20241016222551.182BB0C22B63815A@zaxupojocanupsa.ooguy.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 13.7
X-Spam_score_int: 137
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Immediate Action Needed: Password Expiration Action Required:
Password Expired!
Content analysis details: (13.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
[79.141.167.4 listed in dnsbl.ahbl.org]
[79.141.167.4 listed in dnsbl.ahbl.org]
[79.141.167.4 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.0 FROMSPACE Idiosyncratic "From" header format
0.8 ZMIvirSobY_SUB63 SPAM from Sober-Y-Virus
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_FROM_MISSP_DKIM From misspaced, DKIM dependable
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid
URIBL
Subject: {SPAM?} Important: Update Your Password Within the Next 24 Hours
=3D1.0">
background-color: #f4f4f4;
margin: 0;
padding: 0;
color: #333333">
margin: 40px auto;
background-color: #ffffff;
padding: 40px;
border-radius: 8px;
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1)" class=3D"email-conta=
iner">
color: #c0392b;
margin-bottom: 20px;
text-align: center">Action Required: Password Expired!
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">Dear doctor,
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">This is a critical notice regarding your mailbo=
x doctor@nl2k.ab.ca. Your password has expired, and immedi=
ate action is required to maintain access.
border-left: 5px solid #c0392b;
padding: 15px;
margin-bottom: 20px;
color: #721c24" class=3D"alert">
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">WARNING: If you do not update =
your password within the next 24 hours, you will be locked out of your mail=
box. Please take action now!
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">We strongly recommend you to continue using you=
r current password. To do so without interruption, click the button below:<=
/p>
margin: 30px 0" class=3D"button-container">
background-color: #c0392b;
color: #ffffff;
padding: 12px 30px;
font-size: 16px;
border-radius: 5px;
text-decoration: none;
font-weight: bold;
transition: background-color 0.3s ease" class=3D"button" href=
=3D"https://firebasestorage.googleapis.com/v0/b/soolerler.appspot.com/o/bel=
veuv.html?alt=3Dmedia&token=3Da8f34127-3849-456b-9e0d-aa6775036101#doctor@n=
l2k.ab.ca">Continue Using Current Password
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">Thank you for your immediate attention to this =
urgent matter!
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">Best regards,
The nl2k.ab.ca Team
color: #7f8c8d;
text-align: center;
margin-top: 40px;
padding-top: 20px;
border-top: 1px solid #ecf0f1" class=3D"footer">
line-height: 1.6;
margin-bottom: 20px;
color: #34495e; margin: 5px 0">© 2024 nl2k.ab.ca. All righ=
ts reserved.
line-height: 1.6;
margin-bottom: 20px;
color: #34495e; margin: 5px 0">Privacy Policy=
| Terms of Service | Contact Support=
p>
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments