nk.ca credential phishing
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 16 Oct 2024 15:01:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from)
id 1t1B8F-00000000H8P-4BvF
for dave@doctor.nl2k.ab.ca;
Wed, 16 Oct 2024 15:00:36 -0600
Resent-From: The Doctor
Resent-Date: Wed, 16 Oct 2024 15:00:35 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [79.141.167.4] (port=58457 helo=mail0.zaxupojocanupsa.ooguy.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98 (FreeBSD))
(envelope-from)
id 1t1Acc-000000007Qr-3AfM
for root@nk.ca;
Wed, 16 Oct 2024 14:27:59 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=zaxupojocanupsa.ooguy.com;
h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:
Content-Transfer-Encoding; i=info@zaxupojocanupsa.ooguy.com;
bh=seampN6PZD1dvl30VyYrKpu5cBZBzVmG60VQ5PNSqcI=;
b=IP4qSl7Fh8baoVebKIzInjnVeMiMlEOIaSFA7xckMk7gGua0kMSnKWDwgkbgWzU1oqTJj/o9Egs6
KwxESFKWxXJj8cPtChJ/IFFSPdgSP0IlZliUTbYV+fFTEq1Jmi7q8wAtgYxCH05hSg/zjJ1fb8DT
OcgqpGhFQgqmqFarRLM=
From: " nk.ca "
To: root@nk.ca
Subject: Action requird: Update your Password
Date: 16 Oct 2024 22:25:52 +0200
Message-ID: <20241016222552.0F12F7154A92E460@zaxupojocanupsa.ooguy.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 12.8
X-Spam_score_int: 128
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Immediate Action Needed: Password Expiration Action Required:
Password Expired!
Content analysis details: (12.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
[79.141.167.4 listed in dnsbl.ahbl.org]
[79.141.167.4 listed in dnsbl.ahbl.org]
[79.141.167.4 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.0 FROMSPACE Idiosyncratic "From" header format
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.0 T_FROM_MISSP_DKIM From misspaced, DKIM dependable
3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid
URIBL
Subject: {SPAM?} Action requird: Update your Password
=3D1.0">
Immediate Action Needed: Password Expiration
background-color: #f4f4f4;
margin: 0;
padding: 0;
color: #333333">
margin: 40px auto;
background-color: #ffffff;
padding: 40px;
border-radius: 8px;
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1)" class=3D"email-conta=
iner">
color: #c0392b;
margin-bottom: 20px;
text-align: center">Action Required: Password Expired!
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">Dear root,
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">This is a critical notice regarding your mailbo=
x root@nk.ca. Your password has expired, and immediate act=
ion is required to maintain access.
border-left: 5px solid #c0392b;
padding: 15px;
margin-bottom: 20px;
color: #721c24" class=3D"alert">
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">WARNING: If you do not update =
your password within the next 24 hours, you will be locked out of your mail=
box. Please take action now!
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 16 Oct 2024 15:01:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from
id 1t1B8F-00000000H8P-4BvF
for dave@doctor.nl2k.ab.ca;
Wed, 16 Oct 2024 15:00:36 -0600
Resent-From: The Doctor
Resent-Date: Wed, 16 Oct 2024 15:00:35 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [79.141.167.4] (port=58457 helo=mail0.zaxupojocanupsa.ooguy.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98 (FreeBSD))
(envelope-from
id 1t1Acc-000000007Qr-3AfM
for root@nk.ca;
Wed, 16 Oct 2024 14:27:59 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=zaxupojocanupsa.ooguy.com;
h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:
Content-Transfer-Encoding; i=info@zaxupojocanupsa.ooguy.com;
bh=seampN6PZD1dvl30VyYrKpu5cBZBzVmG60VQ5PNSqcI=;
b=IP4qSl7Fh8baoVebKIzInjnVeMiMlEOIaSFA7xckMk7gGua0kMSnKWDwgkbgWzU1oqTJj/o9Egs6
KwxESFKWxXJj8cPtChJ/IFFSPdgSP0IlZliUTbYV+fFTEq1Jmi7q8wAtgYxCH05hSg/zjJ1fb8DT
OcgqpGhFQgqmqFarRLM=
From: " nk.ca "
To: root@nk.ca
Subject: Action requird: Update your Password
Date: 16 Oct 2024 22:25:52 +0200
Message-ID: <20241016222552.0F12F7154A92E460@zaxupojocanupsa.ooguy.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 12.8
X-Spam_score_int: 128
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Immediate Action Needed: Password Expiration Action Required:
Password Expired!
Content analysis details: (12.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
[79.141.167.4 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
[79.141.167.4 listed in dnsbl.ahbl.org]
[79.141.167.4 listed in dnsbl.ahbl.org]
[79.141.167.4 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[79.141.167.4 listed in dnsbl.ahbl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.0 FROMSPACE Idiosyncratic "From" header format
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.0 T_FROM_MISSP_DKIM From misspaced, DKIM dependable
3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid
URIBL
Subject: {SPAM?} Action requird: Update your Password
=3D1.0">
background-color: #f4f4f4;
margin: 0;
padding: 0;
color: #333333">
margin: 40px auto;
background-color: #ffffff;
padding: 40px;
border-radius: 8px;
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1)" class=3D"email-conta=
iner">
color: #c0392b;
margin-bottom: 20px;
text-align: center">Action Required: Password Expired!
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">Dear root,
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">This is a critical notice regarding your mailbo=
x root@nk.ca. Your password has expired, and immediate act=
ion is required to maintain access.
border-left: 5px solid #c0392b;
padding: 15px;
margin-bottom: 20px;
color: #721c24" class=3D"alert">
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">WARNING: If you do not update =
your password within the next 24 hours, you will be locked out of your mail=
box. Please take action now!
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">We strongly recommend you to continue using you=
r current password. To do so without interruption, click the button below:<=
/p>
margin: 30px 0" class=3D"button-container">
background-color: #c0392b;
color: #ffffff;
padding: 12px 30px;
font-size: 16px;
border-radius: 5px;
text-decoration: none;
font-weight: bold;
transition: background-color 0.3s ease" class=3D"button" href=
=3D"https://firebasestorage.googleapis.com/v0/b/soolerler.appspot.com/o/bel=
veuv.html?alt=3Dmedia&token=3Da8f34127-3849-456b-9e0d-aa6775036101#root@nk.=
ca">Continue Using Current Password
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">Thank you for your immediate attention to this =
urgent matter!
line-height: 1.6;
margin-bottom: 20px;
color: #34495e">Best regards,
The nk.ca Team
color: #7f8c8d;
text-align: center;
margin-top: 40px;
padding-top: 20px;
border-top: 1px solid #ecf0f1" class=3D"footer">
line-height: 1.6;
margin-bottom: 20px;
color: #34495e; margin: 5px 0">© 2024 nk.ca. All rights re=
served.
line-height: 1.6;
margin-bottom: 20px;
color: #34495e; margin: 5px 0">Privacy Policy=
| Terms of Service | Contact Support
p>
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments