We transfer phish from Hostpapa
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dve@doctor.nl2k.ab.ca
Delivery-date: Wed, 13 Nov 2024 18:39:01 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from)
id 1tBNsr-00000000BuR-3pK9
for dve@doctor.nl2k.ab.ca;
Wed, 13 Nov 2024 17:38:53 -0700
Resent-From: The Doctor
Resent-Date: Wed, 13 Nov 2024 17:38:53 -0700
Resent-Message-ID:
Resent-To: dve@doctor.nl2k.ab.ca
Received: from maginal-com.cc ([192.3.255.142]:46446)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.98 (FreeBSD))
(envelope-from)
id 1tBMXE-000000006UK-1GTm
for root@nk.ca;
Wed, 13 Nov 2024 16:12:32 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=re1; d=maginal-com.cc;
h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type;
i=info@maginal-com.cc;
bh=xmuDma2b+MbDw+hmBwl7DQeyu7JeuxnkbVlZmtbK10g=;
b=mSvTJwo5jQ9bC5oXW/YXAdUjzS6DGN4SHrNIhqXnSKsJauINayCbZg8cp784smqOEfmyGYAy/6jC
b3aSEMv+m76cpAX6FW/EkQxhAHucjdbUzc9NObcFnR5dsU9aEXToj9DMd9jiR6tSKehSb/OQ13sq
RxSj6UhxKl8/OXSp6rQT/iH0OY74BuddreRsYs9etL42pqDS4BwOUZtaKeFNF9VjhIJMNWeIV4dY
C8AKQ/nCAsbmU1Ch6lYPucKGCG46Xf7QLK8/iuV80zxKAt4ZI6RAPgRCKaITHxHMdDhPZKMFjJyR
sqUPSdfb+n4Eiqs5SqbyyT1oUVXEGuayki1FEQ==
From: "We Transfer"
To: root@nk.ca
Subject: root@nk.ca Your contact shared a file with you via WeTransfer - [00-112791 ]
Date: 13 Nov 2024 23:26:37 +0100
Message-ID: <20241113232637.FD76782C1077B217@maginal-com.cc>
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_0012_5E8D4409.B1D45FD6"
X-Spam_score: 25.6
X-Spam_score_int: 256
X-Spam_bar: +++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: root@nk.ca received shared files 1 item, 7.1 MB in total
will be deleted on 15th November, 2024 Could you please consider our new request
for quote and prepare an offer for us?
Content analysis details: (25.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.3.255.142 listed in will-spam-for-food.eu.org]
[192.3.255.142 listed in will-spam-for-food.eu.org]
[192.3.255.142 listed in will-spam-for-food.eu.org]
[192.3.255.142 listed in will-spam-for-food.eu.org]
[192.3.255.142 listed in will-spam-for-food.eu.org]
[192.3.255.142 listed in will-spam-for-food.eu.org]
[192.3.255.142 listed in will-spam-for-food.eu.org]
[192.3.255.142 listed in will-spam-for-food.eu.org]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[192.3.255.142 listed in bb.barracudacentral.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[192.3.255.142 listed in sbl-xbl.spamhaus.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.3.255.142 listed in dnsbl.ahbl.org]
[192.3.255.142 listed in dnsbl.ahbl.org]
[192.3.255.142 listed in dnsbl.ahbl.org]
[192.3.255.142 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.3.255.142 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.3.255.142 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.3.255.142 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.3.255.142 listed in dnsbl.ahbl.org]
3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[192.3.255.142 listed in zen.spamhaus.org]
0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS
blocklist
[URI: maginal-com.cc/192.3.255.142]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: maginal-com.cc]
[URI: hotelplazatacna.pe]
0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist
[URI: maginal-com.cc/192.3.255.142]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
1.5 MR_STRANGE_QUESTION URI: No description available.
0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels
0.0 FROM_MISSPACED From: missing whitespace
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
Subject: {SPAM?} root@nk.ca Your contact shared a file with you via WeTransfer - [00-112791 ]
------=_NextPart_000_0012_5E8D4409.B1D45FD6
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
px; width: 600px; color: rgb(51, 51, 51); text-transform: none; font-family=
: "lucida grande" , "verdana" , "arial" , "helvetica" , sans-serif; font-si=
ze: 11px; font-style: normal; font-weight: 400; word-spacing: 0px; white-sp=
ace: normal; border-collapse: collapse; min-width: 600px; border-spacing: 0=
px; background-color: rgb(244, 244, 244); text-decoration-color: initial; t=
ext-decoration-style: initial;' border=3D"0"=20
cellspacing=3D"0" cellpadding=3D"0">
ng: 0px; width: 600px; min-width: 600px;">
ollapse; border-spacing: 0px;" bgcolor=3D"#ffffff" border=3D"0" cellspacing=
=3D"0" cellpadding=3D"0">
: 600px;">
ollapse; border-spacing: 0px;" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0">
: 600px;">
ollapse; border-spacing: 0px;" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0">
x 0px; width: 440px; color: rgb(23, 24, 26); line-height: 30px; font-family=
: "freightsans pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-=
serif; font-size: 26px; font-style: normal; font-weight: normal; word-spaci=
ng: 0px;'>root@=
nk.ca
received shared files
x 0px; width: 440px; color: rgb(106, 109, 112); line-height: 23px; font-fam=
ily: "fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-seri=
f; font-size: 14px; font-style: normal; font-weight: normal; word-spacing: =
0px;'>1 item, 7.1 MB in total will be deleted on 15th November, 2024
0px; width: 440px; color: rgb(121, 124, 127); line-height: 24px; font-famil=
y: "fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif;=
font-size: 14px; font-style: normal; font-weight: normal; word-spacing: 0p=
x;'>
ackground-color: rgb(250, 250, 250);">
ext-transform: none; text-indent: 0px; font-family: "calibri" , sans-serif;=
font-size: 14px; font-style: normal; font-weight: 400; word-spacing: 0px; =
float: none; white-space: normal; background-color: rgb(255, 255, 255); tex=
t-decoration-color: initial; text-decoration-style: initial;'>
Could you please consider our new request for quote and prepare an offer fo=
r us?
0px; width: 280px;">
er-collapse: collapse; border-spacing: 0px;" border=3D"0" cellspacing=3D"0"=
cellpadding=3D"0">
: 280px; height: 15px;">
&nb=
sp;
x; text-align: center; color: rgb(255, 255, 255); font-family: "fakt pro me=
dium" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif; font-si=
ze: 14px; font-style: normal; text-decoration: none; word-spacing: 0px; bac=
kground-color: rgb(64, 159, 255);'=20
href=3D"http://ngzgshbvaw.hotelplazatacna.pe/?userid=3Dcm9vdEBuay5jYQ=3D=3D=
" target=3D"_blank" rel=3D"noopener noreferrer">Get your files
0px; width: 440px;">
ollapse; border-spacing: 0px;" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0">
: 440px; line-height: 0; font-size: 1px; border-bottom-color: rgb(244, 244,=
244); border-bottom-width: 2px; border-bottom-style: solid;">
0px; width: 440px; color: rgb(121, 124, 127); line-height: 24px; font-famil=
y: "fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif;=
font-size: 14px; font-style: normal; font-weight: normal; word-spacing: 0p=
x;'>
"segoe ui" , "sanfrancisco display" , "arial" , sans-serif; font-size: 18p=
x; font-weight: 500;'>Download
0px; width: 440px; color: rgb(121, 124, 127); line-height: 24px; font-famil=
y: "fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif;=
font-size: 14px; font-style: normal; font-weight: normal; word-spacing: 0p=
x;'>
"segoe ui" , "sanfrancisco display" , "arial" , sans-serif; font-size: 18p=
x; font-weight: 500;'>1 item
0px; width: 440px; color: rgb(121, 124, 127); line-height: 24px; font-famil=
y: "fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif;=
font-size: 14px; font-style: normal; font-weight: normal; word-spacing: 0p=
x;'>
htsans pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif; f=
ont-size: 18px; font-weight: 500; border-top-width: 0px; border-top-style: =
none;'>
; border-bottom-width: 1px; border-bottom-style: none;">
font-family: "fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , s=
ans-serif; font-size: 14px; font-style: normal; font-weight: normal; word-s=
pacing: 0px; border-top-width: 0px; border-top-style: none;'>
lor: rgb(0, 105, 166); text-decoration: underline;" href=3D"http://yugnswbs=
dg.hotelplazatacna.pe/?userid=3Dcm9vdEBuay5jYQ=3D=3D" target=3D"_blank" rel=
=3D"noopener noreferrer">
15-11-2024_RFQ_for_new Project.zip
;">7.1 MB
ollapse; border-spacing: 0px;" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0">
x; width: 600px;">
ollapse; border-spacing: 0px;" bgcolor=3D"#ffffff" border=3D"0" cellspacing=
=3D"0" cellpadding=3D"0">
width: 560px;">
ollapse; border-spacing: 0px;" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0">
; width: 560px; color: rgb(121, 124, 127); line-height: 24px; font-family: =
"fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif; fo=
nt-size: 12px; font-style: normal; font-weight: normal; word-spacing: 0px;'=
>
ollapse; border-spacing: 0px;" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0">
x; width: 560px; color: rgb(121, 124, 127); line-height: 23px; font-family:=
"fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif; f=
ont-size: 12px; font-style: normal; font-weight: normal; word-spacing: 0px;=
'>
on: underline;">
text-decoration: underline;">About WeTransfer
oration: underline;">
ormal; text-decoration: underline;">Help
rgb(121, 124, 127);">
b(121, 124, 127); font-weight: normal; text-decoration: underline;">
le=3D"color: rgb(121, 124, 127); font-weight: normal; text-decoration: unde=
rline;">Legal
<=
u style=3D"color: rgb(121, 124, 127); font-weight: normal; text-decoration:=
underline;">Report this transfer as spam
------=_NextPart_000_0012_5E8D4409.B1D45FD6
Content-Type: image/png; name="blue2x.png"
Content-Transfer-Encoding: base64
Content-ID:
Content-Disposition: inline; filename="blue2x.png"
iVBORw0KGgoAAAANSUhEUgAAAHAAAAA8CAYAAAC+ej5cAAAABHNCSVQICAgIfAhkiAAACJJJ
REFUeJztnHtsnXUZxz/f3+natdIwdgO3uKEEuWhEAnFBcONsbMsYMA20Ael6ziRK1IhEMxEj
uj8I8YJBjQEz0JWOiumIch+Dnp6hgAjjEgiI4BDQDWMZc2zrbT3v4x8tsran572d7pzh+0n6
R3/neX7P9/c+7+13eyEhISEhISEhISEhISHh/wmVo5LFt9pcwTzPmCNjjueYI48PAtOARsQR
Bo1Ao4wGgymCWhMpGc6EMCTwEGaGJzhgYlAwiLEP2GtiL7BXsBfoQeyUx07EzhrHziOnsn1T
s/rK0aYwLO+06YMDzKLATGfMKogZKTHgGbudeBvYNb2e7ZuaVSh37FAJXHG/1Q328GkPzjDj
JOBEjBMYTk7FEXgm3gBeAl5y8FytkX9gjV4rZ5yREzbteaRNpDE+HEBbL2Ib8LggtzBD1zrJ
i6slUALXmbmt7ayVsdaMGXGDHnJEl+DKfFYvxKkm3W7LzeMqjHR8SbyO+HVNHbc8dIl2xqjH
n/QG6zD4fNQgVYHY51Is6l6tp8O6LtlgF3vwbYNTyi5L7BesWzifn65Layi0v5/B4jZb5hlb
osmrMsTjW7M6I6j58k6bPtDLrzA+O5myACSec6Ipl9HLYfycn4EZq6LLqjoWnLvBjglieE67
nTWwn2cPRfIAzPiEZ/wxvdFCXeW+CUQsj6yq2jDUD0v9zJbcahcVPLYCH5p8Ue9hxmwrsHVZ
u308qI9/Aoe7Au8nSrZnyUb7jOdxmxmpQyVoFMa0QY/2L22zKUHM/W+hwZJ82OC5iduz5DY7
uVDgLoO6Q6lpHMapL7/Ad4KYvq+SE4emTqstHOBOjKMqrQUA48rsBpvqZ+abQMHb5VFUHTiv
eHt27ecrwPGHWM7EGNNec/4vkEFuoW+WR1F14Nz49qzssKMMrqmEnlLI40I/myBXYORRgmrE
UuPb0zvIdw2mV0KPD8f5GQR5Bm4vg5DqQNj0Wv5+cFFTp6WAbGUElcbEPD+bIP3Av5VFTTVg
/HPsbMWuXs6s0qsPGQ1+Nr4JdI5XyiOn8ojxbfHg/EpoCYLBDj8b3wQ2DvF8eeRUHjG+LYIL
KqElCBqeGiuJbwLvXKP/oNHPjcMVz/HMwf9fcJc1mvHRSunxQ/CAn03QjvyzMbVUBSlGJ7Bv
H4EGtivByOqE2/3sAiXQQeg5tGpDMHDcx/jLwWWeV70JRNzWnVH8Z+CI1WOxBVUYE0+uP10H
RpUNVW0Ce5z4RhDDQAmsgT8jQs8WVxXikbFFnphdCSklEX0uxcW5jHYFMQ+UwAdbtR8b/fw4
3JCNT6AzBiuhZSIEvTXigu5WdQf1CTwboSJn8GGDsIYp4x8Dgp4y1N0n8SOGlzpGr0Y8WlvD
KV0ZdYXxC5xAZ/whvKzqQPD8fZdq99hyT/ETKMPls7rKOU6S6BAMhPIXTyFaFmVYuGW1Qo96
1QQO9AHy6qVQsZnqGAgeKlbuRE/B4tVtULes3WY/2KodQMvKDvta3yCrPLEA4zTBXGCaQYNg
D+Itg5cRD8voymf1FMDWbLT4gRPY1aw9Z7fZE0DgVV3VgrniCUyJHQUxhAU/DsUY8lgCw322
kSu9beTvPQ1mkhTzdBlPqBl5GZvLLWCyEfTOL/Bwsd8ebNV+YFvcGAaX+uqYhORB2ATWcN9k
iJhMTHS3rVH/RL87yMWOYaxc3GYL49YThVAJzLXwjOQ/Ql5NCO4p+bviJxDAjPUrO+yQr6cJ
dwVKJuOOyRJTbiQKUxv4fSmb2lk8JtgTN5bBCb2D3HtOpx0Zt64whN5elm6zM61IpziGAM/E
FsG/MBYbzC9b3SKXz+ocP7t0m11nxtVlirm9xnHxQ60K/Gxd2mHHDx3gEuBCjJkmnk7VcFWu
RS/6xgsr0My0+Fb+YcbcsL5Fovc5x3nvjjysuN/q+v9Np1l55ugkLs9ntd7PbkWnzerr5XWM
+nLERZiMO1Jw41nH8sjYTStNnZba08+8A8bnzLgE4/QidbxZl+K0LatVclFZpA2eZ7fZDRhX
RvEdFdzx1XxGNx5c1tRpR7zVy7Nm/gt6SlfOUH0DczY3K1BnPd1mPzPjilgxi8pgj4lXgB7B
DIb7hccE6U87cU13VteWtIkiKiU2RPEbhch3t3LT2OJNzdqH4zJE3Nfue4MmD6A2xQ8kAg0g
h8HgSIzTMVaY8Skz5gYdDLEAG2cjJTCX0XPAk1F8geFbJ3xxor5RvlUPC26OXD8guCWM/ZbV
etMZLWU4ccrJE34GkZfWS+EO0Jig3+vOquRyxak1rI3aZZHYMbPBfznCWHJr9ICD66LELDcS
b8w3/3535AQ2HsXtEu+EdhTbZjRwg5/Z5ha9I8eXo2gzcXPUDwrMaOD7gvuj+JYTJ75ZagDi
f3ZRA9y9Snsj3OYOpMRlQQ9ud6vuQfw2VATRX1/Pjf6GxdnUrMKiY1kl4fv2OlnI8eNcRoH6
27F2JznHz0PN1Isfjjw/A1PfwBVhXi4kNoZ5eSnGurSG8lld7sRaQewvSQRFouDE2nxG3wrq
EyuBXa16Q/CbILaCF+tnU/KVuBibm9Vj8PVAxmIIx0/CxpiI7qyuTzmWS4Q66SLS48TS7qyu
D+MUe39gTR1XI/aVspEYTDlaNp+rUJOd77I1qw7BpgCmv8iv1l+jxJiIroy6FmU4FdEySetj
e3Csa6zj5FxG+bDOZflSU7rNVgK/M6O2SIAB57gol9G9cWI0dVp9Ty93YxQdGpPIzWzg/Mn8
UlNTp9W+1c9FeJyHsTzyngrRD2xzRvs82BjkZWXiqsrE0g32ySFxNcYCE0cDrwn+lJrCtV2X
6tVyxGjqtNSuXlo9+AJwoowpJl4dORC/jHMgImkZYAFDLDPHR/CYPdLuozFmSvTZ8ObY3TJ2
Az0S2yQenV7PU5uaVVULqhISEhISEhISEhISEhIOD/4Lp+DMB9fdP6wAAAAASUVORK5CYII=
------=_NextPart_000_0012_5E8D4409.B1D45FD6--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dve@doctor.nl2k.ab.ca
Delivery-date: Wed, 13 Nov 2024 18:39:01 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from
id 1tBNsr-00000000BuR-3pK9
for dve@doctor.nl2k.ab.ca;
Wed, 13 Nov 2024 17:38:53 -0700
Resent-From: The Doctor
Resent-Date: Wed, 13 Nov 2024 17:38:53 -0700
Resent-Message-ID:
Resent-To: dve@doctor.nl2k.ab.ca
Received: from maginal-com.cc ([192.3.255.142]:46446)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.98 (FreeBSD))
(envelope-from
id 1tBMXE-000000006UK-1GTm
for root@nk.ca;
Wed, 13 Nov 2024 16:12:32 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=re1; d=maginal-com.cc;
h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type;
i=info@maginal-com.cc;
bh=xmuDma2b+MbDw+hmBwl7DQeyu7JeuxnkbVlZmtbK10g=;
b=mSvTJwo5jQ9bC5oXW/YXAdUjzS6DGN4SHrNIhqXnSKsJauINayCbZg8cp784smqOEfmyGYAy/6jC
b3aSEMv+m76cpAX6FW/EkQxhAHucjdbUzc9NObcFnR5dsU9aEXToj9DMd9jiR6tSKehSb/OQ13sq
RxSj6UhxKl8/OXSp6rQT/iH0OY74BuddreRsYs9etL42pqDS4BwOUZtaKeFNF9VjhIJMNWeIV4dY
C8AKQ/nCAsbmU1Ch6lYPucKGCG46Xf7QLK8/iuV80zxKAt4ZI6RAPgRCKaITHxHMdDhPZKMFjJyR
sqUPSdfb+n4Eiqs5SqbyyT1oUVXEGuayki1FEQ==
From: "We Transfer"
To: root@nk.ca
Subject: root@nk.ca Your contact shared a file with you via WeTransfer - [00-112791 ]
Date: 13 Nov 2024 23:26:37 +0100
Message-ID: <20241113232637.FD76782C1077B217@maginal-com.cc>
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_0012_5E8D4409.B1D45FD6"
X-Spam_score: 25.6
X-Spam_score_int: 256
X-Spam_bar: +++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: root@nk.ca received shared files 1 item, 7.1 MB in total
will be deleted on 15th November, 2024 Could you please consider our new request
for quote and prepare an offer for us?
Content analysis details: (25.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.3.255.142 listed in will-spam-for-food.eu.org]
[192.3.255.142 listed in will-spam-for-food.eu.org]
[192.3.255.142 listed in will-spam-for-food.eu.org]
[192.3.255.142 listed in will-spam-for-food.eu.org]
[192.3.255.142 listed in will-spam-for-food.eu.org]
[192.3.255.142 listed in will-spam-for-food.eu.org]
[192.3.255.142 listed in will-spam-for-food.eu.org]
[192.3.255.142 listed in will-spam-for-food.eu.org]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[192.3.255.142 listed in bb.barracudacentral.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[192.3.255.142 listed in sbl-xbl.spamhaus.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.3.255.142 listed in dnsbl.ahbl.org]
[192.3.255.142 listed in dnsbl.ahbl.org]
[192.3.255.142 listed in dnsbl.ahbl.org]
[192.3.255.142 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.3.255.142 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.3.255.142 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.3.255.142 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.3.255.142 listed in dnsbl.ahbl.org]
3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[192.3.255.142 listed in zen.spamhaus.org]
0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS
blocklist
[URI: maginal-com.cc/192.3.255.142]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: maginal-com.cc]
[URI: hotelplazatacna.pe]
0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist
[URI: maginal-com.cc/192.3.255.142]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
1.5 MR_STRANGE_QUESTION URI: No description available.
0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels
0.0 FROM_MISSPACED From: missing whitespace
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
Subject: {SPAM?} root@nk.ca Your contact shared a file with you via WeTransfer - [00-112791 ]
------=_NextPart_000_0012_5E8D4409.B1D45FD6
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
px; width: 600px; color: rgb(51, 51, 51); text-transform: none; font-family=
: "lucida grande" , "verdana" , "arial" , "helvetica" , sans-serif; font-si=
ze: 11px; font-style: normal; font-weight: 400; word-spacing: 0px; white-sp=
ace: normal; border-collapse: collapse; min-width: 600px; border-spacing: 0=
px; background-color: rgb(244, 244, 244); text-decoration-color: initial; t=
ext-decoration-style: initial;' border=3D"0"=20
cellspacing=3D"0" cellpadding=3D"0">
ng: 0px; width: 600px; min-width: 600px;">
ollapse; border-spacing: 0px;" bgcolor=3D"#ffffff" border=3D"0" cellspacing=
=3D"0" cellpadding=3D"0">
: 600px;">
ollapse; border-spacing: 0px;" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0">
: 600px;">
pan>
=3D"" src=3D"cid:blue2x.png">
ollapse; border-spacing: 0px;" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0">
x 0px; width: 440px; color: rgb(23, 24, 26); line-height: 30px; font-family=
: "freightsans pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-=
serif; font-size: 26px; font-style: normal; font-weight: normal; word-spaci=
ng: 0px;'>root@=
nk.ca
received shared files
x 0px; width: 440px; color: rgb(106, 109, 112); line-height: 23px; font-fam=
ily: "fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-seri=
f; font-size: 14px; font-style: normal; font-weight: normal; word-spacing: =
0px;'>1 item, 7.1 MB in total will be deleted on 15th November, 2024
0px; width: 440px; color: rgb(121, 124, 127); line-height: 24px; font-famil=
y: "fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif;=
font-size: 14px; font-style: normal; font-weight: normal; word-spacing: 0p=
x;'>
ackground-color: rgb(250, 250, 250);">
ext-transform: none; text-indent: 0px; font-family: "calibri" , sans-serif;=
font-size: 14px; font-style: normal; font-weight: 400; word-spacing: 0px; =
float: none; white-space: normal; background-color: rgb(255, 255, 255); tex=
t-decoration-color: initial; text-decoration-style: initial;'>
Could you please consider our new request for quote and prepare an offer fo=
r us?
0px; width: 280px;">
er-collapse: collapse; border-spacing: 0px;" border=3D"0" cellspacing=3D"0"=
cellpadding=3D"0">
: 280px; height: 15px;">
&nb=
sp;
x; text-align: center; color: rgb(255, 255, 255); font-family: "fakt pro me=
dium" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif; font-si=
ze: 14px; font-style: normal; text-decoration: none; word-spacing: 0px; bac=
kground-color: rgb(64, 159, 255);'=20
href=3D"http://ngzgshbvaw.hotelplazatacna.pe/?userid=3Dcm9vdEBuay5jYQ=3D=3D=
" target=3D"_blank" rel=3D"noopener noreferrer">Get your files
0px; width: 440px;">
ollapse; border-spacing: 0px;" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0">
: 440px; line-height: 0; font-size: 1px; border-bottom-color: rgb(244, 244,=
244); border-bottom-width: 2px; border-bottom-style: solid;">
0px; width: 440px; color: rgb(121, 124, 127); line-height: 24px; font-famil=
y: "fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif;=
font-size: 14px; font-style: normal; font-weight: normal; word-spacing: 0p=
x;'>
"segoe ui" , "sanfrancisco display" , "arial" , sans-serif; font-size: 18p=
x; font-weight: 500;'>Download
0px; width: 440px; color: rgb(121, 124, 127); line-height: 24px; font-famil=
y: "fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif;=
font-size: 14px; font-style: normal; font-weight: normal; word-spacing: 0p=
x;'>
"segoe ui" , "sanfrancisco display" , "arial" , sans-serif; font-size: 18p=
x; font-weight: 500;'>1 item
0px; width: 440px; color: rgb(121, 124, 127); line-height: 24px; font-famil=
y: "fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif;=
font-size: 14px; font-style: normal; font-weight: normal; word-spacing: 0p=
x;'>
htsans pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif; f=
ont-size: 18px; font-weight: 500; border-top-width: 0px; border-top-style: =
none;'>
; border-bottom-width: 1px; border-bottom-style: none;">
font-family: "fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , s=
ans-serif; font-size: 14px; font-style: normal; font-weight: normal; word-s=
pacing: 0px; border-top-width: 0px; border-top-style: none;'>
lor: rgb(0, 105, 166); text-decoration: underline;" href=3D"http://yugnswbs=
dg.hotelplazatacna.pe/?userid=3Dcm9vdEBuay5jYQ=3D=3D" target=3D"_blank" rel=
=3D"noopener noreferrer">
15-11-2024_RFQ_for_new Project.zip
;">7.1 MB
ollapse; border-spacing: 0px;" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0">
x; width: 600px;">
ollapse; border-spacing: 0px;" bgcolor=3D"#ffffff" border=3D"0" cellspacing=
=3D"0" cellpadding=3D"0">
width: 560px;">
ollapse; border-spacing: 0px;" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0">
; width: 560px; color: rgb(121, 124, 127); line-height: 24px; font-family: =
"fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif; fo=
nt-size: 12px; font-style: normal; font-weight: normal; word-spacing: 0px;'=
>
To make sure our emails arrive, ple=
ase add
xt-decoration: none;">
: normal; text-decoration: none;">noreply@wetransfer.com to=
oration: underline;" href=3D"https://wetransfer.com/" target=3D"_blank" rel=
=3D"noopener noreferrer">your contacts.
ollapse; border-spacing: 0px;" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0">
x; width: 560px; color: rgb(121, 124, 127); line-height: 23px; font-family:=
"fakt pro" , "segoe ui" , "sanfrancisco display" , "arial" , sans-serif; f=
ont-size: 12px; font-style: normal; font-weight: normal; word-spacing: 0px;=
'>
on: underline;">
text-decoration: underline;">About WeTransfer
oration: underline;">
ormal; text-decoration: underline;">Help
rgb(121, 124, 127);">
b(121, 124, 127); font-weight: normal; text-decoration: underline;">
le=3D"color: rgb(121, 124, 127); font-weight: normal; text-decoration: unde=
rline;">Legal
<=
u style=3D"color: rgb(121, 124, 127); font-weight: normal; text-decoration:=
underline;">Report this transfer as spam
------=_NextPart_000_0012_5E8D4409.B1D45FD6
Content-Type: image/png; name="blue2x.png"
Content-Transfer-Encoding: base64
Content-ID:
Content-Disposition: inline; filename="blue2x.png"
iVBORw0KGgoAAAANSUhEUgAAAHAAAAA8CAYAAAC+ej5cAAAABHNCSVQICAgIfAhkiAAACJJJ
REFUeJztnHtsnXUZxz/f3+natdIwdgO3uKEEuWhEAnFBcONsbMsYMA20Ael6ziRK1IhEMxEj
uj8I8YJBjQEz0JWOiumIch+Dnp6hgAjjEgiI4BDQDWMZc2zrbT3v4x8tsran572d7pzh+0n6
R3/neX7P9/c+7+13eyEhISEhISEhISEhISHh/wmVo5LFt9pcwTzPmCNjjueYI48PAtOARsQR
Bo1Ao4wGgymCWhMpGc6EMCTwEGaGJzhgYlAwiLEP2GtiL7BXsBfoQeyUx07EzhrHziOnsn1T
s/rK0aYwLO+06YMDzKLATGfMKogZKTHgGbudeBvYNb2e7ZuaVSh37FAJXHG/1Q328GkPzjDj
JOBEjBMYTk7FEXgm3gBeAl5y8FytkX9gjV4rZ5yREzbteaRNpDE+HEBbL2Ib8LggtzBD1zrJ
i6slUALXmbmt7ayVsdaMGXGDHnJEl+DKfFYvxKkm3W7LzeMqjHR8SbyO+HVNHbc8dIl2xqjH
n/QG6zD4fNQgVYHY51Is6l6tp8O6LtlgF3vwbYNTyi5L7BesWzifn65Layi0v5/B4jZb5hlb
osmrMsTjW7M6I6j58k6bPtDLrzA+O5myACSec6Ipl9HLYfycn4EZq6LLqjoWnLvBjglieE67
nTWwn2cPRfIAzPiEZ/wxvdFCXeW+CUQsj6yq2jDUD0v9zJbcahcVPLYCH5p8Ue9hxmwrsHVZ
u308qI9/Aoe7Au8nSrZnyUb7jOdxmxmpQyVoFMa0QY/2L22zKUHM/W+hwZJ82OC5iduz5DY7
uVDgLoO6Q6lpHMapL7/Ad4KYvq+SE4emTqstHOBOjKMqrQUA48rsBpvqZ+abQMHb5VFUHTiv
eHt27ecrwPGHWM7EGNNec/4vkEFuoW+WR1F14Nz49qzssKMMrqmEnlLI40I/myBXYORRgmrE
UuPb0zvIdw2mV0KPD8f5GQR5Bm4vg5DqQNj0Wv5+cFFTp6WAbGUElcbEPD+bIP3Av5VFTTVg
/HPsbMWuXs6s0qsPGQ1+Nr4JdI5XyiOn8ojxbfHg/EpoCYLBDj8b3wQ2DvF8eeRUHjG+LYIL
KqElCBqeGiuJbwLvXKP/oNHPjcMVz/HMwf9fcJc1mvHRSunxQ/CAn03QjvyzMbVUBSlGJ7Bv
H4EGtivByOqE2/3sAiXQQeg5tGpDMHDcx/jLwWWeV70JRNzWnVH8Z+CI1WOxBVUYE0+uP10H
RpUNVW0Ce5z4RhDDQAmsgT8jQs8WVxXikbFFnphdCSklEX0uxcW5jHYFMQ+UwAdbtR8b/fw4
3JCNT6AzBiuhZSIEvTXigu5WdQf1CTwboSJn8GGDsIYp4x8Dgp4y1N0n8SOGlzpGr0Y8WlvD
KV0ZdYXxC5xAZ/whvKzqQPD8fZdq99hyT/ETKMPls7rKOU6S6BAMhPIXTyFaFmVYuGW1Qo96
1QQO9AHy6qVQsZnqGAgeKlbuRE/B4tVtULes3WY/2KodQMvKDvta3yCrPLEA4zTBXGCaQYNg
D+Itg5cRD8voymf1FMDWbLT4gRPY1aw9Z7fZE0DgVV3VgrniCUyJHQUxhAU/DsUY8lgCw322
kSu9beTvPQ1mkhTzdBlPqBl5GZvLLWCyEfTOL/Bwsd8ebNV+YFvcGAaX+uqYhORB2ATWcN9k
iJhMTHS3rVH/RL87yMWOYaxc3GYL49YThVAJzLXwjOQ/Ql5NCO4p+bviJxDAjPUrO+yQr6cJ
dwVKJuOOyRJTbiQKUxv4fSmb2lk8JtgTN5bBCb2D3HtOpx0Zt64whN5elm6zM61IpziGAM/E
FsG/MBYbzC9b3SKXz+ocP7t0m11nxtVlirm9xnHxQ60K/Gxd2mHHDx3gEuBCjJkmnk7VcFWu
RS/6xgsr0My0+Fb+YcbcsL5Fovc5x3nvjjysuN/q+v9Np1l55ugkLs9ntd7PbkWnzerr5XWM
+nLERZiMO1Jw41nH8sjYTStNnZba08+8A8bnzLgE4/QidbxZl+K0LatVclFZpA2eZ7fZDRhX
RvEdFdzx1XxGNx5c1tRpR7zVy7Nm/gt6SlfOUH0DczY3K1BnPd1mPzPjilgxi8pgj4lXgB7B
DIb7hccE6U87cU13VteWtIkiKiU2RPEbhch3t3LT2OJNzdqH4zJE3Nfue4MmD6A2xQ8kAg0g
h8HgSIzTMVaY8Skz5gYdDLEAG2cjJTCX0XPAk1F8geFbJ3xxor5RvlUPC26OXD8guCWM/ZbV
etMZLWU4ccrJE34GkZfWS+EO0Jig3+vOquRyxak1rI3aZZHYMbPBfznCWHJr9ICD66LELDcS
b8w3/3535AQ2HsXtEu+EdhTbZjRwg5/Z5ha9I8eXo2gzcXPUDwrMaOD7gvuj+JYTJ75ZagDi
f3ZRA9y9Snsj3OYOpMRlQQ9ud6vuQfw2VATRX1/Pjf6GxdnUrMKiY1kl4fv2OlnI8eNcRoH6
27F2JznHz0PN1Isfjjw/A1PfwBVhXi4kNoZ5eSnGurSG8lld7sRaQewvSQRFouDE2nxG3wrq
EyuBXa16Q/CbILaCF+tnU/KVuBibm9Vj8PVAxmIIx0/CxpiI7qyuTzmWS4Q66SLS48TS7qyu
D+MUe39gTR1XI/aVspEYTDlaNp+rUJOd77I1qw7BpgCmv8iv1l+jxJiIroy6FmU4FdEySetj
e3Csa6zj5FxG+bDOZflSU7rNVgK/M6O2SIAB57gol9G9cWI0dVp9Ty93YxQdGpPIzWzg/Mn8
UlNTp9W+1c9FeJyHsTzyngrRD2xzRvs82BjkZWXiqsrE0g32ySFxNcYCE0cDrwn+lJrCtV2X
6tVyxGjqtNSuXlo9+AJwoowpJl4dORC/jHMgImkZYAFDLDPHR/CYPdLuozFmSvTZ8ObY3TJ2
Az0S2yQenV7PU5uaVVULqhISEhISEhISEhISEhIOD/4Lp+DMB9fdP6wAAAAASUVORK5CYII=
------=_NextPart_000_0012_5E8D4409.B1D45FD6--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments