Overdue invoice phish from Hostpapa.com

Posted by Dave Yadallee on Thursday, November 14. 2024

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 Nov 2024 17:54:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tBNt7-00000000Bwc-0BES

for dave@doctor.nl2k.ab.ca;

Wed, 13 Nov 2024 17:39:09 -0700

Resent-From: The Doctor

Resent-Date: Wed, 13 Nov 2024 17:39:09 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server5565.cc ([192.3.255.134]:47514)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tBMbQ-000000006w8-2bDS

for webmaster@nk.ca;

Wed, 13 Nov 2024 16:16:53 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=re1; d=server5565.cc;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:

Content-Transfer-Encoding; i=info@server5565.cc;

bh=60bmdJEpPCZiP9r+gO/d3BGH/OEvmI1OKbixlPs5JFI=;

b=AKkMN82y+NZ75rRtYDNcjcerZKiz0HYO5RDBP6ygGLw03vUA/NCGaj4nPcedI1F1EOrf1LXsETvK

HbfEOmVwIAHR/UN9VR2RJqfJmqwPDfhuKYyPrUA7IHKxg78zFmtuDFJ7djAb+1kc6zCy7tvtZhrz

Sha8uXvBidTgZiScumbNYyaV2IQ7srIOW5QSmrwMdyG7jhY3RBUUINypJBfQLQHKW9vC+p5Wz4SW

bgKCBn6+FQMk8FpLckJMPpDSw8XyPHjMiKwz+cwaTHP84RdHdUOQ3BrE8Bl5i9xdGreaCukzqplc

qiwY1+mjjhwZCDdYinz/t/USwD3bpTUY5uIUuA==

From: "Finance Department"

To: webmaster@nk.ca

Subject: Re: Re: Overdue Invoices [ No.: 00-12198 ]

Date: 13 Nov 2024 23:33:56 +0100

Message-ID: <20241113233356.2B1D5D0418C4BC88@server5565.cc>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 24.7

X-Spam_score_int: 247

X-Spam_bar: ++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello webmaster, I'm following up on the attached open invoices

on our account. Unfortunately, we have not received any payment nor additional

requests for the balance to be reconciled.

Content analysis details: (24.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.3.255.134 listed in will-spam-for-food.eu.org]

[192.3.255.134 listed in will-spam-for-food.eu.org]

[192.3.255.134 listed in will-spam-for-food.eu.org]

[192.3.255.134 listed in will-spam-for-food.eu.org]

[192.3.255.134 listed in will-spam-for-food.eu.org]

[192.3.255.134 listed in will-spam-for-food.eu.org]

[192.3.255.134 listed in will-spam-for-food.eu.org]

[192.3.255.134 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[192.3.255.134 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.3.255.134 listed in dnsbl.ahbl.org]

[192.3.255.134 listed in dnsbl.ahbl.org]

[192.3.255.134 listed in dnsbl.ahbl.org]

[192.3.255.134 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.3.255.134 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.3.255.134 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.3.255.134 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.3.255.134 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[192.3.255.134 listed in zen.spamhaus.org]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: server5565.cc/192.3.255.134]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: server5565.cc]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: server5565.cc/192.3.255.134]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.5 MR_STRANGE_QUESTION URI: No description available.

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} Re: Re: Overdue Invoices [ No.: 00-12198 ]

>
dana,sans-serif; font-size: 9.5pt;">Hello webmaster,

I'm following u=

p on the attached open invoices on our account. Unfortunately, we have not =

received any payment nor additional requests for the balance to be reconcil=

ed.

Please consider that the next step on our collection strategy is to conside=

r a restriction on the services to the vendor.

>
dana,sans-serif; font-size: 9.5pt;">See attached and let us have your
>
dana,sans-serif; font-size: 9.5pt;"> approval on restriction to this client=

=2E

Regards,

Accounts Receivables Specialist.
account@nk.c=

a

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Name

Homepage

In reply to

Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.

Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enter the string from the spam-prevention image above:

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.

Standard emoticons like :-) and ;-) are converted to images.

Enter the string from the spam-prevention image above:

Remember Information?

Subscribe to this entry

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	December '24					Forward →
						1
2	3	4	5	6	7	8
9	10	11	12	13	14	15
16	17	18	19	20	21	22
23	24	25	26	27	28	29
30	31