Ledger phish from sendgrid
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 24 Nov 2024 18:20:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from)
id 1tFNlJ-00000000OUg-084B
for dave@doctor.nl2k.ab.ca;
Sun, 24 Nov 2024 18:19:37 -0700
Resent-From: The Doctor
Resent-Date: Sun, 24 Nov 2024 18:19:36 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from s.wfbtzhsc.outbound-mail.sendgrid.net ([159.183.224.108]:6572)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98 (FreeBSD))
(envelope-from)
id 1tFLEZ-000000008xh-2b9R
for doctor@doctor.nl2k.ab.ca;
Sun, 24 Nov 2024 15:37:45 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tokiomarine-life.co.id;
h=from:subject:mime-version:to:content-type:content-transfer-encoding:
cc:content-type:from:subject:to;
s=s1; bh=f20hF0zIAzwuzog97lHMamtKY4k5WHQUDBfeLCcUcE0=;
b=Pj0kCcddkhBkM74UwSHBCHrBlcsL6S0dnD6WZl6xCTrGt/Lgjw3HI2XeDcqmTFDK0A9B
mgOmpA5K7Z/gyjK75Il2wDfpp7UMBYAZfFSgv6aDso4FmkrtpyVbPhwcOW8vhosNKOPw7j
gZTUyEsktfgj7v+2NXoYZ538Spk/2t2zmCokEf3+SYT0sJ7N0r8UKfwv+yuNhVKAtGyzjg
QdXQIwID74wULZCZfskNz6gECqRXFWmf78KLWHNEKoayJvRjApnABp/FtzMJd666xbd82x
gshUH1MLlU4hgeTDJuicgGqPRYL2BsJT8932n2DXmUct30tsa51CnHBR8aNmCZZA==
Received: by recvd-845f5fb9db-q9rlv with SMTP id recvd-845f5fb9db-q9rlv-1-6743AA42-E
2024-11-24 22:35:46.435048161 +0000 UTC m=+868439.527731612
Received: from recover.com (unknown)
by geopod-ismtpd-0 (SG) with ESMTP
id H7UF82sESemtlCd-k7lFAQ
for;
Sun, 24 Nov 2024 22:35:46.373 +0000 (UTC)
From: Ledger Notice
Subject: Action Required: Ledger Data Breach =?UTF-8?B?4oCT?= Check Your
Recovery Phrase
Date: Sun, 24 Nov 2024 22:35:46 +0000 (UTC)
Message-ID: <20241124223546.C04043D9C8417948@recover.com>
MIME-Version: 1.0
X-SG-EID:
=?us-ascii?Q?u001=2EUzx+q7Evx8rrJGLSOjy=2F8LCr6OBkz4jCZaXmpbokpU7yNf91U=2FyDtr11X?=
=?us-ascii?Q?uCBPAz1uxws58HPzBn8A4FRvmTJFeynW5jq0=2FW1?=
=?us-ascii?Q?ybq6wFS+1OPbduUyFTTZdpdmK7OuVHO=2FpiRGtOg?=
=?us-ascii?Q?OL7d43fT4x06Vq0dosMquq2sxbNhWVrF7ImdC6P?=
=?us-ascii?Q?FMecYKAo+zsfoeuZDt8V+WrgUq7UDjiclcvkazg?=
=?us-ascii?Q?3z402ka5PNbFwIuJKEfsLDAIM3FkvQ3ASkOgru8?= =?us-ascii?Q?FjCn?=
To: doctor@doctor.nl2k.ab.ca
X-Entity-ID: u001.lpEAD+9vfaXjS4MHU6cW4w==
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 22.7
X-Spam_score_int: 227
X-Spam_bar: ++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Ledger - Important Notice Action Required: Verify Your Recovery
Phrase
Content analysis details: (22.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[159.183.224.108 listed in will-spam-for-food.eu.org]
[159.183.224.108 listed in will-spam-for-food.eu.org]
[159.183.224.108 listed in will-spam-for-food.eu.org]
[159.183.224.108 listed in will-spam-for-food.eu.org]
[159.183.224.108 listed in will-spam-for-food.eu.org]
[159.183.224.108 listed in will-spam-for-food.eu.org]
[159.183.224.108 listed in will-spam-for-food.eu.org]
[159.183.224.108 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[159.183.224.108 listed in dnsbl.ahbl.org]
[159.183.224.108 listed in dnsbl.ahbl.org]
[159.183.224.108 listed in dnsbl.ahbl.org]
[159.183.224.108 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[159.183.224.108 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[159.183.224.108 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[159.183.224.108 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[159.183.224.108 listed in dnsbl.ahbl.org]
1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)
[159.183.224.108 listed in ix.dnsbl.manitu.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
Subject: {SPAM?} Action Required: Ledger Data Breach =?UTF-8?B?4oCT?= Check Your
Recovery Phrase
1.0">
Ledger - Important Notice
ground-color: #f4f4f4; color: #333; line-height: 1.6;">
olor: #fff; border-radius: 10px; overflow: hidden; box-shadow: 0 4px 8px rg=
ba(0, 0, 0, 0.1);">
; padding: 20px;">
![](3D"https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/08=<br)
/Ledger-logo-16_9.png" alt=3D"Ledger Logo" style=3D"width: 140px;" width=3D=
"140" height=3D"79">
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 24 Nov 2024 18:20:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from
id 1tFNlJ-00000000OUg-084B
for dave@doctor.nl2k.ab.ca;
Sun, 24 Nov 2024 18:19:37 -0700
Resent-From: The Doctor
Resent-Date: Sun, 24 Nov 2024 18:19:36 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from s.wfbtzhsc.outbound-mail.sendgrid.net ([159.183.224.108]:6572)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98 (FreeBSD))
(envelope-from
id 1tFLEZ-000000008xh-2b9R
for doctor@doctor.nl2k.ab.ca;
Sun, 24 Nov 2024 15:37:45 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tokiomarine-life.co.id;
h=from:subject:mime-version:to:content-type:content-transfer-encoding:
cc:content-type:from:subject:to;
s=s1; bh=f20hF0zIAzwuzog97lHMamtKY4k5WHQUDBfeLCcUcE0=;
b=Pj0kCcddkhBkM74UwSHBCHrBlcsL6S0dnD6WZl6xCTrGt/Lgjw3HI2XeDcqmTFDK0A9B
mgOmpA5K7Z/gyjK75Il2wDfpp7UMBYAZfFSgv6aDso4FmkrtpyVbPhwcOW8vhosNKOPw7j
gZTUyEsktfgj7v+2NXoYZ538Spk/2t2zmCokEf3+SYT0sJ7N0r8UKfwv+yuNhVKAtGyzjg
QdXQIwID74wULZCZfskNz6gECqRXFWmf78KLWHNEKoayJvRjApnABp/FtzMJd666xbd82x
gshUH1MLlU4hgeTDJuicgGqPRYL2BsJT8932n2DXmUct30tsa51CnHBR8aNmCZZA==
Received: by recvd-845f5fb9db-q9rlv with SMTP id recvd-845f5fb9db-q9rlv-1-6743AA42-E
2024-11-24 22:35:46.435048161 +0000 UTC m=+868439.527731612
Received: from recover.com (unknown)
by geopod-ismtpd-0 (SG) with ESMTP
id H7UF82sESemtlCd-k7lFAQ
for
Sun, 24 Nov 2024 22:35:46.373 +0000 (UTC)
From: Ledger Notice
Subject: Action Required: Ledger Data Breach =?UTF-8?B?4oCT?= Check Your
Recovery Phrase
Date: Sun, 24 Nov 2024 22:35:46 +0000 (UTC)
Message-ID: <20241124223546.C04043D9C8417948@recover.com>
MIME-Version: 1.0
X-SG-EID:
=?us-ascii?Q?u001=2EUzx+q7Evx8rrJGLSOjy=2F8LCr6OBkz4jCZaXmpbokpU7yNf91U=2FyDtr11X?=
=?us-ascii?Q?uCBPAz1uxws58HPzBn8A4FRvmTJFeynW5jq0=2FW1?=
=?us-ascii?Q?ybq6wFS+1OPbduUyFTTZdpdmK7OuVHO=2FpiRGtOg?=
=?us-ascii?Q?OL7d43fT4x06Vq0dosMquq2sxbNhWVrF7ImdC6P?=
=?us-ascii?Q?FMecYKAo+zsfoeuZDt8V+WrgUq7UDjiclcvkazg?=
=?us-ascii?Q?3z402ka5PNbFwIuJKEfsLDAIM3FkvQ3ASkOgru8?= =?us-ascii?Q?FjCn?=
To: doctor@doctor.nl2k.ab.ca
X-Entity-ID: u001.lpEAD+9vfaXjS4MHU6cW4w==
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 22.7
X-Spam_score_int: 227
X-Spam_bar: ++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Ledger - Important Notice Action Required: Verify Your Recovery
Phrase
Content analysis details: (22.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[159.183.224.108 listed in will-spam-for-food.eu.org]
[159.183.224.108 listed in will-spam-for-food.eu.org]
[159.183.224.108 listed in will-spam-for-food.eu.org]
[159.183.224.108 listed in will-spam-for-food.eu.org]
[159.183.224.108 listed in will-spam-for-food.eu.org]
[159.183.224.108 listed in will-spam-for-food.eu.org]
[159.183.224.108 listed in will-spam-for-food.eu.org]
[159.183.224.108 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[159.183.224.108 listed in dnsbl.ahbl.org]
[159.183.224.108 listed in dnsbl.ahbl.org]
[159.183.224.108 listed in dnsbl.ahbl.org]
[159.183.224.108 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[159.183.224.108 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[159.183.224.108 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[159.183.224.108 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[159.183.224.108 listed in dnsbl.ahbl.org]
1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)
[159.183.224.108 listed in ix.dnsbl.manitu.net]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
Subject: {SPAM?} Action Required: Ledger Data Breach =?UTF-8?B?4oCT?= Check Your
Recovery Phrase
1.0">
ground-color: #f4f4f4; color: #333; line-height: 1.6;">
olor: #fff; border-radius: 10px; overflow: hidden; box-shadow: 0 4px 8px rg=
ba(0, 0, 0, 0.1);">
; padding: 20px;">
/Ledger-logo-16_9.png" alt=3D"Ledger Logo" style=3D"width: 140px;" width=3D=
"140" height=3D"79">
Action Required: Verify You=
r Recovery Phrase
Dear Customer,
We regret to inform you that a recent data security incident may have =
affected some recovery phrases linked to Ledger accounts. While your hardwa=
re wallet remains secure, we strongly advise verifying your recovery phrase=
for any potential exposure.
Steps =
to Verify Your Recovery Phrase:
- Visit our official recovery phrase =
verification page. - Enter your recovery phrase as instr=
ucted. - Follow the steps to secure your ass=
ets if necessary.
Ensuring your recovery phrase is safe is critical to protecting your d=
igital assets. If you have any questions, our support team is available to =
assist you.
l" style=3D"display: inline-block; background-color: #007bff; color: #fff; =
padding: 12px 20px; text-decoration: none; border-radius: 5px; font-weight:=
bold;">Verify Now
; padding: 10px; font-size: 12px; line-height: 1.6;">
This email was sent to you as part of our commitment to customer secur=
ity. If you did not request this email, please contact our support team imm=
ediately.
© 2024 Ledger |=20
ation: none;">Visit Ledger |=20
; text-decoration: none;">Unsubscribe
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments