Adobe purchase order phish
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 27 Nov 2024 16:30:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from)
id 1tGQKR-00000000KMr-1u7N
for dave@doctor.nl2k.ab.ca;
Wed, 27 Nov 2024 15:16:11 -0700
Resent-From: The Doctor
Resent-Date: Wed, 27 Nov 2024 15:16:11 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from s1036210.srvape.com ([188.127.251.120]:43272)
by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))
(envelope-from)
id 1tGOA1-00000000DOv-43H9
for doctor@doctor.nl2k.ab.ca;
Wed, 27 Nov 2024 12:57:21 -0700
Received: from biz.oversaesbulker.com (localhost [IPv6:::1])
by s1036210.srvape.com (Postfix) with ESMTP id 7CC54299D10
for; Wed, 27 Nov 2024 22:55:19 +0300 (MSK)
From: "=?UTF-8?B?UmVuw6kgQ2xhYXNzZW5zIC0gS8O2c3RlciBBZHZvY2F0ZW4gTi5WLiA8?= noreply"@biz.oversaesbulker.com>
To: doctor@doctor.nl2k.ab.ca
Subject: Fwd: Purchase order #PO-36739575.adobe
Date: 27 Nov 2024 21:55:19 +0200
Message-ID: <20241127215518.40C43C8A5815AFCB@biz.oversaesbulker.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 13.5
X-Spam_score_int: 135
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: #PO-36739575.xls File Size: 98kb | File Expiry: 3days View
Message: I am interested in some of your products. I want to place a trial
order on the products listed in the attached file. Kindly check a [...]
Content analysis details: (13.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[188.127.251.120 listed in will-spam-for-food.eu.org]
[188.127.251.120 listed in will-spam-for-food.eu.org]
[188.127.251.120 listed in will-spam-for-food.eu.org]
[188.127.251.120 listed in will-spam-for-food.eu.org]
[188.127.251.120 listed in will-spam-for-food.eu.org]
[188.127.251.120 listed in will-spam-for-food.eu.org]
[188.127.251.120 listed in will-spam-for-food.eu.org]
[188.127.251.120 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[188.127.251.120 listed in dnsbl.ahbl.org]
[188.127.251.120 listed in dnsbl.ahbl.org]
[188.127.251.120 listed in dnsbl.ahbl.org]
[188.127.251.120 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[188.127.251.120 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[188.127.251.120 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[188.127.251.120 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[188.127.251.120 listed in dnsbl.ahbl.org]
0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist
[URI: ipfs.io/209.94.90.1]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[188.127.251.120 listed in bb.barracudacentral.org]
2.4 FROM_UNBAL2 From with unbalanced angle brackets, '<' missing
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
3.2 URI_IPFSIO References Interplanetary File System PtP content via
ipfs.io, likely phishing
0.0 URI_IPFS References Interplanetary File System PtP content, probable
phishing
Subject: {SPAM?} Fwd: Purchase order #PO-36739575.adobe
w3.org/TR/html4/loose.dtd">
o, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLAPSE: col=
lapse; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-S=
TYLE: normal; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: norm=
al; BACKGROUND-COLOR: rgb(255,255,255); font-variant-ligatures: normal; fon=
t-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thi=
ckness: initial; text-decoration-style: initial;=20
text-decoration-color: initial" cellSpacing=3D0>
d; HEIGHT: 250px; BORDER-RIGHT: rgb(222,23,23) 1px solid; WIDTH: 400px; BOR=
DER-COLLAPSE: collapse; BORDER-BOTTOM: rgb(222,23,23) 1px solid; PADDING-BO=
TTOM: 10px; PADDING-TOP: 10px; PADDING-LEFT: 10px; BORDER-LEFT: rgb(222,23,=
23) 1px solid; PADDING-RIGHT: 10px; BACKGROUND-COLOR: rgb(255,255,255); bor=
der-radius: 3px 7px">
apse" cellSpacing=3D0 align=3Dcenter>
FONT-SIZE: 13px; FONT-FAMILY: arial; COLOR: rgb(51,51,51)">
=3D"BOX-SIZING: border-box; FONT-WEIGHT: bolder">#PO-36739575.xls<=
BR style=3D"BOX-SIZING: border-box">File Size: 98kb | File Expiry: 3days
PAN>
COLLAPSE: collapse; BACKGROUND-COLOR: rgb(194,1,1); border-radius: 15px" ce=
llSpacing=3D0>
px" align=3Dcenter bis_skin_checked=3D"1">
x; TEXT-DECORATION: none; COLOR: rgb(0,172,255); BACKGROUND-COLOR: transpar=
ent" href=3D"https://ipfs.io/ipfs/QmULozKRB3q9aGVhpr1kqeufdpoUXQRVAtNoxLon9=
1Hvo3#doctor@doctor.nl2k.ab.ca" rel=3Dnoreferrer target=3D_blank>
e=3D"BOX-SIZING: border-box; FONT-SIZE: 13px; FONT-FAMILY: arial; COLOR: rg=
b(255,255,255)">View
FONT-SIZE: 13px; FONT-FAMILY: arial; COLOR: rgb(51,51,51)">
BOX-SIZING: border-box; FONT-SIZE: 13px; FONT-FAMILY: arial; COLOR: rgb(51,=
51,51)">
le=3D"BOX-SIZING: border-box; FONT-WEIGHT: bolder">Message:=
I am interested in some of your produc=
ts.
I want to place a trial order on the products listed in the attached file. =
Kindly check and send your offer, and state your payment terms for trial or=
der.
=
Sender's Profile:=20
-interchange-newline>
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 27 Nov 2024 16:30:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from
id 1tGQKR-00000000KMr-1u7N
for dave@doctor.nl2k.ab.ca;
Wed, 27 Nov 2024 15:16:11 -0700
Resent-From: The Doctor
Resent-Date: Wed, 27 Nov 2024 15:16:11 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from s1036210.srvape.com ([188.127.251.120]:43272)
by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))
(envelope-from
id 1tGOA1-00000000DOv-43H9
for doctor@doctor.nl2k.ab.ca;
Wed, 27 Nov 2024 12:57:21 -0700
Received: from biz.oversaesbulker.com (localhost [IPv6:::1])
by s1036210.srvape.com (Postfix) with ESMTP id 7CC54299D10
for
From: "=?UTF-8?B?UmVuw6kgQ2xhYXNzZW5zIC0gS8O2c3RlciBBZHZvY2F0ZW4gTi5WLiA8?= noreply"@biz.oversaesbulker.com>
To: doctor@doctor.nl2k.ab.ca
Subject: Fwd: Purchase order #PO-36739575.adobe
Date: 27 Nov 2024 21:55:19 +0200
Message-ID: <20241127215518.40C43C8A5815AFCB@biz.oversaesbulker.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 13.5
X-Spam_score_int: 135
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: #PO-36739575.xls File Size: 98kb | File Expiry: 3days View
Message: I am interested in some of your products. I want to place a trial
order on the products listed in the attached file. Kindly check a [...]
Content analysis details: (13.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[188.127.251.120 listed in will-spam-for-food.eu.org]
[188.127.251.120 listed in will-spam-for-food.eu.org]
[188.127.251.120 listed in will-spam-for-food.eu.org]
[188.127.251.120 listed in will-spam-for-food.eu.org]
[188.127.251.120 listed in will-spam-for-food.eu.org]
[188.127.251.120 listed in will-spam-for-food.eu.org]
[188.127.251.120 listed in will-spam-for-food.eu.org]
[188.127.251.120 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[188.127.251.120 listed in dnsbl.ahbl.org]
[188.127.251.120 listed in dnsbl.ahbl.org]
[188.127.251.120 listed in dnsbl.ahbl.org]
[188.127.251.120 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[188.127.251.120 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[188.127.251.120 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[188.127.251.120 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[188.127.251.120 listed in dnsbl.ahbl.org]
0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist
[URI: ipfs.io/209.94.90.1]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[188.127.251.120 listed in bb.barracudacentral.org]
2.4 FROM_UNBAL2 From with unbalanced angle brackets, '<' missing
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
3.2 URI_IPFSIO References Interplanetary File System PtP content via
ipfs.io, likely phishing
0.0 URI_IPFS References Interplanetary File System PtP content, probable
phishing
Subject: {SPAM?} Fwd: Purchase order #PO-36739575.adobe
w3.org/TR/html4/loose.dtd">
o, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLAPSE: col=
lapse; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-S=
TYLE: normal; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: norm=
al; BACKGROUND-COLOR: rgb(255,255,255); font-variant-ligatures: normal; fon=
t-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thi=
ckness: initial; text-decoration-style: initial;=20
text-decoration-color: initial" cellSpacing=3D0>
d; HEIGHT: 250px; BORDER-RIGHT: rgb(222,23,23) 1px solid; WIDTH: 400px; BOR=
DER-COLLAPSE: collapse; BORDER-BOTTOM: rgb(222,23,23) 1px solid; PADDING-BO=
TTOM: 10px; PADDING-TOP: 10px; PADDING-LEFT: 10px; BORDER-LEFT: rgb(222,23,=
23) 1px solid; PADDING-RIGHT: 10px; BACKGROUND-COLOR: rgb(255,255,255); bor=
der-radius: 3px 7px">
apse" cellSpacing=3D0 align=3Dcenter>
FONT-SIZE: 13px; FONT-FAMILY: arial; COLOR: rgb(51,51,51)">
=3D"BOX-SIZING: border-box; FONT-WEIGHT: bolder">#PO-36739575.xls<=
BR style=3D"BOX-SIZING: border-box">File Size: 98kb | File Expiry: 3days
PAN>
COLLAPSE: collapse; BACKGROUND-COLOR: rgb(194,1,1); border-radius: 15px" ce=
llSpacing=3D0>
px" align=3Dcenter bis_skin_checked=3D"1">
x; TEXT-DECORATION: none; COLOR: rgb(0,172,255); BACKGROUND-COLOR: transpar=
ent" href=3D"https://ipfs.io/ipfs/QmULozKRB3q9aGVhpr1kqeufdpoUXQRVAtNoxLon9=
1Hvo3#doctor@doctor.nl2k.ab.ca" rel=3Dnoreferrer target=3D_blank>
e=3D"BOX-SIZING: border-box; FONT-SIZE: 13px; FONT-FAMILY: arial; COLOR: rg=
b(255,255,255)">View
FONT-SIZE: 13px; FONT-FAMILY: arial; COLOR: rgb(51,51,51)">
BOX-SIZING: border-box; FONT-SIZE: 13px; FONT-FAMILY: arial; COLOR: rgb(51,=
51,51)">
le=3D"BOX-SIZING: border-box; FONT-WEIGHT: bolder">Message:=
I am interested in some of your produc=
ts.
I want to place a trial order on the products listed in the attached file. =
Kindly check and send your offer, and state your payment terms for trial or=
der.
=
Sender's Profile:=20
- Name: Islam Aoune=20
- Position: Sales Manager=20
- Company: Al-Yassar General Trading LLC=
-interchange-newline>
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments