RBC PHish from Google Gmail

Trackbacks

Comments

Add Comment

Posted by Dave Yadallee on Thursday, November 28. 2024

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 28 Nov 2024 04:32:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGcjy-000000001uA-09gX

for dave@doctor.nl2k.ab.ca;

Thu, 28 Nov 2024 04:31:22 -0700

Resent-From: The Doctor

Resent-Date: Thu, 28 Nov 2024 04:31:22 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f170.google.com ([209.85.208.170]:47476)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGVz7-000000008aS-37zx

for doctor@netknow.ca;

Wed, 27 Nov 2024 21:18:41 -0700

Received: by mail-lj1-f170.google.com with SMTP id 38308e7fff4ca-2ffa3e8e917so4161731fa.3

for ; Wed, 27 Nov 2024 20:16:38 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1732767391; x=1733372191; darn=netknow.ca;

h=date:to:from:subject:mime-version:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=s0KnP4b34eYlxMaS6tKZyqRpJKB67VQrKabESLAwPUc=;

b=U5eCqXEShAkc+NCGpjLbU4pL4L9ThyR8wrEyaxD3KOQEY+LmiZT12v+ybAVdujsxIL

Q/NuBjItmDnwMC23YLtrNGXoxBKiHhCZEkzuiDDY5+0BPSDEr3ortq6qKBJrZhX0NU2W

pyEFAXxOrpMBTJTOU4LUS0Ioi7WD9hgYk6Vzm2V0aMDT7WkEcsYqO7ZKeP4bwj4ZFoCt

oU8TyBFFIbn/Gx5ZYtas+ptVDEY9H2CquCdeaSTDys9T513kDJHFFb4jvCTVgUku/iFT

6iwTEx6ftHwLr8AB/+nWGYpIcCWzFs1SAzgT+flEczJihRtjoqhfsemly5o54aybd4VF

+rbQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732767391; x=1733372191;

h=date:to:from:subject:mime-version:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=s0KnP4b34eYlxMaS6tKZyqRpJKB67VQrKabESLAwPUc=;

b=Vr3ULyOkiAmsNUG+HlIBAhoy6b8P8krBid8r8xaHCkQZzu2XoiHk081fJ7gA1RRYHA

3G3YNmNjqSpFszyrv/BOjHDHfUMRWBNCXW/165QwdP4CPD1qiAcvXmevL6bdB6Ox1KWG

MP3543wibXGynElNKWMIolOYUY1Of0QE0mfaYmenPZkqfQWpZmLqh1h87KxptAVwLKAe

l81pCW4LPVltdxEiUtWXoWwKRZpW8KnTu/hWm69H8LrFDUEXJS2YCF5zaPQ952dUl7hv

DlfmDgHzMA/3SeDgMLscHwOpATxLx2N3xKB2PPL5/jMaO0E6bJZr/C1lRmYC3uR/p+zu

EToQ==

X-Gm-Message-State: AOJu0YyBG58cXOoXeCIYvpm2w5k+S/PgJCBafsONjR6KdTjeEf+vtoFP

9ZCjt0P2pK6znXl4pQJGh9N/lUPzIC8G9U5Mo9boAmNWdjFc43pN6WSvlQ==

X-Gm-Gg: ASbGncsChmDcXegpa0CTiCS06/Z7iLxtrfciZbLR5G162dP/7sD+iqqk0wKx4she7W9

X0Q/34tZbf9umEbFsn9yRlm8rwyZD78LtvVmxonjivWLhC61n/EL41yPrBzXTkmKwZWUON3G7+Y

TVxiEpAHs1PAXQ+nLJ4QoSJgasiosU0A9Hzy0+etZh6z+RAarbfM3JwKQIRarmR33RYsVB9OMo5

FC2Xr/i3+b339Zfwiqje5XNhbeAdQ1I2iKPuL++YTnJgWF9MnW/yIT+

X-Google-Smtp-Source: AGHT+IHQCopmdL2k+ljeYcnliAaGYkFqSJh0xZ7nUNvFec8QQCrmHZipAgi1u24IMNHaOoJhNpwWow==

X-Received: by 2002:a2e:b8c3:0:b0:2ff:c3d2:b0ab with SMTP id 38308e7fff4ca-2ffd6120f5fmr37965351fa.29.1732767390945;

Wed, 27 Nov 2024 20:16:30 -0800 (PST)

Received: from rbc-desktop ([2a03:94e0:2637:a37d:a879:344:7da2:c7])

by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-2ffdfbef6cbsm734791fa.42.2024.11.27.20.16.28

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 27 Nov 2024 20:16:29 -0800 (PST)

Message-ID: <6747ee9d.2e0a0220.2d609a.0bc8@mx.google.com>

Content-Type: multipart/mixed; boundary="===============3599855668112714759=="

MIME-Version: 1.0

Subject: Please verify your email address

From: RBC Royal Bank

To: doctor@netknow.ca

Date: Wed, 27 Nov 2024 20:16:27 -0800

X-Spam_score: 6.6

X-Spam_score_int: 66

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Dear RBC Client, The following RBC e-Alert(s) is(are) accessible:

Confirm your email address to finalize your verification

Content analysis details: (6.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

[209.85.208.170 listed in dnsbl.ahbl.org]

[209.85.208.170 listed in dnsbl.ahbl.org]

[209.85.208.170 listed in dnsbl.ahbl.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.170 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.170 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[asabeafrimpong(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

Subject: {SPAM?} Please verify your email address

--===============3599855668112714759==

Content-Type: multipart/related; boundary="===============7686648418944254050=="

MIME-Version: 1.0

--===============7686648418944254050==

Content-Type: multipart/alternative; boundary="===============7818777363425432827=="

MIME-Version: 1.0

--===============7818777363425432827==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64

PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBXMyBIVE1MLy9FTiI+PGh0bWw+Cjxo

ZWFkPgo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsg

Y2hhcnNldD1pc28tODg1OS0xIj48L2hlYWQ+Cjxib2R5PgoJCglEZWFyIFJCQyBDbGllbnQsPGJy

Pjxicj4KClRoZSBmb2xsb3dpbmcgUkJDIGUtQWxlcnQocykgaXMoYXJlKSBhY2Nlc3NpYmxlOjxi

cj4KCTxicj4KQ29uZmlybSB5b3VyIGVtYWlsIGFkZHJlc3MgdG8gZmluYWxpemUgeW91ciB2ZXJp

ZmljYXRpb248YnI+Cgk8YnI+ClRvIGNvbXBseSB3aXRoIHJlY2VudCB1cGRhdGVzIHRvIG91ciBz

ZWN1cml0eSB0ZXJtcywgcGxlYXNlIGNvbmZpcm0geW91ciBlbWFpbCBhZGRyZXNzLjxicj4KCTxi

cj4KVG8gZmluYWxpemUgdGhlIHZlcmlmaWNhdGlvbiBwcm9jZXNzLCBsb2cgaW4gdG8gUkJDIE9u

bGluZSBCYW5raW5nIHRocm91Z2ggdGhlIGxpbmsgYmVsb3c6Cgk8YnI+PGJyPgo8YSBocmVmPSJo

dHRwczovL3dpdGhpbmdrYXJhc2lra29jaGcuYmxvZ3Nwb3QuY29tLyI+Q29uZmlybSB5b3VyIGVt

YWlsIGZvciB2ZXJpZmljYXRpb248L2E+PGJyPgoKCTxicj5BZGp1c3QgeW91ciBlbWFpbCBub3Rp

ZmljYXRpb24gcHJlZmVyZW5jZXMgaW4gUkJDIE9ubGluZSBCYW5raW5nLCBzZWxlY3QgJnF1b3Q7

UHJvZmlsZSBhbmQgUHJlZmVyZW5jZXMmcXVvdDsgZnJvbSB0aGUgQmFua2luZyB0YWIgdW5kZXIg

TXkgQWNjb3VudHMuPGJyPjxicj4KCglFbWFpbCB3aXRob3V0IGVuY3J5cHRpb24gaXMgaW5zZWN1

cmUgZm9yIHBlcnNvbmFsIGRldGFpbHMuIEZvciBzYWZlIGNvbW11bmljYXRpb24sIHNlbmQgeW91

ciBtZXNzYWdlIHZpYSB0aGUgUkJDIFJveWFsIEJhbmsgT25saW5lIEJhbmtpbmcgbWVzc2FnZSBj

ZW50ZXIgb3IgYW5vdGhlciBzZWN1cmUgb3B0aW9uLCBvciBjb250YWN0IHVzIGJ5IDxhIGhyZWY9

IiMiPnBob25lPC9hPi48YnI+PGJyPgoKCU91dHNpZGUgQ2FuYWRhIGFuZCB0aGUgVS5TLjogIENv

bnRhY3QgdXMgdmlhIG91ciA8YSBocmVmPSIjIj5JbnRlcm5hdGlvbmFsIEN1c3RvbWVyIFNlcnZp

Y2VzPC9hPgoKCVRoaXMgZW1haWwgd2FzIHNlbnQgZnJvbSBhbiB1bm1vbml0b3JlZCBhY2NvdW50

OyBwbGVhc2UgZG8gbm90IHJlcGx5Ljxicj48YnI+CgoJXlJCQyBCYW5rIGlzIG9mZmVyZWQgYnkg

Um95YWwgQmFuayBvZiBDYW5hZGEuCgoJPC9ib2R5Pgo8L2h0bWw+

--===============7818777363425432827==--

--===============7686648418944254050==--

--===============3599855668112714759==--

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Display comments as Linear | Threaded

No comments

January '25

Name

Homepage

In reply to

Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.

Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enter the string from the spam-prevention image above:

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.

Standard emoticons like :-) and ;-) are converted to images.

Enter the string from the spam-prevention image above:

Remember Information?

Subscribe to this entry