invoice phish
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 13 May 2026 19:54:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wNLGw-000000002dd-3OFb
for dave@doctor.nl2k.ab.ca;
Wed, 13 May 2026 19:53:58 -0600
Resent-From: The Doctor
Resent-Date: Wed, 13 May 2026 19:53:58 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from ip74-208-96-234.pbiaas.com ([74.208.96.234]:64405)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wNHSY-000000001Sd-0Sii
for doctor@nl2k.ab.ca;
Wed, 13 May 2026 15:49:50 -0600
Reply-To: farranbarrow@studiomodernitta.com.br
From: "Farran Barrow"
To: doctor@nl2k.ab.ca
Subject: Invoice copy
Date: 13 May 2026 21:48:53 +0000
Message-ID: <20260513214852.F4AEA2EEC0C4E34E@canva.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 6.5
X-Spam_score_int: 65
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Please view the attached Invoice copy or request for the download
invoice link. Sent to : doctor@nl2k.ab.ca Thanks,
Content analysis details: (6.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[74.208.96.234 listed in dnsbl.ahbl.org]
[74.208.96.234 listed in dnsbl.ahbl.org]
[74.208.96.234 listed in dnsbl.ahbl.org]
[74.208.96.234 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[74.208.96.234 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[74.208.96.234 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[74.208.96.234 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[74.208.96.234 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[74.208.96.234 listed in will-spam-for-food.eu.org]
[74.208.96.234 listed in will-spam-for-food.eu.org]
[74.208.96.234 listed in will-spam-for-food.eu.org]
[74.208.96.234 listed in will-spam-for-food.eu.org]
[74.208.96.234 listed in will-spam-for-food.eu.org]
[74.208.96.234 listed in will-spam-for-food.eu.org]
[74.208.96.234 listed in will-spam-for-food.eu.org]
[74.208.96.234 listed in will-spam-for-food.eu.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[74.208.96.234 listed in bl.score.senderscore.com]
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Rejected by SPF record.]
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.4 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
1.0 FROM_MISSP_SPF_FAIL No description available.
1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.0 FROM_MISSPACED From: missing whitespace
0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope
Subject: {SPAM?} Invoice copy
Please view the attached Invoice copy or request for the download=20
invoice link.
Sent to : doctor@nl2k.ab.ca
Thanks,
Farran Barrow
Gulf Coast Gasket Guy
8722 Rand Ave., Ste A
Daphne, AL 36526
877-626-0701
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 13 May 2026 19:54:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wNLGw-000000002dd-3OFb
for dave@doctor.nl2k.ab.ca;
Wed, 13 May 2026 19:53:58 -0600
Resent-From: The Doctor
Resent-Date: Wed, 13 May 2026 19:53:58 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from ip74-208-96-234.pbiaas.com ([74.208.96.234]:64405)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wNHSY-000000001Sd-0Sii
for doctor@nl2k.ab.ca;
Wed, 13 May 2026 15:49:50 -0600
Reply-To: farranbarrow@studiomodernitta.com.br
From: "Farran Barrow"
To: doctor@nl2k.ab.ca
Subject: Invoice copy
Date: 13 May 2026 21:48:53 +0000
Message-ID: <20260513214852.F4AEA2EEC0C4E34E@canva.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 6.5
X-Spam_score_int: 65
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Please view the attached Invoice copy or request for the download
invoice link. Sent to : doctor@nl2k.ab.ca Thanks,
Content analysis details: (6.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[74.208.96.234 listed in dnsbl.ahbl.org]
[74.208.96.234 listed in dnsbl.ahbl.org]
[74.208.96.234 listed in dnsbl.ahbl.org]
[74.208.96.234 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[74.208.96.234 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[74.208.96.234 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[74.208.96.234 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[74.208.96.234 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[74.208.96.234 listed in will-spam-for-food.eu.org]
[74.208.96.234 listed in will-spam-for-food.eu.org]
[74.208.96.234 listed in will-spam-for-food.eu.org]
[74.208.96.234 listed in will-spam-for-food.eu.org]
[74.208.96.234 listed in will-spam-for-food.eu.org]
[74.208.96.234 listed in will-spam-for-food.eu.org]
[74.208.96.234 listed in will-spam-for-food.eu.org]
[74.208.96.234 listed in will-spam-for-food.eu.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[74.208.96.234 listed in bl.score.senderscore.com]
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Rejected by SPF record.]
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.4 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
1.0 FROM_MISSP_SPF_FAIL No description available.
1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.0 FROM_MISSPACED From: missing whitespace
0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope
Subject: {SPAM?} Invoice copy
Please view the attached Invoice copy or request for the download=20
invoice link.
Sent to : doctor@nl2k.ab.ca
Thanks,
Farran Barrow
Gulf Coast Gasket Guy
8722 Rand Ave., Ste A
Daphne, AL 36526
877-626-0701
