Canada Revenue agency phish from Barracuda/Amazon
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 27 Jul 2026 09:24:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1woNAq-00000000BId-1sdx
for dave@doctor.nl2k.ab.ca;
Mon, 27 Jul 2026 09:23:24 -0600
Resent-From: The Doctor
Resent-Date: Mon, 27 Jul 2026 09:23:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from egress-ip36b.ess.ca.barracuda.com ([15.222.16.245]:57286)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1woN0t-00000000AQ8-3cWF
for sales@nk.ca;
Mon, 27 Jul 2026 09:13:16 -0600
Received: from yk-prod-fe2.internal.messaging (s199-85-226-114.nt.northwestel.net [199.85.226.114]) by mx-outbound42-255.ca-central-1d.ess.aws.cudaops.com; Mon, 27 Jul 2026 15:12:14 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=northwestel;
d=northwestel.net;
h=Date:To:From:Subject:Message-Id:MIME-Version:Sender;
bh=Qt06mb5bhEhuWc1vrJR1EoGV0nOwNQwb4FPJjW4PS7M=;
b=YhPFwp4mI0OndkWgiutcmZGfe8IAUF2UaLGthPEyqEpq5rT4ecVPmx6FJ9c0dqqrKgG2qn2LYT5K
BZOIklOsScVdjcDEThveuw8jUG8yoiL6IcZgiC2ONshNerBCuocLmzXWZtopxRSE6vqJKJgM4RyL
hmgez0RmmkszbuZMroGm13ynfk7FowX/n25V37okNpCTid1kYwUFzOiUWbuNGeLbBEGKfpOnAydr
waprXDrAc+LvFVqsliZZiH30KXCUPLqQlPxskB7pwtrq4Y75F2Bdo/Pks5elvBg17yOKgvE6ng4u
7sh/hufatP2EHxSNmOrBVLWFVJQ9WX20JpMfdw==
MIME-version: 1.0
Content-transfer-encoding: 7BIT
Content-type: text/html
Received: from dkim-sign.northwestel.ca-daemon by
yk-prod-fe2.internal.messaging
(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16
2025)) id <0TIL1V300OHQUF00@yk-prod-fe2.internal.messaging> for sales@nk.ca;
Wed, 22 Jul 2026 17:42:01 -0600 (MDT)
Received: from [14.192.212.27] ([172.19.112.111])
by yk-prod-fe2.internal.messaging
(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16
2025)) with ESMTPA id <0TIL1UUDUOHYYH40@yk-prod-fe2.internal.messaging> for
sales@nk.ca; Wed, 22 Jul 2026 17:42:01 -0600 (MDT)
From:
"Canada Revenue Agency / Agence du Revenu du Canada"
To: sales@nk.ca
Subject:
=?UTF-8?B?UGF5bWVudCBBcHByb3ZlZCAtIENhbmFkYSBSZXZlbnVlIEFnZW5jeSAvIFBhaWVtZW50IGFwcHJvdXbDqSAtIEFnZW5jZSBkdSByZXZlbnUgZHUgQ2FuYWRh?=
Date: 22 Jul 2026 18:41:57 -0500
Message-id: <20260722184157.0305E647F110AB77@northwestel.net>
X-BESS-ID: 1785165134-411007-15463-7320-1
X-BESS-VER: 2019.1_20260723.2316
X-BESS-Apparent-Source-IP: 199.85.226.114
X-BESS-Parts: H4sIAAAAAAACA4uuVkqtKFGyUsooyVXSUcovVrKyNDAxBbIygILJpklGpmlJaU
lJqaYWiWkWpommRkmJJqnGSaapqUaJRkq1sQB6AOxpQQAAAA==
X-BESS-Outbound-Spam-Score: 1.00
X-BESS-Outbound-Spam-Report: Code version 3.2, rules version 3.2.2.274951 [from
cloudscan11-130.ca-central-1a.ess.aws.cudaops.com]
Rule breakdown below
pts rule name description
---- ---------------------- --------------------------------
0.00 HTML_MESSAGE BODY: HTML included in message
0.00 BSF_BESS_OUTBOUND META: BESS Outbound
0.50 BSF_SC7_PS0024c META: Custom rule BSF_SC7_PS0024c
0.50 BSF_SC5_MJ1963 META: Custom Rule MJ1963
0.00 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
X-BESS-Outbound-Spam-Status: SCORE=1.00 using account:ESS173759 scores of KILL_LEVEL=7.0 tests=HTML_MESSAGE, BSF_BESS_OUTBOUND, BSF_SC7_PS0024c, BSF_SC5_MJ1963, MIME_HTML_ONLY
X-BESS-BRTS-Status:1
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 27 Jul 2026 09:24:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1woNAq-00000000BId-1sdx
for dave@doctor.nl2k.ab.ca;
Mon, 27 Jul 2026 09:23:24 -0600
Resent-From: The Doctor
Resent-Date: Mon, 27 Jul 2026 09:23:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from egress-ip36b.ess.ca.barracuda.com ([15.222.16.245]:57286)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1woN0t-00000000AQ8-3cWF
for sales@nk.ca;
Mon, 27 Jul 2026 09:13:16 -0600
Received: from yk-prod-fe2.internal.messaging (s199-85-226-114.nt.northwestel.net [199.85.226.114]) by mx-outbound42-255.ca-central-1d.ess.aws.cudaops.com; Mon, 27 Jul 2026 15:12:14 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=northwestel;
d=northwestel.net;
h=Date:To:From:Subject:Message-Id:MIME-Version:Sender;
bh=Qt06mb5bhEhuWc1vrJR1EoGV0nOwNQwb4FPJjW4PS7M=;
b=YhPFwp4mI0OndkWgiutcmZGfe8IAUF2UaLGthPEyqEpq5rT4ecVPmx6FJ9c0dqqrKgG2qn2LYT5K
BZOIklOsScVdjcDEThveuw8jUG8yoiL6IcZgiC2ONshNerBCuocLmzXWZtopxRSE6vqJKJgM4RyL
hmgez0RmmkszbuZMroGm13ynfk7FowX/n25V37okNpCTid1kYwUFzOiUWbuNGeLbBEGKfpOnAydr
waprXDrAc+LvFVqsliZZiH30KXCUPLqQlPxskB7pwtrq4Y75F2Bdo/Pks5elvBg17yOKgvE6ng4u
7sh/hufatP2EHxSNmOrBVLWFVJQ9WX20JpMfdw==
MIME-version: 1.0
Content-transfer-encoding: 7BIT
Content-type: text/html
Received: from dkim-sign.northwestel.ca-daemon by
yk-prod-fe2.internal.messaging
(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16
2025)) id <0TIL1V300OHQUF00@yk-prod-fe2.internal.messaging> for sales@nk.ca;
Wed, 22 Jul 2026 17:42:01 -0600 (MDT)
Received: from [14.192.212.27] ([172.19.112.111])
by yk-prod-fe2.internal.messaging
(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16
2025)) with ESMTPA id <0TIL1UUDUOHYYH40@yk-prod-fe2.internal.messaging> for
sales@nk.ca; Wed, 22 Jul 2026 17:42:01 -0600 (MDT)
From:
"Canada Revenue Agency / Agence du Revenu du Canada"
To: sales@nk.ca
Subject:
=?UTF-8?B?UGF5bWVudCBBcHByb3ZlZCAtIENhbmFkYSBSZXZlbnVlIEFnZW5jeSAvIFBhaWVtZW50IGFwcHJvdXbDqSAtIEFnZW5jZSBkdSByZXZlbnUgZHUgQ2FuYWRh?=
Date: 22 Jul 2026 18:41:57 -0500
Message-id: <20260722184157.0305E647F110AB77@northwestel.net>
X-BESS-ID: 1785165134-411007-15463-7320-1
X-BESS-VER: 2019.1_20260723.2316
X-BESS-Apparent-Source-IP: 199.85.226.114
X-BESS-Parts: H4sIAAAAAAACA4uuVkqtKFGyUsooyVXSUcovVrKyNDAxBbIygILJpklGpmlJaU
lJqaYWiWkWpommRkmJJqnGSaapqUaJRkq1sQB6AOxpQQAAAA==
X-BESS-Outbound-Spam-Score: 1.00
X-BESS-Outbound-Spam-Report: Code version 3.2, rules version 3.2.2.274951 [from
cloudscan11-130.ca-central-1a.ess.aws.cudaops.com]
Rule breakdown below
pts rule name description
---- ---------------------- --------------------------------
0.00 HTML_MESSAGE BODY: HTML included in message
0.00 BSF_BESS_OUTBOUND META: BESS Outbound
0.50 BSF_SC7_PS0024c META: Custom rule BSF_SC7_PS0024c
0.50 BSF_SC5_MJ1963 META: Custom Rule MJ1963
0.00 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
X-BESS-Outbound-Spam-Status: SCORE=1.00 using account:ESS173759 scores of KILL_LEVEL=7.0 tests=HTML_MESSAGE, BSF_BESS_OUTBOUND, BSF_SC7_PS0024c, BSF_SC5_MJ1963, MIME_HTML_ONLY
X-BESS-BRTS-Status:1