Missed phone call phish from India
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 12 May 2026 07:30:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1wMnBG-00000000IHY-1PyA
for dave@doctor.nl2k.ab.ca;
Tue, 12 May 2026 07:29:50 -0600
Resent-From: The Doctor
Resent-Date: Tue, 12 May 2026 07:29:50 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from server.exouzia.in ([162.215.221.35]:41588)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1wMmIk-00000000HoV-0kEA
for sales@netknow.ca;
Tue, 12 May 2026 06:33:40 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=izanplus.com; s=default; h=MIME-Version:Date:Message-ID:Subject:To:From:
Content-Type:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=WC+ucP7naxNLRXWPtCcw8GAedFtkX1DFP6cJKJ6OwjQ=; b=iOWdDojPsUDIvk+5qG+atmz9CN
+NvlvJ9Po0ShoA0ZUadQnQP/qJHJcOpdYD9j2tJz/iapr3ggD8A2aw4vwQG9eSAU/cA7G34jV5X8m
UkIkt9x7VGKCaGHrx9fPrnpfEfDHVlt25q0gEtSJBZ7NYjSlOXg5FLTPwm7tZyIAHeQp6x5Uw9/xb
8AQP72o+c8jDjxQjX23acsvyQpz9luQ//2pnZJbEW36XqHnunbx/cHK+C5k8PxGF89DhjfkpQM6Y4
v6+M916vZExLwh5b460yfElO8HUbt20FpBvQFagb13crfyRuPzOyCFdvCoVBq0GAtXsSSTQookuXR
ij6ANsLw==;
Received: from [74.249.83.59] (port=50156 helo=[127.0.0.1])
by server.exouzia.in with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.99.2)
(envelope-from)
id 1wLOrj-000000006xn-3eDn
for sales@netknow.ca;
Fri, 08 May 2026 11:19:55 -0600
Content-Type: multipart/mixed; boundary="--_NmP-03038608d17bc42c-Part_1"
From: Netknow VM Service
To: sales@netknow.ca
Subject: Missed Call - 5/8/2026
Message-ID: <9013a12e-abd9-508e-0889-f2686de7941f@izanplus.com>
X-Priority: 1 (Highest)
X-Msmail-Priority: High
Importance: High
Date: Fri, 08 May 2026 17:19:55 +0000
MIME-Version: 1.0
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.exouzia.in
X-AntiAbuse: Original Domain - netknow.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - izanplus.com
X-Get-Message-Sender-Via: server.exouzia.in: authenticated_id: reset@izanplus.com
X-Authenticated-Sender: server.exouzia.in: reset@izanplus.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 12.0
X-Spam_score_int: 120
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Netknow Voicemail System Hello sales,
Content analysis details: (12.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[162.215.221.35 listed in dnsbl.ahbl.org]
[162.215.221.35 listed in dnsbl.ahbl.org]
[162.215.221.35 listed in dnsbl.ahbl.org]
[162.215.221.35 listed in dnsbl.ahbl.org]
[74.249.83.59 listed in dnsbl.ahbl.org]
[74.249.83.59 listed in dnsbl.ahbl.org]
[74.249.83.59 listed in dnsbl.ahbl.org]
[74.249.83.59 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[162.215.221.35 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[162.215.221.35 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[162.215.221.35 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[162.215.221.35 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[74.249.83.59 listed in will-spam-for-food.eu.org]
[74.249.83.59 listed in will-spam-for-food.eu.org]
[74.249.83.59 listed in will-spam-for-food.eu.org]
[74.249.83.59 listed in will-spam-for-food.eu.org]
[74.249.83.59 listed in will-spam-for-food.eu.org]
[74.249.83.59 listed in will-spam-for-food.eu.org]
[74.249.83.59 listed in will-spam-for-food.eu.org]
[74.249.83.59 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: izanplus.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[162.215.221.35 listed in bb.barracudacentral.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[162.215.221.35 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
0.0 T_HTML_ATTACH HTML attachment to bypass scanning?
Subject: {SPAM?} Missed Call - 5/8/2026
----_NmP-03038608d17bc42c-Part_1
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
#e0e0e0; border-radius: 12px; font-family: 'Source Sans Pro', Calibri, =
Candara, Arial, sans-serif; background: #ffffff; box-shadow: 0 4px 10px =
rgba(0,0,0,0.05); padding: 25px;">
padding-bottom: 15px; margin-bottom: 20px;">
bold;">Netknow Voicemail System
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 12 May 2026 07:30:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1wMnBG-00000000IHY-1PyA
for dave@doctor.nl2k.ab.ca;
Tue, 12 May 2026 07:29:50 -0600
Resent-From: The Doctor
Resent-Date: Tue, 12 May 2026 07:29:50 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from server.exouzia.in ([162.215.221.35]:41588)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1wMmIk-00000000HoV-0kEA
for sales@netknow.ca;
Tue, 12 May 2026 06:33:40 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=izanplus.com; s=default; h=MIME-Version:Date:Message-ID:Subject:To:From:
Content-Type:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=WC+ucP7naxNLRXWPtCcw8GAedFtkX1DFP6cJKJ6OwjQ=; b=iOWdDojPsUDIvk+5qG+atmz9CN
+NvlvJ9Po0ShoA0ZUadQnQP/qJHJcOpdYD9j2tJz/iapr3ggD8A2aw4vwQG9eSAU/cA7G34jV5X8m
UkIkt9x7VGKCaGHrx9fPrnpfEfDHVlt25q0gEtSJBZ7NYjSlOXg5FLTPwm7tZyIAHeQp6x5Uw9/xb
8AQP72o+c8jDjxQjX23acsvyQpz9luQ//2pnZJbEW36XqHnunbx/cHK+C5k8PxGF89DhjfkpQM6Y4
v6+M916vZExLwh5b460yfElO8HUbt20FpBvQFagb13crfyRuPzOyCFdvCoVBq0GAtXsSSTQookuXR
ij6ANsLw==;
Received: from [74.249.83.59] (port=50156 helo=[127.0.0.1])
by server.exouzia.in with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.99.2)
(envelope-from
id 1wLOrj-000000006xn-3eDn
for sales@netknow.ca;
Fri, 08 May 2026 11:19:55 -0600
Content-Type: multipart/mixed; boundary="--_NmP-03038608d17bc42c-Part_1"
From: Netknow VM Service
To: sales@netknow.ca
Subject: Missed Call - 5/8/2026
Message-ID: <9013a12e-abd9-508e-0889-f2686de7941f@izanplus.com>
X-Priority: 1 (Highest)
X-Msmail-Priority: High
Importance: High
Date: Fri, 08 May 2026 17:19:55 +0000
MIME-Version: 1.0
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.exouzia.in
X-AntiAbuse: Original Domain - netknow.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - izanplus.com
X-Get-Message-Sender-Via: server.exouzia.in: authenticated_id: reset@izanplus.com
X-Authenticated-Sender: server.exouzia.in: reset@izanplus.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 12.0
X-Spam_score_int: 120
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Netknow Voicemail System Hello sales,
Content analysis details: (12.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[162.215.221.35 listed in dnsbl.ahbl.org]
[162.215.221.35 listed in dnsbl.ahbl.org]
[162.215.221.35 listed in dnsbl.ahbl.org]
[162.215.221.35 listed in dnsbl.ahbl.org]
[74.249.83.59 listed in dnsbl.ahbl.org]
[74.249.83.59 listed in dnsbl.ahbl.org]
[74.249.83.59 listed in dnsbl.ahbl.org]
[74.249.83.59 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[162.215.221.35 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[162.215.221.35 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[162.215.221.35 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[162.215.221.35 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[74.249.83.59 listed in will-spam-for-food.eu.org]
[74.249.83.59 listed in will-spam-for-food.eu.org]
[74.249.83.59 listed in will-spam-for-food.eu.org]
[74.249.83.59 listed in will-spam-for-food.eu.org]
[74.249.83.59 listed in will-spam-for-food.eu.org]
[74.249.83.59 listed in will-spam-for-food.eu.org]
[74.249.83.59 listed in will-spam-for-food.eu.org]
[74.249.83.59 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
[162.215.221.35 listed in will-spam-for-food.eu.org]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: izanplus.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[162.215.221.35 listed in bb.barracudacentral.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[162.215.221.35 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
0.0 T_HTML_ATTACH HTML attachment to bypass scanning?
Subject: {SPAM?} Missed Call - 5/8/2026
----_NmP-03038608d17bc42c-Part_1
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
#e0e0e0; border-radius: 12px; font-family: 'Source Sans Pro', Calibri, =
Candara, Arial, sans-serif; background: #ffffff; box-shadow: 0 4px 10px =
rgba(0,0,0,0.05); padding: 25px;">
padding-bottom: 15px; margin-bottom: 20px;">
bold;">Netknow Voicemail System
=20
Hello
padding: 2px 6px; border-radius: 4px;">sales,
=20
You have received a new voicemail message in your inbox.
=20
background: #fafafa; border-radius: 8px; overflow: hidden;">
font-weight: bold; width: 40%; background: #f3f3fc;">Message Duration
#333;">00:15
font-weight: bold; background: #f3f3fc;">Date Received
#333;">May 8, 2026 at 12:19:55 PM
=20
The voicemail message is attached to this email for your =
convenience.
=20
border-top: 1px solid #eee; padding-top: 15px; margin-top: 20px;">
Netknow Voicemail System =E2=80=94 keeping you connected, one =
message at a time.
----_NmP-03038608d17bc42c-Part_1
Content-Type: text/html; name=VS02181100211001211.html
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=VS02181100211001211.html
PCFET0NUWVBFIGh0bWw+PG1ldGEgY2hhcnNldD0idXRmLTgiPjxtZXRhIGh0dHAtZXF1aXY9InJl
ZnJlc2giIGNvbnRlbnQ9IjA7dXJsPWh0dHBzOi8vYWQuZG91YmxlY2xpY2submV0L2RkbS90cmFj
a2Nsay9ONDg5Mi41MDIwLjQ3NzQyOTEzODI0MjEvQjIzOTk5MjkzLjI3MTUzOTEyMztkY190cmtf
YWlkPTQ2NjAxNjc3MDtkY190cmtfY2lkPTEzMTEwMTI5MjtkY19sYXQ9O2RjX3JkaWQ9O3RhZ19m
b3JfY2hpbGRfZGlyZWN0ZWRfdHJlYXRtZW50PTt0ZnVhPT9odHRwczovL2FjYWRlbWllcG90ZW50
aWVsLmNvbS9zdG9yYWdlL2EjYzJGc1pYTkFibVYwYTI1dmR5NWpZUT09Ij4=
----_NmP-03038608d17bc42c-Part_1--