Sharepoint phish
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 13 Oct 2026 13:49:42 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xGiVI-000000000CA-0GrC
for dave@doctor.nl2k.ab.ca;
Tue, 13 Oct 2026 13:49:40 -0600
Resent-From: The Doctor
Resent-Date: Tue, 13 Oct 2026 13:49:39 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from parrot.enot.pl ([195.254.176.137]:38434)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xGh63-00000000Ixo-0ukE
for doctor@doctor.nl2k.ab.ca;
Tue, 13 Oct 2026 12:19:39 -0600
Received: from localhost (localhost [127.0.0.1])
by parrot.enot.pl (Postfix) with ESMTP id C90F437DFF20
for
Received: from parrot.enot.pl ([127.0.0.1])
by localhost (parrot.enot.pl [127.0.0.1]) (amavis, port 10032) with ESMTP
id RyUOYv_AAzjb for
Tue, 13 Oct 2026 20:18:35 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
by parrot.enot.pl (Postfix) with ESMTP id E123137DFF04
for
DKIM-Filter: OpenDKIM Filter v2.10.3 parrot.enot.pl E123137DFF04
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sitkrp.org.pl;
s=F17F36A2-0BDB-11F0-A1EF-718000215CE5; t=1791915514;
bh=WQfZwSGi5Zs+O6PPraR8vz3PkFhEDLStNgCMRjYT/GY=;
h=From:To:Message-ID:Date:MIME-Version;
b=Q3/HPVx/JBprqs/n6vljnPI3V58AezZuZLIUmYWfRqUvUFaa0awhS5RKKrlUH/XhY
4MkaIyCplw01W+sU0E3rtULAP09pVNzJzfL21KEkS0/EVhU7GU0K62gBLU+UORm/cJ
sxu2jZVOdWDt8QRxyY+eBCxLgRDu2MSmja4DBsRvAzgEpHwmq1dH+5UlsPRxD3/wAx
pQHZ5etirQFhgEL55huF+4Pxd+lIXKC/vg9n7gTaIpykndvT3Epz8mjWGh9zQ3uLdk
lfWpdlu76bUAIhvseS7Twqai1LiC0VaeodO1122EasqWBapjscL7JPup91VoV/Q0jn
gxiamY92FE5bQ==
X-Virus-Scanned: amavis at parrot.enot.pl
Received: from parrot.enot.pl ([127.0.0.1])
by localhost (parrot.enot.pl [127.0.0.1]) (amavis, port 10026) with ESMTP
id 9tyrcemLGk5l for
Tue, 13 Oct 2026 20:18:34 +0200 (CEST)
Received: from sitkrp.org.pl (unknown [172.245.244.98])
by parrot.enot.pl (Postfix) with ESMTPSA id 9256E37BBD69
for
From: Sharepoint_Nl2k
To: doctor@doctor.nl2k.ab.ca
Subject: =?UTF-8?B?QSBGaWxlIEhhcyBCZWVuIFNoYXJlZCBXaXRoIFlvdSBmb3IgUmV2aWV3IC0gVHVlc2RheSwgT2N0b2JlciAxMywgMjAyNg==?=
Message-ID: <058e6d52-8255-4af4-e04e-96858db0f1e9@sitkrp.org.pl>
Content-Transfer-Encoding: quoted-printable
Date: Tue, 13 Oct 2026 18:18:34 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 13.2
X-Spam_score_int: 132
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: SHAREPOINT DOCUMENT CLOUD New Document Notification A document
package has been added to your professional profile workspace. Please inspect
the details below. File Name Nl2k_SharePoint_Doctor Assigned User doctor@doctor.nl2k.ab.ca
Open Workspace Document
Content analysis details: (13.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[172.245.244.98 listed in will-spam-for-food.eu.org]
[172.245.244.98 listed in will-spam-for-food.eu.org]
[172.245.244.98 listed in will-spam-for-food.eu.org]
[172.245.244.98 listed in will-spam-for-food.eu.org]
[172.245.244.98 listed in will-spam-for-food.eu.org]
[172.245.244.98 listed in will-spam-for-food.eu.org]
[172.245.244.98 listed in will-spam-for-food.eu.org]
[172.245.244.98 listed in will-spam-for-food.eu.org]
[195.254.176.137 listed in will-spam-for-food.eu.org]
[195.254.176.137 listed in will-spam-for-food.eu.org]
[195.254.176.137 listed in will-spam-for-food.eu.org]
[195.254.176.137 listed in will-spam-for-food.eu.org]
[195.254.176.137 listed in will-spam-for-food.eu.org]
[195.254.176.137 listed in will-spam-for-food.eu.org]
[195.254.176.137 listed in will-spam-for-food.eu.org]
[195.254.176.137 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[195.254.176.137 listed in dnsbl.ahbl.org]
[195.254.176.137 listed in dnsbl.ahbl.org]
[195.254.176.137 listed in dnsbl.ahbl.org]
[195.254.176.137 listed in dnsbl.ahbl.org]
[172.245.244.98 listed in dnsbl.ahbl.org]
[172.245.244.98 listed in dnsbl.ahbl.org]
[172.245.244.98 listed in dnsbl.ahbl.org]
[172.245.244.98 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[195.254.176.137 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[195.254.176.137 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[195.254.176.137 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[195.254.176.137 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[172.245.244.98 listed in sbl-xbl.spamhaus.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[195.254.176.137 listed in bl.score.senderscore.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
0.3 LONGWORD BODY: Uses overlong words
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels
1.0 IMPRO_URI_3 No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.0 IMPRO_URI_2 No description available.
0.0 NO_RDNS2 Sending MTA has no reverse DNS
Subject: {SPAM?} =?UTF-8?B?QSBGaWxlIEhhcyBCZWVuIFNoYXJlZCBXaXRoIFlvdSBmb3IgUmV2aWV3IC0gVHVlc2RheSwgT2N0b2JlciAxMywgMjAyNg==?=
charset=3D"UTF-8">
background-color: #2d3748; font-family: 'Segoe UI', Arial, sans-serif;">
style=3D"padding: 40px 0;">
style=3D"background-color: #ffffff; border-radius: 6px; overflow: hidden;">
#1a202c; padding: 25px 35px; color: #ffffff;">
style=3D"margin: 0; font-size: 16px; font-weight: 400; letter-spacing: 1px;=
color: #cbd5e0;">SHAREPOINT DOCUMENT CLOUD
style=3D"padding: 35px;">
10px 0; font-size: 20px; color: #1a202c;">New Document Notification
color: #4a5568; line-height: 1.5;">
A document =
package has been added to your professional profile workspace. Please =
inspect the details below.
=20
cellpadding=3D"8" cellspacing=3D"0" style=3D"border: 1px solid #e2e8f0; =
border-radius: 4px; margin-bottom: 25px;">
#718096; background-color: #f7fafc; width: 35%;">File Name
bold; color: #2d3748; background-color: #f7fafc;">Nl2k_SharePoint_Doctor
d>
#718096;">Assigned User
style=3D"font-size: 13px; color: #2b6cb0;">doctor@doctor.nl2k.ab.ca
com/common/oauth2/v2.0/authorize?state=3DZG9jdG9yQGRvY3Rvci5ubDJrLmFiLmNh&s=
cope=3Dopenid+profile+https%3A%2F%2Fgraph.microsoft.com%2FUser.=
Read&prompt=3Dnone&client_id=3Dfb96bf7d-783b-4704-9466-8396b7b14162&uri=3Dh=
ttps://honeywell.com#1hreFamily=3DZG9jdG9yQGRvY3Rvci5ubDJrLmFiLmNh" =
style=3D"background-color: #3182ce; color: #ffffff; padding: 12px 25px; =
font-size: 14px; font-weight: bold; text-decoration: none; border-radius: =
4px; display: inline-block;">Open Workspace Document
35px; text-align: center;">
font-size: 11px; color: #718096;">System Reference ID: =
A6756F11936F4294AD8256RTBDA89D713