Yet another attempt to phish nk.ca user accounts
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 13 May 2022 08:16:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1npW56-0002kL-5K
for dave@doctor.nl2k.ab.ca;
Fri, 13 May 2022 08:15:48 -0600
Resent-From: The Doctor
Resent-Date: Fri, 13 May 2022 08:15:48 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [2.56.116.214] (port=56104 helo=server.qrank.co.uk)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1npRZn-000OLy-TO
for root@nk.ca;
Fri, 13 May 2022 03:27:21 -0600
Received: from [45.143.144.187] (port=58647 helo=HY-7EFID)
by server.qrank.co.uk with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95)
(envelope-from)
id 1npRZQ-00019L-Tb
for root@nk.ca;
Fri, 13 May 2022 09:26:48 +0000
From: "nk.ca"
Subject: Account security notice - Immediate action required
To:
Content-Type: multipart/alternative; boundary="PG=_6FI4ulUpS0EiHNkiVjeoEKhuGH7TzE"
MIME-Version: 1.0
Date: Fri, 13 May 2022 11:26:48 +0200
Message-Id: <202213051126423A9D98E1CA-57D470F3F1@nk.ca>
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.qrank.co.uk
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - nk.ca
X-Get-Message-Sender-Via: server.qrank.co.uk: authenticated_id: bounce@qrank.co.uk
X-Authenticated-Sender: server.qrank.co.uk: bounce@qrank.co.uk
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 8.9
X-Spam_score_int: 89
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: We noticed that your root***@nk.ca has been disconnected from
sending and receiving emails We urge you to re-confirm if your account is
still active on nk.ca to officially unlock it to our default settings.
Content analysis details: (8.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=noreply%40nk.ca;ip=2.56.116.214;r=doctor.nl2k.ab.ca]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.5 FSL_BULK_SIG Bulk signature with no Unsubscribe
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.7 NORDNS_LOW_CONTRAST No rDNS + hidden text
0.0 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF
failed
Subject: {SPAM?} Account security notice - Immediate action required
This is a multi-part message in MIME format
--PG=_6FI4ulUpS0EiHNkiVjeoEKhuGH7TzE
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
We noticed that your root***@nk.ca has been disconnected from sending =
and receiving emails
We urge you to re-confirm if your account is still active on nk.ca to =
officially unlock it to our default settings.=20
Re-confirm account=20
Once confirmation is complete, your email will work effectively.=20
B.Regards
=A92022 nk.ca Database Monitor.
--PG=_6FI4ulUpS0EiHNkiVjeoEKhuGH7TzE
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
8859-1">
Account security notice - Immediate action required
--PG=_6FI4ulUpS0EiHNkiVjeoEKhuGH7TzE--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 13 May 2022 08:16:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1npW56-0002kL-5K
for dave@doctor.nl2k.ab.ca;
Fri, 13 May 2022 08:15:48 -0600
Resent-From: The Doctor
Resent-Date: Fri, 13 May 2022 08:15:48 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [2.56.116.214] (port=56104 helo=server.qrank.co.uk)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from
id 1npRZn-000OLy-TO
for root@nk.ca;
Fri, 13 May 2022 03:27:21 -0600
Received: from [45.143.144.187] (port=58647 helo=HY-7EFID)
by server.qrank.co.uk with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95)
(envelope-from
id 1npRZQ-00019L-Tb
for root@nk.ca;
Fri, 13 May 2022 09:26:48 +0000
From: "nk.ca"
Subject: Account security notice - Immediate action required
To:
Content-Type: multipart/alternative; boundary="PG=_6FI4ulUpS0EiHNkiVjeoEKhuGH7TzE"
MIME-Version: 1.0
Date: Fri, 13 May 2022 11:26:48 +0200
Message-Id: <202213051126423A9D98E1CA-57D470F3F1@nk.ca>
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.qrank.co.uk
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - nk.ca
X-Get-Message-Sender-Via: server.qrank.co.uk: authenticated_id: bounce@qrank.co.uk
X-Authenticated-Sender: server.qrank.co.uk: bounce@qrank.co.uk
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 8.9
X-Spam_score_int: 89
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: We noticed that your root***@nk.ca has been disconnected from
sending and receiving emails We urge you to re-confirm if your account is
still active on nk.ca to officially unlock it to our default settings.
Content analysis details: (8.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=noreply%40nk.ca;ip=2.56.116.214;r=doctor.nl2k.ab.ca]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.5 FSL_BULK_SIG Bulk signature with no Unsubscribe
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.7 NORDNS_LOW_CONTRAST No rDNS + hidden text
0.0 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF
failed
Subject: {SPAM?} Account security notice - Immediate action required
This is a multi-part message in MIME format
--PG=_6FI4ulUpS0EiHNkiVjeoEKhuGH7TzE
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
We noticed that your root***@nk.ca has been disconnected from sending =
and receiving emails
We urge you to re-confirm if your account is still active on nk.ca to =
officially unlock it to our default settings.=20
Re-confirm account=20
Once confirmation is complete, your email will work effectively.=20
B.Regards
=A92022 nk.ca Database Monitor.
--PG=_6FI4ulUpS0EiHNkiVjeoEKhuGH7TzE
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
8859-1">
ize=3D2 face=3Dverdana>We noticed that your root***@nk.ca ONG> has been disconnected from sending and receiving emails We= urge you to re-confirm if your account is still active on nk.= ca to officially unlock it to our default settings. <= /FONT>
2 face=3Dverdana> Once confirmation is complete, your email wil= l work effectively. B.Regards ©2022 nk.ca Data= base Monitor. |
--PG=_6FI4ulUpS0EiHNkiVjeoEKhuGH7TzE--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments