Phish from emailsvr.com
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 22 Jun 2022 14:43:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1o47BA-0009lk-8v
for dave@doctor.nl2k.ab.ca;
Wed, 22 Jun 2022 14:42:24 -0600
Resent-From: The Doctor
Resent-Date: Wed, 22 Jun 2022 14:42:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from smtp106.ord1d.emailsrvr.com ([184.106.54.106]:46262)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1o40us-0009eo-2r
for doctor@nl2k.ab.ca;
Wed, 22 Jun 2022 08:01:15 -0600
X-Auth-ID: amusarra@raypricecars.com
Received: by smtp6.relay.ord1d.emailsrvr.com (Authenticated sender: amusarra-AT-raypricecars.com) with ESMTPA id EBD36E019E;
Wed, 22 Jun 2022 10:00:16 -0400 (EDT)
From: "Amusarra"
Subject: Payment Received
Date: Wed, 22 Jun 2022 14:00:33 -0000
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_00F0_01C2A9A6.336845BA"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Classification-ID: c219685d-7d4d-4b99-a3d5-1b8177297026-1-1
X-Spam_score: 8.7
X-Spam_score_int: 87
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your payment was received, Attached is your invoice copy
Content analysis details: (8.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
1.2 MISSING_HEADERS Missing To: header
0.0 T_OBFU_HTML_ATTACH BODY: HTML attachment with non-text MIME type
-0.0 T_SCC_BODY_TEXT_LINE No description available.
3.5 PHISH_ATTACH Attachment filename suspicious, probable phishing
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 T_HTML_ATTACH HTML attachment to bypass scanning?
0.0 OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced From
0.0 T_OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced
From
0.1 MISSING_MID Missing Message-Id: header
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.0 FROM_MISSPACED From: missing whitespace
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope
Subject: {SPAM?} Payment Received
This is a multi-part message in MIME format.
------=_NextPart_000_00F0_01C2A9A6.336845BA
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
Your payment was received, Attached is your invoice copy
------=_NextPart_000_00F0_01C2A9A6.336845BA
Content-Type: application/octet-stream;
name="PTKOPJAX2196_22_pdf.HTML"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="PTKOPJAX2196_22_pdf.HTML"
PGJvZHkgb25sb2FkPSJqYXZhc2NyaXB0OndpbmRvdy5sb2NhdGlvbi5ocmVm
PSdodHRwczovL2toYWJyaW1lZGlhLmNvbS93cC1pbmNsdWRlcy8xQS9QVEtP
UEpBWDIxOTZfMjJfcGRmLmlzbyc7Ij4K
------=_NextPart_000_00F0_01C2A9A6.336845BA--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 22 Jun 2022 14:43:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1o47BA-0009lk-8v
for dave@doctor.nl2k.ab.ca;
Wed, 22 Jun 2022 14:42:24 -0600
Resent-From: The Doctor
Resent-Date: Wed, 22 Jun 2022 14:42:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from smtp106.ord1d.emailsrvr.com ([184.106.54.106]:46262)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from
id 1o40us-0009eo-2r
for doctor@nl2k.ab.ca;
Wed, 22 Jun 2022 08:01:15 -0600
X-Auth-ID: amusarra@raypricecars.com
Received: by smtp6.relay.ord1d.emailsrvr.com (Authenticated sender: amusarra-AT-raypricecars.com) with ESMTPA id EBD36E019E;
Wed, 22 Jun 2022 10:00:16 -0400 (EDT)
From: "Amusarra"
Subject: Payment Received
Date: Wed, 22 Jun 2022 14:00:33 -0000
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_00F0_01C2A9A6.336845BA"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Classification-ID: c219685d-7d4d-4b99-a3d5-1b8177297026-1-1
X-Spam_score: 8.7
X-Spam_score_int: 87
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your payment was received, Attached is your invoice copy
Content analysis details: (8.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
1.2 MISSING_HEADERS Missing To: header
0.0 T_OBFU_HTML_ATTACH BODY: HTML attachment with non-text MIME type
-0.0 T_SCC_BODY_TEXT_LINE No description available.
3.5 PHISH_ATTACH Attachment filename suspicious, probable phishing
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 T_HTML_ATTACH HTML attachment to bypass scanning?
0.0 OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced From
0.0 T_OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced
From
0.1 MISSING_MID Missing Message-Id: header
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.0 FROM_MISSPACED From: missing whitespace
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope
Subject: {SPAM?} Payment Received
This is a multi-part message in MIME format.
------=_NextPart_000_00F0_01C2A9A6.336845BA
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
Your payment was received, Attached is your invoice copy
------=_NextPart_000_00F0_01C2A9A6.336845BA
Content-Type: application/octet-stream;
name="PTKOPJAX2196_22_pdf.HTML"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="PTKOPJAX2196_22_pdf.HTML"
PGJvZHkgb25sb2FkPSJqYXZhc2NyaXB0OndpbmRvdy5sb2NhdGlvbi5ocmVm
PSdodHRwczovL2toYWJyaW1lZGlhLmNvbS93cC1pbmNsdWRlcy8xQS9QVEtP
UEpBWDIxOTZfMjJfcGRmLmlzbyc7Ij4K
------=_NextPart_000_00F0_01C2A9A6.336845BA--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments