CRA Phish from OVH Toronto
Posted by Dave Yadallee onEnvelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 06 Feb 2023 22:50:31 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pPGs6-0001rc-1P
for dave@doctor.nl2k.ab.ca;
Mon, 06 Feb 2023 22:50:26 -0700
Resent-From: The Doctor
Resent-Date: Mon, 6 Feb 2023 22:50:26 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from soren.irandns.com ([217.182.22.25]:19100)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from
id 1pPGm8-0001PX-2H
for sales@nk.ca;
Mon, 06 Feb 2023 22:44:20 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=drminarezaei.com; s=default; h=Content-Transfer-Encoding:Content-Type:
MIME-Version:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=hppYHZWVXvsKt+YC13HlmxUohMTvL2gruHx3c5g726w=; b=BuMtxXQLH//QtofyIMbJVFHVcJ
z8frsCFLptTwnkOWyt1+uf87ipokp25EpstBKjETPppzbXp6UGLzmA7PyxyA6Lj6KkpF6n8oXbrht
sfRZkTiSd/bLvHMuvq7kVVLzKE0pNgWqkWQy57cGdqwKAXNRwgJdLkGhcSfxXGzGXpPb3AW6W4xkQ
/dtDM4cDGvY1CXWXfRDb/cwPAwZuQQfGF2X33ee2ZTEM9eocdISdd6hhnDM7vQHaNlRHSVf85Du+t
Sb0Nd2P9va1PJaK6V6Tp5PTvUd/LSqWtru9tAfP84nBxMim18fszfd7NuAAdaNXSlYkn+QgX6UHJb
Q+/B7TWw==;
Received: from [173.35.162.92] (port=58511)
by soren.irandns.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95)
(envelope-from
id 1pPGk6-007u6b-12
for sales@nk.ca;
Tue, 07 Feb 2023 09:12:10 +0330
From: Canada Revenue Agency / Nouveau courrier de l'Agence du revenu du Canada.
To: sales@nk.ca
Subject: Canada Revenue Agency / Nouveau courrier de l'Agence du revenu du Canada.
Date: 6 Feb 2023 21:42:08 -0800
Message-ID: <20230206214155.980ECD2D6E37DC1F@drminarezaei.com>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - soren.irandns.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - drminarezaei.com
X-Get-Message-Sender-Via: soren.irandns.com: authenticated_id: help@drminarezaei.com
X-Authenticated-Sender: soren.irandns.com: help@drminarezaei.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 9.0
X-Spam_score_int: 90
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: English version ** La version française suit ** The Canada
Revenue Agency (CRA) sent you new mail online called: OTB notice
Content analysis details: (9.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
[URI: miscreant-wines.com]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
2.7 URI_WPADMIN WordPress login/admin URI, possible phishing
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
Subject: {SPAM?} Canada Revenue Agency / Nouveau courrier de l'Agence du revenu du Canada.
rm: none; text-indent: 0px; letter-spacing: normal; font-family: "Helvetica=
Neue", Helvetica, Arial, sans-serif; font-size: 13px; font-style: normal; =
font-weight: 400; word-spacing: 0px; white-space: normal; orphans: 2; widow=
s: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: normal;=
font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=
-thickness: initial; text-decoration-style:=20
initial; text-decoration-color: initial;' type=3D"cite">
lang=3D"en" style=3D"text-align: center; color: blue; font-weight: bold; m=
argin-top: 12px; margin-bottom: 5px;">
English version
n>** La version française suit ***
=p>
The Canada Re=
venue Agency (CRA) sent you new mail online called:
=
OTB notice
This mail may requ=
ire your attention.
ng=3D"en">If you have My Account, sign-in and click on "Mail" to read your =
mail.
rline;" href=3D"https://miscreant-wines.com/wp-admin/abd/adobe/BE/" target=
=3D"_blank" rel=3D"nofollow noopener noreferrer">View Document Here=
If you signed up to receive mail online b=
ut don't have My Account, go to the CRA web page to register.<=
br>
This is an automated email message. Please=
do not reply.
blue; font-weight: bold; margin-top: 12px; margin-bottom: 5px;">Version fr=
ançaise ** The English version =
precedes ***
L'Agence du revenu du Canada (ARC) vous a envoy&eacu=
te; du nouveau courrier en ligne intitulé :
<=
span>
nt-weight: bold;">Avis de la PTO
pan>Ce courrier peut nécessiter votre attention.
pan>
Si vous êtes inscrit à Mon dossier, ouvrez une session et cliq=
uez sur « Courrier » pour lire votre courrier.
le=3D"color: rgb(25, 106, 212); text-decoration: underline;" href=3D"https:=
//miscreant-wines.com/wp-admin/abd/adobe/BE/" target=3D"_blank" rel=3D"nofo=
llow noopener noreferrer">View Document Here
g=3D"fr">
=
span>
Si vous vous êtes inscrit pour recevoir votre courrier en ligne, mais=
n'êtes pas inscrit à Mon dossier, allez à la page Web =
de l'ARC pour vous y inscrire.
e>Ceci est un message électronique automatisé. Veu=
illez ne pas y répondre.
/html>
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments