Costco phish from dataproviderweb.com
Posted by Dave Yadallee onEnvelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 12 Mar 2025 16:23:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))
(envelope-from
id 1tsUT6-00000000I7x-2q7L
for dave@doctor.nl2k.ab.ca;
Wed, 12 Mar 2025 16:22:28 -0600
Resent-From: The Doctor
Resent-Date: Wed, 12 Mar 2025 16:22:28 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [188.208.110.178] (port=48033 helo=ashawelirei.net)
by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))
id 1tsUL0-000000006xC-0yuf
for sales@netknow.ca;
Wed, 12 Mar 2025 16:14:15 -0600
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=netknow.ca;
h=MIME-Version:To:From:Subject:Content-Type; i=sales@netknow.ca;
bh=fEKg70Iu3DlzdbDd2VJ1jbEN3b4=;
b=G2w4Zyqs1imZKP4SL94hD65qb+yWjE6YeTE/8SDTEMojIKTB6xb8oGDRsyP7iPM5qm5iINDc0RAQ
mdYcD7yRphIigc3T7KRJaVH33Winl7SxNUgvktStGBBN27uEP1vTGiRUDrLOhj4VM7OcKDlwYD+V
yVS9w8e76/Vg1iBTyPA=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=netknow.ca;
b=GtOzet23CP6bE4V7BoK/OTU57l8eDyWuV+bbjdy09iiJfUrRlVOJiGAcnznAosLpAtR3lSLkjZjF
O9OX9bXSY78CgDRl+n2qcxiFHvxzraogghyvwhyU4ulKKogprpEf0djTP5OjzyCmceVXtkFTSsQC
6hr7i9ibhPZNBP0hUuU=;
MIME-Version: 1.0
To: sales@netknow.ca
From: Costco
Subject: Costco Pyrex Container Set - Open Immediately
Content-Type: text/html
X-Spam_score: 18.9
X-Spam_score_int: 189
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Costco Wholesale Special Promotion: Up to 100% Discount for
Selected Items! Congratulation!
Content analysis details: (18.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.4 MISSING_DATE Missing Date: header
0.1 MISSING_MID Missing Message-Id: header
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[188.208.110.178 listed in will-spam-for-food.eu.org]
[188.208.110.178 listed in will-spam-for-food.eu.org]
[188.208.110.178 listed in will-spam-for-food.eu.org]
[188.208.110.178 listed in will-spam-for-food.eu.org]
[188.208.110.178 listed in will-spam-for-food.eu.org]
[188.208.110.178 listed in will-spam-for-food.eu.org]
[188.208.110.178 listed in will-spam-for-food.eu.org]
[188.208.110.178 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[188.208.110.178 listed in dnsbl.ahbl.org]
[188.208.110.178 listed in dnsbl.ahbl.org]
[188.208.110.178 listed in dnsbl.ahbl.org]
[188.208.110.178 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[188.208.110.178 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[188.208.110.178 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[188.208.110.178 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[188.208.110.178 listed in dnsbl.ahbl.org]
0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
[URI: wee.so]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: 185.174.30.244]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: 185.174.30.244]
0.3 OFFER_2 BODY: Offers you Something (2)
0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4
address
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_TAG_BALANCE_CENTER Malformatted HTML
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX
0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
Subject: {SPAM?} Costco Pyrex Container Set - Open Immediately
Unsubscribe