Costco phish from dataproviderweb.com
Posted by Dave Yadallee onEnvelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 12 Mar 2025 16:23:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))
(envelope-from
id 1tsUT2-00000000I7Q-2ryP
for dave@doctor.nl2k.ab.ca;
Wed, 12 Mar 2025 16:22:24 -0600
Resent-From: The Doctor
Resent-Date: Wed, 12 Mar 2025 16:22:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [188.208.110.178] (port=47025 helo=ashawelirei.net)
by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))
id 1tsUL0-000000006x2-0z1I
for doctor@nl2k.ab.ca;
Wed, 12 Mar 2025 16:14:15 -0600
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nl2k.ab.ca;
h=MIME-Version:To:From:Subject:Content-Type; i=doctor@nl2k.ab.ca;
bh=5q64Y/o5AIbkKoBkw/r0+tXxIpc=;
b=Watgekv7TBVtbebC+bWdV1r8+W1TmNiNGcoUF+hA0IV0UXyFiClMTr/CDFQhRClXDGXS+G3nq1xw
mywOdQrXj6DtAD4gSFA6HgVES+r6GWPtM6Q6jHBGGG7V/kvzdbbilHi1OM7hpCQiUjOEHS0IWuzZ
c/FZfMq/ZxjyayGFNkg=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nl2k.ab.ca;
b=eR59gs+I+QH7XI+mEVD58CQDA77IFa6/jr2sTkRP3v5IJ6Rcza817q9Bp47MVCrP/40ReewF5faz
GygmfuWLAxM2+i5p9W9z+2CWN38FcsK4eXuv2FEvIzd4xkQEFEKtrnUrbujvjZAlK8JdJBOTTLTw
oLdHoYuuhNYZUjOSHW8=;
MIME-Version: 1.0
To: doctor@nl2k.ab.ca
From: Costco
Subject: Costco Pyrex Container Set - Open Immediately
Content-Type: text/html
X-Spam_score: 18.1
X-Spam_score_int: 181
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Costco Wholesale Special Promotion: Up to 100% Discount for
Selected Items! Congratulation!
Content analysis details: (18.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.4 MISSING_DATE Missing Date: header
0.1 MISSING_MID Missing Message-Id: header
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[188.208.110.178 listed in will-spam-for-food.eu.org]
[188.208.110.178 listed in will-spam-for-food.eu.org]
[188.208.110.178 listed in will-spam-for-food.eu.org]
[188.208.110.178 listed in will-spam-for-food.eu.org]
[188.208.110.178 listed in will-spam-for-food.eu.org]
[188.208.110.178 listed in will-spam-for-food.eu.org]
[188.208.110.178 listed in will-spam-for-food.eu.org]
[188.208.110.178 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[188.208.110.178 listed in dnsbl.ahbl.org]
[188.208.110.178 listed in dnsbl.ahbl.org]
[188.208.110.178 listed in dnsbl.ahbl.org]
[188.208.110.178 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[188.208.110.178 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[188.208.110.178 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[188.208.110.178 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[188.208.110.178 listed in dnsbl.ahbl.org]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: 185.174.30.244]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: 185.174.30.244]
0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
[URI: wee.so]
0.3 OFFER_2 BODY: Offers you Something (2)
0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4
address
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 HTML_TAG_BALANCE_CENTER Malformatted HTML
0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX
0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
Subject: {SPAM?} Costco Pyrex Container Set - Open Immediately
Unsubscribe