2FA Metamask Phish
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 20 Apr 2024 06:41:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1ryA1D-00000000GYn-2X1P
for dave@doctor.nl2k.ab.ca;
Sat, 20 Apr 2024 06:40:35 -0600
Resent-From: The Doctor
Resent-Date: Sat, 20 Apr 2024 06:40:35 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from cloudhost-2840114.us-west-1.nxcli.net ([173.249.147.141]:59340)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1ry3of-00000000N1d-49XC
for sales@nk.ca;
Sat, 20 Apr 2024 00:03:18 -0600
Received: (qmail 17884 invoked by uid 10128); 20 Apr 2024 05:59:55 +0000
Date: Sat, 20 Apr 2024 05:57:27 +0000
To: sales@nk.ca
From: =?UTF-8?B?TdC1dGFN0LBzaw==?=
Reply-To: metamask@2fa.eth
Subject: Last Reminder: Urgent Two-Factor Authentication Activation
Message-ID: <7e22369f798fe91852511aa5214948a9@2fa.eth>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="1f911cb55121551547d7cb505d3ef3887"
Content-Transfer-Encoding: 8bit
X-Spam_score: 16.9
X-Spam_score_int: 169
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Urgent Two-Factor Authentication Activation body { font-family:
Arial, sans-serif; background-color: #f5f5f5; margin: 0; padding: 0; }
Content analysis details: (16.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[173.249.147.141 listed in dnsbl.ahbl.org]
[173.249.147.141 listed in dnsbl.ahbl.org]
[173.249.147.141 listed in dnsbl.ahbl.org]
[173.249.147.141 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[173.249.147.141 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[173.249.147.141 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[173.249.147.141 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[173.249.147.141 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[173.249.147.141 listed in will-spam-for-food.eu.org]
[173.249.147.141 listed in will-spam-for-food.eu.org]
[173.249.147.141 listed in will-spam-for-food.eu.org]
[173.249.147.141 listed in will-spam-for-food.eu.org]
[173.249.147.141 listed in will-spam-for-food.eu.org]
[173.249.147.141 listed in will-spam-for-food.eu.org]
[173.249.147.141 listed in will-spam-for-food.eu.org]
[173.249.147.141 listed in will-spam-for-food.eu.org]
0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: dt2.za.com]
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing
mails
1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
2.5 UNICODE_OBFU_ASC Obfuscating text with unicode
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: dt2.za.com]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: dt2.za.com]
Subject: {SPAM?} Last Reminder: Urgent Two-Factor Authentication Activation
This is a multi-part message in MIME format.
--1f911cb55121551547d7cb505d3ef3887
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Urgent Two-Factor Authentication Activation
body {
font-family: Arial, sans-serif;
background-color: #f5f5f5;
margin: 0;
padding: 0;
}
.container {
max-width: 600px;
margin: 20px auto;
padding: 20px;
background-color: #ffffff;
box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
border-radius: 10px;
}
h1 {
color: #007BFF;
text-align: center;
margin-bottom: 20px;
}
p {
color: #333333;
line-height: 1.6;
margin-bottom: 15px;
}
.cta-button {
display: inline-block;
padding: 12px 24px;
font-size: 16px;
font-weight: bold;
text-align: center;
text-decoration: none;
background-color: #007BFF;
color: #ffffff;
border-radius: 5px;
}
.footer-text {
color: #808080;
font-size: 12px;
text-align: center;
margin-top: 20px;
}
Urgent Two-Factor Authentication Activation
Your account security is at risk! We've detected suspicious activity on your account.
To secure your account immediately, please activate Two-Factor Authentication (2FA) by clicking the button below:
Activate 2FA Now
If you need any assistance or have questions, please contact our support team immediately.
Thank you for your prompt attention to this matter.
© 2024 MеtaMаsk. All rights reserved. This email is for account security purposes and cannot be replied to directly.
--1f911cb55121551547d7cb505d3ef3887
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
Urgent Two-Factor Authentication Activation
Activate 2FA Now
--1f911cb55121551547d7cb505d3ef3887--
I2.03KL0LD37.0KI2.21KwhoissourceRank12.9MPIN0Summary reportDiagnosisDensity00n/a
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 20 Apr 2024 06:41:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1ryA1D-00000000GYn-2X1P
for dave@doctor.nl2k.ab.ca;
Sat, 20 Apr 2024 06:40:35 -0600
Resent-From: The Doctor
Resent-Date: Sat, 20 Apr 2024 06:40:35 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from cloudhost-2840114.us-west-1.nxcli.net ([173.249.147.141]:59340)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1ry3of-00000000N1d-49XC
for sales@nk.ca;
Sat, 20 Apr 2024 00:03:18 -0600
Received: (qmail 17884 invoked by uid 10128); 20 Apr 2024 05:59:55 +0000
Date: Sat, 20 Apr 2024 05:57:27 +0000
To: sales@nk.ca
From: =?UTF-8?B?TdC1dGFN0LBzaw==?=
Reply-To: metamask@2fa.eth
Subject: Last Reminder: Urgent Two-Factor Authentication Activation
Message-ID: <7e22369f798fe91852511aa5214948a9@2fa.eth>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="1f911cb55121551547d7cb505d3ef3887"
Content-Transfer-Encoding: 8bit
X-Spam_score: 16.9
X-Spam_score_int: 169
X-Spam_bar: ++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Urgent Two-Factor Authentication Activation body { font-family:
Arial, sans-serif; background-color: #f5f5f5; margin: 0; padding: 0; }
Content analysis details: (16.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[173.249.147.141 listed in dnsbl.ahbl.org]
[173.249.147.141 listed in dnsbl.ahbl.org]
[173.249.147.141 listed in dnsbl.ahbl.org]
[173.249.147.141 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[173.249.147.141 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[173.249.147.141 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[173.249.147.141 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[173.249.147.141 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[173.249.147.141 listed in will-spam-for-food.eu.org]
[173.249.147.141 listed in will-spam-for-food.eu.org]
[173.249.147.141 listed in will-spam-for-food.eu.org]
[173.249.147.141 listed in will-spam-for-food.eu.org]
[173.249.147.141 listed in will-spam-for-food.eu.org]
[173.249.147.141 listed in will-spam-for-food.eu.org]
[173.249.147.141 listed in will-spam-for-food.eu.org]
[173.249.147.141 listed in will-spam-for-food.eu.org]
0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: dt2.za.com]
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing
mails
1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
2.5 UNICODE_OBFU_ASC Obfuscating text with unicode
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: dt2.za.com]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: dt2.za.com]
Subject: {SPAM?} Last Reminder: Urgent Two-Factor Authentication Activation
This is a multi-part message in MIME format.
--1f911cb55121551547d7cb505d3ef3887
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Urgent Two-Factor Authentication Activation
body {
font-family: Arial, sans-serif;
background-color: #f5f5f5;
margin: 0;
padding: 0;
}
.container {
max-width: 600px;
margin: 20px auto;
padding: 20px;
background-color: #ffffff;
box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
border-radius: 10px;
}
h1 {
color: #007BFF;
text-align: center;
margin-bottom: 20px;
}
p {
color: #333333;
line-height: 1.6;
margin-bottom: 15px;
}
.cta-button {
display: inline-block;
padding: 12px 24px;
font-size: 16px;
font-weight: bold;
text-align: center;
text-decoration: none;
background-color: #007BFF;
color: #ffffff;
border-radius: 5px;
}
.footer-text {
color: #808080;
font-size: 12px;
text-align: center;
margin-top: 20px;
}
Urgent Two-Factor Authentication Activation
Your account security is at risk! We've detected suspicious activity on your account.
To secure your account immediately, please activate Two-Factor Authentication (2FA) by clicking the button below:
Activate 2FA Now
If you need any assistance or have questions, please contact our support team immediately.
Thank you for your prompt attention to this matter.
© 2024 MеtaMаsk. All rights reserved. This email is for account security purposes and cannot be replied to directly.
--1f911cb55121551547d7cb505d3ef3887
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
Urgent Two-Factor Authentication Activation
Your account security is at risk! We've detected suspicious activity on your account.
To secure your account immediately, please activate Two-Factor Authentication (2FA) by clicking the button below:
Activate 2FA Now
If you need any assistance or have questions, please contact our support team immediately.
Thank you for your prompt attention to this matter.
--1f911cb55121551547d7cb505d3ef3887--
I2.03KL0LD37.0KI2.21KwhoissourceRank12.9MPIN0Summary reportDiagnosisDensity00n/a
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments