Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
CRA Phishing Email sent to caamanitoba.com customers
Message headers
Return-Path: <SRS0=Qc2Q=JY=opac-cornouaille.fr=www-data@█████████.com>
X-Original-To: ███████@█████████.com
Delivered-To: ███████@█████████.com
Received: from mx.opac-cornouaille.fr (mx.opac-cornouaille.fr [185.183.60.228]) by
███████.███████.com (Postfix) with ESMTP for <███-███████-june-06-2018@redactedcatchall.tld;
Sun,
8 Jul 2018 18:48:39 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1]) by mx.opac-cornouaille.fr (Postfix) with
ESMTP id CDB437C08E for <███-███████-june-06-2018@redactedcatchall.tld>; Sun,
8 Jul 2018 20:48:38 +0200 (CEST)
Received: from mx.opac-cornouaille.fr ([127.0.0.1]) by localhost (mx.opac-cornouaille.fr
[127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I1hd51uok9_Z for
<███-███████-june-06-2018@redactedcatchall.tld>; Sun,
8 Jul 2018 20:48:38 +0200 (CEST)
Received: from www1.opac-cornouaille.fr (unknown [192.168.2.6]) by mx.opac-cornouaille.fr
(Postfix) with ESMTPS id 9FF3F7BDEE for <███-███████-june-06-2018@redactedcatchall.tld>; Sun,
8 Jul 2018 20:48:21 +0200 (CEST)
Received: from www-data by www1.opac-cornouaille.fr with local (Exim 4.84_2)
(envelope-from <www-data@opac-cornouaille.fr>) id 1fcEjM-0004py-PK for
███-███████-june-06-2018@redactedcatchall.tld Sun, 08 Jul 2018 20:48:20 +0200
Authentication-Results: █████████.com; dmarc=none (p=none dis=none)
header.from=service.cra-arcemail.gcr.ca
Authentication-Results:█████████.com; spf=pass
smtp.mailfrom=SRS0=Qc2Q=JY=opac-cornouaille.fr=www-data@█████████.com
Authentication-Results: █████████.com; dkim=none
X-Forwarded-For: catchall_53ea9d47@█████████.com by █████████
X-Fda: 74363142000.12.boats90_68c1444ea4011
X-Spam-Summary: 86,7.5,0,c361e2eb4e4c66bb,d41d8cd98f00b204,www-data@opac-cornouaille.fr,:,RULES_HIT:41:46:72:150:152:334:355:368:369:375:379:543:800:967:973:979:982:983:988:989:1185:1208:1216:1224:1260:1261:1263:1311:1313:1314:1345:1381:1431:1432:1433:1437:1514:1515:1516:1517:1535:1543:1546:1555:1593:1594:1676:1699:1711:1730:1747:1777:1792:2194:2196:2197:2198:2199:2200:2201:2202:2393:2525:2527:2553:2559:2567:2610:2682:2685:2693:2731:2741:2859:2890:2891:2892:2897:2917:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3147:3148:3352:3503:3504:3653:3865:3866:3867:3868:3870:3871:3873:3889:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4042:4117:4321:4383:4605:4649:4700:5007:6117:6119:6248:6261:6678:6688:8957:9009:9010:9025:9080:9367:9388:9416:9704:9908:9941:10013:10079:10086:10346:10400:10450:10455:10559:10904:11026:11473:11638:11639:11658:11855:11914:11984:12043:12049:12050:12217:12219:12438:12517:12519:12551:12555:12812:12895:12903:12956:12958:12959:12967:12968:1
X-He-Tag: boats90_68c1444ea4011
X-Filterd-Recvd-Size: 6845
X-Virus-Scanned: Debian amavisd-new at opac-cornouaille.fr
To: ███-███████-june-06-2018@redactedcatchall.tld
Subject: Re: Payment Return Confirmation - No.882385211
X-Php-Originating-Script: 33:eb.php
Mime-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: base64
X-Sender: service.cra-arcemail.gcr.ca
X-Priority: 3
From: Canada Revenue Agency<email-32345@service.cra-arcemail.gcr.ca>
Reply-To: ███-███████-june-06-2018@redactedcatchall.tld
Message-Id: <E1fcEjM-0004py-PK@www1.opac-cornouaille.fr>
Date: Sun, 08 Jul 2018 20:48:20 +0200
X-Spam-Status: No, score=3.2 required=4.0 tests=DKIM_ADSP_NXDOMAIN,
FROM_EXCESS_BASE64,HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,
HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,NO_DNS_FOR_FROM,SPF_PASS, TO_NO_BRKTS_FROM_MSSP
autolearn=no autolearn_force=no version=3.4.0
X-Spam-Level: ***
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on █████████.com
X-Pm-Origin: external
X-Pm-Content-Encryption: on-delivery
X-Pm-Transfer-Encryption: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
<div style="" class="x_page">
<div style=""><img width="603" style="" alt="Canada Revenue Agency
https://www.canada.ca/en/revenue-agency.html" src="https://www.canada.ca/content/dam/cra-arc/lyris/bnnrMllst-eng.jpg" data-imagetype="External"></div>
<div style="" class="x_core" id="x_div13">
<h1 style="border-color:rgb(0,0,0); border-width:1px" id="x_h114">CRA ARC - GST/HST credit payment issuance – <span id="x_OBJ_PREFIX_DWT103_com_zimbra_date" class="x_Object">July 8 </span>, 2018</h1>
<p style="border-color:rgb(0,0,0); border-width:1px" id="x_p15">The Canada Revenue Agency (CRA) </p>
<div>
<div dir="ltr">Regarding your annual tax:</div>
<div dir="ltr">You have paid too much tax.&nbsp;<br>
CRA&nbsp;owes you $628 CAD <br>
<br>
</div>
</div>
<div>
<p>This is the &nbsp;second reminder notice if you miss and you dont register you will suffer the consequences of the new law in force.<br>
<br>
</p>
<div id="x_x_x_m_-4726274048361349433LPBorder_GT_14892960909540.6548167824819195">
<table cellspacing="0" id="x_x_x_m_-4726274048361349433LPContainer_14892960909450.605469567534497">
</table>
</div>
<br>
<div><a title="http://foromalaguistas.com/ca/" href="#"><strong>Claim your money back through your new Personal Tax Account</strong></a><br>
</div>
<div>
<p>You can get your refund fast, straight into your bank account, if you claim online through your Personal Tax Account</p>
<p><br>
<br>
</p>
</div>
<div>If you claim online you could receive your refund within 3 to 5 day. If you don't claim online within the next days, we will send you a payable order.</div>
</div>
</div>
<br style="">
<div style="" class="x_footer">Goods and services tax / harmonized sales tax (GST/HST) credit program<br style="">
For telephone, fax, and TTY (teletypewriter) numbers and for addresses, go to <span id="x_OBJ_PREFIX_DWT107_com_zimbra_url" class="x_Object"><a style="" data-auth="NotApplicable" rel="noopener noreferrer" target="_blank" href="https://www.canada.ca/en/revenue-agency/services/child-family-benefits/contact-information-child-family-benefits.html">Contact us</a></span>.<br style="">
Canada Revenue Agency <br style="">
Government of Canada<br style="">
Ottawa ON K1A 0L5<br style="">
Canada</div>
<div style="" class="x_craBlueBG">&nbsp;</div>
<div style="" class="x_fip"><img height="20" width="286" style="" alt="Canada Revenue Agency" src="https://www.canada.ca/content/dam/cra-arc/lyris/sig-eng.gif" data-imagetype="External"></div>
<br style="">
<div style="" class="x_cwm"><img height="20" width="83" style="" class="x_alignCenter" alt="Symbol of the Government of Canada" src="https://www.canada.ca/content/dam/cra-arc/lyris/wmms.gif" data-imagetype="External"></div>
<br style="">
<hr style="">
<div style="" class="x_privacy">Please <strong style="">do not reply</strong> to this message. If you do not want to receive our email messages, you can <span id="x_OBJ_PREFIX_DWT108_ZmEmailObjectHandler" class="x_Object"><a style="" data-auth="NotApplicable" rel="noopener noreferrer" target="_blank" href="mailto:leave-33674791-26350635.4f4bf04ec1bc4623c8a6f2ebab380e77@pab-dgap.list-liste.cra-arc.gc.ca">cancel your subscription</a></span> to the Goods and services tax / harmonized sales tax (GST/HST) credit electronic mailing list. We protect your confidential information. For details, please see <span id="x_OBJ_PREFIX_DWT109_com_zimbra_url" class="x_Object"><a style="" data-auth="NotApplicable" rel="noopener noreferrer" target="_blank" href="https://www.canada.ca/en/revenue-agency/news/e-services/canada-revenue-electronic-mailing-lists/electronic-mailing-lists-1.html">Privacy protection</a></span>.</div>
<hr style="">
</div>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.