Canada Post Phish
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 17 Apr 2024 17:55:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rxF6e-00000000LbV-36i5
for dave@doctor.nl2k.ab.ca;
Wed, 17 Apr 2024 17:54:25 -0600
Resent-From: The Doctor
Resent-Date: Wed, 17 Apr 2024 17:54:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from vm-dad845ed-abd5-44c0-90af-082dbff6c093.ams.resource.cloud ([83.96.254.206]:39210 helo=mail37.suw17.mcsv.net)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rxDcQ-00000000CYS-3bSE
for sales@nk.ca;
Wed, 17 Apr 2024 16:19:11 -0600
Date: Thu, 18 Apr 2024 00:11:48 +0200
To: sales@nk.ca
From: "canadapost-postescanada.ca"
Subject: Update: Import Charges are Due CA412830655D
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="1ee73da777c181c4106733e6d3d82c36a"
Content-Transfer-Encoding: 8bit
X-Spam_score: 9.7
X-Spam_score_int: 97
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: REMINDER: Shipment is on its way. Your Package could not
be delivered on time duo to unpaid shipping costs. shipping costs (2,99 CAD)
.Shipment Track Number : CA412830655DReason unpaid delivery fees. Terminal
: 346841091-1Estimated de [...]
Content analysis details: (9.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[83.96.254.206 listed in will-spam-for-food.eu.org]
[83.96.254.206 listed in will-spam-for-food.eu.org]
[83.96.254.206 listed in will-spam-for-food.eu.org]
[83.96.254.206 listed in will-spam-for-food.eu.org]
[83.96.254.206 listed in will-spam-for-food.eu.org]
[83.96.254.206 listed in will-spam-for-food.eu.org]
[83.96.254.206 listed in will-spam-for-food.eu.org]
[83.96.254.206 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[83.96.254.206 listed in dnsbl.ahbl.org]
[83.96.254.206 listed in dnsbl.ahbl.org]
[83.96.254.206 listed in dnsbl.ahbl.org]
[83.96.254.206 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[83.96.254.206 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[83.96.254.206 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[83.96.254.206 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[83.96.254.206 listed in dnsbl.ahbl.org]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[83.96.254.206 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[83.96.254.206 listed in bl.score.senderscore.com]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=mail37.suw17.mcsv.net;ip=83.96.254.206;r=doctor.nl2k.ab.ca]
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.0 HTML_MESSAGE BODY: HTML included in message
0.4 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
Subject: {SPAM?} Update: Import Charges are Due CA412830655D
This is a multi-part message in MIME format.
--1ee73da777c181c4106733e6d3d82c36a
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
REMINDER: Shipment is on its way.
Â
Your Package could not be delivered on time duo to unpaid shipping costs.  shipping costs (2,99 CAD) .Shipment Track Number : CA412830655DReason unpaid delivery fees. Terminal : 346841091-1Estimated delivery date : 19/04/24 10:00AM - 15:00PMAmount : 2,99 CAD
Â
PAY NOW
Â
Â
--1ee73da777c181c4106733e6d3d82c36a
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
LY: "times new roman"; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLA=
PSE: collapse; TABLE-LAYOUT: fixed !important; TEXT-TRANSFORM: none; FONT-W=
EIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; BORDER-SPACING: 0px !imp=
ortant; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px auto; LETTER-SPACING: normal; fo=
nt-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-strok=
e-width: 0px; text-decoration-thickness: initial; text-decoration-style: in=
itial; text-decoration-color: initial' cellSpacing=3D0 cellPadding=3D0 widt=
h=3D600 align=3Dcenter bgColor=3D#ffffff border=3D0>
"trebuchet ms", arial, helvetica, sans-serif; BORDER-COLLAPSE: collapse; CO=
LOR: rgb(0,0,0); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 30px;=
LINE-HEIGHT: 22px; PADDING-RIGHT: 30px'>REMINDER: Shipment is on its way.<=
/TD>
=C2=
=A0
trebuchet ms", arial, helvetica, sans-serif; BORDER-COLLAPSE: collapse; COL=
OR: rgb(0,0,0); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 30px; =
LINE-HEIGHT: 22px; PADDING-RIGHT: 160px' align=3Dleft>
=C2=
=A0
PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 30px; PADDING-RIGHT: =
0px">
!important; TABLE-LAYOUT: auto; BORDER-SPACING: 0px !important; MARGIN: 0px=
auto" cellSpacing=3D0 cellPadding=3D0 width=3D150 align=3Dleft border=3D0>
ORDER-SPACING: 0px !important; MARGIN: 0px auto" cellSpacing=3D0 cellPaddin=
g=3D0 width=3D150 align=3Dcenter border=3D0>
d; BORDER-RIGHT: rgb(0,0,0) 1px solid; BORDER-COLLAPSE: collapse; BORDER-BO=
TTOM: rgb(0,0,0) 1px solid; COLOR: rgb(0,0,0) !important; PADDING-BOTTOM: 1=
0px; PADDING-TOP: 10px; PADDING-LEFT: 10px; BORDER-LEFT: rgb(0,0,0) 1px sol=
id; PADDING-RIGHT: 10px; BACKGROUND-COLOR: rgb(92,194,191)" align=3Dcenter>=
: pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)">
EFIX_DWT1945_com_zimbra_url class=3DObject style=3D"CURSOR: pointer; TEXT-D=
ECORATION: none; COLOR: rgb(51,102,153)">
DWT373_com_zimbra_url class=3DObject style=3D"CURSOR: pointer; TEXT-DECORAT=
ION: none; COLOR: rgb(51,102,153)">
_com_zimbra_url class=3DObject style=3D"CURSOR: pointer; TEXT-DECORATION: n=
one; COLOR: rgb(51,102,153)">
TEXT-DECORATION: none; FONT-FAMILY: "trebuchet ms", arial, helvetica, sans-=
serif; TEXT-TRANSFORM: uppercase; COLOR: rgb(0,0,0)' href=3D"https://snip.l=
y/mvfme6" rel=3D"nofollow nofollow noopener noreferrer nofollow noopener no=
referrer" target=3D_blank>PAY NOW
=C2=
=A0
erif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WE=
IGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LE=
TTER-SPACING: normal; BACKGROUND-COLOR: rgb(253,253,253); TEXT-INDENT: 0px;=
font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-st=
roke-width: 0px; text-decoration-thickness: initial; text-decoration-style:=
initial; text-decoration-color: initial'>=C2=A0
--1ee73da777c181c4106733e6d3d82c36a--
I2.40KL0LD36.9KIwhoissourceRank13.0MPIN0Summary reportDiagnosisDensity00n/a
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 17 Apr 2024 17:55:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rxF6e-00000000LbV-36i5
for dave@doctor.nl2k.ab.ca;
Wed, 17 Apr 2024 17:54:25 -0600
Resent-From: The Doctor
Resent-Date: Wed, 17 Apr 2024 17:54:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from vm-dad845ed-abd5-44c0-90af-082dbff6c093.ams.resource.cloud ([83.96.254.206]:39210 helo=mail37.suw17.mcsv.net)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rxDcQ-00000000CYS-3bSE
for sales@nk.ca;
Wed, 17 Apr 2024 16:19:11 -0600
Date: Thu, 18 Apr 2024 00:11:48 +0200
To: sales@nk.ca
From: "canadapost-postescanada.ca"
Subject: Update: Import Charges are Due CA412830655D
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="1ee73da777c181c4106733e6d3d82c36a"
Content-Transfer-Encoding: 8bit
X-Spam_score: 9.7
X-Spam_score_int: 97
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: REMINDER: Shipment is on its way. Your Package could not
be delivered on time duo to unpaid shipping costs. shipping costs (2,99 CAD)
.Shipment Track Number : CA412830655DReason unpaid delivery fees. Terminal
: 346841091-1Estimated de [...]
Content analysis details: (9.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[83.96.254.206 listed in will-spam-for-food.eu.org]
[83.96.254.206 listed in will-spam-for-food.eu.org]
[83.96.254.206 listed in will-spam-for-food.eu.org]
[83.96.254.206 listed in will-spam-for-food.eu.org]
[83.96.254.206 listed in will-spam-for-food.eu.org]
[83.96.254.206 listed in will-spam-for-food.eu.org]
[83.96.254.206 listed in will-spam-for-food.eu.org]
[83.96.254.206 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[83.96.254.206 listed in dnsbl.ahbl.org]
[83.96.254.206 listed in dnsbl.ahbl.org]
[83.96.254.206 listed in dnsbl.ahbl.org]
[83.96.254.206 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[83.96.254.206 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[83.96.254.206 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[83.96.254.206 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[83.96.254.206 listed in dnsbl.ahbl.org]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[83.96.254.206 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[83.96.254.206 listed in bl.score.senderscore.com]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=mail37.suw17.mcsv.net;ip=83.96.254.206;r=doctor.nl2k.ab.ca]
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.0 HTML_MESSAGE BODY: HTML included in message
0.4 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
Subject: {SPAM?} Update: Import Charges are Due CA412830655D
This is a multi-part message in MIME format.
--1ee73da777c181c4106733e6d3d82c36a
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
REMINDER: Shipment is on its way.
Â
Your Package could not be delivered on time duo to unpaid shipping costs.  shipping costs (2,99 CAD) .Shipment Track Number : CA412830655DReason unpaid delivery fees. Terminal : 346841091-1Estimated delivery date : 19/04/24 10:00AM - 15:00PMAmount : 2,99 CAD
Â
PAY NOW
Â
Â
--1ee73da777c181c4106733e6d3d82c36a
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
LY: "times new roman"; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLA=
PSE: collapse; TABLE-LAYOUT: fixed !important; TEXT-TRANSFORM: none; FONT-W=
EIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; BORDER-SPACING: 0px !imp=
ortant; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px auto; LETTER-SPACING: normal; fo=
nt-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-strok=
e-width: 0px; text-decoration-thickness: initial; text-decoration-style: in=
itial; text-decoration-color: initial' cellSpacing=3D0 cellPadding=3D0 widt=
h=3D600 align=3Dcenter bgColor=3D#ffffff border=3D0>
"trebuchet ms", arial, helvetica, sans-serif; BORDER-COLLAPSE: collapse; CO=
LOR: rgb(0,0,0); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 30px;=
LINE-HEIGHT: 22px; PADDING-RIGHT: 30px'>REMINDER: Shipment is on its way.<=
/TD>
=A0
trebuchet ms", arial, helvetica, sans-serif; BORDER-COLLAPSE: collapse; COL=
OR: rgb(0,0,0); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 30px; =
LINE-HEIGHT: 22px; PADDING-RIGHT: 160px' align=3Dleft>
Your Package could not be delivered on time duo to unpaid shipping costs=
.=C2=A0=C2=A0shipping costs (2,99 CAD)=C2=A0.
Shipment Track =
Number :=C2=A0CA412830655D
Reason unpaid delivery fees.=
=C2=A0
Terminal : 346841091-1
Estimated delivery date : 19/04/24 10:0=
0AM - 15:00PM
Amount :=C2=A02,99 CAD
=A0
PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 30px; PADDING-RIGHT: =
0px">
!important; TABLE-LAYOUT: auto; BORDER-SPACING: 0px !important; MARGIN: 0px=
auto" cellSpacing=3D0 cellPadding=3D0 width=3D150 align=3Dleft border=3D0>
ORDER-SPACING: 0px !important; MARGIN: 0px auto" cellSpacing=3D0 cellPaddin=
g=3D0 width=3D150 align=3Dcenter border=3D0>
d; BORDER-RIGHT: rgb(0,0,0) 1px solid; BORDER-COLLAPSE: collapse; BORDER-BO=
TTOM: rgb(0,0,0) 1px solid; COLOR: rgb(0,0,0) !important; PADDING-BOTTOM: 1=
0px; PADDING-TOP: 10px; PADDING-LEFT: 10px; BORDER-LEFT: rgb(0,0,0) 1px sol=
id; PADDING-RIGHT: 10px; BACKGROUND-COLOR: rgb(92,194,191)" align=3Dcenter>=
: pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)">
EFIX_DWT1945_com_zimbra_url class=3DObject style=3D"CURSOR: pointer; TEXT-D=
ECORATION: none; COLOR: rgb(51,102,153)">
DWT373_com_zimbra_url class=3DObject style=3D"CURSOR: pointer; TEXT-DECORAT=
ION: none; COLOR: rgb(51,102,153)">
_com_zimbra_url class=3DObject style=3D"CURSOR: pointer; TEXT-DECORATION: n=
one; COLOR: rgb(51,102,153)">
TEXT-DECORATION: none; FONT-FAMILY: "trebuchet ms", arial, helvetica, sans-=
serif; TEXT-TRANSFORM: uppercase; COLOR: rgb(0,0,0)' href=3D"https://snip.l=
y/mvfme6" rel=3D"nofollow nofollow noopener noreferrer nofollow noopener no=
referrer" target=3D_blank>PAY NOW
=A0
erif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WE=
IGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LE=
TTER-SPACING: normal; BACKGROUND-COLOR: rgb(253,253,253); TEXT-INDENT: 0px;=
font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-st=
roke-width: 0px; text-decoration-thickness: initial; text-decoration-style:=
initial; text-decoration-color: initial'>=C2=A0
--1ee73da777c181c4106733e6d3d82c36a--
I2.40KL0LD36.9KIwhoissourceRank13.0MPIN0Summary reportDiagnosisDensity00n/a
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments