Canada Post Phish from France
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 08 Sep 2022 12:20:53 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oWLnY-000GJn-AN
for dave@doctor.nl2k.ab.ca;
Thu, 08 Sep 2022 11:58:44 -0600
Resent-From: The Doctor
Resent-Date: Thu, 8 Sep 2022 11:58:44 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from solana28.dk4pl.in ([212.83.186.112]:59914)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oWKYH-0007PF-83
for root@nl2k.ab.ca;
Thu, 08 Sep 2022 10:38:57 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; s=default; d=dk4pl.in;
h=Subject:From:To:Sender:Reply-To:Date:List-Unsubscribe:Message-ID:MIME-Version:Content-Type; i=info@dk4pl.in;
bh=b7z4k+HTPLj5rP00kBOa4SqmUxl+Lel3N9LSeztcFA8=;
b=WWA+ZeQZzaGxHNUliRuPEBOfobg8pkqN63YZ2NXCdUja3JJzWQY6W47VNSLQiay+OHmfyGyLa9kd
pNtsBLD4WeZkr2m2xqASeTN6RVs30HS3kln1u2JmTune9hAcXWXIV6VZcUkBlN3OSkFQdXO0aSuA
Z8fasH+JsLs+9ijw21A=
Subject: CONFIRMATION # 234654! root@nl2k.ab.ca, Delivery of your package has
been stopped.
From: "Canada Post"
To: root@nl2k.ab.ca
Sender: info@dk4pl.in
Reply-To: info@dk4pl.in
Date: 08 Sep 2022 16:38:33 -0000
List-Unsubscribe:,
X-CampaignID: s4:40183-2dd0402b7da73cbe
Message-ID:
X-Mailer-Info: 8.E2M5cTN.QDMxgzM.y92b0BkbsJzauEmYuMWY.QTN0cDMyYjN.QDMxgjN
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="==87a0043fb5e6eba8327fdc71ad887ef6"
X-Spam_score: 8.5
X-Spam_score_int: 85
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: CANADAÂ POST _PACKAGE CONFIRMATIONÂ # 234654 _Hello root@nl2k.ab.ca,
This is the last time we are reminding you about your pending shipping cost.
The pending delivery will be canceled if the amount [...]
Content analysis details: (8.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: dk4pl.in]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: dk4pl.in]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL
blocklist
[URIs: dk4pl.in]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
0.0 HTML_MESSAGE BODY: HTML included in message
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.1 TO_IN_SUBJ To address is in Subject
Subject: {SPAM?} CONFIRMATION # 234654! root@nl2k.ab.ca, Delivery of your package has
been stopped.
This is a multi-part message in MIME format.
--==87a0043fb5e6eba8327fdc71ad887ef6
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
CANADA=C2=A0POST
_
_PACKAGE CONFIRMATION=C2=A0# 234654_
_Hello root@nl2k.ab.ca,
This is the last time we are reminding you about your pending shipping
cost. The pending delivery will be canceled if the amount is not paid
within 48 hours.
Confirm the delivery details and pay the shipping costs in order to
get your package delivered within 72 hours.=C2=A0
Track your parcel
CA-TT-7854258-POST
TRACK YOUR PACKAGE [/%%Offer Link%%]
=C2=A0
Your delivery will be cancelled
if you don=E2=80=99t plan the delivery within 48 hours.
=C2=A0
Unsubscribe=
--==87a0043fb5e6eba8327fdc71ad887ef6
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
ft-com:office:office" xmlns:v=3D"urn:schemas-microsoft-com:vml">
0" cellpadding=3D"0">
100%">
style=3D"font-size: 36pt;">CANADA
=3D"font-size: 36pt;">POST
t-size: 36pt; background-color: #004a8e;">
pan>
gn=3D"top" width=3D"100%">
adding=3D"0" bgcolor=3D"#ffffff">
llpadding=3D"0">
00" cellspacing=3D"0" cellpadding=3D"0">
ght: 22px; color: #6c6c6c; height: 376px;" align=3D"center" valign=3D"top" =
width=3D"500">
yle=3D"display: block; color: #ffffff; text-decoration: none; text-align: c=
enter; background: #004A8E; border: 5px solid #004A8E; border-radius: 5px; =
margin: 0 auto; padding: 4px;" href=3D"https://s-trcke.dk4pl.in/ga/click/2-=
45470266-3975-20251-40186-21792-c68a59ab83-cb6f16b568">Track your package
a>
lpadding=3D"0">
ght: 22px; color: #6c6c6c;" align=3D"center" valign=3D"top" width=3D"500">
=3D"https://s-trcke.dk4pl.in/ga/unsubscribe/2-45470266-3975-20251-40186-452=
488969a185fe-cb6f16b568">
Unsubscribe
![](3D"https://s-trcke.dk4pl.in/ga/open/2-45470266-3975-20251-40186-cb=<br)
6f16b568" height=3D"2" width=3D"3" alt=3D"">
=
--==87a0043fb5e6eba8327fdc71ad887ef6--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 08 Sep 2022 12:20:53 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oWLnY-000GJn-AN
for dave@doctor.nl2k.ab.ca;
Thu, 08 Sep 2022 11:58:44 -0600
Resent-From: The Doctor
Resent-Date: Thu, 8 Sep 2022 11:58:44 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from solana28.dk4pl.in ([212.83.186.112]:59914)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oWKYH-0007PF-83
for root@nl2k.ab.ca;
Thu, 08 Sep 2022 10:38:57 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; s=default; d=dk4pl.in;
h=Subject:From:To:Sender:Reply-To:Date:List-Unsubscribe:Message-ID:MIME-Version:Content-Type; i=info@dk4pl.in;
bh=b7z4k+HTPLj5rP00kBOa4SqmUxl+Lel3N9LSeztcFA8=;
b=WWA+ZeQZzaGxHNUliRuPEBOfobg8pkqN63YZ2NXCdUja3JJzWQY6W47VNSLQiay+OHmfyGyLa9kd
pNtsBLD4WeZkr2m2xqASeTN6RVs30HS3kln1u2JmTune9hAcXWXIV6VZcUkBlN3OSkFQdXO0aSuA
Z8fasH+JsLs+9ijw21A=
Subject: CONFIRMATION # 234654! root@nl2k.ab.ca, Delivery of your package has
been stopped.
From: "Canada Post"
To: root@nl2k.ab.ca
Sender: info@dk4pl.in
Reply-To: info@dk4pl.in
Date: 08 Sep 2022 16:38:33 -0000
List-Unsubscribe:
X-CampaignID: s4:40183-2dd0402b7da73cbe
Message-ID:
X-Mailer-Info: 8.E2M5cTN.QDMxgzM.y92b0BkbsJzauEmYuMWY.QTN0cDMyYjN.QDMxgjN
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="==87a0043fb5e6eba8327fdc71ad887ef6"
X-Spam_score: 8.5
X-Spam_score_int: 85
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: CANADAÂ POST _PACKAGE CONFIRMATIONÂ # 234654 _Hello root@nl2k.ab.ca,
This is the last time we are reminding you about your pending shipping cost.
The pending delivery will be canceled if the amount [...]
Content analysis details: (8.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: dk4pl.in]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: dk4pl.in]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL
blocklist
[URIs: dk4pl.in]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
0.0 HTML_MESSAGE BODY: HTML included in message
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.1 TO_IN_SUBJ To address is in Subject
Subject: {SPAM?} CONFIRMATION # 234654! root@nl2k.ab.ca, Delivery of your package has
been stopped.
This is a multi-part message in MIME format.
--==87a0043fb5e6eba8327fdc71ad887ef6
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
CANADA=C2=A0POST
_
_PACKAGE CONFIRMATION=C2=A0# 234654_
_Hello root@nl2k.ab.ca,
This is the last time we are reminding you about your pending shipping
cost. The pending delivery will be canceled if the amount is not paid
within 48 hours.
Confirm the delivery details and pay the shipping costs in order to
get your package delivered within 72 hours.=C2=A0
Track your parcel
CA-TT-7854258-POST
TRACK YOUR PACKAGE [/%%Offer Link%%]
=C2=A0
Your delivery will be cancelled
if you don=E2=80=99t plan the delivery within 48 hours.
=C2=A0
Unsubscribe=
--==87a0043fb5e6eba8327fdc71ad887ef6
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
ft-com:office:office" xmlns:v=3D"urn:schemas-microsoft-com:vml">
0" cellpadding=3D"0">
100%">
style=3D"font-size: 36pt;">CANADA
=3D"font-size: 36pt;">POST
t-size: 36pt; background-color: #004a8e;">
pan>
gn=3D"top" width=3D"100%">
adding=3D"0" bgcolor=3D"#ffffff">
llpadding=3D"0">
00" cellspacing=3D"0" cellpadding=3D"0">
ght: 22px; color: #6c6c6c; height: 376px;" align=3D"center" valign=3D"top" =
width=3D"500">
g>
>PACKAGE CONFIRMATION # 234654=
strong>Hello r=
oot@nl2k.ab.ca,
This is the last time we are reminding you about=
your pending shipping cost. The pending delivery will be canceled if the a=
mount is not paid within 48 hours.
Confirm the delivery details =
and pay the shipping costs in order to get your package delivered within 72=
hours.
=
Track your parcel
CA-TT-7854258-POST
>
yle=3D"display: block; color: #ffffff; text-decoration: none; text-align: c=
enter; background: #004A8E; border: 5px solid #004A8E; border-radius: 5px; =
margin: 0 auto; padding: 4px;" href=3D"https://s-trcke.dk4pl.in/ga/click/2-=
45470266-3975-20251-40186-21792-c68a59ab83-cb6f16b568">Track your package
a>
lpadding=3D"0">
ght: 22px; color: #6c6c6c;" align=3D"center" valign=3D"top" width=3D"500">
Your delivery will be c=
ancelled
if you don’t plan the delivery within 48 hours.<=
/p>
=3D"https://s-trcke.dk4pl.in/ga/unsubscribe/2-45470266-3975-20251-40186-452=
488969a185fe-cb6f16b568">
Unsubscribe
6f16b568" height=3D"2" width=3D"3" alt=3D"">
=
--==87a0043fb5e6eba8327fdc71ad887ef6--
