Fedex Phish from India
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 18 Nov 2022 07:01:16 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1ow1PQ-000BlC-KL
for dave@doctor.nl2k.ab.ca;
Fri, 18 Nov 2022 06:27:56 -0700
Resent-From: The Doctor
Resent-Date: Fri, 18 Nov 2022 06:27:56 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from vmi782244.contaboserver.net ([161.97.93.107]:42168)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1ovysi-000Jvt-Bj
for root@nk.ca;
Fri, 18 Nov 2022 03:46:04 -0700
Received: from supportgnuac by server.triospheretech.com with local (Exim 4.95)
(envelope-from)
id 1ovypx-0006yz-3f
for root@nk.ca;
Fri, 18 Nov 2022 11:43:09 +0100
To: root@nk.ca
Subject: =?UTF-8?Q?Your_new_package_N=C2=B0_RY982465507CN_is_ready_to_be_collected?= =?UTF-8?Q?.?=
X-PHP-Script: support.gnu.ac.in/ictoccthfo.php for 86.98.32.193
X-PHP-Originating-Script: 1009:ictoccthfo.php(291) : eval()'d code(1) : eval()'d code
Date: Fri, 18 Nov 2022 10:43:09 +0000
From: "FedEx."
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_ae6607a9652fa58ff9eef4b68ac682b9"
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.triospheretech.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [1009 993] / [47 12]
X-AntiAbuse: Sender Address Domain - support.gnu.ac.in
X-Get-Message-Sender-Via: server.triospheretech.com: authenticated_id: supportgnuac/from_h
X-Authenticated-Sender: server.triospheretech.com: support@support.gnu.ac.in
X-Source:
X-Source-Args: php-fpm: pool support_gnu_ac_in
X-Source-Dir: support.gnu.ac.in:/public_html
X-Spam_score: 8.2
X-Spam_score_int: 82
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: This message is from a trusted sender.   Dear customer,
Content analysis details: (8.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
0.0 HTML_MESSAGE BODY: HTML included in message
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
1.0 PDS_PHP_EVAL PHP header shows eval'd code
1.0 PHP_ORIG_SCRIPT_EVAL From suspicious PHP source
1.7 PHP_SCRIPT Sent by PHP script
Subject: {SPAM?} =?UTF-8?Q?Your_new_package_N=C2=B0_RY982465507CN_is_ready_to_be_collected?= =?UTF-8?Q?.?=
This is a multi-part message in MIME format.
--b1_ae6607a9652fa58ff9eef4b68ac682b9
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This message is from a trusted sender.
 
Dear customer,
We are ready to announce that your package has arrived at the local post office on 18/11/2022.
But you haven't received it yet.
You have 24 hours to collect the package otherwise it will be returned to sender.
Kindly pay (1.00 CAD) in order to receive your parcel by the next 2-3 working days.
Confirm Payment
 
*Note: You are obliged to resolve the situation as soon as possible to receive your package.
Thank you for your cooperation in this matter.
© FedEx 1995-2022
--b1_ae6607a9652fa58ff9eef4b68ac682b9
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 18 Nov 2022 07:01:16 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1ow1PQ-000BlC-KL
for dave@doctor.nl2k.ab.ca;
Fri, 18 Nov 2022 06:27:56 -0700
Resent-From: The Doctor
Resent-Date: Fri, 18 Nov 2022 06:27:56 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from vmi782244.contaboserver.net ([161.97.93.107]:42168)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from
id 1ovysi-000Jvt-Bj
for root@nk.ca;
Fri, 18 Nov 2022 03:46:04 -0700
Received: from supportgnuac by server.triospheretech.com with local (Exim 4.95)
(envelope-from
id 1ovypx-0006yz-3f
for root@nk.ca;
Fri, 18 Nov 2022 11:43:09 +0100
To: root@nk.ca
Subject: =?UTF-8?Q?Your_new_package_N=C2=B0_RY982465507CN_is_ready_to_be_collected?= =?UTF-8?Q?.?=
X-PHP-Script: support.gnu.ac.in/ictoccthfo.php for 86.98.32.193
X-PHP-Originating-Script: 1009:ictoccthfo.php(291) : eval()'d code(1) : eval()'d code
Date: Fri, 18 Nov 2022 10:43:09 +0000
From: "FedEx."
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_ae6607a9652fa58ff9eef4b68ac682b9"
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.triospheretech.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [1009 993] / [47 12]
X-AntiAbuse: Sender Address Domain - support.gnu.ac.in
X-Get-Message-Sender-Via: server.triospheretech.com: authenticated_id: supportgnuac/from_h
X-Authenticated-Sender: server.triospheretech.com: support@support.gnu.ac.in
X-Source:
X-Source-Args: php-fpm: pool support_gnu_ac_in
X-Source-Dir: support.gnu.ac.in:/public_html
X-Spam_score: 8.2
X-Spam_score_int: 82
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: This message is from a trusted sender.   Dear customer,
Content analysis details: (8.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
0.0 HTML_MESSAGE BODY: HTML included in message
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
1.0 PDS_PHP_EVAL PHP header shows eval'd code
1.0 PHP_ORIG_SCRIPT_EVAL From suspicious PHP source
1.7 PHP_SCRIPT Sent by PHP script
Subject: {SPAM?} =?UTF-8?Q?Your_new_package_N=C2=B0_RY982465507CN_is_ready_to_be_collected?= =?UTF-8?Q?.?=
This is a multi-part message in MIME format.
--b1_ae6607a9652fa58ff9eef4b68ac682b9
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This message is from a trusted sender.
 
Dear customer,
We are ready to announce that your package has arrived at the local post office on 18/11/2022.
But you haven't received it yet.
You have 24 hours to collect the package otherwise it will be returned to sender.
Kindly pay (1.00 CAD) in order to receive your parcel by the next 2-3 working days.
Confirm Payment
 
*Note: You are obliged to resolve the situation as soon as possible to receive your package.
Thank you for your cooperation in this matter.
© FedEx 1995-2022
--b1_ae6607a9652fa58ff9eef4b68ac682b9
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
This message is from a trusted sender. |
|
