DHL Phish from ONE TELECOM ltd Odessa
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 29 May 2023 11:21:26 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from)
id 1q3gUM-0006Jd-2P
for dave@doctor.nl2k.ab.ca;
Mon, 29 May 2023 11:16:58 -0600
Resent-From: The Doctor
Resent-Date: Mon, 29 May 2023 11:16:58 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail.ubase.top ([185.4.42.87]:53716)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96 (FreeBSD))
(envelope-from)
id 1q3ezD-000CHg-2x
for root@nl2k.ab.ca;
Mon, 29 May 2023 09:40:48 -0600
Received: by mail.ubase.top (Postfix, from userid 1025)
id B36653050DC; Mon, 29 May 2023 18:38:36 +0300 (EEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ubase.top; s=mail;
t=1685374716; bh=+s1BuLr860fRULqPQUxJRk8jG+CYwqohtX5xdUTY3KQ=;
h=From:To:Date:Subject;
b=nW8l5RbzLFGPzg2Bp3gbb1oEDLmLTbB9lsphfMtvL1YtszWhpf+GoKMbPttLDSyTN
pnj/Q6IPQ7yJpQUSTDxXXEzCXGjUpKx1AvUnH5L0wC+XwXKjWF70hy9Z7dwbIYCkRZ
zrNHTy8dHUuErrUIhR7qjqayoVgh68hzsuk17dec=
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on mail.8.8.8.8
X-Spam-Level:
X-Spam-Status: No, score=-0.2 required=5.0 tests=ALL_TRUSTED,DKIM_SIGNED,
DKIM_VALID,DKIM_VALID_AU,HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,
HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,MIME_QP_LONG_LINE,MISSING_MID,
URIBL_BLOCKED,URIBL_DBL_BLOCKED_OPENDNS,URIBL_ZEN_BLOCKED_OPENDNS
autolearn=no autolearn_force=no version=3.4.0
Received: from DESKTOP-UPEJSU4 (unknown [194.145.138.26])
by mail.ubase.top (Postfix) with ESMTPA id 171403050EC
for; Mon, 29 May 2023 18:38:36 +0300 (EEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ubase.top; s=mail;
t=1685374716; bh=+s1BuLr860fRULqPQUxJRk8jG+CYwqohtX5xdUTY3KQ=;
h=From:To:Date:Subject;
b=nW8l5RbzLFGPzg2Bp3gbb1oEDLmLTbB9lsphfMtvL1YtszWhpf+GoKMbPttLDSyTN
pnj/Q6IPQ7yJpQUSTDxXXEzCXGjUpKx1AvUnH5L0wC+XwXKjWF70hy9Z7dwbIYCkRZ
zrNHTy8dHUuErrUIhR7qjqayoVgh68hzsuk17dec=
MIME-Version: 1.0
From: EXPRESS
To: root@nl2k.ab.ca
Date: 29 May 2023 16:38:31 +0100
Subject: Your shipment No. 4549652700 is still awaiting
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Message-Id: <20230529153836.B36653050DC@mail.ubase.top>
X-Spam_score: 8.3
X-Spam_score_int: 83
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: EDHLE Your package is waiting for delivery. We inform you
that your shipment No. 4549652700 is still awaiting instructions from you.
Content analysis details: (8.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 T_PDS_OTHER_BAD_TLD Untrustworthy TLDs
[URI: ubase.top (top)]
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars
0.0 FROM_SUSPICIOUS_NTLD From abused NTLD
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
Subject: {SPAM?} Your shipment No. 4549652700 is still awaiting
X-Antivirus: AVG (VPS 230529-2, 5/29/2023), Inbound message
X-Antivirus-Status: Clean
cellPadding=3D0 width=3D480 align=3Dcenter border=3D0>=0D=0A=0D=0A=
=0D=0A=0D=0A
center; BACKGROUND-COLOR: rgb(255,255,255)">
style=3D"FONT-SIZE: 24px">E
style=3D"COLOR: rgb(255,0,0)">
style=3D"BACKGROUND-COLOR: rgb(255,215,0)">DHL
style=3D"COLOR: rgb(255,215,0)">
rgb(255,215,0)">E
face=3D"tahoma, geneva, sans-serif">
style=3D"BACKGROUND-COLOR: rgb(255,215,0)"> =
=0D=0A
rgb(255,255,255)"> =0D=0A
rgb(255,255,255)">
style=3D"FONT-SIZE: 14px">
rgb(51,51,51)">Your package is waiting for delivery.=
=0D=0A
style=3D"TEXT-ALIGN: center">
tahoma,geneva,sans-serif">We inform you that your shipment No.
rgb(0,102,255)">4549652700 is still awaiting instructions from you.=
=0D=0A
=0D=0A
style=3D"MARGIN-LEFT: 20px; MARGIN-RIGHT: 20px" align=3Dcenter>
16px">
14px; FONT-FAMILY: Verdana,Geneva,sans-serif; FONT-WEIGHT: bold; COLOR:=
rgb(255,255,255) !important; PADDING-BOTTOM: 12px; PADDING-TOP: 12px; PADDING-LEFT:=
24px; DISPLAY: inline-block; LINE-HEIGHT: 24px; PADDING-RIGHT: 24px; BACKGROUND-COLOR:=
rgb(255,181,10); border-radius: 5px; text-decoration-line: none" href=3D"https://mby.me/6kG"=
rel=3D"noopener noreferrer" target=3D_blank data-auth=3D"NotApplicable"=
data-linkindex=3D"0">Ship Now=
=0D=0A
20px" align=3Dcenter> =0D=0A=0D=0A
13px; BORDER-TOP: rgb(230,230,230) 1px solid; FONT-FAMILY: Arial,Helvetica,sans-serif;=
VERTICAL-ALIGN: top; PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT:=
20px" align=3Dleft>=0D=0A =0D=0A=
=0D=0A
VERTICAL-ALIGN: top; PADDING-BOTTOM: 23px; PADDING-TOP: 20px; PADDING-LEFT:=
30px; PADDING-RIGHT: 30px; BACKGROUND-COLOR: rgb(237,237,237)" align=3Dleft>=
=0D=0A
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 29 May 2023 11:21:26 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))
(envelope-from
id 1q3gUM-0006Jd-2P
for dave@doctor.nl2k.ab.ca;
Mon, 29 May 2023 11:16:58 -0600
Resent-From: The Doctor
Resent-Date: Mon, 29 May 2023 11:16:58 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail.ubase.top ([185.4.42.87]:53716)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96 (FreeBSD))
(envelope-from
id 1q3ezD-000CHg-2x
for root@nl2k.ab.ca;
Mon, 29 May 2023 09:40:48 -0600
Received: by mail.ubase.top (Postfix, from userid 1025)
id B36653050DC; Mon, 29 May 2023 18:38:36 +0300 (EEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ubase.top; s=mail;
t=1685374716; bh=+s1BuLr860fRULqPQUxJRk8jG+CYwqohtX5xdUTY3KQ=;
h=From:To:Date:Subject;
b=nW8l5RbzLFGPzg2Bp3gbb1oEDLmLTbB9lsphfMtvL1YtszWhpf+GoKMbPttLDSyTN
pnj/Q6IPQ7yJpQUSTDxXXEzCXGjUpKx1AvUnH5L0wC+XwXKjWF70hy9Z7dwbIYCkRZ
zrNHTy8dHUuErrUIhR7qjqayoVgh68hzsuk17dec=
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on mail.8.8.8.8
X-Spam-Level:
X-Spam-Status: No, score=-0.2 required=5.0 tests=ALL_TRUSTED,DKIM_SIGNED,
DKIM_VALID,DKIM_VALID_AU,HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,
HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,MIME_QP_LONG_LINE,MISSING_MID,
URIBL_BLOCKED,URIBL_DBL_BLOCKED_OPENDNS,URIBL_ZEN_BLOCKED_OPENDNS
autolearn=no autolearn_force=no version=3.4.0
Received: from DESKTOP-UPEJSU4 (unknown [194.145.138.26])
by mail.ubase.top (Postfix) with ESMTPA id 171403050EC
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ubase.top; s=mail;
t=1685374716; bh=+s1BuLr860fRULqPQUxJRk8jG+CYwqohtX5xdUTY3KQ=;
h=From:To:Date:Subject;
b=nW8l5RbzLFGPzg2Bp3gbb1oEDLmLTbB9lsphfMtvL1YtszWhpf+GoKMbPttLDSyTN
pnj/Q6IPQ7yJpQUSTDxXXEzCXGjUpKx1AvUnH5L0wC+XwXKjWF70hy9Z7dwbIYCkRZ
zrNHTy8dHUuErrUIhR7qjqayoVgh68hzsuk17dec=
MIME-Version: 1.0
From: EXPRESS
To: root@nl2k.ab.ca
Date: 29 May 2023 16:38:31 +0100
Subject: Your shipment No. 4549652700 is still awaiting
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Message-Id: <20230529153836.B36653050DC@mail.ubase.top>
X-Spam_score: 8.3
X-Spam_score_int: 83
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: EDHLE Your package is waiting for delivery. We inform you
that your shipment No. 4549652700 is still awaiting instructions from you.
Content analysis details: (8.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 T_PDS_OTHER_BAD_TLD Untrustworthy TLDs
[URI: ubase.top (top)]
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars
0.0 FROM_SUSPICIOUS_NTLD From abused NTLD
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
Subject: {SPAM?} Your shipment No. 4549652700 is still awaiting
X-Antivirus: AVG (VPS 230529-2, 5/29/2023), Inbound message
X-Antivirus-Status: Clean
cellPadding=3D0 width=3D480 align=3Dcenter border=3D0>=0D=0A=0D=0A
=0D=0A
center; BACKGROUND-COLOR: rgb(255,255,255)">
style=3D"FONT-SIZE: 24px">E
style=3D"COLOR: rgb(255,0,0)">
style=3D"BACKGROUND-COLOR: rgb(255,215,0)">DHL
style=3D"COLOR: rgb(255,215,0)">
rgb(255,215,0)">E
face=3D"tahoma, geneva, sans-serif">
style=3D"BACKGROUND-COLOR: rgb(255,215,0)"> =
=0D=0A
rgb(255,255,255)"> =0D=0A
rgb(255,255,255)">
style=3D"FONT-SIZE: 14px">
rgb(51,51,51)">Your package is waiting for delivery.=
=0D=0A
=0D=0A
style=3D"TEXT-ALIGN: center">
tahoma,geneva,sans-serif">We inform you that your shipment No.
rgb(0,102,255)">4549652700 is still awaiting instructions from you.=
=0D=0A
style=3D"FONT-FAMILY: tahoma,geneva,sans-serif">
16px">You have to=
pay the additional shipping fees to ship your parcel as soon as possible.
=0D=0A
=0D=0A
style=3D"MARGIN-LEFT: 20px; MARGIN-RIGHT: 20px" align=3Dcenter>
16px">
14px; FONT-FAMILY: Verdana,Geneva,sans-serif; FONT-WEIGHT: bold; COLOR:=
rgb(255,255,255) !important; PADDING-BOTTOM: 12px; PADDING-TOP: 12px; PADDING-LEFT:=
24px; DISPLAY: inline-block; LINE-HEIGHT: 24px; PADDING-RIGHT: 24px; BACKGROUND-COLOR:=
rgb(255,181,10); border-radius: 5px; text-decoration-line: none" href=3D"https://mby.me/6kG"=
rel=3D"noopener noreferrer" target=3D_blank data-auth=3D"NotApplicable"=
data-linkindex=3D"0">Ship Now=
=0D=0A
20px" align=3Dcenter>
13px; BORDER-TOP: rgb(230,230,230) 1px solid; FONT-FAMILY: Arial,Helvetica,sans-serif;=
VERTICAL-ALIGN: top; PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT:=
20px" align=3Dleft>=0D=0A
style=3D"FONT-SIZE: 14px">Sincerely,
=0D=0A
VERTICAL-ALIGN: top; PADDING-BOTTOM: 23px; PADDING-TOP: 20px; PADDING-LEFT:=
30px; PADDING-RIGHT: 30px; BACKGROUND-COLOR: rgb(237,237,237)" align=3Dleft>=
=0D=0A
Thank you for your confide