Fedex Phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 01 Oct 2023 21:59:17 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qn9rn-000FZa-05

for dave@doctor.nl2k.ab.ca;

Sun, 01 Oct 2023 21:45:07 -0600

Resent-From: The Doctor

Resent-Date: Sun, 1 Oct 2023 21:45:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vm4680304.1nvme.had.wf ([77.220.215.39]:39854 helo=blueseed.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qn8En-000OlV-2p

for sales@nk.ca;

Sun, 01 Oct 2023 20:03:21 -0600

Received: by blueseed.com (Postfix, from userid 33)

id 7E8052DC88; Mon, 2 Oct 2023 04:54:49 +0300 (EEST)

Date: Mon, 2 Oct 2023 04:51:38 +0300

To: sales@nk.ca

From: FedEx Express

Subject: Notification: New package waiting for payment

Message-ID: <2553efd8c1bf2c49f1f154b959c57683@blueseed.com>

List-Unsubscribe: mailto:bounce354-wPSWTx70vZK1VUI@blueseed.com?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1d62cdf4931bd3b1862e2a146247ed468"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--1d62cdf4931bd3b1862e2a146247ed468

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



















Dear customer,



Your parcel with the number 7729807242 is in transit.

Â

This parcel has been declared to customs and we kindly ask you to pay the customs fees of 1,99Â in customs and taxes by contacting us via the link below as soon as possible.



Get your package



Once you have paid, you will receive a payment confirmation and your parcel will be delivered as soon as possible.

Finally, you can track the progress of your parcel or get information about our products and services on our website.





*Arrival of the Fedex offices:Â 2023.10.02Â 08:30:00









--1d62cdf4931bd3b1862e2a146247ed468

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit



















Dear customer,





Your parcel with the number 7729807242 is in transit.


Â


This parcel has been declared to customs and we kindly ask you to pay the customs fees of 1,99Â in customs and taxes by contacting us via the link below as soon as possible.





Get your package





Once you have paid, you will receive a payment confirmation and your parcel will be delivered as soon as possible.


Finally, you can track the progress of your parcel or get information about our products and services on our website.







*Arrival of the Fedex offices:Â 2023.10.02Â 08:30:00















--1d62cdf4931bd3b1862e2a146247ed468--

Accounts phish from Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 01 Oct 2023 12:51:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qn1Mg-000AFP-0U

for dave@doctor.nl2k.ab.ca;

Sun, 01 Oct 2023 12:40:26 -0600

Resent-From: The Doctor

Resent-Date: Sun, 1 Oct 2023 12:40:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-mw2nam10hn2236.outbound.protection.outlook.com ([52.100.157.236]:26816 helo=NAM10-MW2-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qn0cz-0003ab-2J

for doctor@doctor.nl2k.ab.ca;

Sun, 01 Oct 2023 11:54:03 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=Usjsw4nk/OaAnPdMUddkWZZt1qcVtbV9GubUSLiwqwNz/V8wzmdnlcuhG3VxhEEbhVJqjC0CPSB0pALu0PYeXTFRO640eP6cxLBrycy0lH7zG8KvOnN5LxaIGAL+rQqJLfJR5WgYgy0RQzyLvYmBti1Ehuw3QQZPaA1NbuAA+UBvYHq42+AesZNgY+Dr+m8ijf4E4iLuLKGBCs7sMn8cR6+99K3WcvxxRCX/1JQZyUp7ixjTugVb3mvB30xOIwrXSSwBhguvqxQDbiyspozDI3Y5xx+6dKVlClw+pPAobiHRFlyxFAO/v6nkuLfA7OLrAja2ou5dgnCDu0nmXU9PwQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=z88baNO4KE++LQUijy6DgSrl3HtErk0UxeqXSzbOQpU=;

b=jDTbyWWE/zqrBh4ZtKC3DFaFRaNy5Fz6JC+RTjujhoyNT5Fk+XEceQjWHY1mfkypH3wvlZdOvvbDEWAlxrU0aGnNTs4YIPKhggKcaue2koIeUDbVfUAJwE6oGNkulabrbUk8COC2+Sq3e5UAWLuniWw/mN92i3JRI4jbbZjb/lAGNH7QKFD20tiLyiCBNubZ8noygsuIMjgQ7jbesl7VIJ52OPFXsavAcd6zu09rMzFijCsu3Ua3LjFoIjOrof14mu/2X9jSMnX7snw/NPVA8eA+KqO1HYbw0X4u6aThWH9ts1aEOvzwLd67PlHW+SGM3iHYKrmAfELvNKPkP4Ld8g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=temperror (sender ip

is 23.26.76.199) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=seenbarbados.com; dmarc=none action=none

header.from=seenbarbados.com; dkim=none (message not signed); arc=none

Received: from MW4PR04CA0308.namprd04.prod.outlook.com (2603:10b6:303:82::13)

by SJ0PR16MB5059.namprd16.prod.outlook.com (2603:10b6:a03:435::11) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6792.24; Sun, 1 Oct

2023 17:50:04 +0000

Received: from MW2NAM12FT092.eop-nam12.prod.protection.outlook.com

(2603:10b6:303:82:cafe::93) by MW4PR04CA0308.outlook.office365.com

(2603:10b6:303:82::13) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6838.29 via Frontend

Transport; Sun, 1 Oct 2023 17:50:04 +0000

X-MS-Exchange-Authentication-Results: spf=temperror (sender IP is

23.26.76.199) smtp.mailfrom=seenbarbados.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=seenbarbados.com;

Received-SPF: TempError (protection.outlook.com: error in processing during

lookup of seenbarbados.com: DNS Timeout)

Received: from [127.0.0.1] (23.26.76.199) by

MW2NAM12FT092.mail.protection.outlook.com (10.13.181.163) with Microsoft SMTP

Server id 15.20.6863.17 via Frontend Transport; Sun, 1 Oct 2023 17:50:02

+0000

Content-Type: text/html; charset=utf-8

Priority: high

Importance: High

From: Gunner Nader

To: doctor@doctor.nl2k.ab.ca

Reply-To: doctor@doctor.nl2k.ab.ca

Subject: Statement of Account for Doctor SOA 60958

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Sun, 01 Oct 2023 17:50:02 +0000

MIME-Version: 1.0

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: MW2NAM12FT092:EE_|SJ0PR16MB5059:EE_

X-MS-Office365-Filtering-Correlation-Id: 5177aa35-b172-453b-96de-08dbc2a6d6eb

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?THZOOFpWSFhzcXdPSEVyZFZuUUN6QndNNDlKQ0JCc2lwRHM4Qm9IcUw0SitL?=

=?utf-8?B?V1dtNjFQWUs2ZlkyaWI0K2lPTlNyYVE3NkE4bjB0R3NMUlg5aGdRTStXV1Fy?=

=?utf-8?B?RnVKZUhRaVd6aWRFWXMyRjRVcjkvSkJTY1FQZVpYczdCSTFweE9ld0FScEZ4?=

=?utf-8?B?Y1RsNHFsYTVkU2RhcjdrMDkrWnY2aXNDeUNPR2xmY1o0cDc4aVpwcHJYblAy?=

=?utf-8?B?aHduUXVkZmRJemRab2FnV2FmSFdRL3RLeXNoeXBxYk1XV3hQbnJkYXVTUEcv?=

=?utf-8?B?Z21iVG04ZFBQY0lQQ0VTek1RUWNmM2p2MENiQW5WTUtWN3FDcFBQS2NqZG4y?=

=?utf-8?B?WnZGMWFsYXlnVXdwS0xUQi9MZ0x0bEFjTUJuV29WU3RpN21GUU56WXRiZnRt?=

=?utf-8?B?NmpqWVJBWVBFZ3psbXFjYTBGMWpySTZYVWFPV1gxZjBsS0dZNkpTcm1RZDR4?=

=?utf-8?B?dk5xbnZubjE4VWY2a2QxRnNoVkI5b25vbm11UUh6MlRMdStDVmdoTW4yOUo2?=

=?utf-8?B?S1Nna29xbG1zeGhwR0RtdUdMRTluQWlmL0RjQ05STTZOTTg5R1pxNnpDVERB?=

=?utf-8?B?UDRkSk1KT2ZrdmE3RXluYldTeXdCK2ZDMm9CWC9yeWo0VVVobG90dkhqcFVW?=

=?utf-8?B?cDNybXlLQmdlVUF4TCtBUUh0M0g1RXhjSERFZ0lKSE81NzRqQlhUNjBLSGpZ?=

=?utf-8?B?TXZ2NEE1M2FLbTAwclNJT3kzUjIvQlkvTENNa1RYK0hRRHVXZThSS1Q5bjFG?=

=?utf-8?B?MzNrSElrOHNZUnpTTWVxaVJMQ1FCNmwrSldJRWRJdmgvb1Y0aDdLQzhJaHNF?=

=?utf-8?B?SnQ5OUZXQm05Q2t3cjlsd2czZWpXWmxTWi9leVFRalZhNmQreWFuUkVBYXhp?=

=?utf-8?B?eFNFbyt6Q3JZempqZFcxN3dtSUw3eGd0dmNLYVVOd294K0ZUcXhtTnY5TDBL?=

=?utf-8?B?YWd2cW13SXloRHAxTW1CanhXQmF2cVN4T1RXRmJlYytEdTNlSEYrZHMwN2NO?=

=?utf-8?B?WFZoRUNaME5MQU9acjd5aE9WYk9kYmRQY2VmWVZ5eUN0dnl1cmd0VklSZURu?=

=?utf-8?B?OWhxajU1RFJ4VnpMR3VvZlNhWmQ1azFoK0svMXdJY1F4UVFLeHllMXJKWUkw?=

=?utf-8?B?dUJBQkxJN3dIYWQzQkR1Ny9xRUp6VzFUa2sxbmRKT0FyRGp1Z25acXVwTnB5?=

=?utf-8?B?dHdhSWVRWjBIdk5uOWZURmRsbkdPdjJpcHM3TVVzWlkzbHRGVXpvUkRWUkN2?=

=?utf-8?B?RStrK1lwdnR4dXBZRnFGbnFuOElXVzMzYXBNenlzbnNUVzczNUJWVm5KMEhJ?=

=?utf-8?B?cm8wVHA2YVIzSEsvSnNlVjF4Y1lqTHdJMFpRNnJEazNZN0Z0K1RrY29hc001?=

=?utf-8?B?K2ZZL1NDQnlYbTlzclY0ODJrejdQTUVmc3NTVWhUSS9ydEZURU55dmhzMytx?=

=?utf-8?B?Yys1UlEvQkpoUWlDbTdNRlZlT0FOUTBCeHc5RnhWdjY3eE9DdlZZaDNjdkZ1?=

=?utf-8?B?R3Y2aW1ybWorK3FzbkVjODJ6VTBVMkFNelJVR0NqS0hsYm5NWGtPRHZicmlM?=

=?utf-8?B?Wi9IbFdkVSt2MFZBcG5rWEpFY3AxbEtCZDNuMi9WV2dIdFNUSEVYbmVocHRV?=

=?utf-8?B?bmlFNjJ4US9TbU8yc0VoaTAwdFpGTmpkT2FJRHhqNTJ2MkJjMEIyZ1FuOFJq?=

=?utf-8?B?Qzh5UnNqLy8zUGxtckt5bWYwVzJMWmViRGV6cmh0UGEzZnlUb0l5NlNRQ0Uw?=

=?utf-8?B?WGJiM3lqTjZzVWJnbjg5eWJOVWlhTDZnclBxenhyd1VkZVVrcTh2Y2laek1o?=

=?utf-8?B?OE13Slpid2N3MWE4TzBWdm5OeExWdkJMaTJWS2U1YUhhcVdCY3h1RE53akU4?=

=?utf-8?B?NjZqMjR1S211RXl6MDVFK3h6WWg2WmVKNVB1WjNxQnBIUUtFcE5mcndqdkE3?=

=?utf-8?B?NGVtYjlwSjE5UGlNRS9XVWt0VHNzVE9WZlFCVmIrTjBvUjgzb2pYZ0Y1bVRw?=

=?utf-8?B?eXV2N0NNd3FKNDlkV1lyVHZ0S09UK0tScW53Ri9MeWZ3STh3MkpWTnBRYjNU?=

=?utf-8?B?UWtjMXNyZE5HQ0tUWElhYkk2ajVRMllTSXFiRlJHRUFZVHlmVGFuMldIQjVJ?=

=?utf-8?B?c0l4YUx2UE1SbTFrb3BRR3QzaGUwTEpFbDkzaXRoNVhpUmdpSkpRZHg2RHA3?=

=?utf-8?B?Q0x5SjdjTWRrUVdNVWxhYXdoRUF0TDRCbWM1MWVLN2lRN0d0bUtwcXpTWWxP?=

=?utf-8?B?ZXdnWWdRTEYwTVZSVHV4cXExMnE3VXNUSFhraVB4Qi9qOVRINHBoMlZIMnpE?=

=?utf-8?B?Ums1eWtmMkRMZ1hRZGVrQ0VhQmNEQ3hTcklISTZZTlRIbXlEZEdtTjlsMmpx?=

=?utf-8?Q?jUXc+zdUecE5uuKM=3D?=

X-Forefront-Antispam-Report:

CIP:23.26.76.199;CTRY:US;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:[127.0.0.1];PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230031)(6049001)(376002)(346002)(396003)(39830400003)(136003)(230922051799003)(64100799003)(451199024)(61400799006)(186009)(82310400011)(46966006)(36840700001)(41300700001)(16576012)(40480700001)(6486002)(166002)(83080400003)(86362001)(70206006)(316002)(70586007)(45640500001)(478600001)(31686004)(6916009)(40265005)(36736006)(8676002)(8936002)(7246003)(36200700002)(7126003)(47076005)(36860700001)(356005)(2616005)(5660300002)(81166007)(26005)(956004)(336012)(4744005)(63350400001)(66574015)(36756003)(2906002)(15650500001)(83380400001)(31696002)(34020700004)(9316004)(19588885021);DIR:OUT;SFP:1501;

X-OriginatorOrg: seenbarbados.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Oct 2023 17:50:02.6993

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 5177aa35-b172-453b-96de-08dbc2a6d6eb

X-MS-Exchange-CrossTenant-Id: 3feb9f01-e4f6-49f0-8a3f-8fdc7b2151ab

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3feb9f01-e4f6-49f0-8a3f-8fdc7b2151ab;Ip=[23.26.76.199];Helo=[[127.0.0.1]]

X-MS-Exchange-CrossTenant-AuthSource:

MW2NAM12FT092.eop-nam12.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR16MB5059

X-Spam_score: 9.1

X-Spam_score_int: 91

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Accounts Shared Your Statement document bundle: SOA-25190.pdf

and has been finalised. The signed documents have been attached. Open document

bundle



Content analysis details: (9.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.157.236 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.100.157.236 listed in list.dnswl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

1.0 FORGED_SPF_HELO No description available.

2.0 GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website

+ HTML only

Subject: {SPAM?} Statement of Account for Doctor SOA 60958




class=3D"adM">






bgcolor=3D"#fff" style=3D"color:rgb(0,0,0);font-family:"Helvetica =

Neue",Helvetica,Arial,sans-serif;font-size:14px;font-style:normal;font=

-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-s=

pacing:normal;text-align:start;text-transform:none;word-spacing:0px;white-s=

pace:normal;text-decoration-style:initial;text-decoration-color:initial;box=

-sizing:border-box;border-radius:3px;margin:0px;border:1px solid rgb(233,=

233,233);background-color:rgb(255,255,255)">
style=3D"font-family:"Helvetica Neue",Helvetica,Arial,=

sans-serif;box-sizing:border-box;font-size:14px;margin:0px">

valign=3D"top" style=3D"font-family:"Helvetica Neue",Helvetica,=

Arial,sans-serif;box-sizing:border-box;font-size:14px;vertical-align:top;ma=

rgin:0px;padding:10px">


Accounts Shared Your Statement =

document bundle: SOA-25190.pdf a=

nd has been finalised.

The signed documents have been attached.=


rgin-right:auto">
body>

cellpadding=3D"0">

style=3D"border-radius:2px">
html#doctor@doctor.nl2k.ab.ca" rel=3D"noopener noreferrer" =

style=3D"padding:8px 12px;border:1px solid rgb(58,165,=

76);font-family:"Helvetica Neue",Helvetica,Arial,=

sans-serif;border-radius:2px;font-size:16px;text-decoration:none;display:in=

line-block;color:rgb(255,255,255)" target=3D"_blank" =

data-saferedirecturl=3D"https://www.google.com/url?q=3Dhttp://SD&source=

=3Dgmail&ust=3D1693447581012000&usg=3DAOvVaw2ae9M5fv8fX9BPAT7848De"=

>
WxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsW11d=

; 4:WyIjbXNnLWY6MTc3NTYwNzAxMTg3MDU1MTU1MSIsbnVsbCxbXSxudWxsLG51bGwsbnVsbCx=

udWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxbXSxbXSxbXV0.=

">Open document bundle 


If you have trouble with the above link, =

copy the link and open it with your browser.

<=

div class=3D"yj6qo">












CONFIDENTIALITY NOTICE: This e-mail transmission, and any documents, files =

or previous e-mail message attached to it may contain confidential, =

sensitive, or personal information. If you are not the intended recipient, =

or a person responsible for delivering it to the intended recipient, you =

are hereby notified that any disclosure, copying, distribution or use of =

any of the information contained in or attached to this transmission is =

STRICTLY PROHIBITED. If you have received this transmission in error, =

please immediately notify the sender. Please destroy the original =

transmission and its attachments without reading or saving in any manner. =

Thank you.