Canada post phish from luminescent-digital.com
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 28 Jan 2024 06:07:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rU4rM-00000000NsC-3so0
for dave@doctor.nl2k.ab.ca;
Sun, 28 Jan 2024 06:06:04 -0700
Resent-From: The Doctor
Resent-Date: Sun, 28 Jan 2024 06:06:04 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [98.142.102.162] (port=41730 helo=server1.luminescent-digital.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rTtiO-00000000Kp1-25DS
for doctor@mail.nl2k.ab.ca;
Sat, 27 Jan 2024 18:12:10 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=bebemicro.luminescent.digital; s=default; h=Sender:
Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:From:Date:
Subject:To:Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From
:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:
List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:
List-Archive; bh=7DVwcIBiJWCWasrOrbMs0IAn65r2Ar1XnEE0C4L4FtE=; b=hki71tK/qLsa
kCvMiqBXsS8ujq0yVk/Bgfl0AbjEmgxPGlmZNJB6QiR8pKLv+Rj8jslzYmZq3Jx2/FRPf/uIaKxg6
AcK9iPf4UrV71qCesC7LZeKdrtJzB5ezdF08AlRxvrYeRXecgR9pJIhd0qukOniQMRbx5ky7ryoao
7QBLUOUXVstKTHSx7inLj7rgLwIpIjyjkbYX33NLmwdt9PJ4oafHdRg/zEFhYXN6akrfUl75HnO4c
nJzeQyY6bzZySUZG73gM8Y9SReUiQy/sa+vXu4iViFlpLWbi4JpazOmbEeN8RDL57wn8q+r30G4KT
BW5DLakwI5Oqydej2m+eRg==;
Received: from bebemicrolumines by server1.luminescent-digital.com with local (Exim 4.93)
(envelope-from)
id 1rTtgL-0003Yh-Cq
for doctor@mail.nl2k.ab.ca; Sat, 27 Jan 2024 20:09:57 -0500
To: doctor@mail.nl2k.ab.ca
Subject: You have a package awaiting delivery
X-PHP-Script: bebemicro.luminescent.digital/wp-admin/ovaretkbm.php for 197.145.226.218
X-PHP-Originating-Script: 582:ovaretkbm.php
Date: Sun, 28 Jan 2024 01:09:57 +0000
From: Canada Post | Postes Canada
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_f4ebc15092ab0287cab96f9bba2105dd"
Content-Transfer-Encoding: 8bit
Sender:
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server1.luminescent-digital.com
X-AntiAbuse: Original Domain - mail.nl2k.ab.ca
X-AntiAbuse: Originator/Caller UID/GID - [582 32007] / [47 12]
X-AntiAbuse: Sender Address Domain - canadapost-postescanada.ca
X-Get-Message-Sender-Via: server1.luminescent-digital.com: authenticated_id: bebemicrolumines/only user confirmed/virtual account not confirmed
X-Authenticated-Sender: server1.luminescent-digital.com: bebemicrolumines
X-Source: /opt/cpanel/ea-php71/root/usr/bin/php-cgi
X-Source-Args: /opt/cpanel/ea-php71/root/usr/bin/php-cgi /home/bebemicrolumines/public_html/wp-admin/ovaretkbm.php
X-Source-Dir: bebemicro.luminescent.digital:/public_html/wp-admin
X-Spam_score: 11.1
X-Spam_score_int: 111
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your package N* 013921283108651253588015 is under transport
by Canada Post Office.This may happen when your delivery's address is incorrect.
We ask you to replan your delivery by connecting via the li [...]
Content analysis details: (11.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: tt.vg]
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=delivery%40canadapost-postescanada.ca;ip=98.142.102.162;r=doctor.nl2k.ab.ca]
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted
Colors in HTML
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.9 PHP_SCRIPT Sent by PHP script
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
Subject: {SPAM?} You have a package awaiting delivery
This is a multi-part message in MIME format.
--b1_f4ebc15092ab0287cab96f9bba2105dd
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Â
Â
Â
Your package N* 013921283108651253588015 is under transport by Canada Post Office.This may happen when your delivery's address is incorrect. We ask you to replan your delivery by connecting via the link below as soon as possible.
Plan your delivery
Once your delivery address and payment is complete, your package will be delivered the next day following our terms and conditions.Finally, be aware that you can follow the progress of your package or have information about our products and services on our site.
This is an automatic message. Please do not reply.
Arrived at Canada Post Office Origin Facility: 01.27.2024 05:32:05 AM
--b1_f4ebc15092ab0287cab96f9bba2105dd
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
--b1_f4ebc15092ab0287cab96f9bba2105dd--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 28 Jan 2024 06:07:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rU4rM-00000000NsC-3so0
for dave@doctor.nl2k.ab.ca;
Sun, 28 Jan 2024 06:06:04 -0700
Resent-From: The Doctor
Resent-Date: Sun, 28 Jan 2024 06:06:04 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [98.142.102.162] (port=41730 helo=server1.luminescent-digital.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rTtiO-00000000Kp1-25DS
for doctor@mail.nl2k.ab.ca;
Sat, 27 Jan 2024 18:12:10 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=bebemicro.luminescent.digital; s=default; h=Sender:
Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:From:Date:
Subject:To:Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From
:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:
List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:
List-Archive; bh=7DVwcIBiJWCWasrOrbMs0IAn65r2Ar1XnEE0C4L4FtE=; b=hki71tK/qLsa
kCvMiqBXsS8ujq0yVk/Bgfl0AbjEmgxPGlmZNJB6QiR8pKLv+Rj8jslzYmZq3Jx2/FRPf/uIaKxg6
AcK9iPf4UrV71qCesC7LZeKdrtJzB5ezdF08AlRxvrYeRXecgR9pJIhd0qukOniQMRbx5ky7ryoao
7QBLUOUXVstKTHSx7inLj7rgLwIpIjyjkbYX33NLmwdt9PJ4oafHdRg/zEFhYXN6akrfUl75HnO4c
nJzeQyY6bzZySUZG73gM8Y9SReUiQy/sa+vXu4iViFlpLWbi4JpazOmbEeN8RDL57wn8q+r30G4KT
BW5DLakwI5Oqydej2m+eRg==;
Received: from bebemicrolumines by server1.luminescent-digital.com with local (Exim 4.93)
(envelope-from
id 1rTtgL-0003Yh-Cq
for doctor@mail.nl2k.ab.ca; Sat, 27 Jan 2024 20:09:57 -0500
To: doctor@mail.nl2k.ab.ca
Subject: You have a package awaiting delivery
X-PHP-Script: bebemicro.luminescent.digital/wp-admin/ovaretkbm.php for 197.145.226.218
X-PHP-Originating-Script: 582:ovaretkbm.php
Date: Sun, 28 Jan 2024 01:09:57 +0000
From: Canada Post | Postes Canada
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_f4ebc15092ab0287cab96f9bba2105dd"
Content-Transfer-Encoding: 8bit
Sender:
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server1.luminescent-digital.com
X-AntiAbuse: Original Domain - mail.nl2k.ab.ca
X-AntiAbuse: Originator/Caller UID/GID - [582 32007] / [47 12]
X-AntiAbuse: Sender Address Domain - canadapost-postescanada.ca
X-Get-Message-Sender-Via: server1.luminescent-digital.com: authenticated_id: bebemicrolumines/only user confirmed/virtual account not confirmed
X-Authenticated-Sender: server1.luminescent-digital.com: bebemicrolumines
X-Source: /opt/cpanel/ea-php71/root/usr/bin/php-cgi
X-Source-Args: /opt/cpanel/ea-php71/root/usr/bin/php-cgi /home/bebemicrolumines/public_html/wp-admin/ovaretkbm.php
X-Source-Dir: bebemicro.luminescent.digital:/public_html/wp-admin
X-Spam_score: 11.1
X-Spam_score_int: 111
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your package N* 013921283108651253588015 is under transport
by Canada Post Office.This may happen when your delivery's address is incorrect.
We ask you to replan your delivery by connecting via the li [...]
Content analysis details: (11.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: tt.vg]
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=delivery%40canadapost-postescanada.ca;ip=98.142.102.162;r=doctor.nl2k.ab.ca]
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted
Colors in HTML
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.9 PHP_SCRIPT Sent by PHP script
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
Subject: {SPAM?} You have a package awaiting delivery
This is a multi-part message in MIME format.
--b1_f4ebc15092ab0287cab96f9bba2105dd
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Â
Â
Â
Your package N* 013921283108651253588015 is under transport by Canada Post Office.This may happen when your delivery's address is incorrect. We ask you to replan your delivery by connecting via the link below as soon as possible.
Plan your delivery
Once your delivery address and payment is complete, your package will be delivered the next day following our terms and conditions.Finally, be aware that you can follow the progress of your package or have information about our products and services on our site.
This is an automatic message. Please do not reply.
Arrived at Canada Post Office Origin Facility: 01.27.2024 05:32:05 AM
--b1_f4ebc15092ab0287cab96f9bba2105dd
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
Â
Â
| ||||
|
*Arrived at Canada Post Office Origin Facility: 01.27.2024 05:32:05 AM
--b1_f4ebc15092ab0287cab96f9bba2105dd--