package Delivery phish from mailgun.org
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 17 Aug 2024 14:06:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from)
id 1sfPg1-00000000CsS-2BI1
for dave@doctor.nl2k.ab.ca;
Sat, 17 Aug 2024 14:05:29 -0600
Resent-From: The Doctor
Resent-Date: Sat, 17 Aug 2024 14:05:29 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from m239-4.eu.mailgun.net ([185.250.239.4]:61239)
by doctor.nl2k.ab.ca with utf8esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98 (FreeBSD))
(envelope-from)
id 1sfNlG-00000000Izs-02Ab
for doctor@nl2k.ab.ca;
Sat, 17 Aug 2024 12:02:51 -0600
DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=messages.nfl.casperfonseca.dk; q=dns/txt; s=k1; t=1723917639; x=1723924839;
h=Content-Type: Content-Transfer-Encoding: Message-Id: To: To: From: From: Subject: Subject: Mime-Version: Date: Sender: Sender;
bh=ehtvw6YqVSGjJ44bmYT9doh0wDQxec4V4v6nfKr7VAM=;
b=qrpEumV1DGcqxF+SfCAbCnjV1xlO/H5z3NJpYyLZMsQtN/tOAzqQrnMCb2EsdpAwvs/MWBEICRNWnd3qThmMSU2hSdgaWiMwbTJ3i6Z9IlnDI7SqRNV2czxceqsg44Fd/odWQOWDrVb9gICsNYGvD618NC1ew6J+3U2ojsyskNSgKxFyTDJZdm71xf7Tf3f152oUEJy7zAZkdjdvSUrIAuVyF0Vea55RUBHYsMLKWOeqn1+vBMVVAFvRYel+Uv+7NNWxAlsPNrAQglfbtIPf8KTjBMaQRzO1K/Rv2pNIiEfDE4Nxdegk+8MNWYM5mHqYxBdIVhP5CJcwOgzGc5STRg==
X-Mailgun-Sending-Ip: 185.250.239.4
X-Mailgun-Sid: WyI1NmNhZCIsImRvY3RvckBubDJrLmFiLmNhIiwiYzRlZSJd
Received: from ( []) by bd8f2dd0b759 with HTTP id
66c0e545980e6908345ebfa2; Sat, 17 Aug 2024 18:00:37 GMT
Sender: postmaster@messages.nfl.casperfonseca.dk
Date: Sat, 17 Aug 2024 18:00:37 +0000
Mime-Version: 1.0
Subject: Delivery Notification - 7774529433
From: Support
To: doctor@nl2k.ab.ca
Message-Id: <20240817180037.f24d67e63eb2a141@messages.nfl.casperfonseca.dk>
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=ascii
X-Spam_score: 7.8
X-Spam_score_int: 78
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Action Required: Update on Your Package Return Package Return
Update
Content analysis details: (7.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[185.250.239.4 listed in will-spam-for-food.eu.org]
[185.250.239.4 listed in will-spam-for-food.eu.org]
[185.250.239.4 listed in will-spam-for-food.eu.org]
[185.250.239.4 listed in will-spam-for-food.eu.org]
[185.250.239.4 listed in will-spam-for-food.eu.org]
[185.250.239.4 listed in will-spam-for-food.eu.org]
[185.250.239.4 listed in will-spam-for-food.eu.org]
[185.250.239.4 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[185.250.239.4 listed in dnsbl.ahbl.org]
[185.250.239.4 listed in dnsbl.ahbl.org]
[185.250.239.4 listed in dnsbl.ahbl.org]
[185.250.239.4 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[185.250.239.4 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[185.250.239.4 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[185.250.239.4 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[185.250.239.4 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[185.250.239.4 listed in list.dnswl.org]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: tsecure-97.ru]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
Subject: {SPAM?} Delivery Notification - 7774529433
Action Required: Update on Your Package Return
Check Now
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 17 Aug 2024 14:06:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from
id 1sfPg1-00000000CsS-2BI1
for dave@doctor.nl2k.ab.ca;
Sat, 17 Aug 2024 14:05:29 -0600
Resent-From: The Doctor
Resent-Date: Sat, 17 Aug 2024 14:05:29 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from m239-4.eu.mailgun.net ([185.250.239.4]:61239)
by doctor.nl2k.ab.ca with utf8esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98 (FreeBSD))
(envelope-from
id 1sfNlG-00000000Izs-02Ab
for doctor@nl2k.ab.ca;
Sat, 17 Aug 2024 12:02:51 -0600
DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=messages.nfl.casperfonseca.dk; q=dns/txt; s=k1; t=1723917639; x=1723924839;
h=Content-Type: Content-Transfer-Encoding: Message-Id: To: To: From: From: Subject: Subject: Mime-Version: Date: Sender: Sender;
bh=ehtvw6YqVSGjJ44bmYT9doh0wDQxec4V4v6nfKr7VAM=;
b=qrpEumV1DGcqxF+SfCAbCnjV1xlO/H5z3NJpYyLZMsQtN/tOAzqQrnMCb2EsdpAwvs/MWBEICRNWnd3qThmMSU2hSdgaWiMwbTJ3i6Z9IlnDI7SqRNV2czxceqsg44Fd/odWQOWDrVb9gICsNYGvD618NC1ew6J+3U2ojsyskNSgKxFyTDJZdm71xf7Tf3f152oUEJy7zAZkdjdvSUrIAuVyF0Vea55RUBHYsMLKWOeqn1+vBMVVAFvRYel+Uv+7NNWxAlsPNrAQglfbtIPf8KTjBMaQRzO1K/Rv2pNIiEfDE4Nxdegk+8MNWYM5mHqYxBdIVhP5CJcwOgzGc5STRg==
X-Mailgun-Sending-Ip: 185.250.239.4
X-Mailgun-Sid: WyI1NmNhZCIsImRvY3RvckBubDJrLmFiLmNhIiwiYzRlZSJd
Received: from
66c0e545980e6908345ebfa2; Sat, 17 Aug 2024 18:00:37 GMT
Sender: postmaster@messages.nfl.casperfonseca.dk
Date: Sat, 17 Aug 2024 18:00:37 +0000
Mime-Version: 1.0
Subject: Delivery Notification - 7774529433
From: Support
To: doctor@nl2k.ab.ca
Message-Id: <20240817180037.f24d67e63eb2a141@messages.nfl.casperfonseca.dk>
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=ascii
X-Spam_score: 7.8
X-Spam_score_int: 78
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Action Required: Update on Your Package Return Package Return
Update
Content analysis details: (7.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[185.250.239.4 listed in will-spam-for-food.eu.org]
[185.250.239.4 listed in will-spam-for-food.eu.org]
[185.250.239.4 listed in will-spam-for-food.eu.org]
[185.250.239.4 listed in will-spam-for-food.eu.org]
[185.250.239.4 listed in will-spam-for-food.eu.org]
[185.250.239.4 listed in will-spam-for-food.eu.org]
[185.250.239.4 listed in will-spam-for-food.eu.org]
[185.250.239.4 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[185.250.239.4 listed in dnsbl.ahbl.org]
[185.250.239.4 listed in dnsbl.ahbl.org]
[185.250.239.4 listed in dnsbl.ahbl.org]
[185.250.239.4 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[185.250.239.4 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[185.250.239.4 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[185.250.239.4 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[185.250.239.4 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[185.250.239.4 listed in list.dnswl.org]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: tsecure-97.ru]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
Subject: {SPAM?} Delivery Notification - 7774529433
Package Return Update
Dear Customer,
We are reaching out to notify you of a problem with returning your package due to an issue with the address provided.
To ensure a successful return and arrange a new delivery, please complete the form on our website by clicking the button below.
Your swift action to address this issue is greatly appreciated.
Check Now