Phish | Entries from August 2024

Canada post phish from Italy

Posted by Dave Yadallee on Friday, August 30. 2024

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 30 Aug 2024 00:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjvUx-00000000Bz6-0m6j

for dave@doctor.nl2k.ab.ca;

Fri, 30 Aug 2024 00:52:43 -0600

Resent-From: The Doctor

Resent-Date: Fri, 30 Aug 2024 00:52:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [156.54.212.124] (port=43957 helo=server-1513638-1.servercloud.wicity.it)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjsj7-00000000MF2-2ItH

for root@nk.ca;

Thu, 29 Aug 2024 21:55:16 -0600

Received: by server-1513638-1.servercloud.wicity.it (Postfix, from userid 10002)

id 4524CE53CD; Fri, 30 Aug 2024 05:53:07 +0200 (CEST)

To: root@nk.ca

Subject: Awaiting Instructions

Date: Fri, 30 Aug 2024 03:53:07 +0000

From: CA POST

Message-ID:

X-Priority: 3

X-Mailer: PHPMailer 5.2.8Securite The World with Root

Reply-To: CA POST

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_be1f4361f53a451d9136c8092a40b9b8"

X-Spam_score: 13.5

X-Spam_score_int: 135

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Reroute Reminder Please click on Show Images to see the content

of the message.

Content analysis details: (13.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

[156.54.212.124 listed in dnsbl.ahbl.org]

[156.54.212.124 listed in dnsbl.ahbl.org]

[156.54.212.124 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[156.54.212.124 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[156.54.212.124 listed in bl.score.senderscore.com]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: colegiomariazambrano.com/82.223.83.229]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: colegiomariazambrano.com/82.223.83.229]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} Awaiting Instructions

--b1_be1f4361f53a451d9136c8092a40b9b8

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: base64

UmVyb3V0ZSBSZW1pbmRlcg==

--b1_be1f4361f53a451d9136c8092a40b9b8

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: base64

PHAgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPiBQbGVhc2UgY2xpY2sgb24gPHNwYW4NCiAg

ICBzdHlsZT0iY29sb3I6IzAwMDBmZjsiPlNob3cgSW1hZ2VzIDwvc3Bhbj4gdG8gc2VlIHRoZSBj

b250ZW50IG9mDQogIHRoZSBtZXNzYWdlLjwvcD4NCjxwIHN0eWxlPSJ0ZXh0LWFsaWduOiBjZW50

ZXI7Ij4gPGENCiAgICBocmVmPSJodHRwczovL3JiZjYyMDc2cXkub25yb2NrZXQuc2l0ZS9jYW5h

ZGEvaG9tZS8iPjxpbWcgYWx0PSIiDQogICAgICBpZD0iaW1nMjMiIHNyYz0iaHR0cHM6Ly9jb2xl

Z2lvbWFyaWF6YW1icmFuby5jb20vcmVhZG1lLnBuZyINCiAgICAgIHdpZHRoPSI3MzYiIGhlaWdo

dD0iNzg5Ij48L2E+PC9wPg0KPHA+PC9wPg0KPHRhYmxlDQpzdHlsZT0iZm9udC1zaXplOiAxMi4w

cHg7Zm9udC1mYW1pbHk6IFJvYm90byAsIEFyaWFsO3dpZHRoOg0KICA2MDAuMHB4O2ZvbnQtd2Vp

Z2h0OiA0MDA7Y29sb3I6IHJnYig3OSw3OSw3OSk7Ym9yZGVyLXNwYWNpbmc6DQogIDAuMHB4O2xp

bmUtaGVpZ2h0OiAxNS4wcHg7YmFja2dyb3VuZC1jb2xvcjogcmdiKDIzOSwyMzksMjM5KTsiDQog

IHdpZHRoPSI2MDAiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMCIgYm9yZGVyPSIwIj4N

CiAgPHRib2R5Pg0KICAgIDx0cj4NCiAgICAgIDx0ZCBjb2xzcGFuPSIzIiBzdHlsZT0iaGVpZ2h0

OiA1LjBweDsiPjxicj4NCiAgICAgIDwvdGQ+DQogICAgPC90cj4NCiAgICA8dHIgd2lkdGg9IjYw

MCI+DQogICAgPC90cj4NCiAgPC90Ym9keT4NCjwvdGFibGU+DQo=

--b1_be1f4361f53a451d9136c8092a40b9b8--

Canada post phish from Italy

Posted by Dave Yadallee on Friday, August 30. 2024

Return-path:

Envelope-to: dve@doctor.nl2k.ab.ca

Delivery-date: Fri, 30 Aug 2024 00:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjvV1-00000000BzE-0DCe

for dve@doctor.nl2k.ab.ca;

Fri, 30 Aug 2024 00:52:47 -0600

Resent-From: The Doctor

Resent-Date: Fri, 30 Aug 2024 00:52:47 -0600

Resent-Message-ID:

Resent-To: dve@doctor.nl2k.ab.ca

Received: from [156.54.212.124] (port=44232 helo=server-1513638-1.servercloud.wicity.it)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjsj7-00000000MF3-2IqX

for sales@nk.ca;

Thu, 29 Aug 2024 21:55:16 -0600

Received: by server-1513638-1.servercloud.wicity.it (Postfix, from userid 10002)

id 2F303E53D6; Fri, 30 Aug 2024 05:53:07 +0200 (CEST)

To: sales@nk.ca

Subject: Awaiting Instructions

Date: Fri, 30 Aug 2024 03:53:07 +0000

From: CA POST

Message-ID:

X-Priority: 3

X-Mailer: PHPMailer 5.2.8Securite The World with Root

Reply-To: CA POST

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_bdf6e38af58ec571b60a74ceb2d11a43"

X-Spam_score: 13.5

X-Spam_score_int: 135

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Reroute Reminder Please click on Show Images to see the content

of the message.

Content analysis details: (13.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

[156.54.212.124 listed in dnsbl.ahbl.org]

[156.54.212.124 listed in dnsbl.ahbl.org]

[156.54.212.124 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: colegiomariazambrano.com/82.223.83.229]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: colegiomariazambrano.com/82.223.83.229]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[156.54.212.124 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[156.54.212.124 listed in bl.score.senderscore.com]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

Subject: {SPAM?} Awaiting Instructions

--b1_bdf6e38af58ec571b60a74ceb2d11a43

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: base64

UmVyb3V0ZSBSZW1pbmRlcg==

--b1_bdf6e38af58ec571b60a74ceb2d11a43

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: base64

PHAgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPiBQbGVhc2UgY2xpY2sgb24gPHNwYW4NCiAg

ICBzdHlsZT0iY29sb3I6IzAwMDBmZjsiPlNob3cgSW1hZ2VzIDwvc3Bhbj4gdG8gc2VlIHRoZSBj

b250ZW50IG9mDQogIHRoZSBtZXNzYWdlLjwvcD4NCjxwIHN0eWxlPSJ0ZXh0LWFsaWduOiBjZW50

ZXI7Ij4gPGENCiAgICBocmVmPSJodHRwczovL3JiZjYyMDc2cXkub25yb2NrZXQuc2l0ZS9jYW5h

ZGEvaG9tZS8iPjxpbWcgYWx0PSIiDQogICAgICBpZD0iaW1nMjMiIHNyYz0iaHR0cHM6Ly9jb2xl

Z2lvbWFyaWF6YW1icmFuby5jb20vcmVhZG1lLnBuZyINCiAgICAgIHdpZHRoPSI3MzYiIGhlaWdo

dD0iNzg5Ij48L2E+PC9wPg0KPHA+PC9wPg0KPHRhYmxlDQpzdHlsZT0iZm9udC1zaXplOiAxMi4w

cHg7Zm9udC1mYW1pbHk6IFJvYm90byAsIEFyaWFsO3dpZHRoOg0KICA2MDAuMHB4O2ZvbnQtd2Vp

Z2h0OiA0MDA7Y29sb3I6IHJnYig3OSw3OSw3OSk7Ym9yZGVyLXNwYWNpbmc6DQogIDAuMHB4O2xp

bmUtaGVpZ2h0OiAxNS4wcHg7YmFja2dyb3VuZC1jb2xvcjogcmdiKDIzOSwyMzksMjM5KTsiDQog

IHdpZHRoPSI2MDAiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMCIgYm9yZGVyPSIwIj4N

CiAgPHRib2R5Pg0KICAgIDx0cj4NCiAgICAgIDx0ZCBjb2xzcGFuPSIzIiBzdHlsZT0iaGVpZ2h0

OiA1LjBweDsiPjxicj4NCiAgICAgIDwvdGQ+DQogICAgPC90cj4NCiAgICA8dHIgd2lkdGg9IjYw

MCI+DQogICAgPC90cj4NCiAgPC90Ym9keT4NCjwvdGFibGU+DQo=

--b1_bdf6e38af58ec571b60a74ceb2d11a43--

e-mail credential phish from sendgrid

Posted by Dave Yadallee on Thursday, August 29. 2024

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 29 Aug 2024 05:30:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjdLK-000000003Zw-0CIc

for dave@doctor.nl2k.ab.ca;

Thu, 29 Aug 2024 05:29:34 -0600

Resent-From: The Doctor

Resent-Date: Thu, 29 Aug 2024 05:29:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wfbthrdf.outbound-mail.sendgrid.net ([159.183.5.223]:34750)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjYoj-0000000031y-2gKf

for sales@nk.ca;

Thu, 29 Aug 2024 00:39:44 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vietiso.com;

h=content-type:from:subject:content-transfer-encoding:mime-version:to:

cc:content-type:from:subject:to;

s=s1; bh=zWmq3nrhJIxaYyZsylX+kNUZMW47yt6uh83gA1qhGeY=;

b=E41eK8Qal6cjCEWOoB6rZ40kvDvtBtOwROZpTyjIkiJBB/0A42hNpPJCvmA4IFCs306w

L76inLnXacn30SgvaMgX3qcEzl2tgUER7A+32OJ3wiZQtYgOJOT6EF1MVZ8nRqwtYUxwrc

nC0YHqfm8oeW4wV7tWzLRUROwWnOBzsLI+yqPMvyBTVs9ZHx68lN1qZLoMAiZFoOEbYGFo

pYD/qcYZGqISopvcsba7xCwtmPEIAR+7tuZpzHb63NkdY7g1bQ7z3d04inSxAdkYzGdofF

JEZlS0TLeNRdIX0EuVdoYUTOClp7hRSe58JKB389B24LirVQpA1AQz8i1JXQSuAA==

Received: by recvd-75c48596c-mbnzv with SMTP id recvd-75c48596c-mbnzv-1-66D01733-7

2024-08-29 06:37:39.157678813 +0000 UTC m=+634262.434399884

Received: from [127.0.0.1] (unknown)

by geopod-ismtpd-7 (SG) with ESMTP

id xpI00CmtQKqtiGFX-3GsOw

for ;

Thu, 29 Aug 2024 06:37:39.024 +0000 (UTC)

Content-Type: text/html; charset=utf-8

From: Mail protection

Subject: Your Mail Requires Verification

Message-ID: <248b9531-f95a-af95-ced5-ce4d360657a2@vietiso.com>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 29 Aug 2024 06:37:39 +0000 (UTC)

MIME-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2E2GVbraVlsAwCqOHZik485QSvfzI5x=2FF1M8W=2Fxsvl1XDl+msQBjGFY31zp?=

=?us-ascii?Q?yaM5W3tv7x5BThY8wGhfOJ4JZJ2U5XjOLgpYNQX?=

=?us-ascii?Q?pr9EK+ol171=2Fovf6yX9OsStmCbOuFWhB7HjLOd4?=

=?us-ascii?Q?l4iXF9OXzQX=2Fa9V07ysAFznnNwrlOJqsoVLeeXD?=

=?us-ascii?Q?NFLr9IpDfwW4nweM1FjYv1UhMZ9bQ8=2FlYHG4fuE?=

=?us-ascii?Q?ZzP0XqgImNrIWZrNe5k8=2FU=3D?=

To: sales@nk.ca

X-Entity-ID: u001.ZfyNQ1Wf18YPkiNJew7C3A==

X-Spam_score: 30.3

X-Spam_score_int: 303

X-Spam_bar: ++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: ï»¿ MAIL PROTECTION ï»¿ï»¿NOTICE â¦¿ï»¿ï»¿ï»¿ï»¿ ï»¿ï»¿ï»¿ï»¿

sales@nk.ca

Content analysis details: (30.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.5.223 listed in dnsbl.ahbl.org]

[159.183.5.223 listed in dnsbl.ahbl.org]

[159.183.5.223 listed in dnsbl.ahbl.org]

[159.183.5.223 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.5.223 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.5.223 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.5.223 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.5.223 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_BOTNETCC Contains a botned C&C URL listed in the DBL

blocklist

[URI: us.kg]

2.5 URIBL_DBL_MALWARE Contains a malware URL listed in the DBL blocklist

[URI: us.kg]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: us.kg]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

0.0 HTML_FONT_SIZE_LARGE BODY: HTML font size is large

0.0 HTML_OBFUSCATE_05_10 BODY: Message is 5% to 10% HTML obfuscation

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} Your Mail Requires Verification

=EF=BB=BF

tyle=3D"font-family:"helvetica neue",helvetica,arial,sans-serif;m=

argin:0px;padding:0px">MAIL PROTECTION =EF=BB=BF=EF=BB=BFNOTICE=

ca neue",helvetica,arial,sans-serif">

, serif" style=3D"margin:0px;padding:0px">N=D0=BE=EF=BB=BF=EF=BB=BF=EF=BB=

=BF=EF=BB=BFt=D0=B5=EF=BB=BF=EF=BB=BF=EF=BB=BF=EF=BB=BF:
in:0px;padding:0px;border:0px;outline:0px;font-weight:inherit">
>If the server does not receive your response within 24hrs you may have log=

in issues.

Th=D0=B0=EF=BB=BF=EF=BB=BF=EF=BB=BF=EF=BB=BFnk you,

padding:0px" />

2024 Supported

ca neue",helvetica,arial,sans-serif;color:rgb(29,34,40);line-height:20=

px">

6ntPcBOrJL5L76VjmE1VjULvKj1KQZ1y00KADp3ayVJM52cpqKQ0-2BHk4ViIeb5p3tQDfBcHOe=

CIqf8aV3jLP8Ie1cfVaKD6Sy34rYS9kzCKmuw6QEagNgHXl6Mu5qRdOQ0dl1TUjax9Hl-2F284r=

HjqLBZIoQYqhrUvamP9sspoq7KHK4OhySFRmswTVPiDK9eVlxDg-3D-3D" alt=3D"" width=

=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px !=

important;border-width:0 !important;margin-top:0 !important;margin-bottom:0=

!important;margin-right:0 !important;margin-left:0 !important;padding-top:=

0 !important;padding-bottom:0 !important;padding-right:0 !important;padding=

-left:0 !important;"/>

DHL Phish

Posted by Dave Yadallee on Wednesday, August 28. 2024

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 28 Aug 2024 10:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjLzF-00000000MIa-044a

for dave@doctor.nl2k.ab.ca;

Wed, 28 Aug 2024 10:57:37 -0600

Resent-From: The Doctor

Resent-Date: Wed, 28 Aug 2024 10:57:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip-173-236-216-248.dreamhost.com ([173.236.216.248]:59868 helo=vps59896.dreamhostps.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjJFy-000000002Cu-00Pt

for root@nl2k.ab.ca;

Wed, 28 Aug 2024 08:02:47 -0600

Received: by vps59896.dreamhostps.com (Postfix, from userid 6633714)

id 4Wv5cQ5TbWz1bQX; Wed, 28 Aug 2024 13:59:02 +0000 (UTC)

Date: Wed, 28 Aug 2024 06:58:46 -0700

To: root@nl2k.ab.ca

From: "DHL(Express Mail Service)"

Subject: DHL-On-Demand Delivery: Collect Your Parcel at Your Convenience!

Message-ID: <0c1c5f97c7ef8c6bbbc87fec83b7ba45@24hservice.vip>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1a0677805e680a59324d3e50c7c1ea1df"

Content-Transfer-Encoding: 8bit

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: FranÃ§ais | English Would you like to collect your shipment

from a collection point?

Content analysis details: (9.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[173.236.216.248 listed in will-spam-for-food.eu.org]

[173.236.216.248 listed in will-spam-for-food.eu.org]

[173.236.216.248 listed in will-spam-for-food.eu.org]

[173.236.216.248 listed in will-spam-for-food.eu.org]

[173.236.216.248 listed in will-spam-for-food.eu.org]

[173.236.216.248 listed in will-spam-for-food.eu.org]

[173.236.216.248 listed in will-spam-for-food.eu.org]

[173.236.216.248 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[173.236.216.248 listed in dnsbl.ahbl.org]

[173.236.216.248 listed in dnsbl.ahbl.org]

[173.236.216.248 listed in dnsbl.ahbl.org]

[173.236.216.248 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[173.236.216.248 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[173.236.216.248 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[173.236.216.248 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[173.236.216.248 listed in dnsbl.ahbl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.5 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: costs.click (click)]

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

Subject: {SPAM?} DHL-On-Demand Delivery: Collect Your Parcel at Your Convenience!

This is a multi-part message in MIME format.

--1a0677805e680a59324d3e50c7c1ea1df

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

FranÃ§ais |Â English

Â

Would you like to collect your shipment from a collection point?

Â

Â

Â

Â

Good morning ,

Â

Would you like to collect your DHL Express parcel with document number 2450478656 from one of our nearby collection points? The delivery date will be updated after payment of shipping costs.Click hereÂ Â to complete your request.

Â

--1a0677805e680a59324d3e50c7c1ea1df

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: =

none; FONT-WEIGHT: 400; COLOR: rgb(29,34,40); OUTLINE-WIDTH: medium !import=

ant; FONT-STYLE: normal; TEXT-ALIGN: left; OUTLINE-STYLE: none !important; =

ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; OUTLINE-COLOR: invert !impor=

tant; BACKGROUND-COLOR: rgb(255,255,255); font-variant-ligatures: normal; f=

ont-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-t=

hickness: initial; text-decoration-style: initial; text-decoration-color: i=

nitial' cellSpacing=3D3 cellPadding=3D3 width=3D600 align=3Dcenter border=

=3D0>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

-serif; WORD-BREAK: normal; OUTLINE-WIDTH: medium !important; OUTLINE-STYLE=

: none !important; OUTLINE-COLOR: invert !important">Fran=C3=A7ais |=

=C2=A0
: rgb(25,106,212); OUTLINE-WIDTH: medium !important; OUTLINE-STYLE: none !i=

mportant; OUTLINE-COLOR: invert !important" href=3D"https://fr.mail.yahoo.c=

om/d/folders/1/messages/AIeF-K9XPs3RZbuNpQy16AFk6s0#English" rel=3D"nofollo=

w noopener noreferrer">English

102443French style=3D'FONT-SIZE: 13px; FONT-FAMILY: "Helvetica Neue", Helve=

tica, Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANS=

FORM: none; FONT-WEIGHT: 400; COLOR: rgb(29,34,40); OUTLINE-WIDTH: medium !=

important; FONT-STYLE: normal; TEXT-ALIGN: left; OUTLINE-STYLE: none !impor=

tant; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; OUTLINE-COLOR: invert =

!important; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-vari=

ant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width=

: 0px; text-decoration-thickness: initial; text-decoration-style: initial; =

text-decoration-color: initial' name=3DFrench rel=3D"nofollow noopener nore=

ferrer">

Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: =

none; FONT-WEIGHT: 400; COLOR: rgb(29,34,40); OUTLINE-WIDTH: medium !import=

ant; FONT-STYLE: normal; TEXT-ALIGN: left; OUTLINE-STYLE: none !important; =

ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; OUTLINE-COLOR: invert !impor=

tant; BACKGROUND-COLOR: rgb(255,255,255); font-variant-ligatures: normal; f=

ont-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-t=

hickness: initial; text-decoration-style: initial; text-decoration-color: i=

nitial' cellSpacing=3D0 cellPadding=3D0 width=3D"100%" border=3D0>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

TABLE>

STYLE: none !important; OUTLINE-COLOR: invert !important" align=3Dcenter>

rgb(235,235,235) thin solid; FONT-FAMILY: Arial, Helvetica, sans-serif; BO=

RDER-RIGHT: rgb(235,235,235) thin solid; WIDTH: 600px; BACKGROUND: rgb(255,=

255,255); BORDER-BOTTOM: rgb(235,235,235) thin solid; OUTLINE-WIDTH: medium=

!important; TEXT-ALIGN: center; OUTLINE-STYLE: none !important; BORDER-LEF=

T: rgb(235,235,235) thin solid; OUTLINE-COLOR: invert !important" cellSpaci=

ng=3D0 cellPadding=3D0 width=3D600 align=3Dcenter bgColor=3D#ffffff>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

STYLE: none !important; OUTLINE-COLOR: invert !important" vAlign=3Dtop alig=

n=3Dleft>

rtant; OUTLINE-COLOR: invert !important" cellSpacing=3D0 cellPadding=3D0 wi=

dth=3D"100%" border=3D0>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

STYLE: none !important; OUTLINE-COLOR: invert !important">
LINE-WIDTH: medium !important; OUTLINE-STYLE: none !important; OUTLINE-COLO=

R: invert !important; TEXT-INDENT: -9999px" alt=3D"On Demand Delivery" src=

=3D"https://ecp.yusercontent.com/mail?url=3Dhttps%3A%2F%2Fdel.dhl.com%2Fimg=

%2Femail_assets%2Fimages%2Fheader.jpg&t=3D1707140204&ymreqid=3De79ddc41-3ab=

2-a7f3-1c6d-38001701f500&sig=3DF1OJj9CBNaf.r.YCJmXQ5w--~D" width=3D600 heig=

ht=3D114>

rtant; OUTLINE-COLOR: invert !important" cellSpacing=3D0 cellPadding=3D0 wi=

dth=3D"100%" border=3D0>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

STYLE: none !important; OUTLINE-COLOR: invert !important" width=3D28>=C2=

=A0

STYLE: none !important; OUTLINE-COLOR: invert !important">

rtant; OUTLINE-COLOR: invert !important" cellSpacing=3D0 cellPadding=3D0 wi=

dth=3D"100%" border=3D0>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

XT-TRANSFORM: uppercase; WORD-BREAK: normal; FONT-WEIGHT: bold; COLOR: rgb(=

214,4,17); OUTLINE-WIDTH: medium !important; OUTLINE-STYLE: none !important=

; MARGIN: 0px; OUTLINE-COLOR: invert !important" vAlign=3Dtop align=3Dleft>

" class=3D"yiv7502102443cke_editable yiv7502102443cke_editable_inline yiv75=

02102443cke_contents_ltr yiv7502102443cke_show_borders" style=3D"POSITION: =

relative; OUTLINE-WIDTH: medium !important; OUTLINE-STYLE: none !important;=

OUTLINE-COLOR: invert !important">Would you like to collect your shipment =

from a collection point?

STYLE: none !important; OUTLINE-COLOR: invert !important" width=3D12>=C2=

=A0

STYLE: none !important; OUTLINE-COLOR: invert !important">

rtant; OUTLINE-COLOR: invert !important" align=3Dright>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

ium !important; PADDING-BOTTOM: 10px; PADDING-TOP: 10px; OUTLINE-STYLE: non=

e !important; PADDING-LEFT: 10px; OUTLINE-COLOR: invert !important; PADDING=

-RIGHT: 10px" width=3D"100%" align=3Dcenter>
view style=3D"OUTLINE-WIDTH: medium !important; OUTLINE-STYLE: none !import=

ant; OUTLINE-COLOR: invert !important; TEXT-INDENT: -9999px" name=3DimagePr=

eview alt=3Dlogo src=3D"https://ecp.yusercontent.com/mail?url=3Dhttps%3A%2F=

%2Fdel.dhl.com%2Fimg%2Femail_assets%2Flogo%2Fonepixel.png&t=3D1707140204&ym=

reqid=3De79ddc41-3ab2-a7f3-1c6d-38001701f500&sig=3DrjZUckobxkYQ9lzzXYTx8Q--=

~D">

STYLE: none !important; OUTLINE-COLOR: invert !important" width=3D26>=C2=

=A0

rtant; OUTLINE-COLOR: invert !important" cellSpacing=3D0 cellPadding=3D0 wi=

dth=3D"100%" border=3D0>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

STYLE: none !important; OUTLINE-COLOR: invert !important" width=3D28>=C2=

=A0

STYLE: none !important; OUTLINE-COLOR: invert !important">

rtant; OUTLINE-COLOR: invert !important" cellSpacing=3D0 cellPadding=3D0 wi=

dth=3D"100%" border=3D0>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

<=

/TR>

nt; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

R>

RD-BREAK: normal; OUTLINE-WIDTH: medium !important; OUTLINE-STYLE: none !im=

portant; OUTLINE-COLOR: invert !important" vAlign=3Dtop align=3Dleft>

STYLE: none !important; OUTLINE-COLOR: invert !important">=C2=A0

RD-BREAK: normal; OUTLINE-WIDTH: medium !important; OUTLINE-STYLE: none !im=

portant; OUTLINE-COLOR: invert !important" vAlign=3Dtop align=3Dleft>

v7502102443cke_editable_inline yiv7502102443cke_contents_ltr yiv7502102443c=

ke_show_borders" style=3D"POSITION: relative; OUTLINE-WIDTH: medium !import=

ant; OUTLINE-STYLE: none !important; OUTLINE-COLOR: invert !important">Woul=

d you like to collect your DHL Express parcel with document number 24504786=

56 from one of our nearby collection points? The delivery date will be upda=

ted after payment of shipping costs.

ortant; OUTLINE-STYLE: none !important; OUTLINE-COLOR: invert !important"><=

BR style=3D"OUTLINE-WIDTH: medium !important; OUTLINE-STYLE: none !importan=

t; OUTLINE-COLOR: invert !important">Click
erline; COLOR: rgb(25,106,212); OUTLINE-WIDTH: medium !important; OUTLINE-S=

TYLE: none !important; OUTLINE-COLOR: invert !important" href=3D"https://ww=

w.prime-b2b.com/app/app" rel=3D"nofollow noopener noreferrer" target=3D_bla=

nk>here=C2=A0=C2=A0to complete your request.

rtant; OUTLINE-COLOR: invert !important" cellSpacing=3D0 cellPadding=3D0 wi=

dth=3D"100%" border=3D0>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

<=

/TBODY>

STYLE: none !important; OUTLINE-COLOR: invert !important">=C2=A0

rtant; OUTLINE-COLOR: invert !important" cellSpacing=3D3 cellPadding=3D0 wi=

dth=3D"100%" border=3D0>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

tica, sans-serif; MARGIN-TOP: 5px; TEXT-TRANSFORM: uppercase; WORD-BREAK: n=

ormal; FONT-WEIGHT: bold; COLOR: rgb(214,4,17); OUTLINE-WIDTH: medium !impo=

rtant; OUTLINE-STYLE: none !important; OUTLINE-COLOR: invert !important">

DING" class=3D"yiv7502102443cke_editable yiv7502102443cke_editable_inline y=

iv7502102443cke_contents_ltr yiv7502102443cke_show_borders" style=3D"POSITI=

ON: relative; WORD-BREAK: normal; OUTLINE-WIDTH: medium !important; OUTLINE=

-STYLE: none !important; OUTLINE-COLOR: invert !important"

=C2=A0=

rtant; OUTLINE-COLOR: invert !important" cellSpacing=3D0 cellPadding=3D0 wi=

dth=3D"100%" border=3D0>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

>

DTH: 546px; WORD-BREAK: normal; OUTLINE-WIDTH: medium !important; OUTLINE-S=

TYLE: none !important; OUTLINE-COLOR: invert !important">
UTLINE-WIDTH: medium !important; OUTLINE-STYLE: none !important; OUTLINE-CO=

LOR: invert !important">

_LINE2" class=3D"yiv7502102443cke_editable yiv7502102443cke_editable_inline=

yiv7502102443cke_contents_ltr yiv7502102443cke_show_borders" style=3D"FONT=

-FAMILY: Arial, Helvetica, sans-serif; POSITION: relative; COLOR: rgb(214,4=

,17); OUTLINE-WIDTH: medium !important; OUTLINE-STYLE: none !important; OUT=

LINE-COLOR: invert !important; BACKGROUND-COLOR: rgb(255,255,255)">DHL Expr=

ess =E2=80=93 Excellence. Simply delivered.

rtant; OUTLINE-COLOR: invert !important" cellSpacing=3D0 cellPadding=3D0 wi=

dth=3D"100%" border=3D0>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

<=

/TBODY>

STYLE: none !important; OUTLINE-COLOR: invert !important">=C2=A0

rtant; OUTLINE-COLOR: invert !important" cellSpacing=3D0 cellPadding=3D0 wi=

dth=3D"100%" border=3D0>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

TBODY>

STYLE: none !important; OUTLINE-COLOR: invert !important" width=3D160>

STYLE: none !important; OUTLINE-COLOR: invert !important">=C2=A0

ana, Geneva, sans-serif; WORD-BREAK: normal; OUTLINE-WIDTH: medium !importa=

nt; TEXT-ALIGN: right; OUTLINE-STYLE: none !important; OUTLINE-COLOR: inver=

t !important" align=3Dright>

class=3D"yiv7502102443cke_editable yiv7502102443cke_editable_inline yiv7502=

102443cke_contents_ltr yiv7502102443cke_show_borders" style=3D"POSITION: re=

lative; OUTLINE-WIDTH: medium !important; OUTLINE-STYLE: none !important; O=

UTLINE-COLOR: invert !important">
LOR: rgb(25,106,212); OUTLINE-WIDTH: medium !important; OUTLINE-STYLE: none=

!important; OUTLINE-COLOR: invert !important" href=3D"http://www.dhl.fr/fr=

/dhl_express.html" rel=3D"nofollow noopener noreferrer" target=3D_blank>DHL=

Express=C2=A0|=C2=A0
ION: underline; COLOR: rgb(25,106,212); OUTLINE-WIDTH: medium !important; O=

UTLINE-STYLE: none !important; OUTLINE-COLOR: invert !important" href=3D"ht=

tp://www.dhl.fr/fr/centre_de_contact/contacter_express.html" rel=3D"nofollo=

w noopener noreferrer" target=3D_blank>Contact DHL=C2=A0|<=

SPAN>=C2=A0
,212); OUTLINE-WIDTH: medium !important; OUTLINE-STYLE: none !important; OU=

TLINE-COLOR: invert !important" href=3D"https://www.logistics.dhl/fr-fr/hom=

e/bas-de-page/avis-de-confidentialite.html" rel=3D"nofollow noopener norefe=

rrer" target=3D_blank>Privacy Notice=C2=A0|=C2=A0
PAN>
-WIDTH: medium !important; OUTLINE-STYLE: none !important; OUTLINE-COLOR: i=

nvert !important" href=3D"https://unsubscribe.dhl.com/FR/unsubscribe_email.=

xhtml?ctry=3DM_j6ZTiIiEtf5wBKsvg1Hg&contact=3D82cG2c0OFqbFocmtg29BaQ0V3zpyK=

4HjRxf2C_USjm0&langcode=3Dfr&locale=3Dfr-FR" rel=3D"nofollow noopener noref=

errer" target=3D_blank>Unsubscribe

ium !important; OUTLINE-STYLE: none !important; OUTLINE-COLOR: invert !impo=

rtant">2024 =C2=A9 DHL International GmbH. All rights reserved.

rtant; OUTLINE-COLOR: invert !important" cellSpacing=3D0 cellPadding=3D0 wi=

dth=3D"100%" border=3D0>

rtant; OUTLINE-COLOR: invert !important">

nt; OUTLINE-COLOR: invert !important">

<=

/TBODY>

STYLE: none !important; OUTLINE-COLOR: invert !important">=C2=A0

STYLE: none !important; OUTLINE-COLOR: invert !important" width=3D26>=C2=

=A0

--1a0677805e680a59324d3e50c7c1ea1df--

DHL Phish

Posted by Dave Yadallee on Wednesday, August 28. 2024

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 28 Aug 2024 10:52:44 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjLsG-00000000LIw-32Pa

for dave@doctor.nl2k.ab.ca;

Wed, 28 Aug 2024 10:50:24 -0600

Resent-From: The Doctor

Resent-Date: Wed, 28 Aug 2024 10:50:24 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip-173-236-216-248.dreamhost.com ([173.236.216.248]:34668 helo=vps59896.dreamhostps.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjIxn-000000001VN-2mCf

for doctor@mail.nl2k.ab.ca;

Wed, 28 Aug 2024 07:44:05 -0600

Received: by vps59896.dreamhostps.com (Postfix, from userid 6633714)

id 4Wv5D22dJDz1QXh; Wed, 28 Aug 2024 13:41:22 +0000 (UTC)

To: doctor@mail.nl2k.ab.ca

Subject: DHL-On-Demand Delivery: Collect Your Parcel at Your Convenience!

X-PHP-Originating-Script: 6633714:v1.php

Date: Wed, 28 Aug 2024 06:41:20 -0700

From: "DHL(Express Mail Service)"

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="15abc699857f111588139eacab16497b7"

Content-Transfer-Encoding: 8bit

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: FranÃ§ais | English Would you like to collect your shipment

from a collection point?

Content analysis details: (9.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[173.236.216.248 listed in will-spam-for-food.eu.org]

[173.236.216.248 listed in will-spam-for-food.eu.org]

[173.236.216.248 listed in will-spam-for-food.eu.org]

[173.236.216.248 listed in will-spam-for-food.eu.org]

[173.236.216.248 listed in will-spam-for-food.eu.org]

[173.236.216.248 listed in will-spam-for-food.eu.org]

[173.236.216.248 listed in will-spam-for-food.eu.org]

[173.236.216.248 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[173.236.216.248 listed in dnsbl.ahbl.org]

[173.236.216.248 listed in dnsbl.ahbl.org]

[173.236.216.248 listed in dnsbl.ahbl.org]

[173.236.216.248 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[173.236.216.248 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[173.236.216.248 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[173.236.216.248 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[173.236.216.248 listed in dnsbl.ahbl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.5 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: costs.click (click)]

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

Subject: {SPAM?} DHL-On-Demand Delivery: Collect Your Parcel at Your Convenience!

This is a multi-part message in MIME format.

--15abc699857f111588139eacab16497b7

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

FranÃ§ais |Â English

Â

Would you like to collect your shipment from a collection point?

Â

Â

Â

Â

Good morning ,

Â

Would you like to collect your DHL Express parcel with document number 2450478656 from one of our nearby collection points? The delivery date will be updated after payment of shipping costs.Click hereÂ Â to complete your request.

Â

--15abc699857f111588139eacab16497b7

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable