Canada Post Phish
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 09 Sep 2022 14:48:37 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from)
id 1oWks7-000G5U-Fx
for dave@doctor.nl2k.ab.ca;
Fri, 09 Sep 2022 14:45:07 -0600
Resent-From: The Doctor
Resent-Date: Fri, 9 Sep 2022 14:45:07 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from round-robin16.sq3n.in ([212.129.0.222]:60300)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from)
id 1oWigD-000Ia1-He
for doctor@netknow.ca;
Fri, 09 Sep 2022 12:24:45 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; s=default; d=sq3n.in;
h=Subject:From:To:Sender:Reply-To:Date:List-Unsubscribe:Message-ID:MIME-Version:Content-Type; i=info@sq3n.in;
bh=ERx7N93Yf41tUZtTQlibyvoLB5xfQehhTQkwyZAVP8M=;
b=v9w329MA0R7SB5I8i1XL4zP4mOCnbk3IdphLJnb24Df9KbEew6W4+fc2x8dZ/jvpzw4FAfjJj3Xu
GWy9sJOXlbFUqy98B5Nsc+FSKX6WNY7croZkCHTddOMqVEpq3zTIl0EE5AspwN0OO1EdSyNTum1e
qa3V1YR9xcCI/kObkJo=
Subject: CONFIRMATION # 234654! doctor@netknow.ca, Delivery of your package has
been stopped.
From: "Canada Post"
To: doctor@netknow.ca
Sender: info@sq3n.in
Reply-To: info@sq3n.in
Date: 09 Sep 2022 17:47:38 -0000
List-Unsubscribe:,
X-CampaignID: s4:40184-baae651ab8457fd9
Message-ID:
X-Mailer-Info: 8.E2M5cjN.QDMxgDN.Q2bjR3byBkblR3au92duMWY.QTN0gjM1kDM.QDMxgzN
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="==c3b599cda5f7a98e93507c6a039fa108"
X-Spam_score: 10.2
X-Spam_score_int: 102
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: CANADAÂ POST _PACKAGE CONFIRMATIONÂ # 234654 _Hello doctor@netknow.ca,
This is the last time we are reminding you about your pending shipping cost.
The pending delivery will be canceled if the amou [...]
Content analysis details: (10.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL
blocklist
[URIs: sq3n.in]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: sq3n.in]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URIs: sq3n.in]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
0.0 HTML_MESSAGE BODY: HTML included in message
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.1 TO_IN_SUBJ To address is in Subject
Subject: {SPAM?} CONFIRMATION # 234654! doctor@netknow.ca, Delivery of your package has
been stopped.
This is a multi-part message in MIME format.
--==c3b599cda5f7a98e93507c6a039fa108
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
CANADA=C2=A0POST
_
_PACKAGE CONFIRMATION=C2=A0# 234654_
_Hello doctor@netknow.ca,
This is the last time we are reminding you about your pending shipping
cost. The pending delivery will be canceled if the amount is not paid
within 48 hours.
Confirm the delivery details and pay the shipping costs in order to
get your package delivered within 72 hours.=C2=A0
Track your parcel
CA-TT-7854258-POST
TRACK YOUR PACKAGE [/%%Offer Link%%]
=C2=A0
Your delivery will be cancelled
if you don=E2=80=99t plan the delivery within 48 hours.
=C2=A0
Unsubscribe=
--==c3b599cda5f7a98e93507c6a039fa108
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
ft-com:office:office" xmlns:v=3D"urn:schemas-microsoft-com:vml">
0" cellpadding=3D"0">
100%">
style=3D"font-size: 36pt;">CANADA
=3D"font-size: 36pt;">POST
t-size: 36pt; background-color: #004a8e;">
pan>
gn=3D"top" width=3D"100%">
adding=3D"0" bgcolor=3D"#ffffff">
llpadding=3D"0">
00" cellspacing=3D"0" cellpadding=3D"0">
ght: 22px; color: #6c6c6c; height: 376px;" align=3D"center" valign=3D"top" =
width=3D"500">
yle=3D"display: block; color: #ffffff; text-decoration: none; text-align: c=
enter; background: #004A8E; border: 5px solid #004A8E; border-radius: 5px; =
margin: 0 auto; padding: 4px;" href=3D"https://sign.sq3n.in/ga/click/2-4548=
2590-3976-20252-40187-21793-9094ed334b-c29929c15d">Track your package
span>
lpadding=3D"0">
ght: 22px; color: #6c6c6c;" align=3D"center" valign=3D"top" width=3D"500">
=3D"https://sign.sq3n.in/ga/unsubscribe/2-45482590-3976-20252-40187-19530bf=
f25ee8cb-c29929c15d">
Unsubscribe
![](3D"https://sign.sq3n.in/ga/open/2-45482590-3976-20252-40187-c29929=<br)
c15d" height=3D"2" width=3D"3" alt=3D"">
=
--==c3b599cda5f7a98e93507c6a039fa108--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 09 Sep 2022 14:48:37 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))
(envelope-from
id 1oWks7-000G5U-Fx
for dave@doctor.nl2k.ab.ca;
Fri, 09 Sep 2022 14:45:07 -0600
Resent-From: The Doctor
Resent-Date: Fri, 9 Sep 2022 14:45:07 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from round-robin16.sq3n.in ([212.129.0.222]:60300)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.95 (FreeBSD))
(envelope-from
id 1oWigD-000Ia1-He
for doctor@netknow.ca;
Fri, 09 Sep 2022 12:24:45 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; s=default; d=sq3n.in;
h=Subject:From:To:Sender:Reply-To:Date:List-Unsubscribe:Message-ID:MIME-Version:Content-Type; i=info@sq3n.in;
bh=ERx7N93Yf41tUZtTQlibyvoLB5xfQehhTQkwyZAVP8M=;
b=v9w329MA0R7SB5I8i1XL4zP4mOCnbk3IdphLJnb24Df9KbEew6W4+fc2x8dZ/jvpzw4FAfjJj3Xu
GWy9sJOXlbFUqy98B5Nsc+FSKX6WNY7croZkCHTddOMqVEpq3zTIl0EE5AspwN0OO1EdSyNTum1e
qa3V1YR9xcCI/kObkJo=
Subject: CONFIRMATION # 234654! doctor@netknow.ca, Delivery of your package has
been stopped.
From: "Canada Post"
To: doctor@netknow.ca
Sender: info@sq3n.in
Reply-To: info@sq3n.in
Date: 09 Sep 2022 17:47:38 -0000
List-Unsubscribe:
X-CampaignID: s4:40184-baae651ab8457fd9
Message-ID:
X-Mailer-Info: 8.E2M5cjN.QDMxgDN.Q2bjR3byBkblR3au92duMWY.QTN0gjM1kDM.QDMxgzN
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="==c3b599cda5f7a98e93507c6a039fa108"
X-Spam_score: 10.2
X-Spam_score_int: 102
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: CANADAÂ POST _PACKAGE CONFIRMATIONÂ # 234654 _Hello doctor@netknow.ca,
This is the last time we are reminding you about your pending shipping cost.
The pending delivery will be canceled if the amou [...]
Content analysis details: (10.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL
blocklist
[URIs: sq3n.in]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: sq3n.in]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URIs: sq3n.in]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
0.0 HTML_MESSAGE BODY: HTML included in message
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.1 TO_IN_SUBJ To address is in Subject
Subject: {SPAM?} CONFIRMATION # 234654! doctor@netknow.ca, Delivery of your package has
been stopped.
This is a multi-part message in MIME format.
--==c3b599cda5f7a98e93507c6a039fa108
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
CANADA=C2=A0POST
_
_PACKAGE CONFIRMATION=C2=A0# 234654_
_Hello doctor@netknow.ca,
This is the last time we are reminding you about your pending shipping
cost. The pending delivery will be canceled if the amount is not paid
within 48 hours.
Confirm the delivery details and pay the shipping costs in order to
get your package delivered within 72 hours.=C2=A0
Track your parcel
CA-TT-7854258-POST
TRACK YOUR PACKAGE [/%%Offer Link%%]
=C2=A0
Your delivery will be cancelled
if you don=E2=80=99t plan the delivery within 48 hours.
=C2=A0
Unsubscribe=
--==c3b599cda5f7a98e93507c6a039fa108
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
ft-com:office:office" xmlns:v=3D"urn:schemas-microsoft-com:vml">
0" cellpadding=3D"0">
100%">
style=3D"font-size: 36pt;">CANADA
=3D"font-size: 36pt;">POST
t-size: 36pt; background-color: #004a8e;">
pan>
gn=3D"top" width=3D"100%">
adding=3D"0" bgcolor=3D"#ffffff">
llpadding=3D"0">
00" cellspacing=3D"0" cellpadding=3D"0">
ght: 22px; color: #6c6c6c; height: 376px;" align=3D"center" valign=3D"top" =
width=3D"500">
g>
>PACKAGE CONFIRMATION # 234654=
strong>Hello d=
octor@netknow.ca,
This is the last time we are reminding you abo=
ut your pending shipping cost. The pending delivery will be canceled if the=
amount is not paid within 48 hours.
Confirm the delivery detail=
s and pay the shipping costs in order to get your package delivered within =
72 hours.
">
Track your parcel
CA-TT-7854258-POST
ng>
yle=3D"display: block; color: #ffffff; text-decoration: none; text-align: c=
enter; background: #004A8E; border: 5px solid #004A8E; border-radius: 5px; =
margin: 0 auto; padding: 4px;" href=3D"https://sign.sq3n.in/ga/click/2-4548=
2590-3976-20252-40187-21793-9094ed334b-c29929c15d">Track your package
span>
lpadding=3D"0">
ght: 22px; color: #6c6c6c;" align=3D"center" valign=3D"top" width=3D"500">
Your delivery will be c=
ancelled
if you don’t plan the delivery within 48 hours.<=
/p>
=3D"https://sign.sq3n.in/ga/unsubscribe/2-45482590-3976-20252-40187-19530bf=
f25ee8cb-c29929c15d">
Unsubscribe
c15d" height=3D"2" width=3D"3" alt=3D"">
=
--==c3b599cda5f7a98e93507c6a039fa108--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments