DHL Phish from digital ocean

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Oct 2022 08:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ooQZQ-0005tv-T5

for dave@doctor.nl2k.ab.ca;

Fri, 28 Oct 2022 08:42:52 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Oct 2022 08:42:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [165.232.148.15] (port=60266 helo=monetizer.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ooPes-000CSK-6g

for sales@nk.ca;

Fri, 28 Oct 2022 07:44:31 -0600

X-priority: 3

Received: by monetizer.com (Postfix, from userid 33)

id EF8E541B44; Fri, 28 Oct 2022 13:40:06 +0000 (UTC)

To: sales@nk.ca

Subject: =?UTF-8?B?REhMIC0gU2hpcG1lbnQgdHJhY2tpbmcgW1hXODQyMzkxNzUwQ0Fd?=

X-PHP-Originating-Script: 0:index.php

Reply-by: newlettre@3rh.fr

From: =?UTF-8?B?RVhQUkVTUw==?=

Reply-To: se@acscom.fr

Message-ID: <43957da982be61ce663ac1fc57104cc1@acscom.fr>

X-Mailer: PHPMailer e1b3a8c9857cf4161954c0b678f82167

List-Unsubscribe: mailto:bounce256-dDjRT4jAdcqQkj3@acscom.fr?subject=list-unsubscribe

X-priority: 2

Content-Type: multipart/alternative;

boundary="1e1b3a8c9857cf4161954c0b678f82167"

Date: Fri, 28 Oct 2022 13:40:06 +0000 (UTC)

X-Spam_score: 7.9

X-Spam_score_int: 79

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Â YOUR PACKAGE IS WAITING FOR DELIVERY Â



Content analysis details: (7.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: wiley.com]

0.0 SPF_HELO_NEUTRAL SPF: HELO does not match SPF record (neutral)

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or

identical to background

0.0 HTML_MESSAGE BODY: HTML included in message

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.0 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required

MIME headers

0.0 NORDNS_LOW_CONTRAST No rDNS + hidden text

Subject: {SPAM?} =?UTF-8?B?REhMIC0gU2hpcG1lbnQgdHJhY2tpbmcgW1hXODQyMzkxNzUwQ0Fd?=



This is a multi-part message in MIME format.



--1e1b3a8c9857cf4161954c0b678f82167

Content-Type: text/plain; charset=UTF-8































































Â



















YOUR PACKAGE IS WAITING FOR

DELIVERY























Â













Â









Â















Dear

Customer,Â







Â







DHLÂ

informs you that your shipment XW842391750CA is

still waiting for your instructions.Â



It

will be delivered as soon as the costs are paid.



Fees

to be paid: 4.26 CAD





















Pay

now

















Sincerely,





DHL















Â















Â



DHL

Express | Help

and support | Privacy

Notice | CONTACT US



2022 © DHL International GmbH. All rights reserved.













Â









Â































opyright @ 2000-2022 by John

Wiley & Sons, Inc., or related companies.

All rights reserved











ite Map

ights &

Permissions

rivacy Policy

erms of Use















--1e1b3a8c9857cf4161954c0b678f82167

Content-Type: text/html; charset=UTF-8










http-equiv="content-type">








style="width: 303.594px; color: rgb(255, 255, 255); font-family: Helvetica,Arial,sans-serif; font-size: 16px; font-style: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; background-color: rgb(255, 255, 255);">


style="margin: 0px; padding: 0px; list-style-type: none; list-style-image: none; list-style-position: outside;">


  • style="background-color: transparent; text-decoration: none; color: rgb(255, 255, 255);">







    style="border-collapse: collapse; font-style: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; color: rgb(34, 34, 34); font-family: Arial,Helvetica,sans-serif; font-size: small; text-align: start; background-color: rgb(255, 255, 255);"

    border="0" cellpadding="0" cellspacing="0"

    width="100%">






    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

    align="center">


    style="border: thin solid rgb(235, 235, 235); background: rgb(255, 255, 255) none repeat scroll 0% 50%; -moz-background-clip: initial; -moz-background-origin: initial; -moz-background-inline-policy: initial; border-collapse: collapse; width: 600px; font-family: Arial,Helvetica,sans-serif; font-size: 12px; text-align: center;"

    align="center" bgcolor="#ffffff" cellpadding="0"

    cellspacing="0" width="600">






    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

    align="left" valign="top">


    border="0" cellpadding="0" cellspacing="0"

    width="100%">






    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">
    src="https://nordichairs.com/dhl.png" alt=""

    class="v1CToWUd"

    style="vertical-align: middle; width: 600px; height: 114px;">



    border="0" cellpadding="0" cellspacing="0"

    width="100%">






    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

    width="28">Â


    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">


    border="0" cellpadding="0" cellspacing="0"

    width="100%">






    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif; font-weight: bold;">


    border="0" cellpadding="0" cellspacing="0"

    width="100%">






    style="margin: 0px; font-family: Arial,Helvetica,sans-serif; color: rgb(214, 4, 17); font-size: 18px; text-transform: uppercase;"

    align="left" valign="top">


    title="Rich Text Editor, MAIN_HEADING"

    id="v1m_-8221325808561420624MAIN_HEADING" style="">
    style="font-size: 14.4px; font-weight: 400;">
    style="font-size: 11.52px; font-weight: 400;">
    style="font-weight: bold;">YOUR PACKAGE IS WAITING FOR

    DELIVERY





    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">
    style="">












    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

    width="26">Â








    border="0" cellpadding="0" cellspacing="0"

    width="100%">






    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

    width="28">Â


    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

    align="left" valign="top">


    border="0" cellpadding="0" cellspacing="0"

    width="100%">






    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">Â








    border="0" cellpadding="0" cellspacing="0"

    width="100%">






    style="margin: 0px; font-family: Arial,Helvetica,sans-serif; font-size: 14px;"

    align="left" valign="top">


    id="v1m_-8221325808561420624GREETING" style="">Dear

    Customer,Â









    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">Â






    style="margin: 0px; font-family: Arial,Helvetica,sans-serif; font-size: 12px;"

    align="left" valign="top">


    id="v1m_-8221325808561420624BODY" style="">
    style="font-weight: bold;">DHLÂ

    informs you that your shipment
    style="font-weight: bold;">XW842391750CA     is

    still waiting for your instructions.Â
    style="font-weight: bold;">
    style="">





    style="font-weight: bolder; color: rgb(0, 0, 0); font-family: Arial,sans-serif; font-size: 16px; font-style: normal; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; background-color: rgb(255, 255, 255);">It

    will be delivered as soon as the costs are paid.



    style="color: rgb(0, 0, 0); font-family: Arial,sans-serif; font-size: 16px; font-style: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; background-color: rgb(255, 255, 255);">


    style="font-weight: bolder; color: rgb(0, 0, 0); font-family: Arial,sans-serif; font-size: 16px; font-style: normal; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; background-color: rgb(255, 255, 255);">
    class="v1auto-style2" style="color: rgb(220, 25, 40);">Fees

    to be paid: 4.26 CAD



















    style="border: 0px none ; margin: auto; padding: 0px; border-collapse: collapse; width: inherit; font-family: Tahoma; font-style: normal; font-variant: normal; font-weight: normal; font-size: 16px; line-height: normal; font-size-adjust: none; font-stretch: normal; background-color: rgb(255, 181, 0);"

    border="0" cellpadding="0" cellspacing="0">


    style="border: 0px none ; margin: auto; padding: 0px; font-family: Tahoma; font-style: normal; font-variant: normal; font-weight: normal; font-size: 16px; line-height: normal; font-size-adjust: none; font-stretch: normal; display: table-row-group;">


    style="border: 0px none ; margin: auto; padding: 0px; background-color: inherit; font-family: Tahoma; font-style: normal; font-variant: normal; font-weight: normal; font-size: 16px; line-height: normal; font-size-adjust: none; font-stretch: normal; display: table-row;">








    style="border: medium none ; margin: auto; padding: 15px 5px; font-family: "Merriweather Sans",Tahoma,Arial,sans-serif; font-style: normal; font-variant: normal; font-weight: normal; font-size: 15px; line-height: 15px; font-size-adjust: none; font-stretch: normal; text-align: center; display: table-cell; width: 182px; letter-spacing: 0px; text-decoration: none;"

    align="center" valign="top">
    href="https://nordichairs.com/m/sup.html?s=zMZods3bd0ASUOQGdALhhHRtDBeFLojkbjJoLMAYMaQGYHnci8tAQl3tXi9IGs3SLMg"

    class="v1fontLink" target="_blank" rel="noreferrer"

    style="border: 0px none ; margin: auto; padding: 0px; color: rgb(54, 54, 54); text-decoration: none; background-color: transparent; font-family: Tahoma; font-style: normal; font-variant: normal; font-weight: normal; font-size: 15px; line-height: 15px; font-size-adjust: none; font-stretch: normal; display: block; letter-spacing: 0px; text-align: center;">Pay

    now






    border="0" cellpadding="0" cellspacing="0"

    width="100%">






    style="margin: 0px; font-family: Arial,Helvetica,sans-serif; font-size: 12px; width: 546px;">
    style="">


    title="Rich Text Editor, SIGNATURE_LINE1"

    id="v1m_-8221325808561420624SIGNATURE_LINE1" style="">Sincerely,







    title="Rich Text Editor, SIGNATURE_LINE2"

    id="v1m_-8221325808561420624SIGNATURE_LINE2"

    style="font-family: Arial,Helvetica,sans-serif; color: rgb(214, 4, 17); background-color: rgb(255, 255, 255);">DHL



    border="0" cellpadding="0" cellspacing="0"

    width="100%">






    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">Â








    border="0" cellpadding="0" cellspacing="0"

    width="100%">






    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

    width="160">
    alt="" class="v1CToWUd"

    style="vertical-align: middle; width: 160px; height: 45px;">


    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">Â


    style="margin: 0px; font-family: Verdana,Geneva,sans-serif; font-size: 10px; text-align: right;"

    align="right">


    title="Rich Text Editor, FOOTER_TEXT"

    id="v1m_-8221325808561420624FOOTER_TEXT" style="">
    href="#"

    style="color: rgb(17, 85, 204); background-color: transparent; text-decoration: underline;">DHL

    Express |
    style="">Â
    style="color: rgb(17, 85, 204); background-color: transparent; text-decoration: underline;">Help

    and support    Â |
    style="">Â
    style="color: rgb(17, 85, 204); background-color: transparent; text-decoration: underline;">Privacy

    Notice    Â |Â
    target="_blank" rel="noreferrer"

    style="color: rgb(17, 85, 204); text-decoration: none; background-color: transparent;">
    style="text-decoration: underline;">CONTACT US




    2022 © DHL International GmbH. All rights reserved.



    border="0" cellpadding="0" cellspacing="0"

    width="100%">






    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">Â










    style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

    width="26">Â




























    • style="width: 595.5px; font-family: "Open Sans",sans-serif; font-size: 13px; font-style: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; background-color: rgb(255, 255, 255);">


    data-cmp-data-layer="{"text-04f72f2e44":{"@type":"wiley/components/content/text","repo:modifyDate":"2022-02-15T14:07:22Z","xdm:text":"

    Copyright @ 2000-2022 by John Wiley & Sons, Inc., or related companies. All rights reserved.

    rn"}}"

    id="text-04f72f2e44" class="cmp-text" style="">


    style="text-decoration: none;">
    style="color: rgb(255, 255, 255);">opyright @ 2000-2022    Â
    style="color: rgb(255, 255, 255);">byÂ
    href="https://www.wiley.com/" style="text-decoration: none;">
    style="color: rgb(255, 255, 255);">John

    Wiley & Sons, Inc.,Â
    style="color: rgb(255, 255, 255);">or related companies.

    All rights reserved








    style="color: rgb(255, 255, 255); font-family: "Open Sans",sans-serif; font-size: 13px; font-style: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; background-color: rgb(255, 255, 255);">


    style="">




    • data-cmp-data-layer="{"list-eae548835e-item-358f941ad5":{"@type":"wiley/components/content/list/item","repo:modifyDate":"2022-02-15T14:07:22Z","dc:title":"Site Map ","xdm:linkURL":"/sitemap"}}"

      style="list-style-type: none; list-style-image: none; list-style-position: outside;">
      style="border-left: medium none; padding-top: 0px; padding-bottom: 0px; padding-left: 0px ! important; line-height: normal;">
      class="cmp-list__item-link" href="https://www.wiley.com/sitemap"

      target="_self"

      style="text-decoration: none; letter-spacing: 0.01em;">
      class="cmp-list__item-text">
      class="cmp-list__item-title">
      style="color: rgb(255, 255, 255);">ite Map



  • data-cmp-data-layer="{"list-eae548835e-item-ef9ab6885f":{"@type":"wiley/components/content/list/item","repo:modifyDate":"2022-02-15T14:07:22Z","dc:title":"Rights & Permissions","xdm:linkURL":"/permissions"}}"

    style="list-style-type: none; list-style-image: none; list-style-position: outside; color: rgb(255, 255, 255);">
    style="line-height: normal;">
    class="cmp-list__item-link"

    href="https://www.wiley.com/permissions" target="_self"

    style="text-decoration: none; letter-spacing: 0.01em;">
    class="cmp-list__item-text">
    class="cmp-list__item-title">
    style="color: rgb(255, 255, 255);">ights &

    Permissions



  • data-cmp-data-layer="{"list-eae548835e-item-ac4d7e1c17":{"@type":"wiley/components/content/list/item","repo:modifyDate":"2022-02-15T14:07:22Z","dc:title":"Privacy Policy","xdm:linkURL":"/privacy"}}"

    style="list-style-type: none; list-style-image: none; list-style-position: outside;">
    style="line-height: normal;">
    class="cmp-list__item-link" href="https://www.wiley.com/privacy"

    target="_self"

    style="text-decoration: none; letter-spacing: 0.01em;">
    class="cmp-list__item-text">
    class="cmp-list__item-title">
    style="color: rgb(255, 255, 255);">rivacy Policy



  • data-cmp-data-layer="{"list-eae548835e-item-d118be8c9e":{"@type":"wiley/components/content/list/item","repo:modifyDate":"2022-02-15T14:07:22Z","dc:title":"Terms of Use","xdm:linkURL":"/terms-of-use"}}"

    style="list-style-type: none; list-style-image: none; list-style-position: outside;">
    style="padding-top: 0px; padding-right: 0px ! important; padding-bottom: 0px; line-height: normal;">
    class="cmp-list__item-link"

    href="https://www.wiley.com/terms-of-use" target="_self"

    style="text-decoration: none; letter-spacing: 0.01em;">
    class="cmp-list__item-text">
    class="cmp-list__item-title">
    style="color: rgb(255, 255, 255);">erms of Use




















    • --1e1b3a8c9857cf4161954c0b678f82167--



    Trackbacks

    Trackback specific URI for this entry

    This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

    No Trackbacks

    Comments

    Display comments as Linear | Threaded

    No comments

    Add Comment

    Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
    Standard emoticons like :-) and ;-) are converted to images.

    To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
    CAPTCHA

    Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
    Standard emoticons like :-) and ;-) are converted to images.

    To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
    CAPTCHA