Canada Post Phish from Somee International Seattle
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@nk.ca
Delivery-date: Tue, 06 Dec 2022 21:21:02 -0700
Received: from [208.64.33.163] (port=62412 helo=oskd10)
by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))
(envelope-from)
id 1p2luq-000836-8m
for dave@nk.ca;
Tue, 06 Dec 2022 21:20:19 -0700
Received: from 3lyw4 ([127.0.0.1]) by oskd10 with Microsoft SMTPSVC(8.5.9600.16384);
Tue, 6 Dec 2022 20:18:39 -0800
From: "CANADA POST"
Subject: Your shipment status is pending !
To: dave@nk.ca
Content-Type: multipart/alternative;
boundary="=_NextPart_2rfkindysadvnqw3nerasdf";
charset="US-ASCII"
MIME-Version: 1.0
Reply-To: pending@postescanada.ca
Date: Sat, 30 Dec 1899 00:00:00 -0800
X-Priority: 3
Message-ID:
X-OriginalArrivalTime: 07 Dec 2022 04:18:39.0376 (UTC) FILETIME=[FBB41900:01D909F2]
X-Spam_score: 12.1
X-Spam_score_int: 121
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:
Content analysis details: (12.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[208.64.33.163 listed in bb.barracudacentral.org]
0.0 FSL_HELO_NON_FQDN_1 No description available.
0.4 INVALID_DATE Invalid Date: header (not RFC 2822)
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=pending%40postescanada.ca;ip=208.64.33.163;r=doctor.nl2k.ab.ca]
2.1 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received:
date
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
0.0 HTML_MESSAGE BODY: HTML included in message
0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words
0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
0.0 HELO_NO_DOMAIN Relay reports its domain incorrectly
0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_REMOTE_IMAGE Message contains an external image
Subject: {SPAM?} Your shipment status is pending !
This is a multi-part message in MIME format
--=_NextPart_2rfkindysadvnqw3nerasdf
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
--=_NextPart_2rfkindysadvnqw3nerasdf
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
--=_NextPart_2rfkindysadvnqw3nerasdf--
Envelope-to: dave@nk.ca
Delivery-date: Tue, 06 Dec 2022 21:21:02 -0700
Received: from [208.64.33.163] (port=62412 helo=oskd10)
by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))
(envelope-from
id 1p2luq-000836-8m
for dave@nk.ca;
Tue, 06 Dec 2022 21:20:19 -0700
Received: from 3lyw4 ([127.0.0.1]) by oskd10 with Microsoft SMTPSVC(8.5.9600.16384);
Tue, 6 Dec 2022 20:18:39 -0800
From: "CANADA POST"
Subject: Your shipment status is pending !
To: dave@nk.ca
Content-Type: multipart/alternative;
boundary="=_NextPart_2rfkindysadvnqw3nerasdf";
charset="US-ASCII"
MIME-Version: 1.0
Reply-To: pending@postescanada.ca
Date: Sat, 30 Dec 1899 00:00:00 -0800
X-Priority: 3
Message-ID:
X-OriginalArrivalTime: 07 Dec 2022 04:18:39.0376 (UTC) FILETIME=[FBB41900:01D909F2]
X-Spam_score: 12.1
X-Spam_score_int: 121
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:
Content analysis details: (12.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[208.64.33.163 listed in bb.barracudacentral.org]
0.0 FSL_HELO_NON_FQDN_1 No description available.
0.4 INVALID_DATE Invalid Date: header (not RFC 2822)
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=pending%40postescanada.ca;ip=208.64.33.163;r=doctor.nl2k.ab.ca]
2.1 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received:
date
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
0.0 HTML_MESSAGE BODY: HTML included in message
0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words
0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
0.0 HELO_NO_DOMAIN Relay reports its domain incorrectly
0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_REMOTE_IMAGE Message contains an external image
Subject: {SPAM?} Your shipment status is pending !
This is a multi-part message in MIME format
--=_NextPart_2rfkindysadvnqw3nerasdf
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
--=_NextPart_2rfkindysadvnqw3nerasdf
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
s2/">
hyudkposcapos2/nshyudkposcapos.gif" style=3D"width: 864px; height: 430px=
;" />
--=_NextPart_2rfkindysadvnqw3nerasdf--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments