fedex Phish from Welcomewebsite.com
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 25 Jan 2023 16:26:35 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pKp9D-000GBt-2r
for dave@doctor.nl2k.ab.ca;
Wed, 25 Jan 2023 16:25:43 -0700
Resent-From: The Doctor
Resent-Date: Wed, 25 Jan 2023 16:25:43 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [108.179.236.193] (port=45778 helo=108-179-236-193.unifiedlayer.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from)
id 1pKohu-000Csc-0u
for www@nl2k.ab.ca;
Wed, 25 Jan 2023 15:56:52 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sitvr.host;
s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:
From:Date:Subject:To:Sender:Reply-To:Cc:Content-ID:Content-Description:
Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:
List-Post:List-Owner:List-Archive;
bh=GVCXYUU+Pg06ABnaE3mBkoV+j4xcnjx8zoNeajhb73Q=; b=e9iUZGF+rmJVFc5G1tdchT+IrI
I5nRIhF6w1JVsfgh+/uMxWnzbiiXeu96H3dwxw89b1nzNx41+8pUUjzDZa7u1rSb2SjIIZBNOiOOS
qe/vOsixo1quQlawFW2lRWlrneVK8pJRehr40QpxjdIGZ6xfXKKPVVuw/LfcrKmQWUhiORwsSoWcK
0oiyWZ1NCuBXuxhb2zBfzj1TQsbTTzBdMeVxCzgpoAla4y2sfqRL4Rvi3KzjwekAIq93guFeYrbcE
Xc6FE7/BQeVQfxqGnjreBUAAmSc7F1KmE0t194j/ujwXy4flBgzEbfQrfud7EKsLQjbVynSNpepgW
7aaNe8Ag==;
Received: from sitvr by sit.sitvr.host with local (Exim 4.94.2)
(envelope-from)
id 1pKoen-0006tX-Qq
for www@nl2k.ab.ca; Wed, 25 Jan 2023 22:54:17 +0000
To: www@nl2k.ab.ca
Subject: Action Required: Your package is on hold
X-PHP-Script: sitvr.host/zok.php for 199.167.107.74
X-PHP-Originating-Script: 1001:zok.php
Date: Wed, 25 Jan 2023 22:54:17 +0000
From: =?UTF-8?Q?FedEx=C2=AE_Express?=
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_d8758d8d2b8913a8d26e9bd2e68a8fdc"
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - sit.sitvr.host
X-AntiAbuse: Original Domain - nl2k.ab.ca
X-AntiAbuse: Originator/Caller UID/GID - [1001 994] / [47 12]
X-AntiAbuse: Sender Address Domain - sitvr.host
X-Get-Message-Sender-Via: sit.sitvr.host: authenticated_id: sitvr/from_h
X-Authenticated-Sender: sit.sitvr.host: www@sitvr.host
X-Source:
X-Source-Args: php-fpm: pool sitvr_host
X-Source-Dir: sitvr.host:/public_html
X-Spam_score: 8.5
X-Spam_score_int: 85
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Valued Customer, We hope this email finds you well. We
wanted to inform you that your pending shipment with tracking number 77298O724289
has outstanding charges due including Duty & Tax. Please note that this fee
is for delivery only and does not include any additional services such as
insurance or signature confirmation.
Content analysis details: (8.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: abre.ai]
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname
(Split IP)
0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.5 PHP_SCRIPT Sent by PHP script
Subject: {SPAM?} Action Required: Your package is on hold
This is a multi-part message in MIME format.
--b1_d8758d8d2b8913a8d26e9bd2e68a8fdc
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Dear Valued Customer,
We hope this email finds you well. We wanted to inform you that your pending shipment with tracking number 77298O724289 has outstanding charges due including Duty & Tax.
Please note that this fee is for delivery only and does not include any additional services such as insurance or signature confirmation.
To pay, view the calculation and download the relevant documents:
TRACK PACKAGE
Â
We apologize for any inconvenience this may cause and appreciate your understanding.
Â
Best regards,
Customer Service Team
--b1_d8758d8d2b8913a8d26e9bd2e68a8fdc
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
--b1_d8758d8d2b8913a8d26e9bd2e68a8fdc--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 25 Jan 2023 16:26:35 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pKp9D-000GBt-2r
for dave@doctor.nl2k.ab.ca;
Wed, 25 Jan 2023 16:25:43 -0700
Resent-From: The Doctor
Resent-Date: Wed, 25 Jan 2023 16:25:43 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [108.179.236.193] (port=45778 helo=108-179-236-193.unifiedlayer.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from
id 1pKohu-000Csc-0u
for www@nl2k.ab.ca;
Wed, 25 Jan 2023 15:56:52 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sitvr.host;
s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:
From:Date:Subject:To:Sender:Reply-To:Cc:Content-ID:Content-Description:
Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:
List-Post:List-Owner:List-Archive;
bh=GVCXYUU+Pg06ABnaE3mBkoV+j4xcnjx8zoNeajhb73Q=; b=e9iUZGF+rmJVFc5G1tdchT+IrI
I5nRIhF6w1JVsfgh+/uMxWnzbiiXeu96H3dwxw89b1nzNx41+8pUUjzDZa7u1rSb2SjIIZBNOiOOS
qe/vOsixo1quQlawFW2lRWlrneVK8pJRehr40QpxjdIGZ6xfXKKPVVuw/LfcrKmQWUhiORwsSoWcK
0oiyWZ1NCuBXuxhb2zBfzj1TQsbTTzBdMeVxCzgpoAla4y2sfqRL4Rvi3KzjwekAIq93guFeYrbcE
Xc6FE7/BQeVQfxqGnjreBUAAmSc7F1KmE0t194j/ujwXy4flBgzEbfQrfud7EKsLQjbVynSNpepgW
7aaNe8Ag==;
Received: from sitvr by sit.sitvr.host with local (Exim 4.94.2)
(envelope-from
id 1pKoen-0006tX-Qq
for www@nl2k.ab.ca; Wed, 25 Jan 2023 22:54:17 +0000
To: www@nl2k.ab.ca
Subject: Action Required: Your package is on hold
X-PHP-Script: sitvr.host/zok.php for 199.167.107.74
X-PHP-Originating-Script: 1001:zok.php
Date: Wed, 25 Jan 2023 22:54:17 +0000
From: =?UTF-8?Q?FedEx=C2=AE_Express?=
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_d8758d8d2b8913a8d26e9bd2e68a8fdc"
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - sit.sitvr.host
X-AntiAbuse: Original Domain - nl2k.ab.ca
X-AntiAbuse: Originator/Caller UID/GID - [1001 994] / [47 12]
X-AntiAbuse: Sender Address Domain - sitvr.host
X-Get-Message-Sender-Via: sit.sitvr.host: authenticated_id: sitvr/from_h
X-Authenticated-Sender: sit.sitvr.host: www@sitvr.host
X-Source:
X-Source-Args: php-fpm: pool sitvr_host
X-Source-Dir: sitvr.host:/public_html
X-Spam_score: 8.5
X-Spam_score_int: 85
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Valued Customer, We hope this email finds you well. We
wanted to inform you that your pending shipment with tracking number 77298O724289
has outstanding charges due including Duty & Tax. Please note that this fee
is for delivery only and does not include any additional services such as
insurance or signature confirmation.
Content analysis details: (8.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: abre.ai]
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname
(Split IP)
0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.5 PHP_SCRIPT Sent by PHP script
Subject: {SPAM?} Action Required: Your package is on hold
This is a multi-part message in MIME format.
--b1_d8758d8d2b8913a8d26e9bd2e68a8fdc
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Dear Valued Customer,
We hope this email finds you well. We wanted to inform you that your pending shipment with tracking number 77298O724289 has outstanding charges due including Duty & Tax.
Please note that this fee is for delivery only and does not include any additional services such as insurance or signature confirmation.
To pay, view the calculation and download the relevant documents:
TRACK PACKAGE
Â
We apologize for any inconvenience this may cause and appreciate your understanding.
Â
Best regards,
Customer Service Team
--b1_d8758d8d2b8913a8d26e9bd2e68a8fdc
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
Dear Valued Customer,
We hope this email finds you well. We wanted to inform you that your pending shipment with tracking number 77298O724289 has outstanding charges due including Duty & Tax.
Please note that this fee is for delivery only and does not include any additional services such as insurance or signature confirmation.
To pay, view the calculation and download the relevant documents:
| TRACK PACKAGE |
Â
We apologize for any inconvenience this may cause and appreciate your understanding.
Â
Best regards,
Customer Service Team
--b1_d8758d8d2b8913a8d26e9bd2e68a8fdc--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments