fedex Phish from Welcomewebsite.com
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 27 Jan 2023 09:40:04 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pLRlN-000MVp-2b
for dave@doctor.nl2k.ab.ca;
Fri, 27 Jan 2023 09:39:41 -0700
Resent-From: The Doctor
Resent-Date: Fri, 27 Jan 2023 09:39:41 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [108.179.236.193] (port=35206 helo=108-179-236-193.unifiedlayer.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from)
id 1pLRLa-000LIi-1a
for www@nl2k.ab.ca;
Fri, 27 Jan 2023 09:12:24 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sitvr.host;
s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:
From:Date:Subject:To:Sender:Reply-To:Cc:Content-ID:Content-Description:
Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:
List-Post:List-Owner:List-Archive;
bh=3uQAZWQ3q9DqhyPtin7IZWXuz2rv9/ojDFUo8EcsVVU=; b=HtCQuPG+Mp283soEDpIKIx87ij
R5froCWN3ycuSdSEQN64kWbtcQFmfJ6wsbyYWgvYasMPwd+hz5j1uau34yMImxL84DdTTUrQTgI5P
+iJDpTvDYyyLVwzWTBW6gikigYAwhOYGrXzxx7VVmxOzFgyCOx7bpmuYMmgUJh9fwOm0MOdkdcPTb
YPa3qZyjUeALNzs2A8PkZXkLU4TG7rU6buLDBUS2P4a8p5lZKq/hoNBc2GTwYbW2GC/LZmymwlo8a
qY5x8fvRm5GYpx0XeJre+6j4HENeMR+GV0JN6a+/Sd7KwHf3ANzoTzmLxUyXEKfyNH49HfBP9xr7b
uuhuvKBg==;
Received: from sitvr by sit.sitvr.host with local (Exim 4.94.2)
(envelope-from)
id 1pLRIy-0006bU-JR
for www@nl2k.ab.ca; Fri, 27 Jan 2023 16:10:20 +0000
To: www@nl2k.ab.ca
Subject: Action Required: Your package is on hold
X-PHP-Script: sitvr.host/zok.php for 199.167.107.74
X-PHP-Originating-Script: 1001:zok.php
Date: Fri, 27 Jan 2023 16:10:20 +0000
From: Info
Message-ID: <994a54e00dbebd731e7c67c5ef09fdee@sitvr.host>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - sit.sitvr.host
X-AntiAbuse: Original Domain - nl2k.ab.ca
X-AntiAbuse: Originator/Caller UID/GID - [1001 994] / [47 12]
X-AntiAbuse: Sender Address Domain - sitvr.host
X-Get-Message-Sender-Via: sit.sitvr.host: authenticated_id: sitvr/from_h
X-Authenticated-Sender: sit.sitvr.host: info@sitvr.host
X-Source:
X-Source-Args: php-fpm: pool sitvr_host
X-Source-Dir: sitvr.host:/public_html
X-Spam_score: 6.9
X-Spam_score_int: 69
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello, Import Duty and/or Tax and Customs Clearance Service
Charges are still outstanding on your FedEx Express shipment with waybill
number 772980724289. ​Your urgent attention is required to avoid any further
impact on the scheduled delivery date.
Content analysis details: (6.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname
(Split IP)
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[108.179.236.193 listed in bb.barracudacentral.org]
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.5 PHP_SCRIPT Sent by PHP script
Subject: {SPAM?} Action Required: Your package is on hold
Hello,
Import Duty and/or Tax and Customs Clearance Service Charges are still outstanding on your FedEx Express shipment with waybill number 772980724289.
​Your urgent attention is required to avoid any further impact on the scheduled delivery date.
To pay, view the calculation and download the relevant documents:
TRACK PACKAGE 》
https://zpr.io/dn8Ty7TkV68F
We apologize for any inconvenience this may cause and appreciate your understanding.
Best regards,
Customer Service
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 27 Jan 2023 09:40:04 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pLRlN-000MVp-2b
for dave@doctor.nl2k.ab.ca;
Fri, 27 Jan 2023 09:39:41 -0700
Resent-From: The Doctor
Resent-Date: Fri, 27 Jan 2023 09:39:41 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [108.179.236.193] (port=35206 helo=108-179-236-193.unifiedlayer.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from
id 1pLRLa-000LIi-1a
for www@nl2k.ab.ca;
Fri, 27 Jan 2023 09:12:24 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sitvr.host;
s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:
From:Date:Subject:To:Sender:Reply-To:Cc:Content-ID:Content-Description:
Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:
List-Post:List-Owner:List-Archive;
bh=3uQAZWQ3q9DqhyPtin7IZWXuz2rv9/ojDFUo8EcsVVU=; b=HtCQuPG+Mp283soEDpIKIx87ij
R5froCWN3ycuSdSEQN64kWbtcQFmfJ6wsbyYWgvYasMPwd+hz5j1uau34yMImxL84DdTTUrQTgI5P
+iJDpTvDYyyLVwzWTBW6gikigYAwhOYGrXzxx7VVmxOzFgyCOx7bpmuYMmgUJh9fwOm0MOdkdcPTb
YPa3qZyjUeALNzs2A8PkZXkLU4TG7rU6buLDBUS2P4a8p5lZKq/hoNBc2GTwYbW2GC/LZmymwlo8a
qY5x8fvRm5GYpx0XeJre+6j4HENeMR+GV0JN6a+/Sd7KwHf3ANzoTzmLxUyXEKfyNH49HfBP9xr7b
uuhuvKBg==;
Received: from sitvr by sit.sitvr.host with local (Exim 4.94.2)
(envelope-from
id 1pLRIy-0006bU-JR
for www@nl2k.ab.ca; Fri, 27 Jan 2023 16:10:20 +0000
To: www@nl2k.ab.ca
Subject: Action Required: Your package is on hold
X-PHP-Script: sitvr.host/zok.php for 199.167.107.74
X-PHP-Originating-Script: 1001:zok.php
Date: Fri, 27 Jan 2023 16:10:20 +0000
From: Info
Message-ID: <994a54e00dbebd731e7c67c5ef09fdee@sitvr.host>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - sit.sitvr.host
X-AntiAbuse: Original Domain - nl2k.ab.ca
X-AntiAbuse: Originator/Caller UID/GID - [1001 994] / [47 12]
X-AntiAbuse: Sender Address Domain - sitvr.host
X-Get-Message-Sender-Via: sit.sitvr.host: authenticated_id: sitvr/from_h
X-Authenticated-Sender: sit.sitvr.host: info@sitvr.host
X-Source:
X-Source-Args: php-fpm: pool sitvr_host
X-Source-Dir: sitvr.host:/public_html
X-Spam_score: 6.9
X-Spam_score_int: 69
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello, Import Duty and/or Tax and Customs Clearance Service
Charges are still outstanding on your FedEx Express shipment with waybill
number 772980724289. ​Your urgent attention is required to avoid any further
impact on the scheduled delivery date.
Content analysis details: (6.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname
(Split IP)
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[108.179.236.193 listed in bb.barracudacentral.org]
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.5 PHP_SCRIPT Sent by PHP script
Subject: {SPAM?} Action Required: Your package is on hold
Hello,
Import Duty and/or Tax and Customs Clearance Service Charges are still outstanding on your FedEx Express shipment with waybill number 772980724289.
​Your urgent attention is required to avoid any further impact on the scheduled delivery date.
To pay, view the calculation and download the relevant documents:
TRACK PACKAGE 》
https://zpr.io/dn8Ty7TkV68F
We apologize for any inconvenience this may cause and appreciate your understanding.
Best regards,
Customer Service
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments