registered letter phish from Germany

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Jul 2023 16:16:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qOmmn-0002MQ-2P

for dave@doctor.nl2k.ab.ca;

Wed, 26 Jul 2023 16:15:13 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Jul 2023 16:15:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [5.230.76.115] (port=39938 helo=vps64bf44848e329131250839.noezserver.de)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qOmUK-0004rs-2A

for root@nk.ca;

Wed, 26 Jul 2023 15:56:12 -0600

Received: from WIN-HJ7HS4240QQ (localhost [IPv6:::1])

by vps64bf44848e329131250839.noezserver.de (Postfix) with ESMTP id 11D4728AFC

for ; Wed, 26 Jul 2023 21:14:14 +0000 (UTC)

MIME-Version: 1.0

From: "Express Delivery"

To: root@nk.ca

Reply-To: noreply@gmbh.de

Date: 26 Jul 2023 14:14:14 -0700

Subject: concerning your registered letter RP3012772642001927

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: base64

Message-Id: <20230726211414.11D4728AFC@vps64bf44848e329131250839.noezserver.de>

X-Spam_score: 5.1

X-Spam_score_int: 51

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: concerning your registered letter RP3012772642001927 You have

a new registered letter pending.We could not find you with the address provided

by the sender 736900203973, for this please correct your address here: RP3012772642001927

Address Update



Content analysis details: (5.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

Subject: {SPAM?} concerning your registered letter RP3012772642001927

X-Antivirus: AVG (VPS 230726-6, 7/26/2023), Inbound message

X-Antivirus-Status: Clean



PFRBQkxFIHJvbGU9cHJlc2VudGF0aW9uIGNsYXNzPW5sLWNvbnRhaW5lciBzdHlsZT0i

QkFDS0dST1VORC1DT0xPUjogI2ZmZjsgbXNvLXRhYmxlLWxzcGFjZTogMHB0OyBtc28t

dGFibGUtcnNwYWNlOiAwcHQiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCB3aWR0

aD0iMTAwJSIgYm9yZGVyPTA+DQo8VEJPRFk+DQo8VFI+DQo8VEQ+DQo8VEFCTEUgcm9s

ZT1wcmVzZW50YXRpb24gY2xhc3M9InJvdyByb3ctMSIgc3R5bGU9Im1zby10YWJsZS1s

c3BhY2U6IDBwdDsgbXNvLXRhYmxlLXJzcGFjZTogMHB0IiBjZWxsU3BhY2luZz0wIGNl

bGxQYWRkaW5nPTAgd2lkdGg9IjEwMCUiIGFsaWduPWNlbnRlciBib3JkZXI9MD4NCjxU

Qk9EWT4NCjxUUj4NCjxURD4NCjxUQUJMRSByb2xlPXByZXNlbnRhdGlvbiBjbGFzcz0i

cm93LWNvbnRlbnQgc3RhY2siIHN0eWxlPSJXSURUSDogNDgwcHg7IENPTE9SOiAjMDAw

OyBNQVJHSU46IDBweCBhdXRvOyBCQUNLR1JPVU5ELUNPTE9SOiAjZWFlYWVhOyBtc28t

dGFibGUtbHNwYWNlOiAwcHQ7IG1zby10YWJsZS1yc3BhY2U6IDBwdDsgYm9yZGVyLXJh

ZGl1czogMCIgY2VsbFNwYWNpbmc9MCBjZWxsUGFkZGluZz0wIHdpZHRoPTQ4MCBhbGln

bj1jZW50ZXIgYm9yZGVyPTA+DQo8VEJPRFk+DQo8VFI+DQo8VEQgY2xhc3M9ImNvbHVt

biBjb2x1bW4tMSIgc3R5bGU9IkJPUkRFUi1UT1A6IDBweDsgQk9SREVSLVJJR0hUOiAw

cHg7IFZFUlRJQ0FMLUFMSUdOOiB0b3A7IEJPUkRFUi1CT1RUT006IDBweDsgRk9OVC1X

RUlHSFQ6IDQwMDsgUEFERElORy1CT1RUT006IDVweDsgVEVYVC1BTElHTjogbGVmdDsg

UEFERElORy1UT1A6IDVweDsgQk9SREVSLUxFRlQ6IDBweDsgbXNvLXRhYmxlLWxzcGFj

ZTogMHB0OyBtc28tdGFibGUtcnNwYWNlOiAwcHQiIHdpZHRoPSIxMDAlIj4NCjxUQUJM

RSByb2xlPXByZXNlbnRhdGlvbiBjbGFzcz0icGFyYWdyYXBoX2Jsb2NrIGJsb2NrLTEi

IHN0eWxlPSJtc28tdGFibGUtbHNwYWNlOiAwcHQ7IG1zby10YWJsZS1yc3BhY2U6IDBw

dCIgY2VsbFNwYWNpbmc9MCBjZWxsUGFkZGluZz0zMCB3aWR0aD0iMTAwJSIgYm9yZGVy

PTA+DQo8VEJPRFk+DQo8VFI+DQo8VEQgY2xhc3M9cGFkPg0KPERJViBzdHlsZT0iRk9O

VC1TSVpFOiAxN3B4OyBGT05ULUZBTUlMWTogQXJpYWwsIEhlbHZldGljYSBOZXVlLCBI

ZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IEZPTlQtV0VJR0hUOiA0MDA7IENPTE9SOiAjMTAx

MTEyOyBESVJFQ1RJT046IGx0cjsgVEVYVC1BTElHTjogbGVmdDsgTEVUVEVSLVNQQUNJ

Tkc6IDBweDsgTElORS1IRUlHSFQ6IDEyMCU7IG1zby1saW5lLWhlaWdodC1hbHQ6IDIw

LjRweCI+DQo8UCBzdHlsZT0iTUFSR0lOOiAwcHggMHB4IDE2cHgiPjxTUEFOIHN0eWxl

PSJDT0xPUjogI2ZmNWUwMCI+PFNUUk9ORz5jb25jZXJuaW5nIHlvdXIgcmVnaXN0ZXJl

ZCBsZXR0ZXIgUlAzMDEyNzcyNjQyMDAxOTI3PC9TVFJPTkc+PC9TUEFOPjwvUD4NCjxQ

IHN0eWxlPSJNQVJHSU46IDBweCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7

Jm5ic3A7Jm5ic3A7IFlvdSBoYXZlIGEgbmV3IHJlZ2lzdGVyZWQgbGV0dGVyIHBlbmRp

bmcuV2UgY291bGQgbm90IGZpbmQgeW91IHdpdGggdGhlIGFkZHJlc3MgcHJvdmlkZWQg

YnkgdGhlIHNlbmRlciA3MzY5MDAyMDM5NzMsIGZvciB0aGlzIHBsZWFzZSBjb3JyZWN0

IHlvdXIgYWRkcmVzcyBoZXJlOiA8QSBzdHlsZT0iVEVYVC1ERUNPUkFUSU9OOiB1bmRl

cmxpbmU7IENPTE9SOiAjOGEzYzkwIiBocmVmPSJodHRwczovL2Fzc29jaWF0aW9uaW1y

ZC5wYWdlLmxpbmsvWGt0UyIgcmVsPW5vb3BlbmVyIHRhcmdldD1fYmxhbms+PFNUUk9O

Rz5SUDMwMTI3NzI2NDIwMDE5MjcgQWRkcmVzcyBVcGRhdGU8L1NUUk9ORz48L0E+PC9Q

PjwvRElWPjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFCTEU+DQo8VEFCTEUgcm9sZT1wcmVz

ZW50YXRpb24gY2xhc3M9ImltYWdlX2Jsb2NrIGJsb2NrLTIiIHN0eWxlPSJtc28tdGFi

bGUtbHNwYWNlOiAwcHQ7IG1zby10YWJsZS1yc3BhY2U6IDBwdCIgY2VsbFNwYWNpbmc9

MCBjZWxsUGFkZGluZz0wIHdpZHRoPSIxMDAlIiBib3JkZXI9MD4NCjxUQk9EWT4NCjxU

Uj4NCjxURCBjbGFzcz1wYWQgc3R5bGU9IldJRFRIOiAxMDAlOyBQQURESU5HLUxFRlQ6

IDBweDsgUEFERElORy1SSUdIVDogMHB4Ij4NCjxESVYgY2xhc3M9YWxpZ25tZW50IHN0

eWxlPSJMSU5FLUhFSUdIVDogMTBweCIgYWxpZ249Y2VudGVyPjxJTUcgY2xhc3M9ZnVs

bFdpZHRoIHN0eWxlPSJNQVgtV0lEVEg6IDQwOHB4OyBCT1JERVItVE9QOiAwcHg7IEJP

UkRFUi1SSUdIVDogMHB4OyBCT1JERVItQk9UVE9NOiAwcHg7IEJPUkRFUi1MRUZUOiAw

cHg7IERJU1BMQVk6IGJsb2NrIiBzcmM9Imh0dHBzOi8vZmI1MGEwY2Y1Ni5pbWdkaXN0

LmNvbS9wdWJsaWMvdXNlcnMvSW50ZWdyYXRvcnMvQmVlUHJvQWdlbmN5Lzg2ODQyMV84

NTI1NTkvZWRpdG9yX2ltYWdlcy9iNDlkZDE4Yi1lZmUwLTRhOGQtYmM3NS01OTFiMmE1

MzZiOTMuanBnIiB3aWR0aD0xMDAlIGhlaWdodD0iYXV0byI+PC9ESVY+PC9URD48L1RS

PjwvVEJPRFk+PC9UQUJMRT4NCjxUQUJMRSByb2xlPXByZXNlbnRhdGlvbiBjbGFzcz0i

cGFyYWdyYXBoX2Jsb2NrIGJsb2NrLTMiIHN0eWxlPSJtc28tdGFibGUtbHNwYWNlOiAw

cHQ7IG1zby10YWJsZS1yc3BhY2U6IDBwdCIgY2VsbFNwYWNpbmc9MCBjZWxsUGFkZGlu

Zz0wIHdpZHRoPSIxMDAlIiBib3JkZXI9MD4NCjxUQk9EWT4NCjxUUj4NCjxURCBjbGFz

cz1wYWQgc3R5bGU9IlBBRERJTkctQk9UVE9NOiAxNXB4OyBQQURESU5HLVRPUDogNjBw

eDsgUEFERElORy1MRUZUOiA1NXB4OyBQQURESU5HLVJJR0hUOiAxNXB4Ij4NCjxESVYg

c3R5bGU9IkZPTlQtU0laRTogOHB4OyBGT05ULUZBTUlMWTogQXJpYWwsIEhlbHZldGlj

YSBOZXVlLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IEZPTlQtV0VJR0hUOiA0MDA7IENP

TE9SOiAjYjViNWI1OyBESVJFQ1RJT046IGx0cjsgVEVYVC1BTElHTjogcmlnaHQ7IExF

VFRFUi1TUEFDSU5HOiAwcHg7IExJTkUtSEVJR0hUOiAxMjAlOyBtc28tbGluZS1oZWln

aHQtYWx0OiA5LjZweCI+DQo8UCBzdHlsZT0iTUFSR0lOOiAwcHgiPjxBIHN0eWxlPSJU

RVhULURFQ09SQVRJT046IHVuZGVybGluZTsgQ09MT1I6ICM4YTNjOTAiIGhyZWY9Imh0

dHBzOi8vYXNzb2NpYXRpb25pbXJkLnBhZ2UubGluay9Ya3RTIiByZWw9bm9vcGVuZXIg

dGFyZ2V0PV9ibGFuaz51bnN1YnNjcmliZTwvQT48L1A+PC9ESVY+PC9URD48L1RSPjwv

VEJPRFk+PC9UQUJMRT4NCjxUQUJMRSByb2xlPXByZXNlbnRhdGlvbiBjbGFzcz0iZGl2

aWRlcl9ibG9jayBibG9jay00IiBzdHlsZT0ibXNvLXRhYmxlLWxzcGFjZTogMHB0OyBt

c28tdGFibGUtcnNwYWNlOiAwcHQiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCB3

aWR0aD0iMTAwJSIgYm9yZGVyPTA+DQo8VEJPRFk+DQo8VFI+DQo8VEQgY2xhc3M9cGFk

IHN0eWxlPSJQQURESU5HLUJPVFRPTTogMTBweDsgUEFERElORy1UT1A6IDYwcHg7IFBB

RERJTkctTEVGVDogMTBweDsgUEFERElORy1SSUdIVDogMTBweCI+DQo8RElWIGNsYXNz

PWFsaWdubWVudCBhbGlnbj1jZW50ZXI+DQo8VEFCTEUgcm9sZT1wcmVzZW50YXRpb24g

c3R5bGU9Im1zby10YWJsZS1sc3BhY2U6IDBwdDsgbXNvLXRhYmxlLXJzcGFjZTogMHB0

IiBjZWxsU3BhY2luZz0wIGNlbGxQYWRkaW5nPTAgd2lkdGg9IjEwMCUiIGJvcmRlcj0w

Pg0KPFRCT0RZPg0KPFRSPg0KPFREIGNsYXNzPWRpdmlkZXJfaW5uZXIgc3R5bGU9IkZP

TlQtU0laRTogMXB4OyBCT1JERVItVE9QOiAjZGRkZGRkIDFweCBzb2xpZDsgTElORS1I

RUlHSFQ6IDFweCI+PFNQQU4+4oCKPC9TUEFOPjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFC

TEU+PC9ESVY+PC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48L1REPjwvVFI+PC9UQk9E

WT48L1RBQkxFPjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9URD48L1RSPjwvVEJP

RFk+PC9UQUJMRT48IS0tIEVuZCAtLT4=



Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA