Fedex Phish from South Africa
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 31 Dec 2023 16:15:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))
(envelope-from)
id 1rK51A-000000002Kh-169O
for dave@doctor.nl2k.ab.ca;
Sun, 31 Dec 2023 16:14:52 -0700
Resent-From: The Doctor
Resent-Date: Sun, 31 Dec 2023 16:14:52 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from bluetreeconceptscc.dedicated.co.za ([197.242.151.29]:51332 helo=honmotakeshi.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.97 (FreeBSD))
(envelope-from)
id 1rK1xi-00000000JKM-078Y
for sales@nk.ca;
Sun, 31 Dec 2023 12:59:11 -0700
Received: by honmotakeshi.com (Postfix, from userid 33)
id E3BC21A833E; Sun, 31 Dec 2023 21:36:24 +0200 (SAST)
To: sales@nk.ca
Subject: Take advantage of our latest delivery services in 2023. Don't miss the chance to pick up your parcels.
Date: Sun, 31 Dec 2023 21:36:24 +0200
From: FedEx Express
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_bd4f61d44a375811b1d508398d254b7b"
Content-Transfer-Encoding: 8bit
X-Spam_score: 14.4
X-Spam_score_int: 144
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear sales@nk.ca, Your package N° CA10090R67**** is under
transport. You've missed your scheduled delivery due to incorrect address.
We ask you to pay the fees of 0.99 CAD to schedule a new attempt of delivery
using the button below:
Content analysis details: (14.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: tt.vg]
1.8 DKIM_ADSP_DISCARD No valid author signature, domain signs all mail
and suggests discarding the rest
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=service%40fedex.com;ip=197.242.151.29;r=doctor.nl2k.ab.ca]
2.0 WIKI_IMG URI: Image from wikipedia
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted
Colors in HTML
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.3 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
1.6 FSL_BULK_SIG Bulk signature with no Unsubscribe
Subject: {SPAM?} Take advantage of our latest delivery services in 2023. Don't miss the chance to pick up your parcels.
X-Antivirus: AVG (VPS 240102-4, 1/2/2024), Inbound message
X-Antivirus-Status: Clean
This is a multi-part message in MIME format.
--b1_bd4f61d44a375811b1d508398d254b7b
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Dear sales@nk.ca,
Your package N° CA10090R67**** is under transport.
You've missed your scheduled delivery due to incorrect address. We ask you to pay the fees of 0.99 CAD to schedule a new attempt of delivery using the button below:
Receive your delivery
This is your last notice before the package is returned to sender in accordance with our terms of use.
*Arrived at FedEx Post Office Origin Facility: 12.31.2023 11:00:51 AM
--b1_bd4f61d44a375811b1d508398d254b7b
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
--b1_bd4f61d44a375811b1d508398d254b7b--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 31 Dec 2023 16:15:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))
(envelope-from
id 1rK51A-000000002Kh-169O
for dave@doctor.nl2k.ab.ca;
Sun, 31 Dec 2023 16:14:52 -0700
Resent-From: The Doctor
Resent-Date: Sun, 31 Dec 2023 16:14:52 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from bluetreeconceptscc.dedicated.co.za ([197.242.151.29]:51332 helo=honmotakeshi.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.97 (FreeBSD))
(envelope-from
id 1rK1xi-00000000JKM-078Y
for sales@nk.ca;
Sun, 31 Dec 2023 12:59:11 -0700
Received: by honmotakeshi.com (Postfix, from userid 33)
id E3BC21A833E; Sun, 31 Dec 2023 21:36:24 +0200 (SAST)
To: sales@nk.ca
Subject: Take advantage of our latest delivery services in 2023. Don't miss the chance to pick up your parcels.
Date: Sun, 31 Dec 2023 21:36:24 +0200
From: FedEx Express
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_bd4f61d44a375811b1d508398d254b7b"
Content-Transfer-Encoding: 8bit
X-Spam_score: 14.4
X-Spam_score_int: 144
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear sales@nk.ca, Your package N° CA10090R67**** is under
transport. You've missed your scheduled delivery due to incorrect address.
We ask you to pay the fees of 0.99 CAD to schedule a new attempt of delivery
using the button below:
Content analysis details: (14.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: tt.vg]
1.8 DKIM_ADSP_DISCARD No valid author signature, domain signs all mail
and suggests discarding the rest
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=service%40fedex.com;ip=197.242.151.29;r=doctor.nl2k.ab.ca]
2.0 WIKI_IMG URI: Image from wikipedia
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted
Colors in HTML
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.3 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
1.6 FSL_BULK_SIG Bulk signature with no Unsubscribe
Subject: {SPAM?} Take advantage of our latest delivery services in 2023. Don't miss the chance to pick up your parcels.
X-Antivirus: AVG (VPS 240102-4, 1/2/2024), Inbound message
X-Antivirus-Status: Clean
This is a multi-part message in MIME format.
--b1_bd4f61d44a375811b1d508398d254b7b
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Dear sales@nk.ca,
Your package N° CA10090R67**** is under transport.
You've missed your scheduled delivery due to incorrect address. We ask you to pay the fees of 0.99 CAD to schedule a new attempt of delivery using the button below:
Receive your delivery
This is your last notice before the package is returned to sender in accordance with our terms of use.
*Arrived at FedEx Post Office Origin Facility: 12.31.2023 11:00:51 AM
--b1_bd4f61d44a375811b1d508398d254b7b
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
Dear sales@nk.ca,
Your package N° CA10090R67**** is under transport.
You've missed your scheduled delivery due to incorrect address. We ask you to pay the fees of 0.99 CAD to schedule a new attempt of delivery using the button below:
This is your last notice before the package is returned to sender in accordance with our terms of use.
*Arrived at FedEx Post Office Origin Facility: 12.31.2023 11:00:51 AM
--b1_bd4f61d44a375811b1d508398d254b7b--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments