Canada post phish from server.effexhost.com from Union City New Jersey
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 13 Jan 2024 08:34:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rOg0U-00000000CTV-2l3i
for dave@doctor.nl2k.ab.ca;
Sat, 13 Jan 2024 08:33:10 -0700
Resent-From: The Doctor
Resent-Date: Sat, 13 Jan 2024 08:33:10 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from server.effexhost.com ([107.182.225.196]:43352)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rOfzm-00000000CL9-36ka
for doctor@nk.ca;
Sat, 13 Jan 2024 08:32:36 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=global.effexhost.com; s=default; h=Content-Transfer-Encoding:Content-Type:
MIME-Version:Message-ID:From:Date:Subject:To:Sender:Reply-To:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=kHxu7mEHgwDHJ37ygRFCeaJbL3SNLvNZqzV2oWi0GxE=; b=K41csrA+KqE4vJwQiizWEAoEYY
Fm9cyJ7mhH5jpcJftjbbXw6Z9uoT4nkw2Tia4ev7A0y7rOOWM9B7A6mGwya7/nhRpMM7FR2pTCuPc
BR6H/AFurDc748tASVM6PtJ44UJMNuMhIfrwbxlQ151F7bbtGCv6kz0DO8au2H075lpmIHB0WkF6s
X4mc9h82aDAeySYNIJfhKCaybY7ABJLcjrIW9TWdEH46l7lMX40RtaZi7ece1+jyVtZoBYDWpcbC6
yqJ66ZDWFMts7RCCDIKlVXe5rVQWgyxqMbCEdChL7pRJkI28RuKPot/fH/tFZs2Ch69T3TY/PPJG4
uhBn3ARA==;
Received: from globaleffexhost by effexhost.com with local (Exim 4.93)
(envelope-from)
id 1rOfxm-0000vD-7z
for doctor@nk.ca; Sat, 13 Jan 2024 15:30:22 +0000
To: doctor@nk.ca
Subject: New package awaiting delivery
X-PHP-Script: global.effexhost.com/wp-content/plugins/lufixmailer.php for 197.146.225.207
X-PHP-Originating-Script: 653:lufixmailer.php
Date: Sat, 13 Jan 2024 15:30:22 +0000
From: Canada Post | Postes Canada
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_f40298d20a217eef06b6620f20eca2d2"
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - effexhost.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [653 496] / [47 12]
X-AntiAbuse: Sender Address Domain - canadapost-postescanada.ca
X-Get-Message-Sender-Via: effexhost.com: authenticated_id: globaleffexhost/only user confirmed/virtual account not confirmed
X-Authenticated-Sender: effexhost.com: globaleffexhost
X-Source: /opt/cpanel/ea-php74/root/usr/bin/php-cgi
X-Source-Args: /opt/cpanel/ea-php74/root/usr/bin/php-cgi
X-Source-Dir: global.effexhost.com:/public_html/wp-content/plugins
X-Spam_score: 10.6
X-Spam_score_int: 106
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your package N* 171221409446816055907752 is under transport
by Canada Post Office.This may happen when your delivery's address is incorrect.
We ask you to replan your delivery by connecting via the li [...]
Content analysis details: (10.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: tt.vg]
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=delivery%40canadapost-postescanada.ca;ip=107.182.225.196;r=doctor.nl2k.ab.ca]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted
Colors in HTML
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.4 PHP_SCRIPT Sent by PHP script
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
Subject: {SPAM?} New package awaiting delivery
This is a multi-part message in MIME format.
--b1_f40298d20a217eef06b6620f20eca2d2
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Â
Â
Your package N* 171221409446816055907752 is under transport by Canada Post Office.This may happen when your delivery's address is incorrect. We ask you to replan your delivery by connecting via the link below as soon as possible.
Plan your delivery
Once your delivery address and payment is complete, your package will be delivered the next day following our terms and conditions.Finally, be aware that you can follow the progress of your package or have information about our products and services on our site.
This is an automatic message. Please do not reply.
Arrived at Canada Post Office Origin Facility: 01.13.2024 06:21:05 AM
--b1_f40298d20a217eef06b6620f20eca2d2
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
--b1_f40298d20a217eef06b6620f20eca2d2--
I1.18KL0LD35.4KI2.16KwhoissourceRank10.8MPIN0Summary reportDiagnosisDensity00n/a
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 13 Jan 2024 08:34:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rOg0U-00000000CTV-2l3i
for dave@doctor.nl2k.ab.ca;
Sat, 13 Jan 2024 08:33:10 -0700
Resent-From: The Doctor
Resent-Date: Sat, 13 Jan 2024 08:33:10 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from server.effexhost.com ([107.182.225.196]:43352)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rOfzm-00000000CL9-36ka
for doctor@nk.ca;
Sat, 13 Jan 2024 08:32:36 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=global.effexhost.com; s=default; h=Content-Transfer-Encoding:Content-Type:
MIME-Version:Message-ID:From:Date:Subject:To:Sender:Reply-To:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Subscribe:List-Post:List-Owner:List-Archive;
bh=kHxu7mEHgwDHJ37ygRFCeaJbL3SNLvNZqzV2oWi0GxE=; b=K41csrA+KqE4vJwQiizWEAoEYY
Fm9cyJ7mhH5jpcJftjbbXw6Z9uoT4nkw2Tia4ev7A0y7rOOWM9B7A6mGwya7/nhRpMM7FR2pTCuPc
BR6H/AFurDc748tASVM6PtJ44UJMNuMhIfrwbxlQ151F7bbtGCv6kz0DO8au2H075lpmIHB0WkF6s
X4mc9h82aDAeySYNIJfhKCaybY7ABJLcjrIW9TWdEH46l7lMX40RtaZi7ece1+jyVtZoBYDWpcbC6
yqJ66ZDWFMts7RCCDIKlVXe5rVQWgyxqMbCEdChL7pRJkI28RuKPot/fH/tFZs2Ch69T3TY/PPJG4
uhBn3ARA==;
Received: from globaleffexhost by effexhost.com with local (Exim 4.93)
(envelope-from
id 1rOfxm-0000vD-7z
for doctor@nk.ca; Sat, 13 Jan 2024 15:30:22 +0000
To: doctor@nk.ca
Subject: New package awaiting delivery
X-PHP-Script: global.effexhost.com/wp-content/plugins/lufixmailer.php for 197.146.225.207
X-PHP-Originating-Script: 653:lufixmailer.php
Date: Sat, 13 Jan 2024 15:30:22 +0000
From: Canada Post | Postes Canada
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_f40298d20a217eef06b6620f20eca2d2"
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - effexhost.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [653 496] / [47 12]
X-AntiAbuse: Sender Address Domain - canadapost-postescanada.ca
X-Get-Message-Sender-Via: effexhost.com: authenticated_id: globaleffexhost/only user confirmed/virtual account not confirmed
X-Authenticated-Sender: effexhost.com: globaleffexhost
X-Source: /opt/cpanel/ea-php74/root/usr/bin/php-cgi
X-Source-Args: /opt/cpanel/ea-php74/root/usr/bin/php-cgi
X-Source-Dir: global.effexhost.com:/public_html/wp-content/plugins
X-Spam_score: 10.6
X-Spam_score_int: 106
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your package N* 171221409446816055907752 is under transport
by Canada Post Office.This may happen when your delivery's address is incorrect.
We ask you to replan your delivery by connecting via the li [...]
Content analysis details: (10.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: tt.vg]
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=delivery%40canadapost-postescanada.ca;ip=107.182.225.196;r=doctor.nl2k.ab.ca]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted
Colors in HTML
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.4 PHP_SCRIPT Sent by PHP script
-0.0 T_SCC_BODY_TEXT_LINE No description available.
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
Subject: {SPAM?} New package awaiting delivery
This is a multi-part message in MIME format.
--b1_f40298d20a217eef06b6620f20eca2d2
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Â
Â
Your package N* 171221409446816055907752 is under transport by Canada Post Office.This may happen when your delivery's address is incorrect. We ask you to replan your delivery by connecting via the link below as soon as possible.
Plan your delivery
Once your delivery address and payment is complete, your package will be delivered the next day following our terms and conditions.Finally, be aware that you can follow the progress of your package or have information about our products and services on our site.
This is an automatic message. Please do not reply.
Arrived at Canada Post Office Origin Facility: 01.13.2024 06:21:05 AM
--b1_f40298d20a217eef06b6620f20eca2d2
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
Â
| ||||
|
*Arrived at Canada Post Office Origin Facility: 01.13.2024 06:21:05 AM
--b1_f40298d20a217eef06b6620f20eca2d2--
I1.18KL0LD35.4KI2.16KwhoissourceRank10.8MPIN0Summary reportDiagnosisDensity00n/a
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments