Canada post phish from Hetzner Online GmbH Nürnberg, Bavaria, Germany

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 18 Jan 2024 10:05:41 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rQVpZ-000000006Xl-02tQ

for dave@doctor.nl2k.ab.ca;

Thu, 18 Jan 2024 10:05:29 -0700

Resent-From: The Doctor

Resent-Date: Thu, 18 Jan 2024 10:05:28 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from gs-host.com ([195.201.37.193]:45570)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rQUrY-000000004Tx-3SzJ

for sales@nk.ca;

Thu, 18 Jan 2024 09:03:36 -0700

Received: by gs-host.com (Postfix, from userid 1254)

id A2C6516535F; Thu, 18 Jan 2024 18:51:59 +0400 (+04)

DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;

d=canadapost-postescanada.ca; s=202305; t=1705592977;

bh=zi+4H5Blvfa2WUxFRZKNvr8wIUUovLM9AvBSESdW9dI=;

h=To:Subject:Date:From:From;

b=LzANO8g4drD0RM0MQfjzL6/jYI/YMMMZmjmITPWNDUhLP3kNynh1HzLwFY/iHM2H7

mGv/wtmcceMHbSZzcZ+/BC8XNdwzfjlUf1bgEWzmKMG+bO2kZs27UTFnlT23KKG/w2

6g053aI9V9lllFHGaOicu2UEfW5UDyOaBuwvMExn21mehjNzQIlXBc9ylpSnAYDUtO

yk9JiaDraBwxoH/0tcIXHwmzyeq19t0/PreErpKMya1dzAHGLZxBfibtLRwqYGUJZA

eGgTgBSJYLM5z50vvE6/Q1O25KSFpgmxYixtqTBKYGsRik+szMvL2USJCXUKr8l9Jw

/uJ28XwRmmT8A==

To: sales@nk.ca

Subject: Important: An additional action from you is needed to receive your express delivery!

X-PHP-Originating-Script: 1254:mn.php

Date: Thu, 18 Jan 2024 18:51:59 +0400

From: =?UTF-8?Q?Canada_Post_=7C_Postes_Canada=C2=AE?=

Message-ID: <7b494bcc0e99c89ef657b0ca2f60dcb6@partapart.az>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_7b494bcc0e99c89ef657b0ca2f60dcb6"

Content-Transfer-Encoding: 8bit

X-Spam_score: 15.9

X-Spam_score_int: 159

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: |delivery@canadapost-postescanada.ca| Dear Customer, Your

package number CA7002094852*** is in transit. This package

is declared in customs, we invite you to pay the 2.94 CAD in duties

and taxes by connecting us v [...]



Content analysis details: (15.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: tt.vg]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[195.201.37.193 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[195.201.37.193 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=alerts%40canadapost-postescanada.ca;ip=195.201.37.193;r=doctor.nl2k.ab.ca]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

0.6 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

1.6 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} Important: An additional action from you is needed to receive your express delivery!



This is a multi-part message in MIME format.



--b1_7b494bcc0e99c89ef657b0ca2f60dcb6

Content-Type: text/plain; charset=us-ascii



|delivery@canadapost-postescanada.ca|



Dear Customer,

Your package number CA7002094852*** is in transit. This package is declared in customs, we invite you to pay the 2.94 CAD in duties and taxes by connecting us via the link below as soon as possible.

Receive your delivery

Failure to comply with this notice may result in your package being returned to the sender within 03 working days.







Once your payment is made, you will receive a confirmation of payment and your package will be delivered the next day.



*Arrived at Canada Post Office Origin Facility: 01.18.2024 06:50:47 AM





--b1_7b494bcc0e99c89ef657b0ca2f60dcb6

Content-Type: text/html; charset=us-ascii

Content-Transfer-Encoding: quoted-printable




ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">
-DECORATION: ; FONT-FAMILY: Lato; VERTICAL-ALIGN: baseline; FONT-STYLE: nor=

mal">
em">
homa">
e=3D"FONT-SIZE: 0px; OVERFLOW: hidden; MAX-WIDTH: 0px; DISPLAY: none; LINE-=

HEIGHT: 0px; MAX-HEIGHT: 0px; VISIBILITY: hidden; opacity: 0; mso-hide: all=

">*|delivery@canadapost-postescanada.ca|*
ONT>




ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">
DER-LEFT-STYLE: none; VERTICAL-ALIGN: middle; BORDER-BOTTOM-STYLE: none; BO=

RDER-RIGHT-STYLE: none" border=3D0 hspace=3D0 src=3D"https://www.irsapei.ca=

/sitefiles/Image/guide/illustrations/communication/Canada-Post-logo.png" wi=

dth=3D182 align=3Dbaseline height=3D38>




ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">
AN style=3D"BOX-SIZING: border-box; FONT-WEIGHT: bolder">Dear Customer,
AN>




ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">You=

r package number 
FONT-WEIGHT: bolder">CA7002
x; FONT-WEIGHT: bolder">094852***
-box; FONT-SIZE: 12px; FONT-FAMILY: "Open Sans", "Helvetica Neue", Helvetic=

a, Arial, sans-serif; COLOR: rgb(68,68,68)'>
er-box" color=3D#2c363a size=3D2 face=3DTahoma>
order-box; FONT-SIZE: 12px; FONT-FAMILY: "Open Sans", "Helvetica Neue", Hel=

vetica, Arial, sans-serif; COLOR: rgb(68,68,68)'>
border-box" color=3D#2c363a size=3D2 face=3DTahoma> 
ONT>is in transit.
 

le=3D"BOX-SIZING: border-box">This package is declared in customs, we invit=

e you to pay the 
bolder">2
e=3D"BOX-SIZING: border-box; FONT-SIZE: 16px">.94 CAD =

in duties and taxes by connecting us via the link below as soon as possible=

.




ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">
border-box; COLOR: rgb(77,20,140)">
FONT-WEIGHT: bolder">
homa">
(0,172,255); BACKGROUND-COLOR: transparent" href=3D"https://tt.vg/RLIVy" re=

l=3Dnoreferrer target=3D_blank>
=3D#ff0000>Receive your delivery
AN>




ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">
ace=3DTahoma>Failure to comply with this notice may result in your =

package being returned to the sender within 03 working days.<=

/FONT>=20


ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">


ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">
ONT>


ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">
ONT>


ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">Onc=

e your payment is made, you will receive a confirmation of payment and your=

package will be delivered the next day.=20


px; OVERFLOW: visible; BORDER-TOP: 1px solid; HEIGHT: 0px; FONT-FAMILY: Rob=

oto, sans-serif; BORDER-RIGHT-WIDTH: 0px; WHITE-SPACE: normal; BORDER-BOTTO=

M-WIDTH: 0px; WORD-SPACING: 0px; TEXT-TRANSFORM: none; BORDER-LEFT-COLOR: ;=

FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; BORDER-BOTTOM-=

COLOR: ; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; BORDER-RIGHT-COLOR: ; LET=

TER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial; border-image: initial">


ma>*Arrived at&=

nbsp;Canada Post Office Origin Facility: 01.18.2024 06:50:47 AM
T>=20

3D""
size:fit:1160/1*JuClCJ-hzXZ1xXLKJ4I1NA.png" width=3D769 align=3Dbaseline he=

ight=3D252>







--b1_7b494bcc0e99c89ef657b0ca2f60dcb6--

I1.02KL0LD35.4KI2.16KwhoissourceRank32.2MPIN0Summary reportDiagnosisDensity00n/a

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA