Canada post phish from Hetzner Online GmbH Nürnberg, Bavaria, Germany

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 18 Jan 2024 10:08:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rQVri-000000006bn-24ym

for dave@doctor.nl2k.ab.ca;

Thu, 18 Jan 2024 10:07:42 -0700

Resent-From: The Doctor

Resent-Date: Thu, 18 Jan 2024 10:07:42 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from gs-host.com ([195.201.37.193]:46902)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rQVJO-0000000056x-2JXv

for root@nk.ca;

Thu, 18 Jan 2024 09:32:20 -0700

Received: by gs-host.com (Postfix, from userid 1254)

id 7D8DE1A218A; Thu, 18 Jan 2024 19:45:36 +0400 (+04)

DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;

d=canadapost-postescanada.ca; s=202305; t=1705594845;

bh=fP1za4x5hFip3o5OXJNoe+N+i7drgY7FYX2DzQ6HgdY=;

h=To:Subject:Date:From:From;

b=fHMOnyXy4Y1ZA1Jt8aMIWbyxBugu93pogAzL9M8tixn65n0zAUOjY9Ir7qBB1AwBL

KG2vzhZg6mdOjRAV330O3CD08dVzHkOTMG/y56hrxoSmeynR6ykOE4Lbz/zQb3tCIN

Szz2XLd0Ou9g0b/I7YWtiKVyY4hOkHOTL3y53XToF0/XgJJxEfJBAOMLeyAJSflFsj

s6Rc5WWlECpeQH1u1nKvuryfkwgHKEZKFxqHEDB7RmiAdz6423KGxrTbDV2Lr5l3Jg

chmKczthTUwkbfpFMkb4k19oAlYFZC/wlGACjgHQzVSduVsHyO8KDT5+tjYKRLh/u2

HmVANMq3pol3g==

To: root@nk.ca

Subject: Important: An additional action from you is required to receive your express delivery!

X-PHP-Originating-Script: 1254:mn.php

Date: Thu, 18 Jan 2024 19:45:36 +0400

From: =?UTF-8?Q?Canada_Post_=7C_Postes_Canada=C2=AE?=

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_a86fb62cb688f4bf543b971c51388793"

Content-Transfer-Encoding: 8bit

X-Spam_score: 15.9

X-Spam_score_int: 159

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: |delivery@canadapost-postescanada.ca| Dear Customer, Your

package number CA7002094852** is in transit. This package is declared in

customs, we invite you to pay the 2.94 CAD in duties and taxes by connecting

us via the link below as soon [...]



Content analysis details: (15.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: tt.vg]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[195.201.37.193 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[195.201.37.193 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=alerts%40canadapost-postescanada.ca;ip=195.201.37.193;r=doctor.nl2k.ab.ca]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

0.6 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

1.6 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} Important: An additional action from you is required to receive your express delivery!



This is a multi-part message in MIME format.



--b1_a86fb62cb688f4bf543b971c51388793

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



|delivery@canadapost-postescanada.ca|*



Dear Customer,

Your package number CA7002094852*** is in transit. This package is declared in customs, we invite you to pay the 2.94 CAD in duties and taxes by connecting us via the link below as soon as possible.

Receive your delivery

Failure to comply with this notice may result in your package being returned to the sender within 03 working days.







Once your payment is made, you will receive a confirmation of payment and your package will be delivered the next day.



*Arrived at Canada Post Office Origin Facility: 01.18.2024 07:14:31 AM





--b1_a86fb62cb688f4bf543b971c51388793

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable




ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">
-DECORATION: ; FONT-FAMILY: Lato; VERTICAL-ALIGN: baseline; FONT-STYLE: nor=

mal">
em">
homa">
e=3D"FONT-SIZE: 0px; OVERFLOW: hidden; MAX-WIDTH: 0px; DISPLAY: none; LINE-=

HEIGHT: 0px; MAX-HEIGHT: 0px; VISIBILITY: hidden; opacity: 0; mso-hide: all=

">*|delivery@canadapost-postescanada.ca|*
ONT>




ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">
DER-LEFT-STYLE: none; VERTICAL-ALIGN: middle; BORDER-BOTTOM-STYLE: none; BO=

RDER-RIGHT-STYLE: none" border=3D0 hspace=3D0 src=3D"https://www.irsapei.ca=

/sitefiles/Image/guide/illustrations/communication/Canada-Post-logo.png" wi=

dth=3D182 align=3Dbaseline height=3D38>




ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">
AN style=3D"BOX-SIZING: border-box; FONT-WEIGHT: bolder">Dear Customer,
AN>




ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">You=

r package number=C2=A0
FONT-WEIGHT: bolder">CA7002
x; FONT-WEIGHT: bolder">094852***
-box; FONT-SIZE: 12px; FONT-FAMILY: "Open Sans", "Helvetica Neue", Helvetic=

a, Arial, sans-serif; COLOR: rgb(68,68,68)'>
er-box" color=3D#2c363a size=3D2 face=3DTahoma>
order-box; FONT-SIZE: 12px; FONT-FAMILY: "Open Sans", "Helvetica Neue", Hel=

vetica, Arial, sans-serif; COLOR: rgb(68,68,68)'>
border-box" color=3D#2c363a size=3D2 face=3DTahoma>=C2=A0
ONT>is in transit.
=C2=A0

le=3D"BOX-SIZING: border-box">This package is declared in customs, we invit=

e you to pay the=C2=A0
bolder">2
e=3D"BOX-SIZING: border-box; FONT-SIZE: 16px">.94 CAD=C2=

=A0in duties and taxes by connecting us via the link below as soon as possi=

ble.




ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">
border-box; COLOR: rgb(77,20,140)">
FONT-WEIGHT: bolder">
homa">
(0,172,255); BACKGROUND-COLOR: transparent" href=3D"https://tt.vg/RLIVy" re=

l=3Dnoreferrer target=3D_blank>
=3D#ff0000>Receive your delivery
AN>




ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">
ace=3DTahoma>Failure to comply with this notice may result in your =

package being returned to the=C2=A0sender within 03 working days.<=

/FONT>=20


ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">


ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">
ONT>


ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">
ONT>


ans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; =

TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND=

-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal;=

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration=

-thickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">Onc=

e your payment is made, you will receive a confirmation of payment and your=

package will be delivered the next day.=20


px; OVERFLOW: visible; BORDER-TOP: 1px solid; HEIGHT: 0px; FONT-FAMILY: Rob=

oto, sans-serif; BORDER-RIGHT-WIDTH: 0px; WHITE-SPACE: normal; BORDER-BOTTO=

M-WIDTH: 0px; WORD-SPACING: 0px; TEXT-TRANSFORM: none; BORDER-LEFT-COLOR: ;=

FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-STYLE: normal; BORDER-BOTTOM-=

COLOR: ; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; BORDER-RIGHT-COLOR: ; LET=

TER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial; border-image: initial">


ma>*Arrived at=

=C2=A0Canada Post Office Origin Facility: 01.18.2024 07:14:31 AM
NT>=20

3D""
size:fit:1160/1*JuClCJ-hzXZ1xXLKJ4I1NA.png" width=3D769 align=3Dbaseline he=

ight=3D252>







--b1_a86fb62cb688f4bf543b971c51388793--

I1.02KL0LD35.4KI2.16KwhoissourceRank32.2MPIN0Summary reportDiagnosisDensity00n/a

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA