Purolator phish from Toronto Ontario Canada

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Aug 2024 17:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sZew3-0000000081j-2dhE

for dave@doctor.nl2k.ab.ca;

Thu, 01 Aug 2024 17:10:15 -0600

Resent-From: The Doctor

Resent-Date: Thu, 1 Aug 2024 17:10:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp1.i3international.com ([209.82.34.68]:63495)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sZdds-00000000KjI-1mPG

for sales@nk.ca;

Thu, 01 Aug 2024 15:47:28 -0600

X-Virus-Scanned: by SpamTitan at i3international.com

Authentication-Results: smtp1.i3international.com;

x-trusted-ip=pass

From: General Account

To: "info@advantageteam.ca"

Subject: Purolator Delivery Status: You have (1) pending parcel

Thread-Topic: Purolator Delivery Status: You have (1) pending parcel

Thread-Index: AQHa5FwdyiRKzmA1BkmFx0ZVXX7inw==

Date: Thu, 1 Aug 2024 21:45:24 +0000

Message-ID: <1722548688a2f54bc1b1eae584268de4729efa460a_28@i3international.com>

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

Content-Type: multipart/alternative;

boundary="_000_1722548688a2f54bc1b1eae584268de4729efa460a28i3internati_"

MIME-Version: 1.0

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [https://i.imgur.com/b5h8EWl.gif] You have (1) pending parcel

Order number: P1019902872 Weight: 1.3kg We were unable to deliver your package

and it has been returned to your local Post Facility. You m [...]



Content analysis details: (5.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.82.34.68 listed in dnsbl.ahbl.org]

[209.82.34.68 listed in dnsbl.ahbl.org]

[209.82.34.68 listed in dnsbl.ahbl.org]

[209.82.34.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.82.34.68 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.82.34.68 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.82.34.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.82.34.68 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.82.34.68 listed in will-spam-for-food.eu.org]

[209.82.34.68 listed in will-spam-for-food.eu.org]

[209.82.34.68 listed in will-spam-for-food.eu.org]

[209.82.34.68 listed in will-spam-for-food.eu.org]

[209.82.34.68 listed in will-spam-for-food.eu.org]

[209.82.34.68 listed in will-spam-for-food.eu.org]

[209.82.34.68 listed in will-spam-for-food.eu.org]

[209.82.34.68 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Purolator Delivery Status: You have (1) pending parcel



--_000_1722548688a2f54bc1b1eae584268de4729efa460a28i3internati_

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: base64



W2h0dHBzOi8vaS5pbWd1ci5jb20vYjVoOEVXbC5naWZdDQpZb3UgaGF2ZSAoMSkgcGVuZGluZyBw

YXJjZWwNCk9yZGVyIG51bWJlcjogUDEwMTk5MDI4NzINCldlaWdodDogMS4za2cNCldlIHdlcmUg

dW5hYmxlIHRvIGRlbGl2ZXIgeW91ciBwYWNrYWdlIGFuZCBpdCBoYXMgYmVlbiByZXR1cm5lZCB0

byB5b3VyIGxvY2FsIFBvc3QgRmFjaWxpdHkuIFlvdSBtYXkgYXJyYW5nZSByZWRlbGl2ZXJ5IGJ5

IHZpc2l0aW5nIHRoZSBuZWFyZXN0IENhbmFkYSBQb3N0IE9mZmljZSB3aXRoIHRoZSBwcmludGVk

IHNoaXBwaW5nIGludm9pY2UgbWVudGlvbmVkIGJlbG93Og0KRG93bmxvYWQgdGhlIGF0dGFjaGVk

IHNoaXBwaW5nIGluc3RydWN0aW9ucy48aHR0cHM6Ly9kb3VpbmUuZnIvYm9vZ3ltYW4vPg0KUGxl

YXNlIG5vdGU6IFlvdSBtaWdodCBiZSByZXF1aXJlZCB0byBzaG93IGEgdmFsaWQgZ292ZXJubWVu

dGFsIElELg0KU2luY2VyZWx5LA0KQ2FuYWRhIFBvc3QNClBlbmFsdGllcyBhcmUgaW1wb3NlZCBm

b3Igc3RvcmFnZSBvZiB0aGUgcGFyY2VsIGlmIHlvdSBmYWlsIHRvIGNvbGxlY3QgaXQgd2l0aGlu

IDMwIGRheXMuDQpUaGUgZGV0YWlsZWQgaW5mb3JtYXRpb24gYWJvdXQgc3RvcmFnZSBpcyBhdmFp

bGFibGUgYXQgb3VyIHdlYnNpdGUuDQoNCg0KDQoNCg0KDQpbaHR0cHM6Ly93d3cuaTNpbnRlcm5h

dGlvbmFsLmNvbS9pbWFnZXMvaTMtbG9nby1wbmcucG5nXSA8aHR0cHM6Ly93d3cuaTNpbnRlcm5h

dGlvbmFsLmNvbT4NCg0KDQoNCkdlbmVyYWwgQWNjb3VudA0KDQoNCmdlbmFjY0BpM2ludGVybmF0

aW9uYWwuY29tDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KDQoNClRvbGwgRnJl

ZTogMS44NjYuODQwLjAwMDQNCldlYnNpdGU6IHd3dy5pM2ludGVybmF0aW9uYWwuY29tPGh0dHBz

Oi8vd3d3LmkzaW50ZXJuYXRpb25hbC5jb20+DQo=



--_000_1722548688a2f54bc1b1eae584268de4729efa460a28i3internati_

Content-Type: text/html; charset="utf-8"

Content-ID:

Content-Transfer-Encoding: base64



PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMCBUcmFuc2l0aW9uYWwv

L0VOIj4NCjxodG1sPg0KPGhlYWQ+DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNv

bnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+DQo8L2hlYWQ+DQo8Ym9keT4NCjxkaXY+

DQo8ZGl2IHN0eWxlPSJGT05ULVNJWkU6IDE1cHg7IE1BWC1XSURUSDogNzAwcHg7IEZPTlQtRkFN

SUxZOiBhcmlhbDsgTUFSR0lOOiAwcHggYXV0byI+DQo8ZGl2IHN0eWxlPSJQQURESU5HLUJPVFRP

TTogMzBweDsgUEFERElORy1UT1A6IDMwcHg7IFBBRERJTkctTEVGVDogMjBweDsgUEFERElORy1S

SUdIVDogMjBweDsgZGJhY2tncm91bmQ6ICNmMGYwZjAiPg0KPGltZyBzcmM9Imh0dHBzOi8vaS5p

bWd1ci5jb20vYjVoOEVXbC5naWYiPjwvZGl2Pg0KPGRpdiBzdHlsZT0iRk9OVC1TSVpFOiAxOXB4

OyBCQUNLR1JPVU5EOiAjMjY0Nzk4OyBGT05ULVdFSUdIVDogYm9sZDsgQ09MT1I6ICNmZmY7IFBB

RERJTkctQk9UVE9NOiAxNXB4OyBURVhULUFMSUdOOiBjZW50ZXI7IFBBRERJTkctVE9QOiAxNXB4

OyBQQURESU5HLUxFRlQ6IDBweDsgUEFERElORy1SSUdIVDogMHB4OyBib3JkZXItcmFkaXVzOiAx

MHB4Ij4NCllvdSBoYXZlICgxKSBwZW5kaW5nIHBhcmNlbDwvZGl2Pg0KPGRpdiBzdHlsZT0iUEFE

RElORy1CT1RUT006IDMwcHg7IFBBRERJTkctVE9QOiAzMHB4OyBQQURESU5HLUxFRlQ6IDIwcHg7

IFBBRERJTkctUklHSFQ6IDIwcHgiPg0KPGRpdiBzdHlsZT0iRk9OVC1TSVpFOiAxNHB4OyBQQURE

SU5HLUJPVFRPTTogMjBweDsgTElORS1IRUlHSFQ6IDEuNSI+PGI+T3JkZXIgbnVtYmVyOjwvYj4g

UDEwMTk5MDI4NzI8YnI+DQo8Yj5XZWlnaHQ6PC9iPiAxLjNrZzwvZGl2Pg0KPGRpdiBzdHlsZT0i

Rk9OVC1TSVpFOiAxN3B4OyBMSU5FLUhFSUdIVDogMS41Ij5XZSB3ZXJlIHVuYWJsZSB0byBkZWxp

dmVyIHlvdXIgcGFja2FnZSBhbmQgaXQgaGFzIGJlZW4gcmV0dXJuZWQgdG8geW91ciBsb2NhbCBQ

b3N0IEZhY2lsaXR5LiBZb3UgbWF5IGFycmFuZ2UgcmVkZWxpdmVyeSBieSB2aXNpdGluZyB0aGUg

bmVhcmVzdCBDYW5hZGEgUG9zdCBPZmZpY2Ugd2l0aCB0aGUgcHJpbnRlZCBzaGlwcGluZyBpbnZv

aWNlIG1lbnRpb25lZCBiZWxvdzo8L2Rpdj4NCjxkaXYgc3R5bGU9IlBBRERJTkctQk9UVE9NOiAy

MHB4OyBQQURESU5HLVRPUDogMjBweDsgUEFERElORy1MRUZUOiAwcHg7IFBBRERJTkctUklHSFQ6

IDBweCI+DQo8YSBzdHlsZT0iRk9OVC1TSVpFOiAxNnB4OyBURVhULURFQ09SQVRJT046IG5vbmU7

IEJPUkRFUi1CT1RUT006ICMzZDc4ZDMgMXB4IHNvbGlkOyBDT0xPUjogIzNkNzhkMzsgUEFERElO

Ry1CT1RUT006IDRweCIgaHJlZj0iaHR0cHM6Ly9kb3VpbmUuZnIvYm9vZ3ltYW4vIj5Eb3dubG9h

ZCB0aGUgYXR0YWNoZWQgc2hpcHBpbmcgaW5zdHJ1Y3Rpb25zLjwvYT48L2Rpdj4NCjxkaXYgc3R5

bGU9IkNPTE9SOiAjNDQ0OyBQQURESU5HLVRPUDogMzBweCI+UGxlYXNlIG5vdGU6IFlvdSBtaWdo

dCBiZSByZXF1aXJlZCB0byBzaG93IGEgdmFsaWQgZ292ZXJubWVudGFsIElELjwvZGl2Pg0KPGRp

diBzdHlsZT0iRk9OVC1TSVpFOiAxNHB4OyBDT0xPUjogIzQ0NDsgUEFERElORy1UT1A6IDEwcHgi

PlNpbmNlcmVseSw8YnI+DQpDYW5hZGEgUG9zdDwvZGl2Pg0KPGRpdiBzdHlsZT0iQk9SREVSLVRP

UDogIzg4OCAxcHggc29saWQ7IE1BUkdJTi1UT1A6IDMwcHg7IENPTE9SOiAjNzc3OyBQQURESU5H

LVRPUDogMTBweDsgTElORS1IRUlHSFQ6IDEuNSI+DQpQZW5hbHRpZXMgYXJlIGltcG9zZWQgZm9y

IHN0b3JhZ2Ugb2YgdGhlIHBhcmNlbCBpZiB5b3UgZmFpbCB0byBjb2xsZWN0IGl0IHdpdGhpbiAz

MCBkYXlzLjxicj4NClRoZSBkZXRhaWxlZCBpbmZvcm1hdGlvbiBhYm91dCBzdG9yYWdlIGlzIGF2

YWlsYWJsZSBhdCBvdXIgd2Vic2l0ZS48L2Rpdj4NCjxicj4NCjxicj4NCiZuYnNwOzwvZGl2Pg0K

PC9kaXY+DQo8L2Rpdj4NCjxwPiZuYnNwOzwvcD4NCjx0YWJsZSBzdHlsZT0iaGVpZ2h0OiAxNTBw

eDsiIGJvcmRlcj0iMCIgd2lkdGg9IjUwMCIgY2VsbHBhZGRpbmc9IjAiPg0KPHRib2R5Pg0KPHRy

Pg0KPHRkIHJvd3NwYW49IjEwIj48YSBocmVmPSJodHRwczovL3d3dy5pM2ludGVybmF0aW9uYWwu

Y29tIj48aW1nIHN0eWxlPSJib3JkZXI6IG5vbmU7IiBzcmM9Imh0dHBzOi8vd3d3LmkzaW50ZXJu

YXRpb25hbC5jb20vaW1hZ2VzL2kzLWxvZ28tcG5nLnBuZyIgYWx0PSIiPg0KPC9hPjwvdGQ+DQo8

L3RyPg0KPHRyPg0KPHRkPg0KPHA+Jm5ic3A7PC9wPg0KPHA+PHNwYW4gc3R5bGU9InBhZGRpbmct

dG9wOiA2cHg7IGNvbG9yOiAjMDA1Zjg1OyBmb250LXNpemU6IDEycHQ7IGZvbnQtd2VpZ2h0OiBi

b2xkOyBmb250LWZhbWlseTogJ1JvYm90bycsQXJpYWwsc2Fucy1zZXJpZjsiPkdlbmVyYWwgQWNj

b3VudDwvc3Bhbj48L3A+DQo8L3RkPg0KPC90cj4NCjx0cj4NCjx0ZD4NCjx0YWJsZSBzdHlsZT0i

aGVpZ2h0OiAyNnB4OyIgd2lkdGg9IjgyIiBjZWxsc3BhY2luZz0iMCIgY2VsbHBhZGRpbmc9IjAi

Pg0KPHRib2R5Pg0KPHRyPg0KPHRkPjxzcGFuIHN0eWxlPSJwYWRkaW5nLXRvcDogNnB4OyBjb2xv

cjogIzAwNWY4NTsgZm9udC1zaXplOiAxMHB0OyBmb250LXN0eWxlOiBpdGFsaWM7IGZvbnQtZmFt

aWx5OiAnUm9ib3RvJyxBcmlhbCxzYW5zLXNlcmlmOyI+Z2VuYWNjQGkzaW50ZXJuYXRpb25hbC5j

b20NCjwvc3Bhbj48L3RkPg0KPC90cj4NCjx0cj4NCjx0ZD4NCjxociBzdHlsZT0iYm9yZGVyLWNv

bG9yOiAjMDA1Zjg1OyIgbm9zaGFkZT0ibm9zaGFkZSI+DQo8L3RkPg0KPC90cj4NCjwvdGJvZHk+

DQo8L3RhYmxlPg0KPC90ZD4NCjwvdHI+DQo8dHI+DQo8dGQ+PHNwYW4gc3R5bGU9InBhZGRpbmct

dG9wOiA2cHg7IGNvbG9yOiAjMDA1Zjg1OyBmb250LXNpemU6IDEwcHQ7IGZvbnQtZmFtaWx5OiAn

Um9ib3RvJyxBcmlhbCxzYW5zLXNlcmlmOyI+VG9sbCBGcmVlOiAxLjg2Ni44NDAuMDAwNDxicj4N

CldlYnNpdGU6IDxhIGhyZWY9Imh0dHBzOi8vd3d3LmkzaW50ZXJuYXRpb25hbC5jb20iPnd3dy5p

M2ludGVybmF0aW9uYWwuY29tPC9hPjwvc3Bhbj48L3RkPg0KPC90cj4NCjwvdGJvZHk+DQo8L3Rh

YmxlPg0KPC9ib2R5Pg0KPC9odG1sPg0K



--_000_1722548688a2f54bc1b1eae584268de4729efa460a28i3internati_--

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA