UPS Phish from Russia
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 01 Oct 2024 09:01:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from)
id 1sveMr-00000000P1m-0QOC
for dave@doctor.nl2k.ab.ca;
Tue, 01 Oct 2024 09:00:49 -0600
Resent-From: The Doctor
Resent-Date: Tue, 1 Oct 2024 09:00:48 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [87.251.81.147] (port=33463 helo=ewdmoburl.com)
by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))
id 1sveKE-00000000OoN-25RH
for support@nk.ca;
Tue, 01 Oct 2024 08:58:15 -0600
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nk.ca;
h=MIME-Version:To:From:Subject:Content-Type; i=support@nk.ca;
bh=RZzJ21xkyI6FELSQaRmoMwGELBM=;
b=H0du3JxMCD2qtkJqI0AxHwrU58NZpzdiu4rRMOHeZfsPDNok9etXUBRYrpGqwi9axDBoIoamosJF
CRmLLNYFsVIpiH4dFeLZ8ChZUIfaLwRjpsgJiu+61/5qOOimr6xuSya8rCf3ScOg30lPt3wYuZ0v
dK2q7TeVOGBm/qUs8ho=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nk.ca;
b=ERrk3VPkkrxc3RfgC6bKjAeYvVz08ppW+Zf9ZtvBRX17N0YZpH4EPM2gV5tH14UZBlfRvlIF68W6
kNngnTEk1mDYNbKIP7TXRT/QxgKWs8gp+wdo9oi7X9T27Z3+QP88zSp3fTIngGHPZa1yhgOJDJTk
PutXl83JyhK6bPAcnNo=;
MIME-Version: 1.0
To: support@nk.ca
From: UPS Shipping
Subject: You've got 1 package pending for delivery support!
Content-Type: text/html
X-Spam_score: 19.1
X-Spam_score_int: 191
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Track & Trace Get Your Suspended Package
Content analysis details: (19.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.4 MISSING_DATE Missing Date: header
0.1 MISSING_MID Missing Message-Id: header
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[87.251.81.147 listed in will-spam-for-food.eu.org]
[87.251.81.147 listed in will-spam-for-food.eu.org]
[87.251.81.147 listed in will-spam-for-food.eu.org]
[87.251.81.147 listed in will-spam-for-food.eu.org]
[87.251.81.147 listed in will-spam-for-food.eu.org]
[87.251.81.147 listed in will-spam-for-food.eu.org]
[87.251.81.147 listed in will-spam-for-food.eu.org]
[87.251.81.147 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[87.251.81.147 listed in dnsbl.ahbl.org]
[87.251.81.147 listed in dnsbl.ahbl.org]
[87.251.81.147 listed in dnsbl.ahbl.org]
[87.251.81.147 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[87.251.81.147 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[87.251.81.147 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[87.251.81.147 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[87.251.81.147 listed in dnsbl.ahbl.org]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: 185.95.84.78]
0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
[URI: 185.95.84.78]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: 185.95.84.78]
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
0.6 SCC_CANSPAM_2 BODY: Interesting compliance language
0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4
address
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.5 FSL_BULK_SIG Bulk signature with no Unsubscribe
Subject: {SPAM?} You've got 1 package pending for delivery support!
Track & Trace
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 01 Oct 2024 09:01:01 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from
id 1sveMr-00000000P1m-0QOC
for dave@doctor.nl2k.ab.ca;
Tue, 01 Oct 2024 09:00:49 -0600
Resent-From: The Doctor
Resent-Date: Tue, 1 Oct 2024 09:00:48 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [87.251.81.147] (port=33463 helo=ewdmoburl.com)
by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))
id 1sveKE-00000000OoN-25RH
for support@nk.ca;
Tue, 01 Oct 2024 08:58:15 -0600
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nk.ca;
h=MIME-Version:To:From:Subject:Content-Type; i=support@nk.ca;
bh=RZzJ21xkyI6FELSQaRmoMwGELBM=;
b=H0du3JxMCD2qtkJqI0AxHwrU58NZpzdiu4rRMOHeZfsPDNok9etXUBRYrpGqwi9axDBoIoamosJF
CRmLLNYFsVIpiH4dFeLZ8ChZUIfaLwRjpsgJiu+61/5qOOimr6xuSya8rCf3ScOg30lPt3wYuZ0v
dK2q7TeVOGBm/qUs8ho=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nk.ca;
b=ERrk3VPkkrxc3RfgC6bKjAeYvVz08ppW+Zf9ZtvBRX17N0YZpH4EPM2gV5tH14UZBlfRvlIF68W6
kNngnTEk1mDYNbKIP7TXRT/QxgKWs8gp+wdo9oi7X9T27Z3+QP88zSp3fTIngGHPZa1yhgOJDJTk
PutXl83JyhK6bPAcnNo=;
MIME-Version: 1.0
To: support@nk.ca
From: UPS Shipping
Subject: You've got 1 package pending for delivery support!
Content-Type: text/html
X-Spam_score: 19.1
X-Spam_score_int: 191
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Track & Trace Get Your Suspended Package
Content analysis details: (19.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.4 MISSING_DATE Missing Date: header
0.1 MISSING_MID Missing Message-Id: header
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[87.251.81.147 listed in will-spam-for-food.eu.org]
[87.251.81.147 listed in will-spam-for-food.eu.org]
[87.251.81.147 listed in will-spam-for-food.eu.org]
[87.251.81.147 listed in will-spam-for-food.eu.org]
[87.251.81.147 listed in will-spam-for-food.eu.org]
[87.251.81.147 listed in will-spam-for-food.eu.org]
[87.251.81.147 listed in will-spam-for-food.eu.org]
[87.251.81.147 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[87.251.81.147 listed in dnsbl.ahbl.org]
[87.251.81.147 listed in dnsbl.ahbl.org]
[87.251.81.147 listed in dnsbl.ahbl.org]
[87.251.81.147 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[87.251.81.147 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[87.251.81.147 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[87.251.81.147 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[87.251.81.147 listed in dnsbl.ahbl.org]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: 185.95.84.78]
0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
[URI: 185.95.84.78]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: 185.95.84.78]
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
0.6 SCC_CANSPAM_2 BODY: Interesting compliance language
0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4
address
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.5 FSL_BULK_SIG Bulk signature with no Unsubscribe
Subject: {SPAM?} You've got 1 package pending for delivery support!
| ||
| ||
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments