Telnet communications phish
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 25 Mar 2026 17:36:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1w5XlA-00000000Cma-1A1J
for dave@doctor.nl2k.ab.ca;
Wed, 25 Mar 2026 17:35:36 -0600
Resent-From: The Doctor
Resent-Date: Wed, 25 Mar 2026 17:35:36 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mx2.ite.net ([202.88.64.59]:60100 helo=mail.ite.net)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1w5V6t-00000000IEi-1Ore
for sales@nk.ca;
Wed, 25 Mar 2026 14:46:00 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mail.ite.net;
s=smtp1dkim; t=1774471493;
bh=vYVpOF546GSDt2FHJ0ur19u5evGX/drhX5uCOZoDhdc=;
h=From:Subject:Date:From;
b=SSNDJ0wfnTXlSyMBq4zzBZs2J+m9AeYOEFzpzA+TtLVmxffF3MM1YWcAQUfSCOgCG
D/JT5TeoqTqk6KYX7cVjX8xeoF6Yow+45J8Nwi/HcfVUvJTtacYDXtpYBmOUGZmDXa
73rvSgYjMwP/VB45KRP8dqPP42JmzzBZR7O5ZGfE=
Received: from User (unknown [173.255.170.165])
by mail.ite.net (Postfix) with ESMTPA id 1AD068CCB4E6;
Thu, 26 Mar 2026 06:44:19 +1000 (ChST)
From:
Subject: Account status update from Telnet Communications
Date: Wed, 25 Mar 2026 15:44:52 -0500
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_00B2_01C2AA85.3B74484C"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
X-Virus-Scanned: clamav-milter 1.4.3 at av01.ite.net
X-Virus-Status: Clean
X-Spam_score: 24.2
X-Spam_score_int: 242
X-Spam_bar: ++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: The Telnet Webmail DNS is being updated and all inactive
Telnet email accounts will be permanently deleted. Do you wish to continue
using the Telnet email services? If YES, then Re-validate your email account
immediately.
Content analysis details: (24.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 MISSING_MID Missing Message-Id: header
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[173.255.170.165 listed in dnsbl.ahbl.org]
[173.255.170.165 listed in dnsbl.ahbl.org]
[173.255.170.165 listed in dnsbl.ahbl.org]
[173.255.170.165 listed in dnsbl.ahbl.org]
[202.88.64.59 listed in dnsbl.ahbl.org]
[202.88.64.59 listed in dnsbl.ahbl.org]
[202.88.64.59 listed in dnsbl.ahbl.org]
[202.88.64.59 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[173.255.170.165 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[173.255.170.165 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[173.255.170.165 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[173.255.170.165 listed in dnsbl.ahbl.org]
0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 NSL_RCVD_FROM_USER Received from User
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
1.2 MISSING_HEADERS Missing To: header
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_IMAGE_RATIO_08 BODY: HTML has a low ratio of text to image area
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 STOCK_IMG_OUTLOOK Stock spam image part, with Outlook-like features
1.2 AXB_XMAILER_MIMEOLE_OL_1ECD5 Yet another X header trait
1.0 ZMIde_OutlookExpress Outlook Express should not be used anymore
0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.2 TVD_PH_SUBJ_META1 Email has a Phishy looking subject line
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
2.0 WINDOWS_7BITS Windows charset announced as 7 bit
2.0 MIXED_HREF_CASE Has href in mixed case
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
2.5 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool
Subject: {SPAM?} Account status update from Telnet Communications
This is a multi-part message in MIME format.
------=_NextPart_000_00B2_01C2AA85.3B74484C
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit

The Telnet Webmail DNS is being updated and all inactive Telnet email accounts will be permanently deleted.
Do you wish to continue using the Telnet email services? If YES, then Re-validate your email account immediately.
Telnet Communications.
http://www.telnetcommunication
------=_NextPart_000_00B2_01C2AA85.3B74484C
Content-Type: image/jpeg;
name="img1.jpg"
Content-Transfer-Encoding: base64
Content-ID: <00CBF0E10CBE$0240DB5C$0100007f@lniwxkczsdfgdyj>
------=_NextPart_000_00B2_01C2AA85.3B74484C--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 25 Mar 2026 17:36:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1w5XlA-00000000Cma-1A1J
for dave@doctor.nl2k.ab.ca;
Wed, 25 Mar 2026 17:35:36 -0600
Resent-From: The Doctor
Resent-Date: Wed, 25 Mar 2026 17:35:36 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mx2.ite.net ([202.88.64.59]:60100 helo=mail.ite.net)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1w5V6t-00000000IEi-1Ore
for sales@nk.ca;
Wed, 25 Mar 2026 14:46:00 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mail.ite.net;
s=smtp1dkim; t=1774471493;
bh=vYVpOF546GSDt2FHJ0ur19u5evGX/drhX5uCOZoDhdc=;
h=From:Subject:Date:From;
b=SSNDJ0wfnTXlSyMBq4zzBZs2J+m9AeYOEFzpzA+TtLVmxffF3MM1YWcAQUfSCOgCG
D/JT5TeoqTqk6KYX7cVjX8xeoF6Yow+45J8Nwi/HcfVUvJTtacYDXtpYBmOUGZmDXa
73rvSgYjMwP/VB45KRP8dqPP42JmzzBZR7O5ZGfE=
Received: from User (unknown [173.255.170.165])
by mail.ite.net (Postfix) with ESMTPA id 1AD068CCB4E6;
Thu, 26 Mar 2026 06:44:19 +1000 (ChST)
From:
Subject: Account status update from Telnet Communications
Date: Wed, 25 Mar 2026 15:44:52 -0500
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_00B2_01C2AA85.3B74484C"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
X-Virus-Scanned: clamav-milter 1.4.3 at av01.ite.net
X-Virus-Status: Clean
X-Spam_score: 24.2
X-Spam_score_int: 242
X-Spam_bar: ++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: The Telnet Webmail DNS is being updated and all inactive
Telnet email accounts will be permanently deleted. Do you wish to continue
using the Telnet email services? If YES, then Re-validate your email account
immediately.
Content analysis details: (24.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 MISSING_MID Missing Message-Id: header
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[173.255.170.165 listed in dnsbl.ahbl.org]
[173.255.170.165 listed in dnsbl.ahbl.org]
[173.255.170.165 listed in dnsbl.ahbl.org]
[173.255.170.165 listed in dnsbl.ahbl.org]
[202.88.64.59 listed in dnsbl.ahbl.org]
[202.88.64.59 listed in dnsbl.ahbl.org]
[202.88.64.59 listed in dnsbl.ahbl.org]
[202.88.64.59 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[173.255.170.165 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[173.255.170.165 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[173.255.170.165 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[173.255.170.165 listed in dnsbl.ahbl.org]
0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 NSL_RCVD_FROM_USER Received from User
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
1.2 MISSING_HEADERS Missing To: header
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_IMAGE_RATIO_08 BODY: HTML has a low ratio of text to image area
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 STOCK_IMG_OUTLOOK Stock spam image part, with Outlook-like features
1.2 AXB_XMAILER_MIMEOLE_OL_1ECD5 Yet another X header trait
1.0 ZMIde_OutlookExpress Outlook Express should not be used anymore
0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.2 TVD_PH_SUBJ_META1 Email has a Phishy looking subject line
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
2.0 WINDOWS_7BITS Windows charset announced as 7 bit
2.0 MIXED_HREF_CASE Has href in mixed case
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
2.5 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool
Subject: {SPAM?} Account status update from Telnet Communications
This is a multi-part message in MIME format.
------=_NextPart_000_00B2_01C2AA85.3B74484C
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
The Telnet Webmail DNS is being updated and all inactive Telnet email accounts will be permanently deleted.
Do you wish to continue using the Telnet email services? If YES, then Re-validate your email account immediately.
Telnet Communications.
http://www.telnetcommunication
------=_NextPart_000_00B2_01C2AA85.3B74484C
Content-Type: image/jpeg;
name="img1.jpg"
Content-Transfer-Encoding: base64
Content-ID: <00CBF0E10CBE$0240DB5C$0100007f@lniwxkczsdfgdyj>
------=_NextPart_000_00B2_01C2AA85.3B74484C--