Intelcom phish
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 27 Jul 2026 14:09:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1woRd0-000000009x5-0WOW
for dave@doctor.nl2k.ab.ca;
Mon, 27 Jul 2026 14:08:46 -0600
Resent-From: The Doctor
Resent-Date: Mon, 27 Jul 2026 14:08:45 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from vps.fslocal.com ([199.83.208.249]:55226)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1woRCO-000000007a3-0key
for sales@nk.ca;
Mon, 27 Jul 2026 13:41:25 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=laravel.perksona.com; s=default; h=MIME-Version:Date:
Content-Transfer-Encoding:Message-ID:Subject:To:From:Content-Type:Sender:
Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From:
Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:
List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:
List-Archive; bh=sDNfpZErZvXaokLFnuFHft4Svn7KnO6x598cSskuhiQ=; b=WuToTHe2TAg7
i5zEUOYBMXafA/GJqPDRBf4vw+qCZvlYywCY020YGFkZek1BxehrYRdlx9F0+Jbx53PAIZW8l/7BD
pNwYLM7B6KMvLDGv8EI1zaX03DxnJh6+F0MhiIhXpk3Lkg4bBc+CH+y0q2QK4Gl7H9I3nqItpTe1O
jlp7ebVuJLTmb9UK1UO37AYTnxhnyu/k4zdkWKOGJKASx928iUWCXlmVaxKVwsJd9ABHalh1NrVin
YewHlT1LLhSa4b4CTqPo4YRZv+Eoo9kG4C0ds4r/fkXBnXehg+rKTAqiL6khd55PuG8331+2HJRzJ
JVzp0LTq41e5X4sZGKaAmw==;
Received: from [196.65.210.156] (port=55476 helo=[127.0.0.1])
by vps.fslocal.com with esmtpsa (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.4)
(envelope-from
id 1woRBW-00000007HG3-29UO
for sales@nk.ca;
Mon, 27 Jul 2026 15:40:22 -0400
Content-Type: text/html
From: Intelcom
To: sales@nk.ca
Subject: Intelcom Delivery Notification
Message-ID: <5b6fea77-2313-bfae-e3a5-87ae3077280a@laravel.perksona.com>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 27 Jul 2026 19:40:19 +0000
MIME-Version: 1.0
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - vps.fslocal.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - laravel.perksona.com
X-Get-Message-Sender-Via: vps.fslocal.com: authenticated_id: info-mjqu@laravel.perksona.com
X-Authenticated-Sender: vps.fslocal.com: info-mjqu@laravel.perksona.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 8.2
X-Spam_score_int: 82
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Intelcom Delivery Update
Content analysis details: (8.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[196.65.210.156 listed in dnsbl.ahbl.org]
[196.65.210.156 listed in dnsbl.ahbl.org]
[196.65.210.156 listed in dnsbl.ahbl.org]
[196.65.210.156 listed in dnsbl.ahbl.org]
[199.83.208.249 listed in dnsbl.ahbl.org]
[199.83.208.249 listed in dnsbl.ahbl.org]
[199.83.208.249 listed in dnsbl.ahbl.org]
[199.83.208.249 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[196.65.210.156 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[196.65.210.156 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[196.65.210.156 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[196.65.210.156 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[196.65.210.156 listed in sbl-xbl.spamhaus.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see
-0.0 SPF_PASS SPF: sender matches SPF record
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[199.83.208.249 listed in will-spam-for-food.eu.org]
[199.83.208.249 listed in will-spam-for-food.eu.org]
[199.83.208.249 listed in will-spam-for-food.eu.org]
[199.83.208.249 listed in will-spam-for-food.eu.org]
[199.83.208.249 listed in will-spam-for-food.eu.org]
[199.83.208.249 listed in will-spam-for-food.eu.org]
[199.83.208.249 listed in will-spam-for-food.eu.org]
[199.83.208.249 listed in will-spam-for-food.eu.org]
[196.65.210.156 listed in will-spam-for-food.eu.org]
[196.65.210.156 listed in will-spam-for-food.eu.org]
[196.65.210.156 listed in will-spam-for-food.eu.org]
[196.65.210.156 listed in will-spam-for-food.eu.org]
[196.65.210.156 listed in will-spam-for-food.eu.org]
[196.65.210.156 listed in will-spam-for-food.eu.org]
[196.65.210.156 listed in will-spam-for-food.eu.org]
[196.65.210.156 listed in will-spam-for-food.eu.org]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[199.83.208.249 listed in bl.score.senderscore.com]
Subject: {SPAM?} Intelcom Delivery Notification
MARGIN: 30px auto; border-radius: 10px; box-shadow: 0 4px 10px rgba(0,0,0,0=
.08)">
center; PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">
Intelcom
TEXT-ALIGN: center; PADDING-TOP: 30px; PADDING-LEFT: 30px; PADDING-RIGHT: =
30px">
Delivery Update
Your package is currently being processed and =
requires a small fee for customs handling.
18px; FONT-WEIGHT: bold; COLOR: #04ab94">Amount due: 2.96 CAD
Please confirm your delivery =
details to ensure a smooth delivery experience.
BACKGROUND: #04ab94; MARGIN-TOP: 20px; FONT-WEIGHT: bold; COLOR: #ffffff; =
PADDING-BOTTOM: 12px; PADDING-TOP: 12px; PADDING-LEFT: 25px; DISPLAY: =
inline-block; PADDING-RIGHT: 25px; border-radius: 6px">Manage My Delivery =
#f1f1f1; COLOR: #888; PADDING-BOTTOM: 20px; TEXT-ALIGN: center; =
PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">
This is an automated message. Please do not reply.=
© 2026 Intelcom Express