Dragonfly Express phishing
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 05 Sep 2026 08:12:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from
id 1x2r7Z-00000000Be5-2hmT
for dave@doctor.nl2k.ab.ca;
Sat, 05 Sep 2026 08:11:53 -0600
Resent-From: The Doctor
Resent-Date: Sat, 5 Sep 2026 08:11:53 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from server.ace-hosting.com ([174.138.172.98]:45644)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.100 (FreeBSD))
(envelope-from
id 1x2qzY-00000000Pkz-2YGb
for sales@nk.ca;
Sat, 05 Sep 2026 08:03:58 -0600
Received: from [196.64.125.203] (port=59514 helo=[127.0.0.1])
by server.ace-hosting.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.99.5)
(envelope-from
id 1x2qyg-000000004qk-0tRb
for sales@nk.ca;
Sat, 05 Sep 2026 21:02:40 +0700
Content-Type: text/html
From: Dragonfly
To: sales@nk.ca
Subject: Dragonfly Delivery Notification
Message-ID: <49a46b01-3313-a051-78a5-384c03b5d91a@ppsolution.com>
Content-Transfer-Encoding: quoted-printable
Date: Sat, 05 Sep 2026 14:02:38 +0000
MIME-Version: 1.0
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.ace-hosting.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - ppsolution.com
X-Get-Message-Sender-Via: server.ace-hosting.com: authenticated_id: jayanto@ppsolution.com
X-Authenticated-Sender: server.ace-hosting.com: jayanto@ppsolution.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 7.0
X-Spam_score_int: 70
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dragonfly Express. Dear Customer,
Content analysis details: (7.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[174.138.172.98 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[174.138.172.98 listed in wl.mailspike.net]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[174.138.172.98 listed in bb.barracudacentral.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[196.64.125.203 listed in will-spam-for-food.eu.org]
[196.64.125.203 listed in will-spam-for-food.eu.org]
[196.64.125.203 listed in will-spam-for-food.eu.org]
[196.64.125.203 listed in will-spam-for-food.eu.org]
[196.64.125.203 listed in will-spam-for-food.eu.org]
[196.64.125.203 listed in will-spam-for-food.eu.org]
[196.64.125.203 listed in will-spam-for-food.eu.org]
[196.64.125.203 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[196.64.125.203 listed in dnsbl.ahbl.org]
[196.64.125.203 listed in dnsbl.ahbl.org]
[196.64.125.203 listed in dnsbl.ahbl.org]
[196.64.125.203 listed in dnsbl.ahbl.org]
[174.138.172.98 listed in dnsbl.ahbl.org]
[174.138.172.98 listed in dnsbl.ahbl.org]
[174.138.172.98 listed in dnsbl.ahbl.org]
[174.138.172.98 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[196.64.125.203 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[196.64.125.203 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[196.64.125.203 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[196.64.125.203 listed in dnsbl.ahbl.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
Subject: {SPAM?} Dragonfly Delivery Notification
hidden; MAX-WIDTH: 600px; BACKGROUND: #fff; MARGIN: 20px auto; =
border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">
align-items: center; justify-content: center">
30px; FONT-WEIGHT: bold; COLOR: #fff; FONT-STYLE: italic">Dragonfly Express=
.
PADDING-TOP: 24px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">
DISPLAY: inline-block; PADDING-RIGHT: 6px">Dear Customer,
1.6">
Goods imported into Canada may be subject to applicable duties =
and/or taxes. Carriers are authorized by the. to process occasional =
shipments on behalf of the importer or owner and may remit applicable =
duties and taxes.
However, a parcel belonging to you has been held =
by customs due to missing declaration details from the sender. Please pay: =
4.95 CAD
in duties and taxes as soon as =
possible using the button below: taxes, or other charges are actually owed.=
href=3D"https://dragonfly-service.duckdns.org/Dragonfly_Shipping/" =
style=3D"FONT-SIZE: 14px; TEXT-DECORATION: none; BACKGROUND: #04ab94; =
FONT-WEIGHT: bold; COLOR: #fff; PADDING-BOTTOM: 10px; PADDING-TOP: 10px; =
PADDING-LEFT: 20px; DISPLAY: inline-block; PADDING-RIGHT: 20px; =
border-radius: 5px">Track my package
COLOR: #000">Thank you for choosing Dragonfly Express.
COLOR: #717171; PADDING-BOTTOM: 20px; TEXT-ALIGN: center; PADDING-TOP: =
20px; PADDING-LEFT: 20px; MARGIN: 0px auto; PADDING-RIGHT: 20px; =
border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">
This email was sent by an automated system=
. Please do not reply official:
© 2026 =
Intelcom Express - Dragonfly Express. All rights reserved.