Dragonfly phish
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 19 Oct 2026 13:01:27 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xIsbo-00000000LYc-0LuC
for dave@doctor.nl2k.ab.ca;
Mon, 19 Oct 2026 13:01:20 -0600
Resent-From: The Doctor
Resent-Date: Mon, 19 Oct 2026 13:01:19 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from server.ace-hosting.com ([174.138.172.98]:56944)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xIo5z-00000000K0B-1YEN
for root@nk.ca;
Mon, 19 Oct 2026 08:12:25 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=ppsolution.com; s=default; h=MIME-Version:Date:Content-Transfer-Encoding:
Message-ID:Subject:To:From:Content-Type:Sender:Reply-To:Cc:Content-ID:
Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive;
bh=pAVf/Wu3kgkRSvEFNd6kGxCfAQpJsVQMQkO82GE7LHQ=; b=G6QwvJpGRgf3vL+gyKkVbbMvIx
aMp5W+SVTmJI3Bf2KOtYrRNOVQ2c635ocnpH9XtUikAZJJHi9BoGeFwz6vMNbPM+LRUi2S3Kty9NS
df4g3dutUlYJAog8KKlb2WyWaotUgpjX0YRV0kiMFSr4IrRMtw9tuX+5Ym7ES9u4D4Csmslb+6x8w
KjHBd/keePniPQImf9egmjLIAewZ8GmM7rcVQ3qoHiPnaZT7MjHRfYN9QF2gLfgRz10q23b/OatUp
j4zHenU24i6/L/eVMhSfDHqStZUGDgycWOQSanr/Ar2jReD3et6jDvOsKCGH8S45HVnOq5ublGa7C
gVUuxeUA==;
Received: from [196.65.228.149] (port=56494 helo=[127.0.0.1])
by server.ace-hosting.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.100.1)
(envelope-from
id 1xIo58-000000007Ma-3y0x
for root@nk.ca;
Mon, 19 Oct 2026 21:11:18 +0700
Content-Type: text/html
From: Dragonfly
To: root@nk.ca
Subject: Dragonfly Delivery Notification
Message-ID: <8b49b314-8dd3-c588-2262-f285084a6019@ppsolution.com>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 19 Oct 2026 14:11:16 +0000
MIME-Version: 1.0
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.ace-hosting.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - ppsolution.com
X-Get-Message-Sender-Via: server.ace-hosting.com: authenticated_id: jayanto@ppsolution.com
X-Authenticated-Sender: server.ace-hosting.com: jayanto@ppsolution.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 7.3
X-Spam_score_int: 73
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dragonfly Express. Dear Customer,
Content analysis details: (7.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[196.65.228.149 listed in dnsbl.ahbl.org]
[196.65.228.149 listed in dnsbl.ahbl.org]
[196.65.228.149 listed in dnsbl.ahbl.org]
[196.65.228.149 listed in dnsbl.ahbl.org]
[174.138.172.98 listed in dnsbl.ahbl.org]
[174.138.172.98 listed in dnsbl.ahbl.org]
[174.138.172.98 listed in dnsbl.ahbl.org]
[174.138.172.98 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[196.65.228.149 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[196.65.228.149 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[196.65.228.149 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[196.65.228.149 listed in dnsbl.ahbl.org]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[174.138.172.98 listed in bb.barracudacentral.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[196.65.228.149 listed in will-spam-for-food.eu.org]
[196.65.228.149 listed in will-spam-for-food.eu.org]
[196.65.228.149 listed in will-spam-for-food.eu.org]
[196.65.228.149 listed in will-spam-for-food.eu.org]
[196.65.228.149 listed in will-spam-for-food.eu.org]
[196.65.228.149 listed in will-spam-for-food.eu.org]
[196.65.228.149 listed in will-spam-for-food.eu.org]
[196.65.228.149 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
[174.138.172.98 listed in will-spam-for-food.eu.org]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[174.138.172.98 listed in bl.score.senderscore.com]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} Dragonfly Delivery Notification
X-Antivirus: AVG (VPS 261018-6, 10/18/2026), Inbound message
X-Antivirus-Status: Clean
hidden; MAX-WIDTH: 600px; BACKGROUND: #fff; MARGIN: 20px auto; =
border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">
align-items: center; justify-content: center">
30px; FONT-WEIGHT: bold; COLOR: #fff; FONT-STYLE: italic">Dragonfly Express=
.
PADDING-TOP: 24px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">
DISPLAY: inline-block; PADDING-RIGHT: 6px">Dear Customer,
1.6">
Goods imported into Canada may be subject to applicable duties =
and/or taxes. Carriers are authorized by the. to process occasional =
shipments on behalf of the importer or owner and may remit applicable =
duties and taxes.
However, a parcel belonging to you has been held =
by customs due to missing declaration details from the sender. Please pay: =
4.95 CAD
in duties and taxes as soon as =
possible using the button below: taxes, or other charges are actually owed.=
href=3D"https://dragonfly-servic.duckdns.org/Dragonfly_Shipping/" =
style=3D"FONT-SIZE: 14px; TEXT-DECORATION: none; BACKGROUND: #04ab94; =
FONT-WEIGHT: bold; COLOR: #fff; PADDING-BOTTOM: 10px; PADDING-TOP: 10px; =
PADDING-LEFT: 20px; DISPLAY: inline-block; PADDING-RIGHT: 20px; =
border-radius: 5px">Track my package
COLOR: #000">Thank you for choosing Dragonfly Express.
COLOR: #717171; PADDING-BOTTOM: 20px; TEXT-ALIGN: center; PADDING-TOP: =
20px; PADDING-LEFT: 20px; MARGIN: 0px auto; PADDING-RIGHT: 20px; =
border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">
This email was sent by an automated system=
. Please do not reply official:
© 2026 =
Intelcom Express - Dragonfly Express. All rights reserved.