Canada Post Phish
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 20 Sep 2026 05:28:31 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from)
id 1x8FiT-000000000aQ-1FZ7
for dave@doctor.nl2k.ab.ca;
Sun, 20 Sep 2026 05:28:17 -0600
Resent-From: The Doctor
Resent-Date: Sun, 20 Sep 2026 05:28:17 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [149.104.79.23] (port=46089 helo=mta.vorbereitung-ruhestand.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.100.1 (FreeBSD))
(envelope-from)
id 1x8Civ-000000004SF-1sww
for sales@nk.ca;
Sun, 20 Sep 2026 02:16:42 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=pmta1789811375;
d=vorbereitung-ruhestand.com;
h=Content-Type:MIME-Version:Subject:From:To:Date:Message-ID:Reply-To:
List-Unsubscribe:List-ID:List-Post:List-Owner:List-Archive:List-Help;
i=no-reply@vorbereitung-ruhestand.com;
bh=od1wdDW6y6ddZ74C6dLuaFwxmugINNkR1jN2Ki4ZhZM=;
b=djsd/tJNLmqWCjFZqRNHQOEZ6CrNsfDp7kp5hlcvckH849r/Sr1ei7wC93HrwBkJfkH89PHiHg6D
oXArqFDCpO4RrZwnR+OFbvdNXdT01R1L8YeFPOh2NpBkBM+/ghLskM9+VlssjEYo5W74UztM+JQw
KvyWnLV13fcdHxh4FFw=
Content-Type: multipart/alternative;
boundary="===============4867318697822099342=="
MIME-Version: 1.0
Subject: =?utf-8?b?Q+KBrOKBrOKBrOKArOKArOKArOKArOKArOKBruKBruKBrOKBrOKBrA==?=
=?utf-8?b?4oCs4oCs4oCs4oCs4oCs4oGu4oGuYeKBrOKBrOKBrOKArOKArOKArOKArOKArA==?=
=?utf-8?b?4oGu4oGubmHigazigazigazigKzigKzigKzigKzigKziga7iga5kYVDigazigaw=?=
=?utf-8?b?4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGub3N04oGs4oGs4oGs4oCs4oCs4oCs4oCs?=
=?utf-8?b?4oCs4oGu4oGu4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGuOiBVcOKBrA==?=
=?utf-8?b?4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGu4oGs4oGs4oGs4oCs4oCs4oCs4oCs?=
=?utf-8?b?4oCs4oGu4oGuZGHigazigazigazigKzigKzigKzigKzigKziga7iga50ZSBvbiB5?=
=?utf-8?b?b+KBrOKBrOKBrOKArOKArOKArOKArOKArOKBruKBrnVyIHNo4oGs4oGs4oGs4oCs?=
=?utf-8?b?4oCs4oCs4oCs4oCs4oGu4oGuaXBt4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu?=
=?utf-8?b?4oGuZW504oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGu4oGs4oGs4oGs4oCs?=
=?utf-8?b?4oCs4oCs4oCs4oCs4oGu4oGu4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGu?=
=?utf-8?b?4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGuIQ==?=
From: Noreply
To: sales@nk.ca
Date: Sat, 19 Sep 2026 13:22:51 +0000
Message-ID:
<178982417114.15427.1108616627936699913@vorbereitung-ruhestand.com>
X-Virtual-MTA: pmta-pool
X-Mailer-RecptId: c51d9fa2329d41b2
Reply-To: support@vorbereitung-ruhestand.com
List-Unsubscribe: =?utf-8?q?=3Cmailto=3Aunsubscribe=40vorbereitung-ruhestand?=
=?utf-8?q?=2Ecom=3Fsubject=3Dunsubscribe-c51d9fa2329d41b2=3E=2C_=3Chttps=3A?=
=?utf-8?q?//vorbereitung-ruhestand=2Ecom/unsubscribe=3Fid=3Dc51d9fa2329d41b?=
=?utf-8?q?2=26e=3Dc2FsZXNAbmsuY2E=3E?=
List-Unsubscribe-Post: List-Unsubscribe=One-Click
List-ID: main.vorbereitung-ruhestand.com
List-Post: NO
Feedback-ID: main:vorbereitung-ruhestand.com
X-Report-Abuse: Please report abuse here: abuse@vorbereitung-ruhestand.com
X-Complaints-To: abuse@vorbereitung-ruhestand.com
List-Owner:
List-Archive:
List-Help:
Organization: PayPal
Content-Language: en
X-Auto-Response-Suppress: OOF, AutoReply
Importance: normal
X-Spam_score: 17.4
X-Spam_score_int: 174
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: CanadaPost – Update about your shipment | Track & trace
CA2609186IH87KEY Dear customer,
Content analysis details: (17.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[149.104.79.23 listed in will-spam-for-food.eu.org]
[149.104.79.23 listed in will-spam-for-food.eu.org]
[149.104.79.23 listed in will-spam-for-food.eu.org]
[149.104.79.23 listed in will-spam-for-food.eu.org]
[149.104.79.23 listed in will-spam-for-food.eu.org]
[149.104.79.23 listed in will-spam-for-food.eu.org]
[149.104.79.23 listed in will-spam-for-food.eu.org]
[149.104.79.23 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[149.104.79.23 listed in dnsbl.ahbl.org]
[149.104.79.23 listed in dnsbl.ahbl.org]
[149.104.79.23 listed in dnsbl.ahbl.org]
[149.104.79.23 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[149.104.79.23 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[149.104.79.23 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[149.104.79.23 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[149.104.79.23 listed in dnsbl.ahbl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
15 GR_DOMAIN_EMARKE3 Header from spammer tool signature (emarke)
0.8 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[149.104.79.23 listed in bl.score.senderscore.com]
0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted
Colors in HTML
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list
manager
Subject: {SPAM?} =?utf-8?b?Q+KBrOKBrOKBrOKArOKArOKArOKArOKArOKBruKBruKBrOKBrOKBrA==?=
=?utf-8?b?4oCs4oCs4oCs4oCs4oCs4oGu4oGuYeKBrOKBrOKBrOKArOKArOKArOKArOKArA==?=
=?utf-8?b?4oGu4oGubmHigazigazigazigKzigKzigKzigKzigKziga7iga5kYVDigazigaw=?=
=?utf-8?b?4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGub3N04oGs4oGs4oGs4oCs4oCs4oCs4oCs?=
=?utf-8?b?4oCs4oGu4oGu4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGuOiBVcOKBrA==?=
=?utf-8?b?4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGu4oGs4oGs4oGs4oCs4oCs4oCs4oCs?=
=?utf-8?b?4oCs4oGu4oGuZGHigazigazigazigKzigKzigKzigKzigKziga7iga50ZSBvbiB5?=
=?utf-8?b?b+KBrOKBrOKBrOKArOKArOKArOKArOKArOKBruKBrnVyIHNo4oGs4oGs4oGs4oCs?=
=?utf-8?b?4oCs4oCs4oCs4oCs4oGu4oGuaXBt4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu?=
=?utf-8?b?4oGuZW504oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGu4oGs4oGs4oGs4oCs?=
=?utf-8?b?4oCs4oCs4oCs4oCs4oGu4oGu4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGu?=
=?utf-8?b?4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGuIQ==?=
CanadaPost
CanadaPost – Update about your shipment | Track & trace
CA2609186IH87KEY
Dear customer,
Your package has arrived and has passed customs control. The status is now: Customs fees outstanding.
One more step is required to release your package for delivery. Click the button below to view all the details of your shipment.
Outstanding customs charges
Track & trace CA2609186IH87KEY
Status Outstanding customs duties
Click the button below for the details of your shipment:
View shipment
Important information:
Timely action prevents delivery delays
The package is fully insured and traceable.
Avoid delays or returns
Yours sincerely
Canada Post
Verstuur je pakketten met de nr.1 van Nederland
CanadaPost
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 20 Sep 2026 05:28:31 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1x8FiT-000000000aQ-1FZ7
for dave@doctor.nl2k.ab.ca;
Sun, 20 Sep 2026 05:28:17 -0600
Resent-From: The Doctor
Resent-Date: Sun, 20 Sep 2026 05:28:17 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [149.104.79.23] (port=46089 helo=mta.vorbereitung-ruhestand.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.100.1 (FreeBSD))
(envelope-from
id 1x8Civ-000000004SF-1sww
for sales@nk.ca;
Sun, 20 Sep 2026 02:16:42 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=pmta1789811375;
d=vorbereitung-ruhestand.com;
h=Content-Type:MIME-Version:Subject:From:To:Date:Message-ID:Reply-To:
List-Unsubscribe:List-ID:List-Post:List-Owner:List-Archive:List-Help;
i=no-reply@vorbereitung-ruhestand.com;
bh=od1wdDW6y6ddZ74C6dLuaFwxmugINNkR1jN2Ki4ZhZM=;
b=djsd/tJNLmqWCjFZqRNHQOEZ6CrNsfDp7kp5hlcvckH849r/Sr1ei7wC93HrwBkJfkH89PHiHg6D
oXArqFDCpO4RrZwnR+OFbvdNXdT01R1L8YeFPOh2NpBkBM+/ghLskM9+VlssjEYo5W74UztM+JQw
KvyWnLV13fcdHxh4FFw=
Content-Type: multipart/alternative;
boundary="===============4867318697822099342=="
MIME-Version: 1.0
Subject: =?utf-8?b?Q+KBrOKBrOKBrOKArOKArOKArOKArOKArOKBruKBruKBrOKBrOKBrA==?=
=?utf-8?b?4oCs4oCs4oCs4oCs4oCs4oGu4oGuYeKBrOKBrOKBrOKArOKArOKArOKArOKArA==?=
=?utf-8?b?4oGu4oGubmHigazigazigazigKzigKzigKzigKzigKziga7iga5kYVDigazigaw=?=
=?utf-8?b?4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGub3N04oGs4oGs4oGs4oCs4oCs4oCs4oCs?=
=?utf-8?b?4oCs4oGu4oGu4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGuOiBVcOKBrA==?=
=?utf-8?b?4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGu4oGs4oGs4oGs4oCs4oCs4oCs4oCs?=
=?utf-8?b?4oCs4oGu4oGuZGHigazigazigazigKzigKzigKzigKzigKziga7iga50ZSBvbiB5?=
=?utf-8?b?b+KBrOKBrOKBrOKArOKArOKArOKArOKArOKBruKBrnVyIHNo4oGs4oGs4oGs4oCs?=
=?utf-8?b?4oCs4oCs4oCs4oCs4oGu4oGuaXBt4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu?=
=?utf-8?b?4oGuZW504oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGu4oGs4oGs4oGs4oCs?=
=?utf-8?b?4oCs4oCs4oCs4oCs4oGu4oGu4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGu?=
=?utf-8?b?4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGuIQ==?=
From: Noreply
To: sales@nk.ca
Date: Sat, 19 Sep 2026 13:22:51 +0000
Message-ID:
<178982417114.15427.1108616627936699913@vorbereitung-ruhestand.com>
X-Virtual-MTA: pmta-pool
X-Mailer-RecptId: c51d9fa2329d41b2
Reply-To: support@vorbereitung-ruhestand.com
List-Unsubscribe: =?utf-8?q?=3Cmailto=3Aunsubscribe=40vorbereitung-ruhestand?=
=?utf-8?q?=2Ecom=3Fsubject=3Dunsubscribe-c51d9fa2329d41b2=3E=2C_=3Chttps=3A?=
=?utf-8?q?//vorbereitung-ruhestand=2Ecom/unsubscribe=3Fid=3Dc51d9fa2329d41b?=
=?utf-8?q?2=26e=3Dc2FsZXNAbmsuY2E=3E?=
List-Unsubscribe-Post: List-Unsubscribe=One-Click
List-ID: main.vorbereitung-ruhestand.com
List-Post: NO
Feedback-ID: main:vorbereitung-ruhestand.com
X-Report-Abuse: Please report abuse here: abuse@vorbereitung-ruhestand.com
X-Complaints-To: abuse@vorbereitung-ruhestand.com
List-Owner:
List-Archive:
List-Help:
Organization: PayPal
Content-Language: en
X-Auto-Response-Suppress: OOF, AutoReply
Importance: normal
X-Spam_score: 17.4
X-Spam_score_int: 174
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: CanadaPost – Update about your shipment | Track & trace
CA2609186IH87KEY Dear customer,
Content analysis details: (17.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[149.104.79.23 listed in will-spam-for-food.eu.org]
[149.104.79.23 listed in will-spam-for-food.eu.org]
[149.104.79.23 listed in will-spam-for-food.eu.org]
[149.104.79.23 listed in will-spam-for-food.eu.org]
[149.104.79.23 listed in will-spam-for-food.eu.org]
[149.104.79.23 listed in will-spam-for-food.eu.org]
[149.104.79.23 listed in will-spam-for-food.eu.org]
[149.104.79.23 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[149.104.79.23 listed in dnsbl.ahbl.org]
[149.104.79.23 listed in dnsbl.ahbl.org]
[149.104.79.23 listed in dnsbl.ahbl.org]
[149.104.79.23 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[149.104.79.23 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[149.104.79.23 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[149.104.79.23 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[149.104.79.23 listed in dnsbl.ahbl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
15 GR_DOMAIN_EMARKE3 Header from spammer tool signature (emarke)
0.8 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[149.104.79.23 listed in bl.score.senderscore.com]
0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted
Colors in HTML
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list
manager
Subject: {SPAM?} =?utf-8?b?Q+KBrOKBrOKBrOKArOKArOKArOKArOKArOKBruKBruKBrOKBrOKBrA==?=
=?utf-8?b?4oCs4oCs4oCs4oCs4oCs4oGu4oGuYeKBrOKBrOKBrOKArOKArOKArOKArOKArA==?=
=?utf-8?b?4oGu4oGubmHigazigazigazigKzigKzigKzigKzigKziga7iga5kYVDigazigaw=?=
=?utf-8?b?4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGub3N04oGs4oGs4oGs4oCs4oCs4oCs4oCs?=
=?utf-8?b?4oCs4oGu4oGu4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGuOiBVcOKBrA==?=
=?utf-8?b?4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGu4oGs4oGs4oGs4oCs4oCs4oCs4oCs?=
=?utf-8?b?4oCs4oGu4oGuZGHigazigazigazigKzigKzigKzigKzigKziga7iga50ZSBvbiB5?=
=?utf-8?b?b+KBrOKBrOKBrOKArOKArOKArOKArOKArOKBruKBrnVyIHNo4oGs4oGs4oGs4oCs?=
=?utf-8?b?4oCs4oCs4oCs4oCs4oGu4oGuaXBt4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu?=
=?utf-8?b?4oGuZW504oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGu4oGs4oGs4oGs4oCs?=
=?utf-8?b?4oCs4oCs4oCs4oCs4oGu4oGu4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGu?=
=?utf-8?b?4oGs4oGs4oGs4oCs4oCs4oCs4oCs4oCs4oGu4oGuIQ==?=
CanadaPost
CanadaPost – Update about your shipment | Track & trace
CA2609186IH87KEY
Dear customer,
Your package has arrived and has passed customs control. The status is now: Customs fees outstanding.
One more step is required to release your package for delivery. Click the button below to view all the details of your shipment.
Outstanding customs charges
Track & trace CA2609186IH87KEY
Status Outstanding customs duties
Click the button below for the details of your shipment:
View shipment
Important information:
Timely action prevents delivery delays
The package is fully insured and traceable.
Avoid delays or returns
Yours sincerely
Canada Post
Verstuur je pakketten met de nr.1 van Nederland
CanadaPost
