Dragonfly phish
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 10 Nov 2026 00:22:59 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xQfFH-00000000J4q-1Ywu
for dave@doctor.nl2k.ab.ca;
Tue, 10 Nov 2026 00:22:15 -0600
Resent-From: The Doctor
Resent-Date: Tue, 10 Nov 2026 00:22:15 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from us19.acugis-dns.com ([152.53.80.197]:35920)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xQa6V-00000000IBZ-3NSo
for sales@nk.ca;
Mon, 09 Nov 2026 18:52:59 -0600
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=llanogas.webgis1.com; s=default; h=MIME-Version:Date:
Content-Transfer-Encoding:Message-ID:Subject:To:From:Content-Type:Sender:
Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From:
Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:
List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post:List-Subscribe:
List-Post:List-Owner:List-Archive;
bh=CNLLG+q/NrzvggOFJw4nyhoJqTyiqAh9UheFqURKN/M=; b=zh+12wYrj4apGoSZH+NfwPSIVS
gVmOPgWO61w5ZFCT+LElGC+tB8Ph68cdT3WAeNu1lGrVwxbutVMNHr+SdAWmbc77fXLhC3cckrve/
ry1egUT4pbZHHvjYVtOC2+EQHeynMfWucMs8IrR3DxdEds8cuV2IBCGYEBvc/hUQldcJ9yNT1uW7F
eqxaMHs5u9SOc1IobM+hLD30jva0VuzTOEbO+b8WaFh+caNcOShszlEnrNYfrogNRQHr9dgorhuHQ
m6Ul52eB/xL7cIw604Vnj5wFNwopGWLzr1NoDQqH85OmsCvOU+XZhBFcA9AJyTGJkTYy/Lqj1jy4T
ckxsgNfg==;
Received: from [196.75.116.150] (port=55374 helo=[127.0.0.1])
by us19.acugis-dns.com with esmtpsa (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100.1)
(envelope-from
id 1xQa5c-0000000B4mr-1BeI
for sales@nk.ca;
Tue, 10 Nov 2026 01:51:55 +0100
Content-Type: text/html
From: Dragonfly
To: sales@nk.ca
Subject: Dragonfly Delivery Notification
Message-ID:
Content-Transfer-Encoding: quoted-printable
Date: Tue, 10 Nov 2026 00:51:53 +0000
MIME-Version: 1.0
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - us19.acugis-dns.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - llanogas.webgis1.com
X-Get-Message-Sender-Via: us19.acugis-dns.com: authenticated_id: info-pvix@llanogas.webgis1.com
X-Authenticated-Sender: us19.acugis-dns.com: info-pvix@llanogas.webgis1.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 9.9
X-Spam_score_int: 99
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dragonfly Express. Dear Customer,
Content analysis details: (9.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[196.75.116.150 listed in will-spam-for-food.eu.org]
[196.75.116.150 listed in will-spam-for-food.eu.org]
[196.75.116.150 listed in will-spam-for-food.eu.org]
[196.75.116.150 listed in will-spam-for-food.eu.org]
[196.75.116.150 listed in will-spam-for-food.eu.org]
[196.75.116.150 listed in will-spam-for-food.eu.org]
[196.75.116.150 listed in will-spam-for-food.eu.org]
[196.75.116.150 listed in will-spam-for-food.eu.org]
[152.53.80.197 listed in will-spam-for-food.eu.org]
[152.53.80.197 listed in will-spam-for-food.eu.org]
[152.53.80.197 listed in will-spam-for-food.eu.org]
[152.53.80.197 listed in will-spam-for-food.eu.org]
[152.53.80.197 listed in will-spam-for-food.eu.org]
[152.53.80.197 listed in will-spam-for-food.eu.org]
[152.53.80.197 listed in will-spam-for-food.eu.org]
[152.53.80.197 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[196.75.116.150 listed in dnsbl.ahbl.org]
[196.75.116.150 listed in dnsbl.ahbl.org]
[196.75.116.150 listed in dnsbl.ahbl.org]
[196.75.116.150 listed in dnsbl.ahbl.org]
[152.53.80.197 listed in dnsbl.ahbl.org]
[152.53.80.197 listed in dnsbl.ahbl.org]
[152.53.80.197 listed in dnsbl.ahbl.org]
[152.53.80.197 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[196.75.116.150 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[196.75.116.150 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[196.75.116.150 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[196.75.116.150 listed in dnsbl.ahbl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
Subject: {SPAM?} Dragonfly Delivery Notification
hidden; MAX-WIDTH: 600px; BACKGROUND: #fff; MARGIN: 20px auto; =
border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">
align-items: center; justify-content: center">
30px; FONT-WEIGHT: bold; COLOR: #fff; FONT-STYLE: italic">Dragonfly Express=
.
PADDING-TOP: 24px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">
DISPLAY: inline-block; PADDING-RIGHT: 6px">Dear Customer,
1.6">
Goods imported into Canada may be subject to applicable duties =
and/or taxes. Carriers are authorized by the. to process occasional =
shipments on behalf of the importer or owner and may remit applicable =
duties and taxes.
However, a parcel belonging to you has been held =
by customs due to missing declaration details from the sender. Please pay: =
4.95 CAD
in duties and taxes as soon as =
possible using the button below: taxes, or other charges are actually owed.=
href=3D"https://dragonfly-exp.duckdns.org/Dragonfly_Shipping/" =
style=3D"FONT-SIZE: 14px; TEXT-DECORATION: none; BACKGROUND: #04ab94; =
FONT-WEIGHT: bold; COLOR: #fff; PADDING-BOTTOM: 10px; PADDING-TOP: 10px; =
PADDING-LEFT: 20px; DISPLAY: inline-block; PADDING-RIGHT: 20px; =
border-radius: 5px">Track my package
COLOR: #000">Thank you for choosing Dragonfly Express.
COLOR: #717171; PADDING-BOTTOM: 20px; TEXT-ALIGN: center; PADDING-TOP: =
20px; PADDING-LEFT: 20px; MARGIN: 0px auto; PADDING-RIGHT: 20px; =
border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">
This email was sent by an automated system=
. Please do not reply official:
© 2026 =
Intelcom Express - Dragonfly Express. All rights reserved.