Telnet Communications phish
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 25 Mar 2026 13:39:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1w5U3j-0000000032T-0s72
for dave@doctor.nl2k.ab.ca;
Wed, 25 Mar 2026 13:38:31 -0600
Resent-From: The Doctor
Resent-Date: Wed, 25 Mar 2026 13:38:30 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mx.ite.net ([202.88.64.59]:55286 helo=mail.ite.net)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1w5Sfw-00000000Hnq-1UMY
for sales@nk.ca;
Wed, 25 Mar 2026 12:10:01 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mail.ite.net;
s=smtp1dkim; t=1774462135;
bh=6e+XtYHY/5JA0scGcYKU21kCZX4mWfr3Mhra8NuvUCk=;
h=From:Subject:Date:From;
b=LLGO13WUG5ClUocYj/4bHia9F33cPVf9yL3x8JOkBZlxoalliF0sIMzrpnnT+0EUB
sQMQMD1EpHERV7lmF0zRrZaAkaUT0FvDoSoQM3hCN1lFJkWvtS3DxPPRZoR73wvl2b
bYGcJhZF1XOfFsDoaZF280wyzNNOHPC0fuT7Gm+k=
Received: from User (unknown [173.255.170.165])
by mail.ite.net (Postfix) with ESMTPA id 8CCBF8CCB063;
Thu, 26 Mar 2026 04:08:21 +1000 (ChST)
From: "Telnet Communications"
Subject: Are you still a Telnet Customer?
Date: Wed, 25 Mar 2026 13:08:54 -0500
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_00DD_01C2A75B.6E7FE5F0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
X-Virus-Scanned: clamav-milter 1.4.3 at av01.ite.net
X-Virus-Status: Clean
X-Spam_score: 22.4
X-Spam_score_int: 224
X-Spam_bar: ++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: The Telnet Webmail DNS is being updated and all inactive
Telnet email accounts will be permanently deleted. Do you wish to continue
using the Telnet email services? If YES, then Re-validate your email account
immediately.
Content analysis details: (22.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 MISSING_MID Missing Message-Id: header
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[202.88.64.59 listed in dnsbl.ahbl.org]
[202.88.64.59 listed in dnsbl.ahbl.org]
[202.88.64.59 listed in dnsbl.ahbl.org]
[202.88.64.59 listed in dnsbl.ahbl.org]
[173.255.170.165 listed in dnsbl.ahbl.org]
[173.255.170.165 listed in dnsbl.ahbl.org]
[173.255.170.165 listed in dnsbl.ahbl.org]
[173.255.170.165 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[202.88.64.59 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[202.88.64.59 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[202.88.64.59 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[202.88.64.59 listed in dnsbl.ahbl.org]
0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 NSL_RCVD_FROM_USER Received from User
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
1.2 MISSING_HEADERS Missing To: header
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_IMAGE_RATIO_08 BODY: HTML has a low ratio of text to image area
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
2.0 WINDOWS_7BITS Windows charset announced as 7 bit
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.7 STOCK_IMG_OUTLOOK Stock spam image part, with Outlook-like features
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FROM_MISSP_USER From misspaced, from "User"
2.0 MIXED_HREF_CASE Has href in mixed case
1.0 ZMIde_OutlookExpress Outlook Express should not be used anymore
0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FROM_MISSPACED From: missing whitespace
2.5 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
Subject: {SPAM?} Are you still a Telnet Customer?
This is a multi-part message in MIME format.
------=_NextPart_000_00DD_01C2A75B.6E7FE5F0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit

The Telnet Webmail DNS is being updated and all inactive Telnet email accounts will be permanently deleted.
Do you wish to continue using the Telnet email services? If YES, then Re-validate your email account immediately.
Telnet Communications.
http://www.telnetcommunication
------=_NextPart_000_00DD_01C2A75B.6E7FE5F0
Content-Type: image/jpeg;
name="img1.jpg"
Content-Transfer-Encoding: base64
Content-ID: <00B2C1E9B417$007492BA$0100007f@hcivklfxriyngkm>
------=_NextPart_000_00DD_01C2A75B.6E7FE5F0--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 25 Mar 2026 13:39:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1w5U3j-0000000032T-0s72
for dave@doctor.nl2k.ab.ca;
Wed, 25 Mar 2026 13:38:31 -0600
Resent-From: The Doctor
Resent-Date: Wed, 25 Mar 2026 13:38:30 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mx.ite.net ([202.88.64.59]:55286 helo=mail.ite.net)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1w5Sfw-00000000Hnq-1UMY
for sales@nk.ca;
Wed, 25 Mar 2026 12:10:01 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mail.ite.net;
s=smtp1dkim; t=1774462135;
bh=6e+XtYHY/5JA0scGcYKU21kCZX4mWfr3Mhra8NuvUCk=;
h=From:Subject:Date:From;
b=LLGO13WUG5ClUocYj/4bHia9F33cPVf9yL3x8JOkBZlxoalliF0sIMzrpnnT+0EUB
sQMQMD1EpHERV7lmF0zRrZaAkaUT0FvDoSoQM3hCN1lFJkWvtS3DxPPRZoR73wvl2b
bYGcJhZF1XOfFsDoaZF280wyzNNOHPC0fuT7Gm+k=
Received: from User (unknown [173.255.170.165])
by mail.ite.net (Postfix) with ESMTPA id 8CCBF8CCB063;
Thu, 26 Mar 2026 04:08:21 +1000 (ChST)
From: "Telnet Communications"
Subject: Are you still a Telnet Customer?
Date: Wed, 25 Mar 2026 13:08:54 -0500
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_00DD_01C2A75B.6E7FE5F0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
X-Virus-Scanned: clamav-milter 1.4.3 at av01.ite.net
X-Virus-Status: Clean
X-Spam_score: 22.4
X-Spam_score_int: 224
X-Spam_bar: ++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: The Telnet Webmail DNS is being updated and all inactive
Telnet email accounts will be permanently deleted. Do you wish to continue
using the Telnet email services? If YES, then Re-validate your email account
immediately.
Content analysis details: (22.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 MISSING_MID Missing Message-Id: header
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[173.255.170.165 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
[202.88.64.59 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[202.88.64.59 listed in dnsbl.ahbl.org]
[202.88.64.59 listed in dnsbl.ahbl.org]
[202.88.64.59 listed in dnsbl.ahbl.org]
[202.88.64.59 listed in dnsbl.ahbl.org]
[173.255.170.165 listed in dnsbl.ahbl.org]
[173.255.170.165 listed in dnsbl.ahbl.org]
[173.255.170.165 listed in dnsbl.ahbl.org]
[173.255.170.165 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[202.88.64.59 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[202.88.64.59 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[202.88.64.59 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[202.88.64.59 listed in dnsbl.ahbl.org]
0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 NSL_RCVD_FROM_USER Received from User
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
1.2 MISSING_HEADERS Missing To: header
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_IMAGE_RATIO_08 BODY: HTML has a low ratio of text to image area
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
2.0 WINDOWS_7BITS Windows charset announced as 7 bit
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.7 STOCK_IMG_OUTLOOK Stock spam image part, with Outlook-like features
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
0.0 FROM_MISSP_USER From misspaced, from "User"
2.0 MIXED_HREF_CASE Has href in mixed case
1.0 ZMIde_OutlookExpress Outlook Express should not be used anymore
0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.0 FROM_MISSPACED From: missing whitespace
2.5 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
Subject: {SPAM?} Are you still a Telnet Customer?
This is a multi-part message in MIME format.
------=_NextPart_000_00DD_01C2A75B.6E7FE5F0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
The Telnet Webmail DNS is being updated and all inactive Telnet email accounts will be permanently deleted.
Do you wish to continue using the Telnet email services? If YES, then Re-validate your email account immediately.
Telnet Communications.
http://www.telnetcommunication
------=_NextPart_000_00DD_01C2A75B.6E7FE5F0
Content-Type: image/jpeg;
name="img1.jpg"
Content-Transfer-Encoding: base64
Content-ID: <00B2C1E9B417$007492BA$0100007f@hcivklfxriyngkm>
------=_NextPart_000_00DD_01C2A75B.6E7FE5F0--