Package Phishing
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 07 May 2026 12:38:00 -0600
Received: from nodels16-ca.n0c.com ([209.16.158.204]:44385)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1wL3bD-00000000HC1-2ZQf
for dave@doctor.nl2k.ab.ca;
Thu, 07 May 2026 12:37:37 -0600
Received: from 127.0.0.1 (unknown [10.123.1.155])
by nodels16-ca.n0c.com (Postfix) with ESMTPA id 215DA806F2;
Thu, 7 May 2026 18:36:29 +0000 (UTC)
DMARC-Filter: OpenDMARC Filter v1.4.1 nodels16-ca.n0c.com 215DA806F2
Authentication-Results: nodels16-ca.n0c.com; dmarc=fail (p=none dis=none) header.from=stsg.ca
Authentication-Results: nodels16-ca.n0c.com; spf=fail smtp.mailfrom=stsg.ca
DKIM-Filter: OpenDKIM Filter v2.11.0 nodels16-ca.n0c.com 215DA806F2
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stsg.ca; s=default;
t=1778178991; bh=OcO2UfG0GAZo+DCpANLW2A1e6LIkEw7aN6Iaf1j0fsI=;
h=Date:From:To:Subject:From;
b=H9KAeZuNCqo/I6b/8LWRNMq7KxgMQe3m8kxdOlXH4b2RzdGYtvodCpWx86HYFS9Qs
Rdt7tt8DOCvhSyZEIUsm8wa9oTslGZB5QXvND7LEQp2WIi4hfN1t8WaPx+em1921t4
b4x8pO+BVQSly5/Sh0A1dM6y1x8delLINgH9a8/vvQjn56jpxmtISNoiaRSt+A3sWy
OJFfbUJtXpZpemBnE9LmOtBmvQ4dw4esyIvvxmhH5yCEquZ2SQusZsKP313AZqHB1P
36PKFeLUI4xvVoMYrbcD/JB38GYOltrAF15k4T6uoutQrBR1DGJy1iMzvqtDZwPqAI
muT374nc6xqaQ==
MIME-Version: 1.0
Date: Thu, 07 May 2026 20:36:28 +0200
From: admin@stsg.ca
To: undisclosed-recipients:;
Subject: Delivery Rescheduling Available 10265600118
Message-ID: <97a91f84758743ff362645e6f8f89d7b@stsg.ca>
X-Sender: admin@stsg.ca
Disposition-Notification-To: admin@stsg.ca
Content-Type: multipart/alternative;
boundary="=_149ed28edce994f55bd69c53f3350327"
X-Spam_score: 8.0
X-Spam_score_int: 80
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: FedEx Hello,
Content analysis details: (8.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.16.158.204 listed in dnsbl.ahbl.org]
[209.16.158.204 listed in dnsbl.ahbl.org]
[209.16.158.204 listed in dnsbl.ahbl.org]
[209.16.158.204 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.16.158.204 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.16.158.204 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.16.158.204 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.16.158.204 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.16.158.204 listed in will-spam-for-food.eu.org]
[209.16.158.204 listed in will-spam-for-food.eu.org]
[209.16.158.204 listed in will-spam-for-food.eu.org]
[209.16.158.204 listed in will-spam-for-food.eu.org]
[209.16.158.204 listed in will-spam-for-food.eu.org]
[209.16.158.204 listed in will-spam-for-food.eu.org]
[209.16.158.204 listed in will-spam-for-food.eu.org]
[209.16.158.204 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: stsg.ca]
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
0.3 LONGWORD BODY: Uses overlong words
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.16.158.204 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.16.158.204 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.4 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
0.8 HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP)
Subject: {SPAM?} Delivery Rescheduling Available 10265600118
--=_149ed28edce994f55bd69c53f3350327
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII;
format=flowed
FedEx
Hello,
A delivery attempt for your package was made on May 7, 2026 at 9:00 a.m.
However, no one was available to receive the shipment at the provided
address.
Shipment details:
Shipping method: Standard delivery
Delivery attempt: May 7, 2026 at 9:00 a.m.
Your package is currently being safely held at our processing center
pending further instructions.
To arrange a new delivery date, please use the link below:
Reschedule Delivery [1]
If you require any additional assistance, our support team remains
available to help.
Thank you for your trust.
Sincerely,
Shipping and Delivery Department
Links:
------
[1]
https://www.mchughluxury.com/fffffffffffffffffuioeuioeoiueuoiueioueiouiouio.html
--=_149ed28edce994f55bd69c53f3350327
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=UTF-8
=3DUTF-8" />
eva,sans-serif'>
--=_149ed28edce994f55bd69c53f3350327--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 07 May 2026 12:38:00 -0600
Received: from nodels16-ca.n0c.com ([209.16.158.204]:44385)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1wL3bD-00000000HC1-2ZQf
for dave@doctor.nl2k.ab.ca;
Thu, 07 May 2026 12:37:37 -0600
Received: from 127.0.0.1 (unknown [10.123.1.155])
by nodels16-ca.n0c.com (Postfix) with ESMTPA id 215DA806F2;
Thu, 7 May 2026 18:36:29 +0000 (UTC)
DMARC-Filter: OpenDMARC Filter v1.4.1 nodels16-ca.n0c.com 215DA806F2
Authentication-Results: nodels16-ca.n0c.com; dmarc=fail (p=none dis=none) header.from=stsg.ca
Authentication-Results: nodels16-ca.n0c.com; spf=fail smtp.mailfrom=stsg.ca
DKIM-Filter: OpenDKIM Filter v2.11.0 nodels16-ca.n0c.com 215DA806F2
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stsg.ca; s=default;
t=1778178991; bh=OcO2UfG0GAZo+DCpANLW2A1e6LIkEw7aN6Iaf1j0fsI=;
h=Date:From:To:Subject:From;
b=H9KAeZuNCqo/I6b/8LWRNMq7KxgMQe3m8kxdOlXH4b2RzdGYtvodCpWx86HYFS9Qs
Rdt7tt8DOCvhSyZEIUsm8wa9oTslGZB5QXvND7LEQp2WIi4hfN1t8WaPx+em1921t4
b4x8pO+BVQSly5/Sh0A1dM6y1x8delLINgH9a8/vvQjn56jpxmtISNoiaRSt+A3sWy
OJFfbUJtXpZpemBnE9LmOtBmvQ4dw4esyIvvxmhH5yCEquZ2SQusZsKP313AZqHB1P
36PKFeLUI4xvVoMYrbcD/JB38GYOltrAF15k4T6uoutQrBR1DGJy1iMzvqtDZwPqAI
muT374nc6xqaQ==
MIME-Version: 1.0
Date: Thu, 07 May 2026 20:36:28 +0200
From: admin@stsg.ca
To: undisclosed-recipients:;
Subject: Delivery Rescheduling Available 10265600118
Message-ID: <97a91f84758743ff362645e6f8f89d7b@stsg.ca>
X-Sender: admin@stsg.ca
Disposition-Notification-To: admin@stsg.ca
Content-Type: multipart/alternative;
boundary="=_149ed28edce994f55bd69c53f3350327"
X-Spam_score: 8.0
X-Spam_score_int: 80
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: FedEx Hello,
Content analysis details: (8.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.16.158.204 listed in dnsbl.ahbl.org]
[209.16.158.204 listed in dnsbl.ahbl.org]
[209.16.158.204 listed in dnsbl.ahbl.org]
[209.16.158.204 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.16.158.204 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.16.158.204 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.16.158.204 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.16.158.204 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.16.158.204 listed in will-spam-for-food.eu.org]
[209.16.158.204 listed in will-spam-for-food.eu.org]
[209.16.158.204 listed in will-spam-for-food.eu.org]
[209.16.158.204 listed in will-spam-for-food.eu.org]
[209.16.158.204 listed in will-spam-for-food.eu.org]
[209.16.158.204 listed in will-spam-for-food.eu.org]
[209.16.158.204 listed in will-spam-for-food.eu.org]
[209.16.158.204 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: stsg.ca]
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
0.3 LONGWORD BODY: Uses overlong words
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.16.158.204 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.16.158.204 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.4 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
0.8 HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP)
Subject: {SPAM?} Delivery Rescheduling Available 10265600118
--=_149ed28edce994f55bd69c53f3350327
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII;
format=flowed
FedEx
Hello,
A delivery attempt for your package was made on May 7, 2026 at 9:00 a.m.
However, no one was available to receive the shipment at the provided
address.
Shipment details:
Shipping method: Standard delivery
Delivery attempt: May 7, 2026 at 9:00 a.m.
Your package is currently being safely held at our processing center
pending further instructions.
To arrange a new delivery date, please use the link below:
Reschedule Delivery [1]
If you require any additional assistance, our support team remains
available to help.
Thank you for your trust.
Sincerely,
Shipping and Delivery Department
Links:
------
[1]
https://www.mchughluxury.com/fffffffffffffffffuioeuioeoiueuoiueioueiouiouio.html
--=_149ed28edce994f55bd69c53f3350327
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=UTF-8
=3DUTF-8" />
eva,sans-serif'>
>FedEx
Hello,
A delivery attempt for your package was made on May 7, 2026 at 9=
:00 a.m. However, no one was available to receive the shipment at =
the provided address.
Shipment details:
>
• Shipping method: Standard delivery
• Delivery a=
ttempt: May 7, 2026 at 9:00 a.m.
Your package is currently being safely held at our processing center pen=
ding further instructions.
To arrange a new delivery date, please use the link below:
ghluxury.com/fffffffffffffffffuioeuioeoiueuoiueioueiouiouio.html">Reschedul=
e Delivery
If you require any additional assistance, our support team remains avail=
able to help.
Thank you for your trust.
Sincerely,
Shipping and Delivery Department
--=_149ed28edce994f55bd69c53f3350327--
