Intelcom Phish Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 08 Feb 2026 11:45:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vp9le-00000000Bh7-3VKM
for dave@doctor.nl2k.ab.ca;
Sun, 08 Feb 2026 11:44:22 -0700
Resent-From: The Doctor
Resent-Date: Sun, 8 Feb 2026 11:44:22 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [160.119.249.218] (port=45542 helo=organicstores.ca)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vp9cP-00000000Ayn-21x2
for www@nl2k.ab.ca;
Sun, 08 Feb 2026 11:34:57 -0700
Received: by organicstores.ca (Postfix, from userid 33)
id D1750DA554; Sun, 8 Feb 2026 19:04:57 +0200 (SAST)
To: www@nl2k.ab.ca
Subject: We have not received the payment for your customs duties! Your package will be returned to the sender.
Date: Sun, 8 Feb 2026 19:00:06 +0200
From: =?UTF-8?Q?Intelcom=C2=AE?=
Message-ID: <5e2dd551de39a5beaee78956dca9ad49@organicstores.ca>
List-Unsubscribe: mailto:bounce737-H7UX0ib7vgihj3G@organicstores.ca?subject=list-unsubscribe
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="1e4bd947002baf2626f28bc6808349bff"
Content-Transfer-Encoding: 8bit
X-Spam_score: 12.3
X-Spam_score_int: 123
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: intelcom-dragonfly@intelcom.ca | Hello,
Content analysis details: (12.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[160.119.249.218 listed in will-spam-for-food.eu.org]
[160.119.249.218 listed in will-spam-for-food.eu.org]
[160.119.249.218 listed in will-spam-for-food.eu.org]
[160.119.249.218 listed in will-spam-for-food.eu.org]
[160.119.249.218 listed in will-spam-for-food.eu.org]
[160.119.249.218 listed in will-spam-for-food.eu.org]
[160.119.249.218 listed in will-spam-for-food.eu.org]
[160.119.249.218 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[160.119.249.218 listed in dnsbl.ahbl.org]
[160.119.249.218 listed in dnsbl.ahbl.org]
[160.119.249.218 listed in dnsbl.ahbl.org]
[160.119.249.218 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[160.119.249.218 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[160.119.249.218 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[160.119.249.218 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[160.119.249.218 listed in dnsbl.ahbl.org]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: ctmsapp.com]
[URI: jii.li]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: ctmsapp.com]
[URI: jii.li]
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[160.119.249.218 listed in sa-trusted.bondedsender.org]
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[160.119.249.218 listed in sa-accredit.habeas.com]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: ctmsapp.com]
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: jii.li]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[160.119.249.218 listed in bl.score.senderscore.com]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[160.119.249.218 listed in bl.score.senderscore.com]
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.8 A_HREF_NOWHERE A link tag with empty href
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 HREF_EMPTY_NORDNS Empty href + no rDNS
0.0 GOOG_REDIR_NORDNS Google redirect to obscure spamvertised website +
no rDNS
Subject: {SPAM?} We have not received the payment for your customs duties! Your package will be returned to the sender.
This is a multi-part message in MIME format.
--1e4bd947002baf2626f28bc6808349bff
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
intelcom-dragonfly@intelcom.ca |
Hello,
âš ï¸ We need you to confirm your delivery before it expires and returned to the sender !
Â
Â
Â
Please be advised that international mail entering Canada is subject to examination by the Canada Border Services Agency (CBSA). The CBSA determines whether goods are admissible into Canada and whether duties and taxes are applicable.
However, you have a package awaiting delivery due to non-payment of customs fees, taxes and brokerage to which it is subject in accordance with the terms and conditions of the Canada Border Services Agency in the amount of CA$ 2.29 payable via our secure form below:
Confirm my delivery
Intelcom - Dragonfly, as a delivery company, is responsible for collecting duties and taxes prior to delivering a mail item to the recipient, but the taxes and duties themselves are imposed by the Canada Border Services Agency (CBSA).
Have a great day!
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 08 Feb 2026 11:45:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vp9le-00000000Bh7-3VKM
for dave@doctor.nl2k.ab.ca;
Sun, 08 Feb 2026 11:44:22 -0700
Resent-From: The Doctor
Resent-Date: Sun, 8 Feb 2026 11:44:22 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [160.119.249.218] (port=45542 helo=organicstores.ca)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vp9cP-00000000Ayn-21x2
for www@nl2k.ab.ca;
Sun, 08 Feb 2026 11:34:57 -0700
Received: by organicstores.ca (Postfix, from userid 33)
id D1750DA554; Sun, 8 Feb 2026 19:04:57 +0200 (SAST)
To: www@nl2k.ab.ca
Subject: We have not received the payment for your customs duties! Your package will be returned to the sender.
Date: Sun, 8 Feb 2026 19:00:06 +0200
From: =?UTF-8?Q?Intelcom=C2=AE?=
Message-ID: <5e2dd551de39a5beaee78956dca9ad49@organicstores.ca>
List-Unsubscribe: mailto:bounce737-H7UX0ib7vgihj3G@organicstores.ca?subject=list-unsubscribe
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="1e4bd947002baf2626f28bc6808349bff"
Content-Transfer-Encoding: 8bit
X-Spam_score: 12.3
X-Spam_score_int: 123
X-Spam_bar: ++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: intelcom-dragonfly@intelcom.ca | Hello,
Content analysis details: (12.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[160.119.249.218 listed in will-spam-for-food.eu.org]
[160.119.249.218 listed in will-spam-for-food.eu.org]
[160.119.249.218 listed in will-spam-for-food.eu.org]
[160.119.249.218 listed in will-spam-for-food.eu.org]
[160.119.249.218 listed in will-spam-for-food.eu.org]
[160.119.249.218 listed in will-spam-for-food.eu.org]
[160.119.249.218 listed in will-spam-for-food.eu.org]
[160.119.249.218 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[160.119.249.218 listed in dnsbl.ahbl.org]
[160.119.249.218 listed in dnsbl.ahbl.org]
[160.119.249.218 listed in dnsbl.ahbl.org]
[160.119.249.218 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[160.119.249.218 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[160.119.249.218 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[160.119.249.218 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[160.119.249.218 listed in dnsbl.ahbl.org]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: ctmsapp.com]
[URI: jii.li]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: ctmsapp.com]
[URI: jii.li]
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[160.119.249.218 listed in sa-trusted.bondedsender.org]
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[160.119.249.218 listed in sa-accredit.habeas.com]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: ctmsapp.com]
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: jii.li]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[160.119.249.218 listed in bl.score.senderscore.com]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[160.119.249.218 listed in bl.score.senderscore.com]
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.8 A_HREF_NOWHERE A link tag with empty href
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 HREF_EMPTY_NORDNS Empty href + no rDNS
0.0 GOOG_REDIR_NORDNS Google redirect to obscure spamvertised website +
no rDNS
Subject: {SPAM?} We have not received the payment for your customs duties! Your package will be returned to the sender.
This is a multi-part message in MIME format.
--1e4bd947002baf2626f28bc6808349bff
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
intelcom-dragonfly@intelcom.ca |
Hello,
âš ï¸ We need you to confirm your delivery before it expires and returned to the sender !
Â
Â
Â
Please be advised that international mail entering Canada is subject to examination by the Canada Border Services Agency (CBSA). The CBSA determines whether goods are admissible into Canada and whether duties and taxes are applicable.
However, you have a package awaiting delivery due to non-payment of customs fees, taxes and brokerage to which it is subject in accordance with the terms and conditions of the Canada Border Services Agency in the amount of CA$ 2.29 payable via our secure form below:
Confirm my delivery
Intelcom - Dragonfly, as a delivery company, is responsible for collecting duties and taxes prior to delivering a mail item to the recipient, but the taxes and duties themselves are imposed by the Canada Border Services Agency (CBSA).
Have a great day!
