Phishers impersonating DHL

by **SlapHappy** » Tue Dec 02, 2014 10:09 am

"NOREPLY@DHLEXPRESS.COM" <hrusikesh@osais.com>

* 41.190.3.239 Emts-nigeria-as Lagos Nigeria

Return-Path: <hrusikesh@osais.com>
Received: from mail.osais.com (mail.osais.com. [87.101.183.60])
by mx.google.com with ESMTP id hr5si15423041wjb.150.2014.12.02.00.43.34
for <multiple recipients>;
Tue, 02 Dec 2014 00:43:35 -0800 (PST)
Received-SPF: none (google.com: hrusikesh@osais.com does not designate
permitted sender hosts) client-ip=87.101.183.60;
Authentication-Results: mx.google.com;
spf=none (google.com: hrusikesh@osais.com does not designate permitted
sender hosts) smtp.mail=hrusikesh@osais.com
Received: from localhost (localhost.localdomain [127.0.0.1])
by mail.osais.com (Postfix) with ESMTP id D4A943E20516;
Tue, 2 Dec 2014 11:43:31 +0300 (AST)
Received: from mail.osais.com ([127.0.0.1])
by localhost (mail.osais.com [127.0.0.1]) (amavisd-new, port 10032)
with ESMTP id yIydXQt3U20u; Tue, 2 Dec 2014 11:43:27 +0300 (AST)
Received: from mail.osais.com (localhost.localdomain [127.0.0.1])
by mail.osais.com (Postfix) with ESMTP id DDA3F3E2036E;
Tue, 2 Dec 2014 11:43:26 +0300 (AST)
Received: from mail.osais.com (mail.osais.com [172.16.4.50])
by mail.osais.com (Postfix) with ESMTP id 35BBC3E206F5;
Tue, 2 Dec 2014 11:43:26 +0300 (AST)
Date: Tue, 2 Dec 2014 11:43:26 +0300 (AST)
From: "NOREPLY@DHLEXPRESS.COM" <hrusikesh@osais.com>
Reply-To: hrusikesh@osais.com
Message-ID: <1717532803.2295788.1417509806146.JavaMail.zimbra@osais.com>
Subject: Shipping documents
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_2295786_2084691948.1417509806140"
X-Originating-IP: [41.190.3.239]
X-Mailer: Zimbra 8.0.6_GA_5922 (zclient/8.0.6_GA_5922)
Thread-Topic: Shipping documents
Thread-Index: rYKAEZFOgwuZrOecySNrkSS37GDh3A==

------=_Part_2295786_2084691948.1417509806140
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Dear Customer,

Based on newly method, attached is your Shipping documents such as BL,
PL, Invoice, etc. and copy of DHL receipt for your tracking. Please
confirm accordingly if your address is correct, before we submit to
our outlet office for dispatch to your destination.

Regards,
Caroline Looseve
Customer's care

2014 © DHL International GmbH. All rights reserved.

Shipping Doc
DHL DELIVERY SERVICE

attachment; filename="DHL Shipping Document.pdf.zip" << Phishing document.

by **SlapHappy** » Fri Dec 05, 2014 2:33 am

* 197.220.169.13 Glo Mobile Ghana Ltd Accra Ghana

Return-Path: <admin@adminsever.com>
Received: from [197.220.169.13] (helo=[192.168.0.4])
by omne.batistella.com.br with esmtpa (EMEXIS MTA)
(envelope-from <admin@adminsever.com> authentic=no)
id 1Xwg4M-0004Sr-Nu; Thu, 04 Dec 2014 21:44:25 -0200
Subject: Shipment document
To: Recipients <admin@adminsever.com>
From: "admin@adminsever.com
Date: Thu, 04 Dec 2014 23:43:21 -0800
Message-Id: <E1Xwg4M-0004Sr-Nu@omne.batistella.com.br>

DHL service. Get your parcel NR583505
Sat, 6, 2014 6:07:01 PM
…
From:
United States Postal

DHL_label_ID7830.zip (26KB)
Good afternoon.

Your parcel has arrived at the post office on November 30.
Our Driver was unable to deliver the parcel to your address.
To receive a parcel you must go to the nearest DHL office and show your mailing label.
You need to print mailing label, and show it in DHL office to receive the parcel.Read the enclosed file for details

attachment; filename="SHIPMENT DOCUMENT.html" << Phishing document.
Thank you for your attention.
DHL Services.

by **SlapHappy** » Sun Dec 14, 2014 10:47 pm

Return-Path: <mega2060@gmail.com>
Received-SPF: pass (google.com: domain of mega2060@gmail.com designates
10.236.15.103 as permitted sender) client-ip=10.236.15.103
Authentication-Results: mr.google.com;
spf=pass (google.com: domain of mega2060@gmail.com designates
10.236.15.103 as permitted sender) smtp.mail=mega2060@gmail.com;
dkim=pass header.i=@gmail.com
X-Received: from mr.google.com ([10.236.15.103])
by 10.236.15.103 with SMTP id e67mr17976545yhe.22.1418593039783
(num_hops = 1);
Sun, 14 Dec 2014 13:37:19 -0800 (PST)
DKIM-Signature:
MIME-Version: 1.0
X-Received: by 10.236.15.103 with SMTP id e67mr19883686yhe.22.1418593039498;
Sun, 14 Dec 2014 13:37:19 -0800 (PST)
Received: by 10.170.65.214 with HTTP; Sun, 14 Dec 2014 13:37:19 -0800 (PST)
Date: Sun, 14 Dec 2014 22:37:19 +0100
Message-ID: <CALoCfkibT08nrG9g6MSxmO43h2S=dG+pQd3M28wRRAjYWqt64Q@mail.gmail.com>
Subject: Shipment/Arrival Notification
From: DHL DELIVERY SERVICE <mega2060@gmail.com>
To: undisclosed-recipients:;
Content-Type: multipart/mixed; boundary=089e0122a47634c23b050a33ee81
Bcc:

Dear Customer,

Attached is your Shipping documents/Invoice and copy of DHL receipt for your tracking. Please confirm accordingly if your address is correct, before we submit to our outlet office for dispatch to your destination.

Regards,
Ethopia Loosveldt
Customer's care

2014 © DHL International GmbH. All rights reserved.

attachment; filename="[DHL goods tracking service.zip" << Phishing document.

by **SlapHappy** » Mon Feb 02, 2015 12:47 pm

Return-Path: <tradersbiz2000@outlook.com>
Received: from BAY004-OMC2S12.hotmail.com (bay004-omc2s12.hotmail.com.
[65.54.190.87])
by mx.google.com with ESMTPS id pg2si21391805pdb.161.2015.02.01.14.06.07
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
Sun, 01 Feb 2015 14:06:08 -0800 (PST)
Received-SPF: pass (google.com: domain of tradersbiz2000@outlook.com designates
65.54.190.87 as permitted sender) client-ip=65.54.190.87;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of tradersbiz2000@outlook.com designates
65.54.190.87 as permitted sender) smtp.mail=tradersbiz2000@outlook.com;
dmarc=pass (p=NONE dis=NONE) header.from=outlook.com
Received: from BAY180-W70 ([65.54.190.124]) by BAY004-OMC2S12.hotmail.com
over TLS secured channel with Microsoft SMTPSVC(7.5.7601.22751);
Sun, 1 Feb 2015 14:06:06 -0800
X-TMN: [mfqw9NCJb1ElywJhoRBZvUH4yHwbGz49]
X-Originating-Email: [tradersbiz2000@outlook.com]
Message-ID: <BAY180-W7070DCC70E012A7B44A5C6C83F0@phx.gbl>
Return-Path: tradersbiz2000@outlook.com
Content-Type: multipart/mixed;
boundary="_6e505778-25e7-4b60-9630-ce62f8b46668_"
From: cool bosco <tradersbiz2000@outlook.com>
To:
Subject: Unclaimed 40 Feet Container and Bill of Lading document
Date: Sun, 1 Feb 2015 23:06:05 +0100
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 01 Feb 2015 22:06:06.0289 (UTC) FILETIME=[46BBF410:01D03E6B]

--_6e505778-25e7-4b60-9630-ce62f8b46668_
Content-Type: multipart/alternative;
boundary="_98d176d0-eff8-47ef-98db-42af06f00c50_"

--_98d176d0-eff8-47ef-98db-42af06f00c50_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Dear sir

Unclaimed 40 Feet Container and Bill of Lading document made in your Company Name and Address.
Please track the shipment via DHL shipping company.
kindly confirm shipping document attached below
Please confirm if the shipping document is made in your company name and get back to us ASAP to release the goods in your company name.

DHL SHIPPING COMPANY
shenzehn branch CHINA
26, gongdong road shenzehn china

Attachment: "DHL Express INTL.html"

by **SlapHappy** » Wed Apr 01, 2015 1:03 pm

* 212.100.76.177 Autonomous System Number For Cyber Space Lagos Nigeria

Return-Path: <billing@ke.wananchi.com>
Received: from mta02.zcs.wananchi.com (mta02.zcs.wananchi.com.
[62.8.88.152])
by mx.google.com with ESMTP id n9si3092278wie.84.2015.04.01.03.20.53;
Wed, 01 Apr 2015 03:20:54 -0700 (PDT)
Received-SPF: none (google.com: billing@ke.wananchi.com does not designate
permitted sender hosts) client-ip=62.8.88.152;
Authentication-Results: mx.google.com;
spf=none (google.com: billing@ke.wananchi.com does not designate
permitted sender hosts) smtp.mail=billing@ke.wananchi.com
Received: from localhost (localhost.localdomain [127.0.0.1])
by mta02.zcs.wananchi.com (Postfix) with ESMTP id BC002806878;
Wed, 1 Apr 2015 13:10:45 +0300 (EAT)
X-Virus-Scanned: amavisd-new at mta02.zcs.wananchi.com
Received: from mta02.zcs.wananchi.com ([127.0.0.1])
by localhost (mta02.zcs.wananchi.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id y4KFFc2j63Lp; Wed, 1 Apr 2015 13:10:44 +0300 (EAT)
Received: from localhost (localhost.localdomain [127.0.0.1])
by mta02.zcs.wananchi.com (Postfix) with ESMTP id CB96D8067EE;
Wed, 1 Apr 2015 13:10:35 +0300 (EAT)
X-Amavis-Modified: Mail body modified (using disclaimer) -
mta02.zcs.wananchi.com
X-Virus-Scanned: amavisd-new at mta02.zcs.wananchi.com
Received: from mta02.zcs.wananchi.com ([127.0.0.1])
by localhost (mta02.zcs.wananchi.com [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id HmwO5olAF847; Wed, 1 Apr 2015 13:10:35 +0300 (EAT)
Received: from [192.168.1.104] (unknown [212.100.76.177])
by mta02.zcs.wananchi.com (Postfix) with ESMTPSA id BCC528067FD;
Wed, 1 Apr 2015 13:10:18 +0300 (EAT)
Content-Type: multipart/mixed; boundary="===============1756327263=="
MIME-Version: 1.0
Subject: Re: Fw: DHL Consignment Notification Arrival: AWB-CN10863274?
To: Recipients <billing@ke.wananchi.com>
From: DHL <billing@ke.wananchi.com>
Date: Tue, 31 Mar 2015 11:10:58 -0700
Message-Id: <20150401101018.BCC528067FD@mta02.zcs.wananchi.com>

Dear Sir,

Attached is your Shipping documents/Invoice and copy of DHL receipt for your tracking. Please confirm accordingly if your address is correct, before we submit to our outlet office for dispatch to your destination.

Regards,

2015 © DHL International GmbH. All rights reserved.

Maersk line Corporate
Office. +1 (800) 321-8807 FREE FREE
Visitingaddress: 180 Park Avenue,
Building 105, PO Box 950, 07932 Florham Park, NJ.
__________________________________________________
Wananchi Group Disclaimer and Confidentiality Note:
The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material. The views expressed herein are those of the sender and not of the
Wananchi Group. Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited. If you received
this in error, please contact the sender and delete the material from any
computer. http:/ /www.zuku.co.ke/

Attachments area
Preview attachment
DHL RECEIPT.HTML
[HTML]

by **SlapHappy** » Mon Apr 06, 2015 10:25 pm

* 169.159.87.244 Smile-nigeria-as Lagos Nigeria

Return-Path: <bartal@bartal.com.br>
Received: from gateway03.websitewelcome.com (gateway03.websitewelcome.com.
[69.93.223.19])
by mx.google.com with ESMTPS id ps1si4084707pbb.236.2015.04.06.08.01.24
for
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Mon, 06 Apr 2015 08:01:24 -0700 (PDT)
Received-SPF: pass (google.com: domain of bartal@bartal.com.br designates
69.93.223.19 as permitted sender) client-ip=69.93.223.19;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of bartal@bartal.com.br designates
69.93.223.19 as permitted sender) smtp.mail=bartal@bartal.com.br;
dkim=pass header.i=@bartal.com.br
Received: by gateway03.websitewelcome.com (Postfix, from userid 5007)
id 945C0B06674C1; Mon, 6 Apr 2015 10:01:21 -0500 (CDT)
Received: from ham06.websitewelcome.com (unknown [192.185.0.197])
by gateway03.websitewelcome.com (Postfix) with ESMTP id 2B1C7B066476F
for ; Mon, 6 Apr 2015 10:01:19 -0500 (CDT)
Received: by ham06.websitewelcome.com (Postfix, from userid 500)
id B1F3140DED; Mon, 6 Apr 2015 10:00:08 -0500 (CDT)
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
ham06.websitewelcome.com
X-Spam-Flag2999: NO
X-Spam-Level2999:
X-Spam-Status2999: "No, score=0.1 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
DKIM_VALID_AU,HTML_MESSAGE,MISSING_MID,T_OBFU_PDF_ATTACH autolearn=disabled
version=3.3.1
Received: from srv86.prodns.com.br (srv86.prodns.com.br [192.185.176.226])
by ham06.websitewelcome.com (Postfix) with ESMTP id 1A27842990
for <XXXXXX@gmail.com>; Mon, 6 Apr 2015 09:50:40 -0500 (CDT)
DKIM-Signature:
Received: from [169.159.87.244] (port=64859 helo=HP-PC)
by srv86.prodns.com.br with esmtpa (Exim 4.82)
(envelope-from <bartal@bartal.com.br>)
id 1Yf8MJ-0002hl-Cv
for Mon, 06 Apr 2015 11:50:39 -0300
From: "DHL Express" <bartal@bartal.com.br>
Subject: Your Tracking No
To:
Content-Type: multipart/mixed; boundary="4Y8RaItt5y8wIg0BWn=
_WrntgnSe6ushTm0"
MIME-Version: 1.0
Date: Mon, 6 Apr 2015 07:50:38 -0700
X-AntiAbuse: This header was added to track abuse, please include it with
any abuse report
X-AntiAbuse: Primary Hostname - srv86.prodns.com.br
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - bartal.com.br
X-BWhitelist: no
X-Source-IP: 169.159.87.244
X-Exim-ID: 1Yf8MJ-0002hl-Cv
X-Source:
X-Source-Args:
X-Source-Dir:
X-Source-Sender: (HP-PC) [169.159.87.244]:64859
X-Source-Auth: bartal@bartal.com.br
X-Email-Count: 419
X-Source-Cap: d3d3YmFydDtlZGhvczcyOTtzcnY4Ni5wcm9kbnMuY29tLmJy
Message-Id: <20150406150118.B1F3140DED@ham06.websitewelcome.com>

This is a multi-part message in MIME format

--4Y8RaItt5y8wIg0BWn=_WrntgnSe6ushTm0
Content-Type: multipart/alternative;
boundary="4Y8RaItt5y8wIg0BWn=_WrntgnSe6ushTm1"

--4Y8RaItt5y8wIg0BWn=_WrntgnSe6ushTm1
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

- This mail is in HTML. Some elements may be ommited in plain text. -

Dear Customer,
Please find attached DHL AWB that need to be printed and given to courier upon arrival.
Best regards
DHL Express Team

Attachments area
Preview attachment DHL Details.pdf
[PDF]

by **SlapHappy** » Mon Apr 06, 2015 10:29 pm

* 169.159.87.244 Smile-nigeria-as Lagos Nigeria

Return-Path: <complementos@veloxmail.com.br>
Received: from r-sv5.v.inova.com.br (111-static-inova.u.inova.com.br.
[177.154.154.111])
by mx.google.com with ESMTP id o186si4204040qhb.69.2015.04.06.07.12.57
for <
Mon, 06 Apr 2015 07:12:58 -0700 (PDT)
Received-SPF: pass (google.com: domain of complementos@veloxmail.com.br
designates 177.154.154.111 as permitted sender) client-ip=177.154.154.111;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of complementos@veloxmail.com.br
designates 177.154.154.111 as permitted sender)
smtp.mail=complementos@veloxmail.com.br
Received: from HP-PC (unknown [169.159.87.244])
(Authenticated sender: complementos@veloxmail.com.br)
by r-sv5.v.inova.com.br (Postfix) with ESMTPA id F089A6B765
for ; Mon, 6 Apr 2015 11:12:45 -0300 (BRT)
From: "DHL Express" <complementos@veloxmail.com.br>
Subject: Your Tracking No
To:
Content-Type: multipart/mixed; boundary="4Y8RaItt5y8wIg0BWn=
_WrntgnSe6ushTm0"
MIME-Version: 1.0
Date: Mon, 6 Apr 2015 07:12:45 -0700
Message-Id: <20150406141245.F089A6B765@r-sv5.v.inova.com.br>

This is a multi-part message in MIME format

--4Y8RaItt5y8wIg0BWn=_WrntgnSe6ushTm0
Content-Type: multipart/alternative;
boundary="4Y8RaItt5y8wIg0BWn=_WrntgnSe6ushTm1"

--4Y8RaItt5y8wIg0BWn=_WrntgnSe6ushTm1
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

- This mail is in HTML. Some elements may be ommited in plain text. -

Same text atachment.

by **SlapHappy** » Sun Apr 12, 2015 7:55 pm

* 212.100.76.63 Autonomous System Number For Cyber Space Lagos Nigeria

Return-Path: <sekretaria@isseti.org>
Received: from ham1.dnslinks.net (ham1-3.dnslinks.net. [74.86.15.250])
by mx.google.com with ESMTPS id x7si5711978obf.27.2015.04.12.08.22.05
for <
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Sun, 12 Apr 2015 08:22:05 -0700 (PDT)
Received-SPF: none (google.com: sekretaria@isseti.org does not designate
permitted sender hosts) client-ip=74.86.15.250;
Authentication-Results: mx.google.com;
spf=none (google.com: sekretaria@isseti.org does not designate
permitted sender hosts) smtp.mail=sekretaria@isseti.org
Message-Id: <552a8d9d.e718b60a.0399.ffffa7b0SMTPIN_ADDED_MISSING@mx.google.com>
Received: (qmail 8793 invoked from network); 12 Apr 2015 14:58:44 -0000
Received: from unknown (HELO ?192.168.1.102?) (sekretaria@isseti.org@212.100.76.63)
by localhost with ESMTPA; 12 Apr 2015 14:58:44 -0000
Content-Type: multipart/mixed; boundary="===============0625723245=="
MIME-Version: 1.0
Subject: DHL Shipping Document
To: Recipients <sekretaria@isseti.org>
From: DHL Express <sekretaria@isseti.org>
Date: Sun, 12 Apr 2015 16:08:47 +0100

Dear Customer,

Attached is your Shipping documents/Invoice and copy of DHL receipt for
your tracking. Please confirm accordingly if your address is correct,
before we submit to our outlet office for dispatch to your destination.

Regards,
2015 © DHL International GmbH. All rights reserved.

Attachments area
Preview attachment
INVOICE.htm
[HTML]

by **SlapHappy** » Tue May 19, 2015 8:48 pm

* 212.100.76.225 Autonomous System Number For Cyber Space Lagos Nigeria

Return-Path: <offers@hosairmails.in>
Received: from unknown (HELO ?192.168.1.110?) (offers@hosairmails.in@212.100.76.225)
by mail1125.opentransfer.com with ESMTPAM; 18 May 2015 09:39:16 -0000
X-Originating-IP: 212.100.76.225
Subject: Re: DHL Shipping Document
To: Recipients <offers@hosairmails.in>
From: DHL EXPRESS <offers@hosairmails.in>
Date: Mon, 18 May 2015 10:38:45 +0100

Dear Customer,

Attached is your Shipping documents/Invoice and copy of DHL receipt for your tracking. Please confirm accordingly if your address is correct, before we submit to our outlet office for dispatch to your destination.

Regards,
2015 © DHL International GmbH. All rights reserved.

Attachments area
Preview attachment
DHL SHIPPING DOC.htm
[HTML]

by **SlapHappy** » Fri Sep 18, 2015 8:52 pm

Return-Path: <waleolatunde@gmail.com>
Date: Tue, 15 Sep 2015 15:15:03 +0100
Subject: Tracking number
From: DHL-Package <waleolatunde@gmail.com>
To: undisclosed-recipients:;

Dear Customer,

A Package is coming your way through DHL.
Track your Package till it gets to your doorstep.
Attached is your Dhl tracking number and a copy of the document.

DHL Worldwide Delivery © 2015

Attachments area
Preview attachment Tracking Number.pdf

PDF
Tracking Number.pdf

Who is online