Phishers impersonating FedEx

Email:

FedEx

We have sent you a message with the required information.
Click here to open this email in your browser.

Thanks for choosing FedEx®.

More details
This message was sent to xxx. Please click unsubscribe if you don't want to receive these messages from FedEx in the future.

©2018 FedEx. The content of this message is protected by copyright and trademark laws under U.S. and international law.
Review our privacy policy. All rights reserved.

Phishing link hidden in the body of the message: http: // gsernawebsitesandbox.azurewebsites.net/smokescreenz.html

Email:

FedEx International


We have sent you a message with the required information.

Click here to open this email in your browser.

Thanks for choosing FedEx®.
View details
This message was sent to xxx@yahoo.com. Please click unsubscribe if you don't want to receive these messages from FedEx International in the future.

©2018 FedEx. The content of this message is protected by copyright and trademark laws under U.S. and international law.
Review our privacy policy. All rights reserved.

Header:

Return-Path: <ermedproducting@connectsa.net>
X-Originating-IP: [200.218.240.120]
Errors-To: gwivcxyrxxukauc@connectsa.net
From: FedEx International <ermedproducting@connectsa.net>
Subject: FedEx International No.47836
X-Mailer: Expects

Hidden link in the "here" and "View details" : http: // realestate. iemelif.com/planarxe.html - identified as Malware by VirusTotal.

Email:

Dear customer!

We were not able to deliver postal package which was sent on the
8th of December in time because the addressee’s address is wrong.
Please view, copy out your TRACKING NUMBER, print out the invoice
copy attached and collect the package at our office.

Best Wishes,
Theresa Martinez
DHL Express Service

Return-Path: <google@ogawaoffice.jp>
Received: from User ([194.110.84.204]) (authenticated bits=0) by www3456.sakura.ne.jp (8.15.2/8.15.2) with ESMTPA id wBJMGA09083241; Thu, 20 Dec 2018
Reply-To: <fedny2016@gmail.com>
From: DHL Customer Care <google@ogawaoffice.jp>
Subject: DHL Customer Service !!!
X-Mailer: Microsoft Outlook Express 6.00.2600.0000

Originating IP: 194.110.84.204
Originating ISP: Volumedrive
City: Scranton
Country of Origin: United States

Note: the email address fedny2016@gmail.com is also reported in viewtopic.php?f=6&t=39190&p=131276 while being used on other online fraud attempts.

Re; DHL invoice attached !!
DHL Delivery Service <test@zszajeci.cz> Today at 6:01
Reply-To: fedny2016@gmail.com
To
Recipients
Message body
Dear customer!

We were not able to deliver postal package which was sent on the
8th of December in time because the addressee’s address is wrong.
Please view, copy out your TRACKING NUMBER, print out the invoice
copy attached and collect the package at our office.

Best Wishes,
Theresa Martinez
DHL Express Service
Attachments in this email may contain harmful content and cannot be downloaded. Learn more
DHL Tracking_invoice .zip - Antivirus flagged it up as infected.