DHL phishing
🎯 @dhlexpressuk
⚠a2dd8470ec.nxcli.net/gt/dhl_topscript/
☣ AS36444 [209.126.25.215] 🇺🇸 🌐 @tucows 🖧 @nexcess NEXCESS-NET, US
Spam sent from 167.89.106.58 @SendGrid @Twilio
seen from Macao SAR China

seen from Greece
seen from China
seen from United States
seen from United States
seen from United States
seen from Türkiye
seen from China
seen from Türkiye
seen from South Africa
seen from United States
seen from Netherlands
seen from Malaysia
seen from United States

seen from South Africa

seen from Netherlands
seen from Netherlands
seen from China
seen from United States

seen from United States
DHL phishing
🎯 @dhlexpressuk
⚠a2dd8470ec.nxcli.net/gt/dhl_topscript/
☣ AS36444 [209.126.25.215] 🇺🇸 🌐 @tucows 🖧 @nexcess NEXCESS-NET, US
Spam sent from 167.89.106.58 @SendGrid @Twilio
Beware Of Job Fraud Scams!
Beware Of Job Fraud Scams!
Sign Up
Searching for a job can be difficult enough, but when you finally spot the ‘job of a lifetime’ just consider that…
View On WordPress
DHL Scam, submission by JamesWT
DHL CBJ200310620276 From: DHL WORLD EXPRESS <[email protected]> Date: Thu, 12/03/202010:12 Dear, Kindly contact local DHL and release goods with attach Your Tracking Number 7966158454
Pickup Confirmation Number CBJ200310620276
Pickup Details me, Mar 12, 2020 Between 5:00 pm and 7:00 pm Normal Attachment (Scanned by Avira antivirus engine) AWB .xlsx (13.32K) Download Open Preview
⚠http://compartetusueno.com/wp-admin/maint/DHL/DHL-DOC1/DHL/portal/index.php [64.71.35.74]
🎯 @dhlexpressuk
⚠megafoundaryww73900.eu-gb.cf.appdomain.cloud/
☣ AS36351[169.50.73.250] 🇺🇸 🌐 CSC Corporate Domains 🖧 @IBMcloud SoftLayer
Spam relay 209.159.153.135
the fake email’s contents:
DELIVERY EXCEPTION – INCORRECT ADDRESS
Hello info,
We are unable to deliver your DHL Express shipment with waybill number 1308881711 because the delivery address we have for you seems to be incorrect.
Please update your address here.
Delivery Information Waybill No. 1308881711 Delivery Address NIL
Thank you for using On Demand Delivery.
DHL Express - Excellence. Simply delivered.
Deutsche Post DHL Group DHL Express | Contact DHL | Privacy Policy | Unsubscribe
2020 © DHL International GmbH. All rights reserved.
🎯 @dhlexpressuk
⚠bit.do/fsKbL ↘ (3 redirects)
9d93983c4e2590643.tempsite.link ↘ bit.ly/37gPGue ↘ bab96c22682590614.temporary.link
☣VPS 104.244.121.240 @inmotionhosting
TLD @tucows 193.26.21.156
DHL scam - "DHL REVENGE BY ALIBOBO" 🤦 📤 Spam relay:37.72.175.191 ⚠ https://meritadlaw.com/itw/DHL%20REVENGE%20BY%20ALIBOBO/index.php ☣ AS22612 [198.54.123.122] 🇺🇸
VPS @Namecheap URL @enomsupport @enom SSL @sectigostore
the real DHL called and told me you have been naughty!
The spammy link leads to MS One Drive URL
https://1drv.ms/xs/s%21AnB4b3SncdLWftmAa42vJgxd7Gs?wdFormId=%7BB4BEAE66%2DF39E%2D43F4%2D8C4D%2DEDB015BF7333%7D
which is no longer active Email headers
From - Sat Aug 24 20:51:51 2019 X-Account-Key: account3 X-UIDL: 1042748947.52820 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: Return-Path: Received: from mx4.mail.bg ([unix socket]) by stor3 (Cyrus 2.5.10-Debian-2.5.10-3) with LMTPA; Sun, 18 Aug 2019 05:12:30 +0300 X-Sieve: CMU Sieve 2.4 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on stor3.stor3 X-Spam-Level: ** X-Spam-Status: No, score=2.8 required=5.0 tests=BAYES_50,HTML_IMAGE_RATIO_06, HTML_MESSAGE,MIME_HTML_ONLY,RCVD_IN_RP_RNBL shortcircuit=no autolearn=no autolearn_force=no version=3.4.2 Received-SPF: none (dhl.hongkong.icda.com: No applicable sender policy available) receiver=mx4.mail.bg; identity=mailfrom; envelope-from="[email protected]"; helo=mail.izcalli.gob.mx; client-ip=187.217.66.203 Received: from mail.izcalli.gob.mx (nsl.izcalli.gob.mx [187.217.66.203]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.mail.bg (Postfix) with ESMTPS id 876F83EE53 for <@mail.bg>; Sun, 18 Aug 2019 05:12:27 +0300 (EEST) Received: from dhl.hongkong.icda.com (unknown [49.248.249.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.izcalli.gob.mx (Postfix) with ESMTPSA id 6449FC4150F for <@mail.bg>; Sat, 17 Aug 2019 20:51:04 -0500 (CDT) From: "DHL Customer Support" To: @mail.bg Subject: DHL Shipment Notification Date: 18 Aug 2019 07:14:34 +0530 Message-ID: <[email protected]> MIME-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: quoted-printable
Email body
Scam Alert: The DHL Email Scam is back
Scam Alert: The DHL Email Scam is back
header image source Pixabay
As we all know email scams are nothing new. They have been around for years. Many you can spot as fake by the way they are written due to poor spelling or grammar. Others might look more convincing due to the brand logo being added.
The email I came across today wasn’t very convincing but I thought I’d share it anyway just in case someone thinks they are being…
View On WordPress