DHL phishing

Miyuki

Administratrix
Staff member
Subject: Your Package Arrived
From: "Dhl" <romulo.int@megatechcontrols.com.br>
Date: Tue, 28 Feb 2017
Reply-To: chung@phuogngphat.com
Return-Path: romulo.int@megatechcontrols.com.br
Message-ID: <SNT004-MC3F55NXRPmc004157e0@SNT004-MC3F55.hotmail.com>

Your shipment(s) listed below is scheduled for delivery tomorrow.

You have a DHL shipment addressed to you.

You need to obtain your Tracking Number so as to check the status of the delivery.

Kindly complete the tracking process on our webpage link www.dhl.com/dl/tracking ----> http://namjestajgavranovic.com/plugins/tmp/Dhl-Auto/dhlindex.php?email=.....@hotmail.com and also confirm your delivery address .

DHL WorldWide Delivery
 

Sapphire's Strike

Administrator
Staff member
Received from: 216.170.126.169,
USA, Buffalo, ColoCrossing

Return Path: <antelecdel@airtelmail.in>
From: DHL EXPRESSt <antelecdel@airtelmail.in>
Date: 12th June 2017
Subject:ARRIVED PARCEL..AWAITING PICK UP
Reply to:

Dear Customer,

Your DHL parcel arrived at our post office since 5th June 2017.
Our courier was unable to deliver the parcel to you due to incorrect delivery details.
To receive your parcel, download attached receipt to view parcel details.
We apologize for the stress and delay in delivery.

NOTE: Due to network issue, please if you receive the message in spam/ junk folder, kindly move to inbox to enable you download the attached file.

DOWNLOAD ATTACHMENT ———> Dhl parcel.htm ————> "https://submit.jotform.us/submit/71592677455570/"

Dhl Online Notification @ 2017.
 

Hua Mulan

Administrator
Staff member
From: 195.158.254.90,
Russia, Moscow, Kosmohost It Technologies Ltd

Return-Path: <k000120@katrin9.kosmohost.net>
Subject: Your parcel Shipment Arriva
Date: Tue, 20 Jun 2017
From: DHL Express <info_shippment@express.com>
Message-ID: <11187c97b0ab90d78e0173839fa35ecd@uuthouse.ru>
Sender: <k000120@katrin9.kosmohost.net>

Please be inform that your shipment listed below is scheduled for delivery tomorrow. You need to obtain your Tracking Number so as to check the status of the delivery kindly complete the tracking process on our webpage link below.
www.dhl.com/en/express/shipping.cn
South Area Sales Marketer Dept.
2017 DHL-Sinotrans International Air Courier Ltd.
Phone : +86 (20) 28031 3130
Mob: +86 185 2130 5830
Fax: +86 (10) 87219111
 

Kat

Administrator
Staff member
Return-Path: <dr.truptishah05@yahoo.com>
Date: Tue, 4 Jul 2017
From: Trupti Shah <dr.truptishah05@yahoo.com>
Reply-To: Trupti Shah <dr.truptishah05@yahoo.com>
Subject: DHL Shipment Notification : 8862555998

Dear Consignee,

Please receive your packages: Your parcel arrived at the post office
Our courier was unable to deliver the parcel to you due to incomplete delivery details.

To receive your parcel
Download the attached receipt and confirm delivery details.

--Shipment Details--

|Service: Express Shipping
|Insurance: Yes
|Authorization: RMA
|Doc/Tracking No.:SECURED
|Status: e-Notification
------------------------------ --

DHL receipt
 

Sapphire's Strike

Administrator
Staff member
Return Path: <bvdc_cooperative@yahoo.com>
From: BACLARAN VENDORS DEVELOPMENT COOP <bvdc_cooperative@yahoo.com>
Date: 2017-07-06
Subject: DHL Shipment Notification : 8862555998
Reply to: <bvdc_cooperative@yahoo.com>

Dear Consignee,

Please receive your packages:
Your parcel arrived at the post office
Our courier was unable to deliver the parcel to you due to incomplete delivery details.

To receive your parcel
Download the attached receipt and confirm delivery details.

--Shipment Details--

|Service: Express Shipping
|Insurance: Yes
|Authorization: RMA
|Doc/Tracking No.:SECURED
|Status: e-Notification

DHL receipt.html —————> http://businessstartupwisdom.com/wp-content/themes/minicorp/xxyzz.php
 

Sapphire's Strike

Administrator
Staff member
Return Path: <srint@airtelmail.in>
From:DHL_EXPRESS <srint@airtelmail.in>
Date: 11th Aug 2017
Subject: KINDLY CONFIRM YOUR SHIPPING ADDRESS

Dear customer,

Your parcel sent by your customer arrived at our office. Here is your Shipping Document/Invoice and copy of DHL receipt for your tracking.

Please kindly CLICK HERE to View and confirm —————>http://astrodns.com/info/dhh.htm accordingly if your address is correct, before we submit to our outlet officer for dispatch to your destination.

Dispatch Department
DHL Express
 

Hua Mulan

Administrator
Staff member
From: 185.208.209.173,
Netherlands, ContraWeb

Return-Path: <gusss@knust.edu.gh>
Subject: notification of your parcel
From: ''DHL EXPRESS''<gusss@knust.edu.gh>
Date: Tue, 15 Aug 2017
Message-Id: <20170815092525.5DEB43583976@mta.knust.edu.gh>

Hello [[-User-]] ,
Good day,

This is an arrival notification of your parcel at our local post-office.

Use below portal to download/print DHL-AWB (Receipt) to be submitted to courier agent.

View Document Here http://delgadosinsurance.com/wp-content/soja/oke/dhl/?email=alfred2cute@yahoo.co.in

Kindly endeavour to be accurate as possible to reduce time of clearance and recipient confirmation.
Ensure future delivery of our emails in your inbox by adding shipping@dhl.com | © 2017 DHL Express | Customer Service |
 

Sapphire's Strike

Administrator
Staff member
Return Path: <xiangju@mail.de>
From: Dhl_Express Korea <xiangju@mail.de>
Date: 12th Sept 2017
Subject: Your parcel has arrived DHL Office South Korea

Dear Customer,

Your parcel has arrived at the post office.
Our courier was unable to deliver the parcel to you due to incorrect delivery details.
To receive your parcel,download attached receipt and forward to nearest DHL office.

DOWNLOAD ATTACHMENT

Air Way Bill-Receipt.htm —————> http://novatema.com/lll/mao.php
 

Nanook

Administrator
Staff member
Return-Path: <isaac_oyeleke@yahoo.com>
Received: from (EHLO sonic308-45.consmr.mail.ir2.yahoo.com) (77.238.178.181)
Date: Thu, 12 Oct 2017
From: DHL Shipment <isaac_oyeleke@yahoo.com>
Reply-To: DHL Shipment <isaac_oyeleke@yahoo.com>
Subject: BL From DHL ATTACH: DHL SHIPPING#207486

Dear Customer,

A package containing some documents has been dispatched to be delivered to you.

DHL was informed that the package contains Original (BL) Bill of Lading and some other shipping documents for your container.Kindly complete Tracking Procedure to get your tracking number and also confirm you delivery address.

Open the attachment to track shipment

Regards,
DHL Worldwide Delivery ©2017.

DHL .html
 

Miyuki

Administratrix
Staff member
From: 85.158.181.42,
Austria, Villach, Profihost Ag

Message-ID: <20160717162301.29661.qmail@server271-han.de-nserver.de>
Subject: Your DHL Tracking Number Arrived
From: DHL WorldWide Delivery <info@update.com>
Reply-To: info@update.com
Return-Path: info@update.com

DHL Capability Tool

Dear

Your shipment(s) listed below is scheduled for delivery tomorrow. You have a DHL shipment addressed to you.

You need to obtain your Tracking Number so as to check the status of the delivery.

Kindly complete the tracking process on our webpage link www.dhl.com/dl/tracking and also confirm your delivery address .

DHL WorldWide Delivery
 
Dear Customer,

We're experiencing parcel misplacement recently,
It is now mandatory that we confirm delivery address from beneficiary before final delivery.

Kindly Re-confirm your delivery address to ensure safe delivery of the attached documents.

COMFIRM HERE

Failure to confirm address might lead to delay in scheduled delivery or loss of attached document.
------------------------------ -------------------- ---------- -----------------
This e-mail is sent because you are subscribed to the Secured and Newsletter.
NOTE : IF MESSAGE IS FOUND BY ERROR IN YOUR JUNK MAIL KINDLY OPEN AS SAME.


© 2017 DHL Express | Customer Service | www.dhl.com


Clicking the "linkhttp://jikus.tk/rs/DHLAuto/index.php?email=youre-email address" diverts to a fake DHL login site with your recipient email address auto filled. The site is a fake DHL Page that is nothing in anyweay to do with DHL real tracking page which is http://www.dhl.com/en/express/tracking.shtml .
http://jikus.tk/rs/DHLAuto/box3Drenewal.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Mailheader-
Return-Path: jhpark@he-trading.co.kr
Received: from virzmbmtap003.pol.local (LHLO smtp.pobroadband.co.uk)
(10.183.82.199) by virzmbmbxp003.pol.local with LMTP; Tue, 16 Jan 2018
13:05:25 +0000 (GMT)
Received: from localhost (localhost6 [127.0.0.1])
by smtp.pobroadband.co.uk (Postfix) with ESMTP id 6316B200069
for <xxxxxxxxx@mypostoffice.co.uk>; Tue, 16 Jan 2018 13:05:25 +0000 (GMT)
X-Virus-Scanned: amavisd-new at virzmbmtap003.pol.local
X-Spam-Flag: NO
X-Spam-Score: 4.405
X-Spam-Level: ****
X-Spam-Status: No, score=4.405 tagged_above=-10 required=6.6
tests=[BAYES_50=0.8, DATE_IN_FUTURE_06_12=1.947, HTML_MESSAGE=0.001,
MIME_HTML_ONLY=0.723, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_SBL=0.141,
RDNS_NONE=0.793, SPF_PASS=-0.001, URIBL_BLOCKED=0.001]
autolearn=no autolearn_force=no
Received: from smtp.pobroadband.co.uk ([127.0.0.1])
by localhost (virzmbmtap003.pol.local [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id mup15uOwK2ru for <xxxxxxxxxxx@mypostoffice.co.uk>;
Tue, 16 Jan 2018 13:05:23 +0000 (GMT)
Received: from sendfilter02.ktweb.co.kr (unknown [222.122.141.91])
by smtp.pobroadband.co.uk (Postfix) with ESMTP id 24621200275
for <xxxxxxxxx@mypostoffice.co.uk>; Tue, 16 Jan 2018 13:05:03 +0000 (GMT)
Received: from [119.206.195.251] ([119.206.195.251])
by sendfilter02.ktweb.co.kr ([222.122.141.91])
with ESMTP id 1516107906.62912.3069066128.sendfilter02
for <xxxxxxxxxxx@mypostoffice.co.uk>;
Tue, 16 Jan 2018 22:05:06 +0900 (KST)
Received: from [178.216.52.107] ([178.216.52.107])
by kttimsmail5.ktweb.co.kr ([119.206.195.186])
with ESMTP id 1516107889.259382.140409525233408.kttimsmail5
for <xxxxxxxxxxxxxxx@mypostoffice.co.uk>;
Tue, 16 Jan 2018 22:03:47 +0900 (KST)
From: DHL<jhpark@he-trading.co.kr>
To: xxxxxxxxxxxxx@mypostoffice.co.uk
Subject: SUB: AWB: Delivery Address Confirmation Urgent!
X-TERRACE-DUMMYSUBJECT: Terrace Spam system *
X-TERRACE-DUMMYSUBJECT: Terrace Spam system *
Date: 16 Jan 2018 15:20:14 -0800
Message-ID: <20180116152013.47FB46420A3DDD7A@he-trading.co.kr>
MIME-Version: 1.0
Content-Type: multipart/related;

A whois search is useless
Reported to Google as webforgery and phishing site
 

Nanook

Administrator
Staff member
Return-Path: <abutcher@healthethics.ca>
Received: from (EHLO CAN01-TO1-obe.outbound.protection.outlook.com) (104.47.61.225)
From: Delivery Notification <abutcher@healthethics.ca>
Subject: DHL Express
Date: 06 Mar 2018

Your parcel has arrived at the post office on 5th MARCH, 2018. Our courier was unable to deliver the parcel to you due to incorrect delivery details. To receive your parcel, Please see and check attached shipping documents.

VIEW STATUS https://media.csosa.gov/blog/wp-includes/js/plupload/ii/?email=.......@yahoo.com

This automated mail was sent to

Thanks & best regards
Deutsche Post DHL Group Logo