An
Email with the Subject "DHL related documents" was
received in one of Scamdex's honeypot email accounts on 06 Jul 2020 04:36:07 -0000
and has been classified as a Generic Scam Email.
The sender shows as <dhltn.billing@dhl.com> (DHL).
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
Scam TagCloud
wincustomercustomach(dhl)dear
NO CHART DATA - EMAIL HAS NOT YET BEEN ANALYSED
Scam Email Headers
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] =>
[delivered-to:] => Array
(
[0] => unknown
[1] => scamdex@gmail.com
)
[received:] => Array
(
[0] => from imap.gmail.com (74.125.195.108:993) by mail.scamalot.com with IMAP4-SSL; 06 Jul 2020 04:36:07 -0000
[1] => by 2002:a05:6638:24f:0:0:0:0 with SMTP id w15csp3589667jaq; Tue, 16 Jun 2020 07:01:06 -0700 (PDT)
[2] => from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id e141sor4854414lfd.12.2020.06.16.07.01.05 for (Google Transport Security); Tue, 16 Jun 2020 07:01:05 -0700 (PDT)
[3] => from host-80-21-190-42.business.telecomitalia.it (host-80-21-190-42.business.telecomitalia.it. [80.21.190.42]) by gmr-mx.google.com with ESMTP id u23si972018ljg.7.2020.06.16.07.00.40; Tue, 16 Jun 2020 07:01:05 -0700 (PDT)
[4] => from [152.75.85.49] (helo=EOCYVIE.HILETUT.qmq) by host-80-21-190-42.business.telecomitalia.it with esmtpa (Exim 4.85) (envelope-from ) id 9A474D6C7C for ebmaster@scamdex.com; Tue, 16 Jun 2020 15:00:55 +0100
[5] => from [181.214.189.178] (helo=NYZYVEWE.czchols4711.prg-dc.dhl.com) by host-80-21-190-42.business.telecomitalia.it with ESMTPA id 9EB0C006B538 for ebmaster@scamdex.com; Tue, 16 Jun 2020 15:00:55 +0100
)
[x-received:] => Array
(
[0] => by 2002:a19:4945:: with SMTP id l5mr1854252lfj.12.1592316065792; Tue, 16 Jun 2020 07:01:05 -0700 (PDT)
[1] => by 2002:ac2:5cac:: with SMTP id e12mr1843072lfq.92.1592316065434; Tue, 16 Jun 2020 07:01:05 -0700 (PDT)
)
[arc-seal:] => Array
(
[0] => i=2; a=rsa-sha256; t=1592316065; cv=pass; d=google.com; s=arc-20160816; b=rz8/5jklWwENin4Wx0yMRPSstn7zNeRn+52aVkdP4bh+wz2SL1j0fOKVaDWI/MtCHk UdcIfvOlvHlmkxu7tqxML0r+aAVWvx35GUzt4EkyYotROVG2DGyrRkIrctgbqElvE/Lc Wih/VsDO0VIMaK0r+4iKVhgkKe5Jb8SfE5iK3l+6a2Ln9kSFpTT8QXRM81udFocw8SfT l4ySdGFzHYWZc6H4aur1SH/5DpNUVlX9wYfRnNcF96yPikDnTCmkYx0nkL89X9p4nYtZ mL8OJIrdMMrXz11FmBaM9cv6ad4r9Je9ZxgcVEWcrrFhltq2I4C1OXo5akEZXkOZJBQ7 /gPQ==
[1] => i=1; a=rsa-sha256; t=1592316065; cv=none; d=google.com; s=arc-20160816; b=s0dhlXJmKAEXzKxoMqpFsnuOdFYqcyxid7r+/i3XUaQw7I0We5ax+TrNwosULSaFsB bQ+HM/bKGcdSRRRNRZvt2Dxy95651orlSkR7+chxUd3G/1DhFBy18loy+9aVh4ryUmhZ 7Lwy//Bk71v6gt7diCZqagFb1vY7qq3hGid69eVnF63PCjtxWfEw5pT42S1gyy+6b0Zw C3EI1EQDHK5zXKpnubAta0WnF96b8PzuOkJlyp6aVSjSwmakHn6ToA1+AYBOXx+ABQMr mTyQnnxfF8JvH3Re4lYDzEgZLczny/mEcbl2HwKcBPp6Iu61oW4lwe8f8S/qibwZi204 ZAUA==
)
[arc-message-signature:] => Array
(
[0] => i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:mime-version:thread-index:date:from:subject:to; bh=UT7rdX/pOgs0VXXWC4lpPfpBka3CRq0Fpx3ung0jIPw=; b=dDTAKUO+PZU0y2sVu5ctVfoqUkpthDu5bRhgvxIIxEODaV2DRbPwT7nBb21mhXYJpr L4nuqfccWZfRa0/V9APgg+A2lLM1lny4fKFUn1SCxgAGpCcgvBYyRqz7Fu6CdXb9DRnR kegyO4vSIQGGDmryOSx1e8636NeBapeS/ciM2ZFzM21e9xu5Q2OIXOUar+TyHEEFv0be rG+KTvHVIpyfF5NzNuRimOkZVACFZrhGis542oPofdh3Xg8NCCdmvqEpyas41xLpmUVv +9ya9c/om11neKA9agaZXpX5LcrW1nbyUug2qS844Jzy06DzZygtrpsjYMeeLzJwF3BI HANQ==
[1] => i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:mime-version:thread-index:date:from:subject:to; bh=UT7rdX/pOgs0VXXWC4lpPfpBka3CRq0Fpx3ung0jIPw=; b=ppDxyzlMYTpmt6cxmbXETSLweP2iGoadEHQXO4RBa3h044PXYsK/yG0A7Yom67IKTA zUHsgcq8ooa0saO3Izwi3hS/TWUE7vgpm5p2BmXFz7zyh4Qh8G2vgC/9xKnXbKqFu5KS 4MW9HqUE1UX77GBOZoOQ2yUfo+0V+kiza8EPRGze+h67gXyMUjo+DL3GZJ/I1P6C+SL0 eMVJeZRYm/3lMsEuxeZ1YgDsVKxjPwiiz9NTNOJDL5tBcwYf7rLuNoHH+DikauH9nkRW yLdBCHvM76BZEUHgsp+l/PQGeKIuCAEymlkeBK6w7L9ysiLAlzcVR4pJpE6XC9v19zpL IZKQ==
)
[arc-authentication-results:] => Array
(
[0] => i=2; mx.google.com; arc=pass (i=1); spf=neutral (google.com: 209.85.220.41 is neither permitted nor denied by best guess record for domain of demerited385@czchols4711.prg-dc.dhl.com) smtp.mailfrom=demerited385@czchols4711.prg-dc.dhl.com; dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE) header.from=dhl.com
[1] => i=1; gmr-mx.google.com; spf=neutral (google.com: 80.21.190.42 is neither permitted nor denied by best guess record for domain of demerited385@czchols4711.prg-dc.dhl.com) smtp.mailfrom=demerited385@czchols4711.prg-dc.dhl.com; dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE) header.from=dhl.com
)
[received-spf:] => Array
(
[0] => neutral (google.com: 209.85.220.41 is neither permitted nor denied by best guess record for domain of demerited385@czchols4711.prg-dc.dhl.com) client-ip=209.85.220.41;
[1] => neutral (google.com: 80.21.190.42 is neither permitted nor denied by best guess record for domain of demerited385@czchols4711.prg-dc.dhl.com) client-ip=80.21.190.42;
)
[authentication-results:] => mx.google.com; arc=pass (i=1); spf=neutral (google.com: 209.85.220.41 is neither permitted nor denied by best guess record for domain of demerited385@czchols4711.prg-dc.dhl.com) smtp.mailfrom=demerited385@czchols4711.prg-dc.dhl.com; dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE) header.from=dhl.com
[x-google-dkim-signature:] => v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:to:subject :from:date:thread-index:mime-version:message-id; bh=UT7rdX/pOgs0VXXWC4lpPfpBka3CRq0Fpx3ung0jIPw=; b=U/J6/OW2VK1MeM6n7PbvlMVDbyQR9iqm66Knvka9w0gITfs38C9P/PHi6V7+C+1Tcs ilA09rVX42y7o0Y0TJz2YBVPJCTATa8/fO08xmhlxUeWFg62HADUeUzt2I9v1Y/6NBai s+B7XdLMGlOIaGKbX/Bp+ypYR5EuwgpUCXYJIWUddn2UdJj2pE56cET7149zpUQtK6OF 7eFiSs0lVFH1wIXpXGhiW8f/xbv96PEAfrtERVhtxNSVCsSZlXvZgDYz8EqwYKvOflgA AWAwisjegGQiJjiFTAS2yov+wLu1jtuMpPZV0oKUEcHemuFovph+1AasKjxXc57X6aFL lk0A==
[x-original-authentication-results:] => gmr-mx.google.com; spf=neutral (google.com: 80.21.190.42 is neither permitted nor denied by best guess record for domain of demerited385@czchols4711.prg-dc.dhl.com) smtp.mailfrom=demerited385@czchols4711.prg-dc.dhl.com; dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE) header.from=dhl.com
[x-gm-message-state:] => AOAM530K7E2vMbXch0eGHzPrBp85WW3IS0D65rAlUy+n/b6nObfqaYzN f8P2fnS2n8vhBrYADu/BXcXW7nhQlYcNN3p19w==
[x-google-smtp-source:] => ABdhPJwTBNLA67XCSutOFOEb+zXpbIEgdw4jguV48eKX9cW9DubmMtIBzBTzgsQHryhEsWbTtf6/9RjKZRod29LSuvjWnkr5X9M=
[to:] => ebmaster@scamdex.com
[subject:] => DHL related documents
[from:] => (DHL)
[date:] => Tue, 16 Jun 2020 15:00:55 +0100
[thread-index:] => 4EUJhoKL7RAkniHllFjVbTFsybH9X==
[mime-version:] => 1.0
[message-id:] => <577373.18210.rh@BOVIDORA.czchols4711.prg-dc.dhl.com>
[content-type:] => multipart/mixed; boundary="----_Part_1494636_49633792.6048366560932"
[x-getmail-retrieved-from-mailbox:] => =?utf-8?q?=5BGmail=5D/Spam?=
[x-gmail-thrid:] => =?utf-8?q?1669664410969803584?=
[x-gmail-msgid:] => =?utf-8?q?1669664410969803584?=
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.