UPS Shipping service report Q76WQCOQBV
[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]
VERY IMPORTANT INFORMATION, READ THIS FIRST: The example and associated information published on this page are subject to the SHPAMEE Terms Of Use. Please familiarise yourself with these terms before viewing or using any information on this page.
Header:
From - Mon Sep 30 20:47:23 2013
X-Account-Key: account2
X-UIDL: x
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: x
X-YahooFilteredBulk: 98.139.212.254
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: x
X-Originating-IP: [98.139.212.254]
Authentication-Results: mta1018.mail.ir2.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass
(ok)
Received: from 127.0.0.1 (EHLO nm15-vm0.bullet.mail.bf1.yahoo.com) (98.139.212.254)
by mta1018.mail.ir2.yahoo.com with SMTP; Tue, 24 Sep 2013 20:05:36 +0000
Received: from [66.196.81.172] by nm15.bullet.mail.bf1.yahoo.com with NNFMP; 24 Sep 2013 20:05:35 -0000
Received: from [98.139.212.207] by tm18.bullet.mail.bf1.yahoo.com with NNFMP; 24 Sep 2013 20:05:35 -0000
Received: from [127.0.0.1] by omp1016.mail.bf1.yahoo.com with NNFMP; 24 Sep 2013 20:05:35 -0000
X-Yahoo-Newman-Id: 149181.5032.bm@omp1016.mail.bf1.yahoo.com
Received: (qmail 74498 invoked by uid 60001); 24 Sep 2013 20:05:35 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1380053135;
bh=FCpR+1SaChIG5rphoJLUmczz9htsnwglAFBWwYBjBdk=;
h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:T...
b=kHhvTtJEdcSPg4M/76R6iV96OyH4Ub9gjI5xCvxABMNqRywyUOP35ZXhdPUF+Fdi4sfClEtDwVfOyojnIhvI/a8...
sAC1qvqcUSnzYK+lPquYwnlNd5u90rEhHzqiP1Wmv+UND4fm/0y7o=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:T...
b=5Kx8xeuwOpl/vEPN/Jm6BBsA5uWwZAJYhYTqlYWaWTk42fyYZF/9MhZZQGX3uPKqLEA9Ee6BC6UsuM3H7h6lovw...
GlhF/fJ5CMl3aGM60YVBbrFTGJRrJw2paSon1Qy7BDAdBzUd+hobE=;
X-YMail-OSG: AALlpCMVM1kNGfC9OIzb8XqDvPx2gho2Wrj_l8KrXn55gNM
hTB62KruHhXE2Hk97onXo
Received: from [88.251.225.42] by web164905.mail.bf1.yahoo.com via HTTP; Tue, 24 Sep 2013 13:05:34 PDT
X-Mailer: YahooMailWebService/0.8.157.561
Message-ID: <x@web164905.mail.bf1.yahoo.com>
Date: Tue, 24 Sep 2013 13:05:34 -0700 (PDT)
From: UPS Shipping service <abbie.sauve@yahoo.com>
Reply-To: UPS Shipping service <abbie.sauve@yahoo.com>
Subject: [Bulk] UPS Shipping service report Q76WQCOQBV
To: Jason <x>,
Ian Tritschler <x>
Cc: x
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="-634521769-1444984357-1380053134=:50408"
X-Account-Key: account2
X-UIDL: x
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: x
X-YahooFilteredBulk: 98.139.212.254
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: x
X-Originating-IP: [98.139.212.254]
Authentication-Results: mta1018.mail.ir2.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass
(ok)
Received: from 127.0.0.1 (EHLO nm15-vm0.bullet.mail.bf1.yahoo.com) (98.139.212.254)
by mta1018.mail.ir2.yahoo.com with SMTP; Tue, 24 Sep 2013 20:05:36 +0000
Received: from [66.196.81.172] by nm15.bullet.mail.bf1.yahoo.com with NNFMP; 24 Sep 2013 20:05:35 -0000
Received: from [98.139.212.207] by tm18.bullet.mail.bf1.yahoo.com with NNFMP; 24 Sep 2013 20:05:35 -0000
Received: from [127.0.0.1] by omp1016.mail.bf1.yahoo.com with NNFMP; 24 Sep 2013 20:05:35 -0000
X-Yahoo-Newman-Id: 149181.5032.bm@omp1016.mail.bf1.yahoo.com
Received: (qmail 74498 invoked by uid 60001); 24 Sep 2013 20:05:35 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1380053135;
bh=FCpR+1SaChIG5rphoJLUmczz9htsnwglAFBWwYBjBdk=;
h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:T...
b=kHhvTtJEdcSPg4M/76R6iV96OyH4Ub9gjI5xCvxABMNqRywyUOP35ZXhdPUF+Fdi4sfClEtDwVfOyojnIhvI/a8...
sAC1qvqcUSnzYK+lPquYwnlNd5u90rEhHzqiP1Wmv+UND4fm/0y7o=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:T...
b=5Kx8xeuwOpl/vEPN/Jm6BBsA5uWwZAJYhYTqlYWaWTk42fyYZF/9MhZZQGX3uPKqLEA9Ee6BC6UsuM3H7h6lovw...
GlhF/fJ5CMl3aGM60YVBbrFTGJRrJw2paSon1Qy7BDAdBzUd+hobE=;
X-YMail-OSG: AALlpCMVM1kNGfC9OIzb8XqDvPx2gho2Wrj_l8KrXn55gNM
hTB62KruHhXE2Hk97onXo
Received: from [88.251.225.42] by web164905.mail.bf1.yahoo.com via HTTP; Tue, 24 Sep 2013 13:05:34 PDT
X-Mailer: YahooMailWebService/0.8.157.561
Message-ID: <x@web164905.mail.bf1.yahoo.com>
Date: Tue, 24 Sep 2013 13:05:34 -0700 (PDT)
From: UPS Shipping service <abbie.sauve@yahoo.com>
Reply-To: UPS Shipping service <abbie.sauve@yahoo.com>
Subject: [Bulk] UPS Shipping service report Q76WQCOQBV
To: Jason <x>,
Ian Tritschler <x>
Cc: x
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="-634521769-1444984357-1380053134=:50408"
Body:
UPS Notification
Our company`s courier cann`t make the delivery of parcel.
REASON: Wrong postal code
DELIVERY STATUS: sort order
SERVICE: Three-day shipping
NUMBER OF parcel: Q76WQCOQBV
FEATURES: No
Print the enclosed file for details.
An extra information:
If the parcel isn`t received within 20 working days our company will have the right to claim compensation from you for it`s keeping in the amount of $7.77 for each day of keeping of it.
Thank you for using our service.
UPS Global
REASON: Wrong postal code
DELIVERY STATUS: sort order
SERVICE: Three-day shipping
NUMBER OF parcel: Q76WQCOQBV
FEATURES: No
Print the enclosed file for details.
An extra information:
If the parcel isn`t received within 20 working days our company will have the right to claim compensation from you for it`s keeping in the amount of $7.77 for each day of keeping of it.
Thank you for using our service.
UPS Global
Comments:
Related Cyber Criminal Profiles:
No related profiles found.Similar Spam Examples:
Parcel Delivery Malware Spam - FedEx Delivery Problem No 7189Parcel Delivery Malware Spam - DHL delivery failure report
Malware Spam - UPS Delivery Notification Tracking Number:APHQUV26F29IG4UFOZ
Parcel Delivery Malware Spam - Royal Mail Shipment Status No 00087904
UPS Parcel Malware Spam - United Parcel Service notification
Related Malware Samples:
PARCEL-443HFD3004.exe - Trojan.horse.SHeur4.BQSX[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]
The UPS will not make silly typos like this.
The name of the enclosed file was PARCEL-UQVT9Z3C8W.zip. The zip file contained an executable file (thus not a printable file) called PARCEL-443HFD3004.exe, infected with the SHeur4.BQSX trojan horse. As you can see, none of these file names relate to the so-called parcel reference number stated in the e-mail, another silly mistake made by the spammers.