Oh look guys @cheshirecat apparently I have a frontier account. Marked it as spam a reported it however seems to be pretty common now days.

There's an awful lot of phishing emails about these days; attackers want your credentials so they can snoop on you waiting for invoices they can change payment details on. 

You already flagged it as spam and reported it; that will let the mail techs tune the system a bit better to block similar ones in the future.  I suspect Spark catch a lot more that you don't see, too.

Sorry but it is time again to resurrect this Topic:

Since the 16 June 2020 been getting almost on a daily basis the below spam. I am not the only one, my brother-in-law and my cousin also. We have all gone into the xtra webmail server and spammed them, but they keep on coming.

Sparks spam filtering AI seems to be slow in learning again.

Anyone else getting these ?

----------------------------------------------------------------------------------

Distribution Centre contact@trackntrace.co.nz

NZ Distribution Centre serv@tracktarnz.co.nz

Your package is on its way

Track your package: #CS279003594DE

OR

Your tracking number is : LZ8942357486EN

STATUS:
The order is being prepared in the warehouse

$3.30 shipping costs have not been paid

DELIVERY TAKES PLACE AFTER PAYMENT

For more informations click the link below:
http://package.track-nz.us/8247da65071170cg15277hh38466to2838gt4733cc?tracking_number=CS279003594DE

OR

http://trace.ontrack.pw/8172jx61924193pt15277zw38466ey2838el4688cc?tracking_number=LZ8942357486EN

FineWine:

 

Sorry but it is time again to resurrect this Topic:

 

Since the 16 June 2020 been getting almost on a daily basis the below spam. I am not the only one, my brother-in-law and my cousin also. We have all gone into the xtra webmail server and spammed them, but they keep on coming.

 

Sparks spam filtering AI seems to be slow in learning again.

 

Anyone else getting these ?

 

----------------------------------------------------------------------------------

 

Distribution Centre contact@trackntrace.co.nz

 

NZ Distribution Centre serv@tracktarnz.co.nz

 

Your package is on its way

 

Track your package: #CS279003594DE

 

OR

 

Your tracking number is : LZ8942357486EN

STATUS:
The order is being prepared in the warehouse

$3.30 shipping costs have not been paid

DELIVERY TAKES PLACE AFTER PAYMENT

For more informations click the link below:
http://package.track-nz.us/8247da65071170cg15277hh38466to2838gt4733cc?tracking_number=CS279003594DE

 

OR

 

http://trace.ontrack.pw/8172jx61924193pt15277zw38466ey2838el4688cc?tracking_number=LZ8942357486EN

 

Yeah both wife and I are getting this.

What sort of Sender and Subject do they all have?  I want to see if I can find one to scan the headers.

Whatttt it use to be only $3.25! (and come in by txt)

https://www.zmonline.com/the-latest/watch-out-for-this-track-and-trace-parcel-delivery-scam-targeting-nz/ 

cheshirecat:

 

What sort of Sender and Subject do they all have?  I want to see if I can find one to scan the headers

Received: from fhaamez.com ([15.236.211.150]) by mx.xtra.co.nz with ESMTP id 5EFF7ED0-6E4D039C@mta2301; Fri, 03 Jul 2020 18:54:08 +0000
Subject:Your package details
Message-ID: <CA.48.11221.0DE7FFE5@xtra.co.nz>
Date:Fri, 03 Jul 2020 20:44:40 +0200
To:************@xtra.co.nz
From:"NZ Distribution Centre " <serv@tracktarnz.co.nz>

Received: from volecanik.com ([15.236.211.45]) by mx.xtra.co.nz with ESMTP
 id 5EFD20E2-D6BE0091@mta2304; Wed, 01 Jul 2020 23:48:51 +0000
Subject:Follow your package : Shipping services
Message-ID: <80.93.21537.2E02DFE5@xtra.co.nz>
To:************@xtra.co.nz
Date:Thu, 02 Jul 2020 01:44:24 +0200
From:"Distribution Centre" <srvce@tracktranez.co.nz>

Received: from tre-bx7kz.com ([15.236.5.8]) by mx.xtra.co.nz with ESMTP
 id 5EFAA4D3-5380007F@mta2306; Tue, 30 Jun 2020 02:34:59 +0000
Date:Tue, 30 Jun 2020 04:25:28 +0200
Message-ID: <40.9B.28116.3D4AAFE5@xtra.co.nz>
To:************@xtra.co.nz
From:"Distribution centre" <srvce@tracktranz.co.nz>
Subject:Track your package: #CS279003594DE

Received: from out21.xtra.co.nz ([15.236.208.238]) by mx.xtra.co.nz
 with ESMTP id 5EE7D139-F2620598@mta2307;
 Mon, 15 Jun 2020 19:51:22 +0000
Date:Mon, 15 Jun 2020 21:46:26 +0200
Message-ID: <51.A5.27964.931D7EE5@xtra.co.nz>
Subject:Your package is on its way
From:"QuickFleet Couriers" <contact@trackntrace.co.nz>
To:************xtra.co.nz

Moving and not paying the retainer thankfully I no longer have the issue.

But good to see such a complex system still can't just blacklist unverified/known bad domains. (none of them exist - all spun up fakes on AWS by the looks of originating IPs)

Looks like random senders, random subjects, on temporary AWS host IPs, with randomised content.  Really difficult to positively identify without a high rate of false positives - though there are likely a lot of them being caught even so.

FineWine:

 

Sorry but it is time again to resurrect this Topic:

 

Since the 16 June 2020 been getting almost on a daily basis the below spam. I am not the only one, my brother-in-law and my cousin also. We have all gone into the xtra webmail server and spammed them, but they keep on coming.

 

Sparks spam filtering AI seems to be slow in learning again.

 

Anyone else getting these ?

 

----------------------------------------------------------------------------------

 

Distribution Centre contact@trackntrace.co.nz

 

NZ Distribution Centre serv@tracktarnz.co.nz

 

Your package is on its way

 

Track your package: #CS279003594DE

 

OR

 

Your tracking number is : LZ8942357486EN

STATUS:
The order is being prepared in the warehouse

$3.30 shipping costs have not been paid

DELIVERY TAKES PLACE AFTER PAYMENT

For more informations click the link below:
http://package.track-nz.us/8247da65071170cg15277hh38466to2838gt4733cc?tracking_number=CS279003594DE

 

OR

 

http://trace.ontrack.pw/8172jx61924193pt15277zw38466ey2838el4688cc?tracking_number=LZ8942357486EN

 

I’m pleased you brought this up - Yep, been getting those and a lot of other spam starting to get through again too. A step backward by Spark/xtra here. It had been quite good for the past year or so.

Yes I’m getting them daily as well glad I not the only one 

I get these, and slackly, I haven't bothered to anti spam them in webmail. But I don't get a lot of spam either. In my "poor" defence, spam is normal, no provider will ever be spam free.

I have a gmail account for Youtube, what a freaking mess

eracode:

 

I’m pleased you brought this up - Yep, been getting those and a lot of other spam starting to get through again too. A step backward by Spark/xtra here. It had been quite good for the past year or so.

Yep almost to the year since this topic was last posted into:

27-Jul-2019 19:54 till 4-Jul-2020 10:10

All three of us plus the wife of one, so now that makes 4 in my family, that I know of, are getting these Tracking spam emails.

I also forgot to mention BMW & Bitcoin ones have started up again after a year of being filtered out or silent.

EDIT: spelling

FineWine:

Yep almost to the year sense this topic was last posted into:

27-Jul-2019 19:54 till 4-Jul-2020 10:10

All three of us plus the wife of one, so now that makes 4 in my family, that I know of, are getting these Tracking spam emails.

I also forgot to mention BMW & Bitcoin ones have started up again after a year of being filtered out or silent.

tdgeek:

 

I get these, and slackly, I haven't bothered to anti spam them in webmail. But I don't get a lot of spam either. In my "poor" defence, spam is normal, no provider will ever be spam free.

 

True - but the point is: Spark/xtra has actually been quite good on this for about a year - now we're slipping back to where we were previously.