MSGID: 1:396/45.29@fidonet ee178756
PID: OpenXP/5.0.49 (Win32)
CHRS: ASCII 1
TZUTC: -0500
Hello All!

An amateur operating from Austria/Belgium in cahoots with Italy:

Looks genuine enough: https://photos.kolico.ca/tmp/dhl-3.jpg

BUT..

Return-Path: 
Delivered-To: august@ashlies.ca
Envelope-to: books@ashlies.ca
Delivery-date: Wed, 03 Mar 2021 23:02:31 -0500
X-EN-OrigIP: 213.33.87.16
Received: from [192.168.43.137] (19-176-62-37.mobileinternet.proximus.be
[37.62.176.19])
From: noreply@dhlverification.com
To: "books" 
Subject: DHL EXPRESS : Your Package is waiting for delivery
X-Mailer: Microsoft Office Outlook 12.0

This is a multi-part message in MIME format.

------=_NextPart_000_0001_37E711D9.D58E9144
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Dear Client,Your Package is waiting for delivery. Please
confirm the payment (4,99 $) on the link below, the online
verification needs to be done in the next 2 days before it expires

Click here.   Thank you for your trust,
DHL EXPRESS

------=_NextPart_000_0001_37E711D9.D58E9144

The "Click here" boils down to:

 "h##p://gadfi.andrewbasso.it/fadujk"

Any dibs that this guy's name is Andre Basso?

This is almost enough to make me want to switch entirely to pure  
TEXT email.
--
  ../|ug

--- OpenXP 5.0.49
 * Origin:  (1:396/45.29)
SEEN-BY: 1/123 19/25 33 75 90/1 103/705 105/81 106/633 987 120/340
SEEN-BY: 123/131 124/5014 5016 129/305 130/803 154/10 203/0 221/0
SEEN-BY: 226/30 227/114 702 229/101 424 426 452 550 664 700 1016 1017
SEEN-BY: 240/5832 249/110 206 317 400 261/38 280/464 5003 282/1038
SEEN-BY: 288/100 292/854 8125 310/31 317/3 322/757 342/200 387/25
SEEN-BY: 387/26 396/45 423/120 712/848 770/1 2452/250
PATH: 396/45 280/464 229/101 426