A couple of days ago, a friend of mine got the following email, formatted in HTML (I have replaced some possible identifying information with *’s):

From: Canada Post <tracking@canadapost.ca>
Subject: Missed package delivery!
Reply-To: tracking@canadapost.ca

Dear customer,

We attempted to deliver your item on September 18th, 2012 , 08:14 AM.
The delivery attempt failed because nobody was present at the shipping address, so this notification has been automatically sent.
You may arrange redelivery by visiting the nearest Canada Post office with the printed shipping inboice mentioned below.

If the package is not scheduled for redelivery or picked up within 48 hours, it will be returned to the sender.
TRACKING Number: *************
Expected Delivery Date: September 18th, 2012
Class: Package Services
Service(s): Delivery Confirmation
Status: eNotification sent

To check on the delivery status of your mailing or arrange redelivery please visit the following URL:

http://www.canadapost.ca/cpotools/apps/track/personal/findByTrackNumber?execution=****

To download the shipping invoice, visit the following link:

http://www.canadapost.ca/cpotools/apps/track/personal/findInvoiceByTrackingNumber?session_id=**********

Thank you,
© 2012 Canada Post Corporation

*** This is an automatically generated email, please do not reply ***

The From address indicates that the message came from Canada Post. Furthermore, the body of the message was accompanied by a Canada Post logo (not shown here), which made the message look even more legit.

Notice that there are two hyperlinks in the above message, which on first glance look benign. On closer inspection, however, …Continue reading » New Phishing Campaign Targeting Canada Post Customers