ATB Phish
Posted by Dave Yadallee on
From - Sat Sep 30 14:39:01 2017
X-Account-Key: account2
X-UIDL: 000645bb501fb806
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-path:
Envelope-to: aboo@nk.ca
Delivery-date: Sat, 30 Sep 2017 14:39:00 -0600
Received: from mail-eopbgr690042.outbound.protection.outlook.com ([40.107.69.42] helo=NAM04-CO1-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLSv1.2:ECDHE-RSA-AES256-SHA384:256)
(Exim 4.89 (FreeBSD))
(envelope-from)
id 1dyOX7-000FfC-Bd
for aboo@nk.ca; Sat, 30 Sep 2017 14:38:49 -0600
Received: from SN1NAM04FT011.eop-NAM04.prod.protection.outlook.com
(10.152.88.60) by SN1NAM04HT079.eop-NAM04.prod.protection.outlook.com
(10.152.89.98) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.35.14; Sat, 30
Sep 2017 20:38:36 +0000
Authentication-Results: spf=none (sender IP is 96.90.254.125)
smtp.mailfrom=atbserver0.atbf.com; nk.ca; dkim=none (message not signed)
header.d=none;nk.ca; dmarc=none action=none header.from=atbserver0.atbf.com;
Received-SPF: None (protection.outlook.com: atbserver0.atbf.com does not
designate permitted sender hosts)
Received: from ex.straitsrestaurants.com (96.90.254.125) by
SN1NAM04FT011.mail.protection.outlook.com (10.152.88.104) with Microsoft SMTP
Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id
15.20.56.11 via Frontend Transport; Sat, 30 Sep 2017 20:38:35 +0000
Received: from [192.168.0.3] (40.132.64.192) by EX.straits.local (10.3.88.50)
with Microsoft SMTP Server id 14.3.319.2; Sat, 30 Sep 2017 13:38:32 -0700
Subject: [0] ATB - One private message.
X-mailer: Load_Delle v4.4
Content-Type: text/html
To:
X-Spam-Flag: YES
Content-Transfer-Encoding: 7bit
X-SA-Exim-Connect-IP: 96.90.254.117
X-Antivirus-Scanner: Clean mail though you should still use an Antivirus
From: ATB Financial
MIME-Version: 1.0
Message-ID:
Date: Sat, 30 Sep 2017 13:38:32 -0700
X-EOPAttributedMessage: 0
X-Matching-Connectors: 131512775163415050;(293fc2d2-3e2d-4ca6-cf7f-08d452aa379c);()
X-Forefront-Antispam-Report:
CIP:96.90.254.125;IPV:NLI;CTRY:US;EFV:NLI;SFV:NSPM;SFS:(10009020)(7966004)(336005)(376002)(346002)(39380400002)(2980300002)(428002)(199003)(189002)(50226002)(189998001)(2420400007)(230700001)(8676002)(16576012)(498600001)(7110500001)(5660300001)(316002)(15650500001)(31696002)(5003940100001)(16799955002)(356003)(861006)(117156002)(81156014)(8936002)(50986999)(50466002)(27156004)(69596002)(6916009)(81166006)(42882006)(22746007)(105586002)(98436002)(33646002)(101416001)(104016004)(2351001)(86362001)(23846002)(22756006)(347745004)(606006)(106466001)(4743002)(77096006)(31686004)(2906002)(15188155005)(733005)(551934003)(53376002)(10126004)(10710500007)(9686003)(575854001)(236005)(6306002)(462464002)(105646017)(79686003)(19627235001);DIR:OUT;SFP:1101;SCL:1;SRVR:SN1NAM04HT079;H:ex.straitsrestaurants.com;FPR:;SPF:None;PTR:96-90-254-125-static.hfc.comcastbusiness.net;A:1;MX:1;LANG:;
X-Microsoft-Exchange-Diagnostics: 1;SN1NAM04FT011;1:fUH+LmCLZoOI7DgASnBBp8wv1Dc9ZiuLpbo6Ma2xZStfza3qr+kq9iW5/D+pOhDiXFXgZzCnaJXH/0VCGM427uT9zM9viy3LVaVPQjwuxPutZHi6UD8WyLdlki8c5Qyb
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: d2aeee05-b841-4c07-0092-08d508433978
X-Microsoft-Antispam:
UriScan:;BCL:0;PCL:0;RULEID:(22001)(2017052603199)(201703131430075)(201703131517081);SRVR:SN1NAM04HT079;
X-Microsoft-Exchange-Diagnostics:
1;SN1NAM04HT079;3:/T2ZHpKzNeNVcrizKMMJVvJ0II2yDENg7BQFDPhSLyX9cwkarq8kRwp9VdSEvfaq1T0A60RKDw5SSOMDM5C4QWsF4CJ1ouEaIay9dZ0MiVw0AuCAzKMPoh9+K2PhZB3E4dmWpj2nf4v389QcDzYCFSv9g5ZuodG58OFrqXBejlFPhkGDzry0EpfWqGAZnPlWEOym083leECBZ/ddMc3I8MzydhseLNSiu9Ql6fd6OFhSGddIhi+n12NHmtkflNAknRCsvBJ/ZtCXB4VcxbXzST/awG3K+EBwJbVEmEqjSOLatMQbrR5bWNAbupqRupGn7kUPB/3smzFgX84tO3RMYDCLMIohkW/pQ3gwwxwGOik=;25:NxTNwTICXlRl+dFzy+7khMKJfEALS+661a82pyYg98wZNYJu5uUfKcKj8mp0i5iIZWVmZAzk3W9g8Ap43tZ2w9RVG73r/oCWoxdZKxyKLDCk+Li8EGHnn/5UPJw8qbSXhmD/wiZYWRQ3jgMvNCbbMQLO3VXLOaIpjwcE++SmTDD/AGwQMvpyER/2+Kj0D4ro6oEiqJtHKg5i9gj6DWl+cIPknhrlssJhbPKtV6HSgI9VO3YLeGR5NFSwl/UAHpx9hrGN2TemwY6fEoys1Rj1d7DrcvqFIgwSKm+lKrzJurooOIxEJ/q+gg5Id3asmrukyhK13fcbqSPVfZKixkNS5Q==
X-MS-TrafficTypeDiagnostic: SN1NAM04HT079:
X-Microsoft-Exchange-Diagnostics:
1;SN1NAM04HT079;31:PJY93ByTEm+8A0C5wX0HQEbXrMbNmiuV6Na38RFa2y9CYVHH++0PYX9BrFYVT6BY3Idi7wyJ0CLpHFc4QQjEhDlDt5JnNCMPFZDxPznz233nmFW925yj9wlUucjMvhT7G1ckfxFw/HGIcUImpiuMArHMhCMQDgwjCPNT4XrXxAhrUBQFgH9Xtkgw/8CFcF7GDK9AIh0H3KNBYnMTeyN8cA6tMMT3yIlkg0jCMYnWFtM=;4:AsFHMHXctCljTMCNvF0f4XwqeBGK+qPOU9t9GYYWaOxkICfoP7IMk6bFGh8PevkVK1EdjmcIFVwDWy8nZT2TWLPxwsaQz6B/mG2R24+RlXd/EjNGTGPI1KTqjQ0cSexEkHMSAEFgRmKYiJQ+wAQzpV78eIVXZvpehvXs5E58ZI8lehTeV87lukXhZZspwigeZYVn78m1lseMCn+BgeUL5D+PD6d5vJDe0QGUzgMcBEvEFnlbhbg1dilEBztrW2iwb1mAJ++uYB+4WciNm+hF3zhq/SS9DPHQPtZYX8D9xi1gM8GDJyz93Q4LlD3Kha82Irq70KPXl5+RH702/NKydA==
X-Exchange-Antispam-Report-Test: UriScan:(209352067349851)(192374486261705);
X-Microsoft-Antispam-PRVS:
<174a539e022444468917618a1951a5d9@SN1NAM04HT079.eop-NAM04.prod.protection.outlook.com>
X-Exchange-Antispam-Report-CFA-Test:
BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6095135)(2401047)(5005006)(8121501046)(100000703101)(100105400095)(93006095)(93003095)(10201501046)(3002001)(6055026)(6096035)(20161123563025)(20161123559100)(20161123565025)(20161123561025)(20161123556025)(201703131430075)(201703131441075)(201703131448075)(201703131433075)(201703161259150)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN1NAM04HT079;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(400006)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN1NAM04HT079;
X-Forefront-PRVS: 0446F0FCE1
X-Microsoft-Exchange-Diagnostics:
=?us-ascii?Q?1;SN1NAM04HT079;23:tm9zFbNeJq+VXZsZjxsVtb/FmnUKz8PlqjtVyMgYe?=
=?us-ascii?Q?rbne+aRjokUVwyYlN+yOoTEl11V5tMUVFv5qcK/sKuYNuto9PeSDbZeDa+a+?=
=?us-ascii?Q?Ah5jtdz/rm6VGtyjUGdMZXkIBhLJnRQjXKzKK+vTkl1+LkTyIfLFjV+IMItA?=
=?us-ascii?Q?M3O+2addrM6K6vfGL4ZqY/33/0EeyI6TAVR+yhrtLQNB89XYD3IG47kop21n?=
=?us-ascii?Q?tUSUNF+ZBqoFMrpVTFAGPRsmadLqdf7ivQ0CDmPjuObgOL6fviQ34JM7jCsU?=
=?us-ascii?Q?JYmoiwd9xhnVYQjZjMnJaTaqwFZ1Mp0I412MYmCODjHb9IdQD61X3Rf174Lq?=
=?us-ascii?Q?51Qua/mgRy6NAZy+iO3aDc3sC/WPsRna+iiBC/OkyAqqcrb59bTt6ziwxppF?=
=?us-ascii?Q?zOAaD3cgit3vXnnPM0G4ePcXMNuyPrAfBx5lYJn8v3PZGWVYUyQM0zMYYtyW?=
=?us-ascii?Q?lmnF2SC6Ur28DFv8N3VpW+8UXyGtfrEcunhfzYFNttGZ0USfItkJ9pkCxSSu?=
=?us-ascii?Q?Nb1AWWGPi/0tHqudY8Z6poDc+vKf8fENDdZEDfCWHiX3nO508kdXMuvjXQFc?=
=?us-ascii?Q?a14JFKFSoYpjrFLMaa+YEzzoEtJUF+JQNgC4FY3ZWrCTaI4jY8bHVgi/HNAw?=
=?us-ascii?Q?xQskES6aR5la05t5EBfBa7OERGXhLdT5yp+7ntwNSYYucOnpG/J2H0o+wV+t?=
=?us-ascii?Q?Ud+tYKUegJw4pHemUo0nSzGmN2MNocHljj2pLRs6huQRa/0prV6VTRGuAOC0?=
=?us-ascii?Q?bq1AXdesMPDEKo2tOEoSf/Io/3PnipImxlYdOrGT10BRilgz58kn+mzxgbEj?=
=?us-ascii?Q?e9u4KmLjN/62BU0e7tJSleRtXyoaHQSZRKrC882zBozxjBzcLP9qux/NvQhJ?=
=?us-ascii?Q?kPHYx3xnVbkDPwCHf4vLFRPz9fkyFFk7F0JYR/k+3jq0eWqouweG9iFQf8dd?=
=?us-ascii?Q?aIOstPwHCIK05jiIgK9KP8i6NnxS6/SaNYX9HeRkB658KLAWsLKBpPEbIFcS?=
=?us-ascii?Q?cfkAZPU3TXMD8HPK6J90ZKEP4m6NbovrJw1GiKTTOILmN/WdyzA4V3N5ARP0?=
=?us-ascii?Q?AgunWP1UO4mf7U0acJT8ijPqBcB1OniTN28hpgHaqFVVxHnYgsKb+0regqO/?=
=?us-ascii?Q?8SJocjglg/il/Qj1nUSRjatJL2vkQJeVXP9cmXg7ncx4AJhgBoQchFzkT9Wx?=
=?us-ascii?Q?fdE+fhdpS7/HjmMWXOi3feRivBJMcvdLKBmd5eFUoSM+efacjj6X6toXedAC?=
=?us-ascii?Q?1MQW7erZTc5L6MbPZvxPX6EOEEAqzo72Isqvi/abwtr6tnonmQljmM3e+MUi?=
=?us-ascii?Q?jtzmBBg7rUX3rl5KgT2rSTFy2xYyD+SlCVCtrlbt9MqKwb0X0J9jHY7ThBbB?=
=?us-ascii?Q?4f46Euxsn1jBA8GcAGI0kM4FiwfJaa+F24vZtwzSA5rrKd1Y/RCJfxRdIjNY?=
=?us-ascii?Q?v2R9WQYHLroCTU3zCutZjX+fTIxhNbDjCaUAJ4UeIYimSXgKkgvZUF4geb3E?=
=?us-ascii?Q?tN2AbN3Xx+gsR9yl8Mgpjn5QLuip7XPDXGnnVq2uLi2+NY3qFoobC3+?=
X-Microsoft-Exchange-Diagnostics:
1;SN1NAM04HT079;6:gjFW0BUJgfviRJ0ZOOIL9oDpMtQPS6qSxH6l9EvMSDFUD6r+ahFocANBaxu2GWBN7oRF+M4N2u33RdC8MRAzmd3YHHx5oTAcC9oVlVDVjMnB3KNxxfwVYtgG5qDq3iaqa+nJZCvHOKmy8dnQvr3JCjKiOdJZluica62YVat0dUiq7QMP3dvk8ZHA+Xmy0U5/PGx3PIZOja1o1iy7pUCcriJk1sKtEgCuEXbc2IyusXlQ9F1hIJRRcZqH2P62A7uS95x3p8tdVWR7zgbi21Uqt16vfGAKUHnl9IOgdOUUBYVRee2zE/NSTEutWKoayJuz1k9nKhFLTHHXCfA9TG2h4A==;5:XluCborCx2AoqYQR66n86cAKWikiwMT9mUjENH4iDMifVB4X6UKa1w7/ji2kMQc582GRJBvMuCCaGwzTH3E78GlAllkWqRiDJnurLsysKoWzYLS16FAfeAvnnmFqV67SjKvQBuimW45KoUqrI6iUfw==;24:JBHPr9gQvjqoOHls4TA+hkRMu8X6oOh79mUI30nRP40A5QqMNIolPLtyz//uouSbC5gOI6IXI/mfKTDl+qW1j0w2kek0iMMU1bIibO2225Y=;7:yFNgZnYNoKUj3x3hbVLX6/feG98lJjpNYuqL4uanO5Xhty6xlmJmRNJciDlDU64PGYRlYKlmumyAf+IdNAMAxlznLm72+hs5ElyTxv7xoBUz2kjsWcMwXm/kxTek0xXS0I+HvxjjYMPMdJOnuew6ytx7+Fn9BcMncsRASgPGOFyJ0Q7+7eqOwOAYuvCuOn+8Ni29Cp19XQI2Zy9AoeNHcfvLoo4jWkXtf/LSyeLjZ94=
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Sep 2017 20:38:35.9039
(UTC)
X-MS-Exchange-CrossTenant-Id: 5afe0b00-7697-4969-b663-5eab37d5f47e
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5afe0b00-7697-4969-b663-5eab37d5f47e;Ip=[96.90.254.125];Helo=[ex.straitsrestaurants.com]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1NAM04HT079
X-Spam_score: 9.6
X-Spam_score_int: 96
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Transaction ID : &OT55617O; - User : aboo@nk.ca Your last
transaction on 29/09/2017 was declined due to unexpected payment behaviour.
In September, month of fraud prevention our security is hightened, therefore
we have suspended your account and online access
Content analysis details: (9.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)
0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags
0.0 HTML_MESSAGE BODY: HTML included in message
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels
0.0 T_REMOTE_IMAGE Message contains an external image
Subject: {SPAM?} [0] ATB - One private message.
X-Antivirus: AVG (VPS 170928-0, 09/27/2017), Inbound message
X-Antivirus-Status: Clean
X-Account-Key: account2
X-UIDL: 000645bb501fb806
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-path:
Envelope-to: aboo@nk.ca
Delivery-date: Sat, 30 Sep 2017 14:39:00 -0600
Received: from mail-eopbgr690042.outbound.protection.outlook.com ([40.107.69.42] helo=NAM04-CO1-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLSv1.2:ECDHE-RSA-AES256-SHA384:256)
(Exim 4.89 (FreeBSD))
(envelope-from
id 1dyOX7-000FfC-Bd
for aboo@nk.ca; Sat, 30 Sep 2017 14:38:49 -0600
Received: from SN1NAM04FT011.eop-NAM04.prod.protection.outlook.com
(10.152.88.60) by SN1NAM04HT079.eop-NAM04.prod.protection.outlook.com
(10.152.89.98) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.35.14; Sat, 30
Sep 2017 20:38:36 +0000
Authentication-Results: spf=none (sender IP is 96.90.254.125)
smtp.mailfrom=atbserver0.atbf.com; nk.ca; dkim=none (message not signed)
header.d=none;nk.ca; dmarc=none action=none header.from=atbserver0.atbf.com;
Received-SPF: None (protection.outlook.com: atbserver0.atbf.com does not
designate permitted sender hosts)
Received: from ex.straitsrestaurants.com (96.90.254.125) by
SN1NAM04FT011.mail.protection.outlook.com (10.152.88.104) with Microsoft SMTP
Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id
15.20.56.11 via Frontend Transport; Sat, 30 Sep 2017 20:38:35 +0000
Received: from [192.168.0.3] (40.132.64.192) by EX.straits.local (10.3.88.50)
with Microsoft SMTP Server id 14.3.319.2; Sat, 30 Sep 2017 13:38:32 -0700
Subject: [0] ATB - One private message.
X-mailer: Load_Delle v4.4
Content-Type: text/html
To:
X-Spam-Flag: YES
Content-Transfer-Encoding: 7bit
X-SA-Exim-Connect-IP: 96.90.254.117
X-Antivirus-Scanner: Clean mail though you should still use an Antivirus
From: ATB Financial
MIME-Version: 1.0
Message-ID:
Date: Sat, 30 Sep 2017 13:38:32 -0700
X-EOPAttributedMessage: 0
X-Matching-Connectors: 131512775163415050;(293fc2d2-3e2d-4ca6-cf7f-08d452aa379c);()
X-Forefront-Antispam-Report:
CIP:96.90.254.125;IPV:NLI;CTRY:US;EFV:NLI;SFV:NSPM;SFS:(10009020)(7966004)(336005)(376002)(346002)(39380400002)(2980300002)(428002)(199003)(189002)(50226002)(189998001)(2420400007)(230700001)(8676002)(16576012)(498600001)(7110500001)(5660300001)(316002)(15650500001)(31696002)(5003940100001)(16799955002)(356003)(861006)(117156002)(81156014)(8936002)(50986999)(50466002)(27156004)(69596002)(6916009)(81166006)(42882006)(22746007)(105586002)(98436002)(33646002)(101416001)(104016004)(2351001)(86362001)(23846002)(22756006)(347745004)(606006)(106466001)(4743002)(77096006)(31686004)(2906002)(15188155005)(733005)(551934003)(53376002)(10126004)(10710500007)(9686003)(575854001)(236005)(6306002)(462464002)(105646017)(79686003)(19627235001);DIR:OUT;SFP:1101;SCL:1;SRVR:SN1NAM04HT079;H:ex.straitsrestaurants.com;FPR:;SPF:None;PTR:96-90-254-125-static.hfc.comcastbusiness.net;A:1;MX:1;LANG:;
X-Microsoft-Exchange-Diagnostics: 1;SN1NAM04FT011;1:fUH+LmCLZoOI7DgASnBBp8wv1Dc9ZiuLpbo6Ma2xZStfza3qr+kq9iW5/D+pOhDiXFXgZzCnaJXH/0VCGM427uT9zM9viy3LVaVPQjwuxPutZHi6UD8WyLdlki8c5Qyb
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: d2aeee05-b841-4c07-0092-08d508433978
X-Microsoft-Antispam:
UriScan:;BCL:0;PCL:0;RULEID:(22001)(2017052603199)(201703131430075)(201703131517081);SRVR:SN1NAM04HT079;
X-Microsoft-Exchange-Diagnostics:
1;SN1NAM04HT079;3:/T2ZHpKzNeNVcrizKMMJVvJ0II2yDENg7BQFDPhSLyX9cwkarq8kRwp9VdSEvfaq1T0A60RKDw5SSOMDM5C4QWsF4CJ1ouEaIay9dZ0MiVw0AuCAzKMPoh9+K2PhZB3E4dmWpj2nf4v389QcDzYCFSv9g5ZuodG58OFrqXBejlFPhkGDzry0EpfWqGAZnPlWEOym083leECBZ/ddMc3I8MzydhseLNSiu9Ql6fd6OFhSGddIhi+n12NHmtkflNAknRCsvBJ/ZtCXB4VcxbXzST/awG3K+EBwJbVEmEqjSOLatMQbrR5bWNAbupqRupGn7kUPB/3smzFgX84tO3RMYDCLMIohkW/pQ3gwwxwGOik=;25:NxTNwTICXlRl+dFzy+7khMKJfEALS+661a82pyYg98wZNYJu5uUfKcKj8mp0i5iIZWVmZAzk3W9g8Ap43tZ2w9RVG73r/oCWoxdZKxyKLDCk+Li8EGHnn/5UPJw8qbSXhmD/wiZYWRQ3jgMvNCbbMQLO3VXLOaIpjwcE++SmTDD/AGwQMvpyER/2+Kj0D4ro6oEiqJtHKg5i9gj6DWl+cIPknhrlssJhbPKtV6HSgI9VO3YLeGR5NFSwl/UAHpx9hrGN2TemwY6fEoys1Rj1d7DrcvqFIgwSKm+lKrzJurooOIxEJ/q+gg5Id3asmrukyhK13fcbqSPVfZKixkNS5Q==
X-MS-TrafficTypeDiagnostic: SN1NAM04HT079:
X-Microsoft-Exchange-Diagnostics:
1;SN1NAM04HT079;31:PJY93ByTEm+8A0C5wX0HQEbXrMbNmiuV6Na38RFa2y9CYVHH++0PYX9BrFYVT6BY3Idi7wyJ0CLpHFc4QQjEhDlDt5JnNCMPFZDxPznz233nmFW925yj9wlUucjMvhT7G1ckfxFw/HGIcUImpiuMArHMhCMQDgwjCPNT4XrXxAhrUBQFgH9Xtkgw/8CFcF7GDK9AIh0H3KNBYnMTeyN8cA6tMMT3yIlkg0jCMYnWFtM=;4:AsFHMHXctCljTMCNvF0f4XwqeBGK+qPOU9t9GYYWaOxkICfoP7IMk6bFGh8PevkVK1EdjmcIFVwDWy8nZT2TWLPxwsaQz6B/mG2R24+RlXd/EjNGTGPI1KTqjQ0cSexEkHMSAEFgRmKYiJQ+wAQzpV78eIVXZvpehvXs5E58ZI8lehTeV87lukXhZZspwigeZYVn78m1lseMCn+BgeUL5D+PD6d5vJDe0QGUzgMcBEvEFnlbhbg1dilEBztrW2iwb1mAJ++uYB+4WciNm+hF3zhq/SS9DPHQPtZYX8D9xi1gM8GDJyz93Q4LlD3Kha82Irq70KPXl5+RH702/NKydA==
X-Exchange-Antispam-Report-Test: UriScan:(209352067349851)(192374486261705);
X-Microsoft-Antispam-PRVS:
<174a539e022444468917618a1951a5d9@SN1NAM04HT079.eop-NAM04.prod.protection.outlook.com>
X-Exchange-Antispam-Report-CFA-Test:
BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6095135)(2401047)(5005006)(8121501046)(100000703101)(100105400095)(93006095)(93003095)(10201501046)(3002001)(6055026)(6096035)(20161123563025)(20161123559100)(20161123565025)(20161123561025)(20161123556025)(201703131430075)(201703131441075)(201703131448075)(201703131433075)(201703161259150)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN1NAM04HT079;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(400006)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN1NAM04HT079;
X-Forefront-PRVS: 0446F0FCE1
X-Microsoft-Exchange-Diagnostics:
=?us-ascii?Q?1;SN1NAM04HT079;23:tm9zFbNeJq+VXZsZjxsVtb/FmnUKz8PlqjtVyMgYe?=
=?us-ascii?Q?rbne+aRjokUVwyYlN+yOoTEl11V5tMUVFv5qcK/sKuYNuto9PeSDbZeDa+a+?=
=?us-ascii?Q?Ah5jtdz/rm6VGtyjUGdMZXkIBhLJnRQjXKzKK+vTkl1+LkTyIfLFjV+IMItA?=
=?us-ascii?Q?M3O+2addrM6K6vfGL4ZqY/33/0EeyI6TAVR+yhrtLQNB89XYD3IG47kop21n?=
=?us-ascii?Q?tUSUNF+ZBqoFMrpVTFAGPRsmadLqdf7ivQ0CDmPjuObgOL6fviQ34JM7jCsU?=
=?us-ascii?Q?JYmoiwd9xhnVYQjZjMnJaTaqwFZ1Mp0I412MYmCODjHb9IdQD61X3Rf174Lq?=
=?us-ascii?Q?51Qua/mgRy6NAZy+iO3aDc3sC/WPsRna+iiBC/OkyAqqcrb59bTt6ziwxppF?=
=?us-ascii?Q?zOAaD3cgit3vXnnPM0G4ePcXMNuyPrAfBx5lYJn8v3PZGWVYUyQM0zMYYtyW?=
=?us-ascii?Q?lmnF2SC6Ur28DFv8N3VpW+8UXyGtfrEcunhfzYFNttGZ0USfItkJ9pkCxSSu?=
=?us-ascii?Q?Nb1AWWGPi/0tHqudY8Z6poDc+vKf8fENDdZEDfCWHiX3nO508kdXMuvjXQFc?=
=?us-ascii?Q?a14JFKFSoYpjrFLMaa+YEzzoEtJUF+JQNgC4FY3ZWrCTaI4jY8bHVgi/HNAw?=
=?us-ascii?Q?xQskES6aR5la05t5EBfBa7OERGXhLdT5yp+7ntwNSYYucOnpG/J2H0o+wV+t?=
=?us-ascii?Q?Ud+tYKUegJw4pHemUo0nSzGmN2MNocHljj2pLRs6huQRa/0prV6VTRGuAOC0?=
=?us-ascii?Q?bq1AXdesMPDEKo2tOEoSf/Io/3PnipImxlYdOrGT10BRilgz58kn+mzxgbEj?=
=?us-ascii?Q?e9u4KmLjN/62BU0e7tJSleRtXyoaHQSZRKrC882zBozxjBzcLP9qux/NvQhJ?=
=?us-ascii?Q?kPHYx3xnVbkDPwCHf4vLFRPz9fkyFFk7F0JYR/k+3jq0eWqouweG9iFQf8dd?=
=?us-ascii?Q?aIOstPwHCIK05jiIgK9KP8i6NnxS6/SaNYX9HeRkB658KLAWsLKBpPEbIFcS?=
=?us-ascii?Q?cfkAZPU3TXMD8HPK6J90ZKEP4m6NbovrJw1GiKTTOILmN/WdyzA4V3N5ARP0?=
=?us-ascii?Q?AgunWP1UO4mf7U0acJT8ijPqBcB1OniTN28hpgHaqFVVxHnYgsKb+0regqO/?=
=?us-ascii?Q?8SJocjglg/il/Qj1nUSRjatJL2vkQJeVXP9cmXg7ncx4AJhgBoQchFzkT9Wx?=
=?us-ascii?Q?fdE+fhdpS7/HjmMWXOi3feRivBJMcvdLKBmd5eFUoSM+efacjj6X6toXedAC?=
=?us-ascii?Q?1MQW7erZTc5L6MbPZvxPX6EOEEAqzo72Isqvi/abwtr6tnonmQljmM3e+MUi?=
=?us-ascii?Q?jtzmBBg7rUX3rl5KgT2rSTFy2xYyD+SlCVCtrlbt9MqKwb0X0J9jHY7ThBbB?=
=?us-ascii?Q?4f46Euxsn1jBA8GcAGI0kM4FiwfJaa+F24vZtwzSA5rrKd1Y/RCJfxRdIjNY?=
=?us-ascii?Q?v2R9WQYHLroCTU3zCutZjX+fTIxhNbDjCaUAJ4UeIYimSXgKkgvZUF4geb3E?=
=?us-ascii?Q?tN2AbN3Xx+gsR9yl8Mgpjn5QLuip7XPDXGnnVq2uLi2+NY3qFoobC3+?=
X-Microsoft-Exchange-Diagnostics:
1;SN1NAM04HT079;6:gjFW0BUJgfviRJ0ZOOIL9oDpMtQPS6qSxH6l9EvMSDFUD6r+ahFocANBaxu2GWBN7oRF+M4N2u33RdC8MRAzmd3YHHx5oTAcC9oVlVDVjMnB3KNxxfwVYtgG5qDq3iaqa+nJZCvHOKmy8dnQvr3JCjKiOdJZluica62YVat0dUiq7QMP3dvk8ZHA+Xmy0U5/PGx3PIZOja1o1iy7pUCcriJk1sKtEgCuEXbc2IyusXlQ9F1hIJRRcZqH2P62A7uS95x3p8tdVWR7zgbi21Uqt16vfGAKUHnl9IOgdOUUBYVRee2zE/NSTEutWKoayJuz1k9nKhFLTHHXCfA9TG2h4A==;5:XluCborCx2AoqYQR66n86cAKWikiwMT9mUjENH4iDMifVB4X6UKa1w7/ji2kMQc582GRJBvMuCCaGwzTH3E78GlAllkWqRiDJnurLsysKoWzYLS16FAfeAvnnmFqV67SjKvQBuimW45KoUqrI6iUfw==;24:JBHPr9gQvjqoOHls4TA+hkRMu8X6oOh79mUI30nRP40A5QqMNIolPLtyz//uouSbC5gOI6IXI/mfKTDl+qW1j0w2kek0iMMU1bIibO2225Y=;7:yFNgZnYNoKUj3x3hbVLX6/feG98lJjpNYuqL4uanO5Xhty6xlmJmRNJciDlDU64PGYRlYKlmumyAf+IdNAMAxlznLm72+hs5ElyTxv7xoBUz2kjsWcMwXm/kxTek0xXS0I+HvxjjYMPMdJOnuew6ytx7+Fn9BcMncsRASgPGOFyJ0Q7+7eqOwOAYuvCuOn+8Ni29Cp19XQI2Zy9AoeNHcfvLoo4jWkXtf/LSyeLjZ94=
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Sep 2017 20:38:35.9039
(UTC)
X-MS-Exchange-CrossTenant-Id: 5afe0b00-7697-4969-b663-5eab37d5f47e
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5afe0b00-7697-4969-b663-5eab37d5f47e;Ip=[96.90.254.125];Helo=[ex.straitsrestaurants.com]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1NAM04HT079
X-Spam_score: 9.6
X-Spam_score_int: 96
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Transaction ID : &OT55617O; - User : aboo@nk.ca Your last
transaction on 29/09/2017 was declined due to unexpected payment behaviour.
In September, month of fraud prevention our security is hightened, therefore
we have suspended your account and online access
Content analysis details: (9.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)
0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags
0.0 HTML_MESSAGE BODY: HTML included in message
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels
0.0 T_REMOTE_IMAGE Message contains an external image
Subject: {SPAM?} [0] ATB - One private message.
X-Antivirus: AVG (VPS 170928-0, 09/27/2017), Inbound message
X-Antivirus-Status: Clean
|
![3D"Amazon"](3D"https://lut.im/rCq0iDRT3U/xHqlltIfGM6eRK8x.png")