NetKnow Corporate Blog | Entries from Sunday, May 22. 2022

CRA phish from UTAH USA (Rockion LLC)

Posted by Dave Yadallee on Sunday, May 22. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 22 May 2022 14:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nssYt-000ERb-6H

for dave@doctor.nl2k.ab.ca;

Sun, 22 May 2022 14:52:27 -0600

Resent-From: The Doctor

Resent-Date: Sun, 22 May 2022 14:52:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from uucp.nk.ca ([204.209.81.3]:44722 helo=gallifrey.nk.ca)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nssB9-000DLy-7v

for doctor@nk.ca;

Sun, 22 May 2022 14:27:57 -0600

Received: from [140.228.29.21] (port=52261 helo=cra-arc.gc.ca)

by gallifrey.nk.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nssAk-000CNm-LK

for root@gallifrey.nk.ca;

Sun, 22 May 2022 14:27:33 -0600

Reply-To:

From: Canada Revenue Agency (CRA)

To: root@gallifrey.nk.ca

Subject: ATTENTION: Please Deposit Your Refund of $2680.50 before it Expires

Date: 23 May 2022 04:27:24 +0800

Message-ID: <20220523042724.8291CCBBAAA3AB44@cra-arc.gc.ca>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 8.6

X-Spam_score_int: 86

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: INTERAC E-TRANSFER REFUND: #8644ON87 Hello You have a refund

of $2680.50 CAD from Canada Revenue Agency

Content analysis details: (8.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=cra-arc.gc.ca;ip=140.228.29.21;r=doctor.nl2k.ab.ca]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[f.morgan12[at]yahoo.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=ne_pas_repondre-do_not_reply%40cra-arc.gc.ca;ip=140.228.29.21;r=doctor.nl2k.ab.ca]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

0.5 SUBJ_ATTENTION ATTENTION in Subject

0.0 LOTS_OF_MONEY Huge... sums of money

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: createsend1.com, glitch.me]

X-Spam_score: 8.6

X-Spam_score_int: 86

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: INTERAC E-TRANSFER REFUND: #8644ON87 Hello You have a refund

of $2680.50 CAD from Canada Revenue Agency

Content analysis details: (8.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=cra-arc.gc.ca;ip=140.228.29.21;r=doctor.nl2k.ab.ca]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[f.morgan12[at]yahoo.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=ne_pas_repondre-do_not_reply%40cra-arc.gc.ca;ip=140.228.29.21;r=doctor.nl2k.ab.ca]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

0.5 SUBJ_ATTENTION ATTENTION in Subject

0.0 LOTS_OF_MONEY Huge... sums of money

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: createsend1.com, glitch.me]

Subject: {SPAM?} ATTENTION: Please Deposit Your Refund of $2680.50 before it Expires

=2Ew3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

" />

=3Dedge" />

0,700,400italic,700italic|Ubuntu:400,700,400italic,700italic" rel=3D"styles=

heet" type=3D"text/css">

padding: 0; margin: 0;

padding: 0;

-webkit-text-size-adjust: 100%; background-color:#ededf1" class=3D"full-p=

adding full-padding">

table-layout: fixed; border-collapse: collapse;

table-layout: fixed; min-width: 320px;

width: 100%; background-color:#ededf1" class=3D"wrapper" cellpadding=3D"0=

" cellspacing=3D"0" role=3D"presentation">

ease-in-out; max-width: 360px !important;

-fallback-width: 90% !important;

width: calc(100% - 60px) !important; Margin: 0 auto;

max-width: 560px;

min-width: 280px;

-fallback-width: 280px;

width: calc(28000% - 167440px)" class=3D"preheader">

display: table;

width: 100%" class=3D"preheader__inner--inline">

splay: table-cell;

Float: left;

font-size: 12px;

line-height: 19px;

max-width: 280px;

min-width: 140px;

-fallback-width: 140px;

width: calc(14000% - 78120px);

padding: 10px 0 5px 0; color:#7c7e7f; font-family:Ubuntu,sans-serif" clas=

s=3D"snippet">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20

splay: table-cell;

Float: left;

font-size: 12px;

line-height: 19px;

max-width: 280px;

min-width: 139px;

-fallback-width: 139px;

width: calc(14100% - 78680px);

padding: 10px 0 5px 0; text-align: right; color:#7c7e7f; font-family:Ubun=

tu,sans-serif" class=3D"webversion">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20

ine">

display: table;

width: 100%" class=3D"layout__inner" emb-background-style=3D"">

s ease-in-out; max-width: 400px !important;

width: 100% !important" class=3D"column">

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

mso-text-raise: 4px" class=3D"text--inline">

INTERAC E-TRANSFER REFUND: #8644O=

N87

Hello

t;">You have a refund of $2680.50 CAD from Canada Revenue Agency

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

font-size: 2px;

line-height: 2px;

Margin-left: auto;

Margin-right: auto;

width: 40px; background-color:#b4b4c4" class=3D"divider">

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

mso-text-raise: 4px" class=3D"text--inline">

Select your financial institution to deposit your refund before =

it expires on 23rd May, 2022.

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

=

data-vml-width=3D"182" height=3D"48" style=3D"background-color: #1c1601; co=

lor: #ffffff !important; font-family: PT Serif, Georgia, serif; border-radi=

us: 4px;">Deposit Your Refund

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

mso-text-raise: 4px" class=3D"text--inline">

Kind Regards,
Andrew Tremblay, Canada Revenue Agency (CRA)
>

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

font-style: normal;

font-weight: normal;

line-height: 19px" class=3D"image--inline" align=3D"left">

height: auto;

width: 100%; max-width:160px" alt=3D"" width=3D"160" src=3D"https://i1.cr=

eatesend1.com/resize/ti/t/78/34E/B40/eblogo/signature4cropped.png">

=20=20=20=20=20=20=20=20

=20=20

nt-size:20px;">

=20=20

=20=20=20=20=20=20

display: table;

width: 100%" class=3D"layout__inner">

Margin-right: 20px" class=3D"column__padding--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

line-height: 19px" class=3D"email-footer__address--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

line-height: 19px" class=3D"email-footer__permission--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

display: table;

width: 100%" class=3D"layout__inner">

25s ease-in-out; max-width: 400px !important;

width: 100% !important" class=3D"column">

Margin-right: 20px" class=3D"column__padding--inline">

line-height: 19px" class=3D"email-footer__subscription--inline">

lang=3D"en">Preferences |
scribe style=3D"text-decoration: underline;">Unsubscribe

Urgency spam from Google

Posted by Dave Yadallee on Sunday, May 22. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 22 May 2022 14:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nssUa-000ECF-Qy

for dave@doctor.nl2k.ab.ca;

Sun, 22 May 2022 14:48:00 -0600

Resent-From: The Doctor

Resent-Date: Sun, 22 May 2022 14:48:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f194.google.com ([209.85.210.194]:33293)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nskoo-000BBS-Ch

for doctor@nl2k.ab.ca;

Sun, 22 May 2022 06:36:28 -0600

Received: by mail-pf1-f194.google.com with SMTP id 202so4444704pfu.0

for ; Sun, 22 May 2022 05:36:05 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=E2C1F8rlKnxoG4iasqEa8mt3rudZatV8G4EwW9yIhaw=;

b=Niy6pjcF0sfRM/WAl43ndUMyoylgdpaCqsWjh3EYA8l6WB51S8KnskHYXrUnR0XRcd

TSgmVa7JO/O9EESJNZV7+B6uLTdyhNTHx/6GuMUqUtHgd7iZFVn1Crzk9v48pJTCMg7z

QU1d2qZNRCbo5RYZTQCaKj2XxOjK+LPbrkAqTE1FjCsoJIhSeaLxMbrKuOpABihDvII8

9y1ybeRJukuvAoMQ04+8QN/QvOaaFFKq5CIMT01pQKkrkwDGd9XL2xsLzikAsvHuZoZm

PzkSENUJcYTwamZfiJMrciiNrZDzD66oGPz3jcX9AeH7H79UPloSPZ6CWOVUiQpr5cvu

pthQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=E2C1F8rlKnxoG4iasqEa8mt3rudZatV8G4EwW9yIhaw=;

b=iP465aw0AO+eSFgydtgF01lY2ri2Ic1RIA4ClGTp5TDCbXXlDJMQp8KrjUJvBaP7LT

5QBNWqOqKKm3bgOXuJUQLswcXOSSoJaH7aO6zfsSEt/TzFDF4gAmTVcL+cJhhwX5fMYQ

fVQoxf+magvmsTS9reZY2ShayR1kvwe3FNs+6lWgov74lTXoaAJJXlnHBLzNgACs5SHq

RWhaFLWqdYzEf4Dobtvqum0dzlpOjNbfIUbuXApegDp0tIA4uQnZlLT3AtAuF2XkG5/x

rdyqdKKEuII0dvDzqA5U9e7wqDfvNemY7F/jmDWEqlqc34CmsJozyk/ys4fHc+dwFuhc

vE2w==

X-Gm-Message-State: AOAM530K6Zyct4u/yHXeNBf2xe8xzF7XYqUzyNOlk2guUJ2ax4ZJMIZg

4t/EM/geLcTlvPWhc4wp87QAcmB6pQv0CdfORQ==

X-Google-Smtp-Source: ABdhPJxWDQOt7uRrofXb93+B1FOzWavpGCBm+Z8pkj5QxgkDH8VnjAggG1hy3fr9zNUorFORrJ8Bp3PBM5Wo4cqhxwY=

X-Received: by 2002:a05:6a00:170c:b0:510:865f:bf34 with SMTP id

h12-20020a056a00170c00b00510865fbf34mr19303314pfc.60.1653222958837; Sun, 22

May 2022 05:35:58 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a17:90b:3e8b:0:0:0:0 with HTTP; Sun, 22 May 2022 05:35:57

-0700 (PDT)

Reply-To: kuntarose0@gmail.com

From: Rose Kunta

Date: Sun, 22 May 2022 13:35:57 +0100

Message-ID:

Subject: From Rose, Please get back now

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 15.7

X-Spam_score_int: 157

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: From Rose Kunta Abidjan Cote d'Ivoire, West Africa. Good day

I am writing this letter in confidence believing that if it is your wish

to help me, I promise you that you will never ever regret helping me after

hearing my situation.

Content analysis details: (15.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

1.0 HK_RANDOM_FROM From username looks random

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.194 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[rrrrrkunta[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[kuntarose0[at]gmail.com]

0.9 URG_BIZ BODY: Contains urgent matter

3.6 NA_DOLLARS BODY: Talks about a million North American dollars

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} From Rose, Please get back now

>From Rose Kunta

Abidjan Cote d'Ivoire,

West Africa.

Good day

I am writing this letter in confidence believing that if it is your

wish to help me, I promise you that you will never ever regret helping

me after hearing my situation.

My name is Miss Rose Kunta, 19 years old. My father and my Mom with my

younger brother was involved in a ghastly motor accident. My Mom and

my younger brother died instantly, while my father later died in the

hospital while he was taking treatment. Before his death, he told me

that he deposited the sum of Three Million, US Dollars with a Bank

here. I have succeeded in locating the bank and also confirmed the

money is in the account. I cannot claim the money myself because i am

not up to the age of 25 which my late father and the bank agreed when

the deposit was made. I urgently need your assistance.I want you to

stand as my guardian and claim the money for me for proper investment

in your country, so that i can come over there to continue with my

education which i stopped.

I will surely compensate you after the transfer has been completed,

for your help and kindness to me.

I will be Waiting anxiously to hear from you.

Please reply me back here kuntarose0@gmail.com

Yours sincerely,

Rose.

Phishing attempt to get Netknow user passwords from Indonesia

Posted by Dave Yadallee on Sunday, May 22. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 22 May 2022 03:49:01 -0600

Received: from [103.5.148.88] (port=16052 helo=bpomsvr-1588.pom.go.id)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nsiBs-000GgT-9Q

for dave@doctor.nl2k.ab.ca;

Sun, 22 May 2022 03:48:09 -0600

Received: from zmtaproxy.pom.go.id ([172.16.3.47])

by bpomsvr-1588.pom.go.id with ESMTP id 24M9hV9P018057-24M9hV9R018057

(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO);

Sun, 22 May 2022 16:43:32 +0700

Received: from localhost (localhost [127.0.0.1])

by zmtaproxy.pom.go.id (Postfix) with ESMTP id AB62083220C2;

Sun, 22 May 2022 15:23:35 +0700 (WIB)

Received: from zmtaproxy.pom.go.id ([127.0.0.1])

by localhost (zmtaproxy.pom.go.id [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id tvnDwujFcXi5; Sun, 22 May 2022 15:23:35 +0700 (WIB)

Received: from localhost (localhost [127.0.0.1])

by zmtaproxy.pom.go.id (Postfix) with ESMTP id 8F9C1832FF37;

Sun, 22 May 2022 15:22:13 +0700 (WIB)

DKIM-Filter: OpenDKIM Filter v2.10.3 zmtaproxy.pom.go.id 8F9C1832FF37

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; d=pom.go.id; s=DKIM_selector; c=relaxed/relaxed;

h=content-type:mime-version:subject:to:from:date:message-id;

bh=uZuwRDBHngXzq2AiTaqF+B8p5jZpyqpC6+vbvDM5r/8=;

b=fIghA0BctHD9u+5wOzpvmbT5oXSOb8vH0oewWlJoYSScbLWRsaESGVKJ7jY+5hR0vEJ4YTGotJYH

HKFLsQMCOHtct4nmpbgckC/VUNBXiaVDpvO+ZnRswH1KSQ3ndAthdsvWZMbukdm8PhYXF5BZa+Fe

8B6iKyvq26mQcInbzAGEtzIha97uv2brjh293179J/EWr2r55WzCV539uE+QmBFwpUWPWDY9uxeN

Ms3wElwy6IBC/6r5NsWQk6LxEbAwPlEuhcRFI7sxOpnr+UhH94nF+55ZBxOrzYNnSy93njQqVR5B

piHBeUJkI+X2nldIIE6LyLSgAGatsaq/tZUxtw==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pom.go.id;

s=9454298A-CE88-11EC-8243-7A809184C385; t=1653207733;

bh=uZuwRDBHngXzq2AiTaqF+B8p5jZpyqpC6+vbvDM5r/8=;

h=MIME-Version:To:From:Date:Message-Id;

b=WJ6U81r1CYxAA9F8qQbqdkaMmjV+WRjbo/lPn1ABGjXnm6N5t4CYIUFGG7NFEg2Q9

t7gY4rbdrfIYyRUwUkKbt7hGv080lz/feBkhYb9NkW26v2bc/UhHSSthEttCxrHMaf

yJbgDg75XAck1M1KxxUWaKkTg+eAjomA1zv/yPAE=

X-Virus-Scanned: amavisd-new at

Received: from zmtaproxy.pom.go.id ([127.0.0.1])

by localhost (zmtaproxy.pom.go.id [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id R-XkIeQ-nR86; Sun, 22 May 2022 15:22:13 +0700 (WIB)

Received: from [103.1.179.201] (unknown [103.1.179.201])

by zmtaproxy.pom.go.id (Postfix) with ESMTPSA id 0DCDA8329D1D;

Sun, 22 May 2022 15:20:54 +0700 (WIB)

Content-Type: multipart/alternative; boundary="===============1124542109=="

MIME-Version: 1.0

Subject: Re:Validate

To: Recipients

From: "Admin"

Date: Sun, 22 May 2022 13:51:20 +0530

Message-Id: <20220522082055.0DCDA8329D1D@zmtaproxy.pom.go.id>

X-FEAS-DKIM: Invalid Public Key

Authentication-Results: bpomsvr-1588.pom.go.id;

dkim=neutral (Could not retrieve key) header.i=@pom.go.id

X-FE-Policy-ID: 9:3:2:SYSTEM

You will not see this in a MIME-aware mail reader.

--===============1124542109==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Dear Zimbra mail users: =

Your account has exceeded the quota limit set by the Administrator, and y=

ou may not be able to send or receive new mail until you re-validate your a=

ccount =

=

=

=

To re-validate your account, please =

=

=

CLICK HERE TO VERIFY

=

click on the above link to verify =

Failure to verify, Your account will be permanently disable and deleted fr=

om our database. Respectfully yours, =A92022 Zimbra Customer Care=20

--===============1124542109==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=3Diso-8859-1"/>

ial, helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TR=

ANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORP=

HANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,2=

55); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: n=

ormal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial">
=3D"FONT-SIZE: 12pt">Dear&=

nbsp;Zimbra mail users:
noreferrer noreferrer">
derline; FONT-FAMILY: verdana, sans-serif">
0)">

HITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 4=

00; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SP=

ACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-v=

ariant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-wi=

dth: 0px; text-decoration-thickness: initial; text-decoration-style: initia=

l; text-decoration-color: initial">
ILY: verdana, sans-serif; COLOR: rgb(255,0,0)">
ON: underline">

OLOR: rgb(0,0,0)">

Your=

account has exceeded the quota limit set by the Administrator, and you may=

not be able to send or receive new mail until you re-validate yo=

ur account

IV>

OLOR: rgb(0,0,0)">

OLOR: rgb(0,0,0)">

hed; BORDER-RIGHT: rgb(187,187,187) 1px dashed; BORDER-COLLAPSE: collapse; =

BORDER-BOTTOM: rgb(187,187,187) 1px dashed; BORDER-LEFT: rgb(187,187,187) 1=

px dashed">

FAMILY: verdana, arial, helvetica, sans-serif; BORDER-RIGHT: rgb(240,240,24=

0) 1pt inset; WIDTH: 105.85pt; BACKGROUND: red; BORDER-BOTTOM: rgb(240,240,=

240) 1pt solid; PADDING-BOTTOM: 0cm; PADDING-TOP: 0cm; PADDING-LEFT: 5.4pt;=

BORDER-LEFT: rgb(240,240,240) 1pt solid; PADDING-RIGHT: 5.4pt" width=3D141>

GIN-RIGHT: 0px">
verdana, sans-serif">

FAMILY: verdana, arial, helvetica, sans-serif; BORDER-RIGHT: rgb(187,187,18=

7) 1pt solid; WIDTH: 35.4pt; BACKGROUND-IMAGE: none; BACKGROUND-REPEAT: rep=

eat; BORDER-BOTTOM: rgb(187,187,187) 1pt solid; BACKGROUND-POSITION: 0% 0%;=

PADDING-BOTTOM: 0cm; PADDING-TOP: 0cm; PADDING-LEFT: 5.4pt; BORDER-LEFT: r=

gb(187,187,187); PADDING-RIGHT: 5.4pt" width=3D47>

GIN-RIGHT: 0px">
serif">

OLOR: rgb(0,0,0)">

To r=

e-validate your account, please

OLOR: rgb(0,0,0)">

,187,187) 1px dashed; BORDER-RIGHT: rgb(187,187,187) 1px dashed; WIDTH: 300=

px; BORDER-BOTTOM: rgb(187,187,187) 1px dashed; PADDING-BOTTOM: 0px; PADDIN=

G-TOP: 0px; PADDING-LEFT: 0px; BORDER-LEFT: rgb(187,187,187) 1px dashed; MA=

RGIN: 0px; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(8,75,138); border-radi=

us: 5px">

<=

/TBODY>

-FAMILY: verdana, arial, helvetica, sans-serif; BORDER-RIGHT: rgb(187,187,1=

87) 1px dashed; BORDER-BOTTOM: rgb(187,187,187) 1px dashed; PADDING-BOTTOM:=

0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; BORDER-LEFT: rgb(187,187,187) 1p=

x dashed; PADDING-RIGHT: 0px">
ACKGROUND: none transparent scroll repeat 0% 0%; OUTLINE-WIDTH: medium; PAD=

DING-BOTTOM: 0px; PADDING-TOP: 0px; OUTLINE-STYLE: none; PADDING-LEFT: 0px;=

MARGIN: 0px; PADDING-RIGHT: 0px" href=3D"http://energymin.gov.lk/mail1.php=

" rel=3D"nofollow%20noopener%20nofollow%20noopener%20noreferrer nofollow no=

opener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer=

noreferrer noreferrer noreferrer noreferrer nofollow noopener noreferrer" =

target=3D_blank>
-FAMILY: verdana, sans-serif">CLICK HERE TO VE
5321923m_3054015556958039049m_-1391893868802809595m_8710498082380162426m_87=

59714186932824562goog_1244613476>
3054015556958039049m_-1391893868802809595m_8710498082380162426m_87597141869=

32824562goog_1244613477>RIFY

OLOR: rgb(0,0,0)">

(0,0,0)'>click on the above link to verify<=

/SPAN>

(0,0,0)'>

(0,0,0)'>Failure to verify, Your accou=

nt will be permanently disable and deleted from our database.
DIV>

(0,0,0)'>Respectfully yours,

(0,0,0)'>

(0,0,0)'>
s-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT=

-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; LETTER-SPACING: normal=

; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px"> =A92022 Zimbra Cu=

stomer Care

--===============1124542109==--

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	May '22					Forward →
						1
2	3	4	5	6	7	8
9	10	11	12	13	14	15
16	17	18	19	20	21	22
23	24	25	26	27	28	29
30	31

INTERAC E-TRANSFER REFUND: #8644O= N87

INTERAC E-TRANSFER REFUND: #8644O=

N87