Older women sex spam from Hotmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Aug 2022 13:17:53 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oSkFs-0007X8-Ik

for dave@doctor.nl2k.ab.ca;

Mon, 29 Aug 2022 13:17:04 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Aug 2022 13:17:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oln040092066023.outbound.protection.outlook.com ([40.92.66.23]:29982 helo=EUR01-VE1-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oSgkc-000AB4-Eg

for doctor@doctor.nl2k.ab.ca;

Mon, 29 Aug 2022 09:32:40 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=Yz198MBQ19vE7LyU0BCo5DK+/U2nOkzOHF+k0dRb7QsA6vYBPloJCWcmw04E2DXcoJiNDkbC0t+yXSDBqLbgWbsVXAUZF4C2TzkK3iXpOp1V+Z8n0It20aSNzoEWuvbRFoWpJIWR6D1bcbE1cVwaeiU22ASAgQicVILBdPgQyAmBGDh87iXX6ggANtRmYttX2zAzHWnb1UFJqr3xh36KyQt9X0JBXgm2mDRgXwvNZxVVUnlXxS9wya+Cool8Z7jz9VoqaSfT3Z2QPSVkelaVV7PYEe4XX5H5aDvKG6XIhXEEwuoTvdnpHZSL+7G7VZoxW74kaDteqKbJYJSxLHRl8g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=phH8r5OFzkuoalHNgzR8eNyLyvZeBkJtgAIqZxjhqjo=;

b=WJioUJgQOoHpU50Yz7IhrMZX8u2E8U5w0khH9yamv6ItBI6VY8Eb3fd3jZHrwIfwIs4EqUlx3lYHXHQdoqtR2Jg2tYD0E9SpwKkvKj/uKgUQEz8D7zAgWSeEg5AtM5e3m/Jq39t0ua63SPmwLv2aJD6NJGZm7HWERoTCJT6V7NdxzveQEShE54Vmen3PrihVESpMfHad+Aek+ATxN2aWvoame9XS5Jr9Nm8R4njS85sU84jzIG14XQdHNQYAN/yM3W9vdFU6JmNiH/gvlrSmMcrKqxVyHJKXBcuxlPmvJXWAgPc8KwAOD+qEiTp72/sEzfzb5NrRo4vtdULfMid9Sw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=phH8r5OFzkuoalHNgzR8eNyLyvZeBkJtgAIqZxjhqjo=;

b=gzS3ZQi362d5pk/sE09gRviWImgRFR77tv5h9sLKUkSVwR+RvkJlWeCc9OPONa+jJinyAmh6TYSqRoFHaJVan7l1nc0iU62+Tm1Jylm7AIRUKFYhETtu0ehHeN34Vi6bWUiWbnUVobsoJEwYpU5YoEiyzHymznkfVRMJ7F33YqQ2kPmiUu6pLn3HNCCS11sP+VEjtHU49ofopw8nGDMHORmYwhveVK/O555c+nJjsxjNnax7FVHqPbtw9zdTSp3qaryVMSTMhUFrZ+wveV+nRXXQwagiTdaRmV0ej9+uv7fyXI0VB+D7ICEvce1sKW4hAo8AIhgTJ882ln8P/dLWHQ==

Received: from VI1PR0902MB1949.eurprd09.prod.outlook.com (2603:10a6:802:9::28)

by DB8PR09MB4360.eurprd09.prod.outlook.com (2603:10a6:10:154::14) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5566.15; Mon, 29 Aug

2022 15:32:04 +0000

Received: from VI1PR0902MB1949.eurprd09.prod.outlook.com

([fe80::6985:f6f2:76e:9909]) by VI1PR0902MB1949.eurprd09.prod.outlook.com

([fe80::6985:f6f2:76e:9909%3]) with mapi id 15.20.5566.021; Mon, 29 Aug 2022

15:32:04 +0000

X-Mailer: MailBee.NET 11.2.0.590

From: "stevenburton197@hotmail.com"

Subject: Website full of mature

Reply-To: "stevenburton197@hotmail.com"

Date: Mon, 29 Aug 2022 17:31:59 +0200

Message-ID:



Content-Type: multipart/alternative;

boundary="----=_NextPart_000_321C_FC8602DB.A8FD1B80"

To: Undisclosed recipients:;

X-TMN: [YkIs1tSJw67eDNR6C1t6kSUjybYj5SFF]

X-ClientProxiedBy: FR0P281CA0053.DEUP281.PROD.OUTLOOK.COM

(2603:10a6:d10:48::17) To VI1PR0902MB1949.eurprd09.prod.outlook.com

(2603:10a6:802:9::28)

X-Microsoft-Original-Message-ID: <1.bc2e570c7a326cb10c36@DESKTOP-1SRV5V9>

MIME-Version: 1.0

X-MS-Exchange-MessageSentRepresentingType: 1

X-MS-PublicTrafficType: Email

X-MS-Office365-Filtering-Correlation-Id: f01bbdac-b0e5-44c2-1cb3-08da89d39f1f

X-MS-TrafficTypeDiagnostic: DB8PR09MB4360:EE_

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

oUlCvLHBt2xf3eD36YcqaTfOFF+hHY18fG+zuvmXEGVjz+k/62uLaZ0k3vWmD6u67q1WxkjPBZlg8dOC8iTnUpuTA/QkXA4lR0/SVgOYUUlN5Gff3Rm5SQj0lu4igRIBi8dl5kGysRd0F0cm+VHNQGlfbCxc2Yp84DyHIM6fb7111YCOqj+y+hDPfhfMNzbFmbPx4fCEzGSIhs43h3z9CF2zPA/QQRNNW8kZ2Hv8uTxYjlfItwb+YdJXgSqhBEmaDgx8nX8/kzg7k/V4l8JJcAkk2eNUtXWn+LiYp25d1okWXmsSULs4Yde8xUjIbk9xkUeKR6/gijknDfn2KglvPFWMEbfLKLxRhcxLGoVSnswi10bUwF6FKMMQzNLkmxZpSvNZUgv3fQi7QRXESTS4Tkv/KOsaUNKMyabNMw+KxYtqz3dRLeZ1sQpFe/B9tXYJFXBl+qEo6ggwNxj702rc1bhpZ7KKQsspyl1DSphBAngK1vHQi7KslPB58nG8V0jkD33NLtC3gLLxI0eg6fvUHO5x2F5jv7zG4z6FwzzFLCSqgFP7TLXJe8gDVdUQZjzFEmJbd2atT8kEsuJ2osDFlt25K4uDTgtmXmPlVctD4my3Cw+C7U5xx5Lq+davS7b5Ml75C4y87z5rb36+++iHVP2q6LVgn39p1JYJ7rh5JLGZXylBpRQ+bjldXHLoV7uKtFg10WypAmO9WKlJ2VZPzSJ8zqdT7JGc8D3Wq8+hA0x/KVKNiiB60/r//7jYgguKOE3MsS6eJFGUyG/6XgP2ZqkgjGiwCdbe0KrzFdPNS7g=

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?cVluWjBVNU5PeTZiNmlrNFMyNlZWU25SQ2tJN2F6aWJkendEY1VPSGR0ckVM?=

=?utf-8?B?MjBUdVRoK0V5TStpVC91RE9PSjU2V1ZLckN5bmNaZVI1Uzh5THVnOTB2M1BD?=

=?utf-8?B?dkc0M1RVcG8yeGhhN3JvSVJVcyttNnBNZGRDWS8wa0FTaHEyLzRFdm5XTlll?=

=?utf-8?B?SE85VTl4T3NVRi9wSHRDckQvNnVsS21GOFRXazVjVGh2ZzQ5VU1PRWFSVTZq?=

=?utf-8?B?UU53dGdsa1Z4bG9KQWRCMVN6cy9Scmh0NWUxUDhSMGRpdFN2ZkhxQWxzYnll?=

=?utf-8?B?R1VDYzhtOWlOdUoxSHB1cjhFbStzVm8vOW1MOG1qMDVYcVdPOU52UHlFN0s2?=

=?utf-8?B?bDhCVjQ1TmF0c1QwVklRc0daT1R0bkduazlmWmRVRkdYczVna3U4a2NENjAr?=

=?utf-8?B?dStudFpnNlduQ3dtOVYrbURyS25iR3RKTHdTbnl3VkpUNjBCazhBbm5lenhr?=

=?utf-8?B?V3RLUXZ4R3dualZ5bXNoTE9lbk5ibDk3eU5McHUvT1Frb2tyVHdRSklBQ25N?=

=?utf-8?B?MVlQKzV2a0FQV3dNdFU4bmh6a3lQNEJnNGgyT0lqcXBqeUM0dWZsRWgyL0RX?=

=?utf-8?B?dExZNUNNaDlDaVJTUWdRMW9nZUEvNmh2bC9JNlY0RVc2cmQ0VWtYU0VwdkQw?=

=?utf-8?B?NHFMZXUwMS96U2g3YWdJbzFLU3dGdFN1aHRpTmYxTHRkTXdja1FUOEFaUHBy?=

=?utf-8?B?Q09TV2d4RnptdzhGeFNDS0liTmxXMHNQNlBUVmlPNWlkQndmd3VGbnprUy9K?=

=?utf-8?B?UVFJOEd4R2F0MGhDN1pId202bFZFdDk2bGcyVEpINVNRRDlrbkxUWUVjdXhs?=

=?utf-8?B?eERPTHRqNFcyY3orK2JuUFF2QzNiVmNERkd5WlI4enFzdnpZS29zYkRoMVZP?=

=?utf-8?B?OG05SDd2bTR2KzRocnU3bTZYSUcyVk9jRlRVTWlpN2l4VGJMZy84NEJKUTN6?=

=?utf-8?B?djl4OEhQS0FuN0xObkE3Mmw2WDZHUXdzaS9JdnJMek9HaGlyUEZ3OEVFYXR2?=

=?utf-8?B?c3Vtd3JXSEg4TjI2dlpZc1A2NlFFYld4YUZxeE9PUUwvbDdiMGpkR2lkWVdR?=

=?utf-8?B?RmZOSThORlhZRXBZbjQwQmtodVhwdkQ1SGtJL1FwVHJKdnB4dzBpcm8yZ3p2?=

=?utf-8?B?YVNkSEJNdU9VWXlib25IWFRnc1RBL0ZYR2lKR3NpSXZyZGM0L1oreEFpUy9p?=

=?utf-8?B?aG5vbVRZaE5VdWp6MEVBbVhFNEthZHZYSGM3MVBFcXBHQVkvUE9lN1ZsdmdJ?=

=?utf-8?B?aiszV0dlcjUwYVJQb3liTVZHRU5qSEVPY0ZnY21sSXpXYkJmSkxNcWp5amFP?=

=?utf-8?B?VFRtNENxVnFENkQ1SktJYUJLV1krYUNFaFpjRTlSYlNqbjlVWlliVWM4Q2k0?=

=?utf-8?B?cHNIb0NyTkpsREpITGUwOTNXZllqenFPdWxESkJjcE12UFdGOUE0VXA5empy?=

=?utf-8?B?ZmdBUzA2aERGaTREOWFoL3FwZzFhUGFDS3IvTm14aXhtYmxkLysyb1VNL0Fk?=

=?utf-8?B?TEFZWWFVbkpTOVRwdzBwMm1Vb3hlZTdacFVrNzUrSUQzZE5McDJ0MVFyQUpK?=

=?utf-8?B?T1Z2QTBnOFJxQTNCbjRoS0VHT2Q5VGdRQk1DRFM3SkxvYzc3ZTJ3NFNGeXJH?=

=?utf-8?B?bk9Fc0RrTGpZb3NpWmhyZEc5eTZhRmRXR0YyYXhiMTBzZks0K3cvMTYyWjNa?=

=?utf-8?B?Y0R6S1k2UlIrUExQdlk3QUp3THNuc2U3Sk5KR3UxYW81ZEIxVUtJWXRKMitz?=

=?utf-8?Q?aOV4aAj3q81utFRfRs=3D?=

X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-64da6.templateTenant

X-MS-Exchange-CrossTenant-Network-Message-Id: f01bbdac-b0e5-44c2-1cb3-08da89d39f1f

X-MS-Exchange-CrossTenant-AuthSource: VI1PR0902MB1949.eurprd09.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Aug 2022 15:32:03.9097

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:

00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR09MB4360

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Are you ready for SEX with an older woman? If your answer

is YES, you've come to the right place cause this is a website full of mature

women looking for hot, steaming SEX! Read below why I started this SEX CLUB

for ELDERLY PEOPLE.



Content analysis details: (5.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URIs: ladyforfun.club]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL

blocklist

[URIs: ladyforfun.club]

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: ladyforfun.club]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[stevenburton197[at]hotmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[stevenburton197[at]hotmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[stevenburton197[at]hotmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 HTML_MESSAGE BODY: HTML included in message

0.6 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image

area

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 T_SCC_BODY_TEXT_LINE No description available.

Subject: {SPAM?} Website full of mature



------=_NextPart_000_321C_FC8602DB.A8FD1B80

Content-Type: text/plain;

charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Are you ready for SEX with an older woman?





If your answer is YES, you've come to the right place cause this is a websi=

te full of mature women looking for hot, steaming SEX!



Read below why I started this SEX CLUB for ELDERLY PEOPLE.



Young people seem to think older women only want to knit scarfs and bake c=

akes but that isn't true at all. WE WANT HARD SEX JUST LIKE YOU MEN!



But we found that on most dating apps like TINDER, there is just no place =

for PEOPLE ABOVE 50.



That's why I started this website, especially for OLDER WOMEN LOOKING FOR =

LIKEMINDED HORNY MEN! As you can see from my pictures, we're NOT SHY, but w=

e keep our identities PRIVATE AND SECURE.



So why don't you come and join me and my girlfriends? We won't bite (unles=

s you want us to ;-))







SIGN UP NOW FOR A HORNY CHAT





http://backdoorflirts.ladyforfun.club



































































Still want to unsubscribe entirely? Click below to unsubscribe.



UNSUBSCRIBE











































=



------=_NextPart_000_321C_FC8602DB.A8FD1B80

Content-Type: text/html;

charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




style=3D"font-weight:normal;" id=3D"docs-internal-guid-1d3b78d4-7fff-f53b-=

141a-2dcc3650a8df">=0A=


margin-bottom:12pt;">=0A=


000;background-color:transparent;font-weight:400;font-style:normal;font-var=

iant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wr=

ap;"> 
0000;background-color:transparent;font-weight:700;font-style:normal;font-va=

riant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-w=

rap;">Are you ready for SEX with an older woman?=0A=

=0A=


=0A=


margin-bottom:12pt;">=0A=


olor:transparent;font-weight:400;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">If your ans=

wer is YES, you've come to the right place cause this is a
le=3D"font-size:13pt;font-family:Arial;color:#000000;background-color:trans=

parent;font-weight:700;font-style:normal;font-variant:normal;text-decoratio=

n:none;vertical-align:baseline;white-space:pre-wrap;">website full of matur=

e women looking for hot, steaming SEX!=0A=

=0A=


margin-bottom:12pt;">=0A=


olor:transparent;font-weight:700;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Read below =

why I started this SEX CLUB for ELDERLY PEOPLE.=0A=

=0A=


;margin-bottom:12pt;">=0A=


olor:transparent;font-weight:400;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Young peopl=

e seem to think older women only want to knit scarfs and bake cakes but tha=

t isn't true at all.
;color:#000000;background-color:transparent;font-weight:700;font-style:norm=

al;font-variant:normal;text-decoration:none;vertical-align:baseline;white-s=

pace:pre-wrap;">WE WANT HARD SEX JUST LIKE YOU MEN!=0A=

=0A=


;margin-bottom:12pt;">=0A=


olor:transparent;font-weight:400;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">But we foun=

d that on most dating apps like
amily:Arial;color:#000000;background-color:transparent;font-weight:700;font=

-style:normal;font-variant:normal;text-decoration:none;vertical-align:basel=

ine;white-space:pre-wrap;">TINDER
family:Arial;color:#000000;background-color:transparent;font-weight:400;fon=

t-style:normal;font-variant:normal;text-decoration:none;vertical-align:base=

line;white-space:pre-wrap;">, there is just no place for
=3D"font-size:13pt;font-family:Arial;color:#000000;background-color:transpa=

rent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:=

none;vertical-align:baseline;white-space:pre-wrap;">PEOPLE ABOVE 50<=

span style=3D"font-size:13pt;font-family:Arial;color:#000000;background-col=

or:transparent;font-weight:400;font-style:normal;font-variant:normal;text-d=

ecoration:none;vertical-align:baseline;white-space:pre-wrap;">.=0A=

=0A=


;margin-bottom:12pt;">=0A=


olor:transparent;font-weight:400;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">That's why =

I started this website, especially for
;font-family:Arial;color:#000000;background-color:transparent;font-weight:7=

00;font-style:normal;font-variant:normal;text-decoration:none;vertical-alig=

n:baseline;white-space:pre-wrap;">OLDER WOMEN LOOKING FOR LIKEMINDED HORNY =

MEN!
ckground-color:transparent;font-weight:400;font-style:normal;font-variant:n=

ormal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> =

As you can see from my pictures, we're NOT SHY, but we keep our identities =


ound-color:transparent;font-weight:700;font-style:normal;font-variant:norma=

l;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">PRIVA=

TE AND SECURE
000000;background-color:transparent;font-weight:400;font-style:normal;font-=

variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre=

-wrap;">.=0A=

=0A=


margin-bottom:12pt;">=0A=


olor:transparent;font-weight:400;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">So why don'=

t you come and join me and my girlfriends? We won't bite (unless you want u=

s to ;-))=0A=

=0A=


margin-bottom:12pt;">=0A=


olor:transparent;font-weight:400;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> 
n>=0A=

=0A=


margin-bottom:12pt;">=0A=


olor:transparent;font-weight:400;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">SIGN UP NOW=

FOR A HORNY CHAT =0A=

=0A=


=0A=


:#ffffff;margin-top:0pt;margin-bottom:0pt;">=0A=


:none;">
kground-color:#ffffff;font-weight:700;font-style:normal;font-variant:normal=

;text-decoration:underline;-webkit-text-decoration-skip:none;text-decoratio=

n-skip-ink:none;vertical-align:baseline;white-space:pre-wrap;">http://backd=

oorflirts.ladyforfun.club=0A=

=0A=


:#ffffff;margin-top:0pt;margin-bottom:0pt;padding:12pt 0pt 0pt 0pt;">=0A=

 =0A=

=0A=


:#ffffff;margin-top:0pt;margin-bottom:0pt;padding:12pt 0pt 0pt 0pt;">=0A=

 =0A=

=0A=


=0A=


=0A=


argin-bottom:0pt;">=0A=


:none;">
round-color:transparent;font-weight:700;font-style:normal;font-variant:norm=

al;text-decoration:underline;-webkit-text-decoration-skip:none;text-decorat=

ion-skip-ink:none;vertical-align:baseline;white-space:pre-wrap;">
e=3D"border:none;display:inline-block;overflow:hidden;width:210px;height:34=

4px;">
9bytz8CJSCTfiFNA_cJjt0OtKlN2EhNsisbJAMEQyT0Ykvmf1SQKxlueI-w-d_-NAXv_aFriNdA=

q4sh4j1AlmZC0u9Kj_UMkeF80_1DETSyyYAADGhOwztgjMKUwIH20" style=3D"margin-left=

:0px;margin-top:0px;" width=3D"210" height=3D"344">
e=3D"font-size:18pt;font-family:Arial;color:#1155cc;background-color:transp=

arent;font-weight:700;font-style:normal;font-variant:normal;text-decoration=

:underline;-webkit-text-decoration-skip:none;text-decoration-skip-ink:none;=

vertical-align:baseline;white-space:pre-wrap;">
isplay:inline-block;overflow:hidden;width:256px;height:340px;">
https://lh6.googleusercontent.com/FqnZV67xMtclHvenkpwhoJbwaCu9hfNfw5mrOtJgL=

uutosodXXGbsyA-8PWHL4MHlbhMEHC-Z1CzH4HzaQJgu_CtjJvPjuJWDfIsvfrH9nUBOG0xRZu3=

eNcil_JpelZwUCFM5RsPf1TQgvbAwif1_rA" style=3D"margin-left:0px;margin-top:0p=

x;" width=3D"256" height=3D"340">
t;font-family:Arial;color:#1155cc;background-color:transparent;font-weight:=

700;font-style:normal;font-variant:normal;text-decoration:underline;-webkit=

-text-decoration-skip:none;text-decoration-skip-ink:none;vertical-align:bas=

eline;white-space:pre-wrap;">
k;overflow:hidden;width:266px;height:320px;">
usercontent.com/gqeBUQqXWEizEkLewwNTNqJeLzGzDlb6WXsUc3lL5B8H5ne1Mbz3xEwGxNm=

q-bqL-eJZxqAPtEMEYskN0eZN_O89JbW-6awomuENE_ol2CFX6zEK5YvRnecYgftw0ZU1xG9Yvu=

y2kVsGr_wkRYkPcmo" style=3D"margin-left:0px;margin-top:0px;" width=3D"266" =

height=3D"320">=0A=

=0A=


=0A=


=0A=


=0A=


=0A=

=0A=

=0A=


=0A=

=0A=

=0A=


=0A=

=0A=

=0A=


=0A=

=0A=

=0A=


=0A=

=0A=

=0A=


=0A=

=0A=

=0A=


=0A=

=0A=

=0A=


=0A=

=0A=

=0A=


=0A=

=0A=

=0A=


=0A=

=0A=

=0A=


=0A=

=0A=

=0A=


=0A=

=0A=

=0A=


=0A=

=0A=

=0A=


=0A=

=0A=

=0A=


=0A=

=0A=

=0A=


=0A=

=0A=


b-141a-2dcc3650a8df">
=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


argin-bottom:12pt;">=0A=


lor:transparent;font-weight:400;font-style:normal;font-variant:normal;text-=

decoration:none;vertical-align:baseline;white-space:pre-wrap;"> Still =

want to unsubscribe entirely? Click below to unsubscribe.=0A=

=0A=


argin-bottom:12pt;">=0A=

<=

span style=3D"font-size:6pt;font-family:Arial;color:#1155cc;background-colo=

r:transparent;font-weight:400;font-style:normal;font-variant:normal;text-de=

coration:underline;-webkit-text-decoration-skip:none;text-decoration-skip-i=

nk:none;vertical-align:baseline;white-space:pre-wrap;">UNSUBSCRIBE
a>=0A=

=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=



------=_NextPart_000_321C_FC8602DB.A8FD1B80--

Beneficiary spam from Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Aug 2022 01:24:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oSXH0-000D5t-MO

for dave@doctor.nl2k.ab.ca;

Sun, 28 Aug 2022 23:25:22 -0600

Resent-From: The Doctor

Resent-Date: Sun, 28 Aug 2022 23:25:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-sgaapc01rlhn2140.outbound.protection.outlook.com ([40.95.54.140]:26255 helo=APC01-SG2-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oSTtJ-000K83-MV

for root@nl2k.ab.ca;

Sun, 28 Aug 2022 19:48:48 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=LwGYqRQHkUFIhwcmiQdywkMCIv/rszmAb5ORMB2LZ0PRBAAbeEJjPSTEhkoeDOX4SIpT4MNB37aPxhWk5EBT+IZ/sN3u2r7Ds5z+8KBo5PIvkoEMQ/umNa+HKtfhgwTJS9FgF8mG3xOuLaqnZgCKgJJ2HrLc5rijNE5nyUbj5ovrNQfxdcvPvMwyYJdZjCF8z+MVEx004Y7eIUZ+//D5N/+WHMMaPTljHQxHilbq01RSHod7cQsyKnERLBT8JdMppZP1eslnwRDHH50JVbf1BkohPEglAs1KwFr/14gnsZrJgVi7rrEfJt9ntbPcHUeRD/CFNmlP2O3e5Tik2y2Nkg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=g2v0lH7IlDiqRi0zRrz2XoYkrDxMr5/d+iWsUIghS+A=;

b=WpaoU6BWGphwbIRafHTxmvarYDQ5faF4zo9ZjgUf5zEPgqOVPhp6nXc3/FmaPrhjn86SSfNW6JjSVR/r+/UphIl7PadLEoqcdJjvat5UsfxoIfIGm0XRPKm8A55g/ayhoIEcuhvkHINCSPdLrwngciXmfRX6m3pJoiuTvceUnqVA8XlJCOw1oFSzREiIF3eNIF2NcpZ3ktHX4eSZVs4pCsh24Zp8dMpfmCrTRNx0g0wd6CNPVMje1WySjY5RdmWCht1UiALRHfqfLF7toeFn2T0zRz0PqZHvFT+V/O4XiagSC0pOMcmd9E5tbw2cSDXXckpfe7FwTO2hOR/hjBWXTg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

203.189.69.107) smtp.rcpttodomain=hullnissan.com smtp.mailfrom=acens.com;

dmarc=fail (p=none sp=none pct=100) action=none header.from=acens.com;

dkim=none (message not signed); arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=hemascol.onmicrosoft.com; s=selector2-hemascol-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=g2v0lH7IlDiqRi0zRrz2XoYkrDxMr5/d+iWsUIghS+A=;

b=qoOFMY5TWvn1u914TGo8cDvzBMg3I7pjIYUhL5wGivqvPa1i/35xDmvDC/YC8GEXo4OFClndzfIOqadOmIrx3N4RZD0R/gni3z45BXyPhT15aLXLFP2ZshqrDlDgYNH8Ye2n8ML587zvrOS2O9qkTHoA1isA1Mhg4Bbx6c+JJ10=

Received: from TYWPR01CA0045.jpnprd01.prod.outlook.com (2603:1096:400:17f::15)

by SG2PR06MB2219.apcprd06.prod.outlook.com (2603:1096:4:c::11) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.5566.15; Mon, 29 Aug 2022 01:48:15 +0000

Received: from TYZAPC01FT021.eop-APC01.prod.protection.outlook.com

(2603:1096:400:17f:cafe::b5) by TYWPR01CA0045.outlook.office365.com

(2603:1096:400:17f::15) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5566.15 via Frontend

Transport; Mon, 29 Aug 2022 01:48:14 +0000

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 203.189.69.107)

smtp.mailfrom=acens.com; dkim=none (message not signed)

header.d=none;dmarc=fail action=none header.from=acens.com;

Received-SPF: Fail (protection.outlook.com: domain of acens.com does not

designate 203.189.69.107 as permitted sender)

receiver=protection.outlook.com; client-ip=203.189.69.107;

helo=mail.atlas.lk;

Received: from mail.atlas.lk (203.189.69.107) by

TYZAPC01FT021.mail.protection.outlook.com (10.118.152.130) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id

15.20.5566.15 via Frontend Transport; Mon, 29 Aug 2022 01:48:14 +0000

Received: from cpcex01.cpc.local (192.168.13.16) by cpcex01.cpc.local

(192.168.13.16) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 29 Aug

2022 05:35:43 +0530

Received: from User (2.56.58.78) by cpcex01.cpc.local (192.168.13.16) with

Microsoft SMTP Server id 15.0.1473.3 via Frontend Transport; Mon, 29 Aug 2022

05:35:33 +0530

Reply-To:

From: Mrs.Juan Henry

Subject: Attention: Beneficiary

Date: Sun, 28 Aug 2022 17:06:08 -0700

MIME-Version: 1.0

Content-Type: text/plain; charset="Windows-1251"

Content-Transfer-Encoding: quoted-printable

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Message-ID: <2bd8768a72c649e2b17157e244655ac4@cpcex01.cpc.local>

To: Undisclosed recipients:;

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-Office365-Filtering-Correlation-Id: 809e56e6-e952-4042-bff4-08da896089b4

X-MS-TrafficTypeDiagnostic: SG2PR06MB2219:EE_

X-Hemas-MessageTracker: #G01

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?windows-1251?Q?/dtgMiAMlQjT0wMjw0iOdtWXlKPUAWR7KyfTtDMCUkQVQoQQs/GLISh4?=

=?windows-1251?Q?Sy7rjQL4mS2wVHpOAErEr+GdyVPebnEdq9yjBjkNP3xitGKmFx0oxU5c?=

=?windows-1251?Q?y4DhffyQi9zy0p1/Q6AgX6A37HRox45SyPUXa+3gg2ljQ4+xrifLhn0V?=

=?windows-1251?Q?ZxTtGr/avPY8TnDDEDp+ZcowMi9XbhILvIw2xFRCXZo8Op8laiPfGjwY?=

=?windows-1251?Q?QmExzY9R3g4PN6yYKckaH+ORGyVAxTNt0MiwW8HVA60ucKXtJFvMQ2IU?=

=?windows-1251?Q?SXWjVo3nHMpi7M9jrOHph8Fw82sEW432szb41dgZh8cmzKz6FQbY2Opg?=

=?windows-1251?Q?WuCE6lcA4NfhcL9yGXAIbHgUgHT1OeGoi/zoQh4LSUqpj5kMwVCuLEZh?=

=?windows-1251?Q?Xev7JHDtkJahfFCAaAkBmAabcXrhTC4wXGQ+R1tyQCtUi5HqJrSKLZt2?=

=?windows-1251?Q?H30XZbNtqztW+qq/ynVTnfa5OkklsL/tSLNDF5Ht1OKO5zXi01GE20sv?=

=?windows-1251?Q?jb67MlOrSV8qBkh788HciFu33JBzBkf6neCkyMck05gyuDRZGp4HrLSO?=

=?windows-1251?Q?uXMOh6XlPoN8SnLtAN+oeYL1VpfTjRda+Lo0OSAlIPIDAbJRbZHu6ETr?=

=?windows-1251?Q?avyi2lX6x781GnBc8ou95MMsEiMGvvyB9PSlkWCqdqe4OzalopbT3sNy?=

=?windows-1251?Q?ZFoS//MdqUNk/cNkjgk8I8CtYDqOSvGEbFwu4Se9rDzGLToMCc2689SB?=

=?windows-1251?Q?ogaJdy0ke8J67QTm4EsMQo6SGqFe/17XT8w2H6dT4rFV3oWAv/KL9orv?=

=?windows-1251?Q?MQ1tkPXRttmnHsjVcbrxNDd5R+1XetlEvNGEIgGrMcZt/b2KHFPYmOLn?=

=?windows-1251?Q?gxQr0wgsbL8l8CbRt13026zt6QcdEe4wB0S2Xwi9JW+uej7yvXLF9bsE?=

=?windows-1251?Q?TZdCU2f4/jLajL1T/78yaKBlOWyaezeAz2LFK4bKXEI/ngBjhFT3vGJB?=

=?windows-1251?Q?hhsGOvbNujQwhIb00ZDkOCTX+r8v2fok94PgYm63huuEfdnoWClW6jIk?=

=?windows-1251?Q?ydvKIUl22VFnXC6+VKEyY/bOMFdScxi08OEG4487Cko/aKwe84/OzqgM?=

=?windows-1251?Q?eAB7eD7H1EHkXpev2cOu8nHSm+ElwHy8U84uKsEkfGs7OFxnlEh9ugXV?=

=?windows-1251?Q?H7q915Resb2sg9eAq1gBxMv5ddb+gI9ZYxYFrE4lB+BqEqcdQMP0c9BX?=

=?windows-1251?Q?IgTQbIHz+4a6HJg4KVhyXq/IF5dZAwAZ03Y5MMY8?=

X-Forefront-Antispam-Report:

CIP:203.189.69.107;CTRY:LK;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:mail.atlas.lk;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230016)(136003)(346002)(396003)(376002)(39860400002)(40470700004)(82740400003)(70586007)(70206006)(8676002)(356005)(86362001)(81166007)(32650700002)(66574015)(109986005)(83380400001)(9686003)(35950700001)(108616005)(24736004)(26005)(41300700001)(498600001)(7366002)(316002)(82310400005)(336012)(2860700004)(40460700003)(40480700001)(6666004)(2906002)(956004)(7406005)(5660300002)(7416002)(8936002)(362954009);DIR:OUT;SFP:1023;

X-OriginatorOrg: hemascol.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Aug 2022 01:48:14.2943

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 809e56e6-e952-4042-bff4-08da896089b4

X-MS-Exchange-CrossTenant-Id: 0b2ad702-c4fe-4319-a94f-4c01f321d5e7

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=0b2ad702-c4fe-4319-a94f-4c01f321d5e7;Ip=[203.189.69.107];Helo=[mail.atlas.lk]

X-MS-Exchange-CrossTenant-AuthSource:

TYZAPC01FT021.eop-APC01.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2PR06MB2219

X-Spam_score: 24.6

X-Spam_score_int: 246

X-Spam_bar: ++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ATTENTION: This email came from an external source. Do not

open attachments or click on links from unknown senders or unexpected emails.

Attention: Beneficiary We are not sure you received our previous message

but we wish to us this medium to officially inform you that following the

ongoing review of all unclaimed and delayed funds by the United Nations and

[...]



Content analysis details: (24.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 NSL_RCVD_FROM_USER Received from User

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[40.95.54.140 listed in psbl.surriel.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[jjjuan429[at]gmail.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=info%40acens.com;ip=40.95.54.140;r=doctor.nl2k.ab.ca]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-SG2-obe.outbound.protection.outlook.com;ip=40.95.54.140;r=doctor.nl2k.ab.ca]

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_NAME_MR_MRS No description available.

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

1.7 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 XFER_LOTSA_MONEY Transfer a lot of money

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

Subject: {SPAM?} Attention: Beneficiary





ATTENTION: This email came from an external source. Do not open attachments=

or click on links from unknown senders or unexpected emails.





Attention: Beneficiary





We are not sure you received our previous message but we wish to us this me=

dium to officially inform you that following the ongoing review of all uncl=

aimed and delayed funds by the United Nations and the World Bank, your paym=

ent file was forwarded to our office for immediate payment of your long del=

ayed funds starting with a first transfer of US$10,000,000.00 with referenc=

e No. NG/FM14FGN, to your bank account.



However, we are surprised to receive another application this morning from =

your representative, MR.KRAUS MULLER,stating that you authorized him to tra=

nsfer the funds to another bank account in Germany and that you were recent=

ly involved in an auto accident and cannot walk right now.





Could you please confirm immediately, your relationship with MR.KRAUS MULLE=

R and also, confirm if the bank account in Germany as shown below is now yo=

ur new bank account information to receive your funds this week from our pa=

ying bank





ACCOUNT NO: 098-11180933-109

IBAN: CH55 0910 3045 6011 91110 0

SWIFT CODE: AREZCHZZ8OU



Kindly get in touch with us today by email with your telephone number to co=

nfirm this information to avoid wrong transfer of your funds, so that we ca=

n proceed with the transfer of the US$10,000,000.00 to your correct bank ac=

count as scheduled.





Yours sincerely,



MRS.JUAN HENRY

Director,Anti-Fraud Unit.

Financial Services Regulation Committee

Plot 33,ATB Way Cadastral Zone,Abuja,NG



________________________________



CONFIDENTIALITY



This message contains confidential information and is intended only for the=

individual named herein. Any attachment transmitted with this email is con=

fidential and intended solely for the use of the individual or entity to wh=

om this email is addressed. If you are not the named addressee you should n=

ot disseminate, distribute or copy this e-mail. Please notify the sender im=

mediately by e-mail if you have received this e-mail by mistake and delete =

this e-mail from your system or please notify the system manager. If you ar=

e not the intended recipient you are hereby notified that disclosing, copyi=

ng, distributing or taking any action in reliance on the contents of this i=

nformation is strictly prohibited and in the event of any unauthorized disc=

losure, copying and/or distribution of the contents the generating entity a=

nd/or the sender reserves the right to take any action against such unautho=

rized use in law, equity or otherwise.

The recipient should check this email and any attachments for the presence =

of viruses. The sender accepts no liability for any damage caused by any vi=

rus transmitted by this email, delays, data corruption, unauthorized access=

or unauthorized amendments.



________________________________