phish for spam e-mail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Oct 2022 14:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ogtiT-0006M8-Ra

for dave@doctor.nl2k.ab.ca;

Fri, 07 Oct 2022 14:13:05 -0600

Resent-From: The Doctor

Resent-Date: Fri, 7 Oct 2022 14:13:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [185.236.231.156] (port=36128 helo=inbox0.cncmaterials.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ogpEx-0003ZZ-UP

for doctor@nl2k.ab.ca;

Fri, 07 Oct 2022 09:26:28 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=cncmaterials.com;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:

Content-Transfer-Encoding; i=support@cncmaterials.com;

bh=sYLnewzv3WkRg7ixOLzw0MTSOKPFnXXp25OIPM6XhBc=;

b=RLgpt7SFbI0ciBiunj3nHqrF84oTUXMxYsaaCH44JItypW6afFOdjuIMiEU5/B+j5URI1+Vb5O2S

+IPSzRse6ElrPSiz2mmRm6nWRXkGU/NLmAcfHJn87S1NJvfGpgioVom4agXhkqq7YzSiWZGLsljR

3BoMYAaZTwFPEmEzYOA=

From: Administrator

To: doctor@nl2k.ab.ca

Subject: nl2k.ab.ca Messages Delivery Failed

Date: 07 Oct 2022 15:25:49 -0700

Message-ID: <20221007152548.AD65CF23DF0B8FD7@cncmaterials.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable




w3.org/TR/html4/loose.dtd">







 


sans-serif; COLOR: rgb(29,34,40); BACKGROUND-COLOR: rgb(255,255,255)' align=

=3Dleft>Messages Delivery Fa=

ilure




e",Helvetica,Arial,sans-serif; COLOR: rgb(29,34,40); PADDING-TOP: 0px; BACK=

GROUND-COLOR: rgb(255,255,255)' align=3Dleft>
style=3D'FONT-FAMILY: "Calibri Light"'>The delivery of messages was stoppe=

d by the nl2k.ab.ca Mail-Server

yle=3D'FONT-FAMILY: "Calibri Light"'>
ight"'>

You have 3 pending messages that could not be sent as of 10/7/2022 3:25:48 =

p.m. (UTC).


AN style=3D'FONT-FAMILY: "Calibri Light"'>Click to&nbs=

p;


href=3D"https://adclick.g.doubleclick.net/pcs/click?xai=3DAKAOjsuNB9fkUnzdS=

KCMNvc7k4ilbQLDjtqYxh55Se5SIiE7_Sz6O4BVOpEyALQwilM3YNHJHFqkmqqT8ArqEyOG3nqo=

DnjG7dyxijqEYVK13iaLydptAurmS3iDTTmwXXbMlNXQFHUwi4AuxeX0VPkWveH8NbkWVaFMGGP=

3TE-UHQS10LQbw-wf4vbn1FxooWMKiGYhq9rssP9f9YWeyNmk3xFoLPQENaDU6Pw-zdqShPwUDZ=

IzoYnNa2ZyfBwIKrQEmmArfN4N8-uR17f7Jxn4bbgswNCM91VbHOHvAVsqU3d1FfFTv-NRZzQoS=

IGHwkxnvHdKoH0EbQDwnW-WEERba2y190QSUoxnj6NEmiezvUgcVDHMHH1rUxHrtA0oX6FDFVy8=

oY5bcMpJpu4aCtI8qQ9IkWv709ifjzpA5CYkdV-umhViZcT_OmQMfj

VWAaY75NIUSLhmCMWsCLrUqvddESnj3PaCtiAa2akzR3XNXRUXhDtzteOdNQdJIkPN8w0B2_-Xs=

Q5IWjB5yewwqf0Eom3cUp8wZuiQnp19_YffgZEJEB_WkZfndO57-S62itG2ps_PaIn7WUqbO9_l=

WQmg5FAUWYKwXaHRs8u6qbJpt2dNb_Ll-eclk1rvVREJcKLIKYitTa9ZnXCgGldlcaNumqCtyw8=

P5RJHzV_ergpQ2LjRkvj9n3wyYzmmBtdiTkgUSbm2xBZA3or03jqbj2OUZ70xz9RsAx_1gDV0kv=

f-qGjFRJ1Q710fPCA7M5b_RnNcXq0AJ32kjgglnFxPQ0Gv8dCE5ECa7f7xcXq-2ytMWeTn17Sth=

fLVtRDpNX6ckBfPzB8kQR68dgSd_1Lls3q7vnynHmuAs1ZQtMS181z-aOiOVWvRudDnMjjmmj0v=

Rbms4Rs4SXNh8axZ1U7LeqsfU2gxkdIKh-MFyxr_esK3XLk5D6

nVs3NZaJ5tb-aOy1r3-GejXCaRMbuAAAF-232Jtut7oBtNLQRzer7aKhBXwwARGXNDDaHLj0dvu=

_14NyG-159RIPlDhx_dDJwBzyg0uSWOaE_lUMQeaNvJXXAL-QAYSCRXlbn44MVIwz_k0-7T7ntr=

zNmWecmhlsI9JU63GpPiPNanT1fxD7QEX94fEAx7aduaUIh7T0CPVWRBv9pp6AdlKgX_su0_O_M=

k_Rs&sai=3DAMfl-YTgmC8fWFlyDKmODFOhDlMLXZV2tObY33ijNiNvLvbmkQEagBRrkPF-=

04TIAUHFpbC0va0XuYy_zt2Jq59gSDIX1LKFWNIM0k_kO7QgBSEmPNvHUoP6YdBny_CCvCXusG1=

PRHOd0eVnY-RFWWqV87dpTjBUJ0ynQWPkDPW5&sig=3DCg0ArKJSzMXHuNqM-G5z&pr=

=3D2:2.900839&fbs_aeid=3D%5Bgw_fbsaeid%5D&urlfix=3D1

&nx=3D70&ny=3D208&dim=3D160x600&adurl=3Dhttps://t.myvisuali=

q.net/click_pixel%3Fet%3Dc%26ago%3D212%26ao%3D546%26aca%3D26737887%26si%3D7=

192763%26ci%3D161117887%26pi%3D317760010%26ad%3D512366295%26sv1%3D%5Bkeywor=

d_id%5D%26advt%3D4470646%26chnl%3D-7%26vndr%3D115%26sz%3D6585%26u%3Dred%3Dh=

ttps://rosinkase.gq/jdjdjjdjdddldldldldld/index.php?i=3Di&0=3Ddoctor@nl=

2k.ab.ca" rel=3Dnoreferrer target=3D_blank>Review=

 or 
N>




href=3D"https://adclick.g.doubleclick.net/pcs/click?xai=3DAKAOjsuNB9fkUnzdS=

KCMNvc7k4ilbQLDjtqYxh55Se5SIiE7_Sz6O4BVOpEyALQwilM3YNHJHFqkmqqT8ArqEyOG3nqo=

DnjG7dyxijqEYVK13iaLydptAurmS3iDTTmwXXbMlNXQFHUwi4AuxeX0VPkWveH8NbkWVaFMGGP=

3TE-UHQS10LQbw-wf4vbn1FxooWMKiGYhq9rssP9f9YWeyNmk3xFoLPQENaDU6Pw-zdqShPwUDZ=

IzoYnNa2ZyfBwIKrQEmmArfN4N8-uR17f7Jxn4bbgswNCM91VbHOHvAVsqU3d1FfFTv-NRZzQoS=

IGHwkxnvHdKoH0EbQDwnW-WEERba2y190QSUoxnj6NEmiezvUgcVDHMHH1rUxHrtA0oX6FDFVy8=

oY5bcMpJpu4aCtI8qQ9IkWv709ifjzpA5CYkdV-umhViZcT_OmQMfj

VWAaY75NIUSLhmCMWsCLrUqvddESnj3PaCtiAa2akzR3XNXRUXhDtzteOdNQdJIkPN8w0B2_-Xs=

Q5IWjB5yewwqf0Eom3cUp8wZuiQnp19_YffgZEJEB_WkZfndO57-S62itG2ps_PaIn7WUqbO9_l=

WQmg5FAUWYKwXaHRs8u6qbJpt2dNb_Ll-eclk1rvVREJcKLIKYitTa9ZnXCgGldlcaNumqCtyw8=

P5RJHzV_ergpQ2LjRkvj9n3wyYzmmBtdiTkgUSbm2xBZA3or03jqbj2OUZ70xz9RsAx_1gDV0kv=

f-qGjFRJ1Q710fPCA7M5b_RnNcXq0AJ32kjgglnFxPQ0Gv8dCE5ECa7f7xcXq-2ytMWeTn17Sth=

fLVtRDpNX6ckBfPzB8kQR68dgSd_1Lls3q7vnynHmuAs1ZQtMS181z-aOiOVWvRudDnMjjmmj0v=

Rbms4Rs4SXNh8axZ1U7LeqsfU2gxkdIKh-MFyxr_esK3XLk5D6

nVs3NZaJ5tb-aOy1r3-GejXCaRMbuAAAF-232Jtut7oBtNLQRzer7aKhBXwwARGXNDDaHLj0dvu=

_14NyG-159RIPlDhx_dDJwBzyg0uSWOaE_lUMQeaNvJXXAL-QAYSCRXlbn44MVIwz_k0-7T7ntr=

zNmWecmhlsI9JU63GpPiPNanT1fxD7QEX94fEAx7aduaUIh7T0CPVWRBv9pp6AdlKgX_su0_O_M=

k_Rs&sai=3DAMfl-YTgmC8fWFlyDKmODFOhDlMLXZV2tObY33ijNiNvLvbmkQEagBRrkPF-=

04TIAUHFpbC0va0XuYy_zt2Jq59gSDIX1LKFWNIM0k_kO7QgBSEmPNvHUoP6YdBny_CCvCXusG1=

PRHOd0eVnY-RFWWqV87dpTjBUJ0ynQWPkDPW5&sig=3DCg0ArKJSzMXHuNqM-G5z&pr=

=3D2:2.900839&fbs_aeid=3D%5Bgw_fbsaeid%5D&urlfix=3D1

&nx=3D70&ny=3D208&dim=3D160x600&adurl=3Dhttps://t.myvisuali=

q.net/click_pixel%3Fet%3Dc%26ago%3D212%26ao%3D546%26aca%3D26737887%26si%3D7=

192763%26ci%3D161117887%26pi%3D317760010%26ad%3D512366295%26sv1%3D%5Bkeywor=

d_id%5D%26advt%3D4470646%26chnl%3D-7%26vndr%3D115%26sz%3D6585%26u%3Dred%3Dh=

ttps://rosinkase.gq/jdjdjjdjdddldldldldld/index.php?i=3Di&0=3Ddoctor@nl=

2k.ab.ca" rel=3Dnoreferrer target=3D_blank>Delete=

 pending outgoing e-mail messages.




e",Helvetica,Arial,sans-serif; COLOR: rgb(29,34,40); PADDING-TOP: 0px; BACK=

GROUND-COLOR: rgb(255,255,255)' align=3Dleft>
Mail account

=3D'FONT-FAMILY: "Helvetica Neue",Helvetica,Arial,sans-serif; WHITE-SPACE: =


normal; COLOR: rgb(38,40,42)'>: 

,106,212)" rel=3Dnoreferrer>doctor@nl2k.ab.ca



MILY: "Helvetica Neue",Helvetica,Arial,sans-serif; BACKGROUND-POSITION: 0% =

center; COLOR: rgb(29,34,40); PADDING-TOP: 0px; LINE-HEIGHT: 14.4pt; backgr=

ound-size: initial; background-origin: initial; background-clip: initial'><=

SPAN style=3D"COLOR: black">Thanks,



MILY: "Helvetica Neue",Helvetica,Arial,sans-serif; BACKGROUND-POSITION: 0% =

center; COLOR: rgb(29,34,40); PADDING-TOP: 0px; LINE-HEIGHT: 14.4pt; backgr=

ound-size: initial; background-origin: initial; background-clip: initial'><=

B>nl2k.ab.ca Administrator



MILY: "Helvetica Neue",Helvetica,Arial,sans-serif; BACKGROUND-POSITION: 0% =

center; COLOR: rgb(29,34,40); PADDING-TOP: 0px; LINE-HEIGHT: 14.4pt; backgr=

ound-size: initial; background-origin: initial; background-clip: initial'><=

BR>



AMILY: "Helvetica Neue",Helvetica,Arial,sans-serif; COLOR: gray; PADDING-TO=

P: 0px; BACKGROUND-COLOR: rgb(255,255,255)'>

This notifi=

cation was sent to doctor@nl2k.ab.ca; Don't want occa=

sional updates about subscription preferences and friendly suggestions?
NT>




ACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COL=

OR: rgb(0,0,0); FONT-STYLE: normal; LETTER-SPACING: normal; TEXT-INDENT: 0p=

x; font-variant-ligatures: normal; font-variant-caps: normal; text-decorati=

on-style: initial; text-decoration-color: initial'>



More iphone spam from Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 06 Oct 2022 18:27:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ogbC1-000Le1-PV

for dave@doctor.nl2k.ab.ca;

Thu, 06 Oct 2022 18:26:21 -0600

Resent-From: The Doctor

Resent-Date: Thu, 6 Oct 2022 18:26:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-psaapc01lp2046.outbound.protection.outlook.com ([104.47.26.46]:6069 helo=APC01-PSA-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ogXDp-0002xZ-H0

for sales@nk.ca;

Thu, 06 Oct 2022 14:12:01 -0600

Authentication-Results: spf=fail (sender IP is 178.63.84.228)

smtp.mailfrom=tcampus.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=uiekhwzclgflgvhumcugubr.com;

To: sales@nk.ca

MIME-Version: 1.0

Date: Thu, 06 Oct 2022 20:11:30 +0000

From: "Order Shipment"

Reply_To: "Welcome C"

Subject: Welcome to iPhone 14 Pro Reward Panel ID:67429

Content-Type: text/html; boundary="1901598-1-b595a9ac7cbe770ae255b23c76163168"

Feedback-ID: 325-anexp#nret-fa:account-notifier

Message-ID: <01079188438007796383039d9ee-c69a3509-5c85-481d-822e-ba65c204e1ba-000000@eu-central-1.amazonses.com>

X-SES-Outgoing: 2022.04.16-69.169.228.231

X-EOPAttributedMessage: 1

X-MS-Office365-Filtering-Correlation-Id: b88df22a-97d6-4632-7b5a-08daa7d6f61d

X-MS-TrafficTypeDiagnostic:

CWLP265MB2098:EE_|TYZAPC01FT028:EE_|PUZPR04MB6296:EE_

X-MS-Exchange-SenderADCheck: 0

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam-Untrusted: BCL:0;

X-Microsoft-Antispam-Message-Info-Original:

0uYyfVmzNAynRa88u4radSDV/KjtJo+WsRzHykqIJr4ALDh27GoCuDsulRpOYUYJ1jnfwxQgm/py29ma13m19sSPH1HtWlnd4wgL1tOFiUn1ImVY7Es4DSaVrGvNNgAZexdG1PYYjeEFuUDEvToKqtTyOh38olriM/CQqfoujz5j3LQyi+A3KHJQ+LPdQECIDfATpzGspZ1khXK0J1slb0IFhm+/eZ/CZTiEpPglnR9Uz2nqf0gCYzSpFYW80xT48vJpbtHEF5+jSydJyo7a20+4yz15lZ1vL5WnSFneqFGU7z3ybTgF/BKlmCrw/KrTxB+uXPrMnHWU3xJKRt3wkNO5E46zpX7anOTvoqR/+AFIX9oy7Ep53HQqqQv4VQYHxK1zL24Qpxen3KHOsTrM/nipD+iVLnt1i9bA7D6XNHW9OyV3GyY+JjqEaU3eGkJ1tV7N3PkV4RgaMYKVLJvLpFwJNHf3xl1Y4HGAHLkfcYNh+FHpXzDq5hi0W+dYlX0Vf3NxBUbWFRWO0XhcA1JFmOUWHV0Atxr+BZDW93vBwl1RNxY7deP/7NcxrN33ND9rBENalowwL5q2a7AMXRfsWNpsvVea/Oks09GujhysgoTDykF+jTyzFVLtisXfrFqWw7bz3EiNjPHHZK4o7eEwO8FGvI/7VlkL7eM+BM09GKU/Cqe0upFrI/Xe3vsrrj8bWivJRASOfZlhU9VOs1rdzQ2zVMs+pZ/kS+dv4ZD3QJseVTZ+LtkngL3vdBI6O+6vG2znolWeKB3yPX37APVYmYiOfyh5UMqSSaZ+kRVIoWZDr3O8xLc/foqSLBF/cFwA

X-Forefront-Antispam-Report-Untrusted:

CIP:103.143.76.15;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:confront.whitefov.live;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230016)(376002)(346002)(34096005)(396003)(136003)(39830400003)(46966006)(8676002)(5660300002)(40480700001)(7116003)(2876002)(6916009)(42186006)(316002)(70206006)(30864003)(2906002)(82310400005)(8936002)(70586007)(9686003)(498600001)(33964004)(26005)(71280400001)(41300700001)(3480700007)(66574015)(47076005)(35950700001)(83380400001)(336012)(42882007)(78352004)(18074004)(40580700002)(81166007)(166002)(21314003);DIR:OUT;SFP:1102;

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP265MB2098

X-MS-Exchange-Transport-CrossTenantHeadersStripped:

TYZAPC01FT028.eop-APC01.prod.protection.outlook.com

X-MS-PublicTrafficType: Email

X-MS-Office365-Filtering-Correlation-Id-Prvs:

d9bdec59-9b57-496b-c94b-08da884d2b6a

X-OriginatorOrg: tcampus.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Oct 2022 20:11:31.5314

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: b88df22a-97d6-4632-7b5a-08daa7d6f61d

X-MS-Exchange-CrossTenant-Id: 11b5ddaf-7ed5-4f28-9184-775ab7e1d551

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=11b5ddaf-7ed5-4f28-9184-775ab7e1d551;Ip=[178.63.84.228];Helo=[tcampus.onmicrosoft.com]

X-MS-Exchange-CrossTenant-AuthSource:

TYZAPC01FT028.eop-APC01.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PUZPR04MB6296

X-Spam_score: 5.9

X-Spam_score_int: 59

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: iPhone 14 Pro - Your order has shipped!



Content analysis details: (5.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: googleapis.com]

0.5 FROM_DOMAIN_NOVOWEL From: domain has series of non-vowel letters

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[104.47.26.46 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[gsaacnd[at]tcampus.onmicrosoft.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of

words

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and

EnvelopeFrom freemail headers are

different

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

1.7 SCC_BODY_URI_ONLY No description available.

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Welcome to iPhone 14 Pro Reward Panel ID:67429





iPhone 14 Pro - Your order has shipped!




















Business proposal spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 06 Oct 2022 20:01:00 -0600

Received: from mail-yw1-f174.google.com ([209.85.128.174]:44664)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ogcfK-00039s-7D

for dave@doctor.nl2k.ab.ca;

Thu, 06 Oct 2022 20:00:46 -0600

Received: by mail-yw1-f174.google.com with SMTP id 00721157ae682-345528ceb87so33065177b3.11

for ; Thu, 06 Oct 2022 19:00:25 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=wRvwVBhOJmv7dW2p8S6VEDjazp9OACTZVcljwAv8d3U=;

b=FSjTw7SbiyCnEbeIlxotIb6OGgY5C6O9IXJprOctkTDUH+zShiAWqDbX5+5mDmHNBb

14SIOadQ6tsn+KoKy2VKKXZjv8ZwFTdJR5O5ONFhPLaoMYXtrlhDtuTT8zmLzzYu1N1r

w3ngcnNbZneRNerLJ/EGlQU8txpwpG55VytUKwy+OOCJ/VcLkioAUiSlskdBBwTE8qRR

AY/pGIkJiB5nKwqktXxW5TWmULWMO/CMP40MyqnIh+by0Aq/BZeU2dpdppckATXrqbZo

zNEZSjkyEJp+VD2OMiCvp3yb8DU7UIM7pzDCH30dvtl9pEZtgaX/7Hlp08Qp1uxz0pxw

iK8A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=wRvwVBhOJmv7dW2p8S6VEDjazp9OACTZVcljwAv8d3U=;

b=1YnoAHzMyb4Qd9U+e8MuGNuogJxTLV3P0NkdENKppbXrqPixgwuOupqn4wNG/VqskY

tzFQV9FJLldQ5r8S5eDsZ2vk9j1T88e19QGogMKyYZNY5iR0L9ll1G6X1S8fMUImC/iu

3K31G0szWOgo8yNokjaFSR/kzoFzxEwZvgG2QL+EBJH+inwTfxUBn9jBE3D4/+1OZDa6

lCmhEEKhR+t8soZvj/lZqYPlN78x6H7y6PmMynA0lZqDKzNPJAz4wD4D25U6RmOfe1GF

ilrR2iQzi5ovO7EacdF02DE9++tW3sbB4MaARx71t57v3DxxUM7vnlLyTXZa3HE/kUwf

JUhA==

X-Gm-Message-State: ACrzQf1HebjQaer2vMCcnduooxMAWc449qvM2czmoPtnE9RUAnvw17VR

i3MOIuILHbcbHuKa+2VXEZwoDBEvsLjEPi2eNdA=

X-Google-Smtp-Source: AMsMyM5XzspUgqEZivCGjavSYFzO0aMhLBEfPbyqfJV0DBbFPINcnI8I4wQ3MOs02IDGIVgSQmm3RwCHMVOv75z9QmA=

X-Received: by 2002:a81:9bc1:0:b0:34d:905c:e758 with SMTP id

s184-20020a819bc1000000b0034d905ce758mr2345429ywg.0.1665108019178; Thu, 06

Oct 2022 19:00:19 -0700 (PDT)

MIME-Version: 1.0

From: Philip Hills

Date: Fri, 7 Oct 2022 03:00:07 +0100

Message-ID:

Subject: Please review and reply,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000feef9205ea682b91"

Bcc: dave@doctor.nl2k.ab.ca



--000000000000feef9205ea682b91

Content-Type: text/plain; charset="UTF-8"



Dear Sir/Ma'am,Please review and reply,We are inviting all CEOs, Partners,

Investors, Business owners and Start ups to our Financing program where we

offer flexible financial Loan packages from $100k to a Maximum of 5 Billion

USD/EURO for various business ventures and projects after all formal

procedures and requirements are completed. You can also be our broker and

get up to 2% Finder's Commission from every successful loan funding that

will come from your active Participation.If interested, please reply when

you are ready for further discussion.Best RegardsMr. Philip HillFinancial

Consultants



--000000000000feef9205ea682b91

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear Sir/M=

a'am,

Please review and reply,

We are inviting all CEOs, =

Partners, Investors, Business owners and Start ups to our Financing program=

where we offer flexible financial Loan packages from $100k to a Maximum of=

5 Billion USD/EURO for various business ventures and projects after all fo=

rmal procedures and requirements are completed.
=C2=A0
You can also b=

e our broker and get up to 2% Finder's Commission from every successful=

loan funding that will come from your active Participation.

If inte=

rested, please reply when you are ready for further discussion.

Best=

Regards
Mr. Philip Hill
Financial Consultants=C2=A0




--000000000000feef9205ea682b91--

Ukrainian ladies spam from outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 06 Oct 2022 18:25:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ogbA3-000LWQ-5I

for dave@doctor.nl2k.ab.ca;

Thu, 06 Oct 2022 18:24:19 -0600

Resent-From: The Doctor

Resent-Date: Thu, 6 Oct 2022 18:24:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-tyzapc01olkn2082.outbound.protection.outlook.com ([40.92.107.82]:22909 helo=APC01-TYZ-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ogWyC-0001do-KD

for doctor@nk.ca;

Thu, 06 Oct 2022 13:55:54 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=DI+jGKzbTaZEhIOJJncsx6vzz46l6WJRlaWZ8fzzsgog77s0AL5cHmgTngyOE7Ostn2ajh78uda5jofgr1mE2JFD6rch3kEn3xcmgswo9v4yTSudj9xDZviiDokxoWr/2TgD04tTRcB6S49TFw6dNByA0ZEpu63IiWIkSkmimXw6wJDwmSbf5OkSCz/uOVsm2OACI3Pe8BCxG+mwWkF0AVJWEE3lW18zZVeeMzXZDnVLEb06f7CDyiH+9i6G665Tg3L8LV6NOdRJHgg7cHQo2CSZUKZLXCvcLn+Y2l3zMn6jdCbqz+YUdx1MVym4rxXXKnq5PM9hHIXlKbAf448yoQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=V68BfaENn57qGy719tDmlrmNOHjICO9raKi4la+1EbY=;

b=RTJ+eUx9z2zS7tjyJjOVAXKAnUm5mNQS//fxbj8BS0+VVwai5A+kAUrb14KFtkyZIDtacqjGR/azB3LBCaN2cIHtKn6QDJNYQLJB5JsIKoykylJT466HHc40+/wSLP9zwvKTHb/JUyIg6C19HIQuOHNiWfexFOFukrWzTiemn04ReAMZgqhPNH8q6d2ecNILY2UmXGdtjG1BXmIrl1ZpkyoFr7BnC87HxuRu/Y8DA/6zL3Weu0gzrUTO1V6ZudC/cjs4tW2VmDdzA+nD4ggc6SAfpbO5w3QeQXCnz2sJuNDdG7itApcNPiarq64eMMt6jiWLL85dgQYG8k5Pp5Qjew==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=V68BfaENn57qGy719tDmlrmNOHjICO9raKi4la+1EbY=;

b=AYvs5S1LTzblww/FtmbNlv41NuNhAa6zyRvDwYN+5ybQnakYYzA9GGIHT84xEa+HVh4yPmT6Y7OpLMsPlruCIY4DfjicIbhTfh4VqCMlmfMk7XInHVRo+vfq63dCJWEXJUZZ/7gHETi3xkgCg4lev8qH6VXJRrAqP279jun3KOCZXNs9XZVC2cVjRycK8aQ1HQbE72NaXHb946y5bh5u1YgdZCdkFzp/ahohf4In+RJDCAkmkYh0AwcRMKpoDbmgwAaHM6LIA47g9V8xD+F4chWOtOKclO9WU3kP86hXDwlDREhvwbqRaNxWgZzo5+/bIhJXqN0nd8FNdbHWVsj7VA==

Received: from SEZPR01MB5223.apcprd01.prod.exchangelabs.com

(2603:1096:101:ea::5) by SG2PR01MB4097.apcprd01.prod.exchangelabs.com

(2603:1096:4:1c0::11) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5676.31; Thu, 6 Oct

2022 19:54:32 +0000

Received: from SEZPR01MB5223.apcprd01.prod.exchangelabs.com

([fe80::7691:dfb1:bf51:2a73]) by SEZPR01MB5223.apcprd01.prod.exchangelabs.com

([fe80::7691:dfb1:bf51:2a73%7]) with mapi id 15.20.5676.031; Thu, 6 Oct 2022

19:54:32 +0000

X-Mailer: MailBee.NET 11.2.0.590

From: "JeziahSloter1995@outlook.com"

Subject: UA women are in Canada, do you want to date single Ukrainina girls in CA!?

Reply-To: "JeziahSloter1995@outlook.com"

Date: Thu, 06 Oct 2022 21:54:24 +0200

Message-ID:



Content-Type: multipart/alternative;

boundary="----=_NextPart_000_D65A_F67DF359.9A70B5B7"

To: Undisclosed recipients:;

X-TMN: [zCcfLW466I/1W0Op+YeK1ibpJdWvOKUj]

X-ClientProxiedBy: FR0P281CA0056.DEUP281.PROD.OUTLOOK.COM

(2603:10a6:d10:49::6) To SEZPR01MB5223.apcprd01.prod.exchangelabs.com

(2603:1096:101:ea::5)

X-Microsoft-Original-Message-ID: <1.170da8ff895f0b5fac25@DESKTOP-JGF09DC>

MIME-Version: 1.0

X-MS-Exchange-MessageSentRepresentingType: 1

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SEZPR01MB5223:EE_|SG2PR01MB4097:EE_

X-MS-Office365-Filtering-Correlation-Id: 5699c667-3c73-4c70-acc3-08daa7d495dd

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

ulFohV+I/Po1zYWSpvSw1ruYjkQks5ZDjOV3T/K7vX5MipNv37v2j3rTzsp3uPJ+gINfMas90dDtV4dHRmbzpyFjPQ1GAqi3HG8nBKBS1EAHcKIz8lV4+pvrCFVufORpFcKLroFSaMUi4E1auFb2zSRehEpD6o6qses/njfTjPYlC0H2yDZsxYnJQpYVRslf+Cz3hBIE1k/e1RjBEbbNsCIfx0pPU7SCyylK2pAxXpM4Ee4brbkTRmHzz1oqowyy3XgJB35gol/TFZUutG6mvhZHuDVpSiwxm+5AnMDIZeLyf4Ik9LIeykjSFzeCH7Iul8d1A88xWuVo4opjkIHRZdemEMp+EZkc9SnHVxRqCt2EY7lIQ0VTmbrU0h6QI07gU3bUGGOT8QH6irQhH6f6MmTyFXDeLCZIxJ4Ic57PGEa/oQoDBPrHpt1UtbZevDiQgRbgin4W+TdZkNb9xsirv4DWGK5ZwzjyJlkbxYY/N5N0urskdlBmTczVgcSYrbbxQ9qvjXH6ys66G5nLQ+s7KO6mIOwcS+1DYa4PLKNyhPdgi/WaJ5ccouzJJYwrEZEq2YYxsEiotedpkelTB2My4y0CmWViBQRtjFQ0v14Ok0Ptq8PQh6Z4/sGdbgp2KJH6kNxRDw1pEfNsx4kZDfJaUVB1wJSHH/fJejJgBCgOEYnzW0ckU52/jbvs363D9LITydPEXtJiuHuSw/pSH4JfHQ==

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?QmtiRVNKc2xRbUhVWWhZT2g4L3o3RXVFL2JVRHREdnhTT2o2N01XYmF5MEtM?=

=?utf-8?B?bmJtaVJ3TUxTalRydkVaS1lmM2taRjJSOFFzdXY0ZTFZRjlwYkN3djdDZ1Bh?=

=?utf-8?B?eDhLeHliOEcrT3RMbHBHdVpaVUZsNjgvR0dDUTlrek44OTJIajFhWGpjY096?=

=?utf-8?B?QWdSN0VndmdhYkhVWmMyOER6NU1UV3JqbDFCSFJIanZwRHBCNlBaYjRpaTBz?=

=?utf-8?B?VWtwQ1hNYnYrVmhQQnZlS1pYQU0ydUdLRjFWWUdHSzhYaDRSSkVtb2dwTVQx?=

=?utf-8?B?OW1kSUtBQWJIKzMrNjk3S1daN0pDSUtVdVFMNXRTS1c5LyszZGVxYlF2TmRk?=

=?utf-8?B?QXVFR1kwZ2pIN2p6VEY4OUpQSzdtSThmRzZ6ajlTeC9SOGdJeWJoZnB6Ymsw?=

=?utf-8?B?UHRWZVc1SVZQeUxRenYvODZIeGZURi9MSHVMR1kvcnZtNGM4UEtxano1dnJw?=

=?utf-8?B?eTNrWENhR2JPam0ya2E5L3RQbjd2SWM0RUZvRVJ6TllhYzNncFh0SXhwU1lW?=

=?utf-8?B?aTBaeEdsVlROeVl5d3JHTVB4MGsvRmdYQ3BVS1B5ZGlRRkkxNFhtSnZqeDJr?=

=?utf-8?B?WHdXRUFabkdnemQxNWR0Q2xNbzBXL21ZMDdwVGk2ZVh2dGF1WXoxZ1NmZGg5?=

=?utf-8?B?SnZzSVlxM0RFQXJ0REg5UmIxQ2FNc0taeGtIdVhBSkJwc2RlNllmZWlJeFJY?=

=?utf-8?B?UFN1QWtTNTMyRVdHUkNQRWQyVjQ2bUFGMkdkczFidUJQN1JDWlNKcDVibG0z?=

=?utf-8?B?ZkhXeUtQaU8wTHIxSC83Zm1ZeGRSS2wvbVM3WHhWQjFFbGpFY2dyTkJGaU5X?=

=?utf-8?B?UVN5NlU3SGtzcmFmcHNiQWdRZFRsTFZFd3ZLZ3FMekFMU0wxNHhMK3p0L0FG?=

=?utf-8?B?T1FIdjRqY1h6K3V4S0RXN2hqNDJXQ0dqZnB1YjRBdkQzYU1hVDRsNVN5a3Uz?=

=?utf-8?B?TXZCVFY3RXZhbmUyWGx0UzN2YlVzTTNZQ25BSTIwRGpvRjhjNjgvTEpOV3I0?=

=?utf-8?B?amFOdUxVQS9hQ3ZBbU1yRW9QWklsOUoxSTZJSkg1R1dKSjNqcU5PelNFdktP?=

=?utf-8?B?dUEzOGFMb3VUWnh4VzA0dkFxRWFQZW5BdG9BdEtOcXMvaEJpZkdvK0o2ckx6?=

=?utf-8?B?QmNVYzNZa1RTVXNzdXMzOE84ZXZvYzBwdVJka1pSb0hENUUyNXlhS0g3SW1G?=

=?utf-8?B?aW5tVHFIL1NRbnh2SGJIMC9PeDZWVk9mcU42Vk5ZVDY2YWNRVTEwSUpZZ2ZD?=

=?utf-8?B?dGF2SjhLN01vZzRzbVR4MGI0S2RDYWZiQTNMb3AwbllEeW9CMWU5aVFtTmND?=

=?utf-8?B?dGZMUWI4NXN2NDJlQmh4VUZHQzM0d3Rod05VdnJadGs5MWlaYjVaM2VocEFt?=

=?utf-8?B?UEVjUUdLSTBNMnhoQVczemgyTDY4Zy9FU0VBU003bXk3dmtKZld2K0ZXaDNx?=

=?utf-8?B?Si9CSVk1RzgrYjRSRnN4V0hYU2FnaXkrVmh5cWlnOWY0Z0kvZTBCZWcxbkhx?=

=?utf-8?B?WWUzWXduallIbFhmMVpIUGpkdlREcHJsRWhjZklsNE5oYjRvZ3RjT0c4T1c2?=

=?utf-8?B?bW9zQUVSWCtneVBrbWFxU0hvV3N5VXY3TnQyZXRkc3BrUmx4VFJLTDBjNURw?=

=?utf-8?B?Q25XN08zSk0ra1c0cXRyK0FEeFJ6bU5ld3d4ZFpEYVJDQzFVOTZtSlJ3Skx5?=

=?utf-8?B?bE85RVovMXNuZTJnWCtxSXkraWVVSDhsNTVmdmthNVVYUFRNQzJ0QkFPYVg4?=

=?utf-8?Q?0AqZiRHWWZTkAbbAkY=3D?=

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-Network-Message-Id: 5699c667-3c73-4c70-acc3-08daa7d495dd

X-MS-Exchange-CrossTenant-AuthSource: SEZPR01MB5223.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Oct 2022 19:54:32.1210

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:

00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2PR01MB4097

X-Spam_score: 5.7

X-Spam_score_int: 57

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Do you live in Canada and want to meet a Ukrainian woman near

you? A brand new site has just been launched where you can meet and date

Ukrainian women who have moved to all these countries because of [...]



Content analysis details: (5.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: httpslink.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[jeziahsloter1995[at]outlook.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.107.82 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[jeziahsloter1995[at]outlook.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[jeziahsloter1995[at]outlook.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.6 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image

area

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.3 PLING_QUERY Subject has exclamation mark and question mark

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} UA women are in Canada, do you want to date single Ukrainina girls in CA!?



------=_NextPart_000_D65A_F67DF359.9A70B5B7

Content-Type: text/plain;

charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Do you live in Canada and want to meet a Ukrainian woman near you? A brand =

new site has just been launched where you can meet and date Ukrainian women=

who have moved to all these countries because of the current situation the=

re!





A large number of users are in the CA!







Our site has over 250,000 users, most of which are women, we are only looki=

ng for male members!







If you received this message, you can join today for free!





UkraineGirl



We only accept men, our site has over 68% female members with the latest d=

ata from last month!







Every woman is real and proven!



Limited time offer and registration!



Single Ukrainian woman!



The site has over 80,000 members!



















deleted from the base



here











































































=



------=_NextPart_000_D65A_F67DF359.9A70B5B7

Content-Type: text/html;

charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




style=3D"font-weight:normal;" id=3D"docs-internal-guid-37a85d74-7fff-8769-=

fad9-7560039c6ff8">=0A=


margin-bottom:0pt;">=0A=


olor:transparent;font-weight:700;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Do you live=

in Canada and want to meet a Ukrainian woman near you? A brand new site ha=

s just been launched where you can meet and date Ukrainian women who have m=

oved to all these countries because of the current situation there!=

=0A=

=0A=


=0A=


margin-bottom:0pt;">=0A=


olor:transparent;font-weight:700;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">A large num=

ber of users are in the CA!=0A=

=0A=


=0A=


=0A=


margin-bottom:0pt;">=0A=


olor:transparent;font-weight:700;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Our site ha=

s over 250,000 users, most of which are women, we are only looking for male=

members!=0A=

=0A=


=0A=


=0A=


t;margin-bottom:0pt;">=0A=


olor:transparent;font-weight:700;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
=3D"border:none;display:inline-block;overflow:hidden;width:624px;height:260=

px;">
R-zxJ_z72JGINoZB5cVgYnlbTe5jOkQl_VL8uby9adAH8J-VGDaC3VOy7RgNHGTjTBlopgb75ny=

gKYXCKvmI17h7-VNQA8L1AaGAByOIu3Tc6txZ6iUbfnR71CoPGSA6dxbpyJfLBBW-XYMCDqkM3U=

Y3hIPoyRLhpg" style=3D"margin-left:0px;margin-top:0px;" width=3D"624" heigh=

t=3D"260">=0A=

=0A=


t;margin-bottom:0pt;">=0A=


olor:transparent;font-weight:700;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">If you rece=

ived this message, you can join today for free!=0A=

=0A=


=0A=


t;margin-bottom:0pt;">=0A=

<=

span style=3D"font-size:20pt;font-family:Arial;color:#1155cc;background-col=

or:transparent;font-weight:700;font-style:normal;font-variant:normal;text-d=

ecoration:underline;-webkit-text-decoration-skip:none;text-decoration-skip-=

ink:none;vertical-align:baseline;white-space:pre-wrap;">UkraineGirl<=

/a>=0A=

=0A=


t;margin-bottom:0pt;">=0A=


olor:transparent;font-weight:700;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">We only acc=

ept men, our site has over 68% female members with the latest data from las=

t month!=0A=

=0A=


=0A=


=0A=


t;margin-bottom:0pt;">=0A=


olor:transparent;font-weight:700;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Every woman=

is real and proven!=0A=

=0A=


t;margin-bottom:0pt;">=0A=


olor:transparent;font-weight:700;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Limited tim=

e offer and registration!=0A=

=0A=


t;margin-bottom:0pt;">=0A=


olor:transparent;font-weight:700;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Single Ukra=

inian woman!=0A=

=0A=


t;margin-bottom:0pt;">=0A=


olor:transparent;font-weight:700;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">The site ha=

s over 80,000 members!=0A=

=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


t;margin-bottom:0pt;">=0A=


olor:transparent;font-weight:700;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">deleted fro=

m the base=0A=

=0A=


t;margin-bottom:0pt;">=0A=


an style=3D"font-size:10pt;font-family:Arial;color:#1155cc;background-color=

:transparent;font-weight:700;font-style:normal;font-variant:normal;text-dec=

oration:underline;-webkit-text-decoration-skip:none;text-decoration-skip-in=

k:none;vertical-align:baseline;white-space:pre-wrap;">here=0A=

=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=0A=


=



------=_NextPart_000_D65A_F67DF359.9A70B5B7--

iphone spam from Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 06 Oct 2022 18:27:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ogbBw-000Ldc-IZ

for dave@doctor.nl2k.ab.ca;

Thu, 06 Oct 2022 18:26:16 -0600

Resent-From: The Doctor

Resent-Date: Thu, 6 Oct 2022 18:26:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-tyzapc01lp2042.outbound.protection.outlook.com ([104.47.110.42]:9618 helo=APC01-TYZ-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ogXCn-0002t5-97

for doctor@netknow.ca;

Thu, 06 Oct 2022 14:10:58 -0600

Authentication-Results: spf=fail (sender IP is 178.63.84.228)

smtp.mailfrom=tcampus.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=jjptcaiusebmqpmiruhscwa.com;

To: doctor@netknow.ca

MIME-Version: 1.0

Date: Thu, 06 Oct 2022 20:10:27 +0000

From: "Order Shipment"

Reply_To: "Welcome C"

Subject: Welcome to iPhone 14 Pro Reward Panel ID:50143

Content-Type: text/html; boundary="1901598-1-b595a9ac7cbe770ae255b23c76163168"

Feedback-ID: 325-anexp#nret-fa:account-notifier

Message-ID: <01075730853010526383039d9ee-c69a3509-5c85-481d-822e-ba65c204e1ba-000000@eu-central-1.amazonses.com>

X-SES-Outgoing: 2022.04.16-69.169.228.231

X-EOPAttributedMessage: 1

X-MS-Office365-Filtering-Correlation-Id: 73b98b1e-716a-4a4e-7d37-08daa7d6d03c

X-MS-TrafficTypeDiagnostic:

CWLP265MB2098:EE_|TYZAPC01FT043:EE_|PSAPR04MB4295:EE_

X-MS-Exchange-SenderADCheck: 0

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam-Untrusted: BCL:0;

X-Microsoft-Antispam-Message-Info-Original:

0uYyfVmzNAynRa88u4radSDV/KjtJo+WsRzHykqIJr4ALDh27GoCuDsulRpOYUYJ1jnfwxQgm/py29ma13m19sSPH1HtWlnd4wgL1tOFiUn1ImVY7Es4DSaVrGvNNgAZexdG1PYYjeEFuUDEvToKqtTyOh38olriM/CQqfoujz5j3LQyi+A3KHJQ+LPdQECIDfATpzGspZ1khXK0J1slb0IFhm+/eZ/CZTiEpPglnR9Uz2nqf0gCYzSpFYW80xT48vJpbtHEF5+jSydJyo7a20+4yz15lZ1vL5WnSFneqFGU7z3ybTgF/BKlmCrw/KrTxB+uXPrMnHWU3xJKRt3wkNO5E46zpX7anOTvoqR/+AFIX9oy7Ep53HQqqQv4VQYHxK1zL24Qpxen3KHOsTrM/nipD+iVLnt1i9bA7D6XNHW9OyV3GyY+JjqEaU3eGkJ1tV7N3PkV4RgaMYKVLJvLpFwJNHf3xl1Y4HGAHLkfcYNh+FHpXzDq5hi0W+dYlX0Vf3NxBUbWFRWO0XhcA1JFmOUWHV0Atxr+BZDW93vBwl1RNxY7deP/7NcxrN33ND9rBENalowwL5q2a7AMXRfsWNpsvVea/Oks09GujhysgoTDykF+jTyzFVLtisXfrFqWw7bz3EiNjPHHZK4o7eEwO8FGvI/7VlkL7eM+BM09GKU/Cqe0upFrI/Xe3vsrrj8bWivJRASOfZlhU9VOs1rdzQ2zVMs+pZ/kS+dv4ZD3QJseVTZ+LtkngL3vdBI6O+6vG2znolWeKB3yPX37APVYmYiOfyh5UMqSSaZ+kRVIoWZDr3O8xLc/foqSLBF/cFwA

X-Forefront-Antispam-Report-Untrusted:

CIP:103.143.76.15;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:confront.whitefov.live;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230016)(376002)(346002)(34096005)(396003)(136003)(39830400003)(46966006)(8676002)(5660300002)(40480700001)(7116003)(2876002)(6916009)(42186006)(316002)(70206006)(30864003)(2906002)(82310400005)(8936002)(70586007)(9686003)(498600001)(33964004)(26005)(71280400001)(41300700001)(3480700007)(66574015)(47076005)(35950700001)(83380400001)(336012)(42882007)(78352004)(18074004)(40580700002)(81166007)(166002)(21314003);DIR:OUT;SFP:1102;

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP265MB2098

X-MS-Exchange-Transport-CrossTenantHeadersStripped:

TYZAPC01FT043.eop-APC01.prod.protection.outlook.com

X-MS-PublicTrafficType: Email

X-MS-Office365-Filtering-Correlation-Id-Prvs:

d9bdec59-9b57-496b-c94b-08da884d2b6a

X-OriginatorOrg: tcampus.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Oct 2022 20:10:27.9812

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 73b98b1e-716a-4a4e-7d37-08daa7d6d03c

X-MS-Exchange-CrossTenant-Id: 11b5ddaf-7ed5-4f28-9184-775ab7e1d551

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=11b5ddaf-7ed5-4f28-9184-775ab7e1d551;Ip=[178.63.84.228];Helo=[tcampus.onmicrosoft.com]

X-MS-Exchange-CrossTenant-AuthSource:

TYZAPC01FT043.eop-APC01.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PSAPR04MB4295

X-Spam_score: 6.9

X-Spam_score_int: 69

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: iPhone 14 Pro - Your order has shipped!



Content analysis details: (6.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: googleapis.com]

1.0 HK_RANDOM_FROM From username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel

letters

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[104.47.110.42 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[tnbvikr[at]tcampus.onmicrosoft.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of

words

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and

EnvelopeFrom freemail headers are

different

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

1.7 SCC_BODY_URI_ONLY No description available.

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Welcome to iPhone 14 Pro Reward Panel ID:50143





iPhone 14 Pro - Your order has shipped!