Machining parts spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 09 Oct 2022 14:11:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ohc8N-000HnN-J4

for dave@doctor.nl2k.ab.ca;

Sun, 09 Oct 2022 13:38:47 -0600

Resent-From: The Doctor

Resent-Date: Sun, 9 Oct 2022 13:38:47 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f194.google.com ([209.85.210.194]:36425)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ohWSo-000EYg-9Q

for root@doctor.nl2k.ab.ca;

Sun, 09 Oct 2022 07:35:35 -0600

Received: by mail-pf1-f194.google.com with SMTP id y1so1587756pfr.3

for ; Sun, 09 Oct 2022 06:34:41 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=goodbomold.com; s=google;

h=mime-version:returnreceipt:disposition-notification-to:reply-to

:date:subject:to:from:message-id:from:to:cc:subject:date:message-id

:reply-to;

bh=NDKeiIo5dvFmzfJn+qRuTsQk6AcF4wjhQhXlDGnXmLk=;

b=Nn7Sx+wTLK38WUbejUQJzfo3tK573absRn6jbIOhCkNjmZix3JhQCzjk12DGpThZCj

alI7+HG0htS5cDeOWiX4x5cKq+XmFqMRmyGttTzxXtfh+Ei5tHxn4q0EmBi2Mv7X6Yuo

G1I/8GhRmkD5O7yOUo0IOYRxcAGC0moTM3gbU=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=mime-version:returnreceipt:disposition-notification-to:reply-to

:date:subject:to:from:message-id:x-gm-message-state:from:to:cc

:subject:date:message-id:reply-to;

bh=NDKeiIo5dvFmzfJn+qRuTsQk6AcF4wjhQhXlDGnXmLk=;

b=a0hkqHZ9YvT4GZyxGvzj7nQo4zyCCdC+lxEF9ewKH7pdw+fd98ah7t9DHp+o8krBgZ

R1l6fBG5mdC4HlM7Ib4xkABYm+hl0mXGBBVjfmcqS+3ZWDNq7nYkw+dpR+SKGRFajnIQ

xLemdqNyEB7EpTTe2sehMyjFfuHaiHD3XQTTYLVIzqS6Pi1tyo/o3zN5tsqKPTUrFRQN

ZOYxkzkgEAHrJlFXU2TAWlsRlPMdFsgL5y+0qqS5LFUTrqqWuuTvdXXX404cPnRG5yof

Jk7Q630tvpTHSCZtsymtswHUakioVDynzZVAiDGc8LrZoYM2caFjKaQfU2fAmJ4ffBYP

vY7g==

X-Gm-Message-State: ACrzQf2y8ksPe/LtbpFe7aMzdTdR+76fplMFQnM8FbbjInaCKQqB0JWV

mZUwo0I3Hpr4MSBDyK3e+ya+6sqntyUOSGjq

X-Google-Smtp-Source: AMsMyM5ItHgPZ7L0NtsxLU/7zWvb75vLpRPbjDpc/6qLeWYxFiQfMgplPBqUcUWmLR267EyG/1KtFQ==

X-Received: by 2002:a65:68cb:0:b0:460:b552:fbf4 with SMTP id k11-20020a6568cb000000b00460b552fbf4mr5065013pgt.457.1665322475335;

Sun, 09 Oct 2022 06:34:35 -0700 (PDT)

Received: from ocnq (awork116105.netvigator.com. [203.198.99.105])

by smtp.gmail.com with ESMTPSA id n15-20020a170902e54f00b001785fa792f4sm4789520plf.243.2022.10.09.06.34.33

for

(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);

Sun, 09 Oct 2022 06:34:34 -0700 (PDT)

Message-ID: <6342cdea.170a0220.582ab.82b4@mx.google.com>

X-Google-Original-Message-ID: EC8C3F68B58B46E2829919280BB8B1DE@ocnq

From: "emma@blueskyalloy.com"

To:

Subject: First Choise for Precision Machining Parts

Date: Sun, 09 Oct 2022 21:34:32 +0800

Reply-To: emma@blueskyalloy.com

Disposition-Notification-To: emma@blueskyalloy.com

ReturnReceipt: 1

X-Priority: 3

X-MSMail-Priority: Normal

MIME-Version: 1.0

Content-type: multipart/alternative; boundary=2c29de559d4e55fd535564a7a6206411

X-Mailer: Microsoft Outlook Express 6.00.3790.4657

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4913

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:

Dear Manager,

Nice to meet you.

Please allow

me to introduce our factory------Shenzhen Blue Sky Precision Technology

Co.,Ltd  shortly.

Why can we become your first [...]



Content analysis details: (7.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 HK_RANDOM_FROM From username looks random

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.194 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 BASE64_LENGTH_79_INF BODY: base64 encoded email part uses line

length greater than 79 characters

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.7 PDS_FROM_2_EMAILS From header has multiple different addresses

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

Subject: {SPAM?} First Choise for Precision Machining Parts



This is a multi-part message in MIME format.



--2c29de559d4e55fd535564a7a6206411

Content-type: text/plain;

charset=gb2312

content-transfer-encoding:base64



PFA+RGVhciBNYW5hZ2VyLDwvUD4NCjxQPk5pY2UgdG8gbWVldCB5b3UuIDwvUD4NCjxQPlBsZWFzZSBhbGxvdyBtZSB0byBpbnRyb2R1Y2Ugb3VyIGZhY3RvcnktLS0tLS08VT5TaGVuemhlbiBCbHVlIFNreSBQcmVjaXNpb24gVGVjaG5vbG9neSBDby4sTHRkJm5ic3A7IDwvVT5zaG9ydGx5LjwvUD4NCjxQPldoeSBjYW4gd2UgYmVjb21lIHlvdXIgZmlyc3QgY2hvaXNlIGZvciBwcmVjaXNpb24gbWFjaGluaW5nIHBhcnRzPzwvUD4NCjxQPjEpIDxTVFJPTkc+UHJvZmVzc2lvbmFsIFByb2Nlc3NpbmcuIDwvU1RST05HPjxCUj5TcGVjaWFsaXppbmcgaW4gcHJlY2lzaW9uIG1lY2hhbmljYWwgcGFydHMgcHJvY2Vzc2luZywgbm9uLXN0YW5kYXJkIHBhcnRzIHByb2Nlc3NpbmcsIHRpdGFuaXVtIGFsbG95IDxCUj5wcm9jZXNzaW5nLCB2YXJpb3VzIGNhc3RpbmcgcHJvY2Vzc2luZywgc2hlZXQgbWV0YWwgcHJvY2Vzc2luZy48L1A+DQo8UD4yKSA8U1RST05HPk9uZS1zdG9wIGZhY3RvcnkuIDwvU1RST05HPjxCUj5Qcm9mZXNzaW9uYWwgc3VyZmFjZSB0cmVhdG1lbnQgc3VwcGxpZXIsIGluY2x1ZGluZyBlbGVjdHJvcGxhdGluZywgb3hpZGF0aW9uLCBvaWwgc3ByYXlpbmcsIHBvd2RlciBzcHJheWluZzwvUD4NCjxQPjMpIDxTVFJPTkc+SGlnaC1RdWFsaXR5IFNldmljZS4gPC9TVFJPTkc+PEJSPkdldHRpbmcgR0IvVDE5MDAxLTIwMTYgaWR0IElTTzkwMDE6MjAxNSwgR0IvVDI0MDAxLTIwMTYgaWR0IElTTzE0MDAxOjIwMTUgY2VydGlmaWNhdGlvbi48L1A+DQo8UD40KSA8U1RST05HPkNvbXBldGl0aXZlIFByaWNlLjwvU1RST05HPjxCUj5FdmFsdWF0aW5nIHRoZSBxdW90YXRpb24gYnkgb3VyIHJpY2ggZXhwZXJpZW5jZSBlbmdpbmVlcmluZyB0ZWFtLjwvUD4NCjxQPjUpIDxTVFJPTkc+UHJlY2lzaW9uIEVxdWlwcG1lbnRzLjwvU1RST05HPjxCUj5DTkMgbWFjaGluaW5nIGNlbnRlciwgQ05DIGxhdGhlLCB3aXJlIGN1dHRpbmcsIGhpZ2gtcHJlY2lzaW9uIGludGVybmFsICZhbXA7IGV4dGVybmFsIGdyaW5kaW5nLjwvUD4NCjxQPklmIHlvdSBoYXZlIGFueSBwcm9qZWN0IG9uIGhhbmQsIHBsZWFzZSBkb24ndCBoZXNpdGF0ZSB0byBjb250YWN0IHVzLiBXZSB3aWxsIHByb3ZpZGUgeW91IHRoZSBtb3N0IGZhdm9yYWJsZTxCUj5wcmljZSBhbmQgdGhlIGJlc3Qgc2VydmljZS48L1A+DQo8UD5Mb29raW5nIGZvcndhcmQgdG8geW91ciBzb29uIHJlcGx5LjwvUD4NCjxQPlNpbmNlcmVseSB5b3Vycyw8QlI+RW1tYTwvUD4NCjxQPjxCUj5TaGVuemhlbiBCbHVlIFNreSBQcmVjaXNpb24gVGVjaG5vbG9neSBDby4sTHRkPEJSPkhvdWdhbmcgWGluZ3hpYW4gSW5kdXN0cmlhbCBab25lLCBTaGlzaGFuIHRvd24sIDxCUj5OYW5oYWkgZGlzdHJpY3QsIEZvc2hhbiBjaXR5LCBHdWFuZ2RvbmcgcHJvdmluY2UuPC9QPg0KPFA+VGVsOiArODYtMDc1Ny04MTc5MjE2OTxCUj5GYXg6ICs4Ni0wNzU3LTg1NTA1OTQ4PEJSPkVtYWlsOiA8QSBocmVmPSJtYWlsdG86ZW1tYUBibHVlc2t5YWxsb3kuY29tIj5lbW1hQGJsdWVza3lhbGxveS5jb208L0E+PEJSPldlYjogPEEgaHJlZj0iaHR0cDovL3d3dy5ibHVlc2t5YWxsb3kuY29tIj53d3cuYmx1ZXNreWFsbG95LmNvbTwvQT4mbmJzcDsgPC9QPg0KPFA+Jm5ic3A7PC9QPg0KDQoNCjxici8+PGJyLz48YnIvPiA8YSBocmVmPSdVbnN1YnNjcmliZS5hc3A/bWFpbD1yb290QGRvY3Rvci5ubDJrLmFiLmNhJyB0YXJnZXQ9X2JsYW5rPlVuc3Vic2NyaWJlLmFzcD9tYWlsPXJvb3RAZG9jdG9yLm5sMmsuYWIuY2E8L2E+

--2c29de559d4e55fd535564a7a6206411

Content-type: text/html;

charset=gb2312

content-transfer-encoding:base64



PFA+RGVhciBNYW5hZ2VyLDwvUD4NCjxQPk5pY2UgdG8gbWVldCB5b3UuIDwvUD4NCjxQPlBsZWFzZSBhbGxvdyBtZSB0byBpbnRyb2R1Y2Ugb3VyIGZhY3RvcnktLS0tLS08VT5TaGVuemhlbiBCbHVlIFNreSBQcmVjaXNpb24gVGVjaG5vbG9neSBDby4sTHRkJm5ic3A7IDwvVT5zaG9ydGx5LjwvUD4NCjxQPldoeSBjYW4gd2UgYmVjb21lIHlvdXIgZmlyc3QgY2hvaXNlIGZvciBwcmVjaXNpb24gbWFjaGluaW5nIHBhcnRzPzwvUD4NCjxQPjEpIDxTVFJPTkc+UHJvZmVzc2lvbmFsIFByb2Nlc3NpbmcuIDwvU1RST05HPjxCUj5TcGVjaWFsaXppbmcgaW4gcHJlY2lzaW9uIG1lY2hhbmljYWwgcGFydHMgcHJvY2Vzc2luZywgbm9uLXN0YW5kYXJkIHBhcnRzIHByb2Nlc3NpbmcsIHRpdGFuaXVtIGFsbG95IDxCUj5wcm9jZXNzaW5nLCB2YXJpb3VzIGNhc3RpbmcgcHJvY2Vzc2luZywgc2hlZXQgbWV0YWwgcHJvY2Vzc2luZy48L1A+DQo8UD4yKSA8U1RST05HPk9uZS1zdG9wIGZhY3RvcnkuIDwvU1RST05HPjxCUj5Qcm9mZXNzaW9uYWwgc3VyZmFjZSB0cmVhdG1lbnQgc3VwcGxpZXIsIGluY2x1ZGluZyBlbGVjdHJvcGxhdGluZywgb3hpZGF0aW9uLCBvaWwgc3ByYXlpbmcsIHBvd2RlciBzcHJheWluZzwvUD4NCjxQPjMpIDxTVFJPTkc+SGlnaC1RdWFsaXR5IFNldmljZS4gPC9TVFJPTkc+PEJSPkdldHRpbmcgR0IvVDE5MDAxLTIwMTYgaWR0IElTTzkwMDE6MjAxNSwgR0IvVDI0MDAxLTIwMTYgaWR0IElTTzE0MDAxOjIwMTUgY2VydGlmaWNhdGlvbi48L1A+DQo8UD40KSA8U1RST05HPkNvbXBldGl0aXZlIFByaWNlLjwvU1RST05HPjxCUj5FdmFsdWF0aW5nIHRoZSBxdW90YXRpb24gYnkgb3VyIHJpY2ggZXhwZXJpZW5jZSBlbmdpbmVlcmluZyB0ZWFtLjwvUD4NCjxQPjUpIDxTVFJPTkc+UHJlY2lzaW9uIEVxdWlwcG1lbnRzLjwvU1RST05HPjxCUj5DTkMgbWFjaGluaW5nIGNlbnRlciwgQ05DIGxhdGhlLCB3aXJlIGN1dHRpbmcsIGhpZ2gtcHJlY2lzaW9uIGludGVybmFsICZhbXA7IGV4dGVybmFsIGdyaW5kaW5nLjwvUD4NCjxQPklmIHlvdSBoYXZlIGFueSBwcm9qZWN0IG9uIGhhbmQsIHBsZWFzZSBkb24ndCBoZXNpdGF0ZSB0byBjb250YWN0IHVzLiBXZSB3aWxsIHByb3ZpZGUgeW91IHRoZSBtb3N0IGZhdm9yYWJsZTxCUj5wcmljZSBhbmQgdGhlIGJlc3Qgc2VydmljZS48L1A+DQo8UD5Mb29raW5nIGZvcndhcmQgdG8geW91ciBzb29uIHJlcGx5LjwvUD4NCjxQPlNpbmNlcmVseSB5b3Vycyw8QlI+RW1tYTwvUD4NCjxQPjxCUj5TaGVuemhlbiBCbHVlIFNreSBQcmVjaXNpb24gVGVjaG5vbG9neSBDby4sTHRkPEJSPkhvdWdhbmcgWGluZ3hpYW4gSW5kdXN0cmlhbCBab25lLCBTaGlzaGFuIHRvd24sIDxCUj5OYW5oYWkgZGlzdHJpY3QsIEZvc2hhbiBjaXR5LCBHdWFuZ2RvbmcgcHJvdmluY2UuPC9QPg0KPFA+VGVsOiArODYtMDc1Ny04MTc5MjE2OTxCUj5GYXg6ICs4Ni0wNzU3LTg1NTA1OTQ4PEJSPkVtYWlsOiA8QSBocmVmPSJtYWlsdG86ZW1tYUBibHVlc2t5YWxsb3kuY29tIj5lbW1hQGJsdWVza3lhbGxveS5jb208L0E+PEJSPldlYjogPEEgaHJlZj0iaHR0cDovL3d3dy5ibHVlc2t5YWxsb3kuY29tIj53d3cuYmx1ZXNreWFsbG95LmNvbTwvQT4mbmJzcDsgPC9QPg0KPFA+Jm5ic3A7PC9QPg0KDQoNCjxici8+PGJyLz48YnIvPiA8YSBocmVmPSdVbnN1YnNjcmliZS5hc3A/bWFpbD1yb290QGRvY3Rvci5ubDJrLmFiLmNhJyB0YXJnZXQ9X2JsYW5rPlVuc3Vic2NyaWJlLmFzcD9tYWlsPXJvb3RAZG9jdG9yLm5sMmsuYWIuY2E8L2E+

--2c29de559d4e55fd535564a7a6206411--



Reward spam from Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 09 Oct 2022 14:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ohc7m-000HlT-2P

for dave@doctor.nl2k.ab.ca;

Sun, 09 Oct 2022 13:38:10 -0600

Resent-From: The Doctor

Resent-Date: Sun, 9 Oct 2022 13:38:10 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-sgaapc01hn2241.outbound.protection.outlook.com ([52.100.164.241]:36619 helo=APC01-SG2-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ohVJj-000Pzg-FF

for doctor@netknow.ca;

Sun, 09 Oct 2022 06:22:09 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=WrmhSv9NVDPv8g+wyhp0fhGAbhxtP0f2VaFLJ2lRDSiWgJ+FLvYv7OJ1+b6MvkWLtRCuYDStYnAXWUkpkXO0pTh0RacYPAL5kiWeAi2yOo4E4pRSkj5Ka8BePnY6TWLkTPQaCgnNnxPV5Cjdrr5A1wVeXZ60mavjEPB6brTiiKknLbqV0wqrK8fjJolqtGoEYNzkysH0PNm7l/fOYQzi0JgYUzS9+OX4QEI52xhtlRfdiwzsbkeRjlaBaeEA431cSEowIW5AEQDVoLf/if4NzUfAbCgi9UXxKnUoQI+ylY8Miw9nX1jgZddLFqS5RX1M/LVrWUeJ8Go969aV70DsUg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=AVRzxnp1Lr5V4ZVZiUoB8lszQv9GLWaX6FuYe4r4Org=;

b=SG4O8QEf0xPKog3JKpUg4zC4X86MUTOh0FIuo0tRIXbt6ts0J1cwZVpKCm0r0fXXshmxF3xn1kiZ7TCPZv6TzI9LzHMCR53L0RpV7VCSE7j2G2jisuKv0U+CN4c3z74a/tjQjzoyWxR54ito4KFt+tZ8S/WnOL83+2+W5Uhl2uGItBNOOiqGWzlHqWdPb6HeP6t+1gDeqpY2eynlNCCpHlMIfHwNHZn2CAOvCGYvfBIi0GfIvfW45hdnXgy2LXio86YQ4tVV7btlWZ1B8lZlB8NzekP3OXn7lO//gYhuaF55m8AIhLGZncK44rpxfMkWi4DT7lu/2zMOP9BoupMhqw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

135.181.210.111) smtp.rcpttodomain=netknow.ca

smtp.mailfrom=mustedumn.onmicrosoft.com; dmarc=none action=none

header.from=pvxjwuuhbjytrwlhbbcetls.com; dkim=none (message not signed);

arc=none

Received: from SG2PR06CA0207.apcprd06.prod.outlook.com (2603:1096:4:68::15) by

TYZPR06MB6213.apcprd06.prod.outlook.com (2603:1096:400:33f::14) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5676.31; Sun, 9 Oct

2022 12:20:35 +0000

Received: from SG2APC01FT0064.eop-APC01.prod.protection.outlook.com

(2603:1096:4:68:cafe::4a) by SG2PR06CA0207.outlook.office365.com

(2603:1096:4:68::15) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5676.17 via Frontend

Transport; Sun, 9 Oct 2022 12:20:35 +0000

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 135.181.210.111)

smtp.mailfrom=mustedumn.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=pvxjwuuhbjytrwlhbbcetls.com;

Received-SPF: Fail (protection.outlook.com: domain of

mustedumn.onmicrosoft.com does not designate 135.181.210.111 as permitted

sender) receiver=protection.outlook.com; client-ip=135.181.210.111;

helo=mustedumn.onmicrosoft.com;

Received: from mustedumn.onmicrosoft.com (135.181.210.111) by

SG2APC01FT0064.mail.protection.outlook.com (10.13.36.172) with Microsoft SMTP

Server id 15.20.5709.10 via Frontend Transport; Sun, 9 Oct 2022 12:20:34

+0000

To: doctor@netknow.ca

MIME-Version: 1.0

Date: Sun, 09 Oct 2022 07:40:09 +0000

From: "𝐓𝐡𝐚𝐧𝐤 𝐲𝐨𝐮! 𝐒𝐡𝐞𝐥𝐥"

Reply_To: "Welcome C"

Subject: $𝟷𝟶𝟶 𝑆ℎ𝑒𝑙𝑙 𝑅𝑒𝑤𝑎𝑟𝑑. 𝑃𝑎𝑟𝑡𝑖𝑐𝑖𝑝𝑎𝑡𝑖𝑜𝑛 𝑅𝑒𝑞𝑢𝑖𝑟𝑒𝑑#417

Content-Type: text/html; boundary="1901598-1-b595a9ac7cbe770ae255b23c76163168"

Feedback-ID: 325-anexp#nret-fa:account-notifier

Message-ID: <01073371717827176383039d9ee-c69a3509-5c85-481d-822e-ba65c204e1ba-000000@eu-central-1.amazonses.com>

X-SES-Outgoing: 2022.04.16-69.169.228.231

X-EOPAttributedMessage: 1

X-MS-Office365-Filtering-Correlation-Id: 1325517e-f8f9-4a84-e097-08daa9f0aa9f

X-MS-TrafficTypeDiagnostic:

CWLP265MB2098:EE_|SG2APC01FT0064:EE_|TYZPR06MB6213:EE_

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam-Untrusted: BCL:0;

X-Microsoft-Antispam-Message-Info-Original:

0uYyfVmzNAynRa88u4radSDV/KjtJo+WsRzHykqIJr4ALDh27GoCuDsulRpOYUYJ1jnfwxQgm/py29ma13m19sSPH1HtWlnd4wgL1tOFiUn1ImVY7Es4DSaVrGvNNgAZexdG1PYYjeEFuUDEvToKqtTyOh38olriM/CQqfoujz5j3LQyi+A3KHJQ+LPdQECIDfATpzGspZ1khXK0J1slb0IFhm+/eZ/CZTiEpPglnR9Uz2nqf0gCYzSpFYW80xT48vJpbtHEF5+jSydJyo7a20+4yz15lZ1vL5WnSFneqFGU7z3ybTgF/BKlmCrw/KrTxB+uXPrMnHWU3xJKRt3wkNO5E46zpX7anOTvoqR/+AFIX9oy7Ep53HQqqQv4VQYHxK1zL24Qpxen3KHOsTrM/nipD+iVLnt1i9bA7D6XNHW9OyV3GyY+JjqEaU3eGkJ1tV7N3PkV4RgaMYKVLJvLpFwJNHf3xl1Y4HGAHLkfcYNh+FHpXzDq5hi0W+dYlX0Vf3NxBUbWFRWO0XhcA1JFmOUWHV0Atxr+BZDW93vBwl1RNxY7deP/7NcxrN33ND9rBENalowwL5q2a7AMXRfsWNpsvVea/Oks09GujhysgoTDykF+jTyzFVLtisXfrFqWw7bz3EiNjPHHZK4o7eEwO8FGvI/7VlkL7eM+BM09GKU/Cqe0upFrI/Xe3vsrrj8bWivJRASOfZlhU9VOs1rdzQ2zVMs+pZ/kS+dv4ZD3QJseVTZ+LtkngL3vdBI6O+6vG2znolWeKB3yPX37APVYmYiOfyh5UMqSSaZ+kRVIoWZDr3O8xLc/foqSLBF/cFwA

X-Forefront-Antispam-Report-Untrusted:

CIP:103.143.76.15;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:confront.whitefov.live;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230016)(376002)(346002)(34096005)(396003)(136003)(39830400003)(46966006)(8676002)(5660300002)(40480700001)(7116003)(2876002)(6916009)(42186006)(316002)(70206006)(30864003)(2906002)(82310400005)(8936002)(70586007)(9686003)(498600001)(33964004)(26005)(71280400001)(41300700001)(3480700007)(66574015)(47076005)(35950700001)(83380400001)(336012)(42882007)(78352004)(18074004)(40580700002)(81166007)(166002)(21314003);DIR:OUT;SFP:1102;

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP265MB2098

X-MS-Exchange-Transport-CrossTenantHeadersStripped:

SG2APC01FT0064.eop-APC01.prod.protection.outlook.com

X-MS-PublicTrafficType: Email

X-MS-Office365-Filtering-Correlation-Id-Prvs:

d9bdec59-9b57-496b-c94b-08da884d2b6a

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?us-ascii?Q?mUur52pSVIidU9stwYymXUiupkiXzCGIu0Silp1WipJSGx8kB+ZYSkGVAe+F?=

=?us-ascii?Q?jcLRaQpfWc7sZuUeDq33W7SeYRoFgGCkfoCE5brDsePm+24fLOxTavVw8UgH?=

=?us-ascii?Q?ngNfuJzywxMYg2v+O8Ej59Sckj9+YkkVZdeg3zjRfv7caP6vpcWdbQzskLsa?=

=?us-ascii?Q?PEBjTvpLlWWvlFFghjwYogmUGZL8lkWGfo1vwSKppOZVI0L26rmrzMgpsRRX?=

=?us-ascii?Q?ByjdM0GRzPnAB7V1x7fnO0tJhtq4wcpxCvEh35jF5z4u2bYa18eBX6fn9YZ3?=

=?us-ascii?Q?iVa2qkYJF/q/IPAOZJAAWLG6yeMQSSSeirJlf93Ely4Q/p3qJF+uPsvnmJ91?=

=?us-ascii?Q?W2Z85H4n1rHQ7wt2tqGy9hylYrslsw09Wxgx50ZV2dlvF8Vcl/ysg+fC0lNF?=

=?us-ascii?Q?9eKc7H2VRhmEDfdILihZUpwK8KivTq+gTWS3TQ7RIcTq/4Bb+E+t2mr1ztPz?=

=?us-ascii?Q?7+cWRDPAkfLEqpG1d1GQkb1oSgIXQBFgfpM35smwdPh5q0NyC+Jw6vgNoixi?=

=?us-ascii?Q?TkszwsjFFurrMs1BZnmOVw1IMHGFEy+aKuhqrGG/FlXiAdMKX6V3fHgNZzPw?=

=?us-ascii?Q?F9zvXpaNe2zRq9zFRtEIa81V2PFhIzTi8gxIJ3vqYvs6gSKxZuBLoyMHVDBL?=

=?us-ascii?Q?cLBeLiHrE+pTcPubue9JudJpnIPHHTO8+H/y9E5MT+sNjuMRgQIyHMVCQWJ6?=

=?us-ascii?Q?+9II6/kIqaUNYwwpfuh4P40LGR8+oholzRw1qlgEViOcMzCdT0c9+TqcsVHD?=

=?us-ascii?Q?BPXT5b6o5EsTnqBHRNRNyxAAyno87lJsdU4ZZKsY58Hf3G7ThRtNBFN2Nmtf?=

=?us-ascii?Q?TwqCsGVQLzjqjIo//P27gT4wLhWv4WRocSPj9vXvZh1mKZ6Bg0++BBSMS7vn?=

=?us-ascii?Q?omHOpcmPTCHc6NBqSkie9m2k2jBgSUwvzOKqlUC98scA58QVw0Z/YeNj1qRt?=

=?us-ascii?Q?OCFoJR31S6ue5oq9m2iPTUewrxKTx1jK7V/d1Orz0kWCZzCNFLiCkYtJIxUe?=

=?us-ascii?Q?sXgIfnRm0+onsur5D9vQyMZQlWUFDhuHS+Ag2Giqrz9tWDKBXsnsBrtGT3BE?=

=?us-ascii?Q?Yyc5+HZNw9UhMk6JaeIJtNx2TfYg69Set4mp7NRK/X7Rla/zF7eHi+BMQe6c?=

=?us-ascii?Q?UzBrVVW6sjNdT+jNnhTSU60aeMl7EKn7/rx1N5csckyPQsqq8hO7T3TV50+6?=

=?us-ascii?Q?cYezD2DM6eFKewYGv7WiIzebEL728tSKNwgnE4ri4JLUpbJCuBy65JUES1I?=

=?us-ascii?Q?=3D?=

X-Forefront-Antispam-Report:

CIP:135.181.210.111;CTRY:FI;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:mustedumn.onmicrosoft.com;PTR:static.111.210.181.135.clients.your-server.de;CAT:OSPM;SFS:(13230022)(39860400002)(346002)(396003)(376002)(136003)(451199015)(1690799008)(46966006)(36840700001)(40470700004)(4744005)(40460700003)(2906002)(82740400003)(356005)(41320700001)(8936002)(166002)(81166007)(36860700001)(6512007)(224303003)(26005)(9686003)(6666004)(70206006)(70586007)(3630700005)(36906005)(36736006)(82310400005)(118246002)(83380400001)(6486002)(6916009)(42882007)(786003)(5660300002)(316002)(478600001)(9316004)(66899015)(63766006)(41300700001)(956004)(47076005)(85182001)(336012)(83170400001)(71280400001)(2876002)(40480700001)(186003)(523964003)(56000400010);DIR:OUT;SFP:1501;

X-OriginatorOrg: mustedumn.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Oct 2022 12:20:34.2290

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 1325517e-f8f9-4a84-e097-08daa9f0aa9f

X-MS-Exchange-CrossTenant-Id: 7aef9087-c590-4578-8f84-622d561e3abb

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=7aef9087-c590-4578-8f84-622d561e3abb;Ip=[135.181.210.111];Helo=[mustedumn.onmicrosoft.com]

X-MS-Exchange-CrossTenant-AuthSource:

SG2APC01FT0064.eop-APC01.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYZPR06MB6213

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Gas Anonymous Survey! Congrats! You've been selected to participate

in our monthly $100 Gas Gift Card Promotion! Take this 30 second survey about

Gas and we'll offer you exclusive rewards over $100 Click here to get started





Content analysis details: (9.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.164.241 listed in wl.mailspike.net]

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[kzvooiy[at]mustedumn.onmicrosoft.com]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of

words

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.1 FROM_ILLEGAL_CHARS From: has too many raw illegal characters

1.1 SUBJ_ILLEGAL_CHARS Subject: has too many raw illegal characters

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.3 MIME_8BIT_HEADER Message header contains 8-bit character

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and

EnvelopeFrom freemail headers are

different

2.5 END_FUTURE_EMAILS Spammy unsubscribe

0.0 T_END_FUTURE_EMAILS Spammy unsubscribe

0.1 SUBJECT_NEEDS_ENCODING Subject is encoded but does not specify

the encoding

Subject: {SPAM?} $𝟷𝟶𝟶 𝑆ℎ𝑒𝑙𝑙 𝑅𝑒𝑤𝑎𝑟𝑑. 𝑃𝑎𝑟𝑡𝑖𝑐𝑖𝑝𝑎𝑡𝑖𝑜𝑛 𝑅𝑒𝑞𝑢𝑖𝑟𝑒𝑑#417









<br /><br /> Gas Anonymous Survey!<br /><br />






















Congrats! You've been selected to participate




in our monthly $100 Gas Gift Card Promotion!
























Take this 30 second survey about Gas and


we'll offer you exclusive rewards over $100

Click here to get started














If you'd prefer not to receive future emails, Unsubscribe Here.


337 Garden Oaks Blvd #67967, houston, tx 77018













liar detection spam from Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 09 Oct 2022 14:11:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ohc7c-000HkP-62

for dave@doctor.nl2k.ab.ca;

Sun, 09 Oct 2022 13:38:00 -0600

Resent-From: The Doctor

Resent-Date: Sun, 9 Oct 2022 13:38:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-psaapc01hn2205.outbound.protection.outlook.com ([52.100.0.205]:15169 helo=APC01-PSA-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ohWQ9-000EMF-HG

for doctor@netknow.ca;

Sun, 09 Oct 2022 07:32:51 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=lO/ygKx8vFpiTsXtD+WDzaIkzFxoRIqN7TkfrHolFbvzL4BIwiEZQ3h3KL5YGTP9+IZLTwEw9K+EnkVm2orLYzc0mFddTa8qL3y65RHzNQeecT5ftHcSeo3QVyqUOfh8PbJIncW+qJA0evSXI4RAOea7KdZBHTyEqv8VfD0u/iKcvkhF9tR9vG3hUESjZAkSVYXpyCWsM63gbNPkOGNMpojtW+o6kGvn46GWypGbHe4eahR/A/J8FFG+Cu4TAbXFGUmKSHFipGjE9atmiNVz0amW2b25XOOCizBuiqqtMdYfQT57jSugNGv2jBDxI6nzShMciuC95bq6XqAEVt9lvg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=gDuba+nlkAApk54vv/I1FA4DAlABLslrAR0+FmwZQa4=;

b=MRc83pX15yCtv6Qh9C7e2s6L3hbm7ftPkL7kSSyVywzKVdEJxiW+v6PVcX+ds04DLR9CNyMWSpjtGtfj41f5l4sr+jyqcPFRCbJJAfoNkcwZYXX+o+Jekgln6pcxiPoVIZLpM3OZQAScN43QGnQ8MfHt3Rwf+N3tK2K4jFTI7OXyEpz/gFGbofY/UDlYgcScVH2JyxTKM62yg+V4Y2BlKOpgYeBEgzMOpxUVcqclT5M9txe7lIuCWaYl7PWOkeAoUjew+30uGpk9krYGEA2rdyt/3A9fFgtinhTzSYpmq1gtNoj5EqAkTiQW/3BKBCYMMx8SDI3LTpWRIpiQRNIRGA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

135.181.210.111) smtp.rcpttodomain=netknow.ca

smtp.mailfrom=mustedumn.onmicrosoft.com; dmarc=none action=none

header.from=auymnekkbekfbitbmxqnqzu.com; dkim=none (message not signed);

arc=none

Received: from SL2PR01CA0016.apcprd01.prod.exchangelabs.com

(2603:1096:100:41::28) by KL1PR0601MB5839.apcprd06.prod.outlook.com

(2603:1096:820:9b::13) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5709.15; Sun, 9 Oct

2022 13:31:47 +0000

Received: from PSAAPC01FT028.eop-APC01.prod.protection.outlook.com

(2603:1096:100:41:cafe::3d) by SL2PR01CA0016.outlook.office365.com

(2603:1096:100:41::28) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5676.17 via Frontend

Transport; Sun, 9 Oct 2022 13:31:47 +0000

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 135.181.210.111)

smtp.mailfrom=mustedumn.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=auymnekkbekfbitbmxqnqzu.com;

Received-SPF: Fail (protection.outlook.com: domain of

mustedumn.onmicrosoft.com does not designate 135.181.210.111 as permitted

sender) receiver=protection.outlook.com; client-ip=135.181.210.111;

helo=mustedumn.onmicrosoft.com;

Received: from mustedumn.onmicrosoft.com (135.181.210.111) by

PSAAPC01FT028.mail.protection.outlook.com (10.13.38.119) with Microsoft SMTP

Server id 15.20.5709.10 via Frontend Transport; Sun, 9 Oct 2022 13:31:46

+0000

To: doctor@netknow.ca

MIME-Version: 1.0

Date: Sun, 09 Oct 2022 07:30:53 +0000

From: "Peoplewhiz"

Reply_To: "Welcome C"

Subject: This 13 Second Trick Catches Any Liar(Addicting)#065

Content-Type: text/html; boundary="1901598-1-b595a9ac7cbe770ae255b23c76163168"

Feedback-ID: 325-anexp#nret-fa:account-notifier

Message-ID: <01078203214674356383039d9ee-c69a3509-5c85-481d-822e-ba65c204e1ba-000000@eu-central-1.amazonses.com>

X-SES-Outgoing: 2022.04.16-69.169.228.231

X-EOPAttributedMessage: 1

X-MS-Office365-Filtering-Correlation-Id: 2197dbf3-62a2-4b86-b138-08daa9fa9d2f

X-MS-TrafficTypeDiagnostic:

CWLP265MB2098:EE_|PSAAPC01FT028:EE_|KL1PR0601MB5839:EE_

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam-Untrusted: BCL:0;

X-Microsoft-Antispam-Message-Info-Original:

0uYyfVmzNAynRa88u4radSDV/KjtJo+WsRzHykqIJr4ALDh27GoCuDsulRpOYUYJ1jnfwxQgm/py29ma13m19sSPH1HtWlnd4wgL1tOFiUn1ImVY7Es4DSaVrGvNNgAZexdG1PYYjeEFuUDEvToKqtTyOh38olriM/CQqfoujz5j3LQyi+A3KHJQ+LPdQECIDfATpzGspZ1khXK0J1slb0IFhm+/eZ/CZTiEpPglnR9Uz2nqf0gCYzSpFYW80xT48vJpbtHEF5+jSydJyo7a20+4yz15lZ1vL5WnSFneqFGU7z3ybTgF/BKlmCrw/KrTxB+uXPrMnHWU3xJKRt3wkNO5E46zpX7anOTvoqR/+AFIX9oy7Ep53HQqqQv4VQYHxK1zL24Qpxen3KHOsTrM/nipD+iVLnt1i9bA7D6XNHW9OyV3GyY+JjqEaU3eGkJ1tV7N3PkV4RgaMYKVLJvLpFwJNHf3xl1Y4HGAHLkfcYNh+FHpXzDq5hi0W+dYlX0Vf3NxBUbWFRWO0XhcA1JFmOUWHV0Atxr+BZDW93vBwl1RNxY7deP/7NcxrN33ND9rBENalowwL5q2a7AMXRfsWNpsvVea/Oks09GujhysgoTDykF+jTyzFVLtisXfrFqWw7bz3EiNjPHHZK4o7eEwO8FGvI/7VlkL7eM+BM09GKU/Cqe0upFrI/Xe3vsrrj8bWivJRASOfZlhU9VOs1rdzQ2zVMs+pZ/kS+dv4ZD3QJseVTZ+LtkngL3vdBI6O+6vG2znolWeKB3yPX37APVYmYiOfyh5UMqSSaZ+kRVIoWZDr3O8xLc/foqSLBF/cFwA

X-Forefront-Antispam-Report-Untrusted:

CIP:103.143.76.15;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:confront.whitefov.live;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230016)(376002)(346002)(34096005)(396003)(136003)(39830400003)(46966006)(8676002)(5660300002)(40480700001)(7116003)(2876002)(6916009)(42186006)(316002)(70206006)(30864003)(2906002)(82310400005)(8936002)(70586007)(9686003)(498600001)(33964004)(26005)(71280400001)(41300700001)(3480700007)(66574015)(47076005)(35950700001)(83380400001)(336012)(42882007)(78352004)(18074004)(40580700002)(81166007)(166002)(21314003);DIR:OUT;SFP:1102;

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP265MB2098

X-MS-Exchange-Transport-CrossTenantHeadersStripped:

PSAAPC01FT028.eop-APC01.prod.protection.outlook.com

X-MS-PublicTrafficType: Email

X-MS-Office365-Filtering-Correlation-Id-Prvs:

d9bdec59-9b57-496b-c94b-08da884d2b6a

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

tSQ18ZeU8kLxWSd3zgOYkO/FbzwudvVgvPbkbe0cQlmf+M1I3lBgE1q0ZJf7UpNA24oFxxb6BvFNmxyskJQXpE5YKC+4xNyXE0rIvwFp6wl0Zz5xpocmEPVrX5pBZkICunvz+GorIi3hLKuKTMMW1oSpqtJeKFEBhgCGNzGoR1+nVLS/rFAfAEh8IUDGUX1PxmApECo2n7kjPhXd8WwTnCI9RJU/vqBfJVZ38LAl7mrhJ+S+wzpRtOYRoHr7gb3ifstSZhMQj3wv3rEzm1GAaSiqeQQBEugjHzQ0uYvt0djQGNHTUG/tTckGG0SttS+w/IwG3Gd9NhkBU1vIZRLPyNfLP+acptDkU+qTdkTnXwWgVBCRtGjk1Uf/mmDLqZssuknvGK0PT/xLPT7IXndGoto0holY/gcwOys50N4h+eQVXRurJOOimcFyLHoY+em0UP8gUIB9uNCrjF1ZTabNnhVRMhAwE2AtZelvPAb6bAdb1obe71vI7NM8GID+jdRijOeVTCnFmh/Yc6MlxXymitFOiYeLPM1VqU45leN2V9tMKlYJGXr/PLnCO4BGlW5YLw/lT808nB55nEO/9WssQPBJfi8d1jgWx/317kyB4uE8GMDPaoLLnX4XQnGDhYykgbuRYkjGZSe0igTfhbgt1n9j0Lk311dgJxcnXs1liuTS4Mammwa0A1GjBhnNV9qcBQWfNJwAIda1SehHyxQkZfldRdjBZF3yJg6QsvOuKDTjPnr60hAZQpwL+/w+IolWSkPp5Wm+lA3UuCWj3TylITJaWaRHkB/tfRjL+Rs3IuY=

X-Forefront-Antispam-Report:

CIP:135.181.210.111;CTRY:FI;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mustedumn.onmicrosoft.com;PTR:static.111.210.181.135.clients.your-server.de;CAT:NONE;SFS:(13230022)(39860400002)(396003)(376002)(136003)(346002)(451199015)(36840700001)(46966006)(40470700004)(166002)(40460700003)(83170400001)(40480700001)(41320700001)(9316004)(6512007)(3630700005)(81166007)(82310400005)(70206006)(8676002)(5660300002)(9686003)(26005)(70586007)(63766006)(786003)(186003)(41300700001)(8936002)(956004)(71280400001)(6666004)(6486002)(336012)(316002)(42882007)(36906005)(478600001)(6916009)(36736006)(118246002)(36860700001)(83380400001)(2876002)(66574015)(47076005)(356005)(66899015)(4744005)(82740400003)(2906002)(15450700026);DIR:OUT;SFP:1501;

X-OriginatorOrg: mustedumn.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Oct 2022 13:31:46.5257

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 2197dbf3-62a2-4b86-b138-08daa9fa9d2f

X-MS-Exchange-CrossTenant-Id: 7aef9087-c590-4578-8f84-622d561e3abb

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=7aef9087-c590-4578-8f84-622d561e3abb;Ip=[135.181.210.111];Helo=[mustedumn.onmicrosoft.com]

X-MS-Exchange-CrossTenant-AuthSource:

PSAAPC01FT028.eop-APC01.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: KL1PR0601MB5839



Unsubscribe
Peoplewhiz Inc.,
4830 Wilson Rd Ste 300 #541,




medical spam from OUtlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 09 Oct 2022 14:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ohc7C-000HfY-KE

for dave@doctor.nl2k.ab.ca;

Sun, 09 Oct 2022 13:37:34 -0600

Resent-From: The Doctor

Resent-Date: Sun, 9 Oct 2022 13:37:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-tyzapc01hn2205.outbound.protection.outlook.com ([52.100.223.205]:61349 helo=APC01-TYZ-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ohbY6-000EDI-5K

for doctor@netknow.ca;

Sun, 09 Oct 2022 13:01:23 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=RMXU6bsiLrPIE2x8yobsSXeHGi0RDhi6yiXEUigMepjPokKH9ffwOSM8yvp2IOftQBysWQtDyjhs8dHDF0pSiHH0Jjp5oal9u7y3vBmAX/qacwx09wbdz9PdcNgbYNTMTYW/Ogkfg2FzN00KFbh0gVpiu9gKk8A6qigVzxODYJG2vCy4zuaDmucqj8ZXO2nhzj/O/kcfHV3BwmwT/YF1Ye+xskAwaKFbqCihiCkazqBqHIjTCPy8FYBMSY9Cxyp5F6/SDCsat0HXYpCNmha+rwP8NISqjhgJ4E2e96uv6DYEq+0Zhi8lEJtk2MfJr3CViJIvXs7zUloLVx1AaWpgSA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=YMgzfcTsmSibv/jwghaHBN5j/VtP+Pvdx2ksT6KbGnA=;

b=aeosDA09wxNXaGS+0bQCwKKON46GBah8zRR7bKc9zSbkxeHmgzEB9A+6oBfgC+4wNH5OKm0ErKRniONigM97+nqRTcBFktC3rFUumRFWeX4Xrn/4OtVnElrsDTI8GD9LuiCm7X7Km6m2GBNQiShZRQvL2djDngvxqpb8+/DaV+DqgQ0fC4GvoOFS+j4ISMoe1SQzyg7U481TnoGQ+F7cbYPCzxOgU2t6f2YPi0vsaywkk5l/6jTaYnpuf8Dk40A4IAtbP+6gid6BHX3O1hETHMsXKjrgJzvRVZbIHivQ7c7zRkXhu65IttsO+abb6NtADKkcBmdMzZOpbTb/xYUUJA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

135.181.210.111) smtp.rcpttodomain=netknow.ca

smtp.mailfrom=mustedumn.onmicrosoft.com; dmarc=none action=none

header.from=qyzzccuopchigsnuamxpkub.com; dkim=none (message not signed);

arc=none

Received: from TYWPR01CA0010.jpnprd01.prod.outlook.com (2603:1096:400:a9::15)

by TY0PR06MB5634.apcprd06.prod.outlook.com (2603:1096:400:278::13) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5709.15; Sun, 9 Oct

2022 19:00:21 +0000

Received: from TYZAPC01FT058.eop-APC01.prod.protection.outlook.com

(2603:1096:400:a9:cafe::e5) by TYWPR01CA0010.outlook.office365.com

(2603:1096:400:a9::15) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5709.15 via Frontend

Transport; Sun, 9 Oct 2022 19:00:21 +0000

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 135.181.210.111)

smtp.mailfrom=mustedumn.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=qyzzccuopchigsnuamxpkub.com;

Received-SPF: Fail (protection.outlook.com: domain of

mustedumn.onmicrosoft.com does not designate 135.181.210.111 as permitted

sender) receiver=protection.outlook.com; client-ip=135.181.210.111;

helo=mustedumn.onmicrosoft.com;

Received: from mustedumn.onmicrosoft.com (135.181.210.111) by

TYZAPC01FT058.mail.protection.outlook.com (10.118.152.155) with Microsoft

SMTP Server id 15.20.5709.10 via Frontend Transport; Sun, 9 Oct 2022 19:00:20

+0000

To: doctor@netknow.ca

MIME-Version: 1.0

Date: Sun, 09 Oct 2022 07:12:13 +0000

From: "Heal Back Pain"

Reply_To: "Welcome C"

Subject: -doctor 30-second stretch ERASES horrific back pain)#053

Content-Type: text/html; boundary="1901598-1-b595a9ac7cbe770ae255b23c76163168"

Feedback-ID: 325-anexp#nret-fa:account-notifier

Message-ID: <01071636722557216383039d9ee-c69a3509-5c85-481d-822e-ba65c204e1ba-000000@eu-central-1.amazonses.com>

X-SES-Outgoing: 2022.04.16-69.169.228.231

X-EOPAttributedMessage: 1

X-MS-Office365-Filtering-Correlation-Id: 869039e3-ab1b-432f-39d7-08daaa28835d

X-MS-TrafficTypeDiagnostic:

CWLP265MB2098:EE_|TYZAPC01FT058:EE_|TY0PR06MB5634:EE_

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam-Untrusted: BCL:0;

X-Microsoft-Antispam-Message-Info-Original:

0uYyfVmzNAynRa88u4radSDV/KjtJo+WsRzHykqIJr4ALDh27GoCuDsulRpOYUYJ1jnfwxQgm/py29ma13m19sSPH1HtWlnd4wgL1tOFiUn1ImVY7Es4DSaVrGvNNgAZexdG1PYYjeEFuUDEvToKqtTyOh38olriM/CQqfoujz5j3LQyi+A3KHJQ+LPdQECIDfATpzGspZ1khXK0J1slb0IFhm+/eZ/CZTiEpPglnR9Uz2nqf0gCYzSpFYW80xT48vJpbtHEF5+jSydJyo7a20+4yz15lZ1vL5WnSFneqFGU7z3ybTgF/BKlmCrw/KrTxB+uXPrMnHWU3xJKRt3wkNO5E46zpX7anOTvoqR/+AFIX9oy7Ep53HQqqQv4VQYHxK1zL24Qpxen3KHOsTrM/nipD+iVLnt1i9bA7D6XNHW9OyV3GyY+JjqEaU3eGkJ1tV7N3PkV4RgaMYKVLJvLpFwJNHf3xl1Y4HGAHLkfcYNh+FHpXzDq5hi0W+dYlX0Vf3NxBUbWFRWO0XhcA1JFmOUWHV0Atxr+BZDW93vBwl1RNxY7deP/7NcxrN33ND9rBENalowwL5q2a7AMXRfsWNpsvVea/Oks09GujhysgoTDykF+jTyzFVLtisXfrFqWw7bz3EiNjPHHZK4o7eEwO8FGvI/7VlkL7eM+BM09GKU/Cqe0upFrI/Xe3vsrrj8bWivJRASOfZlhU9VOs1rdzQ2zVMs+pZ/kS+dv4ZD3QJseVTZ+LtkngL3vdBI6O+6vG2znolWeKB3yPX37APVYmYiOfyh5UMqSSaZ+kRVIoWZDr3O8xLc/foqSLBF/cFwA

X-Forefront-Antispam-Report-Untrusted:

CIP:103.143.76.15;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:confront.whitefov.live;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230016)(376002)(346002)(34096005)(396003)(136003)(39830400003)(46966006)(8676002)(5660300002)(40480700001)(7116003)(2876002)(6916009)(42186006)(316002)(70206006)(30864003)(2906002)(82310400005)(8936002)(70586007)(9686003)(498600001)(33964004)(26005)(71280400001)(41300700001)(3480700007)(66574015)(47076005)(35950700001)(83380400001)(336012)(42882007)(78352004)(18074004)(40580700002)(81166007)(166002)(21314003);DIR:OUT;SFP:1102;

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP265MB2098

X-MS-Exchange-Transport-CrossTenantHeadersStripped:

TYZAPC01FT058.eop-APC01.prod.protection.outlook.com

X-MS-PublicTrafficType: Email

X-MS-Office365-Filtering-Correlation-Id-Prvs:

d9bdec59-9b57-496b-c94b-08da884d2b6a

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

FG+Sx0uNomfplls4ayz1WoV34V3Yie3sXXj627xVnSprUxajY4TZERC9QQ445PLX8WQuTbjElg59IRJr0n/+Tqe24AiUbffd4UwP9pevpk0KfSisO9JxfxRruCJtgsm2NXrhBPoBwy80kHFXLecv+QfUMpe3AmCvrSPbmggaADDNwAMBWHyn3yLToCAsmhAoMHDgI037L5ZWKDvbRdUkZsGJw3hw2Fs68Zp+lwJx9q1r+o2/v2BW9Y7+bVxFIygAsBF2bShKbM0tcw3BYwfZNZa1QludsbCfRxrRNuXPD3oTHCp6j7CL2BbrpThexMqf97G+ziDf737qOF/Ka/5bazCuI3JEUudUYPXyPPjhQtzzfWLmtLVkluQrPyFotW5f3lcCOg5ciAVaGxE4sgyWHMbR2lNTLNYfZtFRIRdCWaVoDzayscrQLhWzlpWaSOCNnJWpJsrUtxpwScZVf0uja/lj0cxpaiGEIVCLu5VBqettszlhit/sd8zD0h8cErzo1c/AXm0lhIuxVJsCJQ9VOUl9zOOkms6Czx6JL2n9RZDqlgISvoDUQ7T4lt+7DEcMunxgs8xUY3qbT9o+4GxcGCbbDTNNoTdN2mm/yq0vAg8ECJZ0TDjchmNO17HlKe4re3nTqXV16YuH9BsrQG0XX+8lAGbLdGQbdcE0ath2Biwvs97L+M2aG5B7fDxvQOLRiWNG9bSa5i+ZxDAcCWNnTYlLU5CMv+PTMj5lV3FgNY3z43mWuiiPK1aa/rfEEanplYk4QybrCa5ZJbiO0hHBcm+CP3JBxelsK6ZVmMwtLYn24QIxWrjIkDne92r8HyluHsYeOLm7gfCaHxc/6NJmcDeQG6b2hsvbT8rbgEPPlS0=

X-Forefront-Antispam-Report:

CIP:135.181.210.111;CTRY:FI;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mustedumn.onmicrosoft.com;PTR:static.111.210.181.135.clients.your-server.de;CAT:NONE;SFS:(13230022)(346002)(136003)(376002)(39860400002)(396003)(451199015)(46966006)(40470700004)(36840700001)(36736006)(66899015)(83170400001)(82740400003)(118246002)(4744005)(9686003)(6512007)(81166007)(40460700003)(356005)(166002)(8676002)(2906002)(41300700001)(2876002)(70206006)(3630700005)(8936002)(5660300002)(6916009)(956004)(70586007)(36860700001)(786003)(316002)(47076005)(336012)(63766006)(26005)(42882007)(186003)(478600001)(6666004)(40480700001)(36906005)(71280400001)(6486002)(82310400005)(41320700001)(9316004)(76236004)(407334004)(214273001)(15450700026);DIR:OUT;SFP:1501;

X-OriginatorOrg: mustedumn.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Oct 2022 19:00:20.0530

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 869039e3-ab1b-432f-39d7-08daaa28835d

X-MS-Exchange-CrossTenant-Id: 7aef9087-c590-4578-8f84-622d561e3abb

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=7aef9087-c590-4578-8f84-622d561e3abb;Ip=[135.181.210.111];Helo=[mustedumn.onmicrosoft.com]

X-MS-Exchange-CrossTenant-AuthSource:

TYZAPC01FT058.eop-APC01.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY0PR06MB5634

X-Spam_score: 5.2

X-Spam_score_int: 52

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: My good friend Emily used to suffer from extreme back pain

caused by a car accident that wasn’t her fault. She tried many things and

even considered surgery… Until she found this:



Content analysis details: (5.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 HK_RANDOM_FROM From username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel

letters

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[qlpnvpj[at]mustedumn.onmicrosoft.com]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and

EnvelopeFrom freemail headers are

different

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

Subject: {SPAM?} -doctor 30-second stretch ERASES horrific back pain)#053



My good friend Emily used to suffer from extreme back pain caused by a car accident that wasn’t her fault.





She tried many things and even considered surgery…





Until she found this:





A simple 30-second stretch that heals back pain & sciatica.





This weird stretch is so effective, Emily is now on a mission to share it with as many back pain sufferers as she possibly can.





=> This 30-second stretch HEALS back pain & sciatica





-doctor





P.S. Since Emily started teaching it, this one simple stretch has helped thousands of back pain and sciatica sufferers all over the world and continues to provide relief to the most skeptical people…





















unsubscribe