NetKnow Corporate Blog | Entries from Wednesday, November 2. 2022

ukrainian woman spam from Hotmail

Investment spam from Hotmail

Posted by Dave Yadallee on Wednesday, November 2. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Nov 2022 07:00:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oqDKl-000BML-NM

for dave@doctor.nl2k.ab.ca;

Wed, 02 Nov 2022 06:59:07 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Nov 2022 06:59:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-sl2kor01olkn0187.outbound.protection.outlook.com ([104.47.108.187]:46035 helo=KOR01-SL2-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oq7VY-000GRD-RT

for doctor@doctor.nl2k.ab.ca;

Wed, 02 Nov 2022 00:45:58 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=ExaKSr5AcbPs9g1lRtrpt2WoO6xpy+/uPNfswPMOwETpHRB1BQC8OEqW2tsgupeH9IAqVuZT5chlYWPR/lthbTlRfXU1hF8T6xGcN5joAq3+tDiUfYfZPApWoUh1Yyz9RSsxN8Tyes9nCa1ikedV5XftBUiJ2+BAVjK9nkR18juhEc4L8lE0TgeZlXcvn6CE8Q/PtSDjPjUuE2U+EHKBxTA4JFD+UVhiRmBp6vh1HCQfROvioQFg699FAg9hsGlX84xIZheZpdsDNj8xHQTm2rbivYOAIlaKtu5e/YRP+6NJ7SFrcx5/hmkYxzMtiYXBcInvpRwsWvicWeNnffsYEA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=QuDSZanneCOqBqOtRJ83yUOaCyGnBvA8nAj/jqR5tUQ=;

b=fnSr12Fls1B0dDpEmVc/KV9J+n45GYTGdDZ/yWMUUJelbVmoOVhKA9/xN7TVnwIlc0hsKxU0+wQv8ZM/8wS/E6OxJGcC7LQ1c2XYZyJtRIstuRTkq5dHx+AVf77uK7T/9Q0ikOtCI8HkUUNhDo/pOaCrJTeHB3BzfRJd1JhPYaP4YpHL2uXAoxWXkn5+z0lMdvacMVuMtSq/WLvPio82GFRYzTviotL7kYeEGI4rnm77y5efPHssjqb7c+tsLD+SR1y6W6BMFwsAEVeHmCebjRxFJ5712wbwREBQprc8Y4OVU6Focjme/ilyvn3d/UPcO0y9ya+PSHpxqT27pc/VsA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=QuDSZanneCOqBqOtRJ83yUOaCyGnBvA8nAj/jqR5tUQ=;

b=Y/Cd4E4oAFQaqT7A2THhCQ9c8V+sIBh+KvSdrQ9zxUxinuBiPdPmFlrXFE37ljbN/TARlisuQ4va31r0jRrQE9hUK5QbUYb4/sugWI0xRVN6kbuBtv+OjoW41KVom3+qxk8oi7pB9vcvR7NlnPWXZULcmvvZQFB7RaGCiwMAY7gZOIg366lHMG7KKUkh6mlnwLvyW/bBr2oYMjrr1lrtC0ewjKcaCGzNx2W9ciMYCvm1uJWUadeyfAvNAgiXPXCAKXlejIC2n3ZrUuTLu+pylFxF4wJ6fyYnQ8Bo2NNzp60ykDUFV993cj9Qa/3MDpCtCRVjO+zanjaTP2FMsuPOjw==

Received: from PSXP216MB0406.KORP216.PROD.OUTLOOK.COM (2603:1096:300:c::14) by

SE1P216MB1334.KORP216.PROD.OUTLOOK.COM (2603:1096:101:16::10) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.5769.19; Wed, 2 Nov 2022 06:42:18 +0000

Received: from PSXP216MB0406.KORP216.PROD.OUTLOOK.COM

([fe80::4495:7df9:814f:7d18]) by PSXP216MB0406.KORP216.PROD.OUTLOOK.COM

([fe80::4495:7df9:814f:7d18%12]) with mapi id 15.20.5791.020; Wed, 2 Nov 2022

06:42:18 +0000

X-Mailer: MailBee.NET 11.2.0.590

From: "smeephiyike@outlook.com"

Subject: =?UTF-8?Q?=E2=99=A5=E2=99=A5_FIND_YOUR_S?=

=?UTF-8?Q?ECRET_WOMAN!!!_=E2=99=A5?=

=?UTF-8?Q?=E2=99=A5?=

Reply-To: "smeephiyike@outlook.com"

Date: Wed, 02 Nov 2022 07:42:07 +0100

Message-ID:

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_B517_10176AD9.93658F7E"

To: Undisclosed recipients:;

X-TMN: [UhTqHrje+mNmHmalHc3B2+6Mxv9EHlA4]

X-ClientProxiedBy: VI1PR04CA0130.eurprd04.prod.outlook.com

(2603:10a6:803:f0::28) To PSXP216MB0406.KORP216.PROD.OUTLOOK.COM

(2603:1096:300:c::14)

X-Microsoft-Original-Message-ID: <1.77699ef24d45c98ce77c@DESKTOP-1SRV5V9>

MIME-Version: 1.0

X-MS-Exchange-MessageSentRepresentingType: 1

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: PSXP216MB0406:EE_|SE1P216MB1334:EE_

X-MS-Office365-Filtering-Correlation-Id: 76caa7af-c834-4c8c-7dd8-08dabc9d625f

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

Yfs5821vw1q5YVUai3/wLrryDyzuM9D5LlL1uVGKKNbwdoO6a78ltaPjnvJLmk5Awe+CfIFxsA1Fu7EeHkGpPPaithHkN6YsB3mYYTOAnPkwJ/yVe8W9f8d1MfEF94cYu9uwGEul3CxMFu82k52SOwmOHvEJ1VVXAGoxb8vyyI9MeClbvdidxBBt2hUnMa3jTSfBVrj4IJOvB98xjulxzN3GFFaqW/SLUvL2ymeyadVeVeGMhAKPevu22qMrwfEShCvkWEfMuNEClbImt3EtSQ1tgIX3Zgk3nNQDNKzaet72ur3k4027+Fp/VS+u3gFr/NUNwnvZ0pWB/sy9t0FAogk282+IJcihIpTL8MIrwAVXezKXdITQo3ibDzNlNKXBZiiaVgKiAYhdA923WKQqIicNN4BPUee3hWzQN8efmqMfFS7azu4/oYnD9RkCNOKtTcgqTHPgZrHoLWsLcXg2qzKvzjjgBlIQ6i6XfKaNg1EdvMGOaDtTH3LXdngWm/LxP1MmIHdr3/4qbKXHufi0FsbzwOCEsSJzM6hGZ49Y4F2wCx8iL6G7ffpnoRuNZGeZmmiQ8wxBI+VfyyBzzT+DJ6HZuLKaKZqdiBZawSORRzdeu5Qr8FiCIn9xtaBwWUBgIHrYYuvwebPCNWY6dvYt3btvzaJJM8sWCSmNXU61Wj3Q4NKlo5BoKyL+VlqTtWETWmLLOIwQ4Tio+ClNkV0/Frou2nZblJM9KawQVdDjLNlHHiTml7McTAndoO8r+1ofEo1er4YkpVlLwaDb4qNzIEHjX3FhBLzg4zO1GXClMgxAhZIBbxiAes9Mjm6AsvBRdXX3gddGhDuimibWxsLTz7S7OHN6TQ19s6kaefA/QIgoLKA/FXZGYzX51j61Twa7dmSb3TiNk2w9w1sJNcc3dFgcNJI7LEOgBf////uHehU=

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?VkRUOUZVSjRkemdNeVRJVktQM0Q1KzFvaWx4Q2lhTXdMRFc1ZEcyLytLazBi?=

=?utf-8?B?dkltaytPZVFvL2tjZGN1eDdSVk1DN05BRUlNNDVjcWhnRHY1YksyMVpNUk4x?=

=?utf-8?B?WThMVDZzN0hldGt2cFZkaEZOVk1iMER5UnNUakZFLzQwQzFKa2x6NDBTc1Bu?=

=?utf-8?B?ZWhkUERSZUJkOUk5Z0M2UWc1NUFKeU1NWmd2TXdSUzlQQ0xjWEdQZmdtYlhR?=

=?utf-8?B?aHcwdVBHT0tMKzlGTDhNaXlidmVRMzNvc1hHamlNSjZqakJpajRtcExEcmU0?=

=?utf-8?B?cThDbTVSbXFmQVYySDVyeHBKenJvWHE0cWRvYXVFQm9ETnJKVG5DZ1Z1V0Qz?=

=?utf-8?B?ZFVRWnZuV3RHQ05VRUZpTXZheGNBTWJVdCtuWTVETjJLU21zV3VNZjdQUnhl?=

=?utf-8?B?RlhzaUx3NG9RbksvS2RBRmtLSHlzRTBha0FEdk9Xc09QcVRaVVpGRGd2MEVH?=

=?utf-8?B?M1QyakRZQkRFL0hlYkNwYm5wcEhGOWxGMHJ4d3BTSlBLTHpwNUJDZ25WMEd3?=

=?utf-8?B?bndKcldMdFRXUGJJSWUvR1hGL29UQldRUGorY2JKZk9BUVMwa1oyTEVlTXFt?=

=?utf-8?B?cllXS24yZXRFeTByaHkxSzdscllHZTRSaGNXYlJNMlpkZnpOQmMvWWcrMTdD?=

=?utf-8?B?aTdkR1hycmx6M242NXVmOU5hTkw3ZXdvZkE3cEcrYVp6YUtPbklTZ0hUKy9F?=

=?utf-8?B?Y2lRdE4zVWhETzcra09hTTQvazBNNUtVVWh6cFVhMFMyWHlpVmlqTzhUWmRF?=

=?utf-8?B?QXp6TWFSSEllRXJ4TUpFRk5VS2QvUFNPUXRpVFhPWXg2cWZjNTFmMDVFVXJK?=

=?utf-8?B?RnA0Q3BHQnFuMCtPWEd2L1d3ZWVFQ3hWcmtudExJeXBNTnFDZDY1cXpCYStP?=

=?utf-8?B?M2V0MUJpbVBFdkpDenRNbnZFbFdua0NTd0g2SHBuQzBQVWFmSHN3dzhFMGpF?=

=?utf-8?B?dU9EdzdhYU1uNjEwVzVUMnAvL2VOWkl5WE9YaTFmQlFLcU9SNVJVMlNvTkJZ?=

=?utf-8?B?MExDNVQ4dm84NGxWbWdIS0xreHNRd3pGWC85MFdrRTZFWndoNkVud0s3aE9Z?=

=?utf-8?B?amFicnNBMWltUURhZUkrUXRaVkpqZCtmeXJHOE9VRkZuTmtzTjduVVBJdE5y?=

=?utf-8?B?bkt6QzlGSjRQS21xNE93Q0RHMFBRMjg3VkJsMEhXc1J4Mk9IQVJpVTN6ZWhF?=

=?utf-8?B?aTlXcUUrTERERDJURXFBM2hJKzIxWkpxNFBBbmtmVmtaR1cxblRlc2hoQ0ZF?=

=?utf-8?B?SnFGaVJHRW9pWDBTU28zUTRQNS95a3RjRGVsS2lJN01MeHZISVN0bDVzcFNm?=

=?utf-8?B?Rjc1WE5FZG9JTHRlNHp4UnRTcUpUUHI3RHpZQUdZL2daWDRsakI5eG12Ry9G?=

=?utf-8?B?bTJSZTAwbFpzc2lWSGY0M2c2MU0zaHZUVG9VY0E0Zkgvd3RIMWw2NXBZQS9S?=

=?utf-8?B?THlNYm83aEZlbVdCYUxYS1BnNU9kMGxvQnkwUDlLVEh2cE0zNG9NYUVGSFJv?=

=?utf-8?B?aERMd3oxb2ViOHh0NEdwSVNKMmkzaXdNU0hxcEJ6VzFsTXk0cXpMZHl6N2dz?=

=?utf-8?B?WWR0NGFySDRJT1ZOVjIzME9uNkErM09vbVZQOUMxWk1aelI2M1g5VzdDSmpF?=

=?utf-8?B?MlNDYnFESHVXV2dLZVJmYWtkZ0ROalVDSFVQai9wdytQekNicURMMytYRWVt?=

=?utf-8?B?b1JUSmpxZWw1b2w4M2dvSHZLTnZ4ZWRIRmM4ZHp1dnAydmtLRmQ4SE9BPT0=?=

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-Network-Message-Id: 76caa7af-c834-4c8c-7dd8-08dabc9d625f

X-MS-Exchange-CrossTenant-AuthSource: PSXP216MB0406.KORP216.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2022 06:42:18.6876

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:

00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SE1P216MB1334

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Why Are Ukrainian Women so Hot? A hot Ukraine girl has so

many incredible features that itâ€™s hard to name them all. Many foreign men

dream of having a Ukrainian wife because of her physical qualities and unique

features.

Content analysis details: (6.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_RED Contains an URL listed in the URIBL redlist

[URIs: myflirtnight.me]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URIs: myflirtnight.me]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL

blocklist

[URIs: myflirtnight.me]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[smeephiyike[at]outlook.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image

area

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?Q?=E2=99=A5=E2=99=A5_FIND_YOUR_S?=

=?UTF-8?Q?ECRET_WOMAN!!!_=E2=99=A5?=

=?UTF-8?Q?=E2=99=A5?=

X-Antivirus: AVG (VPS 221102-0, 11/1/2022), Inbound message

X-Antivirus-Status: Clean

------=_NextPart_000_B517_10176AD9.93658F7E

Content-Type: text/plain;

charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Why Are Ukrainian Women so Hot?

A hot Ukraine girl has so many incredible features that it=E2=80=99s hard t=

o name them all.

Many foreign men dream of having a Ukrainian wife because of her physical =

qualities and unique features.

Ukrainian women win all hearts everywhere - in their native country, Europe=

, and even Hollywood.

They are independent, ambitious, and intelligent, which makes them perfect =

women.

=E2=99=A5=E2=99=A5 FIND YOUR SECRET WOMAN!!! =E2=99=A5=E2=99=A5

=E2=AD=90=E2=AD=90=E2=AD=90 VISIT THE SITE!!!=E2=AD=90=E2=AD=90=E2=AD=90

www.sweetukrainian.live

Don't want to receive notifications/e-mails?

Want to go? UNSUBSCRIBE.

=

------=_NextPart_000_B517_10176AD9.93658F7E

Content-Type: text/html;

charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

style=3D"font-weight:normal;" id=3D"docs-internal-guid-6253bd7d-7fff-d167-=

29b0-3eba074f8b5d">=0A=

argin-bottom:0pt;">=0A=

olor:transparent;font-weight:400;font-style:italic;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Why Are Ukr=

ainian Women so Hot?=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

argin-bottom:0pt;">=0A=

olor:transparent;font-weight:700;font-style:normal;font-variant:normal;text=

-decoration:none;vertical-align:baseline;white-space:pre-wrap;">=E2=99=A5=

=E2=99=A5 FIND YOUR SECRET WOMAN!!! =E2=99=A5=E2=99=A5=0A=

=0A=

=0A=

argin-bottom:0pt;">=0A=

style=3D"text-decoration:none;">
Arial;color:#000000;background-color:#ffffff;font-weight:700;font-style:nor=

mal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-=

space:pre-wrap;">=E2=AD=90=E2=AD=90=E2=AD=90
size:19pt;font-family:Arial;color:#000000;background-color:transparent;font=

-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vert=

ical-align:baseline;white-space:pre-wrap;"> VISIT THE SITE!!!
=3D"https://coolsymbol.com/copy/Medium_Star_Emoji_Symbol_%E2%AD%90" style=

=3D"text-decoration:none;">
color:#000000;background-color:#ffffff;font-weight:700;font-style:normal;fo=

nt-variant:normal;text-decoration:none;vertical-align:baseline;white-space:=

pre-wrap;">=E2=AD=90=E2=AD=90=E2=AD=90
3.999999999999998pt;font-family:Arial;color:#000000;background-color:transp=

arent;font-weight:700;font-style:normal;font-variant:normal;text-decoration=

:none;vertical-align:baseline;white-space:pre-wrap;"> =0A=

=0A=

=0A=

=0A=

=0A=

=0A=

argin-bottom:0pt;">=0A=

>
5cc;background-color:transparent;font-weight:700;font-style:normal;font-var=

iant:normal;text-decoration:underline;-webkit-text-decoration-skip:none;tex=

t-decoration-skip-ink:none;vertical-align:baseline;white-space:pre-wrap;"><=

span style=3D"border:none;display:inline-block;overflow:hidden;width:259px;=

height:395px;">
1Z5UUjgRmK6-DGUcOOyirst4IdcbqtAW9YO5ADzJXoqgigNC-8EtkbMgsbG6TKdrJzBAqqFJIk9=

GpaHLY4wWXvqSrU3yLguSf9xRiiWS3INlKHu2iqkenP15b5EEDI0zLMpcDu-nltoXzpTwJGWPfr=

Oghdvh1m8DJmiPFTPHSWKA" style=3D"margin-left:0px;margin-top:0px;" width=3D"=

259" height=3D"395">
96pt;font-family:Arial;color:#1155cc;background-color:transparent;font-weig=

ht:700;font-style:normal;font-variant:normal;text-decoration:underline;-web=

kit-text-decoration-skip:none;text-decoration-skip-ink:none;vertical-align:=

baseline;white-space:pre-wrap;">
lock;overflow:hidden;width:262px;height:396px;">
gleusercontent.com/8jw7X4wz_CJFJYXvXJyCyZNU_6DWMgdUUhNGY4s1e6j887Vaw6j6_4Yg=

rXOq8SllpKFq2fySAVexb7F0x5ljlafUbNNWYFfVcTebcxgb3LoMn8jLm7c-KRhwt8xmQvDB6d9=

v6KuZTfxZscp9NeId1TqZCfEE6uFIrXWOWVpwlrn95elQrYcMZoheFw" style=3D"margin-le=

ft:0px;margin-top:0px;" width=3D"262" height=3D"396">
yle=3D"font-size:24.999999999999996pt;font-family:Arial;color:#1155cc;backg=

round-color:transparent;font-weight:700;font-style:normal;font-variant:norm=

al;text-decoration:underline;-webkit-text-decoration-skip:none;text-decorat=

ion-skip-ink:none;vertical-align:baseline;white-space:pre-wrap;">
e=3D"border:none;display:inline-block;overflow:hidden;width:290px;height:44=

0px;">
4ZxwfJZr-40J8ipOJfwcRIrMIi1Gg74k-Ku2bur_VBB2UfkBCShEZcZVXdPUAS2FgpvL79H8vXn=

hMNbwbxCLASahTxGQZaOaOcV_bIAdFlFOHhaoXgOl1u40BqM46l3r4QlesLZ_0qXoPfoZm0YWSs=

KzrEgFTdqDHUw" style=3D"margin-left:0px;margin-top:0px;" width=3D"290" heig=

ht=3D"440">
font-family:Arial;color:#000000;background-color:transparent;font-weight:70=

0;font-style:normal;font-variant:normal;text-decoration:none;vertical-align=

:baseline;white-space:pre-wrap;"> =0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

=0A=

rgin-bottom:0pt;">=0A=

lor:transparent;font-weight:400;font-style:normal;font-variant:normal;text-=

decoration:none;vertical-align:baseline;white-space:pre-wrap;">Want to go? =

ne;">
d-color:transparent;font-weight:400;font-style:normal;font-variant:normal;t=

ext-decoration:underline;-webkit-text-decoration-skip:none;text-decoration-=

skip-ink:none;vertical-align:baseline;white-space:pre-wrap;">UNSUBSCRIBE.
span>=0A=

=0A=

=0A=

=

------=_NextPart_000_B517_10176AD9.93658F7E--

November '22

Posted by Dave Yadallee on Wednesday, November 2. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Nov 2022 07:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oqDKT-000BKE-51

for dave@doctor.nl2k.ab.ca;

Wed, 02 Nov 2022 06:58:49 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Nov 2022 06:58:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-bn1nam07hn2226.outbound.protection.outlook.com ([52.100.160.226]:20442 helo=NAM02-BN1-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oq6Q5-000G6p-MS

for root@nk.ca;

Tue, 01 Nov 2022 23:36:15 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=GN7cnyxIIqr8BF0tmOwpYhYN+7Els7BkWwvp6QxnioiyjyqXO3GT1YT/a9etg+Tc7dscpRWBRkD5lcyoDL1btaid+6fsYfbUK3OvytojZtjVRTiULQGeHlgoQli2X/6rAYOrGTGsSnUaFBtdfpCZ73JiGJSd0b2KWS2gqPHAspRIGC5PvdNTFK8FGBAcKT8E4e/s7m48kxITk0rlKO8rvOuTSe4zwVTo/UC0dwt4eZgtE4EMftdByPkmmrFCE1S7rRbgvMXMC7rRNxf/jGeQfd5Lysfg8SaREu/d9N/EnffiImVhQyY1ojD2xpPjcDl1dJ/QUiiUJwndFBYxfhOk8w==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=mSLNISkTH5DIY5J9bcd9rj7xANlj4h/3C9mEl+WXyg4=;

b=RAszIV4PNCPXHQrGm1NI6S1oNsQEWbqmXftk1YswueHWOzlL17Zhc6w0W+Qt+a4qE17zAjsb3u+SIpsnIOhqZF3IHLybBhR7XnbLFQzdE8UD+CNawpL4TU6gPirNg3miU5Yrd8WawTaho6jHv4HVoidEaQ6Zihgys2w7vwFUHSNijb5c79ej8ugEFvMt+MmZ5YuVN7ii73IQhuOHFkVoVY89bFgkueR8fOXYtH9Z6RPH985lKhkxyXLI7kXcx2XCiRgr+blMqtNUMjMsRzIfMQx8GIHXsy44EYiFqpgfzYhlu7/ck/lJtAkz0+Hz17Mnvex4T4oth54D49HW2toa4A==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=softfail (sender ip

is 209.184.167.3) smtp.rcpttodomain=hotmail.com smtp.mailfrom=sheldonisd.com;

dmarc=none action=none header.from=sheldonisd.com; dkim=none (message not

signed); arc=none

Received: from DM6PR10CA0032.namprd10.prod.outlook.com (2603:10b6:5:60::45) by

MN0PR15MB5321.namprd15.prod.outlook.com (2603:10b6:208:370::14) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5769.16; Wed, 2 Nov

2022 05:33:15 +0000

Received: from DM6NAM12FT040.eop-nam12.prod.protection.outlook.com

(2603:10b6:5:60:cafe::6) by DM6PR10CA0032.outlook.office365.com

(2603:10b6:5:60::45) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5791.20 via Frontend

Transport; Wed, 2 Nov 2022 05:33:15 +0000

X-MS-Exchange-Authentication-Results: spf=softfail (sender IP is

209.184.167.3) smtp.mailfrom=sheldonisd.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=sheldonisd.com;

Received-SPF: SoftFail (protection.outlook.com: domain of transitioning

sheldonisd.com discourages use of 209.184.167.3 as permitted sender)

Received: from mail.sheldonisd.com (209.184.167.3) by

DM6NAM12FT040.mail.protection.outlook.com (10.13.179.73) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id

15.20.5791.17 via Frontend Transport; Wed, 2 Nov 2022 05:33:15 +0000

Received: from MAIL-365.ad.sheldonisd.com (10.1.16.82) by

MAIL-365.ad.sheldonisd.com (10.1.16.82) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id

15.1.2106.2; Wed, 2 Nov 2022 00:33:05 -0500

Received: from User (193.47.61.107) by MAIL-365.ad.sheldonisd.com (10.1.16.82)

with Microsoft SMTP Server id 15.1.2106.2 via Frontend Transport; Wed, 2 Nov

2022 00:32:59 -0500

Reply-To:

From: JAMES SEALY

Subject: [EXTERNAL EMAIL - USE CAUTION] Attention Dear,

Date: Tue, 1 Nov 2022 22:33:05 -0700

MIME-Version: 1.0

Content-Type: text/plain; charset="Windows-1251"

Content-Transfer-Encoding: quoted-printable

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Message-ID:

To: Undisclosed recipients:;

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: DM6NAM12FT040:EE_|MN0PR15MB5321:EE_

X-MS-Office365-Filtering-Correlation-Id: a8e69124-f138-4af7-2d2b-08dabc93bdc8

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?windows-1251?Q?e2IyRHlrAtgw8UBbJf+WJeRtq48HPVUOKR4NQoMIjO7qLbNEG/zcPQkU?=

=?windows-1251?Q?M68/cJ1pGm3MefOC8MoRpq3OBsI6cFCIXqa7ThAiUgf9/PGZzGBx61iz?=

=?windows-1251?Q?KydYKYDrc5XDtNqBN0awLzWor0IVfdmVNJrAIeSyR4dRmqsfM1PWBsQ+?=

=?windows-1251?Q?ZO8nZEgw5K/QA/RhMO7CVdicyqO5U+MrydNdRD4S27ErBDT02qIFIKVp?=

=?windows-1251?Q?kej6GwEXp05HCPIdPI7eyBLWSbTQ+ccxto4FBs3iXoWh37draG8pFqq7?=

=?windows-1251?Q?MBJkSegKIWv0X38VIkvzqdPj5fywDBglx4FrRJUksK5LufuFUcO0G35v?=

=?windows-1251?Q?WnQDbJZO1muOSXBZQnJKq6XRyVwpl3ifbBuHjdA3PFb2Bf8Iz8mdqgDs?=

=?windows-1251?Q?4qTyOvE2sTuCtvbEAdazip5DfEXfAu5htuCPf/xxC/7p+ggXWq0OZHDL?=

=?windows-1251?Q?z/60ZRkjgYTLN+8U7GTzE36wzvr4QX+hWlef3uIgZse7ygG4Qu0SrGBq?=

=?windows-1251?Q?qlAnCeGzFLhSq6MfqcYz8J4ad0aFJ39oYrQkC/VXYLm5fmrT84QKVmil?=

=?windows-1251?Q?6pTN4V7DQRba8kbk33Yd2UpK3D1gL+0G6WfvNVjCuv5dta6qX8d/SkHs?=

=?windows-1251?Q?yZx1WFjxEtFFyRL0iaGcrMd1jCrHR8vvXRFFMZMJsWAS1/HcY6kg+zQm?=

=?windows-1251?Q?OxQbtUosy3CE1m6yKnnlxL0GYRr8LbxvsTxhbRhaSh2LZ54PoxyOLIO8?=

=?windows-1251?Q?w8hrS3OyjR91E3t4L/WXLPGhMq0myaR4wFZwd9rqsNpzKutbPqRo2N+s?=

=?windows-1251?Q?v0rXCJ821EB37AM2ipwWY1E8PIHCK0QzmMZ59Jd/aAHp/07sfiuR2nQy?=

=?windows-1251?Q?8WmoghrFAYylzFkZQMzfIqtKEVlBAT/hCS2/u7W8U5VJwrTemgjwzX6H?=

=?windows-1251?Q?o10t/mYhupIXQKJ2Ee64lyx6VOF3r87cSGIwZiNnLPiBbv1TU5L2RhjR?=

=?windows-1251?Q?/7oVjI3TMZZ5Rku57kXy0PSjhz61/gb/iXRt21wbs4hRG8WmHX0V/Nbq?=

=?windows-1251?Q?wk2ZjubYfW0lyxgYG4Afo3Koo4oA6TevFKvzybPVIVlir6k5xe7+5UZh?=

=?windows-1251?Q?ok/3aBAQWmKbD0JcSbIqp25PxFUoCMyS4BLvUnLwy7EmiMPSmQG4aG8k?=

=?windows-1251?Q?PfLghMMkJkO9Q4QI/DNAMB2iNT1o8ocrdSRMSnBVHR3ncsdBX/Mnc5X3?=

=?windows-1251?Q?zRgxWywiao32crPZWCaPxcGFOlYI+H7sqaSJ2y2VFxv8BGOiqT8v4PyT?=

=?windows-1251?Q?1pAPtg=3D=3D?=

X-Forefront-Antispam-Report:

CIP:209.184.167.3;CTRY:US;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:mail.sheldonisd.com;PTR:mail.sheldonisd.com;CAT:OSPM;SFS:(13230022)(396003)(376002)(346002)(39860400002)(136003)(451199015)(109986013)(36840700001)(40470700004)(82740400003)(41300700001)(36860700001)(40480700001)(31686004)(26005)(32650700002)(70206006)(31696002)(786003)(8676002)(82310400005)(2860700004)(316002)(41320700001)(70586007)(4744005)(83170400001)(2906002)(40460700003)(956004)(7596003)(186003)(7416002)(8936002)(356005)(7636003)(7406005)(83380400001)(336012)(7366002)(42882007)(5660300002)(478600001)(426003)(6666004)(32550700012)(4001630100005);DIR:OUT;SFP:1501;

X-OriginatorOrg: sheldonisd.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2022 05:33:15.5792

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: a8e69124-f138-4af7-2d2b-08dabc93bdc8

X-MS-Exchange-CrossTenant-Id: 3237ab13-a154-4aab-bc15-73e6206d6acc

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3237ab13-a154-4aab-bc15-73e6206d6acc;Ip=[209.184.167.3];Helo=[mail.sheldonisd.com]

X-MS-Exchange-CrossTenant-AuthSource:

DM6NAM12FT040.eop-nam12.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN0PR15MB5321

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: CAUTION: This email originated from outside of the organization.

DO NOT click links, provide credentials or open attachments unless you validate

the sender and know the content is safe. Attention Dear,

Content analysis details: (9.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam

0.0 NSL_RCVD_FROM_USER Received from User

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[jamessealy162[at]gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[wendyarandas[at]sheldonisdnoc.onmicrosoft.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and

EnvelopeFrom freemail headers are

different

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

0.0 LOTS_OF_MONEY Huge... sums of money

1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

1.0 XPRIO Has X-Priority header

2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} [EXTERNAL EMAIL - USE CAUTION] Attention Dear,

X-Antivirus: AVG (VPS 221102-0, 11/1/2022), Inbound message

X-Antivirus-Status: Clean

CAUTION: This email originated from outside of the organization. DO NOT cli=

ck links, provide credentials or open attachments unless you validate the s=

ender and know the content is safe.

Attention Dear,

A HIGH LEVEL INVESTMENT OPPORTUNITY IS AVAILABLE NOW. THE INVESTMENT CAPITA=

L IS USD48 MILLION.

REQUIREMENT: CAPABLE AND EXPERIENCED PROFESSIONAL FUND/INVESTMENT MANAGER E=

ITHER CORPORATE BODY OR INDIVIDUAL.

THE INVESTMENT FUND IS DOMICILED IN TURKEY. THE PROCESSING AND TRANSFER WIL=

L TAKE PLACE IN TURKEY AND AS SUCH YOU WILL BE REQUIRED TO COME TO TURKEY.

A ROUND TRIP TICKET WITH FULLY PAID HOTEL ACCOMMODATION FOR 3 NIGHTS IN A H=

OTEL WILL BE ARRANGED FOR YOUR TRIP TO TURKEY.

IF YOU HAVE THE CAPACITY AND WILLINGNESS TO HANDLE THIS PROJECT, KINDLY RES=

POND WITH YOUR DETAILS.

THANKS

BEST REGARDS,

JAMES SEALY

CONSULTANT/BROKER.