financial support spam from Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 Jan 2023 10:09:35 -0700

Received: from mail-psaapc01rlhn2187.outbound.protection.outlook.com ([40.95.53.187]:58849 helo=APC01-PSA-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pIuaJ-000AtU-20

for dave@doctor.nl2k.ab.ca;

Fri, 20 Jan 2023 09:49:53 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=CJjak6+E9ax0jlZfsGVRRkSKhIZp0ogJ1UoX8DT7zsX+fDi4gTh8ecDWcdCpQYTwRxnW3Ez+OqQi2qAb9WE/wxT/nYpc8qr/7uGVo6R2XlXGTJFAGcCidzwU9oMdLJNYP+1cvwmXDqr9O/QBaSkdffRMzH84taWO+RaoB6V5/GBznY2YSZFZ8dRjXA0l+e8JHV+rWXtKJa/L4g2ScWrC12tsoXDVfYxzeqeIfVZrGYykCbipBR/WvMs2YegCYw1uviBvQeMSo30KyocT6fqfDg5tzjHZx/s8W4/JglH+vjPlg2iKJ7nSM2FpBTYluBMDV0O7McXzYNj5LslZfxsUZQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=7s7JBJ9nb18ZFf/ogdm1v3Xta/AfP6qNDtvYuWgtVww=;

b=ROhs+LbDtEZ9jbRnXHFzHklDbCJMbZbfZP6HaLxphK40KpfJXMosFUZxtvwjxL85+XgP4j3k7JfcaN7zdbaOJpB42gsgzyP+IHZHKB20uOygeMRD+O/aYRIxod2hJ6mVnsiAM9IURbLJMc3oO+qVYylGHixKbp+9CM/zlTpzvOFzCqRkY/PjOQ4IOEouIrS2w2XYMQjG8nO07iDMx26Im7Brepdmet4QPC3Ov7MDMHov9j5i69ptctnjx3qr8YmTtoIZJ6Has9Otxfpsauby4uJsH/CyZZCNsekHNPB1e073PP/KteBKR9ddUTOjsndVsu7kbu2+a5uO3mB2AfXBrA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

114.6.82.34) smtp.rcpttodomain=dloudin.com smtp.mailfrom=mcdgrp.com;

dmarc=none action=none header.from=mcdgrp.com; dkim=none (message not

signed); arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=toyotaastra.onmicrosoft.com; s=selector2-toyotaastra-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=7s7JBJ9nb18ZFf/ogdm1v3Xta/AfP6qNDtvYuWgtVww=;

b=Eu+1zcujsuT7D9ntDXP/fw+JfB41ZEwJkFimDr3EOmfvliBRtRQdKUdBlgzXvU/C31r25Xv3tDIkT+HbzRfVG+E6+Q90E2OGohpanIkIzZsbRFNb4HWKPabAfXP9a+6DEB0zIkv4OQBa0HRX+LZJWdy66HBxx1FsKQDNzhosVsc=

Received: from PS2PR03CA0007.apcprd03.prod.outlook.com (2603:1096:300:5b::19)

by TY2PR02MB4288.apcprd02.prod.outlook.com (2603:1096:404:8005::7) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6002.27; Fri, 20 Jan

2023 16:47:11 +0000

Received: from PSAAPC01FT051.eop-APC01.prod.protection.outlook.com

(2603:1096:300:5b:cafe::12) by PS2PR03CA0007.outlook.office365.com

(2603:1096:300:5b::19) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6023.19 via Frontend

Transport; Fri, 20 Jan 2023 16:47:11 +0000

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 114.6.82.34)

smtp.mailfrom=mcdgrp.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=mcdgrp.com;

Received-SPF: Fail (protection.outlook.com: domain of mcdgrp.com does not

designate 114.6.82.34 as permitted sender) receiver=protection.outlook.com;

client-ip=114.6.82.34; helo=toyota.astra.co.id;

Received: from toyota.astra.co.id (114.6.82.34) by

PSAAPC01FT051.mail.protection.outlook.com (10.13.38.135) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id

15.20.6023.16 via Frontend Transport; Fri, 20 Jan 2023 16:47:10 +0000

Received: from User (10.85.28.198) by VSV-C003-002099.toyota.astra.co.id

(10.85.11.213) with Microsoft SMTP Server id 15.0.1497.28; Fri, 20 Jan 2023

23:46:06 +0700

Reply-To:

From: Sawda Finance

Subject: 24/7 Financial Emergency Service

Date: Fri, 20 Jan 2023 16:46:23 -0800

MIME-Version: 1.0

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Message-ID: <9fdaba54d4374ee4ab67fe90930a529e@VSV-C003-002099.toyota.astra.co.id>

To: Undisclosed recipients:;

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: PSAAPC01FT051:EE_|TY2PR02MB4288:EE_

X-MS-Office365-Filtering-Correlation-Id: 86f51a7c-e848-4853-d7e4-08dafb05f998

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?windows-1251?Q?u8wSJGnxmxMEUjPd0YlTLmzIhRQ0myONwyW+FBVlKkXahJUziLVWzWD5?=

=?windows-1251?Q?fZ3ArEILV0F+6LTqojwfhdZvj/3ClUnhewUfp0VFYujkF9FqL7NVWrzl?=

=?windows-1251?Q?Mau30NKKbXQo8233kPUEbPeUysM9lkRwE0/7XfwF3tNePq+ivSiZ/fsE?=

=?windows-1251?Q?TvG6A1sSbJy1FUZijRIPXaCTSh+Qu8Von6mFDSaNEFAcxpGjlTE4Bw4A?=

=?windows-1251?Q?FiAKsdpRwwMdiVZioRIddywXvtGBoFd2rbeFgnQSBBe7aiaJc/4n95Pl?=

=?windows-1251?Q?K8o34x0v+06+ZkevZ/3kITAV3yJb49K++FzVia7t0k1aHin/I6J+aPSB?=

=?windows-1251?Q?lVSjt/LI7FnUjsTmvxCjjWhyAZy1n/fvqxyAL6FNAxdYD3cbTVvcIRmJ?=

=?windows-1251?Q?cWZkMj7cqMep8t8Gcp7PVBhQq89i4qynatgZFxYRjweVLScQry2yV/WN?=

=?windows-1251?Q?iBMx4mU9Tzbzkf91YsMJDpDw07KCaJDuYJvcV7KNp4JYCZtArLYcvdLG?=

=?windows-1251?Q?rLNpftx6x4VHnEWJaGGbap2aV4wPgHVV/ZnqVOALMJtc0WAoKuOR06xH?=

=?windows-1251?Q?2M5h3dX9FLOtUoOh5WEJ64bJqDzaZPTma86I76xjVT6b+thqIOeZ2dug?=

=?windows-1251?Q?JnU8gGBz27voQuKk9e+uFgV60Q07aLRTsArnpWeZoDmKpW99jxavheN6?=

=?windows-1251?Q?NTxRa25jqM3+iS1I3SAqc0hMld/ZMaC9XRRKyJ2Pzv1BV5BZWXwuZw2J?=

=?windows-1251?Q?5pSYmaghytfVd5NMxMU+GMqjfp9gVhvWSK/JzlGPoS0s3BoX7xO0qmV5?=

=?windows-1251?Q?FyAF6y46EsEZkEpRue8xa47y82MjZ2lfom2o1kM6SCc2urpWxIaH8xA5?=

=?windows-1251?Q?J845s9AZQZNDpq+rbS9uw8BnGIvPE8NmrMDqA5ksfNKWFq+NgMmPsK63?=

=?windows-1251?Q?m3ViWI3gGRmC65p3NHlvn4m/FGO8KRVC6rkQh5DQbUgq6XyN6UX6K95q?=

=?windows-1251?Q?HZ9FxCczJo9pnst9rqqYYk68f06jixRsJfkBeQQgcgkPpuqlTPcfp4xK?=

=?windows-1251?Q?UvrUMnF8d7A03f6oYD1EKitRGDOX2zUX51Q07clMZUtRtLB7VtnvHe3I?=

=?windows-1251?Q?aCopqceOHRbof0m71yG4SmnT2Gk1qRP2p+gEHHwSHNGHKESXdRsVvo8I?=

=?windows-1251?Q?yDyjz1XRpj1rTy+ssEQWktU+fAFSsRpT?=

X-Forefront-Antispam-Report:

CIP:114.6.82.34;CTRY:ID;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:toyota.astra.co.id;PTR:114-6-82-34.resources.indosat.com;CAT:OSPM;SFS:(13230022)(4636009)(396003)(39860400002)(346002)(376002)(136003)(451199015)(109986013)(40470700004)(46966006)(316002)(70586007)(336012)(47076005)(7366002)(40460700003)(8676002)(70206006)(2860700004)(356005)(36906005)(2906002)(7276002)(86362001)(41300700001)(82740400003)(81166007)(7406005)(35950700001)(7336002)(82310400005)(5660300002)(7416002)(108616005)(83380400001)(40480700001)(8936002)(26005)(24736004)(498600001)(66899015)(9686003)(6666004)(23876008);DIR:OUT;SFP:1023;

X-OriginatorOrg: toyota.astra.co.id

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jan 2023 16:47:10.5423

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 86f51a7c-e848-4853-d7e4-08dafb05f998

X-MS-Exchange-CrossTenant-Id: 52d4e358-2ecb-48e2-bad4-d3c62441ff17

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52d4e358-2ecb-48e2-bad4-d3c62441ff17;Ip=[114.6.82.34];Helo=[toyota.astra.co.id]

X-MS-Exchange-CrossTenant-AuthSource:

PSAAPC01FT051.eop-APC01.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY2PR02MB4288

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: âš [IMPORTANT CAUTION!]: This is e-mail from outside. Please

verify e-mail sender and subject carefully, Do not open unknown links, attachments

or non-related with your business e-mail and report sus [...]



Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-PSA-obe.outbound.protection.outlook.com;ip=40.95.53.187;r=doctor.nl2k.ab.ca]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=capitap%40mcdgrp.com;ip=40.95.53.187;r=doctor.nl2k.ab.ca]

0.0 NSL_RCVD_FROM_USER Received from User

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.5 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

Subject: {SPAM?} 24/7 Financial Emergency Service














" bottommargin=3D"5">


n" style=3D"max-width: 800px; width: 100%; border:#FF0000 1px solid;">














font-size: 14px; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;;pad=

ding:5px;">

=E2=9A=A0
; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;padding:10px;">

[IMPORTANT CAUTION!]: This is e-mail from outside. Please =

verify e-mail sender and subject carefully, Do not open unknown links, atta=

chments or non-related with your business e-mail and report suspicious e-ma=

il to

it.helpdesk@toyota.astra.co.id




Hi there,


We grant loans to individuals and companies. We are i=

nterested in the financing of large volume projects and grant loans worldwi=

de.


 


The interest rate will be 3% annually. The repayment =

period is 1-25 years.


 


We offer:-


*Project finance


*Business loans


*Personal loans


 


Loan Processing and financing takes about 2 to 3 work=

ing days from the day you submit your loan application. Email us for more i=

nformation via: sawdacapital@gmail.com


 


Kind regards,


Sawda Team




------------------------------------------------=

---------------------------------------------------------------------------=

-------------




This e-mail and any attachment may contain confidential or legally privileg=

ed information for use of PT. Toyota-Astra Motor (TAM) only. If you are not=

the intended recipient, you are not authorized to copy or disclose all or =

any part of it without the prior

written consent of the company.





Each e-mail that is sent to internal or external organizations are logged a=

nd can be used as evidence in case of rule violation.


---------------------------------------------------------------------------=

-------------------------------------------------------------









Phishing on a technical list

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 Jan 2023 09:00:35 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pItoV-0007WT-2U

for dave@doctor.nl2k.ab.ca;

Fri, 20 Jan 2023 09:00:23 -0700

Resent-From: The Doctor

Resent-Date: Fri, 20 Jan 2023 09:00:23 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server2.sourceware.org ([8.43.85.97]:37518 helo=sourceware.org)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pIo53-000K8m-2g

for doctor@doctor.nl2k.ab.ca;

Fri, 20 Jan 2023 02:53:29 -0700

Received: from server2.sourceware.org (localhost [IPv6:::1])

by sourceware.org (Postfix) with ESMTP id B068A3858C27

for ; Fri, 20 Jan 2023 09:50:34 +0000 (GMT)

DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B068A3858C27

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org;

s=default; t=1674208234;

bh=jr9CDaDBMvnkMxFQZmVw7tToHvtup6bql4nar7yxrXQ=;

h=Date:To:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post:

List-Help:List-Subscribe:From:Reply-To:From;

b=rCI2bn1FOdDUWSvwYRzUl80p9m2a1Gq23hY/0MaC/WgouU5AzKJ0RuHbU0ZjB19BE

3vi3kLd5cx31BBQtZTtS/5wBUXpgYbHAV7HmSBzKVnRy7EaAcLxgNjbYVbY01wqffb

dcqM/NZkG4NWKEW7aMJILw0KsqvJpkM7Y1EYufOU=

X-Original-To: binutils@sourceware.org

Delivered-To: binutils@sourceware.org

Received: from mail-il1-x12f.google.com (mail-il1-x12f.google.com

[IPv6:2607:f8b0:4864:20::12f])

by sourceware.org (Postfix) with ESMTPS id 19B913858D20

for ; Fri, 20 Jan 2023 09:49:42 +0000 (GMT)

DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 19B913858D20

Received: by mail-il1-x12f.google.com with SMTP id i17so2465883ila.9

for ; Fri, 20 Jan 2023 01:49:42 -0800 (PST)

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=subject:to:content-language:user-agent:mime-version:date:message-id

:from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=8pq+LUE1BDFaClWW0w/vXDU6ul8k8lHDlwq8f64cXuU=;

b=y/PQWhf1S4zJwydx1QWkZxxTphe1J+4GJ4T7rNDy9cSD5qzWpprbsn6ZZCZTkC3jDI

5jLRHp18lI2CqXXO2Asbqgy5L2ajwkTri7qtduG+BUP/wYtPy0Yh91Roygpy3hE9FD6s

NDUY9OUTH+M/JTcx+D2Fl2hPjkz6B/WCiF3sD67oyOCzJbpncuLZyuSh0uwGjwZRW6EH

qjDdM1YUA+g/GpmIWtmKJK0AlNdqH+deGqUwX/lSuRgnWQDnwWxgiewn6tAB+veU0GqS

2vW3zeXiyTqKeXk8gm9TTHfF4umtXJn/ZFTNZxSqB1RccPgcQ9/8f3jM6fPZjcxwrcV/

fXXQ==

X-Gm-Message-State: AFqh2kqcA86hxQjepCDb8gLhzZy/kbVnidO0Mbs+w33CgvrJSdAg1RSs

tM05XKd7Lw00Mxgk0VEQNDDibMUGKvV7PmRO

X-Google-Smtp-Source: AMrXdXsbRwD72jFhfWTQSnadeMS85GCzpzYYxc2zoGUFcEirhz2jS/sd/SiyyoKmAlVSkkQAHGVLiA==

X-Received: by 2002:a92:502:0:b0:30e:db14:e9c0 with SMTP id

q2-20020a920502000000b0030edb14e9c0mr11069403ile.2.1674208181131;

Fri, 20 Jan 2023 01:49:41 -0800 (PST)

Received: from [172.31.19.0]

(ec2-3-138-183-41.us-east-2.compute.amazonaws.com. [3.138.183.41])

by smtp.gmail.com with ESMTPSA id

d1-20020a92d781000000b00302bb083c2bsm11618563iln.21.2023.01.20.01.49.40

for

(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);

Fri, 20 Jan 2023 01:49:40 -0800 (PST)

X-Google-Original-From: Geek Services

Message-ID:

Date: Fri, 20 Jan 2023 09:49:39 +0000

MIME-Version: 1.0

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101

Thunderbird/102.6.1

Content-Language: en-US

To: binutils@sourceware.org

Subject: Your annual subscription receipt #KW-JAN20-11374195

X-Spam-Status: No, score=2.2 required=5.0 tests=BAYES_40, DKIM_SIGNED,

DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_ENVFROM_END_DIGIT,

FREEMAIL_FROM, HK_RANDOM_ENVFROM, HK_RANDOM_FROM, HTML_FONT_LOW_CONTRAST,

HTML_FONT_SIZE_LARGE, HTML_MESSAGE, KAM_NUMSUBJECT, RCVD_IN_DNSWL_NONE,

SPF_HELO_NONE, SPF_PASS, TXREP autolearn=no autolearn_force=no version=3.4.6

X-Spam-Level: **

X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on

server2.sourceware.org

Content-Type: text/plain; charset=UTF-8; format=flowed

Content-Transfer-Encoding: 7bit

X-Content-Filtered-By: Mailman/MimeDel 2.1.29

X-BeenThere: binutils@sourceware.org

X-Mailman-Version: 2.1.29

Precedence: list

List-Id: Binutils mailing list

List-Unsubscribe: ,



List-Archive:

List-Post:

List-Help:

List-Subscribe: ,



From: Geek Services via Binutils

Reply-To: Geek Services

Errors-To: binutils-bounces+doctor=doctor.nl2k.ab.ca@sourceware.org

Sender: "Binutils"













**iGEEK**SQUADi**

**

**

INVOICE

/#KW-JAN20-11374195/



Hello binutils@sourceware.org



Thank you for choosing Geek Total Tech Protection.



Your annual subscription has been auto-renewed as you have opted for it.



Now your services are valid for another one year till Jan 20, 2024. We

promise to serve you in the same way as we have been serving.



If you wish to stop this subscription, reach us at +1\(866)/266,-\8540.





Renewal details:





Renewed on : 2023-01-20

Plan : Total Tech Protection

Duration : Yearly Subscription

Devices : 03 Devices

Amount : USD 345.49

Mode : Auto-Debit





If you don't recognise this charge, inform us *+1'(866).266/-/8540*. We

are here to assist you in every aspect.



We hope to see you again soon!

Geek Services



This email was sent from a notification-only email address that can't

accept incoming email. Please don't reply to this message.

CRA Phish from Japan

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 Jan 2023 09:01:35 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pItpb-0007cr-28

for dave@doctor.nl2k.ab.ca;

Fri, 20 Jan 2023 09:01:31 -0700

Resent-From: The Doctor

Resent-Date: Fri, 20 Jan 2023 09:01:31 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mebae.ac.jp ([119.245.181.214]:41976)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pIqMa-000OcI-35

for root@nk.ca;

Fri, 20 Jan 2023 05:19:27 -0700

Received: (qmail 4019 invoked by VF by uid 0); 20 Jan 2023 21:16:47 +0900

Received: from unknown (HELO WIN-A0GVJ7MUGG8) (admin@mebae.ac.jp@13.113.225.198)

by dc23.etius.jp (119.245.181.214) with ESMTPA; 20 Jan 2023 21:16:47 +0900

MIME-Version: 1.0

From: =?utf-8?Q?=E2=84=A2Canadian_Revenue_Agency_=28CRA=29=C2=AE?=



To: root@nk.ca

X-Priority: 1

Priority: urgent

Importance: high

Date: 20 Jan 2023 12:16:42 +0000

Subject: =?utf-8?B?4oSiUmVtaW5kZXIgZnJvbSBDYW5hZGHihKIgUmV2ZW51ZSBB?=

=?utf-8?B?Z2VuY3kgLyBSYXBwZWwgZGUgbOKAmUFnZW5jZSBkdSByZXZlbnUgZHUg?=

=?utf-8?B?Q2FuYWRhIC8gT2ZmaWNlIG5yOjgxMzMzMDQ1MSBUYXggUmVmdW5kIElE?=

=?utf-8?B?IE51bWJlcjogMjY4MTMzMzA0NTExNw==?=

Content-Type: multipart/alternative;

boundary=--boundary_247_1a39e578-9c27-435d-8fed-94e351cb6a9b





----boundary_247_1a39e578-9c27-435d-8fed-94e351cb6a9b

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: base64



PFA+CjxUQUJMRSBjbGFzcz1kZXZpY2UgY2VsbFNwYWNpbmc9MCBjZWxsUGFkZGluZz0w

IHdpZHRoPTU3MCBhbGlnbj1jZW50ZXIgYm9yZGVyPTA+CjxUQk9EWT4KPFRSPgo8VEQg

c3R5bGU9IkZPTlQtU0laRTogMTRweDsgRk9OVC1GQU1JTFk6IFRhaG9tYSwgVmVyZGFu

YSwgU2Vnb2UsIHNhbnMtc2VyaWY7IENPTE9SOiAjNTQ2YTc5OyBURVhULUFMSUdOOiBs

ZWZ0OyBMSU5FLUhFSUdIVDogMjRweCIgdkFsaWduPW1pZGRsZSBhbGlnbj1jZW50ZXI+

CjxESVY+U3RyaWN0bHkgUHJpdmF0ZSBhbmQgQ29uZmlkZW50aWFsKiZuYnNwOyA8QlI+

Jm5ic3A7PEJSPlRheCBSZXR1cm4gMjAyMzxCUj5UYXggeWVhciZuYnNwOzEwJm5ic3A7

SmFuIDIwMjIgdG8mbmJzcDsgMTAmbmJzcDtKYW4gMjAyMyAmbmJzcDsgICgyMDIy4oCT

MjMpPC9ESVY+CjxESVY+Jm5ic3A7PC9ESVY+CjxESVY+U3RhcnRpbmcgeW91ciB0YXgg

cmVmdW5kPEJSPkxvY2FsIE9mZmljZSBOby4gMzgxMzMzMjxCUj5UYXggQ3JlZGl0IE9m

ZmljZXI6IEplZmZyZXkgRHVuY2FuPEJSPlRheCBSZWZ1bmQgSUQgTnVtYmVyOiA4MTMz

MzA0NTEzNzg0PEJSPlJlZnVuZCBBbW91bnQ6IENBRCAzODEuODE8L0RJVj4KPERJVj4m

bmJzcDs8L0RJVj4KPERJVj5Zb3UgaGF2ZSBhIFRheCByZWZ1bmQgb2YgQ0FEIDM4MS44

MSB3YWl0aW5nIGZyb20geW91ciBwcmV2aW91cyByZXZlbnVlIHJlY29yZHMuPEJSPllv

dSByZWNlaXZlZCBhIGxldHRlciBmcm9tIENhbmFkYSBSZXZlbnVlIEFnZW5jeSB0byBt

YWtlIGEgcmVmdW5kIHRvIHlvdXIgYWNjb3VudDxCUj5VbmZvcnR1bmF0ZWx5IHdlIHdl

cmUgbm90IGFibGUgdG8gcHJvY2VzcyB5b3VyIGluZm9ybWF0aW9uIGJlY2F1c2UgdGhl

IGRldGFpbHM8QlI+d2UgaGF2ZSwgZGlkIG5vdCBtYXRjaC48QlI+RHVlIHRvIHRoaXMg

aXNzdWUsIHdlIGhhdmUgdG8gcmUtdmVyaWZ5IHlvdXIgaW5mb3JtYXRpb24uPEJSPjwv

RElWPgo8RElWPiZuYnNwOzwvRElWPgo8RElWPjxBIHN0eWxlPSdGT05ULVNJWkU6IDE2

cHg7IFRFWFQtREVDT1JBVElPTjogbm9uZTsgRk9OVC1GQU1JTFk6ICJoZWx2ZXRpY2Ei

LCAiYXJpYWwiLCBzYW5zLXNlcmlmOyBCQUNLR1JPVU5EOiByZ2IoMTIsMTA4LDI0Mik7

IFRFWFQtVFJBTlNGT1JNOiBub25lOyBGT05ULVdFSUdIVDogNjAwOyBDT0xPUjogcmdi

KDI1NSwyNTUsMjU1KSAhaW1wb3J0YW50OyBQQURESU5HLUJPVFRPTTogMHB4OyBGT05U

LVNUWUxFOiBub3JtYWw7IFBBRERJTkctVE9QOiAwcHg7IFBBRERJTkctTEVGVDogMTVw

eDsgTUFSR0lOOiAwcHg7IERJU1BMQVk6IGlubGluZS1ibG9jazsgTElORS1IRUlHSFQ6

IDE1MCU7IFBBRERJTkctUklHSFQ6IDE1cHg7IGJvcmRlci1yYWRpdXM6IDhweDsgYmFj

a2dyb3VuZC1zaXplOiBhdXRvOyBiYWNrZ3JvdW5kLW9yaWdpbjogcGFkZGluZy1ib3g7

IGJhY2tncm91bmQtY2xpcDogYm9yZGVyLWJveCcgaHJlZj0iaHR0cHM6Ly9zMy5hbWF6

b25hd3MuY29tL3RkZ25mYnJkdHlrbWhnbmExYmdtaGdjZnJ0anJjZmd0bXlrdWhmZ2Zu

ZmpjZmhjZ25jZ2RmeGhuMzkvNGZ0eWd1amhnY2JmLmh0bWwiIHJlbD0ibm9mb2xsb3cg

bm9vcGVuZXIgbm9yZWZlcnJlciIgdGFyZ2V0PV9ibGFuayBkYXRhLWxpbmtpbmRleD0i

MCIgZGF0YS1hdXRoPSJOb3RBcHBsaWNhYmxlIj5TaWduIGluIHRvIGEgQ1JBIGFjY291

bnQ8L0E+PC9ESVY+CjxESVY+Jm5ic3A7PC9ESVY+CjxESVY+TWFrZSBzdXJlIHlvdXIg

Y29tcGxldGUgdGhlIGZvcm0gY29ycmVjdGx5IGFzIGFueSBtaXN0YWtlIHdpbGwgdGFr

ZSBtb3JlIHRpbWUgdG88QlI+cHJvY2VzcyBhbmQgeW91IHRheCByZWZ1bmQgd2lsbCBi

ZSBwcm9jZXNzZWQgd2l0aGhpbiA2IC0gOSB3b3JraW5nIGRheXMgYXMgY2xhaW1lZC48

L0RJVj4KPERJVj48QlI+4oCiTk9URTwvRElWPgo8RElWPklmIHlvdSBoYXZlbid0IGdv

dCB5b3VyIGNsYWltIGZvcm0gYWZ0ZXIgdHdvIHdlZWtzLCBjb250YWN0IHRoZSBUYXgg

UmVmdW5kIEhlbHBsaW5lLjxCUj4mbmJzcDsmbmJzcDs8QlI+VGhpcyBlbWFpbCB3YXMg

c2VudCBmcm9tIGEgbm90aWZpY2F0aW9uLW9ubHkgYWRkcmVzcyB0aGF0IGNhbuKAmXQg

YWNjZXB0IGluY29taW5nIGVtYWlsLiBQbGVhc2UgZG9u4oCZdCByZXBseSB0byB0aGlz

IG1lc3NhZ2UuPEJSPjwvRElWPjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9QPg==

----boundary_247_1a39e578-9c27-435d-8fed-94e351cb6a9b

Content-Type: text/html

Content-Transfer-Encoding: base64



PFA+CjxUQUJMRSBjbGFzcz1kZXZpY2UgY2VsbFNwYWNpbmc9MCBjZWxsUGFkZGluZz0w

IHdpZHRoPTU3MCBhbGlnbj1jZW50ZXIgYm9yZGVyPTA+CjxUQk9EWT4KPFRSPgo8VEQg

c3R5bGU9IkZPTlQtU0laRTogMTRweDsgRk9OVC1GQU1JTFk6IFRhaG9tYSwgVmVyZGFu

YSwgU2Vnb2UsIHNhbnMtc2VyaWY7IENPTE9SOiAjNTQ2YTc5OyBURVhULUFMSUdOOiBs

ZWZ0OyBMSU5FLUhFSUdIVDogMjRweCIgdkFsaWduPW1pZGRsZSBhbGlnbj1jZW50ZXI+

CjxESVY+U3RyaWN0bHkgUHJpdmF0ZSBhbmQgQ29uZmlkZW50aWFsKiZuYnNwOyA8QlI+

Jm5ic3A7PEJSPlRheCBSZXR1cm4gMjAyMzxCUj5UYXggeWVhciZuYnNwOzEwJm5ic3A7

SmFuIDIwMjIgdG8mbmJzcDsgMTAmbmJzcDtKYW4gMjAyMyAmbmJzcDsgICgyMDIy4oCT

MjMpPC9ESVY+CjxESVY+Jm5ic3A7PC9ESVY+CjxESVY+U3RhcnRpbmcgeW91ciB0YXgg

cmVmdW5kPEJSPkxvY2FsIE9mZmljZSBOby4gMzgxMzMzMjxCUj5UYXggQ3JlZGl0IE9m

ZmljZXI6IEplZmZyZXkgRHVuY2FuPEJSPlRheCBSZWZ1bmQgSUQgTnVtYmVyOiA4MTMz

MzA0NTEzNzg0PEJSPlJlZnVuZCBBbW91bnQ6IENBRCAzODEuODE8L0RJVj4KPERJVj4m

bmJzcDs8L0RJVj4KPERJVj5Zb3UgaGF2ZSBhIFRheCByZWZ1bmQgb2YgQ0FEIDM4MS44

MSB3YWl0aW5nIGZyb20geW91ciBwcmV2aW91cyByZXZlbnVlIHJlY29yZHMuPEJSPllv

dSByZWNlaXZlZCBhIGxldHRlciBmcm9tIENhbmFkYSBSZXZlbnVlIEFnZW5jeSB0byBt

YWtlIGEgcmVmdW5kIHRvIHlvdXIgYWNjb3VudDxCUj5VbmZvcnR1bmF0ZWx5IHdlIHdl

cmUgbm90IGFibGUgdG8gcHJvY2VzcyB5b3VyIGluZm9ybWF0aW9uIGJlY2F1c2UgdGhl

IGRldGFpbHM8QlI+d2UgaGF2ZSwgZGlkIG5vdCBtYXRjaC48QlI+RHVlIHRvIHRoaXMg

aXNzdWUsIHdlIGhhdmUgdG8gcmUtdmVyaWZ5IHlvdXIgaW5mb3JtYXRpb24uPEJSPjwv

RElWPgo8RElWPiZuYnNwOzwvRElWPgo8RElWPjxBIHN0eWxlPSdGT05ULVNJWkU6IDE2

cHg7IFRFWFQtREVDT1JBVElPTjogbm9uZTsgRk9OVC1GQU1JTFk6ICJoZWx2ZXRpY2Ei

LCAiYXJpYWwiLCBzYW5zLXNlcmlmOyBCQUNLR1JPVU5EOiByZ2IoMTIsMTA4LDI0Mik7

IFRFWFQtVFJBTlNGT1JNOiBub25lOyBGT05ULVdFSUdIVDogNjAwOyBDT0xPUjogcmdi

KDI1NSwyNTUsMjU1KSAhaW1wb3J0YW50OyBQQURESU5HLUJPVFRPTTogMHB4OyBGT05U

LVNUWUxFOiBub3JtYWw7IFBBRERJTkctVE9QOiAwcHg7IFBBRERJTkctTEVGVDogMTVw

eDsgTUFSR0lOOiAwcHg7IERJU1BMQVk6IGlubGluZS1ibG9jazsgTElORS1IRUlHSFQ6

IDE1MCU7IFBBRERJTkctUklHSFQ6IDE1cHg7IGJvcmRlci1yYWRpdXM6IDhweDsgYmFj

a2dyb3VuZC1zaXplOiBhdXRvOyBiYWNrZ3JvdW5kLW9yaWdpbjogcGFkZGluZy1ib3g7

IGJhY2tncm91bmQtY2xpcDogYm9yZGVyLWJveCcgaHJlZj0iaHR0cHM6Ly9zMy5hbWF6

b25hd3MuY29tL3RkZ25mYnJkdHlrbWhnbmExYmdtaGdjZnJ0anJjZmd0bXlrdWhmZ2Zu

ZmpjZmhjZ25jZ2RmeGhuMzkvNGZ0eWd1amhnY2JmLmh0bWwiIHJlbD0ibm9mb2xsb3cg

bm9vcGVuZXIgbm9yZWZlcnJlciIgdGFyZ2V0PV9ibGFuayBkYXRhLWxpbmtpbmRleD0i

MCIgZGF0YS1hdXRoPSJOb3RBcHBsaWNhYmxlIj5TaWduIGluIHRvIGEgQ1JBIGFjY291

bnQ8L0E+PC9ESVY+CjxESVY+Jm5ic3A7PC9ESVY+CjxESVY+TWFrZSBzdXJlIHlvdXIg

Y29tcGxldGUgdGhlIGZvcm0gY29ycmVjdGx5IGFzIGFueSBtaXN0YWtlIHdpbGwgdGFr

ZSBtb3JlIHRpbWUgdG88QlI+cHJvY2VzcyBhbmQgeW91IHRheCByZWZ1bmQgd2lsbCBi

ZSBwcm9jZXNzZWQgd2l0aGhpbiA2IC0gOSB3b3JraW5nIGRheXMgYXMgY2xhaW1lZC48

L0RJVj4KPERJVj48QlI+4oCiTk9URTwvRElWPgo8RElWPklmIHlvdSBoYXZlbid0IGdv

dCB5b3VyIGNsYWltIGZvcm0gYWZ0ZXIgdHdvIHdlZWtzLCBjb250YWN0IHRoZSBUYXgg

UmVmdW5kIEhlbHBsaW5lLjxCUj4mbmJzcDsmbmJzcDs8QlI+VGhpcyBlbWFpbCB3YXMg

c2VudCBmcm9tIGEgbm90aWZpY2F0aW9uLW9ubHkgYWRkcmVzcyB0aGF0IGNhbuKAmXQg

YWNjZXB0IGluY29taW5nIGVtYWlsLiBQbGVhc2UgZG9u4oCZdCByZXBseSB0byB0aGlz

IG1lc3NhZ2UuPEJSPjwvRElWPjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9QPg==

----boundary_247_1a39e578-9c27-435d-8fed-94e351cb6a9b--





USPS Phish from Italy

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 Jan 2023 19:59:40 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pIhcv-000EVq-2g

for dave@doctor.nl2k.ab.ca;

Thu, 19 Jan 2023 19:59:37 -0700

Resent-From: The Doctor

Resent-Date: Thu, 19 Jan 2023 19:59:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mailer.sfera.net ([80.91.49.218]:55385)

by doctor.nl2k.ab.ca with esmtp (Exim 4.96)

(envelope-from )

id 1pIgcu-000C81-05

for doctor@nk.ca;

Thu, 19 Jan 2023 18:55:37 -0700

Received: from serverbis.sfera.net (unknown [80.91.49.226])

by mailer.sfera.net (Postfix) with ESMTP id 393871E86A5

for ; Fri, 20 Jan 2023 02:53:01 +0100 (CET)

Received: from serverbis.sfera.net (localhost.localdomain [127.0.0.1])

by serverbis.sfera.net (Postfix) with ESMTP id 2F7818809A

for ; Fri, 20 Jan 2023 02:53:01 +0100 (CET)

Received: (from apache@localhost)

by serverbis.sfera.net (8.13.8/8.13.8/Submit) id 30K1r0uI023848;

Fri, 20 Jan 2023 02:53:00 +0100

Date: Fri, 20 Jan 2023 02:53:00 +0100

Message-Id: <202301200153.30K1r0uI023848@serverbis.sfera.net>

To: doctor@nk.ca

Subject: Pay for your parcel number 92612927005044004682547103 : Important!

From: USPS - Canada

MIME-Version: 1.0

Content-Type: multipart/mixed;boundary=453f48a3c4116f2c1b908168489b1070

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear User, Package Tracking Number : 92612927005044004682547103.

Confirm payment to complete delivery as soon as possible.



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[80.91.49.218 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[80.91.49.218 listed in bl.score.senderscore.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[80.91.49.218 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

3.0 URI_WP_DIRINDEX URI for compromised WordPress site, possible malware

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Pay for your parcel number 92612927005044004682547103 : Important!



--453f48a3c4116f2c1b908168489b1070

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: base64



PGRpdiBpZD0id3JhcHBlciIgc3R5bGU9ImJvcmRlcjogMXB4IHNvbGlkICNmZmZmZmY7IG1hcmdp

bjogMjBweCBhdXRvOyBwYWRkaW5nOiA3cHggMTNweDsgY29sb3I6ICMwMDAwMDA7IGZvbnQtZmFt

aWx5OiAnVGltZXMgTmV3IFJvbWFuJzsgZm9udC1zaXplOiBtZWRpdW07IGZvbnQtc3R5bGU6IG5v

cm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgb3JwaGFu

czogMjsgdGV4dC1hbGlnbjogbGVmdDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06

IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdpZG93czogMjsgd29yZC1zcGFjaW5nOiAwcHg7

IHdpZHRoOiA0MzRweDsgaGVpZ2h0OiA0NDRweDsgYmFja2dyb3VuZC1jb2xvcjogI2ZmZmZmZjsi

PjxjZW50ZXI+CjxwPjxpbWcgYWx0PSIiIHNyYz0iaHR0cHM6Ly9sb2dvZG93bmxvYWQub3JnL3dw

LWNvbnRlbnQvdXBsb2Fkcy8yMDIxLzAzL3VuaXRlZC1zdGF0ZXMtcG9zdGFsLXNlcnZpY2UtdXNw

cy1sb2dvLTEucG5nIiBzdHlsZT0id2lkdGg6IDMwMHB4OyBoZWlnaHQ6IHB4OyIgLz48L3A+Cjwv

Y2VudGVyPjxiciAvPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogQXJpYWw7IGZvbnQtd2VpZ2h0

OiBib2xkOyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBBcmlhbDsgZm9udC13ZWlnaHQ6IGJv

bGQ7Ij5EZWFyIFVzZXIsPGJyIC8+PGJyIC8+PC9zcGFuPjwvc3Bhbj4KPHA+UGFja2FnZSBUcmFj

a2luZyBOdW1iZXIgOiA5MjYxMjkyNzAwNTA0NDAwNDY4MjU0NzEwMy48L3A+CjxwPkNvbmZpcm0g

cGF5bWVudCB0byBjb21wbGV0ZSBkZWxpdmVyeSBhcyBzb29uIGFzIHBvc3NpYmxlLjwvcD4KPHA+

V2UgbG9vayBmb3J3YXJkIHRvIHN1cHBvcnRpbmcgeW91ciBzaGlwcGluZyBuZWVkcyEuPC9wPgo8

YnIgLz4KPGRpdiBpZD0ic29sdSIgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsgYm9yZGVyLWJv

dHRvbTogMXB4IHNvbGlkICMxMzQyOTA7IHBhZGRpbmctYm90dG9tOiAxOHB4OyBtYXJnaW4tYm90

dG9tOiA1cHg7IG1hcmdpbi10b3A6IDE3cHg7Ij48YSBocmVmPSJodHRwczovL3JpdmVyc2lkZS5l

ZHUucGgvd3AtY29udGVudC9TdXBzYS8iPlBheSBub3c8L2E+PC9kaXY+CjxjZW50ZXI+PHNwYW4g

c3R5bGU9ImZvbnQtZmFtaWx5OiBBcmlhbDsgZm9udC13ZWlnaHQ6IGJvbGQ7Ij5Ob3RlOiA8L3Nw

YW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBBcmlhbDsiPklmIGEgbmV3IGRlbGl2ZXJ5IGlz

IG5vdCBzY2hlZHVsZWQgd2l0aGluIDQ4IGhvdXJzLCB0aGUgcGFja2FnZSB3aWxsIGJlIHJldHVy

bmVkIHRvIHRoZSBzZW5kZXIuIFNoaXBwaW5nIGFuZCBoYW5kbGluZyBjaGFyZ2VzIHdpbGwgbm90

IGJlIHJlZnVuZGVkLjwvc3Bhbj48L2NlbnRlcj4KPGRpdiBzdHlsZT0idGV4dC1hbGlnbjogY2Vu

dGVyOyBib3JkZXItYm90dG9tOiAxcHggc29saWQgIzEzNDI5MDsgcGFkZGluZy1ib3R0b206IDE4

cHg7IG1hcmdpbi1ib3R0b206IDVweDsgbWFyZ2luLXRvcDogMTdweDsiPjxiciAvPjxiciAvPjxz

cGFuIHN0eWxlPSJ2ZXJ0aWNhbC1hbGlnbjogaW5oZXJpdDsiPjxzcGFuIHN0eWxlPSJ2ZXJ0aWNh

bC1hbGlnbjogaW5oZXJpdDsiPjxzY3Bhbj5Db3B5cmlnaHQgMjAyMyBVU1BTLiA8L3NjcGFuPjwv

c3Bhbj48L3NwYW4+PGltZyBhbHQ9IiIgc3JjPSJodHRwczovL2xvZ29kb3dubG9hZC5vcmcvd3At

Y29udGVudC91cGxvYWRzLzIwMjEvMDMvdW5pdGVkLXN0YXRlcy1wb3N0YWwtc2VydmljZS11c3Bz

LWxvZ28tMS5wbmciIHN0eWxlPSJ3aWR0aDogMTEwcHg7IGhlaWdodDogMzNweDsiIC8+PC9kaXY+

CjxkaXYgaWQ9ImZvb3RlciIgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPgo8ZGl2IGlkPSJt

ZW51IiBzdHlsZT0ibWFyZ2luOiAtMzdweCAtMTQ4cHggLTM3cHggYXV0bzsiPjwvZGl2Pgo8L2Rp

dj4KPC9kaXY+



--453f48a3c4116f2c1b908168489b1070--