Recruitment employer spam from Hotmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Feb 2023 08:48:06 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pU8Ne-000BjY-2Y

for dave@doctor.nl2k.ab.ca;

Mon, 20 Feb 2023 08:47:06 -0700

Resent-From: The Doctor

Resent-Date: Mon, 20 Feb 2023 08:47:06 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-mw2nam12olkn2046.outbound.protection.outlook.com ([40.92.23.46]:64821 helo=NAM12-MW2-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pU3lF-000MaO-01

for sales@nk.ca;

Mon, 20 Feb 2023 03:51:10 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=WZ4J5d5pOcfOQuYm0870nKC0CjsYP7I1xqHOA5eJZZOcDFwm1qmJi9lyMzyy6DvIeREoechzSiv1q3L1FX2faor2Sl+MfCbOsMaJJOdxs/sJIqegD9Qrzhde8EaKCPTqJNgDoFC1rYkH482JmgMlZspaI0AP0o1UTQMT+t7trsv+o7RUgrd9TkwWFOnrt4GVRw320dz78mrhECWHs2HfAPWgvXQG5/zPv2ph8Sxwf/cCkH8h3BsJ5f+/7+QgZDv0XaWaMsLcVzJhaNdMCieTro6UjbY2/F4djveodq6D+DoGjBcbG+1ITdMiNNjAvjfxiHOCYXoeKF2ZEKNZMRUkvA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=zqVsD5u30866Oy/Q1TPsAB4KZsenxFzpLLOClGUYrak=;

b=Jjz1tGnydgQmFV6X3VBSl3tgEpBDIXogo2AS/MrP/P6ee4bsfOFFUNF6HOgZ3ldSO7NGji3C4eBg+OqgvjFOXsWaZ4JnMLA9Y2veTsaBNjZUg9UbBB6sYA2zUbzDzdDbVYlyGsBW3m0VFFWiUEwi5rmgppniebDODMYNlgxGwcqpnQFN5vOVxRmseCX6bpmX5QCr6CSst4lz3HiVZ9x/RbxY8gV4HKUnBsrDEVAZ8XBVPl6ZG1u1P2hlVofIMYUMtCrYr0Sp22OhUqi5KtPyh6HQzlMGF9igaRaMKu5cjiHiKUmyoxW1Fp2bYnNpUDgFQ0ygrx0lhT0d5BFKn/zu9g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=zqVsD5u30866Oy/Q1TPsAB4KZsenxFzpLLOClGUYrak=;

b=dzu6lEPhU87Sc3cbnuIimxYa7GEwZS8IcyKIADlCtxfjDIqoHhS7X1o7Fz05uUvQjPWBeaa/nob8KE84AiowaqS1wSDC1F9TotK+cha/LiXxHlqAi8yeK5vKDwKSV9Iv3yi4uU0ragT7K/Q9te8ZSdn/MbI7AtTHnH7skAwLyhyNvQFKXbboisY8BjSUVE6m1Xfo1QCDTGt/wLnreAdPvaZ7Q4On6xQDy3OMgWDnGm2sh+Ss6z5cK7kirAvHlhVgjNvS/CzjvsH9Lalt1BJN4CKgXFeLDAUv2WBSYN1xPhFW3QnQ7TnhLU71nEZrFVjWkejN4yVm7hNSE6ci2pxk6Q==

Received: from SA0PR16MB3869.namprd16.prod.outlook.com (2603:10b6:806:80::22)

by CH3PR16MB5250.namprd16.prod.outlook.com (2603:10b6:610:155::15) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6111.19; Mon, 20 Feb

2023 10:48:46 +0000

Received: from SA0PR16MB3869.namprd16.prod.outlook.com

([fe80::5101:8457:b825:c665]) by SA0PR16MB3869.namprd16.prod.outlook.com

([fe80::5101:8457:b825:c665%4]) with mapi id 15.20.6111.020; Mon, 20 Feb 2023

10:48:46 +0000

From: "Judith"

To: "Judith"

Subject: Dedicated Recruiter for Hire !!

Date: Mon, 20 Feb 2023 16:16:30 +0530

Message-ID:



Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0029_01D94547.01035350"

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: AdlFGHSuvLZe4Hz/SAOYObhN1n5sQw==

Content-Language: en-us

X-TMN: [hHwC3OD1U4eA+1np2E4z+omSK3jF9Qcl]

X-ClientProxiedBy: BM1P287CA0024.INDP287.PROD.OUTLOOK.COM

(2603:1096:b00:40::25) To SA0PR16MB3869.namprd16.prod.outlook.com

(2603:10b6:806:80::22)

X-Microsoft-Original-Message-ID: <002801d94518$e74b1750$b5e145f0$@com>

MIME-Version: 1.0

X-MS-Exchange-MessageSentRepresentingType: 1

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SA0PR16MB3869:EE_|CH3PR16MB5250:EE_

X-MS-Office365-Filtering-Correlation-Id: 9d7c5eb9-a311-4694-7996-08db133009b5

X-MS-Exchange-SLBlob-MailProps:

+cAEnstLRQ/xLolU0ePlo2tMws2OU3co8sFLVn+sNP2TrHcPAVUjftZc0hPqIpR2nJAlwzhj+KXS7DA6gHegosr2LRixLZFM8f65V/z5sQIeNfygBzHWrZA1/1X1P+/K9fLDys2ihvkT3lRAPI1NQzmujHP3WhTg0krkkU05iDWVxSJnzy7oZ19ADdFA2oNrtPoYRh/Bi+m29a6U7EOBfSCjO2scN0fjiAH0I36L1ErunB3x3T5ancqRuCAo8L+zQ2rRlcwRNQCCPJpYh8ioM29H9Kh1ZxETZPInsYk99mE/17+z6MirVjPC7lGidVp4vq8HT+y+Fg0vijsLFWeA/y2jyPuuqGsI2SZ+0TVMXXZJsKj5mkxZ8fbulECJxEWYBtGLNBw+o9WEVoL5Myp3Jknfi1/pawO43CHFLW4jPsNcwj8eSLtqbzQxr0ERrcwyL7gkpsXHe32HCPUtOnSczK/LNSA32X/CaFqWA1ecZHERx/PfpOmHYCKECLR3xlvqs87GRoZDOXNggqPMzoVKKoqOGONcCyctJtJ58A7lZzAyTLJQLx/ZtSKxPkBf2soxHdgtljYW4+jJXN4UCKWFzX85+woCrwCpjBH8h8BHJfB2J26wv84TE3ngGKdaxfbprXBXFCpP6YbVcobAms3xK8BAhbBcDksvpg9NY5tJgSUA3Qfe1+lE0w==

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

r1dGXr8fmKH0FoB4Fj6D33B0RH04Xujs/HxAnYi/7KUvo+gBOhu6ea4IQElwDKNihQiaAXTZdtHhcjZayBaupYyZ0zVSmZIgER+rfHyqL1tksPClerM2YyHP8LNkPpIoaQQIKAJkh5UbAv2gQTD14RGA/7w3lJ1MwOytqmLxmNF0tmdhfRwEjnBvJrv6vYmQ+Qk7vDGvZ9FZDyMx4eCQZlCU9wDqSM6JMHxW8F5ldqVmXqF5zWV+ZVQ+Eb9OKyccQ38Nb4l4ts/i/G+Z6SGYqxpx1m2XP1i9uRO/Y5/xENCJ9xQ6X1gxL5tpBQ0vrqDNmI2kb+EyL5k5pOpBBWHptHPJhfvrLwE4eGZZnKJvTFreN1reYSPIGntWxq//ZPAIf3xHkONB9deYLx72DWuzoMS30QqT7nm44kYmMYSeOk1bvFSOQaZyKXR8kH56nF5lgI8RnGewcfgL51b1QDKCT5opBp2iJ/SWvivlNKMjlFJKTW6tct7RqHTOUoXkG8P4m2KJBdwjBwngGjj8omK4cn95ZA/UV4ZEevO8Kacla0ektv8k76OQ8FGweLRi1WoeKUs8uhbD4L/W8fHLh/u5DFn4L/uL0KUbp9kPlb8AkVUzx0eVUpeKDBs6N6E4awIStgws1fjWSjr3IEU8E/G0wQ==

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?us-ascii?Q?UYWGJkBcIcoyyiaAuTgiHCbEHt9Vd41xE4qVavnbwufRlz8sQ9KZnLFoU+4k?=

=?us-ascii?Q?fG8WbdmHgHiKLouO1G8EQy+PK7SR9K8xn5wmg5TRyhuHiPRy9E+NWfIujdvP?=

=?us-ascii?Q?/NlTFxs9hzBx3oX1w4BlMqgJrd3w+iqz5FLwG8o0peU6wB7i3MRpVPcEIuhk?=

=?us-ascii?Q?ukbMyjqQvIFdyj4sBzlys5TnDOOqdQPhTWZtTF+kazZm0gZ4LLIwCbNYCh7n?=

=?us-ascii?Q?Z58GilPegiGLo5L8vVCFwsNuvMu5MveoVBjsSUVfISG0hS/ISv1SDknOrABm?=

=?us-ascii?Q?e+uQhp+b/7aL6N09PQd4z8cUUSihPgcO79R4WK513RbGV6hrZoeuE7QV4mqR?=

=?us-ascii?Q?st/geaiIMiBu9iXaDt2PV+pwf1SmyVdle9YuQRQ/gyEWLT1CAznfG/sVTbUq?=

=?us-ascii?Q?pmSq1+veSpnK1j2G1GJJljy5Q6SbImiYPhuOQYDP8BGKcxEOIskM8mgs0REr?=

=?us-ascii?Q?Qeb8u0btAc3lO9rrGVWKR6pko+R6vrbLxUqbblV6eCtasSGyA+oSGOR3BHaC?=

=?us-ascii?Q?vsQpqxdFFdFbLsZUC0tuStg+iqqtUSusN8znwzVXtwCR1VMFFaacYqgSkYKu?=

=?us-ascii?Q?Np3CWl9Kas9eonL9JWmwPIJtbrEo20A2N3GU4oBcb6faiAMXfussMZnDIb0A?=

=?us-ascii?Q?OhkCgx80z5vuwM+Bpugs2FstSJgJEpIgyqRdNuR9y8zO0WH4coWqfvW6I4Oz?=

=?us-ascii?Q?Ut8xV2CXH98rne3bjexxp9ZsGpV6OBYe96Zv3UUwpoc64Rlhnw/LWKDIbVrr?=

=?us-ascii?Q?Am+tr/HXxvzDgYUS5Tg6wxDUo/N3d4whpFNZqPNqvgOr1pSkidbfwH4w62Rx?=

=?us-ascii?Q?K8SpdOJEHBtqM4PiaPJCsKH3N4antGofQrN6FYj9eu6IQpq7m+5tV2igC9ju?=

=?us-ascii?Q?OTQ13wSjK1S/42IFCrnKq89yyflnB2+ZnpBNW8F7kabYJ55dttBlJ98YJ+rD?=

=?us-ascii?Q?UHCVnDYQnXpF4mQ9AZiHM7BS8vEi5GSMlmcpL9WziB4rmAx4Mk9qpbngCOm+?=

=?us-ascii?Q?7azVTZdVirVxiUT0QJcnWw5M5on2xMCA4qMjg9uK8RYkxWFQ58QL/f0U4Y6x?=

=?us-ascii?Q?vwhhDA7KVb0NEJi2v6/5hpIBxxXYn6UPjTfnhkNMCXYQ6o+99KxS9NuEIMIO?=

=?us-ascii?Q?/SGBUf9ycykmL+zmFuEXAYWKYxXk+FOp2a6SY+Ei3QQfAHOjkoYx32nbYQWM?=

=?us-ascii?Q?xYCS0+OtDcLQBVdon3u8NmoRLHgDaH3XWW9anYk33pYE/nLmnKolO4A5Ykn2?=

=?us-ascii?Q?zTcAInWW+d2R8Y2Hy+N/rxNonb2y5BLHGFy4VWf1bw=3D=3D?=

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-Network-Message-Id: 9d7c5eb9-a311-4694-7996-08db133009b5

X-MS-Exchange-CrossTenant-AuthSource: SA0PR16MB3869.namprd16.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Feb 2023 10:48:46.1935

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:

00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR16MB5250



------=_NextPart_000_0029_01D94547.01035350

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,



We are a specialist RPO (Recruitment Process Outsourcing) firm that provides

a Dedicated Remote Recruiters at a reasonable price who could assist you to

find the right candidate as per your requirement and handle all the

recruitment needs of your company.



If so, let's set up a time to chat/call to discuss the further steps if this

is something you are looking for!

I will gladly answer any questions you may have.



Regards,

Judith





------=_NextPart_000_0029_01D94547.01035350

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">


>



















Hi,
span>





We are a specialist RPO (Recruitment Proce=

ss

Outsourcing) firm that provides a Dedicated Remote Recruiters at a reasonab=

le

price who could assist you to find the right candidate as per your requirem=

ent

and handle all the recruitment needs of your company.



 


If so, let’s set up a time to chat/c=

all to

discuss the further steps if this is something you are looking for!
<=

br>

I will gladly answer any questions you may=

have.



 


Regards,


Judith

















------=_NextPart_000_0029_01D94547.01035350--

Nigerian Beneficiary spam from Hotmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Feb 2023 01:33:16 -0700

Received: from 124x35x5x2.ap124.ftth.ucom.ne.jp ([124.35.5.2]:2107 helo=mail-smtp.pappy.jp)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pU1as-000GZ3-18

for dave@doctor.nl2k.ab.ca;

Mon, 20 Feb 2023 01:32:15 -0700

Received: from User (128-162.prod.194964.com [172.16.128.162])

by mail-smtp.pappy.jp (Postfix) with SMTP id 077B626FD86;

Mon, 20 Feb 2023 14:25:12 +0900 (JST)

Reply-To:

From: "Mr. George McConnell"

Subject: Greetings To You..

Date: Sun, 19 Feb 2023 21:25:25 -0800

MIME-Version: 1.0

Content-Type: text/plain;

charset="Windows-1251"

Content-Transfer-Encoding: 7bit

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

X-Spam_score: 23.9

X-Spam_score_int: 239

X-Spam_bar: +++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ATTENTION: Beneficiary. I am writing to inform you that your

compensation/winning payment was approved today by the Board and Directors

of the United Nation Committee on Rewards and Compensation. You are hereby

required to reconfirm your following details as to enable the financial department

to release your funds to you without any delay.



Content analysis details: (23.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

0.0 NSL_RCVD_FROM_USER Received from User

0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[georgemcconnell100(at)outlook.com]

1.2 MISSING_HEADERS Missing To: header

1.5 HK_SCAM_N8 BODY: No description available.

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority

0.0 FROM_MISSP_USER From misspaced, from "User"

2.0 HK_SCAM No description available.

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 HK_NAME_MR_MRS No description available.

0.0 T_HK_NAME_MR_MRS No description available.

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS

0.0 FROM_MISSPACED From: missing whitespace

0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.0 PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC with FP steps

0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

2.5 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool

1.8 FORM_FRAUD_3 Fill a form and several fraud phrases

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Greetings To You..



ATTENTION: Beneficiary.





I am writing to inform you that your compensation/winning payment was approved today by the Board and Directors of the United Nation Committee on Rewards and Compensation.



You are hereby required to reconfirm your following details as to enable the financial department to release your funds to you without any delay.



Thus, reconfirm the following:



1. Your full name:

2. Your residential address:

3. Your direct phone number:

4. Your age:



We look forward to your prompt response.



Thank you.



Mr. George McConnell.

Director of Payment,

UN Foreign Office.