Fedex phish from Microsoft Outlook
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 28 Dec 2023 06:59:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))
(envelope-from)
id 1rIqu7-000000005Du-1sou
for dave@doctor.nl2k.ab.ca;
Thu, 28 Dec 2023 06:58:31 -0700
Resent-From: The Doctor
Resent-Date: Thu, 28 Dec 2023 06:58:31 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-am7eur03on2132.outbound.protection.outlook.com ([40.107.105.132]:2688 helo=EUR03-AM7-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97 (FreeBSD))
(envelope-from)
id 1rInER-00000000PN5-3MnG
for doctor@doctor.nl2k.ab.ca;
Thu, 28 Dec 2023 03:04:06 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=OX9SKkBkinQ9OjwZrksuEUWRuhfT9JjNWh2KusSKUY0L05aqqArHmOGc36YQ50iS7Nlu26Pb6xV9C1A9BsfSEmhR44WoUDeMjt0VfJ0tp/HR21vWxnPw65kLFVC5ASiVNfIhC9PRZWcgcaUI6fVvQR4pOjKklNBXZsaLP+eMmgS6CatPkK9vWXC2UYwmUtsOafoTMSePcVP6An9HB7kU2nri75Pa475BAwAIofTvtfGoHMfqrWNiaQpUyOHM5hvAE0g5ykJ0PX7dOB08l/I7EADYMml9tszPjIfNTqhsOACldN9s97ZeVRIby2OOiCcxoBa8pll/APLv8kK9ybhKDQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=CgUAYRvJKjwvMu7zSmBJ9V80/yxuqKiBRfxMqsGFFE4=;
b=d7SmWYWkJr/VoQn+58nMAJzr50JZlfwEPacRfuZmY+MCZlDUzROERa4pBrZgeMXhzSAEY5F54nlElKeGl4wY5M462S5t8htpGkjDCHGYpoWu4R32oo3o9zQigYTiWeMDo4re1X+ez+nPblryvXG01v6WhWBXyodXW3FvVsD3S4uwrsgWOqzgeKhxNbjsJGgTtNG+nukhDir3earGNdY2v0huGp4pG3bMWk/Zg5HksQsrOHf1p/kpZU3TRL+CN77p1G7PjnmiuqY8sg6CjCSk4/HbsvEHeuZ241ptn2EV8+erg1Gs8TZjLlmgVrPD0l55Z2sFWpOTQdIRZo14gjMPGA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
45.79.211.243) smtp.rcpttodomain=doctor.nl2k.ab.ca
smtp.mailfrom=martinho759.onmicrosoft.com; dmarc=none action=none
header.from=martinho759.onmicrosoft.com; dkim=none (message not signed);
arc=none (0)
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 45.79.211.243)
smtp.mailfrom=martinho759.onmicrosoft.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=martinho759.onmicrosoft.com;
X-TOI-MSGID: <529217336.C6D069B7A88A2.1703757295507@thompson.com>
From: =?UTF-8?B?RmVkZXggQ29uZmlybWF0aW9uIA==?=
Importance: high
Subject: =?UTF-8?B?SW1wb3J0YW50IFNoaXBtZW50IFVwZGF0ZTogWW91ciBEZWxpdmVyeSBQcm9ncmVzcw==?=
MIME-Version: 1.0
CC: doctor@doctor.nl2k.ab.ca
To: doctor@doctor.nl2k.ab.ca
In-Reply-To:
Date: Thu, 28 Dec 2023 10:54:55 +0100
Content-Type: multipart/alternative; charset="UTF-8";boundary="PART_XENZ.cgvadkqb"
Message-ID:
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: AMS0EPF00000195:EE_|DBAPR07MB6629:EE_
X-MS-Office365-Filtering-Correlation-Id: 263cdafb-ecf1-42a0-b5b5-08dc078be98d
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
qi/frShUumS2l7sCYppwPnMwy/TPWpiHkFHH7+i+tIidqe0HuwaQtMGDSY7Xxul/4T1jMAnC8b/aMwdcixxOCg74BjGQKrRs63c2c/BzsG5ZMVcv4adeMrzceTGVJaBDHJk5GEdUyYjOWKPSM4QrDZcB0hI9ql4V9VU/1l7+O8wyLfjdhr5XtW3Ojv5kWZwbh0TCngw/HHG5BCUfujUzx5Rex1qRl3zaE5S55Ovt52PdkXP3+TUmrREUonegVZs5iP5KgP2KP4LW6RHgdStzkj6WbhrolOqGIaihxMIXZNy+LnSxLnKq8V9xfM3I2YY1YZYbkV0/wQBInUBwgs05cQUb94gvfzFicxuEjGUYoIVlszxLIQa99aXvcQyBtLAB0EWvNMI45JunF1XWNNDwE1vQS3PVj4rpTdEZrz4q53DS7qbM2tjA/UAAla2KnnEgSxfFhAR3CRoTNRFh+5z53J8KHXNcAnGx3vCvoqSTzkDIC36CJQicAPT8ZqRpv/NFMS0E35LZPfwt1LbKBbw+tCLVcM2A4QyFQFHfzKK1KChytnfAihuoOM+5+4xQ/WiuBV73UbBaZnU4d/S02sSeOJqvD/rC44HvFxhspSSQvzV9F2ouzjhhJyeD3IRqfeTG6QVOb4LHSPry4+4IKif9nSvBjR+epgs3rRrPB0WNg7I=
X-Forefront-Antispam-Report:
CIP:45.79.211.243;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.thompson.com;PTR:45-79-211-243.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(376002)(346002)(39850400004)(136003)(396003)(230922051799003)(82310400011)(186009)(451199024)(7200799017)(1690799017)(64100799003)(61400799012)(46966006)(36840700001)(40470700004)(31696002)(41320700001)(19625305002)(5660300002)(26005)(2906002)(336012)(786003)(70586007)(70206006)(316002)(42186006)(6916009)(10290500003)(33964004)(4326008)(9686003)(478600001)(8676002)(8936002)(166002)(41300700001)(81166007)(47076005)(82740400003)(34070700002)(36860700001)(85622046)(40460700003)(40480700001)(564344004)(8400799017);DIR:OUT;SFP:1102;
X-OriginatorOrg: martinho759.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Dec 2023 10:01:07.7807
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 263cdafb-ecf1-42a0-b5b5-08dc078be98d
X-MS-Exchange-CrossTenant-Id: 7a268d00-c3d2-4549-8ed1-02bbc87ef194
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=7a268d00-c3d2-4549-8ed1-02bbc87ef194;Ip=[45.79.211.243];Helo=[mail.thompson.com]
X-MS-Exchange-CrossTenant-AuthSource:
AMS0EPF00000195.eurprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBAPR07MB6629
X-Antivirus: AVG (VPS 231227-4, 12/27/2023), Inbound message
X-Antivirus-Status: Clean
--PART_XENZ.cgvadkqb
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset="UTF-8"
(3999) Notifications For YOU
--PART_XENZ.cgvadkqb--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 28 Dec 2023 06:59:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))
(envelope-from
id 1rIqu7-000000005Du-1sou
for dave@doctor.nl2k.ab.ca;
Thu, 28 Dec 2023 06:58:31 -0700
Resent-From: The Doctor
Resent-Date: Thu, 28 Dec 2023 06:58:31 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-am7eur03on2132.outbound.protection.outlook.com ([40.107.105.132]:2688 helo=EUR03-AM7-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97 (FreeBSD))
(envelope-from
id 1rInER-00000000PN5-3MnG
for doctor@doctor.nl2k.ab.ca;
Thu, 28 Dec 2023 03:04:06 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=OX9SKkBkinQ9OjwZrksuEUWRuhfT9JjNWh2KusSKUY0L05aqqArHmOGc36YQ50iS7Nlu26Pb6xV9C1A9BsfSEmhR44WoUDeMjt0VfJ0tp/HR21vWxnPw65kLFVC5ASiVNfIhC9PRZWcgcaUI6fVvQR4pOjKklNBXZsaLP+eMmgS6CatPkK9vWXC2UYwmUtsOafoTMSePcVP6An9HB7kU2nri75Pa475BAwAIofTvtfGoHMfqrWNiaQpUyOHM5hvAE0g5ykJ0PX7dOB08l/I7EADYMml9tszPjIfNTqhsOACldN9s97ZeVRIby2OOiCcxoBa8pll/APLv8kK9ybhKDQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=CgUAYRvJKjwvMu7zSmBJ9V80/yxuqKiBRfxMqsGFFE4=;
b=d7SmWYWkJr/VoQn+58nMAJzr50JZlfwEPacRfuZmY+MCZlDUzROERa4pBrZgeMXhzSAEY5F54nlElKeGl4wY5M462S5t8htpGkjDCHGYpoWu4R32oo3o9zQigYTiWeMDo4re1X+ez+nPblryvXG01v6WhWBXyodXW3FvVsD3S4uwrsgWOqzgeKhxNbjsJGgTtNG+nukhDir3earGNdY2v0huGp4pG3bMWk/Zg5HksQsrOHf1p/kpZU3TRL+CN77p1G7PjnmiuqY8sg6CjCSk4/HbsvEHeuZ241ptn2EV8+erg1Gs8TZjLlmgVrPD0l55Z2sFWpOTQdIRZo14gjMPGA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
45.79.211.243) smtp.rcpttodomain=doctor.nl2k.ab.ca
smtp.mailfrom=martinho759.onmicrosoft.com; dmarc=none action=none
header.from=martinho759.onmicrosoft.com; dkim=none (message not signed);
arc=none (0)
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 45.79.211.243)
smtp.mailfrom=martinho759.onmicrosoft.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=martinho759.onmicrosoft.com;
X-TOI-MSGID: <529217336.C6D069B7A88A2.1703757295507@thompson.com>
From: =?UTF-8?B?RmVkZXggQ29uZmlybWF0aW9uIA==?=
Importance: high
Subject: =?UTF-8?B?SW1wb3J0YW50IFNoaXBtZW50IFVwZGF0ZTogWW91ciBEZWxpdmVyeSBQcm9ncmVzcw==?=
MIME-Version: 1.0
CC: doctor@doctor.nl2k.ab.ca
To: doctor@doctor.nl2k.ab.ca
In-Reply-To:
Date: Thu, 28 Dec 2023 10:54:55 +0100
Content-Type: multipart/alternative; charset="UTF-8";boundary="PART_XENZ.cgvadkqb"
Message-ID:
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: AMS0EPF00000195:EE_|DBAPR07MB6629:EE_
X-MS-Office365-Filtering-Correlation-Id: 263cdafb-ecf1-42a0-b5b5-08dc078be98d
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
qi/frShUumS2l7sCYppwPnMwy/TPWpiHkFHH7+i+tIidqe0HuwaQtMGDSY7Xxul/4T1jMAnC8b/aMwdcixxOCg74BjGQKrRs63c2c/BzsG5ZMVcv4adeMrzceTGVJaBDHJk5GEdUyYjOWKPSM4QrDZcB0hI9ql4V9VU/1l7+O8wyLfjdhr5XtW3Ojv5kWZwbh0TCngw/HHG5BCUfujUzx5Rex1qRl3zaE5S55Ovt52PdkXP3+TUmrREUonegVZs5iP5KgP2KP4LW6RHgdStzkj6WbhrolOqGIaihxMIXZNy+LnSxLnKq8V9xfM3I2YY1YZYbkV0/wQBInUBwgs05cQUb94gvfzFicxuEjGUYoIVlszxLIQa99aXvcQyBtLAB0EWvNMI45JunF1XWNNDwE1vQS3PVj4rpTdEZrz4q53DS7qbM2tjA/UAAla2KnnEgSxfFhAR3CRoTNRFh+5z53J8KHXNcAnGx3vCvoqSTzkDIC36CJQicAPT8ZqRpv/NFMS0E35LZPfwt1LbKBbw+tCLVcM2A4QyFQFHfzKK1KChytnfAihuoOM+5+4xQ/WiuBV73UbBaZnU4d/S02sSeOJqvD/rC44HvFxhspSSQvzV9F2ouzjhhJyeD3IRqfeTG6QVOb4LHSPry4+4IKif9nSvBjR+epgs3rRrPB0WNg7I=
X-Forefront-Antispam-Report:
CIP:45.79.211.243;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.thompson.com;PTR:45-79-211-243.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(376002)(346002)(39850400004)(136003)(396003)(230922051799003)(82310400011)(186009)(451199024)(7200799017)(1690799017)(64100799003)(61400799012)(46966006)(36840700001)(40470700004)(31696002)(41320700001)(19625305002)(5660300002)(26005)(2906002)(336012)(786003)(70586007)(70206006)(316002)(42186006)(6916009)(10290500003)(33964004)(4326008)(9686003)(478600001)(8676002)(8936002)(166002)(41300700001)(81166007)(47076005)(82740400003)(34070700002)(36860700001)(85622046)(40460700003)(40480700001)(564344004)(8400799017);DIR:OUT;SFP:1102;
X-OriginatorOrg: martinho759.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Dec 2023 10:01:07.7807
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 263cdafb-ecf1-42a0-b5b5-08dc078be98d
X-MS-Exchange-CrossTenant-Id: 7a268d00-c3d2-4549-8ed1-02bbc87ef194
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=7a268d00-c3d2-4549-8ed1-02bbc87ef194;Ip=[45.79.211.243];Helo=[mail.thompson.com]
X-MS-Exchange-CrossTenant-AuthSource:
AMS0EPF00000195.eurprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBAPR07MB6629
X-Antivirus: AVG (VPS 231227-4, 12/27/2023), Inbound message
X-Antivirus-Status: Clean
--PART_XENZ.cgvadkqb
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset="UTF-8"
|
--PART_XENZ.cgvadkqb--