Fedex phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 28 Dec 2023 06:59:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1rIqu7-000000005Du-1sou

for dave@doctor.nl2k.ab.ca;

Thu, 28 Dec 2023 06:58:31 -0700

Resent-From: The Doctor

Resent-Date: Thu, 28 Dec 2023 06:58:31 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-am7eur03on2132.outbound.protection.outlook.com ([40.107.105.132]:2688 helo=EUR03-AM7-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97 (FreeBSD))

(envelope-from )

id 1rInER-00000000PN5-3MnG

for doctor@doctor.nl2k.ab.ca;

Thu, 28 Dec 2023 03:04:06 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=OX9SKkBkinQ9OjwZrksuEUWRuhfT9JjNWh2KusSKUY0L05aqqArHmOGc36YQ50iS7Nlu26Pb6xV9C1A9BsfSEmhR44WoUDeMjt0VfJ0tp/HR21vWxnPw65kLFVC5ASiVNfIhC9PRZWcgcaUI6fVvQR4pOjKklNBXZsaLP+eMmgS6CatPkK9vWXC2UYwmUtsOafoTMSePcVP6An9HB7kU2nri75Pa475BAwAIofTvtfGoHMfqrWNiaQpUyOHM5hvAE0g5ykJ0PX7dOB08l/I7EADYMml9tszPjIfNTqhsOACldN9s97ZeVRIby2OOiCcxoBa8pll/APLv8kK9ybhKDQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=CgUAYRvJKjwvMu7zSmBJ9V80/yxuqKiBRfxMqsGFFE4=;

b=d7SmWYWkJr/VoQn+58nMAJzr50JZlfwEPacRfuZmY+MCZlDUzROERa4pBrZgeMXhzSAEY5F54nlElKeGl4wY5M462S5t8htpGkjDCHGYpoWu4R32oo3o9zQigYTiWeMDo4re1X+ez+nPblryvXG01v6WhWBXyodXW3FvVsD3S4uwrsgWOqzgeKhxNbjsJGgTtNG+nukhDir3earGNdY2v0huGp4pG3bMWk/Zg5HksQsrOHf1p/kpZU3TRL+CN77p1G7PjnmiuqY8sg6CjCSk4/HbsvEHeuZ241ptn2EV8+erg1Gs8TZjLlmgVrPD0l55Z2sFWpOTQdIRZo14gjMPGA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

45.79.211.243) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=martinho759.onmicrosoft.com; dmarc=none action=none

header.from=martinho759.onmicrosoft.com; dkim=none (message not signed);

arc=none (0)

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 45.79.211.243)

smtp.mailfrom=martinho759.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=martinho759.onmicrosoft.com;

X-TOI-MSGID: <529217336.C6D069B7A88A2.1703757295507@thompson.com>

From: =?UTF-8?B?RmVkZXggQ29uZmlybWF0aW9uIA==?=

Importance: high

Subject: =?UTF-8?B?SW1wb3J0YW50IFNoaXBtZW50IFVwZGF0ZTogWW91ciBEZWxpdmVyeSBQcm9ncmVzcw==?=

MIME-Version: 1.0

CC: doctor@doctor.nl2k.ab.ca

To: doctor@doctor.nl2k.ab.ca

In-Reply-To:

Date: Thu, 28 Dec 2023 10:54:55 +0100

Content-Type: multipart/alternative; charset="UTF-8";boundary="PART_XENZ.cgvadkqb"

Message-ID:



X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: AMS0EPF00000195:EE_|DBAPR07MB6629:EE_

X-MS-Office365-Filtering-Correlation-Id: 263cdafb-ecf1-42a0-b5b5-08dc078be98d

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

qi/frShUumS2l7sCYppwPnMwy/TPWpiHkFHH7+i+tIidqe0HuwaQtMGDSY7Xxul/4T1jMAnC8b/aMwdcixxOCg74BjGQKrRs63c2c/BzsG5ZMVcv4adeMrzceTGVJaBDHJk5GEdUyYjOWKPSM4QrDZcB0hI9ql4V9VU/1l7+O8wyLfjdhr5XtW3Ojv5kWZwbh0TCngw/HHG5BCUfujUzx5Rex1qRl3zaE5S55Ovt52PdkXP3+TUmrREUonegVZs5iP5KgP2KP4LW6RHgdStzkj6WbhrolOqGIaihxMIXZNy+LnSxLnKq8V9xfM3I2YY1YZYbkV0/wQBInUBwgs05cQUb94gvfzFicxuEjGUYoIVlszxLIQa99aXvcQyBtLAB0EWvNMI45JunF1XWNNDwE1vQS3PVj4rpTdEZrz4q53DS7qbM2tjA/UAAla2KnnEgSxfFhAR3CRoTNRFh+5z53J8KHXNcAnGx3vCvoqSTzkDIC36CJQicAPT8ZqRpv/NFMS0E35LZPfwt1LbKBbw+tCLVcM2A4QyFQFHfzKK1KChytnfAihuoOM+5+4xQ/WiuBV73UbBaZnU4d/S02sSeOJqvD/rC44HvFxhspSSQvzV9F2ouzjhhJyeD3IRqfeTG6QVOb4LHSPry4+4IKif9nSvBjR+epgs3rRrPB0WNg7I=

X-Forefront-Antispam-Report:

CIP:45.79.211.243;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.thompson.com;PTR:45-79-211-243.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(376002)(346002)(39850400004)(136003)(396003)(230922051799003)(82310400011)(186009)(451199024)(7200799017)(1690799017)(64100799003)(61400799012)(46966006)(36840700001)(40470700004)(31696002)(41320700001)(19625305002)(5660300002)(26005)(2906002)(336012)(786003)(70586007)(70206006)(316002)(42186006)(6916009)(10290500003)(33964004)(4326008)(9686003)(478600001)(8676002)(8936002)(166002)(41300700001)(81166007)(47076005)(82740400003)(34070700002)(36860700001)(85622046)(40460700003)(40480700001)(564344004)(8400799017);DIR:OUT;SFP:1102;

X-OriginatorOrg: martinho759.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Dec 2023 10:01:07.7807

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 263cdafb-ecf1-42a0-b5b5-08dc078be98d

X-MS-Exchange-CrossTenant-Id: 7a268d00-c3d2-4549-8ed1-02bbc87ef194

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=7a268d00-c3d2-4549-8ed1-02bbc87ef194;Ip=[45.79.211.243];Helo=[mail.thompson.com]

X-MS-Exchange-CrossTenant-AuthSource:

AMS0EPF00000195.eurprd05.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBAPR07MB6629

X-Antivirus: AVG (VPS 231227-4, 12/27/2023), Inbound message

X-Antivirus-Status: Clean



--PART_XENZ.cgvadkqb

Content-Transfer-Encoding: 7bit

Content-Type: text/html; charset="UTF-8"











(3999) Notifications For YOU









































































































--PART_XENZ.cgvadkqb--

Ryobi Chainsaw PHish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 27 Dec 2023 18:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1rIf9r-000000002Xa-1YkY

for dave@doctor.nl2k.ab.ca;

Wed, 27 Dec 2023 18:25:59 -0700

Resent-From: The Doctor

Resent-Date: Wed, 27 Dec 2023 18:25:59 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm3nam02rlnn2043.outbound.protection.outlook.com ([40.95.34.43]:8417 helo=NAM02-DM3-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97 (FreeBSD))

id 1rIegc-000000001wp-3X9S

for doctor@doctor.nl2k.ab.ca;

Wed, 27 Dec 2023 17:55:50 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=Z698ikBfExCQCJfLfV7C1cdWoB/4foct+zBxs34csRvR7sqh2hbGUmpqfScSq3F3CrbykeHXbTy9nWKi6+sIq0VbXLlWk9g0rgK6P1D7YasDDsNbSsuL/uE3VxJjhnYKSqqG1Lsti4fJPpP2zWLXJ4qipZABS6zzDnkeI7hqDqHzfFVbxUXtion4maaRVUXyJQjB/PChRHJrWPYkgOe/57psAmeqfzWfdxZaqebv3HP+sM4TwkimdtttZcU6VGuZi9EkJkZ4ChAqQKueR0Uiqjlj3wcQ3q+swcn5IH/pRQfRlliYbHZCL+x2KTqODaVnEp1l2JU9IWPKdePgtbCTfg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=0styqUom6Rz5RZZNN6C3QyP0c1QN2ZOWD3kZ1CmdkN0=;

b=KcWlp41niq3a6EfLMWB3tI0XAMUquO/6brg59Q3kRa2CSLprIKhj+WmzQb5g9ntm7AF+utaFNot+GRQYyG2OhRthO0LbYhXKs38IavDBPJRGTQq8suoAqZophYm/ZHemZqdOg7utTmbDgbaS0pf/CYZehhhWuUauvdgXcErowjEBqdajSD910y18k1jDSslzstDLdj72cRJbscpjmoFSd+CZWsXq3NTa32qd6LDjTzZUIN9ohpkb0/Z653FUU8T0u3bF2sA0djXT4m10iTgI+uXZZJpZRfy7CrjRsLSavV4JObDa8fYpb4YoAIzl4SFtCjuXC1Ihid/dtS7XDhNU3Q==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

78.46.149.17) smtp.rcpttodomain=doctor.nl2k.ab.ca smtp.helo=mail.goldner.net;

dmarc=none action=none header.from=nvz.dtq7zh.com; dkim=none (message not

signed); arc=none (0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=4pfvf63.onmicrosoft.com; s=selector1-4pfvf63-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=0styqUom6Rz5RZZNN6C3QyP0c1QN2ZOWD3kZ1CmdkN0=;

b=dGwznh7nG/VGRqFlncI8qeJNgvzn+UnFj3umTdrJV/6ejtH+JlMcBLo2tgaWod1fr5MBEMHXaziDx1sDje4n3AwS35ykz5P82bJQwLipJVA78ejaFjeE/rPyEq5gBmpzFHlKyrURhNq1niuYR/yZQewSeUWU5c1LG04PfMZ9OjnMN19JyNUgCOy3ekt7XwXSlXGe8c43L8c1vWGjBPSWdKOQQUX2D7M6zYutYw52KGf7YmSyCnbAxD5qA7xvxZqTRzCc9SBaw215A9z3pw45gzV4JWeuk8piFeUTyUgV/pGC98EbXzbZrk+UKdVIdxmZE3pN+TnwKmRubL47y3EyhQ==

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 78.46.149.17)

smtp.helo=mail.goldner.net; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=nVz.dtQ7zH.com;

CC: doctor@doctor.nl2k.ab.ca

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

To: doctor@doctor.nl2k.ab.ca

X-TOI-MSGID: <1672204214.E18B29F673DB6.1703724695741@goldner.net>

MIME-Version: 1.0

Subject: Your order has shipped! - Ryobi One Chainsaw

Date: Thu, 28 Dec 2023 01:51:35 +0100

In-Reply-To:

From: Welcome

Importance: high

Message-ID:



X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: MW2NAM12FT023:EE_|PH0PR10MB5732:EE_

X-MS-Office365-Filtering-Correlation-Id: a2d122ce-ea8f-4b55-d02c-08dc073f6f18

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

2S3n3/FOBRPN8Wf7Sa3gNsVsfj1+bFX7piR/eZr9UIB9mDIZe5xHZqtSf77CH/4+T0vWyHa4K4MIZlOWfN+1z7NQSl5jvyEG6z66xxYk6powzroXWonr3lTRzorOZaVQkVif3QWpFwX2HtBn8Ec1te00TEZdifwgbp+Fl/Pv2uJYkNjZO04L8sBIpkGIsSImI98CAK9ER3Yo76SlBjRo/CYQVohqES0G3VD7ma1QUwEPoKDTtxPPHeMlxJ+hp1swcvpUoLXX2LFpvZ6gTqqjRAbBzpAaqhA3j2SlzcgyeQur5igIPDtktp9spMYbYIqFT4KA3pReoJ5k85DqTuAm/qe837FomgSXOaiiNgTuX+y/YaKMc+3gbVDSWHigN3mJAIhNeiiE54KV5PEdNNWg8ZK3cyJCVN5hMZXA3KG/AdBvZXXyQr/PpES2BcLTLNJDpExZsshll/nOJvz98x8D4g==

X-Forefront-Antispam-Report:

CIP:78.46.149.17;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.goldner.net;PTR:static.17.149.46.78.clients.your-server.de;CAT:NONE;SFS:(13230031)(136003)(396003)(346002)(376002)(39860400002)(230922051799003)(451199024)(64100799003)(82310400011)(7200799017)(48200799006)(1690799017)(61400799012)(46966006)(42882007)(8400799017)(31686004)(336012)(70586007)(70206006)(26005)(6916009)(42186006)(316002)(786003)(5660300002)(47076005)(8936002)(67280400001)(35950700001)(8676002)(78352004)(9686003)(4326008)(40480700001)(498600001)(19625305002)(82740400003)(2906002)(81166007)(166002)(31696002)(41300700001)(41320700001)(558084003);DIR:OUT;SFP:1022;

X-OriginatorOrg: 4pfvf63.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Dec 2023 00:53:40.1592

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: a2d122ce-ea8f-4b55-d02c-08dc073f6f18

X-MS-Exchange-CrossTenant-Id: 90903da3-5cf4-445f-8a84-a419febd4dd7

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=90903da3-5cf4-445f-8a84-a419febd4dd7;Ip=[78.46.149.17];Helo=[mail.goldner.net]

X-MS-Exchange-CrossTenant-AuthSource:

MW2NAM12FT023.eop-nam12.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB5732

X-Spam_score: 5.2

X-Spam_score_int: 52

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: (1) Notifications



Content analysis details: (5.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=NAM02-DM3-obe.outbound.protection.outlook.com;ip=40.95.34.43;r=doctor.nl2k.ab.ca]

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Your order has shipped! - Ryobi One Chainsaw

X-Antivirus: AVG (VPS 231227-4, 12/27/2023), Inbound message

X-Antivirus-Status: Clean









(1) Notifications
























Fedex phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 27 Dec 2023 18:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1rIf9U-000000002XE-0Ua0

for dave@doctor.nl2k.ab.ca;

Wed, 27 Dec 2023 18:25:36 -0700

Resent-From: The Doctor

Resent-Date: Wed, 27 Dec 2023 18:25:36 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-db8eur05on2125.outbound.protection.outlook.com ([40.107.20.125]:37825 helo=EUR05-DB8-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97 (FreeBSD))

(envelope-from )

id 1rIed0-000000001rP-3hQt

for doctor@doctor.nl2k.ab.ca;

Wed, 27 Dec 2023 17:52:06 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=e1hYLCcRY9wgfgSSoEOQ5akwBlMPuFrzQkzWr+YFKUfftSNcTaeRtWlEBbxW4+7O7LDL0S0mySz89PZ+hDug5fuMm9CZGVe5Wft7TqnU+3du+0SsET2axT0oLe2NL4w2mo0BBeb7sYtJO0I0Eib9BOBKj2f4Wvq2xdHermN9oOKV1f3i0e9RY0Tc7lmEE+a0oyM5gAUB2GUTDTWL8RK/zGN7Ytbz/y07EyHAXk52DrEvGxCT5cJLJm0ijJ2kgbrYVyjCY3+sb2fi0TqKX04Wx2hU70idXBB+vS+dZkKRxTTS0B2VXx+xGsE4r5SNQcmMJ8ueeWfqT47F9ZhXo/8+WA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=c3YLSVpCfu/eYLtBGnAUsz5dmCXs8K8ObO5WIE33efY=;

b=hEDB3/pW1YO65pZFhAxJIoKZWjKh7n7A07nJdT1gPEXMrp4tZvCT7bw7bNMaK7jHj8NbAHdQeiIOgV2a5fLXqe4Go+akRFBwlo7LEaape2vB98dxIf3otvf/8hSRLZeLhUN1R5LUPMC4/3gXpdEqTkuMIxw7NX4mV+DZZLdUFkgsNZVpUuz5AkIBYixA0xO2XMPO8pHCNRUAgWxd3qDJgbZxxeCmRTjwjOhtWLPTMW6Bdiejd+KZFe1pDeeZa4ImE3VaQLgrPqV031PoEE79Z3WelDGlLzuHqCAXzySXmhDJcXqYTlPIfc2dQ+ryb4v+S+ZoTGAyvhkBQNSwhSUsPw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

172.233.200.221) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=calmaa.onmicrosoft.com; dmarc=none action=none

header.from=calmaa.onmicrosoft.com; dkim=none (message not signed); arc=none

(0)

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 172.233.200.221)

smtp.mailfrom=calmaa.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=calmaa.onmicrosoft.com;

Subject: Important for doctor

In-Reply-To:

From: Shipping Department

Content-Type: multipart/alternative; charset="UTF-8";boundary="PART.0ueM.ratozrtn"

Message-ID: <010724376038143039d9ee-c69a3509-5c85-481d-822e-ba65c204e1ba-000000@onmicrosoft.com>

X-TOI-MSGID: <1535564970.FE3B0F50FD9B7.1703721906508@zboncak.com>

To: doctor@doctor.nl2k.ab.ca

MIME-Version: 1.0

Date: Thu, 28 Dec 2023 01:05:06 +0100

CC: doctor@doctor.nl2k.ab.ca

Importance: high

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: AM4PEPF00025F9C:EE_|DB9PR02MB6972:EE_

X-MS-Office365-Filtering-Correlation-Id: 269b8fc2-bcda-4c44-439d-08dc073ee828

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

bNhmqqTF7eku1JhGP8n9zUTw5cv5X9HnqbvedsldroUbtWXmy/e3+FYBNk5SBlrvnP2lGszoDQFFtCLr1VrW5jre14xMTo3BpESaCaFQk5/nDDmbKt0+NiNFZ6PVtyQmMlVFQ0znsSLiEGdqirEAjBhDkyw/JGljeLPX1mVUXZFNhd96wZf7kGtlB3OZGw3f1fRw0CG+ZoJvnE1jLwCGCT+8ghOjW1SuFd9zOLaDMVtPStmaQzY6gv1ehsKVR2R415X3dtNnNYqiQa99FaocSYlTGV8Vw3XT0SV5a2daTxiG7PMaRRdgK87PwSugm1R1j5jiE2uQpeI68b1BTHMfSPj2mUJg13Cj23C4+EjI/+Sva8OGA/tR5Tjz1SYaU/DMILx+QzkpgiO8j/m/gVBiJVkXj4A880o9hzSz/BuCBctUcq8LYzKgFqZ/FtTqXr4yrRQNDFgeyYF+7zTaYldxGuLnxRpHSjdcrDkhfP7lZfhujByuyiypyr0jIaRV5gAgBZCMe9YpHBO982WomAW4XNnzoali0YO8qngqtgWCsxG7qAQc5fMyZeTCMdhb/PF1mQgN70t4OIYqXTq2EwK7VhLMXVZs1X8Xcv+QGeyX7ciRhANIy62+XVVKuqU4R22TQeE+8DhbYABzozQieLIl+jFTVimbJWOSXPjN8WK4zKs28OMpaVTddnjRrTHdj7wGvHNy62OjstpU6ZfqRXbpmc0c0O1oSvoiO7ZYXuE1GNoT+V9K5sVK1BdjJdk74XNjj22jpT2K9iP4HWTg6Y914lMMJUGtVb9gxr13p9c7xoc=

X-Forefront-Antispam-Report:

CIP:172.233.200.221;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.zboncak.com;PTR:mail.courtshipfamiliar.org;CAT:NONE;SFS:(13230031)(376002)(396003)(346002)(39860400002)(136003)(230922051799003)(64100799003)(7200799017)(61400799012)(1690799017)(451199024)(186009)(82310400011)(40470700004)(36840700001)(46966006)(316002)(42186006)(786003)(66899024)(8676002)(8936002)(36756003)(33964004)(26005)(9686003)(564344004)(478600001)(81166007)(166002)(36860700001)(3480700007)(82740400003)(34070700002)(336012)(83380400001)(41300700001)(47076005)(6916009)(41320700001)(70586007)(70206006)(19625305002)(5660300002)(40480700001)(2906002)(8400799017)(7116003)(4326008)(40460700003)(1406899027);DIR:OUT;SFP:1102;

X-OriginatorOrg: calmaa.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Dec 2023 00:49:54.2056

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 269b8fc2-bcda-4c44-439d-08dc073ee828

X-MS-Exchange-CrossTenant-Id: 495b5f9f-927c-4d40-a76b-41bdd5aef523

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=495b5f9f-927c-4d40-a76b-41bdd5aef523;Ip=[172.233.200.221];Helo=[mail.zboncak.com]

X-MS-Exchange-CrossTenant-AuthSource:

AM4PEPF00025F9C.EURPRD83.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR02MB6972

X-Antivirus: AVG (VPS 231227-4, 12/27/2023), Inbound message

X-Antivirus-Status: Clean



--PART.0ueM.ratozrtn

Content-Transfer-Encoding: 7bit

Content-Type: text/html; charset="UTF-8"











(7706) Notifications































































If you no longer wish to receive these emails, you may unsubscribe by

clicking here.




















--PART.0ueM.ratozrtn--

Canadian Tire Phish from amazon

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 27 Dec 2023 16:55:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1rIdj3-00000000OMB-3Bhd

for dave@doctor.nl2k.ab.ca;

Wed, 27 Dec 2023 16:54:13 -0700

Resent-From: The Doctor

Resent-Date: Wed, 27 Dec 2023 16:54:13 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a8-35.smtp-out.amazonses.com ([54.240.8.35]:55353)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

(Exim 4.97 (FreeBSD))

(envelope-from <0100018cad1e913d-500e764a-9a94-49cf-a72d-12e216979b10-000000@amazonses.com>)

id 1rIbDw-00000000LQD-2xDx

for root@nk.ca;

Wed, 27 Dec 2023 14:14:01 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=iumxvzai7h3ln4d7i65v55tz7xp4hs74; d=foxlabs.in; t=1703711510;

h=Subject:From:Reply-To:To:Date:Message-ID:List-ID:List-Unsubscribe:List-Unsubscribe-Post:Content-Type;

bh=mu5vGHYi1zvUoYwJ/Qcpk/QK5xRUpoW6CajgCJjuWVw=;

b=io73ei/YVsHqFEwTCU8xs/J4pol2GpxbkA2emPUSVAnrCVmLQ17Gg5W9dPEh4ALz

mmJOLkLoL6KBxyGukxZA3yyVZDwS7QQaWnppIapXpruVrtdBlrmBni+yiSty7N8EGYK

gazTRPokz7gnuL2U32bv4XPvZPjZOLarrhWXigHIH6dZ/dvY9p/p345de8JPZa4QW+v

mcFFa9bvl8TSfx9ZwYiKJT5X3YMMMaR7vLDPfUDkH6ekRgN1THScWgWfCkjMnZb9VLp

Mq38etc3ZVvbBYE0L31JoVYWgzcwAcDJ2p31CSaCs2BUOE2+f5CxZp3lyFpOEfekK6r

E5i9GgLqfg==

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1703711510;

h=Subject:From:Reply-To:To:Date:Message-ID:Feedback-ID:List-ID:List-Unsubscribe:List-Unsubscribe-Post:Content-Type;

bh=mu5vGHYi1zvUoYwJ/Qcpk/QK5xRUpoW6CajgCJjuWVw=;

b=dh7sIzibCptgKfQi3LD68PQIMIpuzPOvj/A4g+8K9YPImF57KeVcN/keAzNUmPxw

JMUB9pgi3KplTjD4QCSGKhto4NVKTIS32yYQR8MGItS5WF+byDzENMLFtwRQeGZibod

BMAC5P0tMy6bUjoJtIb0b42y1drb4qtX9uShbcno=

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=macpacclub.co.nz;

s=k2; t=1702370545; x=1702631045; i=club@macpacclub.co.nz;

bh=MG33lH+CY79L0833Fn7WMiVOuPH1bWfCxhCKRsRyhGI=;

h=Subject:Exclusive Product Awaits You: Complete Our Survey

List-ID:List-Unsubscribe:List-Unsubscribe-Post:Content-Type:

MIME-Version:CC:Date:Wed, 27 Dec 2023 14:41:39 -0500

b=WgP1KUJeaUgrOkiymoZOvwBMLYFEY2v8RAr8j2IQ54ZwEEY68klLN38mqqFQ0Po7R

4lpTtv7jGI7oLtTwBQTFh1aOuHpA/mIxeOVnasPt3kQ5CeohPOn5q3lLnYZPeLCOHR

TmDYIm8juN9fgqzJ9Sc0LL37b1eSaq/p9rftmUlfLgGVCZx0fC3a2+MguUiyHr9Ov6

jVs0dxoY0x13SLlLAYqI9nPjUFcXlGqQ/lv6Hhl2Q+HNHSUTG4bP/GPGdlDvr3OybD

oxDTSGb7ri7v99U5IW3+jh8hvBZANBM7hJH5BNKQUWrv1Bpq4NgINQz0FeMOOJ6M0S

lSo9lNHMvJRxg==

Subject:Exclusive Product Awaits You: Complete Our Survey

From: Canadian Tire Department

Reply-To: root@nk.ca

To: root@nk.ca

Date: Wed, 27 Dec 2023 21:11:50 +0000

Message-ID: <0100018cad1e913d-500e764a-9a94-49cf-a72d-12e216979b10-000000@email.amazonses.com>

X-Mailer: Mailchimp Mailer - **CID7497ea0e6aed9fb56518**

X-Campaign: mailchimpe6a11f6e800e39b4814219c1e.7497ea0e6a

X-campaignid: mailchimpe6a11f6e800e39b4814219c1e.7497ea0e6a

X-Report-Abuse: Please report abuse for this campaign here: https://mailchimp.com/contact/abuse/?u=e6a11f6e800e39b4814219c1e&id=7497ea0e6a&e=ed9fb56518

X-MC-User: e6a11f6e800e39b4814219c1e

Feedback-ID: 1.us-east-1.4vz5eWi3mu8p3ejxSXq5bqW4hRrKTuBrAoonK+dzQNI=:AmazonSES

List-ID: e6a11f6e800e39b4814219c1emc list

X-Accounttype: pr

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Content-Type: multipart/alternative; boundary="_----------=_MCPart_1888620651"

X-SES-Outgoing: 2023.12.27-54.240.8.35

X-Spam_score: 7.6

X-Spam_score_int: 76

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:






Content analysis details: (7.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.8.35 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[54.240.8.35 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

1.5 MPART_ALT_DIFF_COUNT BODY: HTML and text parts are different

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.0 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME

headers

0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image

2.5 HDRS_MISSP Misspaced headers

Subject: {SPAM?} Exclusive Product Awaits You: Complete Our Survey

X-Antivirus: AVG (VPS 231227-4, 12/27/2023), Inbound message

X-Antivirus-Status: Clean







--_----------=_MCPart_1888620651

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable




OQp3>=0A
TvFInJemCG26>=0A
I9dStpOru58xZoFdl9N3>=0A
vl Ed8j9FXI58IN9vnEhaHcIgkKG>=0A
1Au86BTB3R DQagnP2w1yoh9bgjYVcLNC6Mz>=0A
LEwwoQnmP7GFgeDpNH cw2cZQ953tw741urfaEsPCYlI>=0A
eT6NLKBiWXRubuS55bT1QERnK ZPAUBFDxif8JnUw5fxpXtkZdc>=0A
ewIaB6pp AetCK1lt9T1XSkdm6PYYra3NI fFiuUIydb95ms46jSPuV1rBQf>=0A
FJlJKkEXCzULiA63 nv8tePsA4k2PlOlVZUv9pjBO4 XuaRMncKHhqZHlaA0mfb75Wt4>=0A
wQxADRAkuOn5mulc2wdsnpyp tbFod8KTwbneCyyhLtu5FwX1z fOEu1XvxbywMiSOvWhTlpvFJ=

q>=0A
nesfx3nmH>=0A
BoBtap32NZoAvrkKd>



--_----------=_MCPart_1888620651

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: 8bit