Phish | Entries from Saturday, December 30. 2023

Amazon Phish from Microsoft Outlook

Posted by Dave Yadallee on Saturday, December 30. 2023

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Dec 2023 05:46:03 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1rJYj2-00000000AMx-1QRC

for dave@doctor.nl2k.ab.ca;

Sat, 30 Dec 2023 05:46:00 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Dec 2023 05:46:00 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-db3eur04hn2204.outbound.protection.outlook.com ([52.100.17.204]:27268 helo=EUR04-DB3-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97 (FreeBSD))

(envelope-from )

id 1rJXmA-000000002Os-3TIE

for root@nk.ca;

Sat, 30 Dec 2023 04:45:16 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=AchweslugrgfhUXljm/JnkwbxucpsZd3IiVMLyTHihJ4NMPZCFKtGKU8T+O4J5q28ws9Cef/eEseD7XEBUDzycRCC+ttLxsI1B1Zlvjqzm+BUi8rO3MBPBTjKZdRj7PlAccsRCEn4ulxCKyqr32nr+4F9FJxXKA5vwg+2hzQd3TqGYXNBqDAtQtIIP7ocaA6+PDTRRZxWyF27ag9Xal7ymS8rFp5EYo5Ed49IgedL9g0c3lzzEFdgHTOw3q3JZf80gE/cKD4IP79FiYZtKYbdPFB3DLdwouQIcJp91TxxpJNfpfNjDUjXIy/bEan7ONG9NFXU50KlaLHASnCU5g6Bg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=5mF2a82juWo/Nc67JOG1Lzh0y1ZGRSrJyhXS4I70Nr0=;

b=bt7l8NFQE9g/PlZITupnB4vJ5aOeOusQy3Zu5yR6uDdKXB3in/PoqvZ0G6WJ8fi6LHIHlQWcdPzNNBKCqNBa6kVnXtNnWD7BRmVt66YiiuUDwpOOEdVn3LtLDPI0AmsSboQixCUm3oER16IMS6RCFzO4ugQwnQLG183PEVtkxlrCDlktMYhbg/x22U1u3PcI6XvLlgTt+cpEZP6lU0nCjgWWHR32iLEeLCKyJ/AqHGcmJrfuRsVqhjMlmCPrdioF0n3yzwkRVJlLRBHO1xqD1mE2RZMyrnW8romltTA4scXLn1ZlRFr+6SywHhvsAbB5aZrpqn+894rV6wGDE5gOCw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=abonoorganicoaboplant.com; dmarc=pass action=none

header.from=abonoorganicoaboplant.com; dkim=pass

header.d=abonoorganicoaboplant.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=psp4radomsko.onmicrosoft.com; s=selector1-psp4radomsko-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=5mF2a82juWo/Nc67JOG1Lzh0y1ZGRSrJyhXS4I70Nr0=;

b=iH2eUkCqqkjeOfUS/xEo7TrrTXiVS0WBSTold/WT1UwVPb5Ywo7h9E6AtCQ3/a5EaEEO3BBr/u2jmnyDU5KQAsEmFYDjXltO6VGHcmEQT8mK0UZggQoIkY4sUcVgohswAZlZtkCxtzWIdsjGjzrwOe8iXsyfj+sYBqNP3zjucGx76X6gwENkZLAd8kVAsGOyBNClWRhmVMgIXdvxfPNTKVnbatGiKEQc1Vy0e4WXRFfkugVAZgDJhF7JLEiwh7+0d70Ixo8nkrj3wHRapnzct5bPPXOQhMdC/ZyGaLe4A92Ito100GFVnmfb6A8w4QFMW2pYwvuxe6GQ+5lAGLxw3w==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=abonoorganicoaboplant.com;

Received: from AM0PR08MB5140.eurprd08.prod.outlook.com (2603:10a6:208:162::17)

by DB9PR08MB7747.eurprd08.prod.outlook.com (2603:10a6:10:396::19) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7135.22; Sat, 30 Dec

2023 11:43:39 +0000

Received: from AM0PR08MB5140.eurprd08.prod.outlook.com

([fe80::1930:63ed:4432:b007]) by AM0PR08MB5140.eurprd08.prod.outlook.com

([fe80::1930:63ed:4432:b007%7]) with mapi id 15.20.7135.022; Sat, 30 Dec 2023

11:43:39 +0000

Date: Sat, 30 Dec 2023 07:43:35 -0400

To: root@nk.ca

From: Support Lead

Subject: We locked your account for security reason - Sat, December 30, 2023 7:43 AM

Message-ID:

X-Mailer: WebService/1.1.18291 YMailNorrin Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

X-ClientProxiedBy: SJ0P220CA0017.NAMP220.PROD.OUTLOOK.COM

(2603:10b6:a03:41b::27) To AM0PR08MB5140.eurprd08.prod.outlook.com

(2603:10a6:208:162::17)

Importance: high

X-Priority: 1

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: AM0PR08MB5140:EE_|DB9PR08MB7747:EE_

X-MS-Office365-Filtering-Correlation-Id: 2c40b90d-2414-4fc3-3b1d-08dc092c90ab

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?ZFF2aTkzRkdpdjg3R29WcGVnS2hvVE92MUR0dEhXSjlXRU83VkNibVJsNHJX?=

=?utf-8?B?S0tHUkh1Sm9veHBTL010VmlJSS9wQUd0QVFqMUM5TDB6N1lDN2NYYXE4TU9I?=

=?utf-8?B?RnpVV2RtZldnVkZGYkFFVHB1cXZ0bjVmYVhneDVjaHZxZ1hJWkloNjl2MnUx?=

=?utf-8?B?cFR6S3g2VFBlRnFpZFhheWtSbW84M0NxREY3ck54bjNkbGFYQWZSVGNZbGNv?=

=?utf-8?B?V01lc0RQMjFpSE9yZ2l4Vk0wTThZYkU4b1R5RzZ2Q3pRcS9QMHZkNmoxMEll?=

=?utf-8?B?WUt2YTZmNkpLeWVNMGJzOHQvbkxuMS9MeEtPcGFIOWJHWEtja0RaTk9WMmZ0?=

=?utf-8?B?Um9ORk9hd2dLYlVtbUFBTVBjb2lpNG5xRXc5em52bzBQS0dBeHZRYUFwOXIw?=

=?utf-8?B?KzE3amJGdm51VmpwU3RpVTA2ZEwrL21UbldXdjFiaTZOYXhiY3RvcFpSUUtB?=

=?utf-8?B?WnJZN2lpMnJYZ2lEU2orNmtraEpkQWNLd3FxYjVwWjFGSUo4RDRDSG1GVk9R?=

=?utf-8?B?R0VtSlYwVHBsQ2MzZk1BdmZGd2tZdnBxdWMyNmordzVLVGk5cXZ1M1dtZEZx?=

=?utf-8?B?akYySHllb1piM1BNUTQwQTlQbTNnN1N6T1VwSTBKVnVGSkhCeTM4STM4TzdU?=

=?utf-8?B?RUtJZEhPb25ZeUVWNjFXbnltRTU1czlxb2tXMnNwVGMwaDF0WEpJUC95OVFw?=

=?utf-8?B?RENoRUo5a1E3dDlsU2xFTzZuNFNUV2phTE8xK1IyU2lCbTBMbzhOS3I3ZWpz?=

=?utf-8?B?cmt1b1pPTm01bGJiendab2Q4dTMyeVhYQUF5YmdKcm5WZjNQYmIwdjBZQUd5?=

=?utf-8?B?VVErS2dmUUovdXA0Mld1UElLMytMVTMzbnpRMkxhZWhiQi9rOU80TVFHMjlP?=

=?utf-8?B?UUxlWnNrMENWMXUxYm96aXZESUxzY3RaM2ZScElQSkQ0QnZVQnE5MGNBY1lB?=

=?utf-8?B?UWo3L1ZTZWpVbFdpaFJLRHFJeUkvaDYxU0lQNjBBbm9mZ1JYTjZocjNFemg0?=

=?utf-8?B?Ukp6SlBWV3I3M2JNd2tqelhWcUJSMkNDWWZ2dlNNMmRWbWc2SW8zak9xQVEy?=

=?utf-8?B?OU5TdmFGcElyZkdHajNCR0xReFFMeE5tUG9SK3FjcU91V1JVQi9pRFVUYTdB?=

=?utf-8?B?T1lsKzNpN2xJUlpkY3BkY1NVeDBUbzJPcG5ReWRlenZwUU1jZmEydThWS29u?=

=?utf-8?B?MnVYajNITEhsWXgrU2s5c0lIcGN2Tm1JY3N0czVNSmNNTUxpQWN3a0hkallG?=

=?utf-8?B?YUFrZm9qcmpMbnJlVDA5OFJCNi9reGEzUGp6NUQ1WDZlSUlCSWlkUXF3ajYy?=

=?utf-8?B?WktTVzFUcUVkTGRGQktXODBnV0NtTFZuQUVuamdzcnQxd2Rlc2VTQXdMSHpo?=

=?utf-8?B?b2taT0FtL25OVnlyZzBRLy8zRDRVZStuMHBWODNzTWpWK0NxWTVIdzVaeHFP?=

=?utf-8?B?RVh0U3Y3clBZOTRSTTNtdUI5eG5PYzRlT3gxT2plQVJOdUd1WkZDclFHQm0y?=

=?utf-8?B?ZjkwMkFCdWQyVjVFOUU4K1FXcEJLTjFJenF0Vld1N2lRRUEzVlFMK0dSWEZD?=

=?utf-8?B?MEJJUXZFSG1EL01IS3F1REVlK2RyWVl1TytOV0Y4dEJlS1lKMTBycTB6enFk?=

=?utf-8?B?bnh4am1IM2VpODAwVnlnNUExZys3VSs3aW1XVDJITHhsYVJlK0Q4aHdDODZT?=

=?utf-8?B?aW1HL2ozK2RZMVdZNzRoNFd0YlBLZk1lOTdmK3R1Y1p0T1FkaTNhcGpEVFRr?=

=?utf-8?B?USs3V0RCS01hZlFvMm1kS2ZCWnRyODRoeTAwTnhoRUZHN3NoZG9lc1doZXRZ?=

=?utf-8?B?YjhPTWpRVHphRTdHeE9ZbDZBQk5MamxNMUNuWjVBUkZkcmhlN1JBWEdzd2tK?=

=?utf-8?Q?LPxnUteiJY0Ki?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:AM0PR08MB5140.eurprd08.prod.outlook.com;PTR:;CAT:OSPM;SFS:(13230031)(346002)(136003)(396003)(366004)(376002)(39860400002)(230922051799003)(64100799003)(1690799017)(451199024)(186009)(1800799012)(66899024)(41320700001)(8936002)(8676002)(15650500001)(5660300002)(4744005)(6486002)(316002)(786003)(66946007)(6916009)(66476007)(66556008)(38350700005)(5009030100002)(86362001)(2906002)(38100700002)(166002)(55236004)(26005)(9686003)(6512007)(6666004)(508600001)(6506007)(52116002)(83380400001)(41300700001)(61276011)(131040200001);DIR:OUT;SFP:1501;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?YzFLaE9zTGRmLzNmZFBtNFErZEZGSFBOWGo5Lytqam9Yejd5K0hBY2ZCSDlP?=

=?utf-8?B?cDRBSTg3eTA3QkpZc3FwWU53aUtoSjhVWFBBNUJhVThmLytLRHZQUkRxT3NO?=

=?utf-8?B?Zm5BRWVRQzdIOWhIemRaT1VpL0FXUlQ0TGQxcktnOFdXTldrbTQ5S0w0L0Fp?=

=?utf-8?B?L2cyckRveG1rVDAwNmxJKzZhYW82NnhSYy9XOVI1Z1lsNW1NYll6eFZPRjg4?=

=?utf-8?B?QlRBSkFNR2dyMXJGeWpYNVZ4ZS9XcUNyQ0VKM0VzUHRWTkF2dm9ZM2NybnJN?=

=?utf-8?B?dzlSb1ZWdWR6bHlRRWJ2K0hiaHA4QzRQT1gvdGtqencrVFJIQlpIMThGMlVk?=

=?utf-8?B?WmFSL2ZoMEo0dXkycFRFQVBKZ1FvekJ3WXRrNkJwVTV3ODVxbno5RXlDak1O?=

=?utf-8?B?eEFWSVo2Z3dpSXl0Q1BEaEZPejhRbjMwQ2YrZEtzcGh5KzRiS0hVTG9NbCtn?=

=?utf-8?B?aVFoRmF3dERqR3VsNSs5aUpHL1FzTHpnWWFwM3ZvZkd5WmtZRGFJcThEZFcx?=

=?utf-8?B?aDh6bDhIVkpqS3kvL041REVUem83aE5kWVUvRTJ5cVZ5UmlxUXZPUDdsNnlh?=

=?utf-8?B?RVh4KzZ1bWJLV0FNYlhuaW5iQk5UTWdhZit3Qmg3ZmwyOStPRVQ0V1RTZ2pX?=

=?utf-8?B?OHFrRHRVSkxqaWpmVDRZZk9PVldUU3gwNkZybUx3MG56d0xyUk9hamxtRDRS?=

=?utf-8?B?TXpzeTBpOHJka0ZtUUY4MXlCeXRtenh0ZU9MNU94SGpyaDJjZ2hYdmxoSGxT?=

=?utf-8?B?OFRNVk1MTVdFNUJGQW5FZU11c290M2xCcy94ZEFzSnp4dVpybFVDS1B5WDI2?=

=?utf-8?B?bFpLazY1VG1ZOGFPNE44eUl2MG53eXB2azc5c0dDU2ZCaXllbUR3WW9pQTdy?=

=?utf-8?B?M0xFWVZlYk80UlppL0o4VnhBVW1WRFVSWW9nYWZmYlNHOWk3WGVnTVgzQ0ly?=

=?utf-8?B?QkpnRWNWV3RsbkdJOHZMRWNnVVRqSFBvdVlKTW1KOGx6N2pKTDllQXZoV1Nu?=

=?utf-8?B?TDZYUVpKSEFPcm84ajNVOVpUSFljWjFjeWV1aE8xU3I0YkZNVndyVGdLdThh?=

=?utf-8?B?OW0vTWJUbzYzQnlyZUtnQ1Q2dzNYZ3NhK3cyOEl2RGdpSmtyQy9KRU9LSTZH?=

=?utf-8?B?bkN0enMySG9kbUpYbTZVait6RC9ZWjF1Y0VLK0V5ai9KRnlraFBtOVcvYU1F?=

=?utf-8?B?SGFhUHBJK1k3Vkw2Nk96WERid0dRVGxlMFdBa29lSG9UY2x5RUZaZHM1Rysz?=

=?utf-8?B?RkhZd055S1ZtV28zM2VFbjdDdFh0K0FpSWYrazNuK3UvdGFETm5JSklDQnpW?=

=?utf-8?B?UFE5dCtERHgrOVpWVnVFWThRN2czNVBaWldnWEQvc3cxSjBxY0FQbDdvTlJl?=

=?utf-8?B?NTgxRFR0WU9FbENhRFZaVTdyeXhGdVp1QWFLN2tUUHBoSHloUUV1TGhjT3Bs?=

=?utf-8?B?Rmd4QUhLbzRVRzZDWDZTRzZtN29iOG1sSXdjci84SVpzZjlkaHZsVnhXc3lF?=

=?utf-8?B?RHJ0dFFENVNwOGVBQjVVWGN6cjEyd0wyRklWbzZNREUwUnlBc0k1ZDhTWXo1?=

=?utf-8?B?bFhPb2FYN2FyQ3RUb2p3dFZMNjJqZjhzK0dyQlI4UExIRzRXcU5kR2ZLUUpH?=

=?utf-8?B?ZDV3cDNZKzJ6ZklXU1FqbU5iZ29FWU55bGJLdWtnK1NROVR2QStGcERiOXBj?=

=?utf-8?B?Zkczdjl0RmhZQnlxd3VnTzdKZlJCQVJxZU9YT05oejJjQnpvMGRwdEVqRUJy?=

=?utf-8?B?NjQ5OFBKZnFjNjdsMkQxK0IwODN6eE4rUCswWkFmTm43L3JlcVZoSkNRU2tI?=

=?utf-8?B?VnZ4VHZoZGVwL3NkcEkxdE9TV1E5NmxGcU1zTzV4WjR6M1FDR09IRDdQbTNP?=

=?utf-8?B?QmQ2VnRwNWUrck1uYTBnYW1kd29SWlRGTW1WbHRxWkJHNTIyODFsSEl4ajdZ?=

=?utf-8?B?RjBaZUhNOVcreFBvY2RPc3phZGtJNlpWWWtvUEQ2Z3FSdWhnMk1WdmplUkp6?=

=?utf-8?B?MlUyUkxFL05pSmEzR0s1YmpDLzY2d2sya1JzQUxIOUtBMEFCTUMrZ3pmWGxC?=

=?utf-8?B?UXFIbE1xL2F1ZHVrcFRsMFVVMVZCNVFMV29DMjArZW95TWJYT3IwZElJQXJI?=

=?utf-8?B?bFdWVGJXN1JDamVpYzlUWmROVWVhTExrSEtiYi9TaDM4MHdWV1p3QURseWto?=

=?utf-8?B?OSs3bnVyZlQwWi9uRE1udk8yN1NqVVp5M0traVZiZ3BkZ0hTWGpaeGpNZE5W?=

=?utf-8?B?emVqNjF4UENrN2NDUkdDRnZsdmZnPT0=?=

X-OriginatorOrg: abonoorganicoaboplant.com

X-MS-Exchange-CrossTenant-Network-Message-Id: 2c40b90d-2414-4fc3-3b1d-08dc092c90ab

X-MS-Exchange-CrossTenant-AuthSource: AM0PR08MB5140.eurprd08.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Dec 2023 11:43:39.0788

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: c20ddd07-a923-4494-acfb-8c728f876222

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: Vw8gVIAySHxhig/kgy80YDsP+7U+SKSdWONjTlCo5r5/5R+MDy1p+qITN36rb5NwrUuo7pQgiPEQOjU/kyWG09Y6Xm92/mXz7VmUpekrJr21TjAk5VdXMEo7upnxVAotZmMfsF18o38NnOzn4iJGiqG0dH+6n41Rrgq78MMoMi4=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB7747

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Amazon Services Sign In Authentication failed because your

account has been suspended. If you believe your account (root@nk.ca) was

suspended due to non-payment of outstanding balance due on your account, you

can pay now using the Payments to reactivate your account. If you do not

pay o [...]

Content analysis details: (8.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.17.204 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.100.17.204 listed in list.dnswl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

1.0 AMAZON_IMG_NOT_RCVD_AMZN Amazon hosted image but message not from

Amazon

1.6 FORGED_MUA_MOZILLA Forged mail pretending to be from Mozilla

Subject: {SPAM?} We locked your account for security reason - Sat, December 30, 2023 7:43 AM

X-Antivirus: AVG (VPS 231230-2, 12/30/2023), Inbound message

X-Antivirus-Status: Clean

>

ia-amazon.com/images/G/01/authportal/tiv/amazon_logo_RGB._CB424887820_.png"=

alt=3D"google.com" width=3D"140" height=3D"42">

=0A=

Amazon Services Sign In<=

/strong>

=0A=

Authentication failed because your account has been suspended.
=0A=

If you believe your account (root@nk.ca) was suspended due to non-paymen=

t of outstanding balance due on your account, you can pay now using the Pay=

ments to reactivate your account. If you do not pay or provide a payment me=

thod to resolve your outstanding balance, your account resources may be ter=

minated.
=0A=

QE?802551">Check Activity
=0A=

Please verify and change your password to reactivate your Amazon account=

. If we are unable to complete this action within 24 hours, all pending ord=

ers will be canceled, and you won't be able to access your account until th=

is process is complete.
=0A=

Thank You,
Security Team
=0A=

=0A=

book.com/">Terms of Use Privacy Policy © 1996-2023, Amazon Web=

Services, Inc. or its
000000;" title=3D"hotmail" href=3D"https://live.com/">affiliates=

.
=0A=

.com/">
on_company_160x20.png" alt=3D"affiliates" width=3D"160" height=3D"20"><=

/p>=0A=

line-height:17px;margin-bottom:5px;margin-top:0">=0A=

=0A=

Sat, December 30, 2023 7:43 AM=0A=

=0A=

=0A=

x;line-height:17px;margin-bottom:5px;margin-top:0">=0A=

=0A=

Samsung Galaxy S9+=0A=

=0A=

Categories: Microsoft Outlook Hotmail Spam, Phish

0 Comments

Walmart TV Stick phish from Microsoft Outlook
Posted by Dave Yadallee on Saturday, December 30. 2023

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Dec 2023 16:35:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1rJMNC-000000006UG-0Q3t

for dave@doctor.nl2k.ab.ca;

Fri, 29 Dec 2023 16:34:38 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Dec 2023 16:34:38 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-am0eur02on2086.outbound.protection.outlook.com ([40.107.247.86]:6336 helo=EUR02-AM0-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97 (FreeBSD))

(envelope-from )

id 1rJJe2-000000002ou-1RpM

for doctor@doctor.nl2k.ab.ca;

Fri, 29 Dec 2023 13:39:54 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=h8aNdRsQMKdq6DIXBtZn+GN89L1LqOwZkijzX9KduBzY5jCbFa+2GltuW4IAkk/ou/tcsTjMXT+thZHKCVVFUaTr4R/c6fcKn0+geqZEywqvNFh10VcV5z6AjslJu9fjfMKSdBSWBRBlXCo2DqKd22oYN1EHbbTQAmIwZe7GeHD2WyD+/e4nl7dlt5uyGu2hua065hR3ww9aiuHLWWOmnQf5BGFo/cZms+wyeq3JRM+m1avDxEEg5wGU8lw/6USULSs211WeSb6s8W05dKF9/0WbnM3DkRhmz9KbNRL84G9suLZseDW1xFrSGYDzkGzCRhg7M2nGUvzhQTrFU31/Ag==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=zRhKZxIZjULzhr0FL2oiaYEHVWP6R5ckng1bu1otHSg=;

b=VHmNnYhL/ww03KUMrbnuwMEkBQV4IAEZ3SD1tPyfpL4owaBXLI2JudT4xi6ZgXLTy9Mucmy+//HfqP9XLARxDKf1vvXyWVffAgvKuZIb8RxCSzyCr0F63v+Y85fSQvSGDr4wnN5qFbKr3wV4pchtIgU/3s1OCGkc6k1Ib3FxxwmraQPDY/Zn4iSpc8MU9RJundtHOWiuGKjg6DEPO3hUHK4/+PTxPYxR8ThbOD3mE5amdbPzGFBQC5BLYQLmpl0tvGKSnQYcdL7zGLdL6SOP9u8hIu85wkhwjC61VtI2aWVW2gvUgNOmnToth6WbDO3tTrxtPLhXyXWpUb3o8U1NYw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

168.119.189.236) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=pauliska.onmicrosoft.com; dmarc=none action=none

header.from=pauliska.onmicrosoft.com; dkim=none (message not signed);

arc=none (0)

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 168.119.189.236)

smtp.mailfrom=pauliska.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=pauliska.onmicrosoft.com;

To: doctor@doctor.nl2k.ab.ca

In-Reply-To:

From: Walmart Department

X-TOI-MSGID: <1718905885.D9B7B17203189.1703879903721@dare.com>

Date: Fri, 29 Dec 2023 20:58:23 +0100

Importance: high

CC: doctor@doctor.nl2k.ab.ca

Subject: You have won an Fire TV Stick

Content-Type: multipart/alternative; charset="UTF-8";boundary="PART.Dmu5.ehupiswp"

MIME-Version: 1.0

Message-ID:

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: AMS1EPF00000043:EE_|AS2P192MB2046:EE_

X-MS-Office365-Filtering-Correlation-Id: 3f6f660d-48da-45fe-385a-08dc08ae022a

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

s1AjKS3zi1a+DEeeixSEmTIEJKDVIEkJMazrar3n4KUkck9LGuJeUSigVLjrNkadxyNF5GiNrqmNqSPuKGapUSYBnTtbkgBkaxAyRJ7ZWXmT7fazH6hsyTI+wiyNpNcWKrdUVCBWNm+KAqaUu+oKl12CLlo9eJtCRTgudbqbvPoGGdYzaqRARCKjnXQ3EQrbDDUR2LNC2I2wVGIVqyU40AH7DMLV1HfR9w0jTbqm0aWe44YTCxMSbrhKl7REQvVBaEIci+cbFjSqq7G4+BIKlPCHbpM4wD4Z7uv77xUprGZliFttwj0ww5wEmfuTdwVwd4YDu9KIDvThfZhzXVkqwLabcbb1HC9rjfBRDmY8QdnSpJuqwvnJa41JJdtZtoX7sT502j+knbYs1IvVZFYKIYrpK/XVgbYCLwFSu16FZdHnSQgZBEhL8JvZjScztAVDDrmb3c3ONtXulqJYg1kjHMJRsIFw0nn/r/VyFrCZUWsDc+hHkdjeSydubtf1j+nhTlBmrJhH4WQemagdx7aPCGk9bAuV1ByB5bG82EG23RGDEiKYU5+XfSkqbtoX7TulkJZr7AQpXlw4T5Tjab3vIXgxSd9NkCOtk7G3JdiiH7F2RUClPqRIOlpWW5BUEqDB19r9gcV3MimWQBUzf9ECyic9hsfRf5QKqh2dMCu2b0HUwLxsE37R945vgUsRALJLf/nHAAfEfcBSnS/BsymdXJxcjUm3aye1wTAtX4eVOCoa5IjZxTKxMYhRyJ7qc2AtBxsT20ikXC11dBSNBj2l3htWjIASUUKGRnmaiR0yBlaEQyYvY4ZnFnNCZnkWfLMUMHFJ/WVaAeSuNmnJBvmFmtiH2RRJ9HFrPOTl5Ng0q2TPJnlmali1des/S4ppqDVN

X-Forefront-Antispam-Report:

CIP:168.119.189.236;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.dare.com;PTR:static.236.189.119.168.clients.your-server.de;CAT:NONE;SFS:(13230031)(39860400002)(136003)(346002)(396003)(376002)(230922051799003)(61400799012)(7200799017)(451199024)(64100799003)(186009)(82310400011)(1690799017)(36840700001)(40470700004)(46966006)(8400799017)(564344004)(40480700001)(41320700001)(40460700003)(66899024)(33964004)(70586007)(6916009)(70206006)(31696002)(9686003)(83380400001)(82740400003)(26005)(47076005)(81166007)(5660300002)(41300700001)(336012)(478600001)(19625305002)(36860700001)(2906002)(8936002)(166002)(8676002)(786003)(42186006)(316002)(34070700002)(4326008)(1406899027)(146383001)(18963002)(15913002)(83022004);DIR:OUT;SFP:1101;

X-OriginatorOrg: pauliska.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 20:37:43.2795

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 3f6f660d-48da-45fe-385a-08dc08ae022a

X-MS-Exchange-CrossTenant-Id: e98557a2-ca6b-4144-8399-02262fb7688a

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e98557a2-ca6b-4144-8399-02262fb7688a;Ip=[168.119.189.236];Helo=[mail.dare.com]

X-MS-Exchange-CrossTenant-AuthSource:

AMS1EPF00000043.eurprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS2P192MB2046

X-Antivirus: AVG (VPS 231229-4, 12/29/2023), Inbound message

X-Antivirus-Status: Clean

--PART.Dmu5.ehupiswp

Content-Transfer-Encoding: 7bit

Content-Type: text/html; charset="UTF-8"

(7205) Notifications

If you no longer wish to receive these emails, you may unsubscribe by

clicking here.

--PART.Dmu5.ehupiswp--

Categories: Microsoft Outlook Hotmail Spam, Phish

0 Comments

Amazon Phish from Microsoft Outlook
Posted by Dave Yadallee on Saturday, December 30. 2023

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Dec 2023 16:33:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1rJMKm-000000006QA-2qSN

for dave@doctor.nl2k.ab.ca;

Fri, 29 Dec 2023 16:32:08 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Dec 2023 16:32:08 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-db3eur04on2107.outbound.protection.outlook.com ([40.107.6.107]:24198 helo=EUR04-DB3-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97 (FreeBSD))

(envelope-from )

id 1rJF5i-00000000287-2Wui

for root@nk.ca;

Fri, 29 Dec 2023 08:48:11 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=VqAKbg4Edgqfz4398X+4ARQv8OsB/k3cwO5etUkRfUroq3qugrRipk+CB89jPs3uj0Xe2ad0eE/zR4Uevw9Tpf4z0ZtmoI/jOVqFC3YMcLvo0C9cJKgdKsfuF3pfenwi0gSr52MluX6AQtqJx1EXKzfa6lT1Rq4qlWzg3jVo4ItNNN501DdVRjAB3wjiXApMZ4o5FqZPkwU4y8JaVbf9cjB9vxzEVMz0X97/WkYc90WNtB2LTdvtjMgk7XVuRj7GI6R8ivsIH1E3znrRBJgVVEBpyXKgrfWv4bvD0Kf9zna4/29n2W9nQRsrjA/4q9u3wSMy6PVmLz8MUzhvv+5POg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=uxuQfi2Du1oVktREnN4Sx+v9apwhdfgjrH+7sdPbkKk=;

b=HySym9aLGm4YuKFATeA1YjDKsV0TRnLKQYUeKUVCQ2SYP0tLd4pHSZBiGzRcwZq1OItlFNV9BupRIfx8XJRkkgCTA2FR5l3LFxp2kTP/AQKq3xN5d35KnCdP49uQkKdM9VEfCVVc+9VlJy8lrZ/lc/87y6gThdIH7SWYISaBdVx3NXdCITlQNpUGdIyZWPByn2zEpeIYWqyYjWFSJ1UJ6DVNj6Ev0qOB+11e9Ujai/CB8EZhRfO9FiB/KetThgIbvRxnE+fj8xrqA+vcMjdcU9b9OLpJPzGCL2w9ziUOT4EfUFtBwlweSZMa6dlZsi1X4Arn6Xtv7siMwS3KYWfLHg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=abonoorganicoaboplant.com; dmarc=pass action=none

header.from=abonoorganicoaboplant.com; dkim=pass

header.d=abonoorganicoaboplant.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=psp4radomsko.onmicrosoft.com; s=selector1-psp4radomsko-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=uxuQfi2Du1oVktREnN4Sx+v9apwhdfgjrH+7sdPbkKk=;

b=mCn/7XubVYeYZwVEf04qQCm612eHbgcXxTGm3YGp0//6cS7neJOExyNiymoMZ4IbiqC1eWobtdF0L0U5bJhDpF5TT36kLTNkL6bM8++QGRzQZ+dcKdVLEvbPOxAQJFdpj4UU9+kOIYUo9X8Hm1Lu3659LHgis1xd1Chs1DWgHQcZ+tUXZ3HsNxP9cwSR7Ewo2DDKqikY1+3EU1AE++EDEpXntZTyqtJAeUgdjIemQKEcvnBUrm+qEo4xttgDtpCc5ljgcNPuq0LPFQ3oGHqRPtgIaK4AfTCdPaCpUJ/QEIcpSS+1SneZJmJgduGMrrFVE+ZSHzS/C0b85SxUP00sqw==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=abonoorganicoaboplant.com;

Received: from AM0PR08MB5140.eurprd08.prod.outlook.com (2603:10a6:208:162::17)

by AS2PR08MB9692.eurprd08.prod.outlook.com (2603:10a6:20b:604::20) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7135.19; Fri, 29 Dec

2023 15:45:58 +0000

Received: from AM0PR08MB5140.eurprd08.prod.outlook.com

([fe80::1930:63ed:4432:b007]) by AM0PR08MB5140.eurprd08.prod.outlook.com

([fe80::1930:63ed:4432:b007%7]) with mapi id 15.20.7135.019; Fri, 29 Dec 2023

15:45:58 +0000

Date: Fri, 29 Dec 2023 22:45:54 +0700

To: root@nk.ca

From: Tech Responsibilities

Subject: It seems like you just logged in in an unusual place recently - Fri, December 29, 2023 10:45 PM

Message-ID:

X-Mailer: WebService/1.1.18291 YMailNorrin Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

X-ClientProxiedBy: SJ0PR03CA0148.namprd03.prod.outlook.com

(2603:10b6:a03:33c::33) To AM0PR08MB5140.eurprd08.prod.outlook.com

(2603:10a6:208:162::17)

Importance: high

X-Priority: 1

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: AM0PR08MB5140:EE_|AS2PR08MB9692:EE_

X-MS-Office365-Filtering-Correlation-Id: c9d3ae87-4b7c-4ff7-fc00-08dc0885402c

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

GXfosEKVQD25TcHy4TRxFm5xI9o6NDvv0Uqb6bi/gEeNQGayNSP/OfiLlx+y4LL6D5SaB1sYS9rMn1kHUkADhyxnKOBkVSC/+ZwY/CySPVMlqCDI9o/+ihWei0ml+zJRb1s3G7/pEJihI//3bfEFA3DmuIvnkoQ4udRj05mEg0fXJNiOhhDKbbIEtJiwnTt9o276tg5fz8zhn/3P/qAVz23VaXOV0LjRpzEmFU4+K7SbgnQGD34fuzL+qVVgbZGZbonYAlHkiZUCe+aQpPoHZAyVISoOA5tW/iLD2LB/tvyVs9biBRZmZsPHGlTqSR641sfMRG6KHMXd4tERVCtR1M3l3RqCNbMNkbt8b+8+34gsLPvUSwrHqKPkDSu8ENxBOzX2z7Pf/xVE9l1QP1Q4S5Cidnn8LUeKzOvGZ9yrM1TwihP0/wKiDcvbEsZZWxsUWTi2XIhK+c7hBQ2frxa5Q78cRMaEwhKAmUmtIs673xMZPXTJ8ucUr24XfNWT0x9dA1mSGLRgemq/aVnB83WqZfjOcwGF+5EsFy/EbFHAgp4frzpo13cm600rkla3ejLXEkz8gAD+fWzOSJYz8C3T3TcuyQ+xSSc8LtziipvTTEq8qes6K1wSF6tLNRChkp0R

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM0PR08MB5140.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(346002)(366004)(396003)(376002)(39860400002)(136003)(230922051799003)(186009)(64100799003)(451199024)(1690799017)(1800799012)(2906002)(66476007)(6916009)(66946007)(5660300002)(66556008)(4744005)(8676002)(8936002)(316002)(41320700001)(41300700001)(6506007)(86362001)(786003)(9686003)(6486002)(52116002)(55236004)(478600001)(26005)(76236004)(6512007)(38350700005)(83380400001)(38100700002)(6666004)(16799955002)(166002)(61276011);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?cmd1azBBaUdFczVlL0lZR1MvajJUaUNpWmRXN3FLd2JIVi83NHdHcjMyZXBU?=

=?utf-8?B?eDc2bEQyTUkrVGV2MlJxaXdvQVpPVFFnellhOWhic3lITVIySWloUEpDSFBC?=

=?utf-8?B?NC81UmZCRW5VR213c1dxZXNraENwVDA5VWE3L3pFUHZaaXdPTVRmdnlwT1ZD?=

=?utf-8?B?VHNyTE9PSFNnVWJvVk9hUStZcVdGeTFaTktRQmNsZWZXTk5Xai9uRm4wT252?=

=?utf-8?B?dWRLNTA3ZWRMaVJVYXZaQmI1S1RSUUh3Um0rODRKSlhjUm9qcnpqMlBNVzJT?=

=?utf-8?B?b2cydGgvMDkyQlI4dTVYNEViVHIzclpza2tuU0NxS3AydDFFYWFpa25ueSs3?=

=?utf-8?B?U0lpR0UySHdCdWhrWDdaREN2ejZsUVNESjB1YzNZRmh4bGhSanNSWkVkODhK?=

=?utf-8?B?TU52a2c0Q3ZMOUxvZTA4SUozQkRaNmhXeUF6VnhqNEs4bmwvL0czbUNXWEFP?=

=?utf-8?B?U0RIOE1ORFozK0h3L0RhL3FxSG1UalU3VmdZdWUyOEdZaWpKVm54QVMvQjFI?=

=?utf-8?B?b1kvQkw3eC9sd20ySlY5aStIVXN4TnR6OWhhM0lQQXlURzQ0K0o1cnFXZ1dM?=

=?utf-8?B?c3c4OE5OZjZzMEllMHJNaElQVFlsdjc4UzdYRkxWckd4WTJxQVdXaEorY1RL?=

=?utf-8?B?REI5NXdVenk0TXFvRTIzSXJkK1RZNG1jZDhrTXBUYzIrTlo5by9UWmZWZ2lS?=

=?utf-8?B?dnBFM1VZNWJMNkJSSnd3WEk3YzN1K0ZDSk14TmtGRXptM2VYRmZycHB1UmhC?=

=?utf-8?B?UVRFZTB1cnVRc2ZEYVQrU1hGNlpGV3RCc0U1aEVUUTZiTmlHOUVleHhCUlBL?=

=?utf-8?B?aHBHWE9EMXdITVY4WmJDdlF5b09oQlBhODQrUCtwalhuOHpwSTNJeVRNdzFq?=

=?utf-8?B?Q0h3ZGxrU3JoQWF3ODlKK3dJSW5jaTBWMTJyWDNWZE1lMjNRRXZRa1lGSWZw?=

=?utf-8?B?a0FWR050cjVhMFFJS3JZRjBST0xSR2lLYm5GM3ZVaDlXNGpPT1NGQ1IzNDNR?=

=?utf-8?B?a0lieFlMcE9vNU9Jb0ZPQ04wQklWa25DTUlNSkduSm11UkcybzN4OXNKWkth?=

=?utf-8?B?R2QxaVordlRIVGZzc2QvNWQ3eHdiOUVHZlZ0QVZGbXFhVkZxUFJtNmpsUW1T?=

=?utf-8?B?ZVZZVkJsa2x3SVZiNG9wUWtCYnB2dHUycUs3eEo1STFNdVhDLzRzRUxXR0M5?=

=?utf-8?B?ZS80KzBQSDQ4am1yUmVpaHNRb1dDdmtiZnBnNXMxdUZMVnFKaTllSU9tR3VX?=

=?utf-8?B?cUoxbHpEM0dIQ2QrV2g3SE5xVlR1Z2sxU1ZvalhCWElFQnl4QnYya1EwUEVj?=

=?utf-8?B?RDF1QUpMOWdGWitndXFYdUw3WDhQMXZQNFZXZ1hsbUZCZUZOVTdpQzlPMkRL?=

=?utf-8?B?REtiWU0xNURmWTdjT2lobU52Ynd3Q3U4em5WVGdDT0MxNGo3MGxqUXhqUHVL?=

=?utf-8?B?YUFJNFVMLzkzK2ZmK0pFUi9USElBTDRRMmJRTmRzb1FUTklZMXI3b09zN0lK?=

=?utf-8?B?SW12cmQ4RnZMNTMzK1RJcDEvRnZWaEtZMnhvNUdZVzZrb3JuRmJIUE5YOEEz?=

=?utf-8?B?aTArbWFVelMxUTNqdVl6cUhqK1JUbnYwdG9kSFY3NERNN0RkL1J0VzBmc21Y?=

=?utf-8?B?WkhoRDdQZXY0YVo0QWNTVWtFWStLay9PaDB3aXZCNHhQNGFIdFEvZEsra1RF?=

=?utf-8?B?US9VcVRmdldtMDc4Y05WMGNzSm1KOFhKRnp3Q1B3b0ZXbUpkSFF6MkVpTWh1?=

=?utf-8?B?Q2tobE51dS9seWUvY0l0L0F4N0RzNEtjVmdnemhHajdnU0xYNUEzTDhsMDMy?=

=?utf-8?B?NmgxcjNYa0Nwc0w3YTVrOVJ1ZXU2bytGaTNJRnFJVlFxaVNCNGhMNml1czB5?=

=?utf-8?B?YzFpZU5HOG5hVmVLQkxrMDJudWl6VGpEZlc1UmxDbGRIcmg3cFJLM1JzNUN4?=

=?utf-8?B?YnZxaUVvWEV5RmpQSHVZaVpPeGJwb2pMR0FnSHViTVVkejNTcktvK3laVDNI?=

=?utf-8?B?aVllekdndUlreXNZVlA3TWdJVU9IYVFaK0x1djVWeWxGVkpPa0hLaFFuUUhZ?=

=?utf-8?B?eisxSXhYb2NiaGNJTXZDNzcwNTNGUEFrMk8zZkt5aU1Vdkt5M0NPMVJHbmli?=

=?utf-8?B?R1ViZzM4Y1FDVmN6SmxBUmI1dEhOTGx3ZVEzSGhrek9pTFRSSGxvdTY1VGc5?=

=?utf-8?B?OEhxY2RiYzRvMUtHK28zUkR2KzNPL1pSUDBHYXdDMGlRVFBpNkhjODVEOFlu?=

=?utf-8?B?anZZcXAxTVpMRHo5UFBCYWd2alRBPT0=?=

X-OriginatorOrg: abonoorganicoaboplant.com

X-MS-Exchange-CrossTenant-Network-Message-Id: c9d3ae87-4b7c-4ff7-fc00-08dc0885402c

X-MS-Exchange-CrossTenant-AuthSource: AM0PR08MB5140.eurprd08.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 15:45:58.1451

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: c20ddd07-a923-4494-acfb-8c728f876222

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: v5DO94kN5UZEfkUNeP7gi4KfDQ1G4SuX976k5Dk3mm9m7xdGnj7vzABa/SZgDqP/UpzhGn/GOYAL3MRVRIeXU8RmvtCasg8z+5bXrsUFbvWKY19G3pawFSHubvw8pwSncRxTTErO/X/Xe8cchTwaOHjPFJpI2NuEuPbjyT8UBqg=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS2PR08MB9692

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Dear root@nk.á´„a, Î¥oÏ…r Î‘mazon aá´„á´„oÏ…nt is temÏorarily

on holÉ— beá´„aÏ…se of an Ï…nÏ…sÏ…al login. Î‘boÏ…t this á´„hange Ïœri, Deá´„ember

29, 2023 10:45 Î¡Îœ Î‘roÏ…nÉ— ÏœloriÉ—a, UniteÉ— Õta [...]

Content analysis details: (6.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.107.6.107 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.6.107 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 ARC_SIGNED Message has a ARC signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

2.5 FUZZY_AMAZON BODY: Obfuscated "amazon"

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 AMAZON_IMG_NOT_RCVD_AMZN Amazon hosted image but message not from

Amazon

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

1.6 FORGED_MUA_MOZILLA Forged mail pretending to be from Mozilla

Subject: {SPAM?} It seems like you just logged in in an unusual place recently - Fri, December 29, 2023 10:45 PM

X-Antivirus: AVG (VPS 231229-4, 12/29/2023), Inbound message

X-Antivirus-Status: Clean

body>
g=3D"0" cellpadding=3D"0" align=3D"center" style=3D"border-collapse:collaps=

e">

30px;margin:0 auto" dir=3D"ltr" bgcolor=3D"#ffffff">
lspacing=3D"0" cellpadding=3D"0" align=3D"center" id=3D"m_-4190993533000013=

413email_table" style=3D"border-collapse:collapse;max-width:630px;margin:0 =

auto">

nt-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-=

serif;background:#ffffff">
"0" cellpadding=3D"0" style=3D"border-collapse:collapse">
lid 1px #e5e5e5">
>

ght=3D"20" style=3D"line-height:20px" colspan=3D"3">

t=3D"1" colspan=3D"3" style=3D"line-height:1px">

15" style=3D"display:block;width:15px">
=3D"100%" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:coll=

apse">
>

>

eight:32;line-height:0px">
com/images/G/01/authportal/tiv/amazon_logo_RGB._CB424887820_.png" height=3D=

"32" style=3D"border:0" class=3D"CToWUd" data-bit=3D"iit">
"15" style=3D"display:block;width:15px">
=3D"font-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial=

,sans-serif;font-size:19px;line-height:32px;color:#ffffff">

ine-height:15px" colspan=3D"3">

15" style=3D"display:block;width:15px">

=3D"display:block;width:15px">
ellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:collapse">
y><=

td height=3D"15" style=3D"line-height:15px">
tbody>

class=3D"m_-4190993533000013413mb_text" style=3D"font-family:Helvetica Neue=

,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;font-size:16px;lin=

e-height:21px;color:#141823">Dear root@nk.=E1=B4=84a,

=3D"m_-4190993533000013413mb_text" style=3D"font-family:Helvetica Neue,Helv=

etica,Lucida Grande,tahoma,verdana,arial,sans-serif;font-size:16px;line-hei=

ght:21px;color:#141823">=CE=A5o=CF=85r =CE=91mazon a=E1=B4=84=E1=B4=84o=CF=

=85nt is tem=CF=81orarily on hol=C9=97 be=E1=B4=84a=CF=85se of an =CF=85n=

=CF=85s=CF=85al login.

height:15px">

" style=3D"font-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdan=

a,arial,sans-serif;font-size:16px;line-height:21px;color:#141823">=

=CE=91bo=CF=85t this =E1=B4=84hange

=3D"15" style=3D"line-height:15px">

dth=3D"100%" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:c=

ollapse">
ter"><=

/tr>
tbody>

eusercontent.com/proxy/Mz4b6FP-x65E4RmTqKykmV3ZESDvtDZa063Q387S4JJDlv5ub6Vq=

oVeS8Twy8uQSO5xKCYxd4hEZHRUPTgfb0OlMBoo7Lvu0WCB9CvCQng=3Ds0-d-e1-ft#https:/=

/static.xx.fbcdn.net/rsrc.php/v3/yD/r/KJyTP_2W_qx.png" style=3D"border:0" c=

lass=3D"CToWUd" data-bit=3D"iit"> =CF=9Cri, De=E1=B4=84ember 29, 20=

23 10:45 =CE=A1=CE=9C

aoUURGRlkeLOtIp-GtyR_GZqDr1gYQwFrxxbpoOsCWFXS_-DQ_T_EemJBcB1g5k9jMZpGgtFUMh=

wPTIVTc3OCSWTmjZQ=3Ds0-d-e1-ft#https://static.xx.fbcdn.net/rsrc.php/v3/yK/r=

/EYwma6hBA2v.png" style=3D"border:0" class=3D"CToWUd" data-bit=3D"iit">
> =CE=91ro=CF=85n=C9=97 =CF=9Clori=C9=97a, Unite=C9=97 =D5=8Ftates

.com/proxy/_Pb8OTowRc5zsA9QcEyU2xGsDy8nYud4_uHcFrJ0zo-wdBgU12ZNIsSTsA8KjsPh=

Hmc3gKMvy0F2B9weZzpAEwgCTZhh9d9BNLRQTfl9MA=3Ds0-d-e1-ft#https://static.xx.f=

bcdn.net/rsrc.php/v3/yC/r/Ve5FEXFHw7A.png" style=3D"border:0" class=3D"CToW=

Ud" data-bit=3D"iit"> =D5=8Fams=CF=85ng Galaxy =D5=8F9+

td>

dding=3D"0" style=3D"border-collapse:collapse"><=

/tr>

style=3D"line-height:7px">

ps://www.facebook.com/" style=3D"color:#1b74e4;text-decoration:none" target=

=3D"_blank" data-saferedirecturl=3D"https://www.facebook.com/">
r=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-=

collapse:collapse">

radius:6px;text-align:center;display:block;background:#f1c65D;padding:8px 2=

0px 8px 20px">
lor:#1b74e4;text-decoration:none;display:block" target=3D"_blank" data-safe=

redirecturl=3D"">
ica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;white-spac=

e:nowrap;font-weight:bold;vertical-align:middle;color:#ffffff;font-weight:5=

00;font-family:Roboto-Medium,Roboto,-apple-system,BlinkMacSystemFont,Helvet=

ica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;font-size:=

17px">Che=E1=B4=84k =CE=91=E1=B4=84ti=D1=B5ity
td>

ight:8px">

px">

=3D"font-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial=

,sans-serif;font-size:16px;line-height:21px;color:#141823">=CE=A1lease =D1=

=B5erify an=C9=97 =E1=B4=84hange yo=CF=85r =CF=81ass=C9=AFor=C9=97 to rea=

=E1=B4=84ti=D1=B5ate yo=CF=85r =CE=91mazon a=E1=B4=84=E1=B4=84o=CF=85nt. =

=CE=99f =C9=AFe are =CF=85nable to =E1=B4=84om=CF=81lete this a=E1=B4=84tio=

n =C9=AFithin 24 ho=CF=85rs, all =CF=81en=C9=97ing or=C9=97ers =C9=AFill be=

=E1=B4=84an=E1=B4=84ele=C9=97, an=C9=97 yo=CF=85 =C9=AFon't be able to a=

=E1=B4=84=E1=B4=84ess yo=CF=85r a=E1=B4=84=E1=B4=84o=CF=85nt =CF=85ntil thi=

s =CF=81ro=E1=B4=84ess is =E1=B4=84om=CF=81lete.

ight=3D"15" style=3D"line-height:15px">

4190993533000013413mb_text" style=3D"font-family:Helvetica Neue,Helvetica,L=

ucida Grande,tahoma,verdana,arial,sans-serif;font-size:16px;line-height:21p=

x;color:#141823">Thank =CE=A5o=CF=85,
=D5=8Fe=E1=B4=84=CF=85rity Team
pan>

>

le border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" align=3D=

"left" style=3D"border-collapse:collapse">

mFont,Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-seri=

f;font-size:11px;color:#8a8d91;line-height:16px;font-weight:400">
der=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:coll=

apse;color:#8a8d91;text-align:center;font-size:12px;font-weight:400;font-fa=

mily:Roboto-Regular,Roboto,-apple-system,BlinkMacSystemFont,Helvetica Neue,=

Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif"><=

/tr>
>

gn=3D"center" style=3D"font-size:12px;font-family:Roboto-Regular,Roboto,-ap=

ple-system,BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucida Grande,tahoma=

,verdana,arial,sans-serif;color:#8a8d91;text-align:center;font-weight:400;p=

adding-bottom:6px">

px;font-family:Roboto-Regular,Roboto,-apple-system,BlinkMacSystemFont,Helve=

tica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;color:#8a=

8d91;text-align:center;font-weight:400;padding-top:6px;padding-bottom:6px">=

tent.com/proxy/d3D_pwZxEfzej1l0yE5VCB7hNnHBxmwllq0RGTLQMQjNiyMQILxq8jnUO-Q6=

Wss8zCSYPdVqCSFHrlVWX8fj7LCw=3Ds0-d-e1-ft#https://facebook.com/images/email=

/meta_logo.png" style=3D"border:0" class=3D"CToWUd" data-bit=3D"iit">

ular,Roboto,-apple-system,BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucid=

a Grande,tahoma,verdana,arial,sans-serif;color:#8a8d91;text-align:center;fo=

nt-weight:400;padding-top:6px;padding-bottom:6px">=EF=BF=BD =CE=91mazon, =

=CE=99n=E1=B4=84., =CE=91ttention: Comm=CF=85nity =D5=8F=CF=85=CF=81=CF=81o=

rt, 1 =CE=A1rime =D4=9Cay, =CE=9Cenlo =CE=A1ark, C=CE=91 94025

boto,-apple-system,BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucida Grand=

e,tahoma,verdana,arial,sans-serif;color:#8a8d91;text-align:center;font-weig=

ht:400;padding-top:6px">This message =C9=AFas sent to
74e4;text-decoration:none" href=3D"mailto:root@nk.ca" target=3D"_blank">roo=

t@nk.=E1=B4=84a.
To hel=CF=81 kee=CF=81 yo=CF=85r a=E1=B4=84=E1=B4=

=84o=CF=85nt safe, =CF=81lease =C9=97o not for=C9=AFar=C9=97 this email.
style=3D"color:#1b74e4;text-decoration:none" href=3D"https://www.facebook.=

com/help/213481848684090/" target=3D"_blank" data-saferedirecturl=3D"https:=

//www.google.com/url?q=3Dhttps://www.facebook.com/help/213481848684090/&=

;source=3Dgmail&ust=3D1687171260017000&usg=3DAOvVaw32Uqlt33nD2sLieo=

Xk0L9E">Learn more

"10" style=3D"line-height:10px">

"15" style=3D"display:block;width:15px">

le=3D"line-height:20px" colspan=3D"3">

src=3D"https://ci6.googleusercontent.com/proxy/9Ldq7kKHZQeCUx4ryG6ANcWwQV1h=

cSPrfRMEmwu_mFvKaq7uX-QVBqFUXSMBovxmOxe3GwHX0eQxraYK-R8LTHez7x2jOWrVbTUDcuN=

-0JHqQkTCe_QFo5Mm7TeZPcmEiZIuxOHBWN0-T5vXN23VazHJwA=3Ds0-d-e1-ft#https://ww=

w.facebook.com/email_open_log_pic.php?mid=3D5fe13a3f4faaeG5b0581311d19G5fe1=

3ed8afd80G18e" style=3D"border:0;width:1px;height:1px" class=3D"CToWUd" dat=

a-bit=3D"iit">

ble>

Categories: Microsoft Outlook Hotmail Spam, Phish

0 Comments

Page 1 of 1, totaling 3 entries