Harbor Freight phish from Micosoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 31 Dec 2023 04:23:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1rJttf-000000009AM-2PuY

for dave@doctor.nl2k.ab.ca;

Sun, 31 Dec 2023 04:22:23 -0700

Resent-From: The Doctor

Resent-Date: Sun, 31 Dec 2023 04:22:23 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm6nam12hn2206.outbound.protection.outlook.com ([52.100.166.206]:44129 helo=NAM12-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97 (FreeBSD))

id 1rJkVS-00000000LGU-2bBB

for doctor@doctor.nl2k.ab.ca;

Sat, 30 Dec 2023 18:20:50 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=m2sVh3Z9GjFLYSVxxqC+BlANlEoWJExuOaRe+Y6Cwxgjp5hqEWxcJUc2qsCLeu7M9naXvn5jjcHkpqOpv24Avd2W2rDt/HZgAk28wOO7iFXChsVG/KU16yCVVkH2IgovBzNGwo5isqRryvXOCGmc5zd2CPwtp+4I3jCSyzOTwjqS6CS9qgUYBqbGEL0qZ81/vdnZgC2Hz40jg0WnZoqQxzPFIZXa/eBo4K2q5H/HdX1xK1jf5vnMXts+1qgQRKxJ+wITj+9h9nyCXz9kxhATHmYGXRDnB3+33KMgFI2l9QomHACXTm976NCYgyi2YV/AwPiF1DgfJEryHERQ8d3//g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=yAxdiMhzSkivXmPMWFqC3Hq69ovLWyWd7r1EYzW2wJM=;

b=iZ85OuA8ts0r8/ASgZOMr60qPLgs918J9iy/B2dXuu0qtdw522GAblr2eZipN3t3n7qQW5+dOAEVr9tS3m1SCcaV38D7cZ/Z9YQrMptPZqu9iZB8ABvzKXc84VPndN64EqG9G1C/HQGzakeGxIfUrSK2EcI9iIL9H9GYIlTDyvmA/PNYx6Al7w63hCZxg9Ez5/pnt0L95dEGFofcxcXxLRyG7aBvg6exDcQe+knQVoqOCxtTbzDXWlae8nbTWaRNBpHNEMBNXu/Nx1o7Fhk0fJZ3VZ1vUfDOQ7U/kXWtHCGpMlf5X9nkPiC8tdtIvDg2KO5NajBCtbNzCY1kjNvGng==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

192.155.93.204) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.helo=mail.thompson.com; dmarc=none action=none

header.from=malcis.onmicrosoft.com; dkim=none (message not signed); arc=none

(0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=malcis.onmicrosoft.com; s=selector1-malcis-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=yAxdiMhzSkivXmPMWFqC3Hq69ovLWyWd7r1EYzW2wJM=;

b=Z1uxfb8zqZnSrRQ+es44vck4rU1imuyf6/gNyvnv9sK4X9JDciFbJE05ITpPXC4SlJ0/FcWyMqfoEp7NqYXFkWOsfKiI+XH+6/m23v11qPV+d1+QdOXDr7CjsdlXA8IdPh/B4G98tdc0GeZimq8LlbkRom8l9/yYMl8iG9ogPX0duC7pxt2cksNitZZ+AW/gP6h5YHOf0d4viUj3yF6SSXXV5CUMA5fQRgmVvI9SEKl33DyJzcS9wnVmmmdyqyrTCeF5fESD43YINGFReybX+kOl8VugpypTRE1hQmV3LGrYPUsNU9yAwtFVWXYUt2Ke6WNY9Q0+ATj7p6zpWg5XyQ==

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 192.155.93.204)

smtp.helo=mail.thompson.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=malcis.onmicrosoft.com;

Subject: =?UTF-8?B?Q2VsZWJyYXRpbmcgSGFyYm9yIEZyZWlnaHQgYW5uaXZlcnNhcnkgd2l0aCBhbiBQaXR0c2J1cmdoIE1lY2hhbmljIFRvb2wgU2V0?=

MIME-Version: 1.0

To: doctor@doctor.nl2k.ab.ca

Importance: high

X-TOI-MSGID: <1919043148.2A9A964613146.1703985389649@thompson.com>

Date: Sun, 31 Dec 2023 02:16:29 +0100

Content-Type: text/html; charset="UTF-8"

From: =?UTF-8?B?SGFyYm9yIEZyZWlnaHQ=?=

Content-Transfer-Encoding: 7bit

CC: doctor@doctor.nl2k.ab.ca

In-Reply-To: <1foXLxI96ky2a3hP2rwASVZa6A1WRd@ZcqsLyUBeP.malcis.onmicrosoft.com>

Message-ID:

<589c6609-0dad-4f4b-b20d-f2b3cebed5df@BN8NAM12FT082.eop-nam12.prod.protection.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BN8NAM12FT082:EE_|BY5PR22MB1921:EE_

X-MS-Office365-Filtering-Correlation-Id: fddcf1ed-44ce-4ed4-b865-08dc099e80d6

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

+D+HdbXzUZDkC8II8e5ZKSiiHKgmmGejkSow92ER/boA38CzEWlxezEVRsVkMcPHRE3aal0JeFiZvwiCy3BdD3ItjmkkDPEZM53e8AiWM+pmXaTMfw1TITqKtB8jYu3hKJkyxse9rPzYMr8vbF5KWzaw2NMJN+MgpkqzFTwpbK8/MOE+Ehwmn11/HlPHxp5NrPereyOUdP2MCXedbjvwqg09exbgnm0ysfvS06mkrQ/eBTe4V4qOassfnyuV1dNVUZ9k8dxL1e3Gibn9QmRgE6cNUbvDXCLZvzGslTeFph9Ri7J4B5ZjRlFkLHWKfKVFDESXIUr2yHlpLtuDSjbp8AyDV7CR8VQxTDKBdVDDP+Yn7Fb7bS6FtcsR+E4lCmpFqdd2aN2K7UYXwZr7az5B/sJ9PVRv8s6uobOCh2Qo7YVj88mWdvvWiQA/s1oD0QVaHANdZOwp3ZwokS7KNxirv9rY0RQXJ5+9YhoDNmY3C2wbZ2r1AbxH3D10WjUrMZsE

X-Forefront-Antispam-Report:

CIP:192.155.93.204;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.thompson.com;PTR:192-155-93-204.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(39850400004)(396003)(346002)(376002)(136003)(230922051799003)(7200799017)(1690799017)(451199024)(64100799003)(82310400011)(61400799012)(46966006)(336012)(42882007)(26005)(9686003)(35950700001)(17440700003)(34020700004)(47076005)(5660300002)(19625305002)(4326008)(67280400001)(41300700001)(2906002)(498600001)(316002)(78352004)(786003)(8676002)(8936002)(70586007)(70206006)(6916009)(42186006)(31696002)(41320700001)(558084003)(81166007)(166002)(82740400003)(40480700001)(31686004)(8400799017);DIR:OUT;SFP:1501;

X-OriginatorOrg: malcis.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Dec 2023 01:19:14.5649

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: fddcf1ed-44ce-4ed4-b865-08dc099e80d6

X-MS-Exchange-CrossTenant-Id: c7dc7f4c-7a03-4c13-85cd-0a4d483a5ff1

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=c7dc7f4c-7a03-4c13-85cd-0a4d483a5ff1;Ip=[192.155.93.204];Helo=[mail.thompson.com]

X-MS-Exchange-CrossTenant-AuthSource:

BN8NAM12FT082.eop-nam12.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR22MB1921

X-Antivirus: AVG (VPS 231231-0, 12/30/2023), Inbound message

X-Antivirus-Status: Clean









(1) Notifications