Harbor Freight phish from Micosoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 31 Dec 2023 04:23:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1rJttf-000000009AM-2PuY

for dave@doctor.nl2k.ab.ca;

Sun, 31 Dec 2023 04:22:23 -0700

Resent-From: The Doctor

Resent-Date: Sun, 31 Dec 2023 04:22:23 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm6nam12hn2206.outbound.protection.outlook.com ([52.100.166.206]:44129 helo=NAM12-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97 (FreeBSD))

id 1rJkVS-00000000LGU-2bBB

for doctor@doctor.nl2k.ab.ca;

Sat, 30 Dec 2023 18:20:50 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=m2sVh3Z9GjFLYSVxxqC+BlANlEoWJExuOaRe+Y6Cwxgjp5hqEWxcJUc2qsCLeu7M9naXvn5jjcHkpqOpv24Avd2W2rDt/HZgAk28wOO7iFXChsVG/KU16yCVVkH2IgovBzNGwo5isqRryvXOCGmc5zd2CPwtp+4I3jCSyzOTwjqS6CS9qgUYBqbGEL0qZ81/vdnZgC2Hz40jg0WnZoqQxzPFIZXa/eBo4K2q5H/HdX1xK1jf5vnMXts+1qgQRKxJ+wITj+9h9nyCXz9kxhATHmYGXRDnB3+33KMgFI2l9QomHACXTm976NCYgyi2YV/AwPiF1DgfJEryHERQ8d3//g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=yAxdiMhzSkivXmPMWFqC3Hq69ovLWyWd7r1EYzW2wJM=;

b=iZ85OuA8ts0r8/ASgZOMr60qPLgs918J9iy/B2dXuu0qtdw522GAblr2eZipN3t3n7qQW5+dOAEVr9tS3m1SCcaV38D7cZ/Z9YQrMptPZqu9iZB8ABvzKXc84VPndN64EqG9G1C/HQGzakeGxIfUrSK2EcI9iIL9H9GYIlTDyvmA/PNYx6Al7w63hCZxg9Ez5/pnt0L95dEGFofcxcXxLRyG7aBvg6exDcQe+knQVoqOCxtTbzDXWlae8nbTWaRNBpHNEMBNXu/Nx1o7Fhk0fJZ3VZ1vUfDOQ7U/kXWtHCGpMlf5X9nkPiC8tdtIvDg2KO5NajBCtbNzCY1kjNvGng==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

192.155.93.204) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.helo=mail.thompson.com; dmarc=none action=none

header.from=malcis.onmicrosoft.com; dkim=none (message not signed); arc=none

(0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=malcis.onmicrosoft.com; s=selector1-malcis-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=yAxdiMhzSkivXmPMWFqC3Hq69ovLWyWd7r1EYzW2wJM=;

b=Z1uxfb8zqZnSrRQ+es44vck4rU1imuyf6/gNyvnv9sK4X9JDciFbJE05ITpPXC4SlJ0/FcWyMqfoEp7NqYXFkWOsfKiI+XH+6/m23v11qPV+d1+QdOXDr7CjsdlXA8IdPh/B4G98tdc0GeZimq8LlbkRom8l9/yYMl8iG9ogPX0duC7pxt2cksNitZZ+AW/gP6h5YHOf0d4viUj3yF6SSXXV5CUMA5fQRgmVvI9SEKl33DyJzcS9wnVmmmdyqyrTCeF5fESD43YINGFReybX+kOl8VugpypTRE1hQmV3LGrYPUsNU9yAwtFVWXYUt2Ke6WNY9Q0+ATj7p6zpWg5XyQ==

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 192.155.93.204)

smtp.helo=mail.thompson.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=malcis.onmicrosoft.com;

Subject: =?UTF-8?B?Q2VsZWJyYXRpbmcgSGFyYm9yIEZyZWlnaHQgYW5uaXZlcnNhcnkgd2l0aCBhbiBQaXR0c2J1cmdoIE1lY2hhbmljIFRvb2wgU2V0?=

MIME-Version: 1.0

To: doctor@doctor.nl2k.ab.ca

Importance: high

X-TOI-MSGID: <1919043148.2A9A964613146.1703985389649@thompson.com>

Date: Sun, 31 Dec 2023 02:16:29 +0100

Content-Type: text/html; charset="UTF-8"

From: =?UTF-8?B?SGFyYm9yIEZyZWlnaHQ=?=

Content-Transfer-Encoding: 7bit

CC: doctor@doctor.nl2k.ab.ca

In-Reply-To: <1foXLxI96ky2a3hP2rwASVZa6A1WRd@ZcqsLyUBeP.malcis.onmicrosoft.com>

Message-ID:

<589c6609-0dad-4f4b-b20d-f2b3cebed5df@BN8NAM12FT082.eop-nam12.prod.protection.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BN8NAM12FT082:EE_|BY5PR22MB1921:EE_

X-MS-Office365-Filtering-Correlation-Id: fddcf1ed-44ce-4ed4-b865-08dc099e80d6

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

+D+HdbXzUZDkC8II8e5ZKSiiHKgmmGejkSow92ER/boA38CzEWlxezEVRsVkMcPHRE3aal0JeFiZvwiCy3BdD3ItjmkkDPEZM53e8AiWM+pmXaTMfw1TITqKtB8jYu3hKJkyxse9rPzYMr8vbF5KWzaw2NMJN+MgpkqzFTwpbK8/MOE+Ehwmn11/HlPHxp5NrPereyOUdP2MCXedbjvwqg09exbgnm0ysfvS06mkrQ/eBTe4V4qOassfnyuV1dNVUZ9k8dxL1e3Gibn9QmRgE6cNUbvDXCLZvzGslTeFph9Ri7J4B5ZjRlFkLHWKfKVFDESXIUr2yHlpLtuDSjbp8AyDV7CR8VQxTDKBdVDDP+Yn7Fb7bS6FtcsR+E4lCmpFqdd2aN2K7UYXwZr7az5B/sJ9PVRv8s6uobOCh2Qo7YVj88mWdvvWiQA/s1oD0QVaHANdZOwp3ZwokS7KNxirv9rY0RQXJ5+9YhoDNmY3C2wbZ2r1AbxH3D10WjUrMZsE

X-Forefront-Antispam-Report:

CIP:192.155.93.204;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.thompson.com;PTR:192-155-93-204.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(39850400004)(396003)(346002)(376002)(136003)(230922051799003)(7200799017)(1690799017)(451199024)(64100799003)(82310400011)(61400799012)(46966006)(336012)(42882007)(26005)(9686003)(35950700001)(17440700003)(34020700004)(47076005)(5660300002)(19625305002)(4326008)(67280400001)(41300700001)(2906002)(498600001)(316002)(78352004)(786003)(8676002)(8936002)(70586007)(70206006)(6916009)(42186006)(31696002)(41320700001)(558084003)(81166007)(166002)(82740400003)(40480700001)(31686004)(8400799017);DIR:OUT;SFP:1501;

X-OriginatorOrg: malcis.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Dec 2023 01:19:14.5649

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: fddcf1ed-44ce-4ed4-b865-08dc099e80d6

X-MS-Exchange-CrossTenant-Id: c7dc7f4c-7a03-4c13-85cd-0a4d483a5ff1

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=c7dc7f4c-7a03-4c13-85cd-0a4d483a5ff1;Ip=[192.155.93.204];Helo=[mail.thompson.com]

X-MS-Exchange-CrossTenant-AuthSource:

BN8NAM12FT082.eop-nam12.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR22MB1921

X-Antivirus: AVG (VPS 231231-0, 12/30/2023), Inbound message

X-Antivirus-Status: Clean









(1) Notifications
























Amazon Phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Dec 2023 05:46:03 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1rJYj2-00000000AMx-1QRC

for dave@doctor.nl2k.ab.ca;

Sat, 30 Dec 2023 05:46:00 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Dec 2023 05:46:00 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-db3eur04hn2204.outbound.protection.outlook.com ([52.100.17.204]:27268 helo=EUR04-DB3-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97 (FreeBSD))

(envelope-from )

id 1rJXmA-000000002Os-3TIE

for root@nk.ca;

Sat, 30 Dec 2023 04:45:16 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=AchweslugrgfhUXljm/JnkwbxucpsZd3IiVMLyTHihJ4NMPZCFKtGKU8T+O4J5q28ws9Cef/eEseD7XEBUDzycRCC+ttLxsI1B1Zlvjqzm+BUi8rO3MBPBTjKZdRj7PlAccsRCEn4ulxCKyqr32nr+4F9FJxXKA5vwg+2hzQd3TqGYXNBqDAtQtIIP7ocaA6+PDTRRZxWyF27ag9Xal7ymS8rFp5EYo5Ed49IgedL9g0c3lzzEFdgHTOw3q3JZf80gE/cKD4IP79FiYZtKYbdPFB3DLdwouQIcJp91TxxpJNfpfNjDUjXIy/bEan7ONG9NFXU50KlaLHASnCU5g6Bg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=5mF2a82juWo/Nc67JOG1Lzh0y1ZGRSrJyhXS4I70Nr0=;

b=bt7l8NFQE9g/PlZITupnB4vJ5aOeOusQy3Zu5yR6uDdKXB3in/PoqvZ0G6WJ8fi6LHIHlQWcdPzNNBKCqNBa6kVnXtNnWD7BRmVt66YiiuUDwpOOEdVn3LtLDPI0AmsSboQixCUm3oER16IMS6RCFzO4ugQwnQLG183PEVtkxlrCDlktMYhbg/x22U1u3PcI6XvLlgTt+cpEZP6lU0nCjgWWHR32iLEeLCKyJ/AqHGcmJrfuRsVqhjMlmCPrdioF0n3yzwkRVJlLRBHO1xqD1mE2RZMyrnW8romltTA4scXLn1ZlRFr+6SywHhvsAbB5aZrpqn+894rV6wGDE5gOCw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=abonoorganicoaboplant.com; dmarc=pass action=none

header.from=abonoorganicoaboplant.com; dkim=pass

header.d=abonoorganicoaboplant.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=psp4radomsko.onmicrosoft.com; s=selector1-psp4radomsko-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=5mF2a82juWo/Nc67JOG1Lzh0y1ZGRSrJyhXS4I70Nr0=;

b=iH2eUkCqqkjeOfUS/xEo7TrrTXiVS0WBSTold/WT1UwVPb5Ywo7h9E6AtCQ3/a5EaEEO3BBr/u2jmnyDU5KQAsEmFYDjXltO6VGHcmEQT8mK0UZggQoIkY4sUcVgohswAZlZtkCxtzWIdsjGjzrwOe8iXsyfj+sYBqNP3zjucGx76X6gwENkZLAd8kVAsGOyBNClWRhmVMgIXdvxfPNTKVnbatGiKEQc1Vy0e4WXRFfkugVAZgDJhF7JLEiwh7+0d70Ixo8nkrj3wHRapnzct5bPPXOQhMdC/ZyGaLe4A92Ito100GFVnmfb6A8w4QFMW2pYwvuxe6GQ+5lAGLxw3w==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=abonoorganicoaboplant.com;

Received: from AM0PR08MB5140.eurprd08.prod.outlook.com (2603:10a6:208:162::17)

by DB9PR08MB7747.eurprd08.prod.outlook.com (2603:10a6:10:396::19) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7135.22; Sat, 30 Dec

2023 11:43:39 +0000

Received: from AM0PR08MB5140.eurprd08.prod.outlook.com

([fe80::1930:63ed:4432:b007]) by AM0PR08MB5140.eurprd08.prod.outlook.com

([fe80::1930:63ed:4432:b007%7]) with mapi id 15.20.7135.022; Sat, 30 Dec 2023

11:43:39 +0000

Date: Sat, 30 Dec 2023 07:43:35 -0400

To: root@nk.ca

From: Support Lead

Subject: We locked your account for security reason - Sat, December 30, 2023 7:43 AM

Message-ID:

X-Mailer: WebService/1.1.18291 YMailNorrin Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

X-ClientProxiedBy: SJ0P220CA0017.NAMP220.PROD.OUTLOOK.COM

(2603:10b6:a03:41b::27) To AM0PR08MB5140.eurprd08.prod.outlook.com

(2603:10a6:208:162::17)

Importance: high

X-Priority: 1

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: AM0PR08MB5140:EE_|DB9PR08MB7747:EE_

X-MS-Office365-Filtering-Correlation-Id: 2c40b90d-2414-4fc3-3b1d-08dc092c90ab

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?ZFF2aTkzRkdpdjg3R29WcGVnS2hvVE92MUR0dEhXSjlXRU83VkNibVJsNHJX?=

=?utf-8?B?S0tHUkh1Sm9veHBTL010VmlJSS9wQUd0QVFqMUM5TDB6N1lDN2NYYXE4TU9I?=

=?utf-8?B?RnpVV2RtZldnVkZGYkFFVHB1cXZ0bjVmYVhneDVjaHZxZ1hJWkloNjl2MnUx?=

=?utf-8?B?cFR6S3g2VFBlRnFpZFhheWtSbW84M0NxREY3ck54bjNkbGFYQWZSVGNZbGNv?=

=?utf-8?B?V01lc0RQMjFpSE9yZ2l4Vk0wTThZYkU4b1R5RzZ2Q3pRcS9QMHZkNmoxMEll?=

=?utf-8?B?WUt2YTZmNkpLeWVNMGJzOHQvbkxuMS9MeEtPcGFIOWJHWEtja0RaTk9WMmZ0?=

=?utf-8?B?Um9ORk9hd2dLYlVtbUFBTVBjb2lpNG5xRXc5em52bzBQS0dBeHZRYUFwOXIw?=

=?utf-8?B?KzE3amJGdm51VmpwU3RpVTA2ZEwrL21UbldXdjFiaTZOYXhiY3RvcFpSUUtB?=

=?utf-8?B?WnJZN2lpMnJYZ2lEU2orNmtraEpkQWNLd3FxYjVwWjFGSUo4RDRDSG1GVk9R?=

=?utf-8?B?R0VtSlYwVHBsQ2MzZk1BdmZGd2tZdnBxdWMyNmordzVLVGk5cXZ1M1dtZEZx?=

=?utf-8?B?akYySHllb1piM1BNUTQwQTlQbTNnN1N6T1VwSTBKVnVGSkhCeTM4STM4TzdU?=

=?utf-8?B?RUtJZEhPb25ZeUVWNjFXbnltRTU1czlxb2tXMnNwVGMwaDF0WEpJUC95OVFw?=

=?utf-8?B?RENoRUo5a1E3dDlsU2xFTzZuNFNUV2phTE8xK1IyU2lCbTBMbzhOS3I3ZWpz?=

=?utf-8?B?cmt1b1pPTm01bGJiendab2Q4dTMyeVhYQUF5YmdKcm5WZjNQYmIwdjBZQUd5?=

=?utf-8?B?VVErS2dmUUovdXA0Mld1UElLMytMVTMzbnpRMkxhZWhiQi9rOU80TVFHMjlP?=

=?utf-8?B?UUxlWnNrMENWMXUxYm96aXZESUxzY3RaM2ZScElQSkQ0QnZVQnE5MGNBY1lB?=

=?utf-8?B?UWo3L1ZTZWpVbFdpaFJLRHFJeUkvaDYxU0lQNjBBbm9mZ1JYTjZocjNFemg0?=

=?utf-8?B?Ukp6SlBWV3I3M2JNd2tqelhWcUJSMkNDWWZ2dlNNMmRWbWc2SW8zak9xQVEy?=

=?utf-8?B?OU5TdmFGcElyZkdHajNCR0xReFFMeE5tUG9SK3FjcU91V1JVQi9pRFVUYTdB?=

=?utf-8?B?T1lsKzNpN2xJUlpkY3BkY1NVeDBUbzJPcG5ReWRlenZwUU1jZmEydThWS29u?=

=?utf-8?B?MnVYajNITEhsWXgrU2s5c0lIcGN2Tm1JY3N0czVNSmNNTUxpQWN3a0hkallG?=

=?utf-8?B?YUFrZm9qcmpMbnJlVDA5OFJCNi9reGEzUGp6NUQ1WDZlSUlCSWlkUXF3ajYy?=

=?utf-8?B?WktTVzFUcUVkTGRGQktXODBnV0NtTFZuQUVuamdzcnQxd2Rlc2VTQXdMSHpo?=

=?utf-8?B?b2taT0FtL25OVnlyZzBRLy8zRDRVZStuMHBWODNzTWpWK0NxWTVIdzVaeHFP?=

=?utf-8?B?RVh0U3Y3clBZOTRSTTNtdUI5eG5PYzRlT3gxT2plQVJOdUd1WkZDclFHQm0y?=

=?utf-8?B?ZjkwMkFCdWQyVjVFOUU4K1FXcEJLTjFJenF0Vld1N2lRRUEzVlFMK0dSWEZD?=

=?utf-8?B?MEJJUXZFSG1EL01IS3F1REVlK2RyWVl1TytOV0Y4dEJlS1lKMTBycTB6enFk?=

=?utf-8?B?bnh4am1IM2VpODAwVnlnNUExZys3VSs3aW1XVDJITHhsYVJlK0Q4aHdDODZT?=

=?utf-8?B?aW1HL2ozK2RZMVdZNzRoNFd0YlBLZk1lOTdmK3R1Y1p0T1FkaTNhcGpEVFRr?=

=?utf-8?B?USs3V0RCS01hZlFvMm1kS2ZCWnRyODRoeTAwTnhoRUZHN3NoZG9lc1doZXRZ?=

=?utf-8?B?YjhPTWpRVHphRTdHeE9ZbDZBQk5MamxNMUNuWjVBUkZkcmhlN1JBWEdzd2tK?=

=?utf-8?Q?LPxnUteiJY0Ki?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:AM0PR08MB5140.eurprd08.prod.outlook.com;PTR:;CAT:OSPM;SFS:(13230031)(346002)(136003)(396003)(366004)(376002)(39860400002)(230922051799003)(64100799003)(1690799017)(451199024)(186009)(1800799012)(66899024)(41320700001)(8936002)(8676002)(15650500001)(5660300002)(4744005)(6486002)(316002)(786003)(66946007)(6916009)(66476007)(66556008)(38350700005)(5009030100002)(86362001)(2906002)(38100700002)(166002)(55236004)(26005)(9686003)(6512007)(6666004)(508600001)(6506007)(52116002)(83380400001)(41300700001)(61276011)(131040200001);DIR:OUT;SFP:1501;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?YzFLaE9zTGRmLzNmZFBtNFErZEZGSFBOWGo5Lytqam9Yejd5K0hBY2ZCSDlP?=

=?utf-8?B?cDRBSTg3eTA3QkpZc3FwWU53aUtoSjhVWFBBNUJhVThmLytLRHZQUkRxT3NO?=

=?utf-8?B?Zm5BRWVRQzdIOWhIemRaT1VpL0FXUlQ0TGQxcktnOFdXTldrbTQ5S0w0L0Fp?=

=?utf-8?B?L2cyckRveG1rVDAwNmxJKzZhYW82NnhSYy9XOVI1Z1lsNW1NYll6eFZPRjg4?=

=?utf-8?B?QlRBSkFNR2dyMXJGeWpYNVZ4ZS9XcUNyQ0VKM0VzUHRWTkF2dm9ZM2NybnJN?=

=?utf-8?B?dzlSb1ZWdWR6bHlRRWJ2K0hiaHA4QzRQT1gvdGtqencrVFJIQlpIMThGMlVk?=

=?utf-8?B?WmFSL2ZoMEo0dXkycFRFQVBKZ1FvekJ3WXRrNkJwVTV3ODVxbno5RXlDak1O?=

=?utf-8?B?eEFWSVo2Z3dpSXl0Q1BEaEZPejhRbjMwQ2YrZEtzcGh5KzRiS0hVTG9NbCtn?=

=?utf-8?B?aVFoRmF3dERqR3VsNSs5aUpHL1FzTHpnWWFwM3ZvZkd5WmtZRGFJcThEZFcx?=

=?utf-8?B?aDh6bDhIVkpqS3kvL041REVUem83aE5kWVUvRTJ5cVZ5UmlxUXZPUDdsNnlh?=

=?utf-8?B?RVh4KzZ1bWJLV0FNYlhuaW5iQk5UTWdhZit3Qmg3ZmwyOStPRVQ0V1RTZ2pX?=

=?utf-8?B?OHFrRHRVSkxqaWpmVDRZZk9PVldUU3gwNkZybUx3MG56d0xyUk9hamxtRDRS?=

=?utf-8?B?TXpzeTBpOHJka0ZtUUY4MXlCeXRtenh0ZU9MNU94SGpyaDJjZ2hYdmxoSGxT?=

=?utf-8?B?OFRNVk1MTVdFNUJGQW5FZU11c290M2xCcy94ZEFzSnp4dVpybFVDS1B5WDI2?=

=?utf-8?B?bFpLazY1VG1ZOGFPNE44eUl2MG53eXB2azc5c0dDU2ZCaXllbUR3WW9pQTdy?=

=?utf-8?B?M0xFWVZlYk80UlppL0o4VnhBVW1WRFVSWW9nYWZmYlNHOWk3WGVnTVgzQ0ly?=

=?utf-8?B?QkpnRWNWV3RsbkdJOHZMRWNnVVRqSFBvdVlKTW1KOGx6N2pKTDllQXZoV1Nu?=

=?utf-8?B?TDZYUVpKSEFPcm84ajNVOVpUSFljWjFjeWV1aE8xU3I0YkZNVndyVGdLdThh?=

=?utf-8?B?OW0vTWJUbzYzQnlyZUtnQ1Q2dzNYZ3NhK3cyOEl2RGdpSmtyQy9KRU9LSTZH?=

=?utf-8?B?bkN0enMySG9kbUpYbTZVait6RC9ZWjF1Y0VLK0V5ai9KRnlraFBtOVcvYU1F?=

=?utf-8?B?SGFhUHBJK1k3Vkw2Nk96WERid0dRVGxlMFdBa29lSG9UY2x5RUZaZHM1Rysz?=

=?utf-8?B?RkhZd055S1ZtV28zM2VFbjdDdFh0K0FpSWYrazNuK3UvdGFETm5JSklDQnpW?=

=?utf-8?B?UFE5dCtERHgrOVpWVnVFWThRN2czNVBaWldnWEQvc3cxSjBxY0FQbDdvTlJl?=

=?utf-8?B?NTgxRFR0WU9FbENhRFZaVTdyeXhGdVp1QWFLN2tUUHBoSHloUUV1TGhjT3Bs?=

=?utf-8?B?Rmd4QUhLbzRVRzZDWDZTRzZtN29iOG1sSXdjci84SVpzZjlkaHZsVnhXc3lF?=

=?utf-8?B?RHJ0dFFENVNwOGVBQjVVWGN6cjEyd0wyRklWbzZNREUwUnlBc0k1ZDhTWXo1?=

=?utf-8?B?bFhPb2FYN2FyQ3RUb2p3dFZMNjJqZjhzK0dyQlI4UExIRzRXcU5kR2ZLUUpH?=

=?utf-8?B?ZDV3cDNZKzJ6ZklXU1FqbU5iZ29FWU55bGJLdWtnK1NROVR2QStGcERiOXBj?=

=?utf-8?B?Zkczdjl0RmhZQnlxd3VnTzdKZlJCQVJxZU9YT05oejJjQnpvMGRwdEVqRUJy?=

=?utf-8?B?NjQ5OFBKZnFjNjdsMkQxK0IwODN6eE4rUCswWkFmTm43L3JlcVZoSkNRU2tI?=

=?utf-8?B?VnZ4VHZoZGVwL3NkcEkxdE9TV1E5NmxGcU1zTzV4WjR6M1FDR09IRDdQbTNP?=

=?utf-8?B?QmQ2VnRwNWUrck1uYTBnYW1kd29SWlRGTW1WbHRxWkJHNTIyODFsSEl4ajdZ?=

=?utf-8?B?RjBaZUhNOVcreFBvY2RPc3phZGtJNlpWWWtvUEQ2Z3FSdWhnMk1WdmplUkp6?=

=?utf-8?B?MlUyUkxFL05pSmEzR0s1YmpDLzY2d2sya1JzQUxIOUtBMEFCTUMrZ3pmWGxC?=

=?utf-8?B?UXFIbE1xL2F1ZHVrcFRsMFVVMVZCNVFMV29DMjArZW95TWJYT3IwZElJQXJI?=

=?utf-8?B?bFdWVGJXN1JDamVpYzlUWmROVWVhTExrSEtiYi9TaDM4MHdWV1p3QURseWto?=

=?utf-8?B?OSs3bnVyZlQwWi9uRE1udk8yN1NqVVp5M0traVZiZ3BkZ0hTWGpaeGpNZE5W?=

=?utf-8?B?emVqNjF4UENrN2NDUkdDRnZsdmZnPT0=?=

X-OriginatorOrg: abonoorganicoaboplant.com

X-MS-Exchange-CrossTenant-Network-Message-Id: 2c40b90d-2414-4fc3-3b1d-08dc092c90ab

X-MS-Exchange-CrossTenant-AuthSource: AM0PR08MB5140.eurprd08.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Dec 2023 11:43:39.0788

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: c20ddd07-a923-4494-acfb-8c728f876222

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: Vw8gVIAySHxhig/kgy80YDsP+7U+SKSdWONjTlCo5r5/5R+MDy1p+qITN36rb5NwrUuo7pQgiPEQOjU/kyWG09Y6Xm92/mXz7VmUpekrJr21TjAk5VdXMEo7upnxVAotZmMfsF18o38NnOzn4iJGiqG0dH+6n41Rrgq78MMoMi4=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB7747

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Amazon Services Sign In Authentication failed because your

account has been suspended. If you believe your account (root@nk.ca) was

suspended due to non-payment of outstanding balance due on your account, you

can pay now using the Payments to reactivate your account. If you do not

pay o [...]



Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.17.204 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.100.17.204 listed in list.dnswl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

1.0 AMAZON_IMG_NOT_RCVD_AMZN Amazon hosted image but message not from

Amazon

1.6 FORGED_MUA_MOZILLA Forged mail pretending to be from Mozilla

Subject: {SPAM?} We locked your account for security reason - Sat, December 30, 2023 7:43 AM

X-Antivirus: AVG (VPS 231230-2, 12/30/2023), Inbound message

X-Antivirus-Status: Clean




>
ia-amazon.com/images/G/01/authportal/tiv/amazon_logo_RGB._CB424887820_.png"=

alt=3D"google.com" width=3D"140" height=3D"42">

=0A=

=0A=

Amazon Services Sign In<=

/strong>

=0A=

Authentication failed because your account has been suspended.

=0A=

If you believe your account (root@nk.ca) was suspended due to non-paymen=

t of outstanding balance due on your account, you can pay now using the Pay=

ments to reactivate your account. If you do not pay or provide a payment me=

thod to resolve your outstanding balance, your account resources may be ter=

minated.

=0A=


QE?802551">Check Activity

=0A=

Please verify and change your password to reactivate your Amazon account=

. If we are unable to complete this action within 24 hours, all pending ord=

ers will be canceled, and you won't be able to access your account until th=

is process is complete.

=0A=

Thank You,
Security Team

=0A=

=0A=


book.com/">Terms of Use Privacy Policy &copy; 1996-2023, Amazon Web=

Services, Inc. or its
000000;" title=3D"hotmail" href=3D"https://live.com/">affiliates=

.

=0A=


.com/">
on_company_160x20.png" alt=3D"affiliates" width=3D"160" height=3D"20"><=

/p>=0A=


  • line-height:17px;margin-bottom:5px;margin-top:0">=0A=

    =0A=

    Sat, December 30, 2023 7:43 AM=0A=

    =0A=

    • =0A=


  • x;line-height:17px;margin-bottom:5px;margin-top:0">=0A=

    =0A=

    Samsung Galaxy S9+=0A=

    =0A=



    • shipping spam from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Fri, 29 Dec 2023 16:35:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJMNT-000000006UY-1nL0

    for dave@doctor.nl2k.ab.ca;

    Fri, 29 Dec 2023 16:34:55 -0700

    Resent-From: The Doctor

    Resent-Date: Fri, 29 Dec 2023 16:34:55 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-vi1eur02on2101.outbound.protection.outlook.com ([40.107.241.101]:1408 helo=EUR02-VI1-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJK8j-000000003Kj-0km4

    for doctor@doctor.nl2k.ab.ca;

    Fri, 29 Dec 2023 14:11:37 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=koKjykTK8nZi76IcUGdinhuraXIkY3WJ/ka3NrAKDqUKDUY7dTuBDH81qD0hCNaOEUavrbOhTxBOVQBoYPgMlUN3EBvZREcWFpLiswl6E6NoqHGRIdS3ZmFRNMKUMAwW3ohnajIeFrVPWGOTCk0Fl+C7AYe8nK/mYMf/sukPWZOET/dRMzNsCOzImMG0YJewZzVgaJEec/oGcEN8L3o3x5EJx/ZO1L76QD61DhItfSCFvm7TGLgGY49pvdNMsY9d8Uxc44JXujYduuFF8eoJHT2eI2OrRPyisggWNQWcGD91eWbpWZu/wRld3nO+92PDpwA+G3EuBpIktVFuCj3mPA==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=UuW6aRtnw+8PllIjQxBkvzu9L9n4EodBW/yWnhdE4AU=;

    b=lrbRvedlZMC2/3DdFnVuaP36I+/EW/RwgSzYZ4HQpMSq+rTq8EpjgW0W2s8I1QsXppLnIh8fppsLMiMnxp0Fw2CQcode7LaEeDRiDr2DZT5FzLZLtJYUb9X5/cNApg8x3lyW2WXbFSi3jRWymdw5Ln6PKE3YEjRbrYEOlbj9pQ5lqrX6TyLTgklSU1Qx64jqmiz5Nuu+NVX6idFChfhuPGMOhmeQUj3WFs3PQSbpWi5C1+RHRs7GsQR1QvniAC6XD/x0IprC23fDfwNZN39tjPtmcV9p8egMIa+i+wBWYz0QiWrP/zM8Nl+QuizAhIPtVj75h9wHKdRlsohPfBilqA==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    45.79.211.243) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=ontrag.onmicrosoft.com; dmarc=none action=none

    header.from=ontrag.onmicrosoft.com; dkim=none (message not signed); arc=none

    (0)

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=ontrag.onmicrosoft.com; s=selector1-ontrag-onmicrosoft-com;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

    bh=UuW6aRtnw+8PllIjQxBkvzu9L9n4EodBW/yWnhdE4AU=;

    b=mSLsDqHQlc30BUlwPmFesAHLY/Q5lla4VdPr8gGYSQj9PI33pQSiiJ//y8aLOMq09JxnS7DlM2Hs2sOG80XJvoXV50HdmAGTOFBZyBb7UDhwUsZg1HmeMXXqzqo0JBbPdmQnNZI88o6BO7xtUoD6VqtdcpM3ayd24hnQWh5YEjdw0t6U/Qz5Ze7VDq0MuAPq60L6wkFT+8zLY4QrWMbW5qrjgja/QzW86c3lbez4hz/XW09ZvPoRSNTkXHVWJR6gYMPBCg1G9FngTFj5l87vLAxpOm8bjwDmVz1Gl731s4y2KXDTzeEh8ZhMU+Sex8766zaa07K+QYIlr/h1po04yQ==

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 45.79.211.243)

    smtp.mailfrom=ontrag.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=ontrag.onmicrosoft.com;

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART_fNVV.lhpykfdd"

    Importance: high

    CC: doctor@doctor.nl2k.ab.ca

    In-Reply-To:

    X-TOI-MSGID: <171319376.6BDD4477C1CB2.1703883785714@thompson.com>

    Subject: Important for doctor

    Date: Fri, 29 Dec 2023 22:03:05 +0100

    MIME-Version: 1.0

    To: doctor@doctor.nl2k.ab.ca

    From: Shipping Department

    Message-ID:



    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: DU6PEPF0000A7DE:EE_|AS8P250MB0266:EE_

    X-MS-Office365-Filtering-Correlation-Id: 2536db4b-fb2e-4658-e6a2-08dc08b2701e

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    flDvYSb2i6Xjg8hfkEEWc7Lq7TY69ocz9U7x2Bn9S+ZfsIFoLFPPI5+roMLlh/fAWJlENqSNPToajwM9xhNhHNStLxOMb3Dy0xWlemx9AntP8yk0fUXbUw4wei4BUlO1AudLTJh+GQ3CrP9HFOkEjs8XQKZdNPI0C3yJsrFnReruaPjg4m5oI20XY++U7gnYc4goq69CyUiNkaAhtquTztFRz1HLb4y3tchit9ZagQIJDWEZSstwDN4BYNSEkTGkfBl2YqwO4aAU8uB/XS+9bkAcKzxIyHD1dthUX5AtLdckFu7Cm3R1bkg2evKxamBie8MZq7qJ1MdO1lHrZHFwoCU8ReYAONQcQg3QSooZX1fY4uEcvul9viJUlk8onT/B6kJH43zrHsVMSqjrJ0KU0xREBR6T4sqd+iQV4d9q+/bbrfRb96mV4PWZ17LHt11eCbsWRjgM/JtRny3K/xckKk0U5w67K0nFUg/UcAAabBKwd7I1ekaLcikji2C7FopHUJAzGQJpRey11j5JT4XXwKzJddJRaSmWFRybLZ4wjAI=

    X-Forefront-Antispam-Report:

    CIP:45.79.211.243;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.thompson.com;PTR:45-79-211-243.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(396003)(39860400002)(346002)(136003)(376002)(230922051799003)(61400799012)(64100799003)(451199024)(1690799017)(7200799017)(186009)(82310400011)(46966006)(36840700001)(40470700004)(36860700001)(34020700004)(47076005)(564344004)(82740400003)(81166007)(166002)(3480700007)(41300700001)(41320700001)(9686003)(8400799017)(40480700001)(8936002)(8676002)(7116003)(4326008)(33964004)(2906002)(5660300002)(19625305002)(6082699003)(786003)(316002)(42186006)(478600001)(70206006)(70586007)(6916009)(336012)(40460700003)(26005)(31696002);DIR:OUT;SFP:1102;

    X-OriginatorOrg: ontrag.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 21:09:25.6167

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: 2536db4b-fb2e-4658-e6a2-08dc08b2701e

    X-MS-Exchange-CrossTenant-Id: d3fac25b-5d9e-4e39-9edf-1e565413d2bc

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=d3fac25b-5d9e-4e39-9edf-1e565413d2bc;Ip=[45.79.211.243];Helo=[mail.thompson.com]

    X-MS-Exchange-CrossTenant-AuthSource:

    DU6PEPF0000A7DE.eurprd02.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P250MB0266

    X-Antivirus: AVG (VPS 231229-4, 12/29/2023), Inbound message

    X-Antivirus-Status: Clean



    --PART_fNVV.lhpykfdd

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"











    (8412) Notifications For YOU









































































































    --PART_fNVV.lhpykfdd--

    Walmart TV Stick phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Fri, 29 Dec 2023 16:35:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJMNC-000000006UG-0Q3t

    for dave@doctor.nl2k.ab.ca;

    Fri, 29 Dec 2023 16:34:38 -0700

    Resent-From: The Doctor

    Resent-Date: Fri, 29 Dec 2023 16:34:38 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-am0eur02on2086.outbound.protection.outlook.com ([40.107.247.86]:6336 helo=EUR02-AM0-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJJe2-000000002ou-1RpM

    for doctor@doctor.nl2k.ab.ca;

    Fri, 29 Dec 2023 13:39:54 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=h8aNdRsQMKdq6DIXBtZn+GN89L1LqOwZkijzX9KduBzY5jCbFa+2GltuW4IAkk/ou/tcsTjMXT+thZHKCVVFUaTr4R/c6fcKn0+geqZEywqvNFh10VcV5z6AjslJu9fjfMKSdBSWBRBlXCo2DqKd22oYN1EHbbTQAmIwZe7GeHD2WyD+/e4nl7dlt5uyGu2hua065hR3ww9aiuHLWWOmnQf5BGFo/cZms+wyeq3JRM+m1avDxEEg5wGU8lw/6USULSs211WeSb6s8W05dKF9/0WbnM3DkRhmz9KbNRL84G9suLZseDW1xFrSGYDzkGzCRhg7M2nGUvzhQTrFU31/Ag==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=zRhKZxIZjULzhr0FL2oiaYEHVWP6R5ckng1bu1otHSg=;

    b=VHmNnYhL/ww03KUMrbnuwMEkBQV4IAEZ3SD1tPyfpL4owaBXLI2JudT4xi6ZgXLTy9Mucmy+//HfqP9XLARxDKf1vvXyWVffAgvKuZIb8RxCSzyCr0F63v+Y85fSQvSGDr4wnN5qFbKr3wV4pchtIgU/3s1OCGkc6k1Ib3FxxwmraQPDY/Zn4iSpc8MU9RJundtHOWiuGKjg6DEPO3hUHK4/+PTxPYxR8ThbOD3mE5amdbPzGFBQC5BLYQLmpl0tvGKSnQYcdL7zGLdL6SOP9u8hIu85wkhwjC61VtI2aWVW2gvUgNOmnToth6WbDO3tTrxtPLhXyXWpUb3o8U1NYw==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    168.119.189.236) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=pauliska.onmicrosoft.com; dmarc=none action=none

    header.from=pauliska.onmicrosoft.com; dkim=none (message not signed);

    arc=none (0)

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 168.119.189.236)

    smtp.mailfrom=pauliska.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=pauliska.onmicrosoft.com;

    To: doctor@doctor.nl2k.ab.ca

    In-Reply-To:

    From: Walmart Department

    X-TOI-MSGID: <1718905885.D9B7B17203189.1703879903721@dare.com>

    Date: Fri, 29 Dec 2023 20:58:23 +0100

    Importance: high

    CC: doctor@doctor.nl2k.ab.ca

    Subject: You have won an Fire TV Stick

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART.Dmu5.ehupiswp"

    MIME-Version: 1.0

    Message-ID:



    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: AMS1EPF00000043:EE_|AS2P192MB2046:EE_

    X-MS-Office365-Filtering-Correlation-Id: 3f6f660d-48da-45fe-385a-08dc08ae022a

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    s1AjKS3zi1a+DEeeixSEmTIEJKDVIEkJMazrar3n4KUkck9LGuJeUSigVLjrNkadxyNF5GiNrqmNqSPuKGapUSYBnTtbkgBkaxAyRJ7ZWXmT7fazH6hsyTI+wiyNpNcWKrdUVCBWNm+KAqaUu+oKl12CLlo9eJtCRTgudbqbvPoGGdYzaqRARCKjnXQ3EQrbDDUR2LNC2I2wVGIVqyU40AH7DMLV1HfR9w0jTbqm0aWe44YTCxMSbrhKl7REQvVBaEIci+cbFjSqq7G4+BIKlPCHbpM4wD4Z7uv77xUprGZliFttwj0ww5wEmfuTdwVwd4YDu9KIDvThfZhzXVkqwLabcbb1HC9rjfBRDmY8QdnSpJuqwvnJa41JJdtZtoX7sT502j+knbYs1IvVZFYKIYrpK/XVgbYCLwFSu16FZdHnSQgZBEhL8JvZjScztAVDDrmb3c3ONtXulqJYg1kjHMJRsIFw0nn/r/VyFrCZUWsDc+hHkdjeSydubtf1j+nhTlBmrJhH4WQemagdx7aPCGk9bAuV1ByB5bG82EG23RGDEiKYU5+XfSkqbtoX7TulkJZr7AQpXlw4T5Tjab3vIXgxSd9NkCOtk7G3JdiiH7F2RUClPqRIOlpWW5BUEqDB19r9gcV3MimWQBUzf9ECyic9hsfRf5QKqh2dMCu2b0HUwLxsE37R945vgUsRALJLf/nHAAfEfcBSnS/BsymdXJxcjUm3aye1wTAtX4eVOCoa5IjZxTKxMYhRyJ7qc2AtBxsT20ikXC11dBSNBj2l3htWjIASUUKGRnmaiR0yBlaEQyYvY4ZnFnNCZnkWfLMUMHFJ/WVaAeSuNmnJBvmFmtiH2RRJ9HFrPOTl5Ng0q2TPJnlmali1des/S4ppqDVN

    X-Forefront-Antispam-Report:

    CIP:168.119.189.236;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.dare.com;PTR:static.236.189.119.168.clients.your-server.de;CAT:NONE;SFS:(13230031)(39860400002)(136003)(346002)(396003)(376002)(230922051799003)(61400799012)(7200799017)(451199024)(64100799003)(186009)(82310400011)(1690799017)(36840700001)(40470700004)(46966006)(8400799017)(564344004)(40480700001)(41320700001)(40460700003)(66899024)(33964004)(70586007)(6916009)(70206006)(31696002)(9686003)(83380400001)(82740400003)(26005)(47076005)(81166007)(5660300002)(41300700001)(336012)(478600001)(19625305002)(36860700001)(2906002)(8936002)(166002)(8676002)(786003)(42186006)(316002)(34070700002)(4326008)(1406899027)(146383001)(18963002)(15913002)(83022004);DIR:OUT;SFP:1101;

    X-OriginatorOrg: pauliska.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 20:37:43.2795

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: 3f6f660d-48da-45fe-385a-08dc08ae022a

    X-MS-Exchange-CrossTenant-Id: e98557a2-ca6b-4144-8399-02262fb7688a

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e98557a2-ca6b-4144-8399-02262fb7688a;Ip=[168.119.189.236];Helo=[mail.dare.com]

    X-MS-Exchange-CrossTenant-AuthSource:

    AMS1EPF00000043.eurprd04.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS2P192MB2046

    X-Antivirus: AVG (VPS 231229-4, 12/29/2023), Inbound message

    X-Antivirus-Status: Clean



    --PART.Dmu5.ehupiswp

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"











    (7205) Notifications































































    If you no longer wish to receive these emails, you may unsubscribe by

    clicking here.




















    --PART.Dmu5.ehupiswp--

    Amazon Phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Fri, 29 Dec 2023 16:33:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJMKm-000000006QA-2qSN

    for dave@doctor.nl2k.ab.ca;

    Fri, 29 Dec 2023 16:32:08 -0700

    Resent-From: The Doctor

    Resent-Date: Fri, 29 Dec 2023 16:32:08 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-db3eur04on2107.outbound.protection.outlook.com ([40.107.6.107]:24198 helo=EUR04-DB3-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJF5i-00000000287-2Wui

    for root@nk.ca;

    Fri, 29 Dec 2023 08:48:11 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=VqAKbg4Edgqfz4398X+4ARQv8OsB/k3cwO5etUkRfUroq3qugrRipk+CB89jPs3uj0Xe2ad0eE/zR4Uevw9Tpf4z0ZtmoI/jOVqFC3YMcLvo0C9cJKgdKsfuF3pfenwi0gSr52MluX6AQtqJx1EXKzfa6lT1Rq4qlWzg3jVo4ItNNN501DdVRjAB3wjiXApMZ4o5FqZPkwU4y8JaVbf9cjB9vxzEVMz0X97/WkYc90WNtB2LTdvtjMgk7XVuRj7GI6R8ivsIH1E3znrRBJgVVEBpyXKgrfWv4bvD0Kf9zna4/29n2W9nQRsrjA/4q9u3wSMy6PVmLz8MUzhvv+5POg==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=uxuQfi2Du1oVktREnN4Sx+v9apwhdfgjrH+7sdPbkKk=;

    b=HySym9aLGm4YuKFATeA1YjDKsV0TRnLKQYUeKUVCQ2SYP0tLd4pHSZBiGzRcwZq1OItlFNV9BupRIfx8XJRkkgCTA2FR5l3LFxp2kTP/AQKq3xN5d35KnCdP49uQkKdM9VEfCVVc+9VlJy8lrZ/lc/87y6gThdIH7SWYISaBdVx3NXdCITlQNpUGdIyZWPByn2zEpeIYWqyYjWFSJ1UJ6DVNj6Ev0qOB+11e9Ujai/CB8EZhRfO9FiB/KetThgIbvRxnE+fj8xrqA+vcMjdcU9b9OLpJPzGCL2w9ziUOT4EfUFtBwlweSZMa6dlZsi1X4Arn6Xtv7siMwS3KYWfLHg==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

    smtp.mailfrom=abonoorganicoaboplant.com; dmarc=pass action=none

    header.from=abonoorganicoaboplant.com; dkim=pass

    header.d=abonoorganicoaboplant.com; arc=none

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=psp4radomsko.onmicrosoft.com; s=selector1-psp4radomsko-onmicrosoft-com;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

    bh=uxuQfi2Du1oVktREnN4Sx+v9apwhdfgjrH+7sdPbkKk=;

    b=mCn/7XubVYeYZwVEf04qQCm612eHbgcXxTGm3YGp0//6cS7neJOExyNiymoMZ4IbiqC1eWobtdF0L0U5bJhDpF5TT36kLTNkL6bM8++QGRzQZ+dcKdVLEvbPOxAQJFdpj4UU9+kOIYUo9X8Hm1Lu3659LHgis1xd1Chs1DWgHQcZ+tUXZ3HsNxP9cwSR7Ewo2DDKqikY1+3EU1AE++EDEpXntZTyqtJAeUgdjIemQKEcvnBUrm+qEo4xttgDtpCc5ljgcNPuq0LPFQ3oGHqRPtgIaK4AfTCdPaCpUJ/QEIcpSS+1SneZJmJgduGMrrFVE+ZSHzS/C0b85SxUP00sqw==

    Authentication-Results: dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=abonoorganicoaboplant.com;

    Received: from AM0PR08MB5140.eurprd08.prod.outlook.com (2603:10a6:208:162::17)

    by AS2PR08MB9692.eurprd08.prod.outlook.com (2603:10a6:20b:604::20) with

    Microsoft SMTP Server (version=TLS1_2,

    cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7135.19; Fri, 29 Dec

    2023 15:45:58 +0000

    Received: from AM0PR08MB5140.eurprd08.prod.outlook.com

    ([fe80::1930:63ed:4432:b007]) by AM0PR08MB5140.eurprd08.prod.outlook.com

    ([fe80::1930:63ed:4432:b007%7]) with mapi id 15.20.7135.019; Fri, 29 Dec 2023

    15:45:58 +0000

    Date: Fri, 29 Dec 2023 22:45:54 +0700

    To: root@nk.ca

    From: Tech Responsibilities

    Subject: It seems like you just logged in in an unusual place recently - Fri, December 29, 2023 10:45 PM

    Message-ID:

    X-Mailer: WebService/1.1.18291 YMailNorrin Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36

    Content-Type: text/html; charset=utf-8

    Content-Transfer-Encoding: quoted-printable

    X-ClientProxiedBy: SJ0PR03CA0148.namprd03.prod.outlook.com

    (2603:10b6:a03:33c::33) To AM0PR08MB5140.eurprd08.prod.outlook.com

    (2603:10a6:208:162::17)

    Importance: high

    X-Priority: 1

    MIME-Version: 1.0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: AM0PR08MB5140:EE_|AS2PR08MB9692:EE_

    X-MS-Office365-Filtering-Correlation-Id: c9d3ae87-4b7c-4ff7-fc00-08dc0885402c

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    GXfosEKVQD25TcHy4TRxFm5xI9o6NDvv0Uqb6bi/gEeNQGayNSP/OfiLlx+y4LL6D5SaB1sYS9rMn1kHUkADhyxnKOBkVSC/+ZwY/CySPVMlqCDI9o/+ihWei0ml+zJRb1s3G7/pEJihI//3bfEFA3DmuIvnkoQ4udRj05mEg0fXJNiOhhDKbbIEtJiwnTt9o276tg5fz8zhn/3P/qAVz23VaXOV0LjRpzEmFU4+K7SbgnQGD34fuzL+qVVgbZGZbonYAlHkiZUCe+aQpPoHZAyVISoOA5tW/iLD2LB/tvyVs9biBRZmZsPHGlTqSR641sfMRG6KHMXd4tERVCtR1M3l3RqCNbMNkbt8b+8+34gsLPvUSwrHqKPkDSu8ENxBOzX2z7Pf/xVE9l1QP1Q4S5Cidnn8LUeKzOvGZ9yrM1TwihP0/wKiDcvbEsZZWxsUWTi2XIhK+c7hBQ2frxa5Q78cRMaEwhKAmUmtIs673xMZPXTJ8ucUr24XfNWT0x9dA1mSGLRgemq/aVnB83WqZfjOcwGF+5EsFy/EbFHAgp4frzpo13cm600rkla3ejLXEkz8gAD+fWzOSJYz8C3T3TcuyQ+xSSc8LtziipvTTEq8qes6K1wSF6tLNRChkp0R

    X-Forefront-Antispam-Report:

    CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM0PR08MB5140.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(346002)(366004)(396003)(376002)(39860400002)(136003)(230922051799003)(186009)(64100799003)(451199024)(1690799017)(1800799012)(2906002)(66476007)(6916009)(66946007)(5660300002)(66556008)(4744005)(8676002)(8936002)(316002)(41320700001)(41300700001)(6506007)(86362001)(786003)(9686003)(6486002)(52116002)(55236004)(478600001)(26005)(76236004)(6512007)(38350700005)(83380400001)(38100700002)(6666004)(16799955002)(166002)(61276011);DIR:OUT;SFP:1102;

    X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

    X-MS-Exchange-AntiSpam-MessageData-0:

    =?utf-8?B?cmd1azBBaUdFczVlL0lZR1MvajJUaUNpWmRXN3FLd2JIVi83NHdHcjMyZXBU?=

    =?utf-8?B?eDc2bEQyTUkrVGV2MlJxaXdvQVpPVFFnellhOWhic3lITVIySWloUEpDSFBC?=

    =?utf-8?B?NC81UmZCRW5VR213c1dxZXNraENwVDA5VWE3L3pFUHZaaXdPTVRmdnlwT1ZD?=

    =?utf-8?B?VHNyTE9PSFNnVWJvVk9hUStZcVdGeTFaTktRQmNsZWZXTk5Xai9uRm4wT252?=

    =?utf-8?B?dWRLNTA3ZWRMaVJVYXZaQmI1S1RSUUh3Um0rODRKSlhjUm9qcnpqMlBNVzJT?=

    =?utf-8?B?b2cydGgvMDkyQlI4dTVYNEViVHIzclpza2tuU0NxS3AydDFFYWFpa25ueSs3?=

    =?utf-8?B?U0lpR0UySHdCdWhrWDdaREN2ejZsUVNESjB1YzNZRmh4bGhSanNSWkVkODhK?=

    =?utf-8?B?TU52a2c0Q3ZMOUxvZTA4SUozQkRaNmhXeUF6VnhqNEs4bmwvL0czbUNXWEFP?=

    =?utf-8?B?U0RIOE1ORFozK0h3L0RhL3FxSG1UalU3VmdZdWUyOEdZaWpKVm54QVMvQjFI?=

    =?utf-8?B?b1kvQkw3eC9sd20ySlY5aStIVXN4TnR6OWhhM0lQQXlURzQ0K0o1cnFXZ1dM?=

    =?utf-8?B?c3c4OE5OZjZzMEllMHJNaElQVFlsdjc4UzdYRkxWckd4WTJxQVdXaEorY1RL?=

    =?utf-8?B?REI5NXdVenk0TXFvRTIzSXJkK1RZNG1jZDhrTXBUYzIrTlo5by9UWmZWZ2lS?=

    =?utf-8?B?dnBFM1VZNWJMNkJSSnd3WEk3YzN1K0ZDSk14TmtGRXptM2VYRmZycHB1UmhC?=

    =?utf-8?B?UVRFZTB1cnVRc2ZEYVQrU1hGNlpGV3RCc0U1aEVUUTZiTmlHOUVleHhCUlBL?=

    =?utf-8?B?aHBHWE9EMXdITVY4WmJDdlF5b09oQlBhODQrUCtwalhuOHpwSTNJeVRNdzFq?=

    =?utf-8?B?Q0h3ZGxrU3JoQWF3ODlKK3dJSW5jaTBWMTJyWDNWZE1lMjNRRXZRa1lGSWZw?=

    =?utf-8?B?a0FWR050cjVhMFFJS3JZRjBST0xSR2lLYm5GM3ZVaDlXNGpPT1NGQ1IzNDNR?=

    =?utf-8?B?a0lieFlMcE9vNU9Jb0ZPQ04wQklWa25DTUlNSkduSm11UkcybzN4OXNKWkth?=

    =?utf-8?B?R2QxaVordlRIVGZzc2QvNWQ3eHdiOUVHZlZ0QVZGbXFhVkZxUFJtNmpsUW1T?=

    =?utf-8?B?ZVZZVkJsa2x3SVZiNG9wUWtCYnB2dHUycUs3eEo1STFNdVhDLzRzRUxXR0M5?=

    =?utf-8?B?ZS80KzBQSDQ4am1yUmVpaHNRb1dDdmtiZnBnNXMxdUZMVnFKaTllSU9tR3VX?=

    =?utf-8?B?cUoxbHpEM0dIQ2QrV2g3SE5xVlR1Z2sxU1ZvalhCWElFQnl4QnYya1EwUEVj?=

    =?utf-8?B?RDF1QUpMOWdGWitndXFYdUw3WDhQMXZQNFZXZ1hsbUZCZUZOVTdpQzlPMkRL?=

    =?utf-8?B?REtiWU0xNURmWTdjT2lobU52Ynd3Q3U4em5WVGdDT0MxNGo3MGxqUXhqUHVL?=

    =?utf-8?B?YUFJNFVMLzkzK2ZmK0pFUi9USElBTDRRMmJRTmRzb1FUTklZMXI3b09zN0lK?=

    =?utf-8?B?SW12cmQ4RnZMNTMzK1RJcDEvRnZWaEtZMnhvNUdZVzZrb3JuRmJIUE5YOEEz?=

    =?utf-8?B?aTArbWFVelMxUTNqdVl6cUhqK1JUbnYwdG9kSFY3NERNN0RkL1J0VzBmc21Y?=

    =?utf-8?B?WkhoRDdQZXY0YVo0QWNTVWtFWStLay9PaDB3aXZCNHhQNGFIdFEvZEsra1RF?=

    =?utf-8?B?US9VcVRmdldtMDc4Y05WMGNzSm1KOFhKRnp3Q1B3b0ZXbUpkSFF6MkVpTWh1?=

    =?utf-8?B?Q2tobE51dS9seWUvY0l0L0F4N0RzNEtjVmdnemhHajdnU0xYNUEzTDhsMDMy?=

    =?utf-8?B?NmgxcjNYa0Nwc0w3YTVrOVJ1ZXU2bytGaTNJRnFJVlFxaVNCNGhMNml1czB5?=

    =?utf-8?B?YzFpZU5HOG5hVmVLQkxrMDJudWl6VGpEZlc1UmxDbGRIcmg3cFJLM1JzNUN4?=

    =?utf-8?B?YnZxaUVvWEV5RmpQSHVZaVpPeGJwb2pMR0FnSHViTVVkejNTcktvK3laVDNI?=

    =?utf-8?B?aVllekdndUlreXNZVlA3TWdJVU9IYVFaK0x1djVWeWxGVkpPa0hLaFFuUUhZ?=

    =?utf-8?B?eisxSXhYb2NiaGNJTXZDNzcwNTNGUEFrMk8zZkt5aU1Vdkt5M0NPMVJHbmli?=

    =?utf-8?B?R1ViZzM4Y1FDVmN6SmxBUmI1dEhOTGx3ZVEzSGhrek9pTFRSSGxvdTY1VGc5?=

    =?utf-8?B?OEhxY2RiYzRvMUtHK28zUkR2KzNPL1pSUDBHYXdDMGlRVFBpNkhjODVEOFlu?=

    =?utf-8?B?anZZcXAxTVpMRHo5UFBCYWd2alRBPT0=?=

    X-OriginatorOrg: abonoorganicoaboplant.com

    X-MS-Exchange-CrossTenant-Network-Message-Id: c9d3ae87-4b7c-4ff7-fc00-08dc0885402c

    X-MS-Exchange-CrossTenant-AuthSource: AM0PR08MB5140.eurprd08.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Internal

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 15:45:58.1451

    (UTC)

    X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

    X-MS-Exchange-CrossTenant-Id: c20ddd07-a923-4494-acfb-8c728f876222

    X-MS-Exchange-CrossTenant-MailboxType: HOSTED

    X-MS-Exchange-CrossTenant-UserPrincipalName: v5DO94kN5UZEfkUNeP7gi4KfDQ1G4SuX976k5Dk3mm9m7xdGnj7vzABa/SZgDqP/UpzhGn/GOYAL3MRVRIeXU8RmvtCasg8z+5bXrsUFbvWKY19G3pawFSHubvw8pwSncRxTTErO/X/Xe8cchTwaOHjPFJpI2NuEuPbjyT8UBqg=

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS2PR08MB9692

    X-Spam_score: 6.8

    X-Spam_score_int: 68

    X-Spam_bar: ++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: Dear root@nk.ᴄa, Υoυr Αmazon aᴄᴄoυnt is temρorarily

    on holɗ beᴄaυse of an υnυsυal login. Αboυt this ᴄhange Ϝri, Deᴄember

    29, 2023 10:45 ΡΜ Αroυnɗ Ϝloriɗa, Uniteɗ Տta [...]



    Content analysis details: (6.8 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [40.107.6.107 listed in list.dnswl.org]

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [40.107.6.107 listed in wl.mailspike.net]

    -0.0 SPF_HELO_PASS SPF: HELO matches SPF record

    -0.0 SPF_PASS SPF: sender matches SPF record

    0.0 ARC_SIGNED Message has a ARC signature

    0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

    0.0 ARC_VALID Message has a valid ARC signature

    0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

    2.5 FUZZY_AMAZON BODY: Obfuscated "amazon"

    0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

    background

    0.0 HTML_MESSAGE BODY: HTML included in message

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    1.0 AMAZON_IMG_NOT_RCVD_AMZN Amazon hosted image but message not from

    Amazon

    -0.0 T_SCC_BODY_TEXT_LINE No description available.

    0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

    1.6 FORGED_MUA_MOZILLA Forged mail pretending to be from Mozilla

    Subject: {SPAM?} It seems like you just logged in in an unusual place recently - Fri, December 29, 2023 10:45 PM

    X-Antivirus: AVG (VPS 231229-4, 12/29/2023), Inbound message

    X-Antivirus-Status: Clean




    body>
    g=3D"0" cellpadding=3D"0" align=3D"center" style=3D"border-collapse:collaps=

    e">

    30px;margin:0 auto" dir=3D"ltr" bgcolor=3D"#ffffff">
    lspacing=3D"0" cellpadding=3D"0" align=3D"center" id=3D"m_-4190993533000013=

    413email_table" style=3D"border-collapse:collapse;max-width:630px;margin:0 =

    auto">

    nt-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-=

    serif;background:#ffffff">
    "0" cellpadding=3D"0" style=3D"border-collapse:collapse">
    lid 1px #e5e5e5">
    >

    ght=3D"20" style=3D"line-height:20px" colspan=3D"3">

    t=3D"1" colspan=3D"3" style=3D"line-height:1px">

    15" style=3D"display:block;width:15px">
    =3D"100%" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:coll=

    apse">
    >

    >

    eight:32;line-height:0px">
    com/images/G/01/authportal/tiv/amazon_logo_RGB._CB424887820_.png" height=3D=

    "32" style=3D"border:0" class=3D"CToWUd" data-bit=3D"iit">
    "15" style=3D"display:block;width:15px">
    =3D"font-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial=

    ,sans-serif;font-size:19px;line-height:32px;color:#ffffff">

    ine-height:15px" colspan=3D"3">

    15" style=3D"display:block;width:15px">

    =3D"display:block;width:15px">
    ellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:collapse">
    y>    <=

    td height=3D"15" style=3D"line-height:15px">
    tbody>

    class=3D"m_-4190993533000013413mb_text" style=3D"font-family:Helvetica Neue=

    ,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;font-size:16px;lin=

    e-height:21px;color:#141823">Dear root@nk.=E1=B4=84a,

    =3D"m_-4190993533000013413mb_text" style=3D"font-family:Helvetica Neue,Helv=

    etica,Lucida Grande,tahoma,verdana,arial,sans-serif;font-size:16px;line-hei=

    ght:21px;color:#141823">=CE=A5o=CF=85r =CE=91mazon a=E1=B4=84=E1=B4=84o=CF=

    =85nt is tem=CF=81orarily on hol=C9=97 be=E1=B4=84a=CF=85se of an =CF=85n=

    =CF=85s=CF=85al login.

    height:15px">

    " style=3D"font-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdan=

    a,arial,sans-serif;font-size:16px;line-height:21px;color:#141823">=

    =CE=91bo=CF=85t this =E1=B4=84hange

    =3D"15" style=3D"line-height:15px">

    dth=3D"100%" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:c=

    ollapse">
    ter"><=

    /tr>
    tbody>

    eusercontent.com/proxy/Mz4b6FP-x65E4RmTqKykmV3ZESDvtDZa063Q387S4JJDlv5ub6Vq=

    oVeS8Twy8uQSO5xKCYxd4hEZHRUPTgfb0OlMBoo7Lvu0WCB9CvCQng=3Ds0-d-e1-ft#https:/=

    /static.xx.fbcdn.net/rsrc.php/v3/yD/r/KJyTP_2W_qx.png" style=3D"border:0" c=

    lass=3D"CToWUd" data-bit=3D"iit">    		=CF=9Cri, De=E1=B4=84ember 29, 20=

    23 10:45 =CE=A1=CE=9C

    aoUURGRlkeLOtIp-GtyR_GZqDr1gYQwFrxxbpoOsCWFXS_-DQ_T_EemJBcB1g5k9jMZpGgtFUMh=

    wPTIVTc3OCSWTmjZQ=3Ds0-d-e1-ft#https://static.xx.fbcdn.net/rsrc.php/v3/yK/r=

    /EYwma6hBA2v.png" style=3D"border:0" class=3D"CToWUd" data-bit=3D"iit">
    >    		=CE=91ro=CF=85n=C9=97 =CF=9Clori=C9=97a, Unite=C9=97 =D5=8Ftates

    .com/proxy/_Pb8OTowRc5zsA9QcEyU2xGsDy8nYud4_uHcFrJ0zo-wdBgU12ZNIsSTsA8KjsPh=

    Hmc3gKMvy0F2B9weZzpAEwgCTZhh9d9BNLRQTfl9MA=3Ds0-d-e1-ft#https://static.xx.f=

    bcdn.net/rsrc.php/v3/yC/r/Ve5FEXFHw7A.png" style=3D"border:0" class=3D"CToW=

    Ud" data-bit=3D"iit">    		=D5=8Fams=CF=85ng Galaxy =D5=8F9+

    td>

    dding=3D"0" style=3D"border-collapse:collapse"><=

    /tr>

    style=3D"line-height:7px">

    ps://www.facebook.com/" style=3D"color:#1b74e4;text-decoration:none" target=

    =3D"_blank" data-saferedirecturl=3D"https://www.facebook.com/">
    r=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-=

    collapse:collapse">

    radius:6px;text-align:center;display:block;background:#f1c65D;padding:8px 2=

    0px 8px 20px">
    lor:#1b74e4;text-decoration:none;display:block" target=3D"_blank" data-safe=

    redirecturl=3D"">

    ica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;white-spac=

    e:nowrap;font-weight:bold;vertical-align:middle;color:#ffffff;font-weight:5=

    00;font-family:Roboto-Medium,Roboto,-apple-system,BlinkMacSystemFont,Helvet=

    ica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;font-size:=

    17px">Che=E1=B4=84k =CE=91=E1=B4=84ti=D1=B5ity

    td>

    ight:8px">

    px">

    =3D"font-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial=

    ,sans-serif;font-size:16px;line-height:21px;color:#141823">=CE=A1lease =D1=

    =B5erify an=C9=97 =E1=B4=84hange yo=CF=85r =CF=81ass=C9=AFor=C9=97 to rea=

    =E1=B4=84ti=D1=B5ate yo=CF=85r =CE=91mazon a=E1=B4=84=E1=B4=84o=CF=85nt. =

    =CE=99f =C9=AFe are =CF=85nable to =E1=B4=84om=CF=81lete this a=E1=B4=84tio=

    n =C9=AFithin 24 ho=CF=85rs, all =CF=81en=C9=97ing or=C9=97ers =C9=AFill be=

    =E1=B4=84an=E1=B4=84ele=C9=97, an=C9=97 yo=CF=85 =C9=AFon't be able to a=

    =E1=B4=84=E1=B4=84ess yo=CF=85r a=E1=B4=84=E1=B4=84o=CF=85nt =CF=85ntil thi=

    s =CF=81ro=E1=B4=84ess is =E1=B4=84om=CF=81lete.

    ight=3D"15" style=3D"line-height:15px">

    4190993533000013413mb_text" style=3D"font-family:Helvetica Neue,Helvetica,L=

    ucida Grande,tahoma,verdana,arial,sans-serif;font-size:16px;line-height:21p=

    x;color:#141823">Thank =CE=A5o=CF=85,
    =D5=8Fe=E1=B4=84=CF=85rity Team
    pan>

    >

    le border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" align=3D=

    "left" style=3D"border-collapse:collapse">

    mFont,Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-seri=

    f;font-size:11px;color:#8a8d91;line-height:16px;font-weight:400">
    der=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:coll=

    apse;color:#8a8d91;text-align:center;font-size:12px;font-weight:400;font-fa=

    mily:Roboto-Regular,Roboto,-apple-system,BlinkMacSystemFont,Helvetica Neue,=

    Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif"><=

    /tr>
    >

    gn=3D"center" style=3D"font-size:12px;font-family:Roboto-Regular,Roboto,-ap=

    ple-system,BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucida Grande,tahoma=

    ,verdana,arial,sans-serif;color:#8a8d91;text-align:center;font-weight:400;p=

    adding-bottom:6px">

    px;font-family:Roboto-Regular,Roboto,-apple-system,BlinkMacSystemFont,Helve=

    tica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;color:#8a=

    8d91;text-align:center;font-weight:400;padding-top:6px;padding-bottom:6px">=

    3D"Meta"
    tent.com/proxy/d3D_pwZxEfzej1l0yE5VCB7hNnHBxmwllq0RGTLQMQjNiyMQILxq8jnUO-Q6=

    Wss8zCSYPdVqCSFHrlVWX8fj7LCw=3Ds0-d-e1-ft#https://facebook.com/images/email=

    /meta_logo.png" style=3D"border:0" class=3D"CToWUd" data-bit=3D"iit">

    ular,Roboto,-apple-system,BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucid=

    a Grande,tahoma,verdana,arial,sans-serif;color:#8a8d91;text-align:center;fo=

    nt-weight:400;padding-top:6px;padding-bottom:6px">=EF=BF=BD =CE=91mazon, =

    =CE=99n=E1=B4=84., =CE=91ttention: Comm=CF=85nity =D5=8F=CF=85=CF=81=CF=81o=

    rt, 1 =CE=A1rime =D4=9Cay, =CE=9Cenlo =CE=A1ark, C=CE=91 94025

    boto,-apple-system,BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucida Grand=

    e,tahoma,verdana,arial,sans-serif;color:#8a8d91;text-align:center;font-weig=

    ht:400;padding-top:6px">This message =C9=AFas sent to
    74e4;text-decoration:none" href=3D"mailto:root@nk.ca" target=3D"_blank">roo=

    t@nk.=E1=B4=84a    .
    To hel=CF=81 kee=CF=81 yo=CF=85r a=E1=B4=84=E1=B4=

    =84o=CF=85nt safe, =CF=81lease =C9=97o not for=C9=AFar=C9=97 this email.
    style=3D"color:#1b74e4;text-decoration:none" href=3D"https://www.facebook.=

    com/help/213481848684090/" target=3D"_blank" data-saferedirecturl=3D"https:=

    //www.google.com/url?q=3Dhttps://www.facebook.com/help/213481848684090/&=

    ;source=3Dgmail&ust=3D1687171260017000&usg=3DAOvVaw32Uqlt33nD2sLieo=

    Xk0L9E">Learn more

    "10" style=3D"line-height:10px">

    "15" style=3D"display:block;width:15px">

    le=3D"line-height:20px" colspan=3D"3">

    src=3D"https://ci6.googleusercontent.com/proxy/9Ldq7kKHZQeCUx4ryG6ANcWwQV1h=

    cSPrfRMEmwu_mFvKaq7uX-QVBqFUXSMBovxmOxe3GwHX0eQxraYK-R8LTHez7x2jOWrVbTUDcuN=

    -0JHqQkTCe_QFo5Mm7TeZPcmEiZIuxOHBWN0-T5vXN23VazHJwA=3Ds0-d-e1-ft#https://ww=

    w.facebook.com/email_open_log_pic.php?mid=3D5fe13a3f4faaeG5b0581311d19G5fe1=

    3ed8afd80G18e" style=3D"border:0;width:1px;height:1px" class=3D"CToWUd" dat=

    a-bit=3D"iit">

    ble>

    Tupperware spam from microsoft

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Fri, 29 Dec 2023 08:32:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJEpV-00000000Pe9-0OXf

    for dave@doctor.nl2k.ab.ca;

    Fri, 29 Dec 2023 08:31:21 -0700

    Resent-From: The Doctor

    Resent-Date: Fri, 29 Dec 2023 08:31:21 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-mw2nam10hn2234.outbound.protection.outlook.com ([52.100.157.234]:44193 helo=NAM10-MW2-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    id 1rJETm-000000008ib-3Le6

    for doctor@doctor.nl2k.ab.ca;

    Fri, 29 Dec 2023 08:08:59 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=KPspQYSH56iyXISoZHolxma819kUkOwvWwjlZIx2bIHtnP48eyo/7J/XWxG5tjfjiCNdroX4CtPAtxzvvAwn/uiX1ZRhKL7Q8NK/zOKQ2ZELLA2rRHjZIWr5F9uwBk4mzzZpELeLaMaMYxJO2JHUpAcAzVMMVazouA0m/PhbFMRwWUGp7ReEQN5NwDEV52UshfPDWKuOcnyUlqvaiSGtWuyjv8VLHtQ6QX8QDTeMKuaE9wq7wyH4fWe5xpXsSFlrEA/HKgqJWroRQoJGAR7DEtRZ71JKzq95eGpklOr37KPbRIcp47DBR+Uqz0RgHpa137UYy9pvFkicFHlme1k0Qg==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=SVr6m7fvL+ktP6JNYMDLOJ88i17ep7/UpACNyX7cInw=;

    b=URCdL0soqCiPeUt3jmoauJfMctxaVWYFfRbOMcrxKm5IdufXZZyUzmr9ctGKqP+JJX5VEMtOrjzL6pC5towN1X8w0YbR879jhKm1b2CB0OCzlAl5g3JL/WL7inqvmz18ZdcOA5FQ5OAv4uWiykgjmtGQmyj6c6wERORIHp6Yd+NP9e+KOj9J7oqHFwt4Lr98RtiL4ug53okQcvJfhFDLbNOAI/dR9XGDDXQyd4B/ilm1UImoi8WrldINHLZuhHsMQC1q0FYuLGrDOQZxno1BDmtaLigxBwtBTfN5BnE7tCN6C9824cs0l85v1O/ZQXRbcdS9CspDTIANeQ9IdaGOLg==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

    78.46.149.17) smtp.rcpttodomain=doctor.nl2k.ab.ca smtp.helo=mail.goldner.net;

    dmarc=none action=none header.from=1r78099.onmicrosoft.com; dkim=none

    (message not signed); arc=none (0)

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=1r78099.onmicrosoft.com; s=selector1-1r78099-onmicrosoft-com;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

    bh=SVr6m7fvL+ktP6JNYMDLOJ88i17ep7/UpACNyX7cInw=;

    b=foiX0L8WAOUAgoEm0A4TrphNgXyBs1yQqdigcZyaj6OEIx7tFKYH8Dxv8F/jqVxPhFx+wLkCI/zkH+z6MX/TBiBoex+U4quXwMv7vBCDlc0EUXj+Z7hKF0PVvM24eI5S6Jelj0Era+68nQndyGqaEIWbdkZ92b4tow3NOC4LgmG/Cb6ghEHckQ8zKyS9qo9ChryhjLV8IAgX4BqOEWTVI28o1FtBPvxio40te9nzRMf2MYZFKWdBB8QnC8CBZ5D8Ivp1Bhal+nJuIrgH1lhGo1PCAQ1d2joHWJgnWNb0Yg73XF2kSWpIYwUxJzqdhsCaO6Uvv7G5ZVvgdrUFncN27Q==

    X-MS-Exchange-Authentication-Results: spf=none (sender IP is 78.46.149.17)

    smtp.helo=mail.goldner.net; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=1r78099.onmicrosoft.com;

    CC: doctor@doctor.nl2k.ab.ca

    In-Reply-To: <6P7k4kQcK3uSbOThAOBnZRHF2WxyOx@tuGLaFqBmQ.1r78099.onmicrosoft.com>

    Importance: high

    X-TOI-MSGID: <1778809491.C366D21E67D3C.1703861688696@goldner.net>

    To: doctor@doctor.nl2k.ab.ca

    Content-Transfer-Encoding: 7bit

    Date: Fri, 29 Dec 2023 15:54:48 +0100

    MIME-Version: 1.0

    Subject: =?UTF-8?B?V2luIGEgMzYgUGllY2UgVHVwcGVyd2FyZSBNb2R1bGFyIFNldCBieSBUYWtpbmcgT3VyIFN1cnZleQ==?=

    From: =?UTF-8?B?S3JvZ2Vy?=

    Content-Type: text/html; charset="UTF-8"

    Message-ID:

    <43bdcf59-7baa-4d0f-87f1-c98225711ea4@SN1PEPF0002636A.namprd02.prod.outlook.com>

    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: SN1PEPF0002636A:EE_|CO6P222MB0521:EE_

    X-MS-Office365-Filtering-Correlation-Id: aea9c1c7-e470-4216-deec-08dc087fc62e

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    BTHWXbAq5WLf4mPgcjoZtCe+kbVX9C3h2GbNbUPBacEGI7xMePPB0wuen+g2md2SfpxdYCDpdGnbLCWZSTLyEkdPaFpR8mUQZjAsqPLLEfJh0wmSrC5KO5pCXL3hFgudh/eCbon+PuBbVWSflerz7zCgOI0Dit6IStrtmdXiXZd1oqz+Do5CEZqiWZmQL8D2U3skhPXG4V4arbt235affO/CB7AO+wx3anUhOkPMd/GwKrIzPCGJoeLvpaS4uCsrGrFalWGjLGD5XU0ddW7CC/LILtkwAIMj2y7jh+Dc57sunce+QPYmYMwg+JHOOuedIFuZB4kwhk90U1NpuuuOYAPkeN76S3Z7EEZq9uEoek4sBRa3Jt0mSAz4UCaoPnduZ0Lyz3M7G/bgjS2Qm6aGee2c9vkr9tvYAPA0R20wMYKc0eb5NHskDy5Pnm+jFERHA/3+u17HKRbWolSijKjSRrGOyGj328XVpd0rOcm1y+8=

    X-Forefront-Antispam-Report:

    CIP:78.46.149.17;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.goldner.net;PTR:static.17.149.46.78.clients.your-server.de;CAT:NONE;SFS:(13230031)(39860400002)(376002)(136003)(346002)(396003)(230922051799003)(61400799012)(64100799003)(82310400011)(1690799017)(451199024)(7200799017)(46966006)(26005)(9686003)(81166007)(35950700001)(41300700001)(558084003)(2906002)(8400799017)(6916009)(19625305002)(31696002)(5660300002)(70586007)(70206006)(498600001)(40480700001)(17440700003)(42882007)(67280400001)(4326008)(336012)(82740400003)(166002)(47076005)(8676002)(8936002)(78352004)(41320700001)(42186006)(316002)(786003)(3913002);DIR:OUT;SFP:1501;

    X-OriginatorOrg: 1r78099.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 15:06:45.4222

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: aea9c1c7-e470-4216-deec-08dc087fc62e

    X-MS-Exchange-CrossTenant-Id: d2ae39a8-0ef3-4185-90be-c73d99c9fb7f

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=d2ae39a8-0ef3-4185-90be-c73d99c9fb7f;Ip=[78.46.149.17];Helo=[mail.goldner.net]

    X-MS-Exchange-CrossTenant-AuthSource:

    SN1PEPF0002636A.namprd02.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO6P222MB0521

    X-Spam_score: 7.1

    X-Spam_score_int: 71

    X-Spam_bar: +++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: (1) Notifications



    Content analysis details: (7.1 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

    [URI: harderto.blob.core.windows.net]

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [52.100.157.234 listed in list.dnswl.org]

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [52.100.157.234 listed in wl.mailspike.net]

    -0.0 SPF_HELO_PASS SPF: HELO matches SPF record

    0.0 ARC_SIGNED Message has a ARC signature

    0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

    0.0 ARC_VALID Message has a valid ARC signature

    0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

    1.0 HK_RANDOM_FROM From username looks random

    0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

    [tmtakas_dclbgk(at)1r78099.onmicrosoft.com]

    0.0 HTML_MESSAGE BODY: HTML included in message

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

    0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    1.0 FORGED_SPF_HELO No description available.

    -0.0 T_SCC_BODY_TEXT_LINE No description available.

    0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for

    an image

    0.0 T_REMOTE_IMAGE Message contains an external image

    Subject: {SPAM?} =?UTF-8?B?V2luIGEgMzYgUGllY2UgVHVwcGVyd2FyZSBNb2R1bGFyIFNldCBieSBUYWtpbmcgT3VyIFN1cnZleQ==?=









    (1) Notifications
























    I1.21KL0LD384I2.16KwhoissourceRank10.4MPIN0Summary reportDiagnosisDensity00n/a

    Fedex Phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Thu, 28 Dec 2023 22:18:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ5FK-000000007nL-2yxa

    for dave@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 22:17:22 -0700

    Resent-From: The Doctor

    Resent-Date: Thu, 28 Dec 2023 22:17:22 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-bn8nam11on2100.outbound.protection.outlook.com ([40.107.236.100]:50935 helo=NAM11-BN8-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ2iq-0000000036T-1O7O

    for doctor@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 19:35:44 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=NVRpoe9ICOmpnTpiEQDLl34Ucwon/FrCd3nHs15cnDB29Q6MEmdij6IX4608N4Y7xadzZTeHzJGG4q65tEFB+qdnBgvYLkWqx1QlZzW+gjlGkaia6potJOFtCHsjyRQOn4cDCmeHN5MPIml287QXxg8Y8CBko9lZ23lHtq/1DgVK1xam/VQsgoRQTouczN9c9HEpaBMJdUjFWXgbiLM1fWS3W+ULq/ynTOU1YxX36jT0prGnGA6t9PzZ1Y17aJR+x5Wh2EWIlPgrUFjkZsJa/f70ypW0uM0A6a5avKWa535+/Lq/URNI07TZxRken0r+Nb5iQLUhLJz1M0xVMirnKQ==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=achYhA62g8csa4q4avakf5Q3OH7ny0y3L+GeRV0AeW8=;

    b=Bh3vSvyEymyflSbECGR42JoAe3ELVcx/f0bSsGd/oeIGLdhzYk4dOwSbgytjx8BqxbpiauT94Mygjw7LgAwXJWmkKyMqbV09/gyF9jEUlFMMH+n+8zHEX1gZUmDCXs4KEFLUiuDXEGLc0oxlvmepCgUSZ1XRjT3tUfrF0Jdxtj9D6QZguFpuet+3BZLxMnZLpiTnRacMdTIOHD3U3JN5PH379Jk+YX66AIouVbq+4Fdzn8oGi2TVNwqOJv9J7F3AtsHYQ3M18D2FU5UOuAquUo3QzF/CyPsCJLBlQpeG7WrR6GAszQ/qDitumwlshdpVIgDpmmb0QllgflijW+bMLQ==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    172.234.36.107) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=vdmtlncw.onmicrosoft.com; dmarc=none action=none

    header.from=vdmtlncw.onmicrosoft.com; dkim=none (message not signed);

    arc=none (0)

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=vdmtlncw.onmicrosoft.com; s=selector1-vdmtlncw-onmicrosoft-com;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

    bh=achYhA62g8csa4q4avakf5Q3OH7ny0y3L+GeRV0AeW8=;

    b=E0snxsX7RLANoZt98xh/t3bbOSZvlBpL9+D0l45v9k79VWkccnInwUBHIgq72/6//RvZGlRN9+YG9IZGD7USO19S30W5NUsDvEs35uVAbUuN3/OTn/CAhGT9zvRlVG7Fih4bm94umdlylbdnlGnlmBd2f67v79r4Bf9wgFJ8SORWsy3PpY+eONZsigFLKv5hS9NIW9DB05LGW0NzV++gamRZ1J0RGPegSnpU5BZBWjM80lBjIdQISrxclfDa4wDYcS3BW+nmw8kNL0MAl3D3RC9lUM9eBxZv9XaSk8u62k2OAxKARmL1TwaNTKcVxbQTljFeq4AYMgCW2cZClzGzRg==

    Received: from DS7PR03CA0291.namprd03.prod.outlook.com (2603:10b6:5:3ad::26)

    by BN0P223MB0197.NAMP223.PROD.OUTLOOK.COM (2603:10b6:408:147::6) with

    Microsoft SMTP Server (version=TLS1_2,

    cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7159.8; Fri, 29 Dec

    2023 02:33:34 +0000

    Received: from SN1PEPF0002BA51.namprd03.prod.outlook.com

    (2603:10b6:5:3ad:cafe::c6) by DS7PR03CA0291.outlook.office365.com

    (2603:10b6:5:3ad::26) with Microsoft SMTP Server (version=TLS1_2,

    cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7135.21 via Frontend

    Transport; Fri, 29 Dec 2023 02:33:34 +0000

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 172.234.36.107)

    smtp.mailfrom=vdmtlncw.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=vdmtlncw.onmicrosoft.com;

    Received: from mail.hirthe.net (172.234.36.107) by

    SN1PEPF0002BA51.mail.protection.outlook.com (10.167.242.74) with Microsoft

    SMTP Server id 15.20.7159.9 via Frontend Transport; Fri, 29 Dec 2023 02:33:33

    +0000

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART.gExQ.teulenry"

    Subject: Important for doctor

    MIME-Version: 1.0

    From: Shipping Department

    X-TOI-MSGID: <2001900369.3D9D97E8C4BAD.1703816027541@hirthe.net>

    CC: doctor@doctor.nl2k.ab.ca

    To: doctor@doctor.nl2k.ab.ca

    In-Reply-To:

    Importance: high

    Date: Fri, 29 Dec 2023 03:13:47 +0100

    Message-ID:



    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: SN1PEPF0002BA51:EE_|BN0P223MB0197:EE_

    X-MS-Office365-Filtering-Correlation-Id: 8d05fa9e-5bee-4f38-44c0-08dc08168d9a

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    oGEDqBhIA5TFlpvBtliiSN5q/n2E6xYoNhsZoUpT4brshq5xmE/16Hg8lJihTl/+FfQ8PfgVcAtUSY1SMtp4YSSlE0dbZkE5Rn9O0pIFU4j+a8RBQWe8kexBS4apn8K7xkpON3sKbtTmNjwqwoFJ82XGarhFV+OnDyw+kk6tIQNYge1AlJJFQtr61To5D0SiM5rIouUgOqTRE9txrEE1e6SPommdMBv+jt179rZixJnnKNm53/i7TxbxxXTRZTFko2gEiy5sm4pGb2oldq40XdsZ328QVvDoBu9pIrEwNpGt/u79idXkWMURc4PGqbIS199nj9rNX2TEd8Y4CTNtGrRwJhg9ppK8grf1BdJ4TCvCV6PG6HSJB+LyO1o8vPDxhKDC+Te6VdFw1Q8QhmN1Ozif8mlCZ83VJyZSY/Ux//VARxPlaJ6LHW42ShJ5vsce9iR/zc9W/E3t+LmC1YYCKJAOaIj7IwGmlGv/o9GJLqWgxK0FpbR3azOpDkCvxNBV++4M2VmjDaCvLUqR7WNBePvOuttX9LjWOpI3XbKtWaLfr+3HoYpPp8/O/VDEo8cVmlj5FTW4lbhvUMu26KM1k52mTMP49ABuwV1uIVKH7VDAsxSPMj4U5BU43B7ANFu6TTfFZNjMflWqewcPDQVHXyIpxBcfn6M1fokTpQ+NMj+NIGA/lgOkgeOQAFitmiFO2RqaOE/sQW/UpacvzX3MeSvQ5zeiYSskptS75wg8h1PAmb7WYhlzkDv1Q1cR/MPubvmnWyG6oFb1RXdTOh2hu7OSjcQ8Pl3vDz3JpnSOvQsjS2DP9SHxD6IElvSXeChsPlhcrTKv6tFLNziVj1vVUA==

    X-Forefront-Antispam-Report:

    CIP:172.234.36.107;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.hirthe.net;PTR:172-234-36-107.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(376002)(136003)(346002)(396003)(39860400002)(230922051799003)(186009)(1690799017)(1800799012)(82310400011)(7200799017)(64100799003)(451199024)(36840700001)(46966006)(40470700004)(2906002)(8400799017)(478600001)(40460700003)(564344004)(34070700002)(66899024)(6486002)(5660300002)(40480700001)(19625305002)(82740400003)(9686003)(33964004)(6666004)(70206006)(70586007)(8936002)(8676002)(7116003)(6506007)(4326008)(6512007)(786003)(6916009)(36736006)(316002)(118246002)(336012)(47076005)(26005)(9316004)(41320700001)(3480700007)(36860700001)(356005)(81166007)(956004)(31696002)(41300700001)(83380400001)(166002)(6082699003)(1406899027)(83022004);DIR:OUT;SFP:1102;

    X-OriginatorOrg: vdmtlncw.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 02:33:33.6674

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: 8d05fa9e-5bee-4f38-44c0-08dc08168d9a

    X-MS-Exchange-CrossTenant-Id: 700fc255-a97f-41f0-bb96-0eacc9d075d1

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=700fc255-a97f-41f0-bb96-0eacc9d075d1;Ip=[172.234.36.107];Helo=[mail.hirthe.net]

    X-MS-Exchange-CrossTenant-AuthSource:

    SN1PEPF0002BA51.namprd03.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN0P223MB0197

    X-Spam_score: 5.6

    X-Spam_score_int: 56

    X-Spam_bar: +++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: (6649) Notifications If you no longer wish to receive these

    emails, you may unsubscribe by clicking here.



    Content analysis details: (5.6 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [40.107.236.100 listed in list.dnswl.org]

    1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

    [URI: anotherswaytodo.blob.core.windows.net]

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [40.107.236.100 listed in wl.mailspike.net]

    -0.0 SPF_HELO_PASS SPF: HELO matches SPF record

    -0.0 SPF_PASS SPF: sender matches SPF record

    0.0 ARC_SIGNED Message has a ARC signature

    0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

    0.0 ARC_VALID Message has a valid ARC signature

    0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

    0.5 FROM_DOMAIN_NOVOWEL From: domain has series of non-vowel letters

    0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

    [bounce_cslzgooj(at)vdmtlncw.onmicrosoft.com]

    0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

    0.0 HTML_MESSAGE BODY: HTML included in message

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

    0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

    -0.0 T_SCC_BODY_TEXT_LINE No description available.

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    Subject: {SPAM?} Important for doctor



    --PART.gExQ.teulenry

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"











    (6649) Notifications































































    If you no longer wish to receive these emails, you may unsubscribe by

    clicking here.




















    --PART.gExQ.teulenry--

    I1.21KLLD384I2.16KwhoissourceRank10.4MPIN0Summary reportDiagnosisDensity00n/a

    Amazon Phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Thu, 28 Dec 2023 22:18:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ5Fv-000000007nx-34So

    for dave@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 22:17:59 -0700

    Resent-From: The Doctor

    Resent-Date: Thu, 28 Dec 2023 22:17:59 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-co1nam11hn2222.outbound.protection.outlook.com ([52.100.173.222]:7425 helo=NAM11-CO1-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ4oK-0000000071Y-2i1w

    for root@nk.ca;

    Thu, 28 Dec 2023 21:49:32 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=MM7VcjNxiq0aOV8mxuzIqZpWayjNnVGGOGqIVoU0uR5eBXeJ+bvB5JmqDxaIdi85VQOHpiPhtm+tirT9I3o+d7BZZGj0DxPnxRtODXMFfBUkB1iLwlXwxQQJVJmzDdF/5PRDPQanfOuYleQPYt7PzVYXF0JT/EAIvjV0u1cM81Ent5rJTkV14k1lrWfJ8Xkb4zkte94O+u3tTQOkgrdZDc2jQfS6Zh8caryquKgukDdfOQTH3CpH8YJa/GhXZqiJJ5U5A3jzsxxaq9ihlAgM69ydLZo2eV8kG0FVt5793jfOF5pgoEDoP4n7sCPP03VpYbo4nIsxGh8BSxd6Y+Kjlg==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=OsAuNSK/RfJVRvIyo1Lt7LrDzmjx1LHCiRtecBIlRFM=;

    b=GAnbDbDEIhL3pdmYS4FdU/MS2o87ZBYf2rcAHnGGJEWiNmXAyh/skHJVUKhtZ1wuE8EtkXvEYJUr9xZZJD//UCr4lnfOfIKoWty6TxAuHS59lxapmmTb2LDTzUJge2VJ1VoJ2n/gaFOdRNkEy+GCKv8LsyvkeLLYMNG/nfBMpECAO6Ei5cht5b4BTMwNYzxVbg2IAL3WTwxWBQdFgSrN2TUaOEo7fxMg+0PBHAtFU95OGZmOclcSfmDZKttEJJv+OtPPurgXwLFUQHvUhngiT82nKc1K5B+pMBjt/0SF2dp/lxWVSJ7deq4rxoEUPcQRDSxDodT+vRwl7DEsTSXaXg==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

    smtp.mailfrom=tiktok.villegasadventure.com; dmarc=pass action=none

    header.from=tiktok.villegasadventure.com; dkim=pass

    header.d=tiktok.villegasadventure.com; arc=none

    Authentication-Results: dkim=none (message not signed)

    header.d=none;dmarc=none action=none

    header.from=tiktok.villegasadventure.com;

    Received: from CYXP222MB1097.NAMP222.PROD.OUTLOOK.COM (2603:10b6:930:dc::8) by

    LV8P222MB0941.NAMP222.PROD.OUTLOOK.COM (2603:10b6:408:203::22) with Microsoft

    SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

    15.20.7135.19; Fri, 29 Dec 2023 04:47:21 +0000

    Received: from CYXP222MB1097.NAMP222.PROD.OUTLOOK.COM

    ([fe80::dfa5:8d49:8a09:5d1]) by CYXP222MB1097.NAMP222.PROD.OUTLOOK.COM

    ([fe80::dfa5:8d49:8a09:5d1%6]) with mapi id 15.20.7159.006; Fri, 29 Dec 2023

    04:47:21 +0000

    Date: Fri, 29 Dec 2023 05:47:21 +0100

    To: root@nk.ca

    From: Technical

    Subject: Your Prime membership is Renewing - Fri, December 29, 2023 5:47 AM

    Message-ID:

    X-Mailer: WebService/1.1.18291 YMailNorrin Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36

    Content-Type: text/html; charset=utf-8

    Content-Transfer-Encoding: quoted-printable

    X-ClientProxiedBy: BY5PR17CA0014.namprd17.prod.outlook.com

    (2603:10b6:a03:1b8::27) To CYXP222MB1097.NAMP222.PROD.OUTLOOK.COM

    (2603:10b6:930:dc::8)

    Importance: high

    X-Priority: 1

    MIME-Version: 1.0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: CYXP222MB1097:EE_|LV8P222MB0941:EE_

    X-MS-Office365-Filtering-Correlation-Id: c478b6e7-ac9d-48ea-d260-08dc08293e97

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    =?utf-8?B?VUpZaE92WGNldDFDTFBibzlScmRmblFXVmMvQ3NqTDRJQm5pZWxwV01URmVP?=

    =?utf-8?B?d2VOWnEzZHNocWdLK3FCRjRNM05iSXE2ak5HRERwRFZZNEVmOG8yVjhTbVFW?=

    =?utf-8?B?T0ZlRFZOZHk4K0VNdEJyUVNGd1gzTTJWck12RmVvdUc5QzNlR0hkTUVvWUZp?=

    =?utf-8?B?VG1HcTFoNzVYU3hMdWo5aUpsTTI0YW40V3BEVFAwajQzU1NwMGlYaU5Qb2NL?=

    =?utf-8?B?TFJIeXU5ZFNneFBET3BWbG9RNkJOWmN5NFJNWFNnUDI1eTNSZUdsbTBwcklE?=

    =?utf-8?B?RVRFWXlCVUphR2FBeDVMQ1JNQ3NMTUNFdkhUeE9COWNFRnJFRGZIRzBtcTBR?=

    =?utf-8?B?S2R4Wm45WVBLUUtkM282REdJYWdrNVJZSGRZN3QyTnRvMlNKcXRiOW95emZ1?=

    =?utf-8?B?VzJYMEs0aGJFc0Jma2o1NUFQUU9QbDNhZW8wb2hhYnhibE5TZGYvZm1qMThx?=

    =?utf-8?B?R0xGMElEVkpDb1N1R0tSSkRUaVQ2d0VRSENvcGl6NlB2Y2dpY2h1K0VUdEI4?=

    =?utf-8?B?elMyNW1RMko4cGc5UjhJQUM3RmpQelJRYWRpT3I4emRYWFhNMXMvdWlHRDlR?=

    =?utf-8?B?Q3ZIS1JiT1FSWUtZS3V1MGZ5NGVLdjdnL1ZGTmloaHNabXJvSHNPazF6cENa?=

    =?utf-8?B?dHo2S043dFVPMTVVTXA3dVFoZ3ZmZU1MbXhTbWNUallhTGNkVDNOblFVS05l?=

    =?utf-8?B?NU5iY3gyUkxabmt3UnhsYk1GcUxlSTJxSTREK2Q3U2ovcThYc3NaNnZENWJt?=

    =?utf-8?B?dGlKSTlHRGhtMUgrRDNCUWFjTXF2RkI5aGM5VHhMT2VzeWN6YmhYamkvN2o1?=

    =?utf-8?B?eWpnNUljbVJ5OFNFSmU5bURGQlpDeFQwVHQ4U1J5endNNDVpNG50cnYwcm1s?=

    =?utf-8?B?RXhnaHZZY1J2VVQ3TVAyaUNxcjJVS0N3VUZMcHFNek5qMzFCNFFkQi9CNWc1?=

    =?utf-8?B?NitWT2pqRThCZ0Vnb04yaTM2N2hicklrWisxVmU0eTR5WHVURzFJcVFOUkFJ?=

    =?utf-8?B?endINFJ6amxLZlh4RWx2dVloNUdBcWU3REU4MEFuNlJCcHJWRXhPeDQvaHBk?=

    =?utf-8?B?Qk1XemxUY2VGanFSTzlvbTNQNURVRFlFOXUyYUpYcWorRm0wd3pEUGpYMHBq?=

    =?utf-8?B?OTF6YVR0SDJZN0NGNFlrd3lkT2JTOTlwZ1JtR1QrbEp5dkpxd2t3N1VTWWx4?=

    =?utf-8?B?L21sMHBuak9MZmlWdEFwU0c0NEdGa0F1YXlQTCtnZzFSalNCb3pZbmtuWCtG?=

    =?utf-8?B?dU5RTURvaE5aWUQ3czVWeUptcFhLMWt1TUF4OWhJMHVGdFBCdjVqa3JoMmdK?=

    =?utf-8?B?TS9TUGZRR3pCZEYycFQrWHRMTmk4RGtBdmE5RStvVE9ONzBOOFJXaTRvS3Zp?=

    =?utf-8?B?eTN0VEx2U2RxN2NvWmd1ZE1kcXpvTFgxdFJIZWl0RDVRS2Fuc3JvWVVzcGoy?=

    =?utf-8?B?YVhESEM2My9EcitnRHlZV0l0WVRUbndXeWlJeEtlMVkwbnRFb1ZwOHh4WWIr?=

    =?utf-8?B?L2RDKzhVQjh3cWpSR3o3QU5OOHRFeDNRTnhjTU5oN2lWbTJjRDUrdTIzR2Nk?=

    =?utf-8?B?WmVHRkJDcDdDZXZvY3RHNnpCL0ZLK2dZNzRLRUJZeC9iaGtRS3MyN2lwOFpn?=

    =?utf-8?Q?UFOG8lqYHoQ1O1qEYeWcbMOWFA+u5L9JnuanJEVU4d+A=3D?=

    X-Forefront-Antispam-Report:

    CIP:255.255.255.255;CTRY:;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:CYXP222MB1097.NAMP222.PROD.OUTLOOK.COM;PTR:;CAT:OSPM;SFS:(13230031)(39860400002)(396003)(376002)(366004)(136003)(346002)(230922051799003)(230173577357003)(230273577357003)(64100799003)(186009)(1690799017)(451199024)(1800799012)(76236004)(41320700001)(16799955002)(66556008)(6506007)(6916009)(6512007)(52116002)(66946007)(6486002)(86362001)(66476007)(9686003)(38350700005)(41300700001)(26005)(166002)(38100700002)(4744005)(83380400001)(5660300002)(2906002)(8936002)(478600001)(8676002)(786003)(316002)(51984012)(459424003);DIR:OUT;SFP:1501;

    X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

    X-MS-Exchange-AntiSpam-MessageData-0:

    =?utf-8?B?cWpKbnRMelkvOFltclVjWTdRM2Z0Y1Jydnlaa0FFam9vNkQrbXU3bVd2Rzdm?=

    =?utf-8?B?aG01dXg2NksyRytvOWZEL1N3VXp4Y2hYengrN2ZlY3c5NWxmQnNxcW1yekZQ?=

    =?utf-8?B?R3oyUHBCenNveERuQU1zMUNRZ0cvclBKdmNUY3lUVTU5dDBORjNiWHo1VERH?=

    =?utf-8?B?ZXhLaWtucDVTN1RPZXBmZUh3QitxbUxzSkpkZTNTeVI5Z1hueU8yY21aZFd1?=

    =?utf-8?B?S2Q0ZWlKQmFGWjdWQU1ka0UrWXo2N0pxN1d5TWlNWjFrd3BkU2podnkyOWtX?=

    =?utf-8?B?cklCdDlhc3BPL1pnTHRtaXcxK3lGNUcwUkJBem0xOFNlaXdQUW1TSU9HcEll?=

    =?utf-8?B?MlR1aGlEK09STDQyc0U4RUpEbFg4K0R5TkRkd0RubVBhYlpwK0hka1FuRlFQ?=

    =?utf-8?B?aGZSZldxSTlzYk43bENWd0s3QVh5QkZiWEZjSjVwRDFRSVZEdmVzVUxyTW9U?=

    =?utf-8?B?dmllQ21TNEttK0pkMTFWQ3BROXhMUUNuVHZwNUZsOGdyT2dydGtRaGRzYVdD?=

    =?utf-8?B?U0pNaVlOZjk5YXA0U0w1d2loRVptQkFxNjhDSUNvSDZ4MDBacUQvUGl1Rklz?=

    =?utf-8?B?OUdxa1o4WXlQZk1WaEk3SU5ZOWp2R2JaYmFwaThzSDh5SlBEVDB1bTFPNmxU?=

    =?utf-8?B?UVhnRVlvSW8vaGU2dXZ5SFdXNXJ1QWZwSFZOV0lSM3NpVWdsdEh4emtQcFpq?=

    =?utf-8?B?TlpkQmRIY3JxWjRTdm9lWWtZcWtab3V5Rk01eDBIUkNsdFkrQSs4TlE5ekRx?=

    =?utf-8?B?ZDhsSXRpQXNKdFAxUUZTanUzL0djOVp1dE0yczV1bWtLV2xreWRZRDVZSGdl?=

    =?utf-8?B?elpoR0piRUdhQkZzTWUwazJ1NXVNcjdUV3BOWFBSTDVBOXVuTXhrNzYyMlB1?=

    =?utf-8?B?RUhuS0ExU015YUgwV1F4bUFTRGx4c0ZQd1YxRmpQVGI1K1g4dW5QLzNQV0dW?=

    =?utf-8?B?MmdvM2N6VFZqblN5OTNjMjRqa0lobXM1VHpMdDdUQlpLeFJSdVJQMkpYN3pO?=

    =?utf-8?B?amtxSTExT0w3cmVqZlZFYzV4MXpuRmlwbFRtWWlaZWR4cU42R0xXM3hUYnRF?=

    =?utf-8?B?amdzbFppT3VUc0tIN1VsbGdCWWRZRDBDa1lGUDVlbUdDdXpGcExYblJlSlBJ?=

    =?utf-8?B?cWt3MENpdERvd3JsUGsrSHBwQmNzL2xnZ2c3MWc3eFE5aE5COGc5K2ZpRlJu?=

    =?utf-8?B?ZVJWbUg5TWkvUjE2TnRtWktxVUZSa1c2UjNQdC9nZ214bnU0R3JIMGF3NkJu?=

    =?utf-8?B?TTBIdEVFdFVGM2xhSGVyTDFrUjBPYUpJYjMxbXF3V2pncEMvT3RramY2YXNY?=

    =?utf-8?B?dGR0Mm14OGpadGdLcTdya0pCc09JU2ROYlZidXUvUTZaVzhENi81K25wZDVI?=

    =?utf-8?B?dmw3VlJ4dXBLOTYwb0V0M3ZlbWZXSTRrSVFYaEdvM005RGpaU0M3ZThKUkUy?=

    =?utf-8?B?dTI0b1JvTllKNHpnc0s0NDVrUW5CNTQ1NnNacEZNNmtGT3l6REJBeGxyak15?=

    =?utf-8?B?YUIrTEhrSkxqT3dHYXNZZnd5UGFIcW13Vmd6YUxXYnNYZnVOM3BLc2lQTXo2?=

    =?utf-8?B?UEU3QjBvMUpxdG1KWkRRYytOR1JrcU5KYzZ0MzRVZGovalhxeTBEU3drRzht?=

    =?utf-8?B?czErcE5EWlVNYWQzbDBsS2FhMkV0ZVhRUXc3aHgxUHJ4ZkFqZHBscmtkZXVj?=

    =?utf-8?B?d0NGemx6dC93YnRDSE5IcWRnM1FTNk5CT25RZ1hYZTBrUCtleEFNdGk3UWZp?=

    =?utf-8?B?ekt5UUtsYTFSeUIwZ1dpS1lIa3lQNUZPS3UwNjZGMFVFSmVBUTBsUGdaRURo?=

    =?utf-8?B?ek5oQ0diL0ZNblg4c3pwR0ZvUjV1Y3hVWUJZeVc3VUdFb21IZEVKbGRWKzgy?=

    =?utf-8?B?bkNCT1VWaFkybnZWR1BEU2ljQUMvbVJvaTJnQ1ZOR1gyZXlaTDNGdHZrZ051?=

    =?utf-8?B?UitNSkJxUWZra3FCWDd5bSt4SjBIMFA1dTE5TGd0dzc0NnUwbVAzdlk5TkM0?=

    =?utf-8?B?am9lUVZaaGtsbHJIaWRFU1lDMDEyajJ1WEVNVmdBMm1ZTDl2bW5LdmRDdjFu?=

    =?utf-8?B?VGl4cTc1RlAxbkJYdVpwbE1ITTAzd0VZWXU4cUM2L1dWZ0pnd05MRDJTRnpo?=

    =?utf-8?B?UThVaFhXZlJMUUYwRGd2WjRoTmNtbGtCM3lzK2ZobVVFejY5WnNaSmRaRFhv?=

    =?utf-8?B?YkNPTkNXd2pxcnoyVkNJVW0xMDdPY3d3cDBqVTVqYXJHQTJEQm45ZjRVZUJT?=

    =?utf-8?B?QXpKMG8wQWhrOGQ5RFQ1TzIxQVNVbWJZM0VmcUJnLzdObnBTYmpIUkFFQ05Y?=

    =?utf-8?Q?J6mkWXsNr6cfiRB9jI?=

    X-OriginatorOrg: tiktok.villegasadventure.com

    X-MS-Exchange-CrossTenant-Network-Message-Id: c478b6e7-ac9d-48ea-d260-08dc08293e97

    X-MS-Exchange-CrossTenant-AuthSource: CYXP222MB1097.NAMP222.PROD.OUTLOOK.COM

    X-MS-Exchange-CrossTenant-AuthAs: Internal

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 04:47:21.7611

    (UTC)

    X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

    X-MS-Exchange-CrossTenant-Id: dbbb195f-4a0a-4922-9e6e-e4ae6eb1bf18

    X-MS-Exchange-CrossTenant-MailboxType: HOSTED

    X-MS-Exchange-CrossTenant-UserPrincipalName: qIgWGp8y3ujFTkbQ8llNf7lQJEj25vUKpNZ7eBKYqCcHnUyrJN3FDiwcklFt+ns/Sf2YCPmehF/iVIY2hEMnWIBYZpeDX9hRqpH5sl0bA3bqonnGh4D4DLYSi03z20ShmMifao59AZ3H/zvfuyrSlnYpM5eDS23pWPcEj1TAOYSG6k5rFO3uujkpSGyqDuewvGp5voOPKxaLhiMh3FdbtA==

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV8P222MB0941

    X-Spam_score: 5.9

    X-Spam_score_int: 59

    X-Spam_bar: +++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: Dear root@nk.ca, Your Amazon account is temporarily on hold

    because of an unusual login. About this change Fri, December 29, 2023 5:47

    AM Around Florida, United States Macbook Retina Pro Check Activi [...]



    Content analysis details: (5.9 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

    -0.0 SPF_HELO_PASS SPF: HELO matches SPF record

    0.0 ARC_SIGNED Message has a ARC signature

    0.0 ARC_VALID Message has a valid ARC signature

    0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [52.100.173.222 listed in wl.mailspike.net]

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [52.100.173.222 listed in list.dnswl.org]

    0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

    background

    0.0 HTML_MESSAGE BODY: HTML included in message

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

    -0.0 T_SCC_BODY_TEXT_LINE No description available.

    1.0 AMAZON_IMG_NOT_RCVD_AMZN Amazon hosted image but message not from

    Amazon

    1.0 FORGED_SPF_HELO No description available.

    1.6 FORGED_MUA_MOZILLA Forged mail pretending to be from Mozilla

    Subject: {SPAM?} Your Prime membership is Renewing - Fri, December 29, 2023 5:47 AM




    body>
    g=3D"0" cellpadding=3D"0" align=3D"center" style=3D"border-collapse:collaps=

    e">

    30px;margin:0 auto" dir=3D"ltr" bgcolor=3D"#ffffff">
    lspacing=3D"0" cellpadding=3D"0" align=3D"center" id=3D"m_-4190993533000013=

    413email_table" style=3D"border-collapse:collapse;max-width:630px;margin:0 =

    auto">

    nt-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-=

    serif;background:#ffffff">
    "0" cellpadding=3D"0" style=3D"border-collapse:collapse">
    r>=


    ght=3D"20" style=3D"line-height:20px" colspan=3D"3">

    t=3D"1" colspan=3D"3" style=3D"line-height:1px">

    15" style=3D"display:block;width:15px">
    =3D"100%" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:coll=

    apse">
    >

    >

    eight:32;line-height:0px">
    com/images/G/01/authportal/tiv/amazon_logo_RGB._CB424887820_.png" height=3D=

    "32" style=3D"border:0" class=3D"CToWUd" data-bit=3D"iit">
    "15" style=3D"display:block;width:15px">
    =3D"font-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial=

    ,sans-serif;font-size:19px;line-height:32px;color:#ffffff">

    ine-height:15px" colspan=3D"3">

    15" style=3D"display:block;width:15px">

    =3D"display:block;width:15px">
    ellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:collapse">
    y>
    >

    class=3D"m_-4190993533000013413mb_text" style=3D"font-family:Helvetica Neue=

    ,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;font-size:16px;lin=

    e-height:21px;color:#141823">Dear root@nk.ca,

    t=3D"15" style=3D"line-height:15px">

    0993533000013413mb_text" style=3D"font-family:Helvetica Neue,Helvetica,Luci=

    da Grande,tahoma,verdana,arial,sans-serif;font-size:16px;line-height:21px;c=

    olor:#141823">Your Amazon account is temporarily on hold because of an unus=

    ual login.

    >

    ont-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans=

    -serif;font-size:16px;line-height:21px;color:#141823">About this ch=

    ange

    px">

    cellpadding=3D"0" style=3D"border-collapse:collapse">
    ight:44px">
    x;vertical-align:center">
    =3D"height:44px">

    x65E4RmTqKykmV3ZESDvtDZa063Q387S4JJDlv5ub6VqoVeS8Twy8uQSO5xKCYxd4hEZHRUPTgf=

    b0OlMBoo7Lvu0WCB9CvCQng=3Ds0-d-e1-ft#https://static.xx.fbcdn.net/rsrc.php/v=

    3/yD/r/KJyTP_2W_qx.png" style=3D"border:0" class=3D"CToWUd" data-bit=3D"iit=

    ">    		Fri, December 29, 2023 5:47 AM

    proxy/c9KFiortacut7caoUURGRlkeLOtIp-GtyR_GZqDr1gYQwFrxxbpoOsCWFXS_-DQ_T_Eem=

    JBcB1g5k9jMZpGgtFUMhwPTIVTc3OCSWTmjZQ=3Ds0-d-e1-ft#https://static.xx.fbcdn.=

    net/rsrc.php/v3/yK/r/EYwma6hBA2v.png" style=3D"border:0" class=3D"CToWUd" d=

    ata-bit=3D"iit">    		Around Florida, United States

    b8OTowRc5zsA9QcEyU2xGsDy8nYud4_uHcFrJ0zo-wdBgU12ZNIsSTsA8KjsPhHmc3gKMvy0F2B=

    9weZzpAEwgCTZhh9d9BNLRQTfl9MA=3Ds0-d-e1-ft#https://static.xx.fbcdn.net/rsrc=

    .php/v3/yC/r/Ve5FEXFHw7A.png" style=3D"border:0" class=3D"CToWUd" data-bit=

    =3D"iit">    		Macbook Retina Pro

    er=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" style=3D"border=

    -collapse:collapse">
    <=

    /td>

    le=3D"color:#1b74e4;text-decoration:none" target=3D"_blank" data-saferedire=

    cturl=3D"https://www.facebook.com/">
    spacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:collapse"><=

    tr>

    r;display:block;background:#f1c65D;padding:8px 20px 8px 20px">
    tps://google.federicogaon.com/RoUXQE" style=3D"color:#1b74e4;text-decoratio=

    n:none;display:block" target=3D"_blank" data-saferedirecturl=3D"">
    <=

    font size=3D"3">
    Grande,tahoma,verdana,arial,sans-serif;white-space:nowrap;font-weight:bold;=

    vertical-align:middle;color:#ffffff;font-weight:500;font-family:Roboto-Medi=

    um,Roboto,-apple-system,BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucida =

    Grande,tahoma,verdana,arial,sans-serif;font-size:17px">Check Activity
    >

    =3D"8" style=3D"line-height:8px">

    ine-height:13px">

    style=3D"line-height:15px">

    0013413mb_text" style=3D"font-family:Helvetica Neue,Helvetica,Lucida Grande=

    ,tahoma,verdana,arial,sans-serif;font-size:16px;line-height:21px;color:#141=

    823">Please verify and change your password to reactivate your Amazon accou=

    nt. If we are unable to complete this action within 24 hours, all pending o=

    rders will be canceled, and you won't be able to access your account until =

    this process is complete.

    ne-height:15px">

    ext" style=3D"font-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,ver=

    dana,arial,sans-serif;font-size:16px;line-height:21px;color:#141823">Thank =

    You,
    Security Team

    eight:15px">

    y:block;width:15px">

    idth:15px">
    llpadding=3D"0" align=3D"left" style=3D"border-collapse:collapse">
    r style=3D"border-top:solid 1px #e5e5e5">
    y>

    ight:19px">

    ple-system,BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucida Grande,tahoma=

    ,verdana,arial,sans-serif;font-size:11px;color:#8a8d91;line-height:16px;fon=

    t-weight:400">
    =3D"border-collapse:collapse;color:#8a8d91;text-align:center;font-size:12px=

    ;font-weight:400;font-family:Roboto-Regular,Roboto,-apple-system,BlinkMacSy=

    stemFont,Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-s=

    erif">

    oboto-Regular,Roboto,-apple-system,BlinkMacSystemFont,Helvetica Neue,Helvet=

    ica,Lucida Grande,tahoma,verdana,arial,sans-serif;color:#8a8d91;text-align:=

    center;font-weight:400;padding-bottom:6px">

    r" style=3D"font-size:12px;font-family:Roboto-Regular,Roboto,-apple-system,=

    BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,ar=

    ial,sans-serif;color:#8a8d91;text-align:center;font-weight:400;padding-top:=

    6px;padding-bottom:6px">3D"Meta"
    ttps://ci4.googleusercontent.com/proxy/d3D_pwZxEfzej1l0yE5VCB7hNnHBxmwllq0R=

    GTLQMQjNiyMQILxq8jnUO-Q6Wss8zCSYPdVqCSFHrlVWX8fj7LCw=3Ds0-d-e1-ft#https://f=

    acebook.com/images/email/meta_logo.png" style=3D"border:0" class=3D"CToWUd"=

    data-bit=3D"iit">

    x;font-family:Roboto-Regular,Roboto,-apple-system,BlinkMacSystemFont,Helvet=

    ica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;color:#8a8=

    d91;text-align:center;font-weight:400;padding-top:6px;padding-bottom:6px">=

    =C2=A9 Amazon, Inc., Attention: Community Support, 1 Prime Way, Menlo Park,=

    CA 94025

    mily:Roboto-Regular,Roboto,-apple-system,BlinkMacSystemFont,Helvetica Neue,=

    Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;color:#8a8d91;text-=

    align:center;font-weight:400;padding-top:6px">This message was sent to
    tyle=3D"color:#1b74e4;text-decoration:none" href=3D"mailto:root@nk.ca" targ=

    et=3D"_blank">root@nk.ca    .
    To help keep your account safe, please do=

    not forward this email.
    ef=3D"https://www.facebook.com/help/213481848684090/" target=3D"_blank" dat=

    a-saferedirecturl=3D"https://www.google.com/url?q=3Dhttps://www.facebook.co=

    m/help/213481848684090/&source=3Dgmail&ust=3D1687171260017000&u=

    sg=3DAOvVaw32Uqlt33nD2sLieoXk0L9E">Learn more
    =


    Ldq7kKHZQeCUx4ryG6ANcWwQV1hcSPrfRMEmwu_mFvKaq7uX-QVBqFUXSMBovxmOxe3GwHX0eQx=

    raYK-R8LTHez7x2jOWrVbTUDcuN-0JHqQkTCe_QFo5Mm7TeZPcmEiZIuxOHBWN0-T5vXN23VazH=

    JwA=3Ds0-d-e1-ft#https://www.facebook.com/email_open_log_pic.php?mid=3D5fe1=

    3a3f4faaeG5b0581311d19G5fe13ed8afd80G18e" style=3D"border:0;width:1px;heigh=

    t:1px" class=3D"CToWUd" data-bit=3D"iit">
    <=

    /div>


    I1.21KL0LD384I2.16KwhoissourceRank10.4MPIN0Summary reportDiagnosisDensity00n/a

    Fedex Phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Thu, 28 Dec 2023 18:26:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ1cz-000000001kt-1OnO

    for dave@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 18:25:33 -0700

    Resent-From: The Doctor

    Resent-Date: Thu, 28 Dec 2023 18:25:33 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-he1eur04on2051.outbound.protection.outlook.com ([40.107.7.51]:29440 helo=EUR04-HE1-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ1ZD-000000001ZS-1yHh

    for doctor@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 18:21:43 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=N0z53eUK9+j4CpGovBeHApu8ItU3ZzPKwT5iqNDE46IotjI1/RMRbP0XQUI261chpT6KprKzvduQ6jWe11AiKbOIbBWQOPfSLLy6z1Bt93W17/lv+h9GisIf5DEezjeuzKYkdKmzTziEO8XjVQojvhC4jq8u9+x6depjFq7jqXo4k+JTBcxJP/rAEQBE22VMbzo6WljM2WCnwug4FlKuiO+26aCnpDK3uyjVyItdiDTZ0kmKcNGe0+42mhLB4PCR5BNTXA3bxjOsZceyXHUcSccf6zaVe1aE3w3aUi3qVQbTk1t5nHeHE7y1vOQC5A79WeWtR69m7GoxD3DixNlfzw==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=5EDXwmwMLlZJEwQ8nMsnUIAZB1fIUKGBVPZQVKFGHeY=;

    b=OLFKvUSWKqxM4hGjW9IVmEfbV5i0/pgxpfAPDKBlB/UVKa1TC35VOZtrPRbs+ZWgUrgl6h37rQWXAj13ZMrMAJZ89i92EivvK/bItAstrIkMXCzNdPP10GN8LAKUoxcwF6XDVo8SowLSfw+NOvqjjcKnftEFrlzUad9rOYg+BclVxh/up5ITtGuVJJLOuNVz8IqZV/QBwS2fL1OKXjg7NCD5gL1xfGzBkkp6oYay9noJx0Yc8or4ElcEmFSgmWstGMZ/J4EOZjXpCsBkNkk8TpQpTKIZP0wiuu3ZVb1igkWtaBbz1WuPYHBrrbvlI96EOk2HR9ZoPV4u1nqJUbkO6w==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    172.233.222.135) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=es02ms.onmicrosoft.com; dmarc=none action=none

    header.from=es02ms.onmicrosoft.com; dkim=none (message not signed); arc=none

    (0)

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 172.233.222.135)

    smtp.mailfrom=ES02MS.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=ES02MS.onmicrosoft.com;

    From: =?UTF-8?B?U2hpcHBpbmcgRGVwYXJ0bWVudA==?=

    MIME-Version: 1.0

    Importance: high

    Date: Fri, 29 Dec 2023 02:16:50 +0100

    In-Reply-To:

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART_b7GI.mytqqnhi"

    Subject: Important for doctor

    To: doctor@doctor.nl2k.ab.ca

    CC: doctor@doctor.nl2k.ab.ca

    X-TOI-MSGID: <492523584.502521A1F3D1C.1703812610053@hudson.com>

    Message-ID:

    <14d76994-1228-41af-89aa-8f0e76009331@AMS0EPF000001B3.eurprd05.prod.outlook.com>

    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: AMS0EPF000001B3:EE_|DU0PR10MB6509:EE_

    X-MS-Office365-Filtering-Correlation-Id: ed9bdf76-e66f-49c2-59d3-08dc080c356f

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    LleeufDdg834UTwksxJQhZ3Y/Q5Z2o/LhjQodQNZGHVBn2KvjKJlW62Fj2x8EaPgfAPmJTYDUPQCHlzFR5vnQW6AvaBsfCJwV1nwwgYcAuLuWbOFEqOUmwGF5rladJHYfvt8PNAya0ATOFx+g0yS/4HW2An8ZRYfEDfqcHpwxkFsCP7OY+myegKwwsv/yatsUN/zGoqKuZB9PbL7md9WX2j1vfkGA1CWO+6NzjLsWs9ioX1fqknuv9coLU7HG2kWBT2VOnF+iGnOSoRCdpGmM/DdVUEJeQl+gRaKrNJdX7YFDsQBTO+4ScSTtFiOxa0XfYmvWg2fVnxqlvxfENeex78vZgw1zBg9Jv3LYBja+t3NTtJa+G4cUC4OpBnI3RG3E2h4LX9nTkQ5HDocWstwB/0NpvV/Wzp5IZesALpRKBYYUvOFzI6HnkypxHgP4pcrq8Tl/G6jFJnsAjgFyTSKsysr9dMbPFzI300wUqypJYBrfNoeRReukw8gnvOxa8Hj7y7hsp5Fwqup/+0lXpxJhjmDDKDwVilBY0MYa4rCzjE=

    X-Forefront-Antispam-Report:

    CIP:172.233.222.135;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.hudson.com;PTR:172-233-222-135.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(39860400002)(346002)(396003)(136003)(376002)(230922051799003)(82310400011)(61400799012)(64100799003)(451199024)(186009)(1690799017)(7200799017)(46966006)(36840700001)(40470700004)(3480700007)(40460700003)(40480700001)(41320700001)(81166007)(478600001)(36860700001)(8400799017)(9686003)(42186006)(31696002)(41300700001)(82740400003)(70586007)(33964004)(316002)(6916009)(70206006)(786003)(47076005)(34020700004)(8936002)(8676002)(2906002)(166002)(4326008)(564344004)(7116003)(336012)(19625305002)(6082699003)(5660300002)(26005);DIR:OUT;SFP:1101;

    X-OriginatorOrg: ES02MS.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 01:19:30.6543

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: ed9bdf76-e66f-49c2-59d3-08dc080c356f

    X-MS-Exchange-CrossTenant-Id: ac42b354-6a08-466b-af44-99b0968edd61

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=ac42b354-6a08-466b-af44-99b0968edd61;Ip=[172.233.222.135];Helo=[mail.hudson.com]

    X-MS-Exchange-CrossTenant-AuthSource:

    AMS0EPF000001B3.eurprd05.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR10MB6509



    --PART_b7GI.mytqqnhi

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"











    (9159) Notifications For YOU









































































































    --PART_b7GI.mytqqnhi--

    I1.21KL0LD384I2.16KwhoissourceRank10.4MPIN0Summary reportDiagnosisDensity00n/a

    Fedex Phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Thu, 28 Dec 2023 18:26:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ1d4-000000001lE-4A07

    for dave@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 18:25:38 -0700

    Resent-From: The Doctor

    Resent-Date: Thu, 28 Dec 2023 18:25:38 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-he1eur04on2051.outbound.protection.outlook.com ([40.107.7.51]:29440 helo=EUR04-HE1-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ1ZD-000000001ZS-1yHh

    for doctor@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 18:21:43 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=N0z53eUK9+j4CpGovBeHApu8ItU3ZzPKwT5iqNDE46IotjI1/RMRbP0XQUI261chpT6KprKzvduQ6jWe11AiKbOIbBWQOPfSLLy6z1Bt93W17/lv+h9GisIf5DEezjeuzKYkdKmzTziEO8XjVQojvhC4jq8u9+x6depjFq7jqXo4k+JTBcxJP/rAEQBE22VMbzo6WljM2WCnwug4FlKuiO+26aCnpDK3uyjVyItdiDTZ0kmKcNGe0+42mhLB4PCR5BNTXA3bxjOsZceyXHUcSccf6zaVe1aE3w3aUi3qVQbTk1t5nHeHE7y1vOQC5A79WeWtR69m7GoxD3DixNlfzw==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=5EDXwmwMLlZJEwQ8nMsnUIAZB1fIUKGBVPZQVKFGHeY=;

    b=OLFKvUSWKqxM4hGjW9IVmEfbV5i0/pgxpfAPDKBlB/UVKa1TC35VOZtrPRbs+ZWgUrgl6h37rQWXAj13ZMrMAJZ89i92EivvK/bItAstrIkMXCzNdPP10GN8LAKUoxcwF6XDVo8SowLSfw+NOvqjjcKnftEFrlzUad9rOYg+BclVxh/up5ITtGuVJJLOuNVz8IqZV/QBwS2fL1OKXjg7NCD5gL1xfGzBkkp6oYay9noJx0Yc8or4ElcEmFSgmWstGMZ/J4EOZjXpCsBkNkk8TpQpTKIZP0wiuu3ZVb1igkWtaBbz1WuPYHBrrbvlI96EOk2HR9ZoPV4u1nqJUbkO6w==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    172.233.222.135) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=es02ms.onmicrosoft.com; dmarc=none action=none

    header.from=es02ms.onmicrosoft.com; dkim=none (message not signed); arc=none

    (0)

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 172.233.222.135)

    smtp.mailfrom=ES02MS.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=ES02MS.onmicrosoft.com;

    From: =?UTF-8?B?U2hpcHBpbmcgRGVwYXJ0bWVudA==?=

    MIME-Version: 1.0

    Importance: high

    Date: Fri, 29 Dec 2023 02:16:50 +0100

    In-Reply-To:

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART_b7GI.mytqqnhi"

    Subject: Important for doctor

    To: doctor@doctor.nl2k.ab.ca

    CC: doctor@doctor.nl2k.ab.ca

    X-TOI-MSGID: <492523584.502521A1F3D1C.1703812610053@hudson.com>

    Message-ID:

    <14d76994-1228-41af-89aa-8f0e76009331@AMS0EPF000001B3.eurprd05.prod.outlook.com>

    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: AMS0EPF000001B3:EE_|DU0PR10MB6509:EE_

    X-MS-Office365-Filtering-Correlation-Id: ed9bdf76-e66f-49c2-59d3-08dc080c356f

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    LleeufDdg834UTwksxJQhZ3Y/Q5Z2o/LhjQodQNZGHVBn2KvjKJlW62Fj2x8EaPgfAPmJTYDUPQCHlzFR5vnQW6AvaBsfCJwV1nwwgYcAuLuWbOFEqOUmwGF5rladJHYfvt8PNAya0ATOFx+g0yS/4HW2An8ZRYfEDfqcHpwxkFsCP7OY+myegKwwsv/yatsUN/zGoqKuZB9PbL7md9WX2j1vfkGA1CWO+6NzjLsWs9ioX1fqknuv9coLU7HG2kWBT2VOnF+iGnOSoRCdpGmM/DdVUEJeQl+gRaKrNJdX7YFDsQBTO+4ScSTtFiOxa0XfYmvWg2fVnxqlvxfENeex78vZgw1zBg9Jv3LYBja+t3NTtJa+G4cUC4OpBnI3RG3E2h4LX9nTkQ5HDocWstwB/0NpvV/Wzp5IZesALpRKBYYUvOFzI6HnkypxHgP4pcrq8Tl/G6jFJnsAjgFyTSKsysr9dMbPFzI300wUqypJYBrfNoeRReukw8gnvOxa8Hj7y7hsp5Fwqup/+0lXpxJhjmDDKDwVilBY0MYa4rCzjE=

    X-Forefront-Antispam-Report:

    CIP:172.233.222.135;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.hudson.com;PTR:172-233-222-135.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(39860400002)(346002)(396003)(136003)(376002)(230922051799003)(82310400011)(61400799012)(64100799003)(451199024)(186009)(1690799017)(7200799017)(46966006)(36840700001)(40470700004)(3480700007)(40460700003)(40480700001)(41320700001)(81166007)(478600001)(36860700001)(8400799017)(9686003)(42186006)(31696002)(41300700001)(82740400003)(70586007)(33964004)(316002)(6916009)(70206006)(786003)(47076005)(34020700004)(8936002)(8676002)(2906002)(166002)(4326008)(564344004)(7116003)(336012)(19625305002)(6082699003)(5660300002)(26005);DIR:OUT;SFP:1101;

    X-OriginatorOrg: ES02MS.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 01:19:30.6543

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: ed9bdf76-e66f-49c2-59d3-08dc080c356f

    X-MS-Exchange-CrossTenant-Id: ac42b354-6a08-466b-af44-99b0968edd61

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=ac42b354-6a08-466b-af44-99b0968edd61;Ip=[172.233.222.135];Helo=[mail.hudson.com]

    X-MS-Exchange-CrossTenant-AuthSource:

    AMS0EPF000001B3.eurprd05.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR10MB6509



    --PART_b7GI.mytqqnhi

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"











    (9159) Notifications For YOU









































































































    --PART_b7GI.mytqqnhi--

    I1.21KL0LD384I2.16KwhoissourceRank10.4MPIN0Summary reportDiagnosisDensity00n/a

    Fedex phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Thu, 28 Dec 2023 06:59:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIqu7-000000005Du-1sou

    for dave@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 06:58:31 -0700

    Resent-From: The Doctor

    Resent-Date: Thu, 28 Dec 2023 06:58:31 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-am7eur03on2132.outbound.protection.outlook.com ([40.107.105.132]:2688 helo=EUR03-AM7-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rInER-00000000PN5-3MnG

    for doctor@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 03:04:06 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=OX9SKkBkinQ9OjwZrksuEUWRuhfT9JjNWh2KusSKUY0L05aqqArHmOGc36YQ50iS7Nlu26Pb6xV9C1A9BsfSEmhR44WoUDeMjt0VfJ0tp/HR21vWxnPw65kLFVC5ASiVNfIhC9PRZWcgcaUI6fVvQR4pOjKklNBXZsaLP+eMmgS6CatPkK9vWXC2UYwmUtsOafoTMSePcVP6An9HB7kU2nri75Pa475BAwAIofTvtfGoHMfqrWNiaQpUyOHM5hvAE0g5ykJ0PX7dOB08l/I7EADYMml9tszPjIfNTqhsOACldN9s97ZeVRIby2OOiCcxoBa8pll/APLv8kK9ybhKDQ==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=CgUAYRvJKjwvMu7zSmBJ9V80/yxuqKiBRfxMqsGFFE4=;

    b=d7SmWYWkJr/VoQn+58nMAJzr50JZlfwEPacRfuZmY+MCZlDUzROERa4pBrZgeMXhzSAEY5F54nlElKeGl4wY5M462S5t8htpGkjDCHGYpoWu4R32oo3o9zQigYTiWeMDo4re1X+ez+nPblryvXG01v6WhWBXyodXW3FvVsD3S4uwrsgWOqzgeKhxNbjsJGgTtNG+nukhDir3earGNdY2v0huGp4pG3bMWk/Zg5HksQsrOHf1p/kpZU3TRL+CN77p1G7PjnmiuqY8sg6CjCSk4/HbsvEHeuZ241ptn2EV8+erg1Gs8TZjLlmgVrPD0l55Z2sFWpOTQdIRZo14gjMPGA==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    45.79.211.243) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=martinho759.onmicrosoft.com; dmarc=none action=none

    header.from=martinho759.onmicrosoft.com; dkim=none (message not signed);

    arc=none (0)

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 45.79.211.243)

    smtp.mailfrom=martinho759.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=martinho759.onmicrosoft.com;

    X-TOI-MSGID: <529217336.C6D069B7A88A2.1703757295507@thompson.com>

    From: =?UTF-8?B?RmVkZXggQ29uZmlybWF0aW9uIA==?=

    Importance: high

    Subject: =?UTF-8?B?SW1wb3J0YW50IFNoaXBtZW50IFVwZGF0ZTogWW91ciBEZWxpdmVyeSBQcm9ncmVzcw==?=

    MIME-Version: 1.0

    CC: doctor@doctor.nl2k.ab.ca

    To: doctor@doctor.nl2k.ab.ca

    In-Reply-To:

    Date: Thu, 28 Dec 2023 10:54:55 +0100

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART_XENZ.cgvadkqb"

    Message-ID:



    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: AMS0EPF00000195:EE_|DBAPR07MB6629:EE_

    X-MS-Office365-Filtering-Correlation-Id: 263cdafb-ecf1-42a0-b5b5-08dc078be98d

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    qi/frShUumS2l7sCYppwPnMwy/TPWpiHkFHH7+i+tIidqe0HuwaQtMGDSY7Xxul/4T1jMAnC8b/aMwdcixxOCg74BjGQKrRs63c2c/BzsG5ZMVcv4adeMrzceTGVJaBDHJk5GEdUyYjOWKPSM4QrDZcB0hI9ql4V9VU/1l7+O8wyLfjdhr5XtW3Ojv5kWZwbh0TCngw/HHG5BCUfujUzx5Rex1qRl3zaE5S55Ovt52PdkXP3+TUmrREUonegVZs5iP5KgP2KP4LW6RHgdStzkj6WbhrolOqGIaihxMIXZNy+LnSxLnKq8V9xfM3I2YY1YZYbkV0/wQBInUBwgs05cQUb94gvfzFicxuEjGUYoIVlszxLIQa99aXvcQyBtLAB0EWvNMI45JunF1XWNNDwE1vQS3PVj4rpTdEZrz4q53DS7qbM2tjA/UAAla2KnnEgSxfFhAR3CRoTNRFh+5z53J8KHXNcAnGx3vCvoqSTzkDIC36CJQicAPT8ZqRpv/NFMS0E35LZPfwt1LbKBbw+tCLVcM2A4QyFQFHfzKK1KChytnfAihuoOM+5+4xQ/WiuBV73UbBaZnU4d/S02sSeOJqvD/rC44HvFxhspSSQvzV9F2ouzjhhJyeD3IRqfeTG6QVOb4LHSPry4+4IKif9nSvBjR+epgs3rRrPB0WNg7I=

    X-Forefront-Antispam-Report:

    CIP:45.79.211.243;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.thompson.com;PTR:45-79-211-243.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(376002)(346002)(39850400004)(136003)(396003)(230922051799003)(82310400011)(186009)(451199024)(7200799017)(1690799017)(64100799003)(61400799012)(46966006)(36840700001)(40470700004)(31696002)(41320700001)(19625305002)(5660300002)(26005)(2906002)(336012)(786003)(70586007)(70206006)(316002)(42186006)(6916009)(10290500003)(33964004)(4326008)(9686003)(478600001)(8676002)(8936002)(166002)(41300700001)(81166007)(47076005)(82740400003)(34070700002)(36860700001)(85622046)(40460700003)(40480700001)(564344004)(8400799017);DIR:OUT;SFP:1102;

    X-OriginatorOrg: martinho759.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Dec 2023 10:01:07.7807

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: 263cdafb-ecf1-42a0-b5b5-08dc078be98d

    X-MS-Exchange-CrossTenant-Id: 7a268d00-c3d2-4549-8ed1-02bbc87ef194

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=7a268d00-c3d2-4549-8ed1-02bbc87ef194;Ip=[45.79.211.243];Helo=[mail.thompson.com]

    X-MS-Exchange-CrossTenant-AuthSource:

    AMS0EPF00000195.eurprd05.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBAPR07MB6629

    X-Antivirus: AVG (VPS 231227-4, 12/27/2023), Inbound message

    X-Antivirus-Status: Clean



    --PART_XENZ.cgvadkqb

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"











    (3999) Notifications For YOU









































































































    --PART_XENZ.cgvadkqb--

    Ryobi Chainsaw PHish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Wed, 27 Dec 2023 18:26:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIf9r-000000002Xa-1YkY

    for dave@doctor.nl2k.ab.ca;

    Wed, 27 Dec 2023 18:25:59 -0700

    Resent-From: The Doctor

    Resent-Date: Wed, 27 Dec 2023 18:25:59 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-dm3nam02rlnn2043.outbound.protection.outlook.com ([40.95.34.43]:8417 helo=NAM02-DM3-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    id 1rIegc-000000001wp-3X9S

    for doctor@doctor.nl2k.ab.ca;

    Wed, 27 Dec 2023 17:55:50 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=Z698ikBfExCQCJfLfV7C1cdWoB/4foct+zBxs34csRvR7sqh2hbGUmpqfScSq3F3CrbykeHXbTy9nWKi6+sIq0VbXLlWk9g0rgK6P1D7YasDDsNbSsuL/uE3VxJjhnYKSqqG1Lsti4fJPpP2zWLXJ4qipZABS6zzDnkeI7hqDqHzfFVbxUXtion4maaRVUXyJQjB/PChRHJrWPYkgOe/57psAmeqfzWfdxZaqebv3HP+sM4TwkimdtttZcU6VGuZi9EkJkZ4ChAqQKueR0Uiqjlj3wcQ3q+swcn5IH/pRQfRlliYbHZCL+x2KTqODaVnEp1l2JU9IWPKdePgtbCTfg==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=0styqUom6Rz5RZZNN6C3QyP0c1QN2ZOWD3kZ1CmdkN0=;

    b=KcWlp41niq3a6EfLMWB3tI0XAMUquO/6brg59Q3kRa2CSLprIKhj+WmzQb5g9ntm7AF+utaFNot+GRQYyG2OhRthO0LbYhXKs38IavDBPJRGTQq8suoAqZophYm/ZHemZqdOg7utTmbDgbaS0pf/CYZehhhWuUauvdgXcErowjEBqdajSD910y18k1jDSslzstDLdj72cRJbscpjmoFSd+CZWsXq3NTa32qd6LDjTzZUIN9ohpkb0/Z653FUU8T0u3bF2sA0djXT4m10iTgI+uXZZJpZRfy7CrjRsLSavV4JObDa8fYpb4YoAIzl4SFtCjuXC1Ihid/dtS7XDhNU3Q==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

    78.46.149.17) smtp.rcpttodomain=doctor.nl2k.ab.ca smtp.helo=mail.goldner.net;

    dmarc=none action=none header.from=nvz.dtq7zh.com; dkim=none (message not

    signed); arc=none (0)

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=4pfvf63.onmicrosoft.com; s=selector1-4pfvf63-onmicrosoft-com;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

    bh=0styqUom6Rz5RZZNN6C3QyP0c1QN2ZOWD3kZ1CmdkN0=;

    b=dGwznh7nG/VGRqFlncI8qeJNgvzn+UnFj3umTdrJV/6ejtH+JlMcBLo2tgaWod1fr5MBEMHXaziDx1sDje4n3AwS35ykz5P82bJQwLipJVA78ejaFjeE/rPyEq5gBmpzFHlKyrURhNq1niuYR/yZQewSeUWU5c1LG04PfMZ9OjnMN19JyNUgCOy3ekt7XwXSlXGe8c43L8c1vWGjBPSWdKOQQUX2D7M6zYutYw52KGf7YmSyCnbAxD5qA7xvxZqTRzCc9SBaw215A9z3pw45gzV4JWeuk8piFeUTyUgV/pGC98EbXzbZrk+UKdVIdxmZE3pN+TnwKmRubL47y3EyhQ==

    X-MS-Exchange-Authentication-Results: spf=none (sender IP is 78.46.149.17)

    smtp.helo=mail.goldner.net; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=nVz.dtQ7zH.com;

    CC: doctor@doctor.nl2k.ab.ca

    Content-Type: text/html; charset="UTF-8"

    Content-Transfer-Encoding: 7bit

    To: doctor@doctor.nl2k.ab.ca

    X-TOI-MSGID: <1672204214.E18B29F673DB6.1703724695741@goldner.net>

    MIME-Version: 1.0

    Subject: Your order has shipped! - Ryobi One Chainsaw

    Date: Thu, 28 Dec 2023 01:51:35 +0100

    In-Reply-To:

    From: Welcome

    Importance: high

    Message-ID:



    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: MW2NAM12FT023:EE_|PH0PR10MB5732:EE_

    X-MS-Office365-Filtering-Correlation-Id: a2d122ce-ea8f-4b55-d02c-08dc073f6f18

    X-MS-Exchange-SenderADCheck: 2

    X-MS-Exchange-AntiSpam-Relay: 1

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    2S3n3/FOBRPN8Wf7Sa3gNsVsfj1+bFX7piR/eZr9UIB9mDIZe5xHZqtSf77CH/4+T0vWyHa4K4MIZlOWfN+1z7NQSl5jvyEG6z66xxYk6powzroXWonr3lTRzorOZaVQkVif3QWpFwX2HtBn8Ec1te00TEZdifwgbp+Fl/Pv2uJYkNjZO04L8sBIpkGIsSImI98CAK9ER3Yo76SlBjRo/CYQVohqES0G3VD7ma1QUwEPoKDTtxPPHeMlxJ+hp1swcvpUoLXX2LFpvZ6gTqqjRAbBzpAaqhA3j2SlzcgyeQur5igIPDtktp9spMYbYIqFT4KA3pReoJ5k85DqTuAm/qe837FomgSXOaiiNgTuX+y/YaKMc+3gbVDSWHigN3mJAIhNeiiE54KV5PEdNNWg8ZK3cyJCVN5hMZXA3KG/AdBvZXXyQr/PpES2BcLTLNJDpExZsshll/nOJvz98x8D4g==

    X-Forefront-Antispam-Report:

    CIP:78.46.149.17;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.goldner.net;PTR:static.17.149.46.78.clients.your-server.de;CAT:NONE;SFS:(13230031)(136003)(396003)(346002)(376002)(39860400002)(230922051799003)(451199024)(64100799003)(82310400011)(7200799017)(48200799006)(1690799017)(61400799012)(46966006)(42882007)(8400799017)(31686004)(336012)(70586007)(70206006)(26005)(6916009)(42186006)(316002)(786003)(5660300002)(47076005)(8936002)(67280400001)(35950700001)(8676002)(78352004)(9686003)(4326008)(40480700001)(498600001)(19625305002)(82740400003)(2906002)(81166007)(166002)(31696002)(41300700001)(41320700001)(558084003);DIR:OUT;SFP:1022;

    X-OriginatorOrg: 4pfvf63.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Dec 2023 00:53:40.1592

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: a2d122ce-ea8f-4b55-d02c-08dc073f6f18

    X-MS-Exchange-CrossTenant-Id: 90903da3-5cf4-445f-8a84-a419febd4dd7

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=90903da3-5cf4-445f-8a84-a419febd4dd7;Ip=[78.46.149.17];Helo=[mail.goldner.net]

    X-MS-Exchange-CrossTenant-AuthSource:

    MW2NAM12FT023.eop-nam12.prod.protection.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB5732

    X-Spam_score: 5.2

    X-Spam_score_int: 52

    X-Spam_bar: +++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: (1) Notifications



    Content analysis details: (5.2 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

    [SPF failed: Please see http://www.openspf.org/Why?s=helo;id=NAM02-DM3-obe.outbound.protection.outlook.com;ip=40.95.34.43;r=doctor.nl2k.ab.ca]

    0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

    0.0 ARC_SIGNED Message has a ARC signature

    -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

    0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

    0.0 ARC_VALID Message has a valid ARC signature

    0.0 HTML_MESSAGE BODY: HTML included in message

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

    -0.0 T_SCC_BODY_TEXT_LINE No description available.

    2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

    0.0 T_REMOTE_IMAGE Message contains an external image

    Subject: {SPAM?} Your order has shipped! - Ryobi One Chainsaw

    X-Antivirus: AVG (VPS 231227-4, 12/27/2023), Inbound message

    X-Antivirus-Status: Clean









    (1) Notifications
























    Fedex phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Wed, 27 Dec 2023 18:26:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIf9U-000000002XE-0Ua0

    for dave@doctor.nl2k.ab.ca;

    Wed, 27 Dec 2023 18:25:36 -0700

    Resent-From: The Doctor

    Resent-Date: Wed, 27 Dec 2023 18:25:36 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-db8eur05on2125.outbound.protection.outlook.com ([40.107.20.125]:37825 helo=EUR05-DB8-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIed0-000000001rP-3hQt

    for doctor@doctor.nl2k.ab.ca;

    Wed, 27 Dec 2023 17:52:06 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=e1hYLCcRY9wgfgSSoEOQ5akwBlMPuFrzQkzWr+YFKUfftSNcTaeRtWlEBbxW4+7O7LDL0S0mySz89PZ+hDug5fuMm9CZGVe5Wft7TqnU+3du+0SsET2axT0oLe2NL4w2mo0BBeb7sYtJO0I0Eib9BOBKj2f4Wvq2xdHermN9oOKV1f3i0e9RY0Tc7lmEE+a0oyM5gAUB2GUTDTWL8RK/zGN7Ytbz/y07EyHAXk52DrEvGxCT5cJLJm0ijJ2kgbrYVyjCY3+sb2fi0TqKX04Wx2hU70idXBB+vS+dZkKRxTTS0B2VXx+xGsE4r5SNQcmMJ8ueeWfqT47F9ZhXo/8+WA==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=c3YLSVpCfu/eYLtBGnAUsz5dmCXs8K8ObO5WIE33efY=;

    b=hEDB3/pW1YO65pZFhAxJIoKZWjKh7n7A07nJdT1gPEXMrp4tZvCT7bw7bNMaK7jHj8NbAHdQeiIOgV2a5fLXqe4Go+akRFBwlo7LEaape2vB98dxIf3otvf/8hSRLZeLhUN1R5LUPMC4/3gXpdEqTkuMIxw7NX4mV+DZZLdUFkgsNZVpUuz5AkIBYixA0xO2XMPO8pHCNRUAgWxd3qDJgbZxxeCmRTjwjOhtWLPTMW6Bdiejd+KZFe1pDeeZa4ImE3VaQLgrPqV031PoEE79Z3WelDGlLzuHqCAXzySXmhDJcXqYTlPIfc2dQ+ryb4v+S+ZoTGAyvhkBQNSwhSUsPw==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    172.233.200.221) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=calmaa.onmicrosoft.com; dmarc=none action=none

    header.from=calmaa.onmicrosoft.com; dkim=none (message not signed); arc=none

    (0)

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 172.233.200.221)

    smtp.mailfrom=calmaa.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=calmaa.onmicrosoft.com;

    Subject: Important for doctor

    In-Reply-To:

    From: Shipping Department

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART.0ueM.ratozrtn"

    Message-ID: <010724376038143039d9ee-c69a3509-5c85-481d-822e-ba65c204e1ba-000000@onmicrosoft.com>

    X-TOI-MSGID: <1535564970.FE3B0F50FD9B7.1703721906508@zboncak.com>

    To: doctor@doctor.nl2k.ab.ca

    MIME-Version: 1.0

    Date: Thu, 28 Dec 2023 01:05:06 +0100

    CC: doctor@doctor.nl2k.ab.ca

    Importance: high

    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: AM4PEPF00025F9C:EE_|DB9PR02MB6972:EE_

    X-MS-Office365-Filtering-Correlation-Id: 269b8fc2-bcda-4c44-439d-08dc073ee828

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    bNhmqqTF7eku1JhGP8n9zUTw5cv5X9HnqbvedsldroUbtWXmy/e3+FYBNk5SBlrvnP2lGszoDQFFtCLr1VrW5jre14xMTo3BpESaCaFQk5/nDDmbKt0+NiNFZ6PVtyQmMlVFQ0znsSLiEGdqirEAjBhDkyw/JGljeLPX1mVUXZFNhd96wZf7kGtlB3OZGw3f1fRw0CG+ZoJvnE1jLwCGCT+8ghOjW1SuFd9zOLaDMVtPStmaQzY6gv1ehsKVR2R415X3dtNnNYqiQa99FaocSYlTGV8Vw3XT0SV5a2daTxiG7PMaRRdgK87PwSugm1R1j5jiE2uQpeI68b1BTHMfSPj2mUJg13Cj23C4+EjI/+Sva8OGA/tR5Tjz1SYaU/DMILx+QzkpgiO8j/m/gVBiJVkXj4A880o9hzSz/BuCBctUcq8LYzKgFqZ/FtTqXr4yrRQNDFgeyYF+7zTaYldxGuLnxRpHSjdcrDkhfP7lZfhujByuyiypyr0jIaRV5gAgBZCMe9YpHBO982WomAW4XNnzoali0YO8qngqtgWCsxG7qAQc5fMyZeTCMdhb/PF1mQgN70t4OIYqXTq2EwK7VhLMXVZs1X8Xcv+QGeyX7ciRhANIy62+XVVKuqU4R22TQeE+8DhbYABzozQieLIl+jFTVimbJWOSXPjN8WK4zKs28OMpaVTddnjRrTHdj7wGvHNy62OjstpU6ZfqRXbpmc0c0O1oSvoiO7ZYXuE1GNoT+V9K5sVK1BdjJdk74XNjj22jpT2K9iP4HWTg6Y914lMMJUGtVb9gxr13p9c7xoc=

    X-Forefront-Antispam-Report:

    CIP:172.233.200.221;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.zboncak.com;PTR:mail.courtshipfamiliar.org;CAT:NONE;SFS:(13230031)(376002)(396003)(346002)(39860400002)(136003)(230922051799003)(64100799003)(7200799017)(61400799012)(1690799017)(451199024)(186009)(82310400011)(40470700004)(36840700001)(46966006)(316002)(42186006)(786003)(66899024)(8676002)(8936002)(36756003)(33964004)(26005)(9686003)(564344004)(478600001)(81166007)(166002)(36860700001)(3480700007)(82740400003)(34070700002)(336012)(83380400001)(41300700001)(47076005)(6916009)(41320700001)(70586007)(70206006)(19625305002)(5660300002)(40480700001)(2906002)(8400799017)(7116003)(4326008)(40460700003)(1406899027);DIR:OUT;SFP:1102;

    X-OriginatorOrg: calmaa.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Dec 2023 00:49:54.2056

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: 269b8fc2-bcda-4c44-439d-08dc073ee828

    X-MS-Exchange-CrossTenant-Id: 495b5f9f-927c-4d40-a76b-41bdd5aef523

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=495b5f9f-927c-4d40-a76b-41bdd5aef523;Ip=[172.233.200.221];Helo=[mail.zboncak.com]

    X-MS-Exchange-CrossTenant-AuthSource:

    AM4PEPF00025F9C.EURPRD83.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR02MB6972

    X-Antivirus: AVG (VPS 231227-4, 12/27/2023), Inbound message

    X-Antivirus-Status: Clean



    --PART.0ueM.ratozrtn

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"











    (7706) Notifications































































    If you no longer wish to receive these emails, you may unsubscribe by

    clicking here.




















    --PART.0ueM.ratozrtn--

    NeverDull Premium Knife Set Customer spam from Microsoft

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Tue, 26 Dec 2023 19:40:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIJpF-00000000Eer-44bq

    for dave@doctor.nl2k.ab.ca;

    Tue, 26 Dec 2023 19:39:17 -0700

    Resent-From: The Doctor

    Resent-Date: Tue, 26 Dec 2023 19:39:17 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-mw2nam10rlnn2078.outbound.protection.outlook.com ([40.95.33.78]:48448 helo=NAM10-MW2-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    id 1rIJma-00000000EX0-4Bf8

    for doctor@doctor.nl2k.ab.ca;

    Tue, 26 Dec 2023 19:36:37 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=SW6as5NMPUib0Qgg+NkZD1lgDa1H/xn9HpfmLO9rjOUowfhC/1FpBt/eNiHTvXY8kq5ajB0+DZYyHDu5gqURxTZ4R9eDps7bv6NG3Jga3COPfELBcOeSOGdskQPSDa3wmZsmUsmka/+aX5UtbFL3z0zHBGu0j5habU7QNg57elN+8y550cXrqluY6iJgkE113HYb15NVVnH3kvq55ruJhLdW8mnmYEWU7y+biYtWwHt61lJPL9pVSWpywnbxoEnjIbcseAhoWcf6ik93CIhZbc9Wg2DbuZXNhqX8ztMNW/UhS39jhR3/4+5JRwgqXoJYP8vJ+MDebxyJMV/BHap2Yw==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=7fjPO7dmi06Vai2jKqtrgVKQEpMg19nzqdn6F55oohk=;

    b=d/c4485doAIEsT0sZrXOfVXHI78gwSGKBzVURSOsEtbhQn92JN3NbboccrGZNxm40Bpy4gkFO/o/vdAQqV+M42GcrMu0UqOBLW1oGZRptFipajjxZYcEVIoPeyNNF/ftcwc98wtg8uVQaBmGCTFPzNScYTn/kmA/UCU7p5gnmmdvIn4LXRh4DlfYG+0GrmKkB2fSvPuou4ZLuhaRAdazCE8iJqyY+MxIeRjnUSLtXVZ9JdDk8Yj0xI+3URr1dw9sWQeqU1MglWkC0Uu9HOAPtRNFHLQSkgTH3bgllgd2BYufoU9J87Xon2HtFuFBE3cCyqA9oSabCIn+/PqRzaBUNg==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

    78.46.149.17) smtp.rcpttodomain=doctor.nl2k.ab.ca smtp.helo=mail.goldner.net;

    dmarc=none action=none header.from=hse.a8v8oi.com; dkim=none (message not

    signed); arc=none (0)

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=6lq7t8c.onmicrosoft.com; s=selector2-6lq7t8c-onmicrosoft-com;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

    bh=7fjPO7dmi06Vai2jKqtrgVKQEpMg19nzqdn6F55oohk=;

    b=tM6pfy9DbS0RRmlfb23vF7s3QzRJSBD4NooyHrAoCzNZLukQEo42l9MEo6kzapKXhMrwhO/4liYk2NpNKN3195iUgq9d69iFf+buO/7+wpF9qe1/yz5O3uULh/oavcatNxj34kn0xcSw3YQwvCgKGHlk7Fy9ssf2b/U2zrLDD4V/lo9aetbu52gV+HJZqgqEpnItPQrKwsRRN/VspjkVH5SabecyVxCxhAuGBCmHn6j4/5mrj6XqCccTp/afmhqVpoX68pvhM9d9IZGShucbtuXXkldwF77wgpina3TnbLi93/KO0VIa6RW//d/k0puQVfXyqGwhfbh9WWBrJB51LQ==

    X-MS-Exchange-Authentication-Results: spf=none (sender IP is 78.46.149.17)

    smtp.helo=mail.goldner.net; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=HsE.a8v8OI.com;

    MIME-Version: 1.0

    Content-Type: text/html; charset="UTF-8"

    X-TOI-MSGID: <1666154052.923D5CD602B6D.1703644408839@goldner.net>

    Date: Wed, 27 Dec 2023 03:33:28 +0100

    From: Welcome

    In-Reply-To:

    Content-Transfer-Encoding: 7bit

    CC: doctor@doctor.nl2k.ab.ca

    Subject: We Have a Surprise For Ninja NeverDull Premium Knife Set Customers

    To: doctor@doctor.nl2k.ab.ca

    Importance: high

    Message-ID:

    <1a273422-d9a0-4047-84a2-db332d2c039d@DM6NAM12FT035.eop-nam12.prod.protection.outlook.com>

    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: DM6NAM12FT035:EE_|CH0PR16MB4499:EE_

    X-MS-Office365-Filtering-Correlation-Id: 68a74e89-055b-4d4a-9506-08dc068458c1

    X-MS-Exchange-SenderADCheck: 2

    X-MS-Exchange-AntiSpam-Relay: 1

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    AmF69s5MWkuA4LdzZQNQ0Lx7zsPcJhdSsimt/bKE1G8kVnLCSEsM8eOKFUscdmuYv4pIic9E7Im4FAVzyuQMOYu7pGqFvcNKz9Z55ZugCJ4ZmRxKZoEqUx2Zy6mwTiengB5gAX9PbhnaRqdox+Xv9fLdtMNfnW4/q7A+MpcgITR2B8DaKWn44KXRzRzcnEV/ALZPu9NQioqBvDO8RSNLWqwalMpZXX46yvHsxStliwejcznBjnLwxsYrwU8TF4QZ9a7Ry972f0rrWXmtNW8B42cdSRvvLaMFcjehi2HbAIYRTxLEj7q3ju5DSaBorN/mHk9nma4YVLoPxYILtPBztYYzSaUUc9YNFqCJtSX0DlRPVtd4qiDStLMrWtH2Cz6HW/cmwFHFqcr1LKB7k1dgXWMCCL0mzckY5qywnWb7sn+P9fql5B7EPQ03n+/cQxFlSs71kyIVRhVfOORrbuw4qQ==

    X-Forefront-Antispam-Report:

    CIP:78.46.149.17;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.goldner.net;PTR:static.17.149.46.78.clients.your-server.de;CAT:NONE;SFS:(13230031)(39860400002)(346002)(396003)(136003)(376002)(230922051799003)(48200799006)(1690799017)(7200799017)(82310400011)(64100799003)(451199024)(61400799012)(46966006)(40480700001)(31686004)(2906002)(6916009)(70206006)(70586007)(5660300002)(19625305002)(67280400001)(8400799017)(4326008)(8676002)(78352004)(8936002)(316002)(786003)(41300700001)(47076005)(42186006)(41320700001)(558084003)(9686003)(508600001)(26005)(31696002)(336012)(42882007)(35950700001)(166002)(82740400003)(81166007);DIR:OUT;SFP:1022;

    X-OriginatorOrg: 6lq7t8c.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Dec 2023 02:34:26.8986

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: 68a74e89-055b-4d4a-9506-08dc068458c1

    X-MS-Exchange-CrossTenant-Id: 48880dbd-c027-4bf6-ac97-9a6ff80829c7

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=48880dbd-c027-4bf6-ac97-9a6ff80829c7;Ip=[78.46.149.17];Helo=[mail.goldner.net]

    X-MS-Exchange-CrossTenant-AuthSource:

    DM6NAM12FT035.eop-nam12.prod.protection.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR16MB4499

    X-Spam_score: 8.3

    X-Spam_score_int: 83

    X-Spam_bar: ++++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: (1) Notifications



    Content analysis details: (8.3 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

    [URI: potredrt.blob.core.windows.net]

    0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

    [SPF failed: Please see http://www.openspf.org/Why?s=helo;id=NAM10-MW2-obe.outbound.protection.outlook.com;ip=40.95.33.78;r=doctor.nl2k.ab.ca]

    0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

    0.0 ARC_SIGNED Message has a ARC signature

    0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

    0.0 ARC_VALID Message has a valid ARC signature

    0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

    0.0 HTML_MESSAGE BODY: HTML included in message

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

    2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

    -0.0 T_SCC_BODY_TEXT_LINE No description available.

    0.3 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for

    an image

    0.0 T_REMOTE_IMAGE Message contains an external image

    Subject: {SPAM?} We Have a Surprise For Ninja NeverDull Premium Knife Set Customers









    (1) Notifications
























    I810L0LD383I2.16KwhoissourceRank7.12MPIN0Summary reportDiagnosisDensity00n/a

    Fedex Phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Tue, 26 Dec 2023 19:39:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIJoY-00000000Ed9-2CQK

    for dave@doctor.nl2k.ab.ca;

    Tue, 26 Dec 2023 19:38:34 -0700

    Resent-From: The Doctor

    Resent-Date: Tue, 26 Dec 2023 19:38:34 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-eastusazon11010001.outbound.protection.outlook.com ([52.101.51.1]:56178 helo=BL0PR02CU006.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIIjR-00000000Cbo-3UDS

    for doctor@doctor.nl2k.ab.ca;

    Tue, 26 Dec 2023 18:29:18 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=RNBrh+UEs33O4CxuFLxOnaZ7Gfsh1KYH+dJdZTJYrSxnm6LmioGlayWFPlVS2vJfDNHQoHjvPVktNKegffncQqJCiF/ezpk7yZ9l+rwsQjqkLbc6BjNPcnhLMlc56TXYtLlmDA3dbnjY6wCAYpMX+dt44UbbKNYq2uGcKTokc6KF17d8HYvq1xLN+JeZbRLdH3d3ZOkoBkBL/pNbxWOK1GGwySlWGWHRfpnnaYj9KVb+3IVfP6ghF/K0QnnDwdFnbe0xIqbas1vVLqXIKwNvLfEybhOwUvy34wW/SdVi7FttXOomV82Dn3YS8uMnuxLXMc/QB+NdLLl0vodwHWCAIA==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=13NbYPirSeK9jJYiofiqYH2YV5VljrOYIlCzRY7u+I0=;

    b=BzknQKTa2JTRzXU7TGSmNeyEXe2wKUweI4nB4QAlE5YsgMvTe44y4Xyw4xlz04GcCE+I+gjsbIAxNsUwEoAaBv3OUQh81uDR/uTiEhdG9M8RYo95ZOakkKlcqEZXRtJwwtWOE0KK8SgE+sY4bZYu/NHxRfSZqWbVcWgIbJ5qjKwmkFxxzWC0/Qpg6cWdUHtjPzTIjgzlHnvSZFOxOif4vy/duCW7H5Z/SL5ors/mUbHfXAP6GEWfYZqjCRwSiddInSuYtv4q2EBzLc+qNOVve41+Zfw61HjFj0vt14zB+bH00AHC2oqx4aV72u2uDk48NiQeE0hotHOwYEbm4cFyeg==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    65.108.80.57) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=vknhsutl.onmicrosoft.com; dmarc=none action=none

    header.from=vknhsutl.onmicrosoft.com; dkim=none (message not signed);

    arc=none (0)

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=vknhsutl.onmicrosoft.com; s=selector1-vknhsutl-onmicrosoft-com;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

    bh=13NbYPirSeK9jJYiofiqYH2YV5VljrOYIlCzRY7u+I0=;

    b=h1mYw0HsJ0B34Cqrtb282VFyOwDylfNBve8CoUK0nPUVy5bN19qdzIYUvwXf7FMAm81AuMCPm+Kli/NVwRtIB2QOR0pZKadxw9immj90Y8lSvO1IYCPUrFyewErFgViGsAReu8sOuiHtKrdqDUXpNlr3pbOvEjejxawZmGObEYDI8eqav1ASoEZGp3kF4Tydl0lrnjolPnC33bXZRgCox2QGM5j6tGL+wFeE4kJIj2CjdcLQHr4Zvppm1w6KoWOzB92qC75Oa1iCeoj4FxcxeLKgQmonNW1HxyQTjcsUHpZU8XGfyGuSD7sqeVyd8XCsn0a+kfy8SVsWJM0rjmhRZQ==

    Received: from SA1P222CA0095.NAMP222.PROD.OUTLOOK.COM (2603:10b6:806:35e::26)

    by PH0PR05MB8059.namprd05.prod.outlook.com (2603:10b6:510:77::17) with

    Microsoft SMTP Server (version=TLS1_2,

    cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7113.27; Wed, 27 Dec

    2023 01:27:08 +0000

    Received: from SA2PEPF000015C9.namprd03.prod.outlook.com

    (2603:10b6:806:35e:cafe::e) by SA1P222CA0095.outlook.office365.com

    (2603:10b6:806:35e::26) with Microsoft SMTP Server (version=TLS1_2,

    cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7113.27 via Frontend

    Transport; Wed, 27 Dec 2023 01:27:07 +0000

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 65.108.80.57)

    smtp.mailfrom=vknhsutl.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=vknhsutl.onmicrosoft.com;

    Received: from mail.keebler.com (65.108.80.57) by

    SA2PEPF000015C9.mail.protection.outlook.com (10.167.241.199) with Microsoft

    SMTP Server id 15.20.7135.14 via Frontend Transport; Wed, 27 Dec 2023

    01:27:07 +0000

    To: doctor@doctor.nl2k.ab.ca

    MIME-Version: 1.0

    Subject: Update: Your Shipment is Moving Towards You

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART.2044.zlwhcskl.83289592"

    Date: Wed, 27 Dec 2023 02:08:37 +0100

    From: Fedex Customer-Support

    X_Priority: 1

    Message-ID:

    <82c4403d-3acb-43a0-aa3b-9dc674722426@SA2PEPF000015C9.namprd03.prod.outlook.com>

    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: SA2PEPF000015C9:EE_|PH0PR05MB8059:EE_

    X-MS-Office365-Filtering-Correlation-Id: a1a9df75-58f4-44fc-4a46-08dc067af0ce

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    WHG0RFd3M3+zzoZLhQhl2ap4Ez9amhDNxX57yUfPjKxZP71Rm3eaEgAt/58A15Ae1dt7WLjZAAhkJV4T0eyLjMcU9RSW1bJRIosiBcfBmO/Q+YQedi7NZ9ye1hH3kiqrutyD19K2ovQWRi5GVjsJ1KAhUqxWSjDyVhxFGo8fdjzaCBeALaU6vI+msN8Hme8ryahUhZtkglwNwBauqzGN8TyGFZuvbV+cmp288toZj5twcJnwVIcdqYpxHe2EP3G2AZ/4UoLxEAbaFdKbDfgL1BnXHYSrXukkASQcro1edlo6mZQRO24Yv7Q1lqLSxBifxaXdSsq+MZdTa1RA7SLJnwg7nvvaS6xJ2Ukk7oIa2h7g2xyZx2hn4aqBbGBEJ1Ka8k/KemN05l3pOnDqmcUD/1j5B10+fUUpQKQGNzXFI8eqh1ybfo/TS5FBeQmZEPev7j1R75xC+OHeRpk81fLfe6sicDfS3GH22tHD/2wPr5ReMx9LjdAd1vMIVip3njQk7x19VZjJgAOjLuUfVuNmhFsIOhYqW8HU2DF7uNeQ5I5edEsrHMp9VAcgzVD/1eGNQYOtmws6xxCkF/i+joDkBTSJYgrv0E0SKz/w2IZGeZSwpSuwQXhEVUan1N4nt6fmgjnLzXy4Wk2ointw6RbB9WxtgLPmx8VUbBapegTDN9EQIMpW4JT5CVPT6SakmopO

    X-Forefront-Antispam-Report:

    CIP:65.108.80.57;CTRY:FI;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.keebler.com;PTR:static.57.80.108.65.clients.your-server.de;CAT:NONE;SFS:(13230031)(346002)(396003)(376002)(39860400002)(136003)(230922051799003)(186009)(82310400011)(64100799003)(1690799017)(1800799012)(7200799017)(451199024)(46966006)(40470700004)(36840700001)(40480700001)(2906002)(6916009)(70206006)(70586007)(5660300002)(19625305002)(40460700003)(8400799017)(8676002)(8936002)(316002)(36736006)(41300700001)(41320700001)(786003)(9316004)(47076005)(10290500003)(9686003)(564344004)(478600001)(118246002)(6486002)(6666004)(33964004)(6512007)(6506007)(31696002)(26005)(956004)(34070700002)(336012)(36860700001)(356005)(166002)(82740400003)(81166007)(81512002)(83022004);DIR:OUT;SFP:1101;

    X-OriginatorOrg: vknhsutl.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Dec 2023 01:27:07.2314

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: a1a9df75-58f4-44fc-4a46-08dc067af0ce

    X-MS-Exchange-CrossTenant-Id: f8470ee8-0a4e-4a07-a137-8af55b3f5fc4

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f8470ee8-0a4e-4a07-a137-8af55b3f5fc4;Ip=[65.108.80.57];Helo=[mail.keebler.com]

    X-MS-Exchange-CrossTenant-AuthSource:

    SA2PEPF000015C9.namprd03.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR05MB8059

    X-Spam_score: 9.9

    X-Spam_score_int: 99

    X-Spam_bar: +++++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview:



    Content analysis details: (9.9 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

    Subject: text

    1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

    [URI: bidatinar.blob.core.windows.net]

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [52.101.51.1 listed in list.dnswl.org]

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [52.101.51.1 listed in wl.mailspike.net]

    -0.0 SPF_HELO_PASS SPF: HELO matches SPF record

    -0.0 SPF_PASS SPF: sender matches SPF record

    0.0 ARC_SIGNED Message has a ARC signature

    0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

    0.0 ARC_VALID Message has a valid ARC signature

    0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

    0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

    [bounces-fedex(at)vknhsutl.onmicrosoft.com]

    0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

    0.0 HTML_MESSAGE BODY: HTML included in message

    1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    1.0 MIXED_IMG_CASE Has img tag in mixed case

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    1.0 MIXED_AREA_CASE Has area tag in mixed case

    0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

    0.0 T_REMOTE_IMAGE Message contains an external image

    Subject: {SPAM?} Update: Your Shipment is Moving Towards You



    --PART.2044.zlwhcskl.83289592

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"







































    --PART.2044.zlwhcskl.83289592--

    I810L0LD383I2.16KwhoissourceRank7.12MPIN0Summary reportDiagnosisDensity00n/a