Harbor Freight phish from Micosoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 31 Dec 2023 04:23:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1rJttf-000000009AM-2PuY

for dave@doctor.nl2k.ab.ca;

Sun, 31 Dec 2023 04:22:23 -0700

Resent-From: The Doctor

Resent-Date: Sun, 31 Dec 2023 04:22:23 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm6nam12hn2206.outbound.protection.outlook.com ([52.100.166.206]:44129 helo=NAM12-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97 (FreeBSD))

id 1rJkVS-00000000LGU-2bBB

for doctor@doctor.nl2k.ab.ca;

Sat, 30 Dec 2023 18:20:50 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=m2sVh3Z9GjFLYSVxxqC+BlANlEoWJExuOaRe+Y6Cwxgjp5hqEWxcJUc2qsCLeu7M9naXvn5jjcHkpqOpv24Avd2W2rDt/HZgAk28wOO7iFXChsVG/KU16yCVVkH2IgovBzNGwo5isqRryvXOCGmc5zd2CPwtp+4I3jCSyzOTwjqS6CS9qgUYBqbGEL0qZ81/vdnZgC2Hz40jg0WnZoqQxzPFIZXa/eBo4K2q5H/HdX1xK1jf5vnMXts+1qgQRKxJ+wITj+9h9nyCXz9kxhATHmYGXRDnB3+33KMgFI2l9QomHACXTm976NCYgyi2YV/AwPiF1DgfJEryHERQ8d3//g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=yAxdiMhzSkivXmPMWFqC3Hq69ovLWyWd7r1EYzW2wJM=;

b=iZ85OuA8ts0r8/ASgZOMr60qPLgs918J9iy/B2dXuu0qtdw522GAblr2eZipN3t3n7qQW5+dOAEVr9tS3m1SCcaV38D7cZ/Z9YQrMptPZqu9iZB8ABvzKXc84VPndN64EqG9G1C/HQGzakeGxIfUrSK2EcI9iIL9H9GYIlTDyvmA/PNYx6Al7w63hCZxg9Ez5/pnt0L95dEGFofcxcXxLRyG7aBvg6exDcQe+knQVoqOCxtTbzDXWlae8nbTWaRNBpHNEMBNXu/Nx1o7Fhk0fJZ3VZ1vUfDOQ7U/kXWtHCGpMlf5X9nkPiC8tdtIvDg2KO5NajBCtbNzCY1kjNvGng==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

192.155.93.204) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.helo=mail.thompson.com; dmarc=none action=none

header.from=malcis.onmicrosoft.com; dkim=none (message not signed); arc=none

(0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=malcis.onmicrosoft.com; s=selector1-malcis-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=yAxdiMhzSkivXmPMWFqC3Hq69ovLWyWd7r1EYzW2wJM=;

b=Z1uxfb8zqZnSrRQ+es44vck4rU1imuyf6/gNyvnv9sK4X9JDciFbJE05ITpPXC4SlJ0/FcWyMqfoEp7NqYXFkWOsfKiI+XH+6/m23v11qPV+d1+QdOXDr7CjsdlXA8IdPh/B4G98tdc0GeZimq8LlbkRom8l9/yYMl8iG9ogPX0duC7pxt2cksNitZZ+AW/gP6h5YHOf0d4viUj3yF6SSXXV5CUMA5fQRgmVvI9SEKl33DyJzcS9wnVmmmdyqyrTCeF5fESD43YINGFReybX+kOl8VugpypTRE1hQmV3LGrYPUsNU9yAwtFVWXYUt2Ke6WNY9Q0+ATj7p6zpWg5XyQ==

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 192.155.93.204)

smtp.helo=mail.thompson.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=malcis.onmicrosoft.com;

Subject: =?UTF-8?B?Q2VsZWJyYXRpbmcgSGFyYm9yIEZyZWlnaHQgYW5uaXZlcnNhcnkgd2l0aCBhbiBQaXR0c2J1cmdoIE1lY2hhbmljIFRvb2wgU2V0?=

MIME-Version: 1.0

To: doctor@doctor.nl2k.ab.ca

Importance: high

X-TOI-MSGID: <1919043148.2A9A964613146.1703985389649@thompson.com>

Date: Sun, 31 Dec 2023 02:16:29 +0100

Content-Type: text/html; charset="UTF-8"

From: =?UTF-8?B?SGFyYm9yIEZyZWlnaHQ=?=

Content-Transfer-Encoding: 7bit

CC: doctor@doctor.nl2k.ab.ca

In-Reply-To: <1foXLxI96ky2a3hP2rwASVZa6A1WRd@ZcqsLyUBeP.malcis.onmicrosoft.com>

Message-ID:

<589c6609-0dad-4f4b-b20d-f2b3cebed5df@BN8NAM12FT082.eop-nam12.prod.protection.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BN8NAM12FT082:EE_|BY5PR22MB1921:EE_

X-MS-Office365-Filtering-Correlation-Id: fddcf1ed-44ce-4ed4-b865-08dc099e80d6

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

+D+HdbXzUZDkC8II8e5ZKSiiHKgmmGejkSow92ER/boA38CzEWlxezEVRsVkMcPHRE3aal0JeFiZvwiCy3BdD3ItjmkkDPEZM53e8AiWM+pmXaTMfw1TITqKtB8jYu3hKJkyxse9rPzYMr8vbF5KWzaw2NMJN+MgpkqzFTwpbK8/MOE+Ehwmn11/HlPHxp5NrPereyOUdP2MCXedbjvwqg09exbgnm0ysfvS06mkrQ/eBTe4V4qOassfnyuV1dNVUZ9k8dxL1e3Gibn9QmRgE6cNUbvDXCLZvzGslTeFph9Ri7J4B5ZjRlFkLHWKfKVFDESXIUr2yHlpLtuDSjbp8AyDV7CR8VQxTDKBdVDDP+Yn7Fb7bS6FtcsR+E4lCmpFqdd2aN2K7UYXwZr7az5B/sJ9PVRv8s6uobOCh2Qo7YVj88mWdvvWiQA/s1oD0QVaHANdZOwp3ZwokS7KNxirv9rY0RQXJ5+9YhoDNmY3C2wbZ2r1AbxH3D10WjUrMZsE

X-Forefront-Antispam-Report:

CIP:192.155.93.204;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.thompson.com;PTR:192-155-93-204.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(39850400004)(396003)(346002)(376002)(136003)(230922051799003)(7200799017)(1690799017)(451199024)(64100799003)(82310400011)(61400799012)(46966006)(336012)(42882007)(26005)(9686003)(35950700001)(17440700003)(34020700004)(47076005)(5660300002)(19625305002)(4326008)(67280400001)(41300700001)(2906002)(498600001)(316002)(78352004)(786003)(8676002)(8936002)(70586007)(70206006)(6916009)(42186006)(31696002)(41320700001)(558084003)(81166007)(166002)(82740400003)(40480700001)(31686004)(8400799017);DIR:OUT;SFP:1501;

X-OriginatorOrg: malcis.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Dec 2023 01:19:14.5649

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: fddcf1ed-44ce-4ed4-b865-08dc099e80d6

X-MS-Exchange-CrossTenant-Id: c7dc7f4c-7a03-4c13-85cd-0a4d483a5ff1

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=c7dc7f4c-7a03-4c13-85cd-0a4d483a5ff1;Ip=[192.155.93.204];Helo=[mail.thompson.com]

X-MS-Exchange-CrossTenant-AuthSource:

BN8NAM12FT082.eop-nam12.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR22MB1921

X-Antivirus: AVG (VPS 231231-0, 12/30/2023), Inbound message

X-Antivirus-Status: Clean









(1) Notifications
























Amazon Phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Dec 2023 05:46:03 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1rJYj2-00000000AMx-1QRC

for dave@doctor.nl2k.ab.ca;

Sat, 30 Dec 2023 05:46:00 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Dec 2023 05:46:00 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-db3eur04hn2204.outbound.protection.outlook.com ([52.100.17.204]:27268 helo=EUR04-DB3-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97 (FreeBSD))

(envelope-from )

id 1rJXmA-000000002Os-3TIE

for root@nk.ca;

Sat, 30 Dec 2023 04:45:16 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=AchweslugrgfhUXljm/JnkwbxucpsZd3IiVMLyTHihJ4NMPZCFKtGKU8T+O4J5q28ws9Cef/eEseD7XEBUDzycRCC+ttLxsI1B1Zlvjqzm+BUi8rO3MBPBTjKZdRj7PlAccsRCEn4ulxCKyqr32nr+4F9FJxXKA5vwg+2hzQd3TqGYXNBqDAtQtIIP7ocaA6+PDTRRZxWyF27ag9Xal7ymS8rFp5EYo5Ed49IgedL9g0c3lzzEFdgHTOw3q3JZf80gE/cKD4IP79FiYZtKYbdPFB3DLdwouQIcJp91TxxpJNfpfNjDUjXIy/bEan7ONG9NFXU50KlaLHASnCU5g6Bg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=5mF2a82juWo/Nc67JOG1Lzh0y1ZGRSrJyhXS4I70Nr0=;

b=bt7l8NFQE9g/PlZITupnB4vJ5aOeOusQy3Zu5yR6uDdKXB3in/PoqvZ0G6WJ8fi6LHIHlQWcdPzNNBKCqNBa6kVnXtNnWD7BRmVt66YiiuUDwpOOEdVn3LtLDPI0AmsSboQixCUm3oER16IMS6RCFzO4ugQwnQLG183PEVtkxlrCDlktMYhbg/x22U1u3PcI6XvLlgTt+cpEZP6lU0nCjgWWHR32iLEeLCKyJ/AqHGcmJrfuRsVqhjMlmCPrdioF0n3yzwkRVJlLRBHO1xqD1mE2RZMyrnW8romltTA4scXLn1ZlRFr+6SywHhvsAbB5aZrpqn+894rV6wGDE5gOCw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=abonoorganicoaboplant.com; dmarc=pass action=none

header.from=abonoorganicoaboplant.com; dkim=pass

header.d=abonoorganicoaboplant.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=psp4radomsko.onmicrosoft.com; s=selector1-psp4radomsko-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=5mF2a82juWo/Nc67JOG1Lzh0y1ZGRSrJyhXS4I70Nr0=;

b=iH2eUkCqqkjeOfUS/xEo7TrrTXiVS0WBSTold/WT1UwVPb5Ywo7h9E6AtCQ3/a5EaEEO3BBr/u2jmnyDU5KQAsEmFYDjXltO6VGHcmEQT8mK0UZggQoIkY4sUcVgohswAZlZtkCxtzWIdsjGjzrwOe8iXsyfj+sYBqNP3zjucGx76X6gwENkZLAd8kVAsGOyBNClWRhmVMgIXdvxfPNTKVnbatGiKEQc1Vy0e4WXRFfkugVAZgDJhF7JLEiwh7+0d70Ixo8nkrj3wHRapnzct5bPPXOQhMdC/ZyGaLe4A92Ito100GFVnmfb6A8w4QFMW2pYwvuxe6GQ+5lAGLxw3w==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=abonoorganicoaboplant.com;

Received: from AM0PR08MB5140.eurprd08.prod.outlook.com (2603:10a6:208:162::17)

by DB9PR08MB7747.eurprd08.prod.outlook.com (2603:10a6:10:396::19) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7135.22; Sat, 30 Dec

2023 11:43:39 +0000

Received: from AM0PR08MB5140.eurprd08.prod.outlook.com

([fe80::1930:63ed:4432:b007]) by AM0PR08MB5140.eurprd08.prod.outlook.com

([fe80::1930:63ed:4432:b007%7]) with mapi id 15.20.7135.022; Sat, 30 Dec 2023

11:43:39 +0000

Date: Sat, 30 Dec 2023 07:43:35 -0400

To: root@nk.ca

From: Support Lead

Subject: We locked your account for security reason - Sat, December 30, 2023 7:43 AM

Message-ID:

X-Mailer: WebService/1.1.18291 YMailNorrin Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

X-ClientProxiedBy: SJ0P220CA0017.NAMP220.PROD.OUTLOOK.COM

(2603:10b6:a03:41b::27) To AM0PR08MB5140.eurprd08.prod.outlook.com

(2603:10a6:208:162::17)

Importance: high

X-Priority: 1

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: AM0PR08MB5140:EE_|DB9PR08MB7747:EE_

X-MS-Office365-Filtering-Correlation-Id: 2c40b90d-2414-4fc3-3b1d-08dc092c90ab

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?ZFF2aTkzRkdpdjg3R29WcGVnS2hvVE92MUR0dEhXSjlXRU83VkNibVJsNHJX?=

=?utf-8?B?S0tHUkh1Sm9veHBTL010VmlJSS9wQUd0QVFqMUM5TDB6N1lDN2NYYXE4TU9I?=

=?utf-8?B?RnpVV2RtZldnVkZGYkFFVHB1cXZ0bjVmYVhneDVjaHZxZ1hJWkloNjl2MnUx?=

=?utf-8?B?cFR6S3g2VFBlRnFpZFhheWtSbW84M0NxREY3ck54bjNkbGFYQWZSVGNZbGNv?=

=?utf-8?B?V01lc0RQMjFpSE9yZ2l4Vk0wTThZYkU4b1R5RzZ2Q3pRcS9QMHZkNmoxMEll?=

=?utf-8?B?WUt2YTZmNkpLeWVNMGJzOHQvbkxuMS9MeEtPcGFIOWJHWEtja0RaTk9WMmZ0?=

=?utf-8?B?Um9ORk9hd2dLYlVtbUFBTVBjb2lpNG5xRXc5em52bzBQS0dBeHZRYUFwOXIw?=

=?utf-8?B?KzE3amJGdm51VmpwU3RpVTA2ZEwrL21UbldXdjFiaTZOYXhiY3RvcFpSUUtB?=

=?utf-8?B?WnJZN2lpMnJYZ2lEU2orNmtraEpkQWNLd3FxYjVwWjFGSUo4RDRDSG1GVk9R?=

=?utf-8?B?R0VtSlYwVHBsQ2MzZk1BdmZGd2tZdnBxdWMyNmordzVLVGk5cXZ1M1dtZEZx?=

=?utf-8?B?akYySHllb1piM1BNUTQwQTlQbTNnN1N6T1VwSTBKVnVGSkhCeTM4STM4TzdU?=

=?utf-8?B?RUtJZEhPb25ZeUVWNjFXbnltRTU1czlxb2tXMnNwVGMwaDF0WEpJUC95OVFw?=

=?utf-8?B?RENoRUo5a1E3dDlsU2xFTzZuNFNUV2phTE8xK1IyU2lCbTBMbzhOS3I3ZWpz?=

=?utf-8?B?cmt1b1pPTm01bGJiendab2Q4dTMyeVhYQUF5YmdKcm5WZjNQYmIwdjBZQUd5?=

=?utf-8?B?VVErS2dmUUovdXA0Mld1UElLMytMVTMzbnpRMkxhZWhiQi9rOU80TVFHMjlP?=

=?utf-8?B?UUxlWnNrMENWMXUxYm96aXZESUxzY3RaM2ZScElQSkQ0QnZVQnE5MGNBY1lB?=

=?utf-8?B?UWo3L1ZTZWpVbFdpaFJLRHFJeUkvaDYxU0lQNjBBbm9mZ1JYTjZocjNFemg0?=

=?utf-8?B?Ukp6SlBWV3I3M2JNd2tqelhWcUJSMkNDWWZ2dlNNMmRWbWc2SW8zak9xQVEy?=

=?utf-8?B?OU5TdmFGcElyZkdHajNCR0xReFFMeE5tUG9SK3FjcU91V1JVQi9pRFVUYTdB?=

=?utf-8?B?T1lsKzNpN2xJUlpkY3BkY1NVeDBUbzJPcG5ReWRlenZwUU1jZmEydThWS29u?=

=?utf-8?B?MnVYajNITEhsWXgrU2s5c0lIcGN2Tm1JY3N0czVNSmNNTUxpQWN3a0hkallG?=

=?utf-8?B?YUFrZm9qcmpMbnJlVDA5OFJCNi9reGEzUGp6NUQ1WDZlSUlCSWlkUXF3ajYy?=

=?utf-8?B?WktTVzFUcUVkTGRGQktXODBnV0NtTFZuQUVuamdzcnQxd2Rlc2VTQXdMSHpo?=

=?utf-8?B?b2taT0FtL25OVnlyZzBRLy8zRDRVZStuMHBWODNzTWpWK0NxWTVIdzVaeHFP?=

=?utf-8?B?RVh0U3Y3clBZOTRSTTNtdUI5eG5PYzRlT3gxT2plQVJOdUd1WkZDclFHQm0y?=

=?utf-8?B?ZjkwMkFCdWQyVjVFOUU4K1FXcEJLTjFJenF0Vld1N2lRRUEzVlFMK0dSWEZD?=

=?utf-8?B?MEJJUXZFSG1EL01IS3F1REVlK2RyWVl1TytOV0Y4dEJlS1lKMTBycTB6enFk?=

=?utf-8?B?bnh4am1IM2VpODAwVnlnNUExZys3VSs3aW1XVDJITHhsYVJlK0Q4aHdDODZT?=

=?utf-8?B?aW1HL2ozK2RZMVdZNzRoNFd0YlBLZk1lOTdmK3R1Y1p0T1FkaTNhcGpEVFRr?=

=?utf-8?B?USs3V0RCS01hZlFvMm1kS2ZCWnRyODRoeTAwTnhoRUZHN3NoZG9lc1doZXRZ?=

=?utf-8?B?YjhPTWpRVHphRTdHeE9ZbDZBQk5MamxNMUNuWjVBUkZkcmhlN1JBWEdzd2tK?=

=?utf-8?Q?LPxnUteiJY0Ki?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:AM0PR08MB5140.eurprd08.prod.outlook.com;PTR:;CAT:OSPM;SFS:(13230031)(346002)(136003)(396003)(366004)(376002)(39860400002)(230922051799003)(64100799003)(1690799017)(451199024)(186009)(1800799012)(66899024)(41320700001)(8936002)(8676002)(15650500001)(5660300002)(4744005)(6486002)(316002)(786003)(66946007)(6916009)(66476007)(66556008)(38350700005)(5009030100002)(86362001)(2906002)(38100700002)(166002)(55236004)(26005)(9686003)(6512007)(6666004)(508600001)(6506007)(52116002)(83380400001)(41300700001)(61276011)(131040200001);DIR:OUT;SFP:1501;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?YzFLaE9zTGRmLzNmZFBtNFErZEZGSFBOWGo5Lytqam9Yejd5K0hBY2ZCSDlP?=

=?utf-8?B?cDRBSTg3eTA3QkpZc3FwWU53aUtoSjhVWFBBNUJhVThmLytLRHZQUkRxT3NO?=

=?utf-8?B?Zm5BRWVRQzdIOWhIemRaT1VpL0FXUlQ0TGQxcktnOFdXTldrbTQ5S0w0L0Fp?=

=?utf-8?B?L2cyckRveG1rVDAwNmxJKzZhYW82NnhSYy9XOVI1Z1lsNW1NYll6eFZPRjg4?=

=?utf-8?B?QlRBSkFNR2dyMXJGeWpYNVZ4ZS9XcUNyQ0VKM0VzUHRWTkF2dm9ZM2NybnJN?=

=?utf-8?B?dzlSb1ZWdWR6bHlRRWJ2K0hiaHA4QzRQT1gvdGtqencrVFJIQlpIMThGMlVk?=

=?utf-8?B?WmFSL2ZoMEo0dXkycFRFQVBKZ1FvekJ3WXRrNkJwVTV3ODVxbno5RXlDak1O?=

=?utf-8?B?eEFWSVo2Z3dpSXl0Q1BEaEZPejhRbjMwQ2YrZEtzcGh5KzRiS0hVTG9NbCtn?=

=?utf-8?B?aVFoRmF3dERqR3VsNSs5aUpHL1FzTHpnWWFwM3ZvZkd5WmtZRGFJcThEZFcx?=

=?utf-8?B?aDh6bDhIVkpqS3kvL041REVUem83aE5kWVUvRTJ5cVZ5UmlxUXZPUDdsNnlh?=

=?utf-8?B?RVh4KzZ1bWJLV0FNYlhuaW5iQk5UTWdhZit3Qmg3ZmwyOStPRVQ0V1RTZ2pX?=

=?utf-8?B?OHFrRHRVSkxqaWpmVDRZZk9PVldUU3gwNkZybUx3MG56d0xyUk9hamxtRDRS?=

=?utf-8?B?TXpzeTBpOHJka0ZtUUY4MXlCeXRtenh0ZU9MNU94SGpyaDJjZ2hYdmxoSGxT?=

=?utf-8?B?OFRNVk1MTVdFNUJGQW5FZU11c290M2xCcy94ZEFzSnp4dVpybFVDS1B5WDI2?=

=?utf-8?B?bFpLazY1VG1ZOGFPNE44eUl2MG53eXB2azc5c0dDU2ZCaXllbUR3WW9pQTdy?=

=?utf-8?B?M0xFWVZlYk80UlppL0o4VnhBVW1WRFVSWW9nYWZmYlNHOWk3WGVnTVgzQ0ly?=

=?utf-8?B?QkpnRWNWV3RsbkdJOHZMRWNnVVRqSFBvdVlKTW1KOGx6N2pKTDllQXZoV1Nu?=

=?utf-8?B?TDZYUVpKSEFPcm84ajNVOVpUSFljWjFjeWV1aE8xU3I0YkZNVndyVGdLdThh?=

=?utf-8?B?OW0vTWJUbzYzQnlyZUtnQ1Q2dzNYZ3NhK3cyOEl2RGdpSmtyQy9KRU9LSTZH?=

=?utf-8?B?bkN0enMySG9kbUpYbTZVait6RC9ZWjF1Y0VLK0V5ai9KRnlraFBtOVcvYU1F?=

=?utf-8?B?SGFhUHBJK1k3Vkw2Nk96WERid0dRVGxlMFdBa29lSG9UY2x5RUZaZHM1Rysz?=

=?utf-8?B?RkhZd055S1ZtV28zM2VFbjdDdFh0K0FpSWYrazNuK3UvdGFETm5JSklDQnpW?=

=?utf-8?B?UFE5dCtERHgrOVpWVnVFWThRN2czNVBaWldnWEQvc3cxSjBxY0FQbDdvTlJl?=

=?utf-8?B?NTgxRFR0WU9FbENhRFZaVTdyeXhGdVp1QWFLN2tUUHBoSHloUUV1TGhjT3Bs?=

=?utf-8?B?Rmd4QUhLbzRVRzZDWDZTRzZtN29iOG1sSXdjci84SVpzZjlkaHZsVnhXc3lF?=

=?utf-8?B?RHJ0dFFENVNwOGVBQjVVWGN6cjEyd0wyRklWbzZNREUwUnlBc0k1ZDhTWXo1?=

=?utf-8?B?bFhPb2FYN2FyQ3RUb2p3dFZMNjJqZjhzK0dyQlI4UExIRzRXcU5kR2ZLUUpH?=

=?utf-8?B?ZDV3cDNZKzJ6ZklXU1FqbU5iZ29FWU55bGJLdWtnK1NROVR2QStGcERiOXBj?=

=?utf-8?B?Zkczdjl0RmhZQnlxd3VnTzdKZlJCQVJxZU9YT05oejJjQnpvMGRwdEVqRUJy?=

=?utf-8?B?NjQ5OFBKZnFjNjdsMkQxK0IwODN6eE4rUCswWkFmTm43L3JlcVZoSkNRU2tI?=

=?utf-8?B?VnZ4VHZoZGVwL3NkcEkxdE9TV1E5NmxGcU1zTzV4WjR6M1FDR09IRDdQbTNP?=

=?utf-8?B?QmQ2VnRwNWUrck1uYTBnYW1kd29SWlRGTW1WbHRxWkJHNTIyODFsSEl4ajdZ?=

=?utf-8?B?RjBaZUhNOVcreFBvY2RPc3phZGtJNlpWWWtvUEQ2Z3FSdWhnMk1WdmplUkp6?=

=?utf-8?B?MlUyUkxFL05pSmEzR0s1YmpDLzY2d2sya1JzQUxIOUtBMEFCTUMrZ3pmWGxC?=

=?utf-8?B?UXFIbE1xL2F1ZHVrcFRsMFVVMVZCNVFMV29DMjArZW95TWJYT3IwZElJQXJI?=

=?utf-8?B?bFdWVGJXN1JDamVpYzlUWmROVWVhTExrSEtiYi9TaDM4MHdWV1p3QURseWto?=

=?utf-8?B?OSs3bnVyZlQwWi9uRE1udk8yN1NqVVp5M0traVZiZ3BkZ0hTWGpaeGpNZE5W?=

=?utf-8?B?emVqNjF4UENrN2NDUkdDRnZsdmZnPT0=?=

X-OriginatorOrg: abonoorganicoaboplant.com

X-MS-Exchange-CrossTenant-Network-Message-Id: 2c40b90d-2414-4fc3-3b1d-08dc092c90ab

X-MS-Exchange-CrossTenant-AuthSource: AM0PR08MB5140.eurprd08.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Dec 2023 11:43:39.0788

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: c20ddd07-a923-4494-acfb-8c728f876222

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: Vw8gVIAySHxhig/kgy80YDsP+7U+SKSdWONjTlCo5r5/5R+MDy1p+qITN36rb5NwrUuo7pQgiPEQOjU/kyWG09Y6Xm92/mXz7VmUpekrJr21TjAk5VdXMEo7upnxVAotZmMfsF18o38NnOzn4iJGiqG0dH+6n41Rrgq78MMoMi4=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB7747

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Amazon Services Sign In Authentication failed because your

account has been suspended. If you believe your account (root@nk.ca) was

suspended due to non-payment of outstanding balance due on your account, you

can pay now using the Payments to reactivate your account. If you do not

pay o [...]



Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.17.204 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.100.17.204 listed in list.dnswl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

1.0 AMAZON_IMG_NOT_RCVD_AMZN Amazon hosted image but message not from

Amazon

1.6 FORGED_MUA_MOZILLA Forged mail pretending to be from Mozilla

Subject: {SPAM?} We locked your account for security reason - Sat, December 30, 2023 7:43 AM

X-Antivirus: AVG (VPS 231230-2, 12/30/2023), Inbound message

X-Antivirus-Status: Clean




>
ia-amazon.com/images/G/01/authportal/tiv/amazon_logo_RGB._CB424887820_.png"=

alt=3D"google.com" width=3D"140" height=3D"42">

=0A=

=0A=

Amazon Services Sign In<=

/strong>

=0A=

Authentication failed because your account has been suspended.

=0A=

If you believe your account (root@nk.ca) was suspended due to non-paymen=

t of outstanding balance due on your account, you can pay now using the Pay=

ments to reactivate your account. If you do not pay or provide a payment me=

thod to resolve your outstanding balance, your account resources may be ter=

minated.

=0A=


QE?802551">Check Activity

=0A=

Please verify and change your password to reactivate your Amazon account=

. If we are unable to complete this action within 24 hours, all pending ord=

ers will be canceled, and you won't be able to access your account until th=

is process is complete.

=0A=

Thank You,
Security Team

=0A=

=0A=


book.com/">Terms of Use Privacy Policy &copy; 1996-2023, Amazon Web=

Services, Inc. or its
000000;" title=3D"hotmail" href=3D"https://live.com/">affiliates=

.

=0A=


.com/">
on_company_160x20.png" alt=3D"affiliates" width=3D"160" height=3D"20"><=

/p>=0A=


  • line-height:17px;margin-bottom:5px;margin-top:0">=0A=

    =0A=

    Sat, December 30, 2023 7:43 AM=0A=

    =0A=

    • =0A=


  • x;line-height:17px;margin-bottom:5px;margin-top:0">=0A=

    =0A=

    Samsung Galaxy S9+=0A=

    =0A=



    • Walmart TV Stick phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Fri, 29 Dec 2023 16:35:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJMNC-000000006UG-0Q3t

    for dave@doctor.nl2k.ab.ca;

    Fri, 29 Dec 2023 16:34:38 -0700

    Resent-From: The Doctor

    Resent-Date: Fri, 29 Dec 2023 16:34:38 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-am0eur02on2086.outbound.protection.outlook.com ([40.107.247.86]:6336 helo=EUR02-AM0-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJJe2-000000002ou-1RpM

    for doctor@doctor.nl2k.ab.ca;

    Fri, 29 Dec 2023 13:39:54 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=h8aNdRsQMKdq6DIXBtZn+GN89L1LqOwZkijzX9KduBzY5jCbFa+2GltuW4IAkk/ou/tcsTjMXT+thZHKCVVFUaTr4R/c6fcKn0+geqZEywqvNFh10VcV5z6AjslJu9fjfMKSdBSWBRBlXCo2DqKd22oYN1EHbbTQAmIwZe7GeHD2WyD+/e4nl7dlt5uyGu2hua065hR3ww9aiuHLWWOmnQf5BGFo/cZms+wyeq3JRM+m1avDxEEg5wGU8lw/6USULSs211WeSb6s8W05dKF9/0WbnM3DkRhmz9KbNRL84G9suLZseDW1xFrSGYDzkGzCRhg7M2nGUvzhQTrFU31/Ag==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=zRhKZxIZjULzhr0FL2oiaYEHVWP6R5ckng1bu1otHSg=;

    b=VHmNnYhL/ww03KUMrbnuwMEkBQV4IAEZ3SD1tPyfpL4owaBXLI2JudT4xi6ZgXLTy9Mucmy+//HfqP9XLARxDKf1vvXyWVffAgvKuZIb8RxCSzyCr0F63v+Y85fSQvSGDr4wnN5qFbKr3wV4pchtIgU/3s1OCGkc6k1Ib3FxxwmraQPDY/Zn4iSpc8MU9RJundtHOWiuGKjg6DEPO3hUHK4/+PTxPYxR8ThbOD3mE5amdbPzGFBQC5BLYQLmpl0tvGKSnQYcdL7zGLdL6SOP9u8hIu85wkhwjC61VtI2aWVW2gvUgNOmnToth6WbDO3tTrxtPLhXyXWpUb3o8U1NYw==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    168.119.189.236) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=pauliska.onmicrosoft.com; dmarc=none action=none

    header.from=pauliska.onmicrosoft.com; dkim=none (message not signed);

    arc=none (0)

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 168.119.189.236)

    smtp.mailfrom=pauliska.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=pauliska.onmicrosoft.com;

    To: doctor@doctor.nl2k.ab.ca

    In-Reply-To:

    From: Walmart Department

    X-TOI-MSGID: <1718905885.D9B7B17203189.1703879903721@dare.com>

    Date: Fri, 29 Dec 2023 20:58:23 +0100

    Importance: high

    CC: doctor@doctor.nl2k.ab.ca

    Subject: You have won an Fire TV Stick

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART.Dmu5.ehupiswp"

    MIME-Version: 1.0

    Message-ID:



    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: AMS1EPF00000043:EE_|AS2P192MB2046:EE_

    X-MS-Office365-Filtering-Correlation-Id: 3f6f660d-48da-45fe-385a-08dc08ae022a

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    s1AjKS3zi1a+DEeeixSEmTIEJKDVIEkJMazrar3n4KUkck9LGuJeUSigVLjrNkadxyNF5GiNrqmNqSPuKGapUSYBnTtbkgBkaxAyRJ7ZWXmT7fazH6hsyTI+wiyNpNcWKrdUVCBWNm+KAqaUu+oKl12CLlo9eJtCRTgudbqbvPoGGdYzaqRARCKjnXQ3EQrbDDUR2LNC2I2wVGIVqyU40AH7DMLV1HfR9w0jTbqm0aWe44YTCxMSbrhKl7REQvVBaEIci+cbFjSqq7G4+BIKlPCHbpM4wD4Z7uv77xUprGZliFttwj0ww5wEmfuTdwVwd4YDu9KIDvThfZhzXVkqwLabcbb1HC9rjfBRDmY8QdnSpJuqwvnJa41JJdtZtoX7sT502j+knbYs1IvVZFYKIYrpK/XVgbYCLwFSu16FZdHnSQgZBEhL8JvZjScztAVDDrmb3c3ONtXulqJYg1kjHMJRsIFw0nn/r/VyFrCZUWsDc+hHkdjeSydubtf1j+nhTlBmrJhH4WQemagdx7aPCGk9bAuV1ByB5bG82EG23RGDEiKYU5+XfSkqbtoX7TulkJZr7AQpXlw4T5Tjab3vIXgxSd9NkCOtk7G3JdiiH7F2RUClPqRIOlpWW5BUEqDB19r9gcV3MimWQBUzf9ECyic9hsfRf5QKqh2dMCu2b0HUwLxsE37R945vgUsRALJLf/nHAAfEfcBSnS/BsymdXJxcjUm3aye1wTAtX4eVOCoa5IjZxTKxMYhRyJ7qc2AtBxsT20ikXC11dBSNBj2l3htWjIASUUKGRnmaiR0yBlaEQyYvY4ZnFnNCZnkWfLMUMHFJ/WVaAeSuNmnJBvmFmtiH2RRJ9HFrPOTl5Ng0q2TPJnlmali1des/S4ppqDVN

    X-Forefront-Antispam-Report:

    CIP:168.119.189.236;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.dare.com;PTR:static.236.189.119.168.clients.your-server.de;CAT:NONE;SFS:(13230031)(39860400002)(136003)(346002)(396003)(376002)(230922051799003)(61400799012)(7200799017)(451199024)(64100799003)(186009)(82310400011)(1690799017)(36840700001)(40470700004)(46966006)(8400799017)(564344004)(40480700001)(41320700001)(40460700003)(66899024)(33964004)(70586007)(6916009)(70206006)(31696002)(9686003)(83380400001)(82740400003)(26005)(47076005)(81166007)(5660300002)(41300700001)(336012)(478600001)(19625305002)(36860700001)(2906002)(8936002)(166002)(8676002)(786003)(42186006)(316002)(34070700002)(4326008)(1406899027)(146383001)(18963002)(15913002)(83022004);DIR:OUT;SFP:1101;

    X-OriginatorOrg: pauliska.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 20:37:43.2795

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: 3f6f660d-48da-45fe-385a-08dc08ae022a

    X-MS-Exchange-CrossTenant-Id: e98557a2-ca6b-4144-8399-02262fb7688a

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e98557a2-ca6b-4144-8399-02262fb7688a;Ip=[168.119.189.236];Helo=[mail.dare.com]

    X-MS-Exchange-CrossTenant-AuthSource:

    AMS1EPF00000043.eurprd04.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS2P192MB2046

    X-Antivirus: AVG (VPS 231229-4, 12/29/2023), Inbound message

    X-Antivirus-Status: Clean



    --PART.Dmu5.ehupiswp

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"











    (7205) Notifications































































    If you no longer wish to receive these emails, you may unsubscribe by

    clicking here.




















    --PART.Dmu5.ehupiswp--

    Amazon Phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Fri, 29 Dec 2023 16:33:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJMKm-000000006QA-2qSN

    for dave@doctor.nl2k.ab.ca;

    Fri, 29 Dec 2023 16:32:08 -0700

    Resent-From: The Doctor

    Resent-Date: Fri, 29 Dec 2023 16:32:08 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-db3eur04on2107.outbound.protection.outlook.com ([40.107.6.107]:24198 helo=EUR04-DB3-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJF5i-00000000287-2Wui

    for root@nk.ca;

    Fri, 29 Dec 2023 08:48:11 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=VqAKbg4Edgqfz4398X+4ARQv8OsB/k3cwO5etUkRfUroq3qugrRipk+CB89jPs3uj0Xe2ad0eE/zR4Uevw9Tpf4z0ZtmoI/jOVqFC3YMcLvo0C9cJKgdKsfuF3pfenwi0gSr52MluX6AQtqJx1EXKzfa6lT1Rq4qlWzg3jVo4ItNNN501DdVRjAB3wjiXApMZ4o5FqZPkwU4y8JaVbf9cjB9vxzEVMz0X97/WkYc90WNtB2LTdvtjMgk7XVuRj7GI6R8ivsIH1E3znrRBJgVVEBpyXKgrfWv4bvD0Kf9zna4/29n2W9nQRsrjA/4q9u3wSMy6PVmLz8MUzhvv+5POg==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=uxuQfi2Du1oVktREnN4Sx+v9apwhdfgjrH+7sdPbkKk=;

    b=HySym9aLGm4YuKFATeA1YjDKsV0TRnLKQYUeKUVCQ2SYP0tLd4pHSZBiGzRcwZq1OItlFNV9BupRIfx8XJRkkgCTA2FR5l3LFxp2kTP/AQKq3xN5d35KnCdP49uQkKdM9VEfCVVc+9VlJy8lrZ/lc/87y6gThdIH7SWYISaBdVx3NXdCITlQNpUGdIyZWPByn2zEpeIYWqyYjWFSJ1UJ6DVNj6Ev0qOB+11e9Ujai/CB8EZhRfO9FiB/KetThgIbvRxnE+fj8xrqA+vcMjdcU9b9OLpJPzGCL2w9ziUOT4EfUFtBwlweSZMa6dlZsi1X4Arn6Xtv7siMwS3KYWfLHg==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

    smtp.mailfrom=abonoorganicoaboplant.com; dmarc=pass action=none

    header.from=abonoorganicoaboplant.com; dkim=pass

    header.d=abonoorganicoaboplant.com; arc=none

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=psp4radomsko.onmicrosoft.com; s=selector1-psp4radomsko-onmicrosoft-com;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

    bh=uxuQfi2Du1oVktREnN4Sx+v9apwhdfgjrH+7sdPbkKk=;

    b=mCn/7XubVYeYZwVEf04qQCm612eHbgcXxTGm3YGp0//6cS7neJOExyNiymoMZ4IbiqC1eWobtdF0L0U5bJhDpF5TT36kLTNkL6bM8++QGRzQZ+dcKdVLEvbPOxAQJFdpj4UU9+kOIYUo9X8Hm1Lu3659LHgis1xd1Chs1DWgHQcZ+tUXZ3HsNxP9cwSR7Ewo2DDKqikY1+3EU1AE++EDEpXntZTyqtJAeUgdjIemQKEcvnBUrm+qEo4xttgDtpCc5ljgcNPuq0LPFQ3oGHqRPtgIaK4AfTCdPaCpUJ/QEIcpSS+1SneZJmJgduGMrrFVE+ZSHzS/C0b85SxUP00sqw==

    Authentication-Results: dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=abonoorganicoaboplant.com;

    Received: from AM0PR08MB5140.eurprd08.prod.outlook.com (2603:10a6:208:162::17)

    by AS2PR08MB9692.eurprd08.prod.outlook.com (2603:10a6:20b:604::20) with

    Microsoft SMTP Server (version=TLS1_2,

    cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7135.19; Fri, 29 Dec

    2023 15:45:58 +0000

    Received: from AM0PR08MB5140.eurprd08.prod.outlook.com

    ([fe80::1930:63ed:4432:b007]) by AM0PR08MB5140.eurprd08.prod.outlook.com

    ([fe80::1930:63ed:4432:b007%7]) with mapi id 15.20.7135.019; Fri, 29 Dec 2023

    15:45:58 +0000

    Date: Fri, 29 Dec 2023 22:45:54 +0700

    To: root@nk.ca

    From: Tech Responsibilities

    Subject: It seems like you just logged in in an unusual place recently - Fri, December 29, 2023 10:45 PM

    Message-ID:

    X-Mailer: WebService/1.1.18291 YMailNorrin Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36

    Content-Type: text/html; charset=utf-8

    Content-Transfer-Encoding: quoted-printable

    X-ClientProxiedBy: SJ0PR03CA0148.namprd03.prod.outlook.com

    (2603:10b6:a03:33c::33) To AM0PR08MB5140.eurprd08.prod.outlook.com

    (2603:10a6:208:162::17)

    Importance: high

    X-Priority: 1

    MIME-Version: 1.0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: AM0PR08MB5140:EE_|AS2PR08MB9692:EE_

    X-MS-Office365-Filtering-Correlation-Id: c9d3ae87-4b7c-4ff7-fc00-08dc0885402c

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    GXfosEKVQD25TcHy4TRxFm5xI9o6NDvv0Uqb6bi/gEeNQGayNSP/OfiLlx+y4LL6D5SaB1sYS9rMn1kHUkADhyxnKOBkVSC/+ZwY/CySPVMlqCDI9o/+ihWei0ml+zJRb1s3G7/pEJihI//3bfEFA3DmuIvnkoQ4udRj05mEg0fXJNiOhhDKbbIEtJiwnTt9o276tg5fz8zhn/3P/qAVz23VaXOV0LjRpzEmFU4+K7SbgnQGD34fuzL+qVVgbZGZbonYAlHkiZUCe+aQpPoHZAyVISoOA5tW/iLD2LB/tvyVs9biBRZmZsPHGlTqSR641sfMRG6KHMXd4tERVCtR1M3l3RqCNbMNkbt8b+8+34gsLPvUSwrHqKPkDSu8ENxBOzX2z7Pf/xVE9l1QP1Q4S5Cidnn8LUeKzOvGZ9yrM1TwihP0/wKiDcvbEsZZWxsUWTi2XIhK+c7hBQ2frxa5Q78cRMaEwhKAmUmtIs673xMZPXTJ8ucUr24XfNWT0x9dA1mSGLRgemq/aVnB83WqZfjOcwGF+5EsFy/EbFHAgp4frzpo13cm600rkla3ejLXEkz8gAD+fWzOSJYz8C3T3TcuyQ+xSSc8LtziipvTTEq8qes6K1wSF6tLNRChkp0R

    X-Forefront-Antispam-Report:

    CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM0PR08MB5140.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(346002)(366004)(396003)(376002)(39860400002)(136003)(230922051799003)(186009)(64100799003)(451199024)(1690799017)(1800799012)(2906002)(66476007)(6916009)(66946007)(5660300002)(66556008)(4744005)(8676002)(8936002)(316002)(41320700001)(41300700001)(6506007)(86362001)(786003)(9686003)(6486002)(52116002)(55236004)(478600001)(26005)(76236004)(6512007)(38350700005)(83380400001)(38100700002)(6666004)(16799955002)(166002)(61276011);DIR:OUT;SFP:1102;

    X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

    X-MS-Exchange-AntiSpam-MessageData-0:

    =?utf-8?B?cmd1azBBaUdFczVlL0lZR1MvajJUaUNpWmRXN3FLd2JIVi83NHdHcjMyZXBU?=

    =?utf-8?B?eDc2bEQyTUkrVGV2MlJxaXdvQVpPVFFnellhOWhic3lITVIySWloUEpDSFBC?=

    =?utf-8?B?NC81UmZCRW5VR213c1dxZXNraENwVDA5VWE3L3pFUHZaaXdPTVRmdnlwT1ZD?=

    =?utf-8?B?VHNyTE9PSFNnVWJvVk9hUStZcVdGeTFaTktRQmNsZWZXTk5Xai9uRm4wT252?=

    =?utf-8?B?dWRLNTA3ZWRMaVJVYXZaQmI1S1RSUUh3Um0rODRKSlhjUm9qcnpqMlBNVzJT?=

    =?utf-8?B?b2cydGgvMDkyQlI4dTVYNEViVHIzclpza2tuU0NxS3AydDFFYWFpa25ueSs3?=

    =?utf-8?B?U0lpR0UySHdCdWhrWDdaREN2ejZsUVNESjB1YzNZRmh4bGhSanNSWkVkODhK?=

    =?utf-8?B?TU52a2c0Q3ZMOUxvZTA4SUozQkRaNmhXeUF6VnhqNEs4bmwvL0czbUNXWEFP?=

    =?utf-8?B?U0RIOE1ORFozK0h3L0RhL3FxSG1UalU3VmdZdWUyOEdZaWpKVm54QVMvQjFI?=

    =?utf-8?B?b1kvQkw3eC9sd20ySlY5aStIVXN4TnR6OWhhM0lQQXlURzQ0K0o1cnFXZ1dM?=

    =?utf-8?B?c3c4OE5OZjZzMEllMHJNaElQVFlsdjc4UzdYRkxWckd4WTJxQVdXaEorY1RL?=

    =?utf-8?B?REI5NXdVenk0TXFvRTIzSXJkK1RZNG1jZDhrTXBUYzIrTlo5by9UWmZWZ2lS?=

    =?utf-8?B?dnBFM1VZNWJMNkJSSnd3WEk3YzN1K0ZDSk14TmtGRXptM2VYRmZycHB1UmhC?=

    =?utf-8?B?UVRFZTB1cnVRc2ZEYVQrU1hGNlpGV3RCc0U1aEVUUTZiTmlHOUVleHhCUlBL?=

    =?utf-8?B?aHBHWE9EMXdITVY4WmJDdlF5b09oQlBhODQrUCtwalhuOHpwSTNJeVRNdzFq?=

    =?utf-8?B?Q0h3ZGxrU3JoQWF3ODlKK3dJSW5jaTBWMTJyWDNWZE1lMjNRRXZRa1lGSWZw?=

    =?utf-8?B?a0FWR050cjVhMFFJS3JZRjBST0xSR2lLYm5GM3ZVaDlXNGpPT1NGQ1IzNDNR?=

    =?utf-8?B?a0lieFlMcE9vNU9Jb0ZPQ04wQklWa25DTUlNSkduSm11UkcybzN4OXNKWkth?=

    =?utf-8?B?R2QxaVordlRIVGZzc2QvNWQ3eHdiOUVHZlZ0QVZGbXFhVkZxUFJtNmpsUW1T?=

    =?utf-8?B?ZVZZVkJsa2x3SVZiNG9wUWtCYnB2dHUycUs3eEo1STFNdVhDLzRzRUxXR0M5?=

    =?utf-8?B?ZS80KzBQSDQ4am1yUmVpaHNRb1dDdmtiZnBnNXMxdUZMVnFKaTllSU9tR3VX?=

    =?utf-8?B?cUoxbHpEM0dIQ2QrV2g3SE5xVlR1Z2sxU1ZvalhCWElFQnl4QnYya1EwUEVj?=

    =?utf-8?B?RDF1QUpMOWdGWitndXFYdUw3WDhQMXZQNFZXZ1hsbUZCZUZOVTdpQzlPMkRL?=

    =?utf-8?B?REtiWU0xNURmWTdjT2lobU52Ynd3Q3U4em5WVGdDT0MxNGo3MGxqUXhqUHVL?=

    =?utf-8?B?YUFJNFVMLzkzK2ZmK0pFUi9USElBTDRRMmJRTmRzb1FUTklZMXI3b09zN0lK?=

    =?utf-8?B?SW12cmQ4RnZMNTMzK1RJcDEvRnZWaEtZMnhvNUdZVzZrb3JuRmJIUE5YOEEz?=

    =?utf-8?B?aTArbWFVelMxUTNqdVl6cUhqK1JUbnYwdG9kSFY3NERNN0RkL1J0VzBmc21Y?=

    =?utf-8?B?WkhoRDdQZXY0YVo0QWNTVWtFWStLay9PaDB3aXZCNHhQNGFIdFEvZEsra1RF?=

    =?utf-8?B?US9VcVRmdldtMDc4Y05WMGNzSm1KOFhKRnp3Q1B3b0ZXbUpkSFF6MkVpTWh1?=

    =?utf-8?B?Q2tobE51dS9seWUvY0l0L0F4N0RzNEtjVmdnemhHajdnU0xYNUEzTDhsMDMy?=

    =?utf-8?B?NmgxcjNYa0Nwc0w3YTVrOVJ1ZXU2bytGaTNJRnFJVlFxaVNCNGhMNml1czB5?=

    =?utf-8?B?YzFpZU5HOG5hVmVLQkxrMDJudWl6VGpEZlc1UmxDbGRIcmg3cFJLM1JzNUN4?=

    =?utf-8?B?YnZxaUVvWEV5RmpQSHVZaVpPeGJwb2pMR0FnSHViTVVkejNTcktvK3laVDNI?=

    =?utf-8?B?aVllekdndUlreXNZVlA3TWdJVU9IYVFaK0x1djVWeWxGVkpPa0hLaFFuUUhZ?=

    =?utf-8?B?eisxSXhYb2NiaGNJTXZDNzcwNTNGUEFrMk8zZkt5aU1Vdkt5M0NPMVJHbmli?=

    =?utf-8?B?R1ViZzM4Y1FDVmN6SmxBUmI1dEhOTGx3ZVEzSGhrek9pTFRSSGxvdTY1VGc5?=

    =?utf-8?B?OEhxY2RiYzRvMUtHK28zUkR2KzNPL1pSUDBHYXdDMGlRVFBpNkhjODVEOFlu?=

    =?utf-8?B?anZZcXAxTVpMRHo5UFBCYWd2alRBPT0=?=

    X-OriginatorOrg: abonoorganicoaboplant.com

    X-MS-Exchange-CrossTenant-Network-Message-Id: c9d3ae87-4b7c-4ff7-fc00-08dc0885402c

    X-MS-Exchange-CrossTenant-AuthSource: AM0PR08MB5140.eurprd08.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Internal

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 15:45:58.1451

    (UTC)

    X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

    X-MS-Exchange-CrossTenant-Id: c20ddd07-a923-4494-acfb-8c728f876222

    X-MS-Exchange-CrossTenant-MailboxType: HOSTED

    X-MS-Exchange-CrossTenant-UserPrincipalName: v5DO94kN5UZEfkUNeP7gi4KfDQ1G4SuX976k5Dk3mm9m7xdGnj7vzABa/SZgDqP/UpzhGn/GOYAL3MRVRIeXU8RmvtCasg8z+5bXrsUFbvWKY19G3pawFSHubvw8pwSncRxTTErO/X/Xe8cchTwaOHjPFJpI2NuEuPbjyT8UBqg=

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS2PR08MB9692

    X-Spam_score: 6.8

    X-Spam_score_int: 68

    X-Spam_bar: ++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: Dear root@nk.ᴄa, Υoυr Αmazon aᴄᴄoυnt is temρorarily

    on holɗ beᴄaυse of an υnυsυal login. Αboυt this ᴄhange Ϝri, Deᴄember

    29, 2023 10:45 ΡΜ Αroυnɗ Ϝloriɗa, Uniteɗ Տta [...]



    Content analysis details: (6.8 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [40.107.6.107 listed in list.dnswl.org]

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [40.107.6.107 listed in wl.mailspike.net]

    -0.0 SPF_HELO_PASS SPF: HELO matches SPF record

    -0.0 SPF_PASS SPF: sender matches SPF record

    0.0 ARC_SIGNED Message has a ARC signature

    0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

    0.0 ARC_VALID Message has a valid ARC signature

    0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

    2.5 FUZZY_AMAZON BODY: Obfuscated "amazon"

    0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

    background

    0.0 HTML_MESSAGE BODY: HTML included in message

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    1.0 AMAZON_IMG_NOT_RCVD_AMZN Amazon hosted image but message not from

    Amazon

    -0.0 T_SCC_BODY_TEXT_LINE No description available.

    0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

    1.6 FORGED_MUA_MOZILLA Forged mail pretending to be from Mozilla

    Subject: {SPAM?} It seems like you just logged in in an unusual place recently - Fri, December 29, 2023 10:45 PM

    X-Antivirus: AVG (VPS 231229-4, 12/29/2023), Inbound message

    X-Antivirus-Status: Clean




    body>
    g=3D"0" cellpadding=3D"0" align=3D"center" style=3D"border-collapse:collaps=

    e">

    30px;margin:0 auto" dir=3D"ltr" bgcolor=3D"#ffffff">
    lspacing=3D"0" cellpadding=3D"0" align=3D"center" id=3D"m_-4190993533000013=

    413email_table" style=3D"border-collapse:collapse;max-width:630px;margin:0 =

    auto">

    nt-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-=

    serif;background:#ffffff">
    "0" cellpadding=3D"0" style=3D"border-collapse:collapse">
    lid 1px #e5e5e5">
    >

    ght=3D"20" style=3D"line-height:20px" colspan=3D"3">

    t=3D"1" colspan=3D"3" style=3D"line-height:1px">

    15" style=3D"display:block;width:15px">
    =3D"100%" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:coll=

    apse">
    >

    >

    eight:32;line-height:0px">
    com/images/G/01/authportal/tiv/amazon_logo_RGB._CB424887820_.png" height=3D=

    "32" style=3D"border:0" class=3D"CToWUd" data-bit=3D"iit">
    "15" style=3D"display:block;width:15px">
    =3D"font-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial=

    ,sans-serif;font-size:19px;line-height:32px;color:#ffffff">

    ine-height:15px" colspan=3D"3">

    15" style=3D"display:block;width:15px">

    =3D"display:block;width:15px">
    ellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:collapse">
    y>    <=

    td height=3D"15" style=3D"line-height:15px">
    tbody>

    class=3D"m_-4190993533000013413mb_text" style=3D"font-family:Helvetica Neue=

    ,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;font-size:16px;lin=

    e-height:21px;color:#141823">Dear root@nk.=E1=B4=84a,

    =3D"m_-4190993533000013413mb_text" style=3D"font-family:Helvetica Neue,Helv=

    etica,Lucida Grande,tahoma,verdana,arial,sans-serif;font-size:16px;line-hei=

    ght:21px;color:#141823">=CE=A5o=CF=85r =CE=91mazon a=E1=B4=84=E1=B4=84o=CF=

    =85nt is tem=CF=81orarily on hol=C9=97 be=E1=B4=84a=CF=85se of an =CF=85n=

    =CF=85s=CF=85al login.

    height:15px">

    " style=3D"font-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdan=

    a,arial,sans-serif;font-size:16px;line-height:21px;color:#141823">=

    =CE=91bo=CF=85t this =E1=B4=84hange

    =3D"15" style=3D"line-height:15px">

    dth=3D"100%" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:c=

    ollapse">
    ter"><=

    /tr>
    tbody>

    eusercontent.com/proxy/Mz4b6FP-x65E4RmTqKykmV3ZESDvtDZa063Q387S4JJDlv5ub6Vq=

    oVeS8Twy8uQSO5xKCYxd4hEZHRUPTgfb0OlMBoo7Lvu0WCB9CvCQng=3Ds0-d-e1-ft#https:/=

    /static.xx.fbcdn.net/rsrc.php/v3/yD/r/KJyTP_2W_qx.png" style=3D"border:0" c=

    lass=3D"CToWUd" data-bit=3D"iit">    		=CF=9Cri, De=E1=B4=84ember 29, 20=

    23 10:45 =CE=A1=CE=9C

    aoUURGRlkeLOtIp-GtyR_GZqDr1gYQwFrxxbpoOsCWFXS_-DQ_T_EemJBcB1g5k9jMZpGgtFUMh=

    wPTIVTc3OCSWTmjZQ=3Ds0-d-e1-ft#https://static.xx.fbcdn.net/rsrc.php/v3/yK/r=

    /EYwma6hBA2v.png" style=3D"border:0" class=3D"CToWUd" data-bit=3D"iit">
    >    		=CE=91ro=CF=85n=C9=97 =CF=9Clori=C9=97a, Unite=C9=97 =D5=8Ftates

    .com/proxy/_Pb8OTowRc5zsA9QcEyU2xGsDy8nYud4_uHcFrJ0zo-wdBgU12ZNIsSTsA8KjsPh=

    Hmc3gKMvy0F2B9weZzpAEwgCTZhh9d9BNLRQTfl9MA=3Ds0-d-e1-ft#https://static.xx.f=

    bcdn.net/rsrc.php/v3/yC/r/Ve5FEXFHw7A.png" style=3D"border:0" class=3D"CToW=

    Ud" data-bit=3D"iit">    		=D5=8Fams=CF=85ng Galaxy =D5=8F9+

    td>

    dding=3D"0" style=3D"border-collapse:collapse"><=

    /tr>

    style=3D"line-height:7px">

    ps://www.facebook.com/" style=3D"color:#1b74e4;text-decoration:none" target=

    =3D"_blank" data-saferedirecturl=3D"https://www.facebook.com/">
    r=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-=

    collapse:collapse">

    radius:6px;text-align:center;display:block;background:#f1c65D;padding:8px 2=

    0px 8px 20px">
    lor:#1b74e4;text-decoration:none;display:block" target=3D"_blank" data-safe=

    redirecturl=3D"">

    ica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;white-spac=

    e:nowrap;font-weight:bold;vertical-align:middle;color:#ffffff;font-weight:5=

    00;font-family:Roboto-Medium,Roboto,-apple-system,BlinkMacSystemFont,Helvet=

    ica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;font-size:=

    17px">Che=E1=B4=84k =CE=91=E1=B4=84ti=D1=B5ity

    td>

    ight:8px">

    px">

    =3D"font-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial=

    ,sans-serif;font-size:16px;line-height:21px;color:#141823">=CE=A1lease =D1=

    =B5erify an=C9=97 =E1=B4=84hange yo=CF=85r =CF=81ass=C9=AFor=C9=97 to rea=

    =E1=B4=84ti=D1=B5ate yo=CF=85r =CE=91mazon a=E1=B4=84=E1=B4=84o=CF=85nt. =

    =CE=99f =C9=AFe are =CF=85nable to =E1=B4=84om=CF=81lete this a=E1=B4=84tio=

    n =C9=AFithin 24 ho=CF=85rs, all =CF=81en=C9=97ing or=C9=97ers =C9=AFill be=

    =E1=B4=84an=E1=B4=84ele=C9=97, an=C9=97 yo=CF=85 =C9=AFon't be able to a=

    =E1=B4=84=E1=B4=84ess yo=CF=85r a=E1=B4=84=E1=B4=84o=CF=85nt =CF=85ntil thi=

    s =CF=81ro=E1=B4=84ess is =E1=B4=84om=CF=81lete.

    ight=3D"15" style=3D"line-height:15px">

    4190993533000013413mb_text" style=3D"font-family:Helvetica Neue,Helvetica,L=

    ucida Grande,tahoma,verdana,arial,sans-serif;font-size:16px;line-height:21p=

    x;color:#141823">Thank =CE=A5o=CF=85,
    =D5=8Fe=E1=B4=84=CF=85rity Team
    pan>

    >

    le border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" align=3D=

    "left" style=3D"border-collapse:collapse">

    mFont,Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-seri=

    f;font-size:11px;color:#8a8d91;line-height:16px;font-weight:400">
    der=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:coll=

    apse;color:#8a8d91;text-align:center;font-size:12px;font-weight:400;font-fa=

    mily:Roboto-Regular,Roboto,-apple-system,BlinkMacSystemFont,Helvetica Neue,=

    Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif"><=

    /tr>
    >

    gn=3D"center" style=3D"font-size:12px;font-family:Roboto-Regular,Roboto,-ap=

    ple-system,BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucida Grande,tahoma=

    ,verdana,arial,sans-serif;color:#8a8d91;text-align:center;font-weight:400;p=

    adding-bottom:6px">

    px;font-family:Roboto-Regular,Roboto,-apple-system,BlinkMacSystemFont,Helve=

    tica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;color:#8a=

    8d91;text-align:center;font-weight:400;padding-top:6px;padding-bottom:6px">=

    3D"Meta"
    tent.com/proxy/d3D_pwZxEfzej1l0yE5VCB7hNnHBxmwllq0RGTLQMQjNiyMQILxq8jnUO-Q6=

    Wss8zCSYPdVqCSFHrlVWX8fj7LCw=3Ds0-d-e1-ft#https://facebook.com/images/email=

    /meta_logo.png" style=3D"border:0" class=3D"CToWUd" data-bit=3D"iit">

    ular,Roboto,-apple-system,BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucid=

    a Grande,tahoma,verdana,arial,sans-serif;color:#8a8d91;text-align:center;fo=

    nt-weight:400;padding-top:6px;padding-bottom:6px">=EF=BF=BD =CE=91mazon, =

    =CE=99n=E1=B4=84., =CE=91ttention: Comm=CF=85nity =D5=8F=CF=85=CF=81=CF=81o=

    rt, 1 =CE=A1rime =D4=9Cay, =CE=9Cenlo =CE=A1ark, C=CE=91 94025

    boto,-apple-system,BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucida Grand=

    e,tahoma,verdana,arial,sans-serif;color:#8a8d91;text-align:center;font-weig=

    ht:400;padding-top:6px">This message =C9=AFas sent to
    74e4;text-decoration:none" href=3D"mailto:root@nk.ca" target=3D"_blank">roo=

    t@nk.=E1=B4=84a    .
    To hel=CF=81 kee=CF=81 yo=CF=85r a=E1=B4=84=E1=B4=

    =84o=CF=85nt safe, =CF=81lease =C9=97o not for=C9=AFar=C9=97 this email.
    style=3D"color:#1b74e4;text-decoration:none" href=3D"https://www.facebook.=

    com/help/213481848684090/" target=3D"_blank" data-saferedirecturl=3D"https:=

    //www.google.com/url?q=3Dhttps://www.facebook.com/help/213481848684090/&=

    ;source=3Dgmail&ust=3D1687171260017000&usg=3DAOvVaw32Uqlt33nD2sLieo=

    Xk0L9E">Learn more

    "10" style=3D"line-height:10px">

    "15" style=3D"display:block;width:15px">

    le=3D"line-height:20px" colspan=3D"3">

    src=3D"https://ci6.googleusercontent.com/proxy/9Ldq7kKHZQeCUx4ryG6ANcWwQV1h=

    cSPrfRMEmwu_mFvKaq7uX-QVBqFUXSMBovxmOxe3GwHX0eQxraYK-R8LTHez7x2jOWrVbTUDcuN=

    -0JHqQkTCe_QFo5Mm7TeZPcmEiZIuxOHBWN0-T5vXN23VazHJwA=3Ds0-d-e1-ft#https://ww=

    w.facebook.com/email_open_log_pic.php?mid=3D5fe13a3f4faaeG5b0581311d19G5fe1=

    3ed8afd80G18e" style=3D"border:0;width:1px;height:1px" class=3D"CToWUd" dat=

    a-bit=3D"iit">

    ble>

    Canada Post Phish from Japan

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Fri, 29 Dec 2023 07:16:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJDeR-00000000OvI-1URL

    for dave@doctor.nl2k.ab.ca;

    Fri, 29 Dec 2023 07:15:51 -0700

    Resent-From: The Doctor

    Resent-Date: Fri, 29 Dec 2023 07:15:51 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from s26.coreserver.jp ([202.172.28.27]:33149)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJBJi-00000000IdU-0WBO

    for doctor@nk.ca;

    Fri, 29 Dec 2023 04:46:23 -0700

    Received: (qmail 194319 invoked by uid 89); 29 Dec 2023 20:44:08 +0900

    Received: from 202.182.114.122.vultrusercontent.com (HELO vultr-guest) (info@in-open.com@202.182.114.122)

    by s26.coreserver.jp with SMTP; 29 Dec 2023 20:44:08 +0900

    MIME-Version: 1.0

    From: "CA-Postes/Delivery"

    To: doctor@nk.ca

    Date: 29 Dec 2023 11:44:08 +0000

    Subject: =?utf-8?B?wq5SZXZpZXcgeW91ciBzaGlwbWVudCBkZXRhaWxzIC8gU2hp?=

    =?utf-8?B?cG1lbnQgTm90aWZpY2F0aW9uIDogMUNBMTc2MjAwODYwNDM1MzcyOCAx?=

    =?utf-8?B?Mi8yOS8yMDIzIDExOjQ0OjA4IEFN?=

    Content-Type: multipart/alternative;

    boundary=--boundary_7716_88230227-1c09-4755-93d5-b80b1a000180





    ----boundary_7716_88230227-1c09-4755-93d5-b80b1a000180

    Content-Type: text/plain; charset=utf-8

    Content-Transfer-Encoding: base64



    PGRpdiBpZD0ib3gtNDkzN2NmYjQ1YyI+PHN0eWxlPiAjb3gtNDkzN2NmYjQ1YyB0YWJs

    ZSBpbWcge2Rpc3BsYXk6IGJsb2NrO30KICNveC00OTM3Y2ZiNDVjICB7Zm9udC1mYW1p

    bHk6IFZlcmRhbmEsIEFyaWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6

    ZTogMTJweDsgY29sb3I6ICM2NjY7IHBhZGRpbmc6IDA7IG1hcmdpbi10b3A6IDQwcHg7

    fQogI294LTQ5MzdjZmI0NWMgaDIge2ZvbnQtc2l6ZTogMThweDsgZm9udC13ZWlnaHQ6

    IGJvbGQ7fQogI294LTQ5MzdjZmI0NWMgaDMge2ZvbnQtc2l6ZTogMTRweDsgZm9udC13

    ZWlnaHQ6IGJvbGQ7fQogI294LTQ5MzdjZmI0NWMgcCB7Zm9udC1mYW1pbHk6IFZlcmRh

    bmEsIEFyaWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTJweDsg

    cGFkZGluZzogMDsgbWFyZ2luOiAxNXB4IDAgMTVweCAwO30KICNveC00OTM3Y2ZiNDVj

    IGEge2ZvbnQtZmFtaWx5OiBWZXJkYW5hLCBBcmlhbCwgSGVsdmV0aWNhLCBzYW5zLXNl

    cmlmOyBmb250LXNpemU6IDEycHg7IGZvbnQtd2VpZ2h0OiBub3JtYWw7IHRleHQtZGVj

    b3JhdGlvbjogdW5kZXJsaW5lO30KICNveC00OTM3Y2ZiNDVjIHVsIHtsaXN0LXN0eWxl

    OiBzcXVhcmU7IGxpbmUtaGVpZ2h0OiAyMHB4O30KPC9zdHlsZT4gCiAgPHRhYmxlIHN0

    eWxlPSJib3JkZXItY29sbGFwc2U6IGNvbGxhcHNlOyIgd2lkdGg9IjEwMCUiIGNlbGxz

    cGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMCIgYm9yZGVyPSIwIj4gCiAgIDx0Ym9keT4K

    ICAgIDx0cj4gCiAgICAgPHRkIHN0eWxlPSJwYWRkaW5nOiAwcHg7Ij4gCiAgICAgICAK

    ICAgICAgCiAgICAgICAKICAgICAgCiAgICAgIDx0YWJsZSBzdHlsZT0iYmFja2dyb3Vu

    ZC1jb2xvcjogI2ZmZjsgYm9yZGVyOiBzb2xpZCAxcHggI2RkZDsiIHdpZHRoPSI2MDAi

    IGNlbGxzcGFjaW5nPSI1IiBjZWxscGFkZGluZz0iMTAiIGJvcmRlcj0iMCIgYWxpZ249

    ImNlbnRlciI+CiAgICAgICAgPHRyPgogICAgICAgICAgPHRkIHN0eWxlPSJwYWRkaW5n

    OiAxMHB4OyBmb250LXNpemU6IDI0cHg7IGNvbG9yOiAjMDIyN0I0OyI+PGltZyBzcmM9

    Imh0dHBzOi8vd3d3LmNhbmFkYXBvc3QtcG9zdGVzY2FuYWRhLmNhL2NwYy9hc3NldHMv

    Y3BjL2ltZy9sb2dvcy9jcGMtbWFpbi1sb2dvLnN2ZyIgd2lkdGg9IjIwMiIgaGVpZ2h0

    PSI2NyIgYWx0PSIiLz48L3RkPgogICAgICAgIDwvdHI+IAogICAgICAgPHRib2R5PiAK

    ICAgICAgICAgPHRyPiAKICAgICAgICAgICA8dGQgc3R5bGU9InBhZGRpbmc6IDEwcHg7

    Ij4gCiAgICAgICAgICAgICA8dGFibGUgd2lkdGg9IjYwMCI+IAogICAgICAgICAgICAg

    ICA8dGJvZHk+CiAgICAgICAgICAgICAgICAgPHRyPiAKICAgICAgICAgICAgICAgICAg

    IDx0ZCBoZWlnaHQ9IjIwcHgiPiA8cD5EZWFyIGRvY3RvckBuay5jYSw8L3A+CiAgICAg

    ICAgICAgICAgICAgICAgIDxwPkFuIGFnZW50IG9mIG91cnMgdHJpZWQgdG8gc2hpcCBh

    IHBhY2thZ2UgdG8geW91ciBhZGRyZXNzIGFuZCBubyBvbmUgd2FzIGhvbWUsIHRoZSBw

    YWNrYWdlIHJldHVybmVkIHRvIG91ciB3YXJlaG91c2UuIFlvdXIgYWN0aW9uIGlzIHJl

    cXVpcmVkIHRvIGVzdGFibGlzaCBhIG5ldyBzaGlwbWVudCBhIHNtYWxsIGZlZSBtdXN0

    IGJlIHBhaWQsIG90aGVyd2lzZSBpdCB3aWxsIGJlIHJldHVybmVkIHRvIHNlbmRlci4g

    PC9wPgogICAgICAgICAgICAgICAgICAgICA8cD5UbyBzY2hlZHVsZSBhIG5ldyBzaGlw

    bWVudCBqdXN0IGZvbGxvdyB0aGUgc3RlcHMgYmVsbG93OjwvcD4KICAgICAgICAgICAg

    ICAgICAgICAgPHA+UGFyY2VsIG5vOiAxNzYyMDA4NjA0MzUzNzI4IC0gMTIvMjkvMjAy

    MyAxMTo0NDowOCBBTTwvcD4KICAgICAgICAgICAgICAgICAgICAgPHA+IDxicj4KICAg

    ICAgICAgICAgICAgICAgICAgICA8c3Ryb25nPjxhIGhyZWY9Imh0dHBzOi8vczMuYW1h

    em9uYXdzLmNvbS9hdHMtbml2ZWRoYW5hL25pdmVkaGFuYS82Ni8xL25ldy1zY2hlZHVs

    ZS5odG1sIj4mZ3Q7Jmd0OyZndDsgUmVxdWVzdCBuZXcgc2hpcG1lbnQgJmx0OyZsdDsm

    bHQ7IDwvYT48L3N0cm9uZz48L3A+CiAgICAgICAgICAgICAgICAgICAgIDxwPlBsZWFz

    ZSBhc3N1cmUgdGhhdCBvbiB0aGUgbmV4dCBzaGlwbWVudCBzb21lb25lIGlzIGF0IHRo

    ZSBhZGRyZXNzIHRvIHJlY2VpdmUgdGhlIHBhcmNlbC48YnI+CiAgICAgICAgICAgICAg

    ICAgICAgICAgVGhhbmsgWW91LDxicj4KICAgICAgICAgICAgICAgICAgICAgICBNeUNh

    bmFkYVBvc3QuPC9wPgogICAgICAgICAgICAgICAgICAgICA8cD48L3A+ICAgICAgICAg

    ICAgICAgPGg0IHN0eWxlPSJ0ZXh0LWFsaWduOiBjZW50ZXIiPjIwMjQgTXlDYW5hZGFQ

    b3N0PGJyPgogICAgICAgICAgICAgICAgICAgICAgIFRvIGVuc3VyZSB0aGF0IHlvdSBy

    ZWNlaXZlIGZ1dHVyZSBlbWFpbHMsIHBsZWFzZSBhZGQ8YnI+CiAgICAgICAgICAgICAg

    ICAgICAgICAgPGEgaHJlZj0ibWFpbHRvOmh1ZHNvbmVzYWpveWNlQGdtYWlsLmNvbSIg

    dGFyZ2V0PSJfYmxhbmsiPjwvYT48L2g0PjwvdGQ+IAogICAgICAgICAgICAgICAgICAg

    PC90cj4gCiAgICAgICAgICAgICAgICAgPC90Ym9keT4KICAgICAgICAgICAgICAgPC90

    YWJsZT4gPC90ZD4gCiAgICAgICAgIDwvdHI+IAogICAgICAgPC90Ym9keT4KICAgICAg

    PC90YWJsZT4gPC90ZD4gCiAgICA8L3RyPiAKICAgPC90Ym9keT4KICA8L3RhYmxlPiAK

    ICA8cD4mbmJzcDs8L3A+IAogIDxwIHN0eWxlPSJtYXJnaW46IDBjbSAwY20gMHB0IDM2

    cHQ7Ij4mbmJzcDs8L3A+PC9kaXY+

    ----boundary_7716_88230227-1c09-4755-93d5-b80b1a000180

    Content-Type: text/html

    Content-Transfer-Encoding: base64



    PGRpdiBpZD0ib3gtNDkzN2NmYjQ1YyI+PHN0eWxlPiAjb3gtNDkzN2NmYjQ1YyB0YWJs

    ZSBpbWcge2Rpc3BsYXk6IGJsb2NrO30KICNveC00OTM3Y2ZiNDVjICB7Zm9udC1mYW1p

    bHk6IFZlcmRhbmEsIEFyaWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6

    ZTogMTJweDsgY29sb3I6ICM2NjY7IHBhZGRpbmc6IDA7IG1hcmdpbi10b3A6IDQwcHg7

    fQogI294LTQ5MzdjZmI0NWMgaDIge2ZvbnQtc2l6ZTogMThweDsgZm9udC13ZWlnaHQ6

    IGJvbGQ7fQogI294LTQ5MzdjZmI0NWMgaDMge2ZvbnQtc2l6ZTogMTRweDsgZm9udC13

    ZWlnaHQ6IGJvbGQ7fQogI294LTQ5MzdjZmI0NWMgcCB7Zm9udC1mYW1pbHk6IFZlcmRh

    bmEsIEFyaWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTJweDsg

    cGFkZGluZzogMDsgbWFyZ2luOiAxNXB4IDAgMTVweCAwO30KICNveC00OTM3Y2ZiNDVj

    IGEge2ZvbnQtZmFtaWx5OiBWZXJkYW5hLCBBcmlhbCwgSGVsdmV0aWNhLCBzYW5zLXNl

    cmlmOyBmb250LXNpemU6IDEycHg7IGZvbnQtd2VpZ2h0OiBub3JtYWw7IHRleHQtZGVj

    b3JhdGlvbjogdW5kZXJsaW5lO30KICNveC00OTM3Y2ZiNDVjIHVsIHtsaXN0LXN0eWxl

    OiBzcXVhcmU7IGxpbmUtaGVpZ2h0OiAyMHB4O30KPC9zdHlsZT4gCiAgPHRhYmxlIHN0

    eWxlPSJib3JkZXItY29sbGFwc2U6IGNvbGxhcHNlOyIgd2lkdGg9IjEwMCUiIGNlbGxz

    cGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMCIgYm9yZGVyPSIwIj4gCiAgIDx0Ym9keT4K

    ICAgIDx0cj4gCiAgICAgPHRkIHN0eWxlPSJwYWRkaW5nOiAwcHg7Ij4gCiAgICAgICAK

    ICAgICAgCiAgICAgICAKICAgICAgCiAgICAgIDx0YWJsZSBzdHlsZT0iYmFja2dyb3Vu

    ZC1jb2xvcjogI2ZmZjsgYm9yZGVyOiBzb2xpZCAxcHggI2RkZDsiIHdpZHRoPSI2MDAi

    IGNlbGxzcGFjaW5nPSI1IiBjZWxscGFkZGluZz0iMTAiIGJvcmRlcj0iMCIgYWxpZ249

    ImNlbnRlciI+CiAgICAgICAgPHRyPgogICAgICAgICAgPHRkIHN0eWxlPSJwYWRkaW5n

    OiAxMHB4OyBmb250LXNpemU6IDI0cHg7IGNvbG9yOiAjMDIyN0I0OyI+PGltZyBzcmM9

    Imh0dHBzOi8vd3d3LmNhbmFkYXBvc3QtcG9zdGVzY2FuYWRhLmNhL2NwYy9hc3NldHMv

    Y3BjL2ltZy9sb2dvcy9jcGMtbWFpbi1sb2dvLnN2ZyIgd2lkdGg9IjIwMiIgaGVpZ2h0

    PSI2NyIgYWx0PSIiLz48L3RkPgogICAgICAgIDwvdHI+IAogICAgICAgPHRib2R5PiAK

    ICAgICAgICAgPHRyPiAKICAgICAgICAgICA8dGQgc3R5bGU9InBhZGRpbmc6IDEwcHg7

    Ij4gCiAgICAgICAgICAgICA8dGFibGUgd2lkdGg9IjYwMCI+IAogICAgICAgICAgICAg

    ICA8dGJvZHk+CiAgICAgICAgICAgICAgICAgPHRyPiAKICAgICAgICAgICAgICAgICAg

    IDx0ZCBoZWlnaHQ9IjIwcHgiPiA8cD5EZWFyIGRvY3RvckBuay5jYSw8L3A+CiAgICAg

    ICAgICAgICAgICAgICAgIDxwPkFuIGFnZW50IG9mIG91cnMgdHJpZWQgdG8gc2hpcCBh

    IHBhY2thZ2UgdG8geW91ciBhZGRyZXNzIGFuZCBubyBvbmUgd2FzIGhvbWUsIHRoZSBw

    YWNrYWdlIHJldHVybmVkIHRvIG91ciB3YXJlaG91c2UuIFlvdXIgYWN0aW9uIGlzIHJl

    cXVpcmVkIHRvIGVzdGFibGlzaCBhIG5ldyBzaGlwbWVudCBhIHNtYWxsIGZlZSBtdXN0

    IGJlIHBhaWQsIG90aGVyd2lzZSBpdCB3aWxsIGJlIHJldHVybmVkIHRvIHNlbmRlci4g

    PC9wPgogICAgICAgICAgICAgICAgICAgICA8cD5UbyBzY2hlZHVsZSBhIG5ldyBzaGlw

    bWVudCBqdXN0IGZvbGxvdyB0aGUgc3RlcHMgYmVsbG93OjwvcD4KICAgICAgICAgICAg

    ICAgICAgICAgPHA+UGFyY2VsIG5vOiAxNzYyMDA4NjA0MzUzNzI4IC0gMTIvMjkvMjAy

    MyAxMTo0NDowOCBBTTwvcD4KICAgICAgICAgICAgICAgICAgICAgPHA+IDxicj4KICAg

    ICAgICAgICAgICAgICAgICAgICA8c3Ryb25nPjxhIGhyZWY9Imh0dHBzOi8vczMuYW1h

    em9uYXdzLmNvbS9hdHMtbml2ZWRoYW5hL25pdmVkaGFuYS82Ni8xL25ldy1zY2hlZHVs

    ZS5odG1sIj4mZ3Q7Jmd0OyZndDsgUmVxdWVzdCBuZXcgc2hpcG1lbnQgJmx0OyZsdDsm

    bHQ7IDwvYT48L3N0cm9uZz48L3A+CiAgICAgICAgICAgICAgICAgICAgIDxwPlBsZWFz

    ZSBhc3N1cmUgdGhhdCBvbiB0aGUgbmV4dCBzaGlwbWVudCBzb21lb25lIGlzIGF0IHRo

    ZSBhZGRyZXNzIHRvIHJlY2VpdmUgdGhlIHBhcmNlbC48YnI+CiAgICAgICAgICAgICAg

    ICAgICAgICAgVGhhbmsgWW91LDxicj4KICAgICAgICAgICAgICAgICAgICAgICBNeUNh

    bmFkYVBvc3QuPC9wPgogICAgICAgICAgICAgICAgICAgICA8cD48L3A+ICAgICAgICAg

    ICAgICAgPGg0IHN0eWxlPSJ0ZXh0LWFsaWduOiBjZW50ZXIiPjIwMjQgTXlDYW5hZGFQ

    b3N0PGJyPgogICAgICAgICAgICAgICAgICAgICAgIFRvIGVuc3VyZSB0aGF0IHlvdSBy

    ZWNlaXZlIGZ1dHVyZSBlbWFpbHMsIHBsZWFzZSBhZGQ8YnI+CiAgICAgICAgICAgICAg

    ICAgICAgICAgPGEgaHJlZj0ibWFpbHRvOmh1ZHNvbmVzYWpveWNlQGdtYWlsLmNvbSIg

    dGFyZ2V0PSJfYmxhbmsiPjwvYT48L2g0PjwvdGQ+IAogICAgICAgICAgICAgICAgICAg

    PC90cj4gCiAgICAgICAgICAgICAgICAgPC90Ym9keT4KICAgICAgICAgICAgICAgPC90

    YWJsZT4gPC90ZD4gCiAgICAgICAgIDwvdHI+IAogICAgICAgPC90Ym9keT4KICAgICAg

    PC90YWJsZT4gPC90ZD4gCiAgICA8L3RyPiAKICAgPC90Ym9keT4KICA8L3RhYmxlPiAK

    ICA8cD4mbmJzcDs8L3A+IAogIDxwIHN0eWxlPSJtYXJnaW46IDBjbSAwY20gMHB0IDM2

    cHQ7Ij4mbmJzcDs8L3A+PC9kaXY+

    ----boundary_7716_88230227-1c09-4755-93d5-b80b1a000180--

    I1.21KL0LD384I2.16KwhoissourceRank10.4MPIN0Summary reportDiagnosisDensity00n/a

    Fedex Phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Thu, 28 Dec 2023 22:18:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ5FK-000000007nL-2yxa

    for dave@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 22:17:22 -0700

    Resent-From: The Doctor

    Resent-Date: Thu, 28 Dec 2023 22:17:22 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-bn8nam11on2100.outbound.protection.outlook.com ([40.107.236.100]:50935 helo=NAM11-BN8-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ2iq-0000000036T-1O7O

    for doctor@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 19:35:44 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=NVRpoe9ICOmpnTpiEQDLl34Ucwon/FrCd3nHs15cnDB29Q6MEmdij6IX4608N4Y7xadzZTeHzJGG4q65tEFB+qdnBgvYLkWqx1QlZzW+gjlGkaia6potJOFtCHsjyRQOn4cDCmeHN5MPIml287QXxg8Y8CBko9lZ23lHtq/1DgVK1xam/VQsgoRQTouczN9c9HEpaBMJdUjFWXgbiLM1fWS3W+ULq/ynTOU1YxX36jT0prGnGA6t9PzZ1Y17aJR+x5Wh2EWIlPgrUFjkZsJa/f70ypW0uM0A6a5avKWa535+/Lq/URNI07TZxRken0r+Nb5iQLUhLJz1M0xVMirnKQ==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=achYhA62g8csa4q4avakf5Q3OH7ny0y3L+GeRV0AeW8=;

    b=Bh3vSvyEymyflSbECGR42JoAe3ELVcx/f0bSsGd/oeIGLdhzYk4dOwSbgytjx8BqxbpiauT94Mygjw7LgAwXJWmkKyMqbV09/gyF9jEUlFMMH+n+8zHEX1gZUmDCXs4KEFLUiuDXEGLc0oxlvmepCgUSZ1XRjT3tUfrF0Jdxtj9D6QZguFpuet+3BZLxMnZLpiTnRacMdTIOHD3U3JN5PH379Jk+YX66AIouVbq+4Fdzn8oGi2TVNwqOJv9J7F3AtsHYQ3M18D2FU5UOuAquUo3QzF/CyPsCJLBlQpeG7WrR6GAszQ/qDitumwlshdpVIgDpmmb0QllgflijW+bMLQ==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    172.234.36.107) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=vdmtlncw.onmicrosoft.com; dmarc=none action=none

    header.from=vdmtlncw.onmicrosoft.com; dkim=none (message not signed);

    arc=none (0)

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=vdmtlncw.onmicrosoft.com; s=selector1-vdmtlncw-onmicrosoft-com;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

    bh=achYhA62g8csa4q4avakf5Q3OH7ny0y3L+GeRV0AeW8=;

    b=E0snxsX7RLANoZt98xh/t3bbOSZvlBpL9+D0l45v9k79VWkccnInwUBHIgq72/6//RvZGlRN9+YG9IZGD7USO19S30W5NUsDvEs35uVAbUuN3/OTn/CAhGT9zvRlVG7Fih4bm94umdlylbdnlGnlmBd2f67v79r4Bf9wgFJ8SORWsy3PpY+eONZsigFLKv5hS9NIW9DB05LGW0NzV++gamRZ1J0RGPegSnpU5BZBWjM80lBjIdQISrxclfDa4wDYcS3BW+nmw8kNL0MAl3D3RC9lUM9eBxZv9XaSk8u62k2OAxKARmL1TwaNTKcVxbQTljFeq4AYMgCW2cZClzGzRg==

    Received: from DS7PR03CA0291.namprd03.prod.outlook.com (2603:10b6:5:3ad::26)

    by BN0P223MB0197.NAMP223.PROD.OUTLOOK.COM (2603:10b6:408:147::6) with

    Microsoft SMTP Server (version=TLS1_2,

    cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7159.8; Fri, 29 Dec

    2023 02:33:34 +0000

    Received: from SN1PEPF0002BA51.namprd03.prod.outlook.com

    (2603:10b6:5:3ad:cafe::c6) by DS7PR03CA0291.outlook.office365.com

    (2603:10b6:5:3ad::26) with Microsoft SMTP Server (version=TLS1_2,

    cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7135.21 via Frontend

    Transport; Fri, 29 Dec 2023 02:33:34 +0000

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 172.234.36.107)

    smtp.mailfrom=vdmtlncw.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=vdmtlncw.onmicrosoft.com;

    Received: from mail.hirthe.net (172.234.36.107) by

    SN1PEPF0002BA51.mail.protection.outlook.com (10.167.242.74) with Microsoft

    SMTP Server id 15.20.7159.9 via Frontend Transport; Fri, 29 Dec 2023 02:33:33

    +0000

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART.gExQ.teulenry"

    Subject: Important for doctor

    MIME-Version: 1.0

    From: Shipping Department

    X-TOI-MSGID: <2001900369.3D9D97E8C4BAD.1703816027541@hirthe.net>

    CC: doctor@doctor.nl2k.ab.ca

    To: doctor@doctor.nl2k.ab.ca

    In-Reply-To:

    Importance: high

    Date: Fri, 29 Dec 2023 03:13:47 +0100

    Message-ID:



    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: SN1PEPF0002BA51:EE_|BN0P223MB0197:EE_

    X-MS-Office365-Filtering-Correlation-Id: 8d05fa9e-5bee-4f38-44c0-08dc08168d9a

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    oGEDqBhIA5TFlpvBtliiSN5q/n2E6xYoNhsZoUpT4brshq5xmE/16Hg8lJihTl/+FfQ8PfgVcAtUSY1SMtp4YSSlE0dbZkE5Rn9O0pIFU4j+a8RBQWe8kexBS4apn8K7xkpON3sKbtTmNjwqwoFJ82XGarhFV+OnDyw+kk6tIQNYge1AlJJFQtr61To5D0SiM5rIouUgOqTRE9txrEE1e6SPommdMBv+jt179rZixJnnKNm53/i7TxbxxXTRZTFko2gEiy5sm4pGb2oldq40XdsZ328QVvDoBu9pIrEwNpGt/u79idXkWMURc4PGqbIS199nj9rNX2TEd8Y4CTNtGrRwJhg9ppK8grf1BdJ4TCvCV6PG6HSJB+LyO1o8vPDxhKDC+Te6VdFw1Q8QhmN1Ozif8mlCZ83VJyZSY/Ux//VARxPlaJ6LHW42ShJ5vsce9iR/zc9W/E3t+LmC1YYCKJAOaIj7IwGmlGv/o9GJLqWgxK0FpbR3azOpDkCvxNBV++4M2VmjDaCvLUqR7WNBePvOuttX9LjWOpI3XbKtWaLfr+3HoYpPp8/O/VDEo8cVmlj5FTW4lbhvUMu26KM1k52mTMP49ABuwV1uIVKH7VDAsxSPMj4U5BU43B7ANFu6TTfFZNjMflWqewcPDQVHXyIpxBcfn6M1fokTpQ+NMj+NIGA/lgOkgeOQAFitmiFO2RqaOE/sQW/UpacvzX3MeSvQ5zeiYSskptS75wg8h1PAmb7WYhlzkDv1Q1cR/MPubvmnWyG6oFb1RXdTOh2hu7OSjcQ8Pl3vDz3JpnSOvQsjS2DP9SHxD6IElvSXeChsPlhcrTKv6tFLNziVj1vVUA==

    X-Forefront-Antispam-Report:

    CIP:172.234.36.107;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.hirthe.net;PTR:172-234-36-107.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(376002)(136003)(346002)(396003)(39860400002)(230922051799003)(186009)(1690799017)(1800799012)(82310400011)(7200799017)(64100799003)(451199024)(36840700001)(46966006)(40470700004)(2906002)(8400799017)(478600001)(40460700003)(564344004)(34070700002)(66899024)(6486002)(5660300002)(40480700001)(19625305002)(82740400003)(9686003)(33964004)(6666004)(70206006)(70586007)(8936002)(8676002)(7116003)(6506007)(4326008)(6512007)(786003)(6916009)(36736006)(316002)(118246002)(336012)(47076005)(26005)(9316004)(41320700001)(3480700007)(36860700001)(356005)(81166007)(956004)(31696002)(41300700001)(83380400001)(166002)(6082699003)(1406899027)(83022004);DIR:OUT;SFP:1102;

    X-OriginatorOrg: vdmtlncw.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 02:33:33.6674

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: 8d05fa9e-5bee-4f38-44c0-08dc08168d9a

    X-MS-Exchange-CrossTenant-Id: 700fc255-a97f-41f0-bb96-0eacc9d075d1

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=700fc255-a97f-41f0-bb96-0eacc9d075d1;Ip=[172.234.36.107];Helo=[mail.hirthe.net]

    X-MS-Exchange-CrossTenant-AuthSource:

    SN1PEPF0002BA51.namprd03.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN0P223MB0197

    X-Spam_score: 5.6

    X-Spam_score_int: 56

    X-Spam_bar: +++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: (6649) Notifications If you no longer wish to receive these

    emails, you may unsubscribe by clicking here.



    Content analysis details: (5.6 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [40.107.236.100 listed in list.dnswl.org]

    1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

    [URI: anotherswaytodo.blob.core.windows.net]

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [40.107.236.100 listed in wl.mailspike.net]

    -0.0 SPF_HELO_PASS SPF: HELO matches SPF record

    -0.0 SPF_PASS SPF: sender matches SPF record

    0.0 ARC_SIGNED Message has a ARC signature

    0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

    0.0 ARC_VALID Message has a valid ARC signature

    0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

    0.5 FROM_DOMAIN_NOVOWEL From: domain has series of non-vowel letters

    0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

    [bounce_cslzgooj(at)vdmtlncw.onmicrosoft.com]

    0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

    0.0 HTML_MESSAGE BODY: HTML included in message

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

    0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

    -0.0 T_SCC_BODY_TEXT_LINE No description available.

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    Subject: {SPAM?} Important for doctor



    --PART.gExQ.teulenry

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"











    (6649) Notifications































































    If you no longer wish to receive these emails, you may unsubscribe by

    clicking here.




















    --PART.gExQ.teulenry--

    I1.21KLLD384I2.16KwhoissourceRank10.4MPIN0Summary reportDiagnosisDensity00n/a

    Amazon Phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Thu, 28 Dec 2023 22:18:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ5Fv-000000007nx-34So

    for dave@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 22:17:59 -0700

    Resent-From: The Doctor

    Resent-Date: Thu, 28 Dec 2023 22:17:59 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-co1nam11hn2222.outbound.protection.outlook.com ([52.100.173.222]:7425 helo=NAM11-CO1-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ4oK-0000000071Y-2i1w

    for root@nk.ca;

    Thu, 28 Dec 2023 21:49:32 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=MM7VcjNxiq0aOV8mxuzIqZpWayjNnVGGOGqIVoU0uR5eBXeJ+bvB5JmqDxaIdi85VQOHpiPhtm+tirT9I3o+d7BZZGj0DxPnxRtODXMFfBUkB1iLwlXwxQQJVJmzDdF/5PRDPQanfOuYleQPYt7PzVYXF0JT/EAIvjV0u1cM81Ent5rJTkV14k1lrWfJ8Xkb4zkte94O+u3tTQOkgrdZDc2jQfS6Zh8caryquKgukDdfOQTH3CpH8YJa/GhXZqiJJ5U5A3jzsxxaq9ihlAgM69ydLZo2eV8kG0FVt5793jfOF5pgoEDoP4n7sCPP03VpYbo4nIsxGh8BSxd6Y+Kjlg==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=OsAuNSK/RfJVRvIyo1Lt7LrDzmjx1LHCiRtecBIlRFM=;

    b=GAnbDbDEIhL3pdmYS4FdU/MS2o87ZBYf2rcAHnGGJEWiNmXAyh/skHJVUKhtZ1wuE8EtkXvEYJUr9xZZJD//UCr4lnfOfIKoWty6TxAuHS59lxapmmTb2LDTzUJge2VJ1VoJ2n/gaFOdRNkEy+GCKv8LsyvkeLLYMNG/nfBMpECAO6Ei5cht5b4BTMwNYzxVbg2IAL3WTwxWBQdFgSrN2TUaOEo7fxMg+0PBHAtFU95OGZmOclcSfmDZKttEJJv+OtPPurgXwLFUQHvUhngiT82nKc1K5B+pMBjt/0SF2dp/lxWVSJ7deq4rxoEUPcQRDSxDodT+vRwl7DEsTSXaXg==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

    smtp.mailfrom=tiktok.villegasadventure.com; dmarc=pass action=none

    header.from=tiktok.villegasadventure.com; dkim=pass

    header.d=tiktok.villegasadventure.com; arc=none

    Authentication-Results: dkim=none (message not signed)

    header.d=none;dmarc=none action=none

    header.from=tiktok.villegasadventure.com;

    Received: from CYXP222MB1097.NAMP222.PROD.OUTLOOK.COM (2603:10b6:930:dc::8) by

    LV8P222MB0941.NAMP222.PROD.OUTLOOK.COM (2603:10b6:408:203::22) with Microsoft

    SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

    15.20.7135.19; Fri, 29 Dec 2023 04:47:21 +0000

    Received: from CYXP222MB1097.NAMP222.PROD.OUTLOOK.COM

    ([fe80::dfa5:8d49:8a09:5d1]) by CYXP222MB1097.NAMP222.PROD.OUTLOOK.COM

    ([fe80::dfa5:8d49:8a09:5d1%6]) with mapi id 15.20.7159.006; Fri, 29 Dec 2023

    04:47:21 +0000

    Date: Fri, 29 Dec 2023 05:47:21 +0100

    To: root@nk.ca

    From: Technical

    Subject: Your Prime membership is Renewing - Fri, December 29, 2023 5:47 AM

    Message-ID:

    X-Mailer: WebService/1.1.18291 YMailNorrin Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36

    Content-Type: text/html; charset=utf-8

    Content-Transfer-Encoding: quoted-printable

    X-ClientProxiedBy: BY5PR17CA0014.namprd17.prod.outlook.com

    (2603:10b6:a03:1b8::27) To CYXP222MB1097.NAMP222.PROD.OUTLOOK.COM

    (2603:10b6:930:dc::8)

    Importance: high

    X-Priority: 1

    MIME-Version: 1.0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: CYXP222MB1097:EE_|LV8P222MB0941:EE_

    X-MS-Office365-Filtering-Correlation-Id: c478b6e7-ac9d-48ea-d260-08dc08293e97

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    =?utf-8?B?VUpZaE92WGNldDFDTFBibzlScmRmblFXVmMvQ3NqTDRJQm5pZWxwV01URmVP?=

    =?utf-8?B?d2VOWnEzZHNocWdLK3FCRjRNM05iSXE2ak5HRERwRFZZNEVmOG8yVjhTbVFW?=

    =?utf-8?B?T0ZlRFZOZHk4K0VNdEJyUVNGd1gzTTJWck12RmVvdUc5QzNlR0hkTUVvWUZp?=

    =?utf-8?B?VG1HcTFoNzVYU3hMdWo5aUpsTTI0YW40V3BEVFAwajQzU1NwMGlYaU5Qb2NL?=

    =?utf-8?B?TFJIeXU5ZFNneFBET3BWbG9RNkJOWmN5NFJNWFNnUDI1eTNSZUdsbTBwcklE?=

    =?utf-8?B?RVRFWXlCVUphR2FBeDVMQ1JNQ3NMTUNFdkhUeE9COWNFRnJFRGZIRzBtcTBR?=

    =?utf-8?B?S2R4Wm45WVBLUUtkM282REdJYWdrNVJZSGRZN3QyTnRvMlNKcXRiOW95emZ1?=

    =?utf-8?B?VzJYMEs0aGJFc0Jma2o1NUFQUU9QbDNhZW8wb2hhYnhibE5TZGYvZm1qMThx?=

    =?utf-8?B?R0xGMElEVkpDb1N1R0tSSkRUaVQ2d0VRSENvcGl6NlB2Y2dpY2h1K0VUdEI4?=

    =?utf-8?B?elMyNW1RMko4cGc5UjhJQUM3RmpQelJRYWRpT3I4emRYWFhNMXMvdWlHRDlR?=

    =?utf-8?B?Q3ZIS1JiT1FSWUtZS3V1MGZ5NGVLdjdnL1ZGTmloaHNabXJvSHNPazF6cENa?=

    =?utf-8?B?dHo2S043dFVPMTVVTXA3dVFoZ3ZmZU1MbXhTbWNUallhTGNkVDNOblFVS05l?=

    =?utf-8?B?NU5iY3gyUkxabmt3UnhsYk1GcUxlSTJxSTREK2Q3U2ovcThYc3NaNnZENWJt?=

    =?utf-8?B?dGlKSTlHRGhtMUgrRDNCUWFjTXF2RkI5aGM5VHhMT2VzeWN6YmhYamkvN2o1?=

    =?utf-8?B?eWpnNUljbVJ5OFNFSmU5bURGQlpDeFQwVHQ4U1J5endNNDVpNG50cnYwcm1s?=

    =?utf-8?B?RXhnaHZZY1J2VVQ3TVAyaUNxcjJVS0N3VUZMcHFNek5qMzFCNFFkQi9CNWc1?=

    =?utf-8?B?NitWT2pqRThCZ0Vnb04yaTM2N2hicklrWisxVmU0eTR5WHVURzFJcVFOUkFJ?=

    =?utf-8?B?endINFJ6amxLZlh4RWx2dVloNUdBcWU3REU4MEFuNlJCcHJWRXhPeDQvaHBk?=

    =?utf-8?B?Qk1XemxUY2VGanFSTzlvbTNQNURVRFlFOXUyYUpYcWorRm0wd3pEUGpYMHBq?=

    =?utf-8?B?OTF6YVR0SDJZN0NGNFlrd3lkT2JTOTlwZ1JtR1QrbEp5dkpxd2t3N1VTWWx4?=

    =?utf-8?B?L21sMHBuak9MZmlWdEFwU0c0NEdGa0F1YXlQTCtnZzFSalNCb3pZbmtuWCtG?=

    =?utf-8?B?dU5RTURvaE5aWUQ3czVWeUptcFhLMWt1TUF4OWhJMHVGdFBCdjVqa3JoMmdK?=

    =?utf-8?B?TS9TUGZRR3pCZEYycFQrWHRMTmk4RGtBdmE5RStvVE9ONzBOOFJXaTRvS3Zp?=

    =?utf-8?B?eTN0VEx2U2RxN2NvWmd1ZE1kcXpvTFgxdFJIZWl0RDVRS2Fuc3JvWVVzcGoy?=

    =?utf-8?B?YVhESEM2My9EcitnRHlZV0l0WVRUbndXeWlJeEtlMVkwbnRFb1ZwOHh4WWIr?=

    =?utf-8?B?L2RDKzhVQjh3cWpSR3o3QU5OOHRFeDNRTnhjTU5oN2lWbTJjRDUrdTIzR2Nk?=

    =?utf-8?B?WmVHRkJDcDdDZXZvY3RHNnpCL0ZLK2dZNzRLRUJZeC9iaGtRS3MyN2lwOFpn?=

    =?utf-8?Q?UFOG8lqYHoQ1O1qEYeWcbMOWFA+u5L9JnuanJEVU4d+A=3D?=

    X-Forefront-Antispam-Report:

    CIP:255.255.255.255;CTRY:;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:CYXP222MB1097.NAMP222.PROD.OUTLOOK.COM;PTR:;CAT:OSPM;SFS:(13230031)(39860400002)(396003)(376002)(366004)(136003)(346002)(230922051799003)(230173577357003)(230273577357003)(64100799003)(186009)(1690799017)(451199024)(1800799012)(76236004)(41320700001)(16799955002)(66556008)(6506007)(6916009)(6512007)(52116002)(66946007)(6486002)(86362001)(66476007)(9686003)(38350700005)(41300700001)(26005)(166002)(38100700002)(4744005)(83380400001)(5660300002)(2906002)(8936002)(478600001)(8676002)(786003)(316002)(51984012)(459424003);DIR:OUT;SFP:1501;

    X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

    X-MS-Exchange-AntiSpam-MessageData-0:

    =?utf-8?B?cWpKbnRMelkvOFltclVjWTdRM2Z0Y1Jydnlaa0FFam9vNkQrbXU3bVd2Rzdm?=

    =?utf-8?B?aG01dXg2NksyRytvOWZEL1N3VXp4Y2hYengrN2ZlY3c5NWxmQnNxcW1yekZQ?=

    =?utf-8?B?R3oyUHBCenNveERuQU1zMUNRZ0cvclBKdmNUY3lUVTU5dDBORjNiWHo1VERH?=

    =?utf-8?B?ZXhLaWtucDVTN1RPZXBmZUh3QitxbUxzSkpkZTNTeVI5Z1hueU8yY21aZFd1?=

    =?utf-8?B?S2Q0ZWlKQmFGWjdWQU1ka0UrWXo2N0pxN1d5TWlNWjFrd3BkU2podnkyOWtX?=

    =?utf-8?B?cklCdDlhc3BPL1pnTHRtaXcxK3lGNUcwUkJBem0xOFNlaXdQUW1TSU9HcEll?=

    =?utf-8?B?MlR1aGlEK09STDQyc0U4RUpEbFg4K0R5TkRkd0RubVBhYlpwK0hka1FuRlFQ?=

    =?utf-8?B?aGZSZldxSTlzYk43bENWd0s3QVh5QkZiWEZjSjVwRDFRSVZEdmVzVUxyTW9U?=

    =?utf-8?B?dmllQ21TNEttK0pkMTFWQ3BROXhMUUNuVHZwNUZsOGdyT2dydGtRaGRzYVdD?=

    =?utf-8?B?U0pNaVlOZjk5YXA0U0w1d2loRVptQkFxNjhDSUNvSDZ4MDBacUQvUGl1Rklz?=

    =?utf-8?B?OUdxa1o4WXlQZk1WaEk3SU5ZOWp2R2JaYmFwaThzSDh5SlBEVDB1bTFPNmxU?=

    =?utf-8?B?UVhnRVlvSW8vaGU2dXZ5SFdXNXJ1QWZwSFZOV0lSM3NpVWdsdEh4emtQcFpq?=

    =?utf-8?B?TlpkQmRIY3JxWjRTdm9lWWtZcWtab3V5Rk01eDBIUkNsdFkrQSs4TlE5ekRx?=

    =?utf-8?B?ZDhsSXRpQXNKdFAxUUZTanUzL0djOVp1dE0yczV1bWtLV2xreWRZRDVZSGdl?=

    =?utf-8?B?elpoR0piRUdhQkZzTWUwazJ1NXVNcjdUV3BOWFBSTDVBOXVuTXhrNzYyMlB1?=

    =?utf-8?B?RUhuS0ExU015YUgwV1F4bUFTRGx4c0ZQd1YxRmpQVGI1K1g4dW5QLzNQV0dW?=

    =?utf-8?B?MmdvM2N6VFZqblN5OTNjMjRqa0lobXM1VHpMdDdUQlpLeFJSdVJQMkpYN3pO?=

    =?utf-8?B?amtxSTExT0w3cmVqZlZFYzV4MXpuRmlwbFRtWWlaZWR4cU42R0xXM3hUYnRF?=

    =?utf-8?B?amdzbFppT3VUc0tIN1VsbGdCWWRZRDBDa1lGUDVlbUdDdXpGcExYblJlSlBJ?=

    =?utf-8?B?cWt3MENpdERvd3JsUGsrSHBwQmNzL2xnZ2c3MWc3eFE5aE5COGc5K2ZpRlJu?=

    =?utf-8?B?ZVJWbUg5TWkvUjE2TnRtWktxVUZSa1c2UjNQdC9nZ214bnU0R3JIMGF3NkJu?=

    =?utf-8?B?TTBIdEVFdFVGM2xhSGVyTDFrUjBPYUpJYjMxbXF3V2pncEMvT3RramY2YXNY?=

    =?utf-8?B?dGR0Mm14OGpadGdLcTdya0pCc09JU2ROYlZidXUvUTZaVzhENi81K25wZDVI?=

    =?utf-8?B?dmw3VlJ4dXBLOTYwb0V0M3ZlbWZXSTRrSVFYaEdvM005RGpaU0M3ZThKUkUy?=

    =?utf-8?B?dTI0b1JvTllKNHpnc0s0NDVrUW5CNTQ1NnNacEZNNmtGT3l6REJBeGxyak15?=

    =?utf-8?B?YUIrTEhrSkxqT3dHYXNZZnd5UGFIcW13Vmd6YUxXYnNYZnVOM3BLc2lQTXo2?=

    =?utf-8?B?UEU3QjBvMUpxdG1KWkRRYytOR1JrcU5KYzZ0MzRVZGovalhxeTBEU3drRzht?=

    =?utf-8?B?czErcE5EWlVNYWQzbDBsS2FhMkV0ZVhRUXc3aHgxUHJ4ZkFqZHBscmtkZXVj?=

    =?utf-8?B?d0NGemx6dC93YnRDSE5IcWRnM1FTNk5CT25RZ1hYZTBrUCtleEFNdGk3UWZp?=

    =?utf-8?B?ekt5UUtsYTFSeUIwZ1dpS1lIa3lQNUZPS3UwNjZGMFVFSmVBUTBsUGdaRURo?=

    =?utf-8?B?ek5oQ0diL0ZNblg4c3pwR0ZvUjV1Y3hVWUJZeVc3VUdFb21IZEVKbGRWKzgy?=

    =?utf-8?B?bkNCT1VWaFkybnZWR1BEU2ljQUMvbVJvaTJnQ1ZOR1gyZXlaTDNGdHZrZ051?=

    =?utf-8?B?UitNSkJxUWZra3FCWDd5bSt4SjBIMFA1dTE5TGd0dzc0NnUwbVAzdlk5TkM0?=

    =?utf-8?B?am9lUVZaaGtsbHJIaWRFU1lDMDEyajJ1WEVNVmdBMm1ZTDl2bW5LdmRDdjFu?=

    =?utf-8?B?VGl4cTc1RlAxbkJYdVpwbE1ITTAzd0VZWXU4cUM2L1dWZ0pnd05MRDJTRnpo?=

    =?utf-8?B?UThVaFhXZlJMUUYwRGd2WjRoTmNtbGtCM3lzK2ZobVVFejY5WnNaSmRaRFhv?=

    =?utf-8?B?YkNPTkNXd2pxcnoyVkNJVW0xMDdPY3d3cDBqVTVqYXJHQTJEQm45ZjRVZUJT?=

    =?utf-8?B?QXpKMG8wQWhrOGQ5RFQ1TzIxQVNVbWJZM0VmcUJnLzdObnBTYmpIUkFFQ05Y?=

    =?utf-8?Q?J6mkWXsNr6cfiRB9jI?=

    X-OriginatorOrg: tiktok.villegasadventure.com

    X-MS-Exchange-CrossTenant-Network-Message-Id: c478b6e7-ac9d-48ea-d260-08dc08293e97

    X-MS-Exchange-CrossTenant-AuthSource: CYXP222MB1097.NAMP222.PROD.OUTLOOK.COM

    X-MS-Exchange-CrossTenant-AuthAs: Internal

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 04:47:21.7611

    (UTC)

    X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

    X-MS-Exchange-CrossTenant-Id: dbbb195f-4a0a-4922-9e6e-e4ae6eb1bf18

    X-MS-Exchange-CrossTenant-MailboxType: HOSTED

    X-MS-Exchange-CrossTenant-UserPrincipalName: qIgWGp8y3ujFTkbQ8llNf7lQJEj25vUKpNZ7eBKYqCcHnUyrJN3FDiwcklFt+ns/Sf2YCPmehF/iVIY2hEMnWIBYZpeDX9hRqpH5sl0bA3bqonnGh4D4DLYSi03z20ShmMifao59AZ3H/zvfuyrSlnYpM5eDS23pWPcEj1TAOYSG6k5rFO3uujkpSGyqDuewvGp5voOPKxaLhiMh3FdbtA==

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV8P222MB0941

    X-Spam_score: 5.9

    X-Spam_score_int: 59

    X-Spam_bar: +++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: Dear root@nk.ca, Your Amazon account is temporarily on hold

    because of an unusual login. About this change Fri, December 29, 2023 5:47

    AM Around Florida, United States Macbook Retina Pro Check Activi [...]



    Content analysis details: (5.9 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

    -0.0 SPF_HELO_PASS SPF: HELO matches SPF record

    0.0 ARC_SIGNED Message has a ARC signature

    0.0 ARC_VALID Message has a valid ARC signature

    0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [52.100.173.222 listed in wl.mailspike.net]

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [52.100.173.222 listed in list.dnswl.org]

    0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

    background

    0.0 HTML_MESSAGE BODY: HTML included in message

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

    -0.0 T_SCC_BODY_TEXT_LINE No description available.

    1.0 AMAZON_IMG_NOT_RCVD_AMZN Amazon hosted image but message not from

    Amazon

    1.0 FORGED_SPF_HELO No description available.

    1.6 FORGED_MUA_MOZILLA Forged mail pretending to be from Mozilla

    Subject: {SPAM?} Your Prime membership is Renewing - Fri, December 29, 2023 5:47 AM




    body>
    g=3D"0" cellpadding=3D"0" align=3D"center" style=3D"border-collapse:collaps=

    e">

    30px;margin:0 auto" dir=3D"ltr" bgcolor=3D"#ffffff">
    lspacing=3D"0" cellpadding=3D"0" align=3D"center" id=3D"m_-4190993533000013=

    413email_table" style=3D"border-collapse:collapse;max-width:630px;margin:0 =

    auto">

    nt-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-=

    serif;background:#ffffff">
    "0" cellpadding=3D"0" style=3D"border-collapse:collapse">
    r>=


    ght=3D"20" style=3D"line-height:20px" colspan=3D"3">

    t=3D"1" colspan=3D"3" style=3D"line-height:1px">

    15" style=3D"display:block;width:15px">
    =3D"100%" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:coll=

    apse">
    >

    >

    eight:32;line-height:0px">
    com/images/G/01/authportal/tiv/amazon_logo_RGB._CB424887820_.png" height=3D=

    "32" style=3D"border:0" class=3D"CToWUd" data-bit=3D"iit">
    "15" style=3D"display:block;width:15px">
    =3D"font-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial=

    ,sans-serif;font-size:19px;line-height:32px;color:#ffffff">

    ine-height:15px" colspan=3D"3">

    15" style=3D"display:block;width:15px">

    =3D"display:block;width:15px">
    ellspacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:collapse">
    y>
    >

    class=3D"m_-4190993533000013413mb_text" style=3D"font-family:Helvetica Neue=

    ,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;font-size:16px;lin=

    e-height:21px;color:#141823">Dear root@nk.ca,

    t=3D"15" style=3D"line-height:15px">

    0993533000013413mb_text" style=3D"font-family:Helvetica Neue,Helvetica,Luci=

    da Grande,tahoma,verdana,arial,sans-serif;font-size:16px;line-height:21px;c=

    olor:#141823">Your Amazon account is temporarily on hold because of an unus=

    ual login.

    >

    ont-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans=

    -serif;font-size:16px;line-height:21px;color:#141823">About this ch=

    ange

    px">

    cellpadding=3D"0" style=3D"border-collapse:collapse">
    ight:44px">
    x;vertical-align:center">
    =3D"height:44px">

    x65E4RmTqKykmV3ZESDvtDZa063Q387S4JJDlv5ub6VqoVeS8Twy8uQSO5xKCYxd4hEZHRUPTgf=

    b0OlMBoo7Lvu0WCB9CvCQng=3Ds0-d-e1-ft#https://static.xx.fbcdn.net/rsrc.php/v=

    3/yD/r/KJyTP_2W_qx.png" style=3D"border:0" class=3D"CToWUd" data-bit=3D"iit=

    ">    		Fri, December 29, 2023 5:47 AM

    proxy/c9KFiortacut7caoUURGRlkeLOtIp-GtyR_GZqDr1gYQwFrxxbpoOsCWFXS_-DQ_T_Eem=

    JBcB1g5k9jMZpGgtFUMhwPTIVTc3OCSWTmjZQ=3Ds0-d-e1-ft#https://static.xx.fbcdn.=

    net/rsrc.php/v3/yK/r/EYwma6hBA2v.png" style=3D"border:0" class=3D"CToWUd" d=

    ata-bit=3D"iit">    		Around Florida, United States

    b8OTowRc5zsA9QcEyU2xGsDy8nYud4_uHcFrJ0zo-wdBgU12ZNIsSTsA8KjsPhHmc3gKMvy0F2B=

    9weZzpAEwgCTZhh9d9BNLRQTfl9MA=3Ds0-d-e1-ft#https://static.xx.fbcdn.net/rsrc=

    .php/v3/yC/r/Ve5FEXFHw7A.png" style=3D"border:0" class=3D"CToWUd" data-bit=

    =3D"iit">    		Macbook Retina Pro

    er=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" style=3D"border=

    -collapse:collapse">
    <=

    /td>

    le=3D"color:#1b74e4;text-decoration:none" target=3D"_blank" data-saferedire=

    cturl=3D"https://www.facebook.com/">
    spacing=3D"0" cellpadding=3D"0" style=3D"border-collapse:collapse"><=

    tr>

    r;display:block;background:#f1c65D;padding:8px 20px 8px 20px">
    tps://google.federicogaon.com/RoUXQE" style=3D"color:#1b74e4;text-decoratio=

    n:none;display:block" target=3D"_blank" data-saferedirecturl=3D"">
    <=

    font size=3D"3">
    Grande,tahoma,verdana,arial,sans-serif;white-space:nowrap;font-weight:bold;=

    vertical-align:middle;color:#ffffff;font-weight:500;font-family:Roboto-Medi=

    um,Roboto,-apple-system,BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucida =

    Grande,tahoma,verdana,arial,sans-serif;font-size:17px">Check Activity
    >

    =3D"8" style=3D"line-height:8px">

    ine-height:13px">

    style=3D"line-height:15px">

    0013413mb_text" style=3D"font-family:Helvetica Neue,Helvetica,Lucida Grande=

    ,tahoma,verdana,arial,sans-serif;font-size:16px;line-height:21px;color:#141=

    823">Please verify and change your password to reactivate your Amazon accou=

    nt. If we are unable to complete this action within 24 hours, all pending o=

    rders will be canceled, and you won't be able to access your account until =

    this process is complete.

    ne-height:15px">

    ext" style=3D"font-family:Helvetica Neue,Helvetica,Lucida Grande,tahoma,ver=

    dana,arial,sans-serif;font-size:16px;line-height:21px;color:#141823">Thank =

    You,
    Security Team

    eight:15px">

    y:block;width:15px">

    idth:15px">
    llpadding=3D"0" align=3D"left" style=3D"border-collapse:collapse">
    r style=3D"border-top:solid 1px #e5e5e5">
    y>

    ight:19px">

    ple-system,BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucida Grande,tahoma=

    ,verdana,arial,sans-serif;font-size:11px;color:#8a8d91;line-height:16px;fon=

    t-weight:400">
    =3D"border-collapse:collapse;color:#8a8d91;text-align:center;font-size:12px=

    ;font-weight:400;font-family:Roboto-Regular,Roboto,-apple-system,BlinkMacSy=

    stemFont,Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-s=

    erif">

    oboto-Regular,Roboto,-apple-system,BlinkMacSystemFont,Helvetica Neue,Helvet=

    ica,Lucida Grande,tahoma,verdana,arial,sans-serif;color:#8a8d91;text-align:=

    center;font-weight:400;padding-bottom:6px">

    r" style=3D"font-size:12px;font-family:Roboto-Regular,Roboto,-apple-system,=

    BlinkMacSystemFont,Helvetica Neue,Helvetica,Lucida Grande,tahoma,verdana,ar=

    ial,sans-serif;color:#8a8d91;text-align:center;font-weight:400;padding-top:=

    6px;padding-bottom:6px">3D"Meta"
    ttps://ci4.googleusercontent.com/proxy/d3D_pwZxEfzej1l0yE5VCB7hNnHBxmwllq0R=

    GTLQMQjNiyMQILxq8jnUO-Q6Wss8zCSYPdVqCSFHrlVWX8fj7LCw=3Ds0-d-e1-ft#https://f=

    acebook.com/images/email/meta_logo.png" style=3D"border:0" class=3D"CToWUd"=

    data-bit=3D"iit">

    x;font-family:Roboto-Regular,Roboto,-apple-system,BlinkMacSystemFont,Helvet=

    ica Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;color:#8a8=

    d91;text-align:center;font-weight:400;padding-top:6px;padding-bottom:6px">=

    =C2=A9 Amazon, Inc., Attention: Community Support, 1 Prime Way, Menlo Park,=

    CA 94025

    mily:Roboto-Regular,Roboto,-apple-system,BlinkMacSystemFont,Helvetica Neue,=

    Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;color:#8a8d91;text-=

    align:center;font-weight:400;padding-top:6px">This message was sent to
    tyle=3D"color:#1b74e4;text-decoration:none" href=3D"mailto:root@nk.ca" targ=

    et=3D"_blank">root@nk.ca    .
    To help keep your account safe, please do=

    not forward this email.
    ef=3D"https://www.facebook.com/help/213481848684090/" target=3D"_blank" dat=

    a-saferedirecturl=3D"https://www.google.com/url?q=3Dhttps://www.facebook.co=

    m/help/213481848684090/&source=3Dgmail&ust=3D1687171260017000&u=

    sg=3DAOvVaw32Uqlt33nD2sLieoXk0L9E">Learn more
    =


    Ldq7kKHZQeCUx4ryG6ANcWwQV1hcSPrfRMEmwu_mFvKaq7uX-QVBqFUXSMBovxmOxe3GwHX0eQx=

    raYK-R8LTHez7x2jOWrVbTUDcuN-0JHqQkTCe_QFo5Mm7TeZPcmEiZIuxOHBWN0-T5vXN23VazH=

    JwA=3Ds0-d-e1-ft#https://www.facebook.com/email_open_log_pic.php?mid=3D5fe1=

    3a3f4faaeG5b0581311d19G5fe13ed8afd80G18e" style=3D"border:0;width:1px;heigh=

    t:1px" class=3D"CToWUd" data-bit=3D"iit">
    <=

    /div>


    I1.21KL0LD384I2.16KwhoissourceRank10.4MPIN0Summary reportDiagnosisDensity00n/a

    Fedex Phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Thu, 28 Dec 2023 18:26:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ1cz-000000001kt-1OnO

    for dave@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 18:25:33 -0700

    Resent-From: The Doctor

    Resent-Date: Thu, 28 Dec 2023 18:25:33 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-he1eur04on2051.outbound.protection.outlook.com ([40.107.7.51]:29440 helo=EUR04-HE1-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ1ZD-000000001ZS-1yHh

    for doctor@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 18:21:43 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=N0z53eUK9+j4CpGovBeHApu8ItU3ZzPKwT5iqNDE46IotjI1/RMRbP0XQUI261chpT6KprKzvduQ6jWe11AiKbOIbBWQOPfSLLy6z1Bt93W17/lv+h9GisIf5DEezjeuzKYkdKmzTziEO8XjVQojvhC4jq8u9+x6depjFq7jqXo4k+JTBcxJP/rAEQBE22VMbzo6WljM2WCnwug4FlKuiO+26aCnpDK3uyjVyItdiDTZ0kmKcNGe0+42mhLB4PCR5BNTXA3bxjOsZceyXHUcSccf6zaVe1aE3w3aUi3qVQbTk1t5nHeHE7y1vOQC5A79WeWtR69m7GoxD3DixNlfzw==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=5EDXwmwMLlZJEwQ8nMsnUIAZB1fIUKGBVPZQVKFGHeY=;

    b=OLFKvUSWKqxM4hGjW9IVmEfbV5i0/pgxpfAPDKBlB/UVKa1TC35VOZtrPRbs+ZWgUrgl6h37rQWXAj13ZMrMAJZ89i92EivvK/bItAstrIkMXCzNdPP10GN8LAKUoxcwF6XDVo8SowLSfw+NOvqjjcKnftEFrlzUad9rOYg+BclVxh/up5ITtGuVJJLOuNVz8IqZV/QBwS2fL1OKXjg7NCD5gL1xfGzBkkp6oYay9noJx0Yc8or4ElcEmFSgmWstGMZ/J4EOZjXpCsBkNkk8TpQpTKIZP0wiuu3ZVb1igkWtaBbz1WuPYHBrrbvlI96EOk2HR9ZoPV4u1nqJUbkO6w==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    172.233.222.135) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=es02ms.onmicrosoft.com; dmarc=none action=none

    header.from=es02ms.onmicrosoft.com; dkim=none (message not signed); arc=none

    (0)

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 172.233.222.135)

    smtp.mailfrom=ES02MS.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=ES02MS.onmicrosoft.com;

    From: =?UTF-8?B?U2hpcHBpbmcgRGVwYXJ0bWVudA==?=

    MIME-Version: 1.0

    Importance: high

    Date: Fri, 29 Dec 2023 02:16:50 +0100

    In-Reply-To:

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART_b7GI.mytqqnhi"

    Subject: Important for doctor

    To: doctor@doctor.nl2k.ab.ca

    CC: doctor@doctor.nl2k.ab.ca

    X-TOI-MSGID: <492523584.502521A1F3D1C.1703812610053@hudson.com>

    Message-ID:

    <14d76994-1228-41af-89aa-8f0e76009331@AMS0EPF000001B3.eurprd05.prod.outlook.com>

    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: AMS0EPF000001B3:EE_|DU0PR10MB6509:EE_

    X-MS-Office365-Filtering-Correlation-Id: ed9bdf76-e66f-49c2-59d3-08dc080c356f

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    LleeufDdg834UTwksxJQhZ3Y/Q5Z2o/LhjQodQNZGHVBn2KvjKJlW62Fj2x8EaPgfAPmJTYDUPQCHlzFR5vnQW6AvaBsfCJwV1nwwgYcAuLuWbOFEqOUmwGF5rladJHYfvt8PNAya0ATOFx+g0yS/4HW2An8ZRYfEDfqcHpwxkFsCP7OY+myegKwwsv/yatsUN/zGoqKuZB9PbL7md9WX2j1vfkGA1CWO+6NzjLsWs9ioX1fqknuv9coLU7HG2kWBT2VOnF+iGnOSoRCdpGmM/DdVUEJeQl+gRaKrNJdX7YFDsQBTO+4ScSTtFiOxa0XfYmvWg2fVnxqlvxfENeex78vZgw1zBg9Jv3LYBja+t3NTtJa+G4cUC4OpBnI3RG3E2h4LX9nTkQ5HDocWstwB/0NpvV/Wzp5IZesALpRKBYYUvOFzI6HnkypxHgP4pcrq8Tl/G6jFJnsAjgFyTSKsysr9dMbPFzI300wUqypJYBrfNoeRReukw8gnvOxa8Hj7y7hsp5Fwqup/+0lXpxJhjmDDKDwVilBY0MYa4rCzjE=

    X-Forefront-Antispam-Report:

    CIP:172.233.222.135;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.hudson.com;PTR:172-233-222-135.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(39860400002)(346002)(396003)(136003)(376002)(230922051799003)(82310400011)(61400799012)(64100799003)(451199024)(186009)(1690799017)(7200799017)(46966006)(36840700001)(40470700004)(3480700007)(40460700003)(40480700001)(41320700001)(81166007)(478600001)(36860700001)(8400799017)(9686003)(42186006)(31696002)(41300700001)(82740400003)(70586007)(33964004)(316002)(6916009)(70206006)(786003)(47076005)(34020700004)(8936002)(8676002)(2906002)(166002)(4326008)(564344004)(7116003)(336012)(19625305002)(6082699003)(5660300002)(26005);DIR:OUT;SFP:1101;

    X-OriginatorOrg: ES02MS.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 01:19:30.6543

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: ed9bdf76-e66f-49c2-59d3-08dc080c356f

    X-MS-Exchange-CrossTenant-Id: ac42b354-6a08-466b-af44-99b0968edd61

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=ac42b354-6a08-466b-af44-99b0968edd61;Ip=[172.233.222.135];Helo=[mail.hudson.com]

    X-MS-Exchange-CrossTenant-AuthSource:

    AMS0EPF000001B3.eurprd05.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR10MB6509



    --PART_b7GI.mytqqnhi

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"











    (9159) Notifications For YOU









































































































    --PART_b7GI.mytqqnhi--

    I1.21KL0LD384I2.16KwhoissourceRank10.4MPIN0Summary reportDiagnosisDensity00n/a

    Fedex Phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Thu, 28 Dec 2023 18:26:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ1d4-000000001lE-4A07

    for dave@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 18:25:38 -0700

    Resent-From: The Doctor

    Resent-Date: Thu, 28 Dec 2023 18:25:38 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-he1eur04on2051.outbound.protection.outlook.com ([40.107.7.51]:29440 helo=EUR04-HE1-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rJ1ZD-000000001ZS-1yHh

    for doctor@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 18:21:43 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=N0z53eUK9+j4CpGovBeHApu8ItU3ZzPKwT5iqNDE46IotjI1/RMRbP0XQUI261chpT6KprKzvduQ6jWe11AiKbOIbBWQOPfSLLy6z1Bt93W17/lv+h9GisIf5DEezjeuzKYkdKmzTziEO8XjVQojvhC4jq8u9+x6depjFq7jqXo4k+JTBcxJP/rAEQBE22VMbzo6WljM2WCnwug4FlKuiO+26aCnpDK3uyjVyItdiDTZ0kmKcNGe0+42mhLB4PCR5BNTXA3bxjOsZceyXHUcSccf6zaVe1aE3w3aUi3qVQbTk1t5nHeHE7y1vOQC5A79WeWtR69m7GoxD3DixNlfzw==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=5EDXwmwMLlZJEwQ8nMsnUIAZB1fIUKGBVPZQVKFGHeY=;

    b=OLFKvUSWKqxM4hGjW9IVmEfbV5i0/pgxpfAPDKBlB/UVKa1TC35VOZtrPRbs+ZWgUrgl6h37rQWXAj13ZMrMAJZ89i92EivvK/bItAstrIkMXCzNdPP10GN8LAKUoxcwF6XDVo8SowLSfw+NOvqjjcKnftEFrlzUad9rOYg+BclVxh/up5ITtGuVJJLOuNVz8IqZV/QBwS2fL1OKXjg7NCD5gL1xfGzBkkp6oYay9noJx0Yc8or4ElcEmFSgmWstGMZ/J4EOZjXpCsBkNkk8TpQpTKIZP0wiuu3ZVb1igkWtaBbz1WuPYHBrrbvlI96EOk2HR9ZoPV4u1nqJUbkO6w==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    172.233.222.135) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=es02ms.onmicrosoft.com; dmarc=none action=none

    header.from=es02ms.onmicrosoft.com; dkim=none (message not signed); arc=none

    (0)

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 172.233.222.135)

    smtp.mailfrom=ES02MS.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=ES02MS.onmicrosoft.com;

    From: =?UTF-8?B?U2hpcHBpbmcgRGVwYXJ0bWVudA==?=

    MIME-Version: 1.0

    Importance: high

    Date: Fri, 29 Dec 2023 02:16:50 +0100

    In-Reply-To:

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART_b7GI.mytqqnhi"

    Subject: Important for doctor

    To: doctor@doctor.nl2k.ab.ca

    CC: doctor@doctor.nl2k.ab.ca

    X-TOI-MSGID: <492523584.502521A1F3D1C.1703812610053@hudson.com>

    Message-ID:

    <14d76994-1228-41af-89aa-8f0e76009331@AMS0EPF000001B3.eurprd05.prod.outlook.com>

    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: AMS0EPF000001B3:EE_|DU0PR10MB6509:EE_

    X-MS-Office365-Filtering-Correlation-Id: ed9bdf76-e66f-49c2-59d3-08dc080c356f

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    LleeufDdg834UTwksxJQhZ3Y/Q5Z2o/LhjQodQNZGHVBn2KvjKJlW62Fj2x8EaPgfAPmJTYDUPQCHlzFR5vnQW6AvaBsfCJwV1nwwgYcAuLuWbOFEqOUmwGF5rladJHYfvt8PNAya0ATOFx+g0yS/4HW2An8ZRYfEDfqcHpwxkFsCP7OY+myegKwwsv/yatsUN/zGoqKuZB9PbL7md9WX2j1vfkGA1CWO+6NzjLsWs9ioX1fqknuv9coLU7HG2kWBT2VOnF+iGnOSoRCdpGmM/DdVUEJeQl+gRaKrNJdX7YFDsQBTO+4ScSTtFiOxa0XfYmvWg2fVnxqlvxfENeex78vZgw1zBg9Jv3LYBja+t3NTtJa+G4cUC4OpBnI3RG3E2h4LX9nTkQ5HDocWstwB/0NpvV/Wzp5IZesALpRKBYYUvOFzI6HnkypxHgP4pcrq8Tl/G6jFJnsAjgFyTSKsysr9dMbPFzI300wUqypJYBrfNoeRReukw8gnvOxa8Hj7y7hsp5Fwqup/+0lXpxJhjmDDKDwVilBY0MYa4rCzjE=

    X-Forefront-Antispam-Report:

    CIP:172.233.222.135;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.hudson.com;PTR:172-233-222-135.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(39860400002)(346002)(396003)(136003)(376002)(230922051799003)(82310400011)(61400799012)(64100799003)(451199024)(186009)(1690799017)(7200799017)(46966006)(36840700001)(40470700004)(3480700007)(40460700003)(40480700001)(41320700001)(81166007)(478600001)(36860700001)(8400799017)(9686003)(42186006)(31696002)(41300700001)(82740400003)(70586007)(33964004)(316002)(6916009)(70206006)(786003)(47076005)(34020700004)(8936002)(8676002)(2906002)(166002)(4326008)(564344004)(7116003)(336012)(19625305002)(6082699003)(5660300002)(26005);DIR:OUT;SFP:1101;

    X-OriginatorOrg: ES02MS.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Dec 2023 01:19:30.6543

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: ed9bdf76-e66f-49c2-59d3-08dc080c356f

    X-MS-Exchange-CrossTenant-Id: ac42b354-6a08-466b-af44-99b0968edd61

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=ac42b354-6a08-466b-af44-99b0968edd61;Ip=[172.233.222.135];Helo=[mail.hudson.com]

    X-MS-Exchange-CrossTenant-AuthSource:

    AMS0EPF000001B3.eurprd05.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR10MB6509



    --PART_b7GI.mytqqnhi

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"











    (9159) Notifications For YOU









































































































    --PART_b7GI.mytqqnhi--

    I1.21KL0LD384I2.16KwhoissourceRank10.4MPIN0Summary reportDiagnosisDensity00n/a

    Fedex phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Thu, 28 Dec 2023 06:59:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIqu7-000000005Du-1sou

    for dave@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 06:58:31 -0700

    Resent-From: The Doctor

    Resent-Date: Thu, 28 Dec 2023 06:58:31 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-am7eur03on2132.outbound.protection.outlook.com ([40.107.105.132]:2688 helo=EUR03-AM7-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rInER-00000000PN5-3MnG

    for doctor@doctor.nl2k.ab.ca;

    Thu, 28 Dec 2023 03:04:06 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=OX9SKkBkinQ9OjwZrksuEUWRuhfT9JjNWh2KusSKUY0L05aqqArHmOGc36YQ50iS7Nlu26Pb6xV9C1A9BsfSEmhR44WoUDeMjt0VfJ0tp/HR21vWxnPw65kLFVC5ASiVNfIhC9PRZWcgcaUI6fVvQR4pOjKklNBXZsaLP+eMmgS6CatPkK9vWXC2UYwmUtsOafoTMSePcVP6An9HB7kU2nri75Pa475BAwAIofTvtfGoHMfqrWNiaQpUyOHM5hvAE0g5ykJ0PX7dOB08l/I7EADYMml9tszPjIfNTqhsOACldN9s97ZeVRIby2OOiCcxoBa8pll/APLv8kK9ybhKDQ==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=CgUAYRvJKjwvMu7zSmBJ9V80/yxuqKiBRfxMqsGFFE4=;

    b=d7SmWYWkJr/VoQn+58nMAJzr50JZlfwEPacRfuZmY+MCZlDUzROERa4pBrZgeMXhzSAEY5F54nlElKeGl4wY5M462S5t8htpGkjDCHGYpoWu4R32oo3o9zQigYTiWeMDo4re1X+ez+nPblryvXG01v6WhWBXyodXW3FvVsD3S4uwrsgWOqzgeKhxNbjsJGgTtNG+nukhDir3earGNdY2v0huGp4pG3bMWk/Zg5HksQsrOHf1p/kpZU3TRL+CN77p1G7PjnmiuqY8sg6CjCSk4/HbsvEHeuZ241ptn2EV8+erg1Gs8TZjLlmgVrPD0l55Z2sFWpOTQdIRZo14gjMPGA==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    45.79.211.243) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=martinho759.onmicrosoft.com; dmarc=none action=none

    header.from=martinho759.onmicrosoft.com; dkim=none (message not signed);

    arc=none (0)

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 45.79.211.243)

    smtp.mailfrom=martinho759.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=martinho759.onmicrosoft.com;

    X-TOI-MSGID: <529217336.C6D069B7A88A2.1703757295507@thompson.com>

    From: =?UTF-8?B?RmVkZXggQ29uZmlybWF0aW9uIA==?=

    Importance: high

    Subject: =?UTF-8?B?SW1wb3J0YW50IFNoaXBtZW50IFVwZGF0ZTogWW91ciBEZWxpdmVyeSBQcm9ncmVzcw==?=

    MIME-Version: 1.0

    CC: doctor@doctor.nl2k.ab.ca

    To: doctor@doctor.nl2k.ab.ca

    In-Reply-To:

    Date: Thu, 28 Dec 2023 10:54:55 +0100

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART_XENZ.cgvadkqb"

    Message-ID:



    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: AMS0EPF00000195:EE_|DBAPR07MB6629:EE_

    X-MS-Office365-Filtering-Correlation-Id: 263cdafb-ecf1-42a0-b5b5-08dc078be98d

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    qi/frShUumS2l7sCYppwPnMwy/TPWpiHkFHH7+i+tIidqe0HuwaQtMGDSY7Xxul/4T1jMAnC8b/aMwdcixxOCg74BjGQKrRs63c2c/BzsG5ZMVcv4adeMrzceTGVJaBDHJk5GEdUyYjOWKPSM4QrDZcB0hI9ql4V9VU/1l7+O8wyLfjdhr5XtW3Ojv5kWZwbh0TCngw/HHG5BCUfujUzx5Rex1qRl3zaE5S55Ovt52PdkXP3+TUmrREUonegVZs5iP5KgP2KP4LW6RHgdStzkj6WbhrolOqGIaihxMIXZNy+LnSxLnKq8V9xfM3I2YY1YZYbkV0/wQBInUBwgs05cQUb94gvfzFicxuEjGUYoIVlszxLIQa99aXvcQyBtLAB0EWvNMI45JunF1XWNNDwE1vQS3PVj4rpTdEZrz4q53DS7qbM2tjA/UAAla2KnnEgSxfFhAR3CRoTNRFh+5z53J8KHXNcAnGx3vCvoqSTzkDIC36CJQicAPT8ZqRpv/NFMS0E35LZPfwt1LbKBbw+tCLVcM2A4QyFQFHfzKK1KChytnfAihuoOM+5+4xQ/WiuBV73UbBaZnU4d/S02sSeOJqvD/rC44HvFxhspSSQvzV9F2ouzjhhJyeD3IRqfeTG6QVOb4LHSPry4+4IKif9nSvBjR+epgs3rRrPB0WNg7I=

    X-Forefront-Antispam-Report:

    CIP:45.79.211.243;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.thompson.com;PTR:45-79-211-243.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(376002)(346002)(39850400004)(136003)(396003)(230922051799003)(82310400011)(186009)(451199024)(7200799017)(1690799017)(64100799003)(61400799012)(46966006)(36840700001)(40470700004)(31696002)(41320700001)(19625305002)(5660300002)(26005)(2906002)(336012)(786003)(70586007)(70206006)(316002)(42186006)(6916009)(10290500003)(33964004)(4326008)(9686003)(478600001)(8676002)(8936002)(166002)(41300700001)(81166007)(47076005)(82740400003)(34070700002)(36860700001)(85622046)(40460700003)(40480700001)(564344004)(8400799017);DIR:OUT;SFP:1102;

    X-OriginatorOrg: martinho759.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Dec 2023 10:01:07.7807

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: 263cdafb-ecf1-42a0-b5b5-08dc078be98d

    X-MS-Exchange-CrossTenant-Id: 7a268d00-c3d2-4549-8ed1-02bbc87ef194

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=7a268d00-c3d2-4549-8ed1-02bbc87ef194;Ip=[45.79.211.243];Helo=[mail.thompson.com]

    X-MS-Exchange-CrossTenant-AuthSource:

    AMS0EPF00000195.eurprd05.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBAPR07MB6629

    X-Antivirus: AVG (VPS 231227-4, 12/27/2023), Inbound message

    X-Antivirus-Status: Clean



    --PART_XENZ.cgvadkqb

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"











    (3999) Notifications For YOU









































































































    --PART_XENZ.cgvadkqb--

    Ryobi Chainsaw PHish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Wed, 27 Dec 2023 18:26:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIf9r-000000002Xa-1YkY

    for dave@doctor.nl2k.ab.ca;

    Wed, 27 Dec 2023 18:25:59 -0700

    Resent-From: The Doctor

    Resent-Date: Wed, 27 Dec 2023 18:25:59 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-dm3nam02rlnn2043.outbound.protection.outlook.com ([40.95.34.43]:8417 helo=NAM02-DM3-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    id 1rIegc-000000001wp-3X9S

    for doctor@doctor.nl2k.ab.ca;

    Wed, 27 Dec 2023 17:55:50 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=Z698ikBfExCQCJfLfV7C1cdWoB/4foct+zBxs34csRvR7sqh2hbGUmpqfScSq3F3CrbykeHXbTy9nWKi6+sIq0VbXLlWk9g0rgK6P1D7YasDDsNbSsuL/uE3VxJjhnYKSqqG1Lsti4fJPpP2zWLXJ4qipZABS6zzDnkeI7hqDqHzfFVbxUXtion4maaRVUXyJQjB/PChRHJrWPYkgOe/57psAmeqfzWfdxZaqebv3HP+sM4TwkimdtttZcU6VGuZi9EkJkZ4ChAqQKueR0Uiqjlj3wcQ3q+swcn5IH/pRQfRlliYbHZCL+x2KTqODaVnEp1l2JU9IWPKdePgtbCTfg==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=0styqUom6Rz5RZZNN6C3QyP0c1QN2ZOWD3kZ1CmdkN0=;

    b=KcWlp41niq3a6EfLMWB3tI0XAMUquO/6brg59Q3kRa2CSLprIKhj+WmzQb5g9ntm7AF+utaFNot+GRQYyG2OhRthO0LbYhXKs38IavDBPJRGTQq8suoAqZophYm/ZHemZqdOg7utTmbDgbaS0pf/CYZehhhWuUauvdgXcErowjEBqdajSD910y18k1jDSslzstDLdj72cRJbscpjmoFSd+CZWsXq3NTa32qd6LDjTzZUIN9ohpkb0/Z653FUU8T0u3bF2sA0djXT4m10iTgI+uXZZJpZRfy7CrjRsLSavV4JObDa8fYpb4YoAIzl4SFtCjuXC1Ihid/dtS7XDhNU3Q==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

    78.46.149.17) smtp.rcpttodomain=doctor.nl2k.ab.ca smtp.helo=mail.goldner.net;

    dmarc=none action=none header.from=nvz.dtq7zh.com; dkim=none (message not

    signed); arc=none (0)

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=4pfvf63.onmicrosoft.com; s=selector1-4pfvf63-onmicrosoft-com;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

    bh=0styqUom6Rz5RZZNN6C3QyP0c1QN2ZOWD3kZ1CmdkN0=;

    b=dGwznh7nG/VGRqFlncI8qeJNgvzn+UnFj3umTdrJV/6ejtH+JlMcBLo2tgaWod1fr5MBEMHXaziDx1sDje4n3AwS35ykz5P82bJQwLipJVA78ejaFjeE/rPyEq5gBmpzFHlKyrURhNq1niuYR/yZQewSeUWU5c1LG04PfMZ9OjnMN19JyNUgCOy3ekt7XwXSlXGe8c43L8c1vWGjBPSWdKOQQUX2D7M6zYutYw52KGf7YmSyCnbAxD5qA7xvxZqTRzCc9SBaw215A9z3pw45gzV4JWeuk8piFeUTyUgV/pGC98EbXzbZrk+UKdVIdxmZE3pN+TnwKmRubL47y3EyhQ==

    X-MS-Exchange-Authentication-Results: spf=none (sender IP is 78.46.149.17)

    smtp.helo=mail.goldner.net; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=nVz.dtQ7zH.com;

    CC: doctor@doctor.nl2k.ab.ca

    Content-Type: text/html; charset="UTF-8"

    Content-Transfer-Encoding: 7bit

    To: doctor@doctor.nl2k.ab.ca

    X-TOI-MSGID: <1672204214.E18B29F673DB6.1703724695741@goldner.net>

    MIME-Version: 1.0

    Subject: Your order has shipped! - Ryobi One Chainsaw

    Date: Thu, 28 Dec 2023 01:51:35 +0100

    In-Reply-To:

    From: Welcome

    Importance: high

    Message-ID:



    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: MW2NAM12FT023:EE_|PH0PR10MB5732:EE_

    X-MS-Office365-Filtering-Correlation-Id: a2d122ce-ea8f-4b55-d02c-08dc073f6f18

    X-MS-Exchange-SenderADCheck: 2

    X-MS-Exchange-AntiSpam-Relay: 1

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    2S3n3/FOBRPN8Wf7Sa3gNsVsfj1+bFX7piR/eZr9UIB9mDIZe5xHZqtSf77CH/4+T0vWyHa4K4MIZlOWfN+1z7NQSl5jvyEG6z66xxYk6powzroXWonr3lTRzorOZaVQkVif3QWpFwX2HtBn8Ec1te00TEZdifwgbp+Fl/Pv2uJYkNjZO04L8sBIpkGIsSImI98CAK9ER3Yo76SlBjRo/CYQVohqES0G3VD7ma1QUwEPoKDTtxPPHeMlxJ+hp1swcvpUoLXX2LFpvZ6gTqqjRAbBzpAaqhA3j2SlzcgyeQur5igIPDtktp9spMYbYIqFT4KA3pReoJ5k85DqTuAm/qe837FomgSXOaiiNgTuX+y/YaKMc+3gbVDSWHigN3mJAIhNeiiE54KV5PEdNNWg8ZK3cyJCVN5hMZXA3KG/AdBvZXXyQr/PpES2BcLTLNJDpExZsshll/nOJvz98x8D4g==

    X-Forefront-Antispam-Report:

    CIP:78.46.149.17;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.goldner.net;PTR:static.17.149.46.78.clients.your-server.de;CAT:NONE;SFS:(13230031)(136003)(396003)(346002)(376002)(39860400002)(230922051799003)(451199024)(64100799003)(82310400011)(7200799017)(48200799006)(1690799017)(61400799012)(46966006)(42882007)(8400799017)(31686004)(336012)(70586007)(70206006)(26005)(6916009)(42186006)(316002)(786003)(5660300002)(47076005)(8936002)(67280400001)(35950700001)(8676002)(78352004)(9686003)(4326008)(40480700001)(498600001)(19625305002)(82740400003)(2906002)(81166007)(166002)(31696002)(41300700001)(41320700001)(558084003);DIR:OUT;SFP:1022;

    X-OriginatorOrg: 4pfvf63.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Dec 2023 00:53:40.1592

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: a2d122ce-ea8f-4b55-d02c-08dc073f6f18

    X-MS-Exchange-CrossTenant-Id: 90903da3-5cf4-445f-8a84-a419febd4dd7

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=90903da3-5cf4-445f-8a84-a419febd4dd7;Ip=[78.46.149.17];Helo=[mail.goldner.net]

    X-MS-Exchange-CrossTenant-AuthSource:

    MW2NAM12FT023.eop-nam12.prod.protection.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB5732

    X-Spam_score: 5.2

    X-Spam_score_int: 52

    X-Spam_bar: +++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: (1) Notifications



    Content analysis details: (5.2 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

    [SPF failed: Please see http://www.openspf.org/Why?s=helo;id=NAM02-DM3-obe.outbound.protection.outlook.com;ip=40.95.34.43;r=doctor.nl2k.ab.ca]

    0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

    0.0 ARC_SIGNED Message has a ARC signature

    -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

    0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

    0.0 ARC_VALID Message has a valid ARC signature

    0.0 HTML_MESSAGE BODY: HTML included in message

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

    -0.0 T_SCC_BODY_TEXT_LINE No description available.

    2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

    0.0 T_REMOTE_IMAGE Message contains an external image

    Subject: {SPAM?} Your order has shipped! - Ryobi One Chainsaw

    X-Antivirus: AVG (VPS 231227-4, 12/27/2023), Inbound message

    X-Antivirus-Status: Clean









    (1) Notifications
























    Fedex phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Wed, 27 Dec 2023 18:26:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIf9U-000000002XE-0Ua0

    for dave@doctor.nl2k.ab.ca;

    Wed, 27 Dec 2023 18:25:36 -0700

    Resent-From: The Doctor

    Resent-Date: Wed, 27 Dec 2023 18:25:36 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-db8eur05on2125.outbound.protection.outlook.com ([40.107.20.125]:37825 helo=EUR05-DB8-obe.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIed0-000000001rP-3hQt

    for doctor@doctor.nl2k.ab.ca;

    Wed, 27 Dec 2023 17:52:06 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=e1hYLCcRY9wgfgSSoEOQ5akwBlMPuFrzQkzWr+YFKUfftSNcTaeRtWlEBbxW4+7O7LDL0S0mySz89PZ+hDug5fuMm9CZGVe5Wft7TqnU+3du+0SsET2axT0oLe2NL4w2mo0BBeb7sYtJO0I0Eib9BOBKj2f4Wvq2xdHermN9oOKV1f3i0e9RY0Tc7lmEE+a0oyM5gAUB2GUTDTWL8RK/zGN7Ytbz/y07EyHAXk52DrEvGxCT5cJLJm0ijJ2kgbrYVyjCY3+sb2fi0TqKX04Wx2hU70idXBB+vS+dZkKRxTTS0B2VXx+xGsE4r5SNQcmMJ8ueeWfqT47F9ZhXo/8+WA==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=c3YLSVpCfu/eYLtBGnAUsz5dmCXs8K8ObO5WIE33efY=;

    b=hEDB3/pW1YO65pZFhAxJIoKZWjKh7n7A07nJdT1gPEXMrp4tZvCT7bw7bNMaK7jHj8NbAHdQeiIOgV2a5fLXqe4Go+akRFBwlo7LEaape2vB98dxIf3otvf/8hSRLZeLhUN1R5LUPMC4/3gXpdEqTkuMIxw7NX4mV+DZZLdUFkgsNZVpUuz5AkIBYixA0xO2XMPO8pHCNRUAgWxd3qDJgbZxxeCmRTjwjOhtWLPTMW6Bdiejd+KZFe1pDeeZa4ImE3VaQLgrPqV031PoEE79Z3WelDGlLzuHqCAXzySXmhDJcXqYTlPIfc2dQ+ryb4v+S+ZoTGAyvhkBQNSwhSUsPw==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    172.233.200.221) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=calmaa.onmicrosoft.com; dmarc=none action=none

    header.from=calmaa.onmicrosoft.com; dkim=none (message not signed); arc=none

    (0)

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 172.233.200.221)

    smtp.mailfrom=calmaa.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=calmaa.onmicrosoft.com;

    Subject: Important for doctor

    In-Reply-To:

    From: Shipping Department

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART.0ueM.ratozrtn"

    Message-ID: <010724376038143039d9ee-c69a3509-5c85-481d-822e-ba65c204e1ba-000000@onmicrosoft.com>

    X-TOI-MSGID: <1535564970.FE3B0F50FD9B7.1703721906508@zboncak.com>

    To: doctor@doctor.nl2k.ab.ca

    MIME-Version: 1.0

    Date: Thu, 28 Dec 2023 01:05:06 +0100

    CC: doctor@doctor.nl2k.ab.ca

    Importance: high

    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: AM4PEPF00025F9C:EE_|DB9PR02MB6972:EE_

    X-MS-Office365-Filtering-Correlation-Id: 269b8fc2-bcda-4c44-439d-08dc073ee828

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    bNhmqqTF7eku1JhGP8n9zUTw5cv5X9HnqbvedsldroUbtWXmy/e3+FYBNk5SBlrvnP2lGszoDQFFtCLr1VrW5jre14xMTo3BpESaCaFQk5/nDDmbKt0+NiNFZ6PVtyQmMlVFQ0znsSLiEGdqirEAjBhDkyw/JGljeLPX1mVUXZFNhd96wZf7kGtlB3OZGw3f1fRw0CG+ZoJvnE1jLwCGCT+8ghOjW1SuFd9zOLaDMVtPStmaQzY6gv1ehsKVR2R415X3dtNnNYqiQa99FaocSYlTGV8Vw3XT0SV5a2daTxiG7PMaRRdgK87PwSugm1R1j5jiE2uQpeI68b1BTHMfSPj2mUJg13Cj23C4+EjI/+Sva8OGA/tR5Tjz1SYaU/DMILx+QzkpgiO8j/m/gVBiJVkXj4A880o9hzSz/BuCBctUcq8LYzKgFqZ/FtTqXr4yrRQNDFgeyYF+7zTaYldxGuLnxRpHSjdcrDkhfP7lZfhujByuyiypyr0jIaRV5gAgBZCMe9YpHBO982WomAW4XNnzoali0YO8qngqtgWCsxG7qAQc5fMyZeTCMdhb/PF1mQgN70t4OIYqXTq2EwK7VhLMXVZs1X8Xcv+QGeyX7ciRhANIy62+XVVKuqU4R22TQeE+8DhbYABzozQieLIl+jFTVimbJWOSXPjN8WK4zKs28OMpaVTddnjRrTHdj7wGvHNy62OjstpU6ZfqRXbpmc0c0O1oSvoiO7ZYXuE1GNoT+V9K5sVK1BdjJdk74XNjj22jpT2K9iP4HWTg6Y914lMMJUGtVb9gxr13p9c7xoc=

    X-Forefront-Antispam-Report:

    CIP:172.233.200.221;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.zboncak.com;PTR:mail.courtshipfamiliar.org;CAT:NONE;SFS:(13230031)(376002)(396003)(346002)(39860400002)(136003)(230922051799003)(64100799003)(7200799017)(61400799012)(1690799017)(451199024)(186009)(82310400011)(40470700004)(36840700001)(46966006)(316002)(42186006)(786003)(66899024)(8676002)(8936002)(36756003)(33964004)(26005)(9686003)(564344004)(478600001)(81166007)(166002)(36860700001)(3480700007)(82740400003)(34070700002)(336012)(83380400001)(41300700001)(47076005)(6916009)(41320700001)(70586007)(70206006)(19625305002)(5660300002)(40480700001)(2906002)(8400799017)(7116003)(4326008)(40460700003)(1406899027);DIR:OUT;SFP:1102;

    X-OriginatorOrg: calmaa.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Dec 2023 00:49:54.2056

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: 269b8fc2-bcda-4c44-439d-08dc073ee828

    X-MS-Exchange-CrossTenant-Id: 495b5f9f-927c-4d40-a76b-41bdd5aef523

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=495b5f9f-927c-4d40-a76b-41bdd5aef523;Ip=[172.233.200.221];Helo=[mail.zboncak.com]

    X-MS-Exchange-CrossTenant-AuthSource:

    AM4PEPF00025F9C.EURPRD83.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR02MB6972

    X-Antivirus: AVG (VPS 231227-4, 12/27/2023), Inbound message

    X-Antivirus-Status: Clean



    --PART.0ueM.ratozrtn

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"











    (7706) Notifications































































    If you no longer wish to receive these emails, you may unsubscribe by

    clicking here.




















    --PART.0ueM.ratozrtn--

    Canadian Tire Phish from amazon

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Wed, 27 Dec 2023 16:55:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIdj3-00000000OMB-3Bhd

    for dave@doctor.nl2k.ab.ca;

    Wed, 27 Dec 2023 16:54:13 -0700

    Resent-From: The Doctor

    Resent-Date: Wed, 27 Dec 2023 16:54:13 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from a8-35.smtp-out.amazonses.com ([54.240.8.35]:55353)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

    (Exim 4.97 (FreeBSD))

    (envelope-from <0100018cad1e913d-500e764a-9a94-49cf-a72d-12e216979b10-000000@amazonses.com>)

    id 1rIbDw-00000000LQD-2xDx

    for root@nk.ca;

    Wed, 27 Dec 2023 14:14:01 -0700

    DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

    s=iumxvzai7h3ln4d7i65v55tz7xp4hs74; d=foxlabs.in; t=1703711510;

    h=Subject:From:Reply-To:To:Date:Message-ID:List-ID:List-Unsubscribe:List-Unsubscribe-Post:Content-Type;

    bh=mu5vGHYi1zvUoYwJ/Qcpk/QK5xRUpoW6CajgCJjuWVw=;

    b=io73ei/YVsHqFEwTCU8xs/J4pol2GpxbkA2emPUSVAnrCVmLQ17Gg5W9dPEh4ALz

    mmJOLkLoL6KBxyGukxZA3yyVZDwS7QQaWnppIapXpruVrtdBlrmBni+yiSty7N8EGYK

    gazTRPokz7gnuL2U32bv4XPvZPjZOLarrhWXigHIH6dZ/dvY9p/p345de8JPZa4QW+v

    mcFFa9bvl8TSfx9ZwYiKJT5X3YMMMaR7vLDPfUDkH6ekRgN1THScWgWfCkjMnZb9VLp

    Mq38etc3ZVvbBYE0L31JoVYWgzcwAcDJ2p31CSaCs2BUOE2+f5CxZp3lyFpOEfekK6r

    E5i9GgLqfg==

    DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

    s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1703711510;

    h=Subject:From:Reply-To:To:Date:Message-ID:Feedback-ID:List-ID:List-Unsubscribe:List-Unsubscribe-Post:Content-Type;

    bh=mu5vGHYi1zvUoYwJ/Qcpk/QK5xRUpoW6CajgCJjuWVw=;

    b=dh7sIzibCptgKfQi3LD68PQIMIpuzPOvj/A4g+8K9YPImF57KeVcN/keAzNUmPxw

    JMUB9pgi3KplTjD4QCSGKhto4NVKTIS32yYQR8MGItS5WF+byDzENMLFtwRQeGZibod

    BMAC5P0tMy6bUjoJtIb0b42y1drb4qtX9uShbcno=

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=macpacclub.co.nz;

    s=k2; t=1702370545; x=1702631045; i=club@macpacclub.co.nz;

    bh=MG33lH+CY79L0833Fn7WMiVOuPH1bWfCxhCKRsRyhGI=;

    h=Subject:Exclusive Product Awaits You: Complete Our Survey

    List-ID:List-Unsubscribe:List-Unsubscribe-Post:Content-Type:

    MIME-Version:CC:Date:Wed, 27 Dec 2023 14:41:39 -0500

    b=WgP1KUJeaUgrOkiymoZOvwBMLYFEY2v8RAr8j2IQ54ZwEEY68klLN38mqqFQ0Po7R

    4lpTtv7jGI7oLtTwBQTFh1aOuHpA/mIxeOVnasPt3kQ5CeohPOn5q3lLnYZPeLCOHR

    TmDYIm8juN9fgqzJ9Sc0LL37b1eSaq/p9rftmUlfLgGVCZx0fC3a2+MguUiyHr9Ov6

    jVs0dxoY0x13SLlLAYqI9nPjUFcXlGqQ/lv6Hhl2Q+HNHSUTG4bP/GPGdlDvr3OybD

    oxDTSGb7ri7v99U5IW3+jh8hvBZANBM7hJH5BNKQUWrv1Bpq4NgINQz0FeMOOJ6M0S

    lSo9lNHMvJRxg==

    Subject:Exclusive Product Awaits You: Complete Our Survey

    From: Canadian Tire Department

    Reply-To: root@nk.ca

    To: root@nk.ca

    Date: Wed, 27 Dec 2023 21:11:50 +0000

    Message-ID: <0100018cad1e913d-500e764a-9a94-49cf-a72d-12e216979b10-000000@email.amazonses.com>

    X-Mailer: Mailchimp Mailer - **CID7497ea0e6aed9fb56518**

    X-Campaign: mailchimpe6a11f6e800e39b4814219c1e.7497ea0e6a

    X-campaignid: mailchimpe6a11f6e800e39b4814219c1e.7497ea0e6a

    X-Report-Abuse: Please report abuse for this campaign here: https://mailchimp.com/contact/abuse/?u=e6a11f6e800e39b4814219c1e&id=7497ea0e6a&e=ed9fb56518

    X-MC-User: e6a11f6e800e39b4814219c1e

    Feedback-ID: 1.us-east-1.4vz5eWi3mu8p3ejxSXq5bqW4hRrKTuBrAoonK+dzQNI=:AmazonSES

    List-ID: e6a11f6e800e39b4814219c1emc list

    X-Accounttype: pr

    List-Unsubscribe: ,

    List-Unsubscribe-Post: List-Unsubscribe=One-Click

    Content-Type: multipart/alternative; boundary="_----------=_MCPart_1888620651"

    X-SES-Outgoing: 2023.12.27-54.240.8.35

    X-Spam_score: 7.6

    X-Spam_score_int: 76

    X-Spam_bar: +++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview:






    Content analysis details: (7.6 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [54.240.8.35 listed in list.dnswl.org]

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [54.240.8.35 listed in wl.mailspike.net]

    -0.0 SPF_PASS SPF: sender matches SPF record

    -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

    0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

    -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

    envelope-from domain

    -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

    domain

    0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

    domains are different

    -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

    domain

    1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

    1.5 MPART_ALT_DIFF_COUNT BODY: HTML and text parts are different

    0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

    0.0 HTML_MESSAGE BODY: HTML included in message

    -0.0 T_SCC_BODY_TEXT_LINE No description available.

    2.0 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME

    headers

    0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image

    2.5 HDRS_MISSP Misspaced headers

    Subject: {SPAM?} Exclusive Product Awaits You: Complete Our Survey

    X-Antivirus: AVG (VPS 231227-4, 12/27/2023), Inbound message

    X-Antivirus-Status: Clean







    --_----------=_MCPart_1888620651

    Content-Type: text/plain; charset="utf-8"

    Content-Transfer-Encoding: quoted-printable




    OQp3>=0A
    TvFInJemCG26>=0A
    I9dStpOru58xZoFdl9N3>=0A
    vl Ed8j9FXI58IN9vnEhaHcIgkKG>=0A
    1Au86BTB3R DQagnP2w1yoh9bgjYVcLNC6Mz>=0A
    LEwwoQnmP7GFgeDpNH cw2cZQ953tw741urfaEsPCYlI>=0A
    eT6NLKBiWXRubuS55bT1QERnK ZPAUBFDxif8JnUw5fxpXtkZdc>=0A
    ewIaB6pp AetCK1lt9T1XSkdm6PYYra3NI fFiuUIydb95ms46jSPuV1rBQf>=0A
    FJlJKkEXCzULiA63 nv8tePsA4k2PlOlVZUv9pjBO4 XuaRMncKHhqZHlaA0mfb75Wt4>=0A
    wQxADRAkuOn5mulc2wdsnpyp tbFod8KTwbneCyyhLtu5FwX1z fOEu1XvxbywMiSOvWhTlpvFJ=

    q>=0A
    nesfx3nmH>=0A
    BoBtap32NZoAvrkKd>



    --_----------=_MCPart_1888620651

    Content-Type: text/html; charset="utf-8"

    Content-Transfer-Encoding: 8bit



    Fedex Phish from Microsoft Outlook

    Posted by Dave Yadallee on
    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Tue, 26 Dec 2023 19:39:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIJoY-00000000Ed9-2CQK

    for dave@doctor.nl2k.ab.ca;

    Tue, 26 Dec 2023 19:38:34 -0700

    Resent-From: The Doctor

    Resent-Date: Tue, 26 Dec 2023 19:38:34 -0700

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-eastusazon11010001.outbound.protection.outlook.com ([52.101.51.1]:56178 helo=BL0PR02CU006.outbound.protection.outlook.com)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIIjR-00000000Cbo-3UDS

    for doctor@doctor.nl2k.ab.ca;

    Tue, 26 Dec 2023 18:29:18 -0700

    ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

    b=RNBrh+UEs33O4CxuFLxOnaZ7Gfsh1KYH+dJdZTJYrSxnm6LmioGlayWFPlVS2vJfDNHQoHjvPVktNKegffncQqJCiF/ezpk7yZ9l+rwsQjqkLbc6BjNPcnhLMlc56TXYtLlmDA3dbnjY6wCAYpMX+dt44UbbKNYq2uGcKTokc6KF17d8HYvq1xLN+JeZbRLdH3d3ZOkoBkBL/pNbxWOK1GGwySlWGWHRfpnnaYj9KVb+3IVfP6ghF/K0QnnDwdFnbe0xIqbas1vVLqXIKwNvLfEybhOwUvy34wW/SdVi7FttXOomV82Dn3YS8uMnuxLXMc/QB+NdLLl0vodwHWCAIA==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

    s=arcselector9901;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

    bh=13NbYPirSeK9jJYiofiqYH2YV5VljrOYIlCzRY7u+I0=;

    b=BzknQKTa2JTRzXU7TGSmNeyEXe2wKUweI4nB4QAlE5YsgMvTe44y4Xyw4xlz04GcCE+I+gjsbIAxNsUwEoAaBv3OUQh81uDR/uTiEhdG9M8RYo95ZOakkKlcqEZXRtJwwtWOE0KK8SgE+sY4bZYu/NHxRfSZqWbVcWgIbJ5qjKwmkFxxzWC0/Qpg6cWdUHtjPzTIjgzlHnvSZFOxOif4vy/duCW7H5Z/SL5ors/mUbHfXAP6GEWfYZqjCRwSiddInSuYtv4q2EBzLc+qNOVve41+Zfw61HjFj0vt14zB+bH00AHC2oqx4aV72u2uDk48NiQeE0hotHOwYEbm4cFyeg==

    ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

    65.108.80.57) smtp.rcpttodomain=doctor.nl2k.ab.ca

    smtp.mailfrom=vknhsutl.onmicrosoft.com; dmarc=none action=none

    header.from=vknhsutl.onmicrosoft.com; dkim=none (message not signed);

    arc=none (0)

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=vknhsutl.onmicrosoft.com; s=selector1-vknhsutl-onmicrosoft-com;

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

    bh=13NbYPirSeK9jJYiofiqYH2YV5VljrOYIlCzRY7u+I0=;

    b=h1mYw0HsJ0B34Cqrtb282VFyOwDylfNBve8CoUK0nPUVy5bN19qdzIYUvwXf7FMAm81AuMCPm+Kli/NVwRtIB2QOR0pZKadxw9immj90Y8lSvO1IYCPUrFyewErFgViGsAReu8sOuiHtKrdqDUXpNlr3pbOvEjejxawZmGObEYDI8eqav1ASoEZGp3kF4Tydl0lrnjolPnC33bXZRgCox2QGM5j6tGL+wFeE4kJIj2CjdcLQHr4Zvppm1w6KoWOzB92qC75Oa1iCeoj4FxcxeLKgQmonNW1HxyQTjcsUHpZU8XGfyGuSD7sqeVyd8XCsn0a+kfy8SVsWJM0rjmhRZQ==

    Received: from SA1P222CA0095.NAMP222.PROD.OUTLOOK.COM (2603:10b6:806:35e::26)

    by PH0PR05MB8059.namprd05.prod.outlook.com (2603:10b6:510:77::17) with

    Microsoft SMTP Server (version=TLS1_2,

    cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7113.27; Wed, 27 Dec

    2023 01:27:08 +0000

    Received: from SA2PEPF000015C9.namprd03.prod.outlook.com

    (2603:10b6:806:35e:cafe::e) by SA1P222CA0095.outlook.office365.com

    (2603:10b6:806:35e::26) with Microsoft SMTP Server (version=TLS1_2,

    cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7113.27 via Frontend

    Transport; Wed, 27 Dec 2023 01:27:07 +0000

    X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 65.108.80.57)

    smtp.mailfrom=vknhsutl.onmicrosoft.com; dkim=none (message not signed)

    header.d=none;dmarc=none action=none header.from=vknhsutl.onmicrosoft.com;

    Received: from mail.keebler.com (65.108.80.57) by

    SA2PEPF000015C9.mail.protection.outlook.com (10.167.241.199) with Microsoft

    SMTP Server id 15.20.7135.14 via Frontend Transport; Wed, 27 Dec 2023

    01:27:07 +0000

    To: doctor@doctor.nl2k.ab.ca

    MIME-Version: 1.0

    Subject: Update: Your Shipment is Moving Towards You

    Content-Type: multipart/alternative; charset="UTF-8";boundary="PART.2044.zlwhcskl.83289592"

    Date: Wed, 27 Dec 2023 02:08:37 +0100

    From: Fedex Customer-Support

    X_Priority: 1

    Message-ID:

    <82c4403d-3acb-43a0-aa3b-9dc674722426@SA2PEPF000015C9.namprd03.prod.outlook.com>

    X-EOPAttributedMessage: 0

    X-MS-PublicTrafficType: Email

    X-MS-TrafficTypeDiagnostic: SA2PEPF000015C9:EE_|PH0PR05MB8059:EE_

    X-MS-Office365-Filtering-Correlation-Id: a1a9df75-58f4-44fc-4a46-08dc067af0ce

    X-MS-Exchange-SenderADCheck: 1

    X-MS-Exchange-AntiSpam-Relay: 0

    X-Microsoft-Antispam: BCL:0;

    X-Microsoft-Antispam-Message-Info:

    WHG0RFd3M3+zzoZLhQhl2ap4Ez9amhDNxX57yUfPjKxZP71Rm3eaEgAt/58A15Ae1dt7WLjZAAhkJV4T0eyLjMcU9RSW1bJRIosiBcfBmO/Q+YQedi7NZ9ye1hH3kiqrutyD19K2ovQWRi5GVjsJ1KAhUqxWSjDyVhxFGo8fdjzaCBeALaU6vI+msN8Hme8ryahUhZtkglwNwBauqzGN8TyGFZuvbV+cmp288toZj5twcJnwVIcdqYpxHe2EP3G2AZ/4UoLxEAbaFdKbDfgL1BnXHYSrXukkASQcro1edlo6mZQRO24Yv7Q1lqLSxBifxaXdSsq+MZdTa1RA7SLJnwg7nvvaS6xJ2Ukk7oIa2h7g2xyZx2hn4aqBbGBEJ1Ka8k/KemN05l3pOnDqmcUD/1j5B10+fUUpQKQGNzXFI8eqh1ybfo/TS5FBeQmZEPev7j1R75xC+OHeRpk81fLfe6sicDfS3GH22tHD/2wPr5ReMx9LjdAd1vMIVip3njQk7x19VZjJgAOjLuUfVuNmhFsIOhYqW8HU2DF7uNeQ5I5edEsrHMp9VAcgzVD/1eGNQYOtmws6xxCkF/i+joDkBTSJYgrv0E0SKz/w2IZGeZSwpSuwQXhEVUan1N4nt6fmgjnLzXy4Wk2ointw6RbB9WxtgLPmx8VUbBapegTDN9EQIMpW4JT5CVPT6SakmopO

    X-Forefront-Antispam-Report:

    CIP:65.108.80.57;CTRY:FI;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.keebler.com;PTR:static.57.80.108.65.clients.your-server.de;CAT:NONE;SFS:(13230031)(346002)(396003)(376002)(39860400002)(136003)(230922051799003)(186009)(82310400011)(64100799003)(1690799017)(1800799012)(7200799017)(451199024)(46966006)(40470700004)(36840700001)(40480700001)(2906002)(6916009)(70206006)(70586007)(5660300002)(19625305002)(40460700003)(8400799017)(8676002)(8936002)(316002)(36736006)(41300700001)(41320700001)(786003)(9316004)(47076005)(10290500003)(9686003)(564344004)(478600001)(118246002)(6486002)(6666004)(33964004)(6512007)(6506007)(31696002)(26005)(956004)(34070700002)(336012)(36860700001)(356005)(166002)(82740400003)(81166007)(81512002)(83022004);DIR:OUT;SFP:1101;

    X-OriginatorOrg: vknhsutl.onmicrosoft.com

    X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Dec 2023 01:27:07.2314

    (UTC)

    X-MS-Exchange-CrossTenant-Network-Message-Id: a1a9df75-58f4-44fc-4a46-08dc067af0ce

    X-MS-Exchange-CrossTenant-Id: f8470ee8-0a4e-4a07-a137-8af55b3f5fc4

    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f8470ee8-0a4e-4a07-a137-8af55b3f5fc4;Ip=[65.108.80.57];Helo=[mail.keebler.com]

    X-MS-Exchange-CrossTenant-AuthSource:

    SA2PEPF000015C9.namprd03.prod.outlook.com

    X-MS-Exchange-CrossTenant-AuthAs: Anonymous

    X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

    X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR05MB8059

    X-Spam_score: 9.9

    X-Spam_score_int: 99

    X-Spam_bar: +++++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview:



    Content analysis details: (9.9 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

    Subject: text

    1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

    [URI: bidatinar.blob.core.windows.net]

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [52.101.51.1 listed in list.dnswl.org]

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [52.101.51.1 listed in wl.mailspike.net]

    -0.0 SPF_HELO_PASS SPF: HELO matches SPF record

    -0.0 SPF_PASS SPF: sender matches SPF record

    0.0 ARC_SIGNED Message has a ARC signature

    0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

    0.0 ARC_VALID Message has a valid ARC signature

    0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

    0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

    [bounces-fedex(at)vknhsutl.onmicrosoft.com]

    0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

    0.0 HTML_MESSAGE BODY: HTML included in message

    1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    1.0 MIXED_IMG_CASE Has img tag in mixed case

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    1.0 MIXED_AREA_CASE Has area tag in mixed case

    0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

    0.0 T_REMOTE_IMAGE Message contains an external image

    Subject: {SPAM?} Update: Your Shipment is Moving Towards You



    --PART.2044.zlwhcskl.83289592

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset="UTF-8"







































    --PART.2044.zlwhcskl.83289592--

    I810L0LD383I2.16KwhoissourceRank7.12MPIN0Summary reportDiagnosisDensity00n/a

    Zoom phish from Amazon

    Posted by Dave Yadallee on


    Return-path:

    Envelope-to: davey@doctor.nl2k.ab.ca

    Delivery-date: Tue, 26 Dec 2023 17:41:00 -0700

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

    (envelope-from )

    id 1rIHya-00000000ACE-0kM7

    for davey@doctor.nl2k.ab.ca;

    Tue, 26 Dec 2023 17:40:48 -0700

    Resent-From: The Doctor

    Resent-Date: Tue, 26 Dec 2023 17:40:48 -0700

    Resent-Message-ID:

    Resent-To: davey@doctor.nl2k.ab.ca

    Received: from a87-219.smtp-out.us-west-2.amazonses.com ([54.240.87.219]:57317)

    by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

    (Exim 4.97 (FreeBSD))

    (envelope-from <0101018ca87bc50d-69348ae6-0c37-403f-9225-912389bb644e-000000@noreply.zuora.com>)

    id 1rIGzR-000000002KR-3I2E

    for root@nk.ca;

    Tue, 26 Dec 2023 16:37:42 -0700

    DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

    s=2udze2i7cfr4byeytyph3x6gxqhthkif; d=zuora.com; t=1703633733;

    h=Date:From:Reply-To:To:Message-ID:Subject:Mime-Version:Content-Type:Content-Transfer-Encoding;

    bh=V/8B6Nh7h21rswV6F5IpL68haG9uV1qElSoInXnq+HM=;

    b=ko4qPk2a+OWPiKsFqlbO9n/OYhDD3q7WWvGdysMYetI9N/3LrNPvUnJTBUrYfo5n

    4dqE5ytuD6aKaaDFpS5n3vu6lQmJJa8b0PT+wD3LeYreetS8Cmu7/HV7nD2U32l2vSd

    wOWCSl79yszTgLjW9n7MAnmxhUn1OeJ2z0Y9veG+twDbA0wncPLEf1EoQObgIy/5QP1

    cFV3N483kIQQMbkMQra+ef8OETmxdWOnd+hW8LIYlCQvUyI7CYL6ayOqPwVv2fuROT+

    m15eXwLig3YYsA7wceMGilesl09xdY4bBrkTxHhy5+No7u8vCGW7UgN6de/uvP2uwkl

    iG7exZcGUg==

    DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

    s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1703633733;

    h=Date:From:Reply-To:To:Message-ID:Subject:Mime-Version:Content-Type:Content-Transfer-Encoding:Feedback-ID;

    bh=V/8B6Nh7h21rswV6F5IpL68haG9uV1qElSoInXnq+HM=;

    b=Qt+8p4spWvjexqj9ADVERmE8YF5QpidchyeJirsWDvZZ8npKYlpkYaKc+Isrx7K1

    Kl/RDUKvPvkjv2CMDtq+bbpChs4qRqoZiyZdXMtqykI2Ew3i+3Dkegbbcksd3rW2ejy

    cOqPo7YT3Y/JZYpMNpXQBZF0/MiNKl4c/8vE9NuM=

    Date: Tue, 26 Dec 2023 23:35:32 +0000

    From: Zoom

    Reply-To: no-reply@zoom.us

    To: root@nk.ca

    Message-ID: <0101018ca87bc50d-69348ae6-0c37-403f-9225-912389bb644e-000000@us-west-2.amazonses.com>

    Subject: [ACTION REQUIRED] Your Payment Method on file is expiring soon!

    Mime-Version: 1.0

    Content-Type: text/html;

    charset=UTF-8

    Content-Transfer-Encoding: quoted-printable

    Application: workflow

    Feedback-ID: 1.us-west-2.bUqZEy4ndYef5W/E3kAu2X3cqy3esJ7vu/M6fo7z32w=:AmazonSES

    X-SES-Outgoing: 2023.12.26-54.240.87.219









    =20




    ">


    =3D1">





    =20



    =20




    px; font-family: Lato, Helvetica, Helvetica, sans-serif; max-height: 0px; m=

    ax-width: 0px; opacity: 0; overflow: hidden;">This is a friendly reminder t=

    hat your credit card will be expiring soon.=20

    =09=09=09=09=09=09=09=09=09





    dth=3D"100%">

    =09

    =09=09

    =09=09=09

    =09=09

    =09



    =09=09=09
    =3D"0" class=3D"container" style=3D"max-width:600px;" width=3D"100%">

    =09=09=09=09

    =09=09=09=09=09

    =09=09=09=09=09=09

    =09=09=09=09=09

    =09=09=09=09=09

    =09=09=09=09=09

    =09=09=09=09=09=09

    =09=09=09=09=09

    =09=09=09=09=09



    =09=09=09=09=09

    =09=09=09=09=09=09

    =09=09=09=09=09

    =09=09=09=09=09



    =09=09=09=09=09

    =09=09=09=09=09=09

    =09=09=09=09=09

    =09=09=09=09=09





    =09=09=09=09=09=09









    =09=09=09=09=09

    =09=09=09=09=09=09

    =09=09=09=09=09

    =09=09=09=09=09

    =09=09=09=09=09

    =09=09=09=09=09=09

    =09=09=09=09=09

    =09=09=09=09

    =09=09=09


    =09=09=09=09=09=09
    llspacing=3D"0" style=3D"max-width:600px;" width=3D"100%">

    =09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09

    =09=09=09=09=09=09

    font-size:0; padding-top:0px;" valign=3D"top" class=3D"">

    =09=09=09=09=09=09=09=09=09

    0px; vertical-align:top; width:100%;">

    =09=09=09=09=09=09=09=09=09
    =3D"0" cellpadding=3D"0" cellspacing=3D"0" style=3D"" width=3D"100%">












    valign=3D"middle" class=3D"mobile-header-padding">
    5qr.r.us-west-2.awstrack.me/L0/https:%2F%2Fzoom.us%2F%3Fzcid=3D1640/1/01010=

    18ca87bc50d-69348ae6-0c37-403f-9225-912389bb644e-000000/eqApRme2XKsWQttOGo-=

    L9F8oYh4=3D355" style=3D"text-decoration:none;" target=3D"_blank"><br
    =3D"Zoom Logo" border=3D"0" src=3D"http://click.zoom.us/l/84442/2020-05-20/=

    blf6y3/84442/140394/zoom_logo_white.png" style=3D"display:block; font-famil=

    y:'Lato', Helvetica, sans-serif; font-size:18px; line-height:22px; color:#7=

    6798a; font-weight:bold; width:100%; max-width: 100px" width=3D"100">     <=

    /td>

    =09=09=09=09=09=09=09=09=09=09=09=09
    0px 30px" valign=3D"top" class=3D"mobile-header-padding">




    der-spacing:0;">

    =09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09

    " href=3D"https://bjwg65qr.r.us-west-2.awstrack.me/L0/https:%2F%2Fzoom.us%2=

    Fsignin%3Fzcid=3D1640/1/0101018ca87bc50d-69348ae6-0c37-403f-9225-912389bb64=

    4e-000000/XvWvJoQmtFhZUodsNIrHHft_nCg=3D355" style=3D"border-radius: 3px; b=

    order: 1px solid #57A3FF; display: inline-block; padding: 7px 30px; text-a=

    lign: center; font-family:'Lato', Helvetica, sans-serif; font-size:12px; li=

    ne-height:20px; color:#FFFFFF; font-weight:700; text-decoration: none; text=

    -transform: uppercase; letter-spacing: 0.2em" target=3D"_blank">Sign In    =


    =09=09=09=09=09=09=09=09=09


    =09=09=09=09=09=09=09=09=09


    =09=09=09=09=09=09

    n=3D"top" class=3D"mobile-padding">

    =20

    =09=09=09=09=09=09
    llspacing=3D"0" style=3D"max-width:600px;" width=3D"100%">

    =09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09

    =09=09=09=09=09=09

    px 30px 10px; font-family:'Lato', Helvetica, sans-serif; font-size:38px; li=

    ne-height:42px; color:#232333; font-weight:900; display: block; letter-spac=

    ing: 0.01em;">Your Payment Method on file is expiring soon!




    =09=09=09=09=09=09
    llspacing=3D"0" style=3D"max-width:600px;" width=3D"100%">

    =09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09

    =09=09=09=09=09=09

    px 30px; display: block" valign=3D"top" class=3D"mobile-padding">


    84442/2020-05-20/blf6y1/84442/140392/title_marker_40x8.png" style=3D"width:=

    100%; max-width: 40px" width=3D"40">


    =09=09=09=09=09=09

    :0px 30px 60px 30px;" valign=3D"top" class=3D"mobile-padding">

    =09=09=09=09=09=09
    llspacing=3D"0" style=3D"max-width:600px;" width=3D"100%">

    =09=09=09=09=09=09=09

    =09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09





    =09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09





    =09=09=09=09=09=09=09=09=09



    =09=09=09=09=09=09=09

    =09=09=09=09=09=09

    adding-bottom: 30px; font-family:'Lato', Helvetica, sans-serif; font-size:1=

    6px; line-height:24px; color:#FFFFFF; font-weight:400; color:#747487; lette=

    r-spacing: .01em; text-align: left">Dear Dave Yadallee,



    Your payment method on file is expi=

    ring soon:



    ************7600



    Please update your payment method in your billing portal in order to avoid=

    losing any of your paid features.

    =09=09=09=09=09=09=09=09=09

    px" valign=3D"top">

    =09=09=09=09=09=09=09=09=09
    s:3px; border-spacing:0; margin:0 auto">

    =09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09

    href=3D"http://bjwg65qr.r.us-west-2.awstrack.me/L0/http:%2F%2Fzoom.us%2Fbil=

    ling%2Fpayment/1/0101018ca87bc50d-69348ae6-0c37-403f-9225-912389bb644e-0000=

    00/XCFt8lVLC3eneJ9Qy0Vpq984ytM=3D355" style=3D"border: 0 solid #FF5F0F; di=

    splay: inline-block; padding: 20px 45px; text-align: center; font-family:'L=

    ato', Helvetica, sans-serif; font-size:15px; line-height:24px; color:#FFFFF=

    F; font-weight:900; text-decoration: none; text-transform: uppercase; lette=

    r-spacing: .2em" target=3D"_blank">Update Credit Card


    =09=09=09=09=09=09=09=09=09

    ding-top: 50px">


    ed; border-width: 0 0 5px 0;">


    =09=09=09=09=09=09

    :0px 30px 60px 30px;" valign=3D"top" class=3D"mobile-padding">

    =09=09=09=09=09=09
    llspacing=3D"0" style=3D"max-width:600px;" width=3D"100%">

    =09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =20

    =09=09=09=09=09=09=09

    =09=09=09=09=09=09

    g: 0px 30px 20px 30px; font-family:'Lato', Helvetica, sans-serif; font-size=

    :20px; line-height:24px; font-weight:700; color:#232333; text-align: center=

    ; text-transform: uppercase; letter-spacing:0.05em;" class=3D"mobile-paddin=

    g">Related Articles

    =09=09=09=09=09=09=09=09

    adding-bottom: 0px; font-family:'Lato', Helvetica, sans-serif; font-size:16=

    px; line-height:24px; color:#FFFFFF; font-weight:400; color:#747487; letter=

    -spacing: .01em; text-align: left">

    =09=09=09=09=09=09=09=09=09


    =09=09=09=09=09=09

    n=3D"top">

    =09=09=09=09=09=09
    llspacing=3D"0" style=3D"max-width:600px;" width=3D"100%">

    =09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09









    =09=09=09=09=09=09=09

    =09=09=09=09=09=09

    adding:60px 30px 40px; font-family:'Lato', Helvetica, sans-serif; font-size=

    :20px; line-height:24px; font-weight:700; color:#ffffff; text-align: center=

    ; text-transform: uppercase; letter-spacing:0.05em; background-color: #2255=

    85; text-transform: uppercase">

    to">Need Additional Help, Resources, or Training?

    x 80px; font-family:'Lato', Helvetica, sans-serif; font-size:15px; line-hei=

    ght:22px; color:#ffffff; font-weight:900; text-align: center; display: bloc=

    k; letter-spacing: 0.2em; text-transform: uppercase; background-color: #225=

    585;">


    wg65qr.r.us-west-2.awstrack.me/L0/https:%2F%2Fsupport.zoom.us/1/0101018ca87=

    bc50d-69348ae6-0c37-403f-9225-912389bb644e-000000/ivQW_OiGzxI2Axn7grUMUIBSU=

    xk=3D355" style=3D"color:#ffffff; text-decoration: none; vertical-align: mi=

    ddle" target=3D"_blank">Visit Zoom Help Center   
    "https://storage.pardot.com/84442/140356/textual_link_arrow_white.png" styl=

    e=3D"width:100%; max-width: 8px; vertical-align: middle" width=3D"8">
    td>

    =09=09=09=09=09=09=09=09

    lass=3D"mobile-padding">

    =09=09=09=09=09=09
    llspacing=3D"0" style=3D"max-width:600px;" width=3D"100%">

    =09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09

    =09=09=09=09=09=09

    " valign=3D"top">

    =09=09=09=09=09=09=09=09=09
    =3D"0" cellspacing=3D"0" width=3D"100%">

    =09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09

    ottom:15px;" valign=3D"top">

    =09=09=09=09=09=09=09=09=09=09=09=09
    llpadding=3D"0" cellspacing=3D"0">

    =09=09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09

    "top" class=3D"">
    ps:%2F%2Ftwitter.com%2Fzoom_us/1/0101018ca87bc50d-69348ae6-0c37-403f-9225-9=

    12389bb644e-000000/T_xuPcGKxbxAuQztJHnWObt23Zo=3D355" style=3D"text-decorat=

    ion:none;" target=3D"_blank">3D"Twitter"
    " src=3D"http://click.zoom.us/l/84442/2019-12-26/bfs1bv/84442/140021/Social=

    _Twitter_2020.png" style=3D"display:block; font-family:'Lato', Helvetica, s=

    ans-serif; font-size:9px; line-height:22px; color:#ffffff;" width=3D"28">
    a>    		&n=

    bsp;
    "top" class=3D"">
    ps:%2F%2Fwww.linkedin.com%2Fcompany%2Fzoom-video-communications%2F/1/010101=

    8ca87bc50d-69348ae6-0c37-403f-9225-912389bb644e-000000/IOSAUQBnvUw55ffu077T=

    wSkZT9M=3D355" style=3D"text-decoration:none;" target=3D"_blank"><br
    =3D"LinkedIn" border=3D"0" height=3D"28" src=3D"http://click.zoom.us/l/8444=

    2/2019-12-26/bfs1bs/84442/140023/Social_LinkedIn_2020.png" style=3D"display=

    :block; font-family:'Lato', Helvetica, sans-serif; font-size:9px; line-heig=

    ht:22px; color:#ffffff;" width=3D"28">    		&n=

    bsp;
    "top" class=3D"">
    :%2F%2Fblog.zoom.us%2F/1/0101018ca87bc50d-69348ae6-0c37-403f-9225-912389bb6=

    44e-000000/gVb7W1VGBJEXnBimRWXLwOQGGKI=3D355" style=3D"text-decoration:none=

    ;" target=3D"_blank">3D"Blog"
    tp://click.zoom.us/l/84442/2019-12-26/bfs1bx/84442/140025/Social_Blog_2020.=

    png" style=3D"display:block; font-family:'Lato', Helvetica, sans-serif; fon=

    t-size:9px; line-height:22px; color:#ffffff;" width=3D"28">


    =09=09=09=09=09=09=09=09=09=09=09=09

    oter" style=3D"font-family:'Lato', Helvetica, sans-serif; font-size:13px; l=

    ine-height:22px; color:#828282;">
    track.me/L0/tel:1-888-799-9666/1/0101018ca87bc50d-69348ae6-0c37-403f-9225-9=

    12389bb644e-000000/3Gui_WU4DIjXWbaBLQ2EmD-rO9I=3D355" style=3D" text-decora=

    tion: none; color: #828282;">+1.888.799.9666


    =09=09=09=09=09=09=09=09=09=09=09=09=C2=A9 2022 Zoom - All Rights Reserved<=

    /td>

    =09=09=09=09=09=09=09=09=09=09=09


    =09=09=09=09=09=09=09=09=09


    =09=09=09=09=09=09

    lass=3D"mobile-padding">

    =09=09=09=09=09=09
    llspacing=3D"0" style=3D"max-width:600px;" width=3D"100%">

    =09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09

    =09=09=09=09=09=09

    x 0;" valign=3D"top">

    =09=09=09=09=09=09=09=09=09
    =3D"0" cellspacing=3D"0" width=3D"100%">

    =09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09

    oter" style=3D"font-family:'Lato', Helvetica, sans-serif; font-size:13px; l=

    ine-height:20px; color:#969AA1;">Visit
    -2.awstrack.me/L0/http:%2F%2Fzoom.us/1/0101018ca87bc50d-69348ae6-0c37-403f-=

    9225-912389bb644e-000000/XzlLG-enc9h7vFWZk7jSOlsv-Ek=3D355" style=3D"color:=

    #969AA1" target=3D"_blank">zoom.us


    =09=09=09=09=09=09=09=09=09=09=09=09
    .awstrack.me/L0/https:%2F%2Fwww.google.com%2Fmaps%2Fplace%2F55%2BAlmaden%2B=

    Blvd,%2BSan%2BJose,%2BCA%2B95113%2F@37.3328541,-121.897097,17z%2Fdata=3D!3m=

    1!4b1!4m5!3m4!1s0x808fcca40adf3cb7:0x5a2d33d3593e0a33!8m2!3d37.3328541!4d-1=

    21.8949083/1/0101018ca87bc50d-69348ae6-0c37-403f-9225-912389bb644e-000000/F=

    06n7-rS6NnHnYac_OcoQrJ8Cac=3D355" style=3D"color:#969AA1; text-decoration: =

    none;" target=3D"_blank">55 Almaden Blvd


    =09=09=09=09=09=09=09=09=09=09=09=09San Jose, CA 95113


    =09=09=09=09=09=09=09=09=09

    ;" valign=3D"top">

    =09=09=09=09=09=09=09=09=09
    =3D"0" cellspacing=3D"0" width=3D"100%">

    =09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09=09

    =09=09=09=09=09=09=09=09=09

    oter" style=3D"font-family:'Lato', Helvetica, sans-serif; font-size:10px; l=

    ine-height:15px; color:#969AA1;">You're receiving this email because you si=

    gned up for a Zoom account.


    =09=09=09=09=09=09=09=09=09=09=09=09If you wish to be removed from our emai=

    l list,
    fr=3Dpd" style=3D"color:#969AA1; text-decoration: underline;">unsubscribe
    a>.


    =09=09=09=09=09=09=09=09=09


    =09=09=09=09=09=09


    =09=09=09




    3D""
    7bc50d-69348ae6-0c37-403f-9225-912389bb644e-000000/FdB14I15dCtt0Qd3vMGe_eqd=

    rFc=3D355" style=3D"display: none; width: 1px; height: 1px;">