Office Depot Officemax Phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 13 Jan 2024 14:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rOltR-00000000AXn-3Gdx

for dave@doctor.nl2k.ab.ca;

Sat, 13 Jan 2024 14:50:17 -0700

Resent-From: The Doctor

Resent-Date: Sat, 13 Jan 2024 14:50:17 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dbaeur03on2066.outbound.protection.outlook.com ([40.107.104.66]:37138 helo=EUR03-DBA-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rOkiM-00000000Do3-3fGC

for doctor@doctor.nl2k.ab.ca;

Sat, 13 Jan 2024 13:34:50 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=P3i/nB7ay2yLQ/YhZGr0ngcvrD/gZhluZ5PS5FhHJG8PPJ8ExS2ppk1iTDJSXAzTcc3fHOGeNfLy8Dx7HFSxR5Qtw5GRHN1oRbi/TfEpZdUItmndBH4nNCT2fa6dCfts1w9zEW6zSjbNLldmIHDLvqVmJQ9YAwbtaw1ESYMtoGa1YIX+gKzUECaGIBdCX0HAogssoDjgCCw97Bnp7uYNCJcNqX4ppBA1gxwV1MuEhkrQ8tHyE3OweS0rT7UAEe91LlbzzGxsTzbo3pbOiaQRznhtGgwvILTQdG6uObExayg7KYAzAOIuQ2q55Kpqql16afU8jBplvAqDET0TOWUd7g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=bKSzDAPK9p7yXbjf0j4F0qGOelArydWyV+W2JXkxXD0=;

b=YoQ58eiNAZAPdlEBfMyXuOJySYO/GhQmvr6LOFJvTV9Dc372dJ4lfOe18BgcqC9qH0f+tBc6g85CZE4zRFN+x39D7H9teF9d2knv9LNUXkS0WjJccSIQfuJc1o8+kKcWkAvzB9oaQu8US7SxA9xKwCoI8LPdu1VmTLYcCvgas135Zy3aEiJdgcETStEyM3SmFtjMcDcegI1WdT8M4rHknufwxBtKibp87WexMqgQIv2U3lw635rFT6Fny1oD/wI0DLOb9nlVDk5FZCqq7VIc1IFS81918xYQd19JpbdivGX3gTqIFz0RFw/JNAOei14RvIrOAQfoho0tpTSn5vy3xw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

139.177.205.207) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=maritinschool.onmicrosoft.com; dmarc=none action=none

header.from=maritinschool.onmicrosoft.com; dkim=none (message not signed);

arc=none (0)

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 139.177.205.207)

smtp.mailfrom=maritinschool.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none

header.from=maritinschool.onmicrosoft.com;

From: OfficeMax Rewards

Content-Transfer-Encoding: 7bit

Date: Sat, 13 Jan 2024 21:25:55 +0100

To: doctor@doctor.nl2k.ab.ca

CC: doctor@doctor.nl2k.ab.ca

In-Reply-To:

Subject: Your Printer Dreams Come True: Free Epson Printer Awaits

Content-Type: text/html; charset="UTF-8"

MIME-Version: 1.0

Importance: high

Message-ID:



X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: AMS0EPF00000197:EE_|VE1PR06MB7053:EE_

X-MS-Office365-Filtering-Correlation-Id: ca220083-8c6e-475b-e2ac-08dc1476c936

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

2rutlsXWe/kDMaPH5WoQpezEx/Mu78J/rPzHINcaDq936S3nE8IDdMIO7WUKJBPOjFQZn8+UL/XYLPK7X9VLMWLgEtbSe0noXChuvrXgZxg7KGqVtXROfNbH7OKPvCXyMU/FdRSb1m/a+/ugFsVWZCV3hwE7KFFfDBNfJU+eYltwxmcq4Qf3+2VLBtL5JVR4Qcow7d3ZiDNbjoOIjfzZ6KMCgML/GVKS452uvI7doGirCO4i2lJJGcFXVBXN0cMWj0aQkODCPelE4u1NwvO/oL9F4jFb3/jlnBGjFkzJva8rKnYO+E/3HsDg6rJOLDZd3SxCEPQ/c+ntCRSE9tvJfnpBLTb1CgNE0nFcImCkrlM1BVBpjjrT3gosiuPQiz7kqw90P3OrGo93rlVwGJEwxAkucCGGZvJVvETuZMuQ9n3gbEOJGFt2rFBNBIsFyxgOfUTeLVVspJGTDqGFi47JBNZjQa2/m1unVnv3KWK2ofkf02MSZTQNNzwbW5RbhtknDjXkqsAEiXVABX1d7Q/qRw==

X-Forefront-Antispam-Report:

CIP:139.177.205.207;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.beatty.com;PTR:139-177-205-207.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(396003)(346002)(376002)(136003)(39860400002)(230922051799003)(61400799012)(1690799017)(451199024)(7200799017)(64100799003)(186009)(82310400011)(40470700004)(36840700001)(46966006)(5660300002)(2906002)(31696002)(558084003)(86362001)(81166007)(478600001)(166002)(41320700001)(9686003)(336012)(26005)(36860700001)(82740400003)(34070700002)(8936002)(47076005)(8676002)(316002)(67280400001)(4326008)(786003)(70586007)(70206006)(41300700001)(42186006)(6916009)(40480700001)(8400799017)(40460700003);DIR:OUT;SFP:1101;

X-OriginatorOrg: maritinschool.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jan 2024 20:32:39.2094

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: ca220083-8c6e-475b-e2ac-08dc1476c936

X-MS-Exchange-CrossTenant-Id: 6fbbd7c3-ed6f-4166-979d-b2ae1e2e62db

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=6fbbd7c3-ed6f-4166-979d-b2ae1e2e62db;Ip=[139.177.205.207];Helo=[mail.beatty.com]

X-MS-Exchange-CrossTenant-AuthSource:

AMS0EPF00000197.eurprd05.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: VE1PR06MB7053









(1) Notifications
























I1.18KL0LD35.4KI2.16KwhoissourceRank10.8MPIN0Summary reportDiagnosisDensity00n/a

Office Depot Phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 13 Jan 2024 14:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rOltx-00000000CRM-2eEZ

for dave@doctor.nl2k.ab.ca;

Sat, 13 Jan 2024 14:50:49 -0700

Resent-From: The Doctor

Resent-Date: Sat, 13 Jan 2024 14:50:49 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-mw2nam10on2056.outbound.protection.outlook.com ([40.107.94.56]:34784 helo=NAM10-MW2-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rOlWj-00000000F83-3Wjm

for root@nk.ca;

Sat, 13 Jan 2024 14:26:53 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=ZKYpImn043xyOxprDhZi0U2XfjnbpmB2UshC4fvKedYP2iOZ4FvXomt5BFh8io+2m0MEp3TcWhSJCbABHHfTPawDTJ6N9MZKl0yC7JxjndlIuTbxHPkZIUI06QdGJ7tLE9+1IhrbnTGWsh8hZTglWgYxtqrf3Q72AIpXduW9TGtFD58xtmJiJuhTBo2bzqJXv52BS5OMCOwZ9OTsgUwUGRiFccZ+LGINgVEOlVSIWeyzH0PA5aOyRSio25Jf6D5smWO6cXPEWnsofHVWKHUZgYzwJFk4o/Yq8Q90tKFVzODyyGkD5uy2ZcXh6n6Q9guOUK5BXmHn4PFBDg2YBs7zFg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=A8piq+IWKl85EQYVtv95MnzHfEIsIcbjqc/nP392xzA=;

b=hWCuMLyf/Saa/FawRF7p9eK07O2/TM8+x9nDIdgWG0kcu/kACDrWvvUot2eJWPzu4iieCt/UtaJdsCD0ybHw7sl+JGZfVfXCTJGoKR9Ug1IMNo/jMl6W52PmCkQZd6cjM4AbxXuNNAiSIioh3CR6HVA6x+syfHlmNgXUBBhYAEX56z9fiCwHUIX7Frj/vnErd08l73M7WHngNn+RV6r14RaQyDxvL084PnQ96kLoEVMgiz8oKnkVREgcIehibVtYWWTg9OAkzGly/LaWktM7LKxKhBj+xz90vzHZZL6cMaqsdKL1ApMai75hlLcVUiaGlwc8ksW2LxxXnMue/ftekw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

173.230.129.124) smtp.rcpttodomain=nk.ca

smtp.mailfrom=1r78099.onmicrosoft.com; dmarc=none action=none

header.from=1r78099.onmicrosoft.com; dkim=none (message not signed); arc=none

(0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1r78099.onmicrosoft.com; s=selector1-1r78099-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=A8piq+IWKl85EQYVtv95MnzHfEIsIcbjqc/nP392xzA=;

b=O4vsSdqeofPuvDQITyKfUcnHTdf51HtcZDqbdhyszkEpRbVMPPRV8pOTmjJPaPlhYXGF6ZUFwi5xula399OtOBxdaIgZUnWgZP3tS4VhKSWDxOZLMS+6IKxxO905AS6Rdk/bCJ9YFNg47BjVkxpqXrU9nNQU/Ys9vQhP2rlzcVOO03vx+j16ceZ4dQ0Tgb1dw/pEym4bSWNjGe3bM03Hx/A4U5IqY0g/hnpB07pHQDgC6jYToIgjTRKPNneJ+dUACMLPDhGgq4UN4ik6R3baEZ94IS8R0cDOwTRqGBCud0ZAShPQA3jEg2pKeMMBuZWMsnjFiMHJ8LaLBXtqw2ntxQ==

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 173.230.129.124)

smtp.mailfrom=1r78099.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=1r78099.onmicrosoft.com;

To: root@nk.ca

Content-Type: text/html; charset="UTF-8"

MIME-Version: 1.0

From: Office Depot

Date: Sat, 13 Jan 2024 22:18:58 +0100

Importance: high

Subject: Your Printer Dreams Come True: Free Epson Printer Awaits

CC: root@nk.ca

In-Reply-To:

Content-Transfer-Encoding: 7bit

Message-ID:

<8f761206-5b5a-4476-98aa-1d4691a35bb8@BL02EPF0001A0F9.namprd03.prod.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BL02EPF0001A0F9:EE_|PH0P222MB0548:EE_

X-MS-Office365-Filtering-Correlation-Id: a9277b05-07f0-4110-16e0-08dc147e0f61

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

xWzmtzCQEy8IMqeEipHzsqJdsbLSalwyRejtuwrmYF1dOE1vcgmWS/s7XVHRkp72WBuO8RWAVJtETAuwNKcbCMjf3C7EWRRdnEw98aEwvAQgOJqXeg/GGwfSUHm/EqiB4hDAWf+C0ZWW/KYyDhmuBESFjKw0xzHye8gDbPnWqXQfPsxhHwlTahL57zZyX7Zbf82JtNTjLiWBDNtoCFNH4H+gPXyi+mbK6qAty2AteOIlIoPEGuGVB06wdEZgbkgCoAtWx119DZAi5s6g+NbSOBVfYGaHnQ+meNxrqv65OfA2yLCvZjgemknMZfAZ4cykyMXZJir8dyiQkoSztN3jihtp4uRD4dtC6R8wBCWUsNaaGvg0imbjtWX4idpTovmFNcHLK0i24Cc2RKMlX0jMXl6z9I9oOBTlmYtRo8tV2aNS9JfGT6VWG8reVI2efAahSPjNzxWska6EnG0v/smYF6VQTujWfuROpy3jJHb0Df3tWKixH1/U9P3qWJDqd70ShFebFLmUKs9YUZiWSGTItw==

X-Forefront-Antispam-Report:

CIP:173.230.129.124;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.thompson.com;PTR:173-230-129-124.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(346002)(136003)(39860400002)(396003)(376002)(230922051799003)(7200799017)(451199024)(1690799017)(82310400011)(186009)(64100799003)(61400799012)(40470700004)(46966006)(36840700001)(9686003)(336012)(26005)(36860700001)(82740400003)(34070700002)(47076005)(5660300002)(4326008)(67280400001)(41300700001)(2906002)(478600001)(316002)(786003)(8676002)(42186006)(8936002)(70586007)(6916009)(70206006)(41320700001)(558084003)(31696002)(86362001)(166002)(81166007)(8400799017)(40460700003)(40480700001);DIR:OUT;SFP:1101;

X-OriginatorOrg: 1r78099.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jan 2024 21:24:43.5911

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: a9277b05-07f0-4110-16e0-08dc147e0f61

X-MS-Exchange-CrossTenant-Id: d2ae39a8-0ef3-4185-90be-c73d99c9fb7f

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=d2ae39a8-0ef3-4185-90be-c73d99c9fb7f;Ip=[173.230.129.124];Helo=[mail.thompson.com]

X-MS-Exchange-CrossTenant-AuthSource:

BL02EPF0001A0F9.namprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0P222MB0548









(1) Notifications
























I1.18KL0LD35.4KI2.16KwhoissourceRank10.8MPIN0Summary reportDiagnosisDensity00n/a

Canada post phish from server.effexhost.com from Union City New Jersey

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 13 Jan 2024 08:34:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rOg0U-00000000CTV-2l3i

for dave@doctor.nl2k.ab.ca;

Sat, 13 Jan 2024 08:33:10 -0700

Resent-From: The Doctor

Resent-Date: Sat, 13 Jan 2024 08:33:10 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.effexhost.com ([107.182.225.196]:43352)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rOfzm-00000000CL9-36ka

for doctor@nk.ca;

Sat, 13 Jan 2024 08:32:36 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=global.effexhost.com; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:From:Date:Subject:To:Sender:Reply-To:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=kHxu7mEHgwDHJ37ygRFCeaJbL3SNLvNZqzV2oWi0GxE=; b=K41csrA+KqE4vJwQiizWEAoEYY

Fm9cyJ7mhH5jpcJftjbbXw6Z9uoT4nkw2Tia4ev7A0y7rOOWM9B7A6mGwya7/nhRpMM7FR2pTCuPc

BR6H/AFurDc748tASVM6PtJ44UJMNuMhIfrwbxlQ151F7bbtGCv6kz0DO8au2H075lpmIHB0WkF6s

X4mc9h82aDAeySYNIJfhKCaybY7ABJLcjrIW9TWdEH46l7lMX40RtaZi7ece1+jyVtZoBYDWpcbC6

yqJ66ZDWFMts7RCCDIKlVXe5rVQWgyxqMbCEdChL7pRJkI28RuKPot/fH/tFZs2Ch69T3TY/PPJG4

uhBn3ARA==;

Received: from globaleffexhost by effexhost.com with local (Exim 4.93)

(envelope-from )

id 1rOfxm-0000vD-7z

for doctor@nk.ca; Sat, 13 Jan 2024 15:30:22 +0000

To: doctor@nk.ca

Subject: New package awaiting delivery

X-PHP-Script: global.effexhost.com/wp-content/plugins/lufixmailer.php for 197.146.225.207

X-PHP-Originating-Script: 653:lufixmailer.php

Date: Sat, 13 Jan 2024 15:30:22 +0000

From: Canada Post | Postes Canada

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_f40298d20a217eef06b6620f20eca2d2"

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - effexhost.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [653 496] / [47 12]

X-AntiAbuse: Sender Address Domain - canadapost-postescanada.ca

X-Get-Message-Sender-Via: effexhost.com: authenticated_id: globaleffexhost/only user confirmed/virtual account not confirmed

X-Authenticated-Sender: effexhost.com: globaleffexhost

X-Source: /opt/cpanel/ea-php74/root/usr/bin/php-cgi

X-Source-Args: /opt/cpanel/ea-php74/root/usr/bin/php-cgi

X-Source-Dir: global.effexhost.com:/public_html/wp-content/plugins

X-Spam_score: 10.6

X-Spam_score_int: 106

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your package N* 171221409446816055907752 is under transport

by Canada Post Office.This may happen when your delivery's address is incorrect.

We ask you to replan your delivery by connecting via the li [...]



Content analysis details: (10.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: tt.vg]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=delivery%40canadapost-postescanada.ca;ip=107.182.225.196;r=doctor.nl2k.ab.ca]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.4 PHP_SCRIPT Sent by PHP script

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} New package awaiting delivery



This is a multi-part message in MIME format.



--b1_f40298d20a217eef06b6620f20eca2d2

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit









Â















Â





Your package N* 171221409446816055907752 is under transport by Canada Post Office.This may happen when your delivery's address is incorrect. We ask you to replan your delivery by connecting via the link below as soon as possible.





































Plan your delivery













Once your delivery address and payment is complete, your package will be delivered the next day following our terms and conditions.Finally, be aware that you can follow the progress of your package or have information about our products and services on our site.

This is an automatic message. Please do not reply.





Arrived at Canada Post Office Origin Facility: 01.13.2024 06:21:05 AM





--b1_f40298d20a217eef06b6620f20eca2d2

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit

















Â



















Â


Your package N 964836133325 is under transport by Canada Post Office.

This may happen when your delivery's address is incorrect. We ask you to replan your delivery by connecting via the link below as soon as possible.



































Plan your delivery










Once your delivery address and payment is complete, your package will be delivered the next day following our terms and conditions.
Finally, be aware that you can follow the progress of your package or have information about our products and services on our site.



This is an automatic message. Please do not reply.







*Arrived at Canada Post Office Origin Facility: 01.13.2024 06:21:05 AM











--b1_f40298d20a217eef06b6620f20eca2d2--

I1.18KL0LD35.4KI2.16KwhoissourceRank10.8MPIN0Summary reportDiagnosisDensity00n/a

Rachel Ray Cookware Phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 12 Jan 2024 20:01:37 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rOUGR-00000000FFI-1UnV

for dave@doctor.nl2k.ab.ca;

Fri, 12 Jan 2024 20:00:51 -0700

Resent-From: The Doctor

Resent-Date: Fri, 12 Jan 2024 20:00:51 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm3nam02on2106.outbound.protection.outlook.com ([40.107.95.106]:8544 helo=NAM02-DM3-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rOU1f-00000000ArF-1tmw

for root@nk.ca;

Fri, 12 Jan 2024 19:45:39 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=Zo5Ez+Lf5l82eYtDrauCYzTC4dZHSftqJECt/TlA1TUCsN3Zlq3pTC3kibiYYZ8blIHzpfNZKELYDIec/g2PCaTaXkOaVdZMMDfyw585H9npjwmdSya87UrVLxBavrc7uLCvjgzKbU5OiSa3bsaI0g9/X+v2qlGw5tWghFPENlxMXGogBE3dqnzlh6fWG1PxhX+t0DgrZ1hJFLKYWqBvZ/v88DGEqrcWw+M0GUbAcQBU3TpVwH0AAVmHZy4Ehy1BdiTGJxrXzJgmE6qTM1eOm22FgzneswsJxmwUGveyIuoD5/9AN8OvZ4cpsE8NFYxldMrcpx4eG7S1ySXRqIanWA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=1PodxtikuJNiWWcUA+48znHSCJtVCWw+EYzlmnOl8Tc=;

b=kJJalqsRAnWVIFRm08vdChQp8mbaNqkS32vwUjIUgbrSF0AMmlQVizlD7+0iByZkIwb3zY0twIRDLvQYI0qPqn3Svr/Ne3o0UaAKWxqFcsUWnq5M2hiaYmGwMYeqpvBb18PbJHspWbe9w1cf+e4kzi8f3Zj1ell4uyy2Ay2uFEPNLOMf3SaelFFYP4X7R44k30tnWINt1JaG/Fycml7AXSgyIE2tccOXcIPPg0L0Jg89p57UjDvKGSON+hY40Ta6pz7G25/BlXVTVRU0nVSZjNCnC+gNAEU9rdAwUL4ryrUnZg0ILxnN7DkMQptPHRvCSliU4RBhc+GxNAUaWJFpbg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

45.79.196.24) smtp.rcpttodomain=nk.ca

smtp.mailfrom=nvduw2axyqgs.onmicrosoft.com; dmarc=none action=none

header.from=nvduw2axyqgs.onmicrosoft.com; dkim=none (message not signed);

arc=none (0)

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 45.79.196.24)

smtp.mailfrom=nvduw2axyqgs.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none

header.from=nvduw2axyqgs.onmicrosoft.com;

In-Reply-To:

CC: root@nk.ca

Date: Sat, 13 Jan 2024 03:36:49 +0100

Subject: Get a Rachael Ray Cucina Cookware Set for Your Valuable Input

Importance: high

From: Confirmation Needed

To: root@nk.ca

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

Message-ID:

<11d86d30-fcf7-4174-b457-b16b602b9375@DS3PEPF000099DA.namprd04.prod.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: DS3PEPF000099DA:EE_|DM6PR06MB6748:EE_

X-MS-Office365-Filtering-Correlation-Id: f324a110-f235-4d28-0778-08dc13e16cf2

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

ZrsxiMtjxuRAJnXF1eaKtCCsgdkwlgsSlVOQdtdqpUi3tFQO67ii8wBXheWDvAvsGDI6nBNX6axMgwSQIX0p92z4CHG3a/KyoiwNHuYfVwLK7PCAGzKvvCn0AAIbrBLN8IMoBsR/MUt/8GBDQiGoiLM2yqZiDyZNfY4y1qP07cYAeoWMiMrwGnSDUMZaC8CHBasxZbB9aP7MN1+GhaKDI4DoPiN5Krb4P23u5hS9Ajx6FxqtXdVu/VXqBJ+xJcTqcKbZIU/28J0di+QIiYQh9j262mlqkN02ZHoKjUnoVyQ3eK8ZQwVH2FuTS3dkzemlZVQxn5dJSa9hicyX9HvxNLKMheIHTAXEv8N4ogRyN4htYPKeb8OwIY0GjnuD2RO52bcjPTOMzj658mH3s4iV76G+md13b8PyybR641R9zQyMe33VG87a1l4hElg4G30c+aM74RvPvBORkOHKzFsHtppD0XWn/nXnQvtytZWgRcvSnLn8XRP0ltI9ykZ01ynf/v9mMEpaMQx8ZpZuZe4tNj8JYIODXB+FHKEDwU9CElQ=

X-Forefront-Antispam-Report:

CIP:45.79.196.24;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.simonis.com;PTR:45-79-196-24.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(39860400002)(376002)(346002)(136003)(396003)(230922051799003)(451199024)(61400799012)(7200799017)(186009)(82310400011)(1690799017)(64100799003)(40470700004)(36840700001)(46966006)(81166007)(82740400003)(166002)(40480700001)(8400799017)(31696002)(86362001)(40460700003)(26005)(336012)(41320700001)(478600001)(70586007)(6916009)(70206006)(316002)(8936002)(8676002)(42186006)(786003)(9686003)(36860700001)(34070700002)(47076005)(558084003)(5660300002)(2906002)(67280400001)(41300700001)(4326008)(44642001);DIR:OUT;SFP:1102;

X-OriginatorOrg: nvduw2axyqgs.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jan 2024 02:43:29.5044

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: f324a110-f235-4d28-0778-08dc13e16cf2

X-MS-Exchange-CrossTenant-Id: 1ce81aac-37c9-4a18-b953-e48b5c8216a1

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=1ce81aac-37c9-4a18-b953-e48b5c8216a1;Ip=[45.79.196.24];Helo=[mail.simonis.com]

X-MS-Exchange-CrossTenant-AuthSource:

DS3PEPF000099DA.namprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR06MB6748

X-Spam_score: 6.2

X-Spam_score_int: 62

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: (1) Notifications



Content analysis details: (6.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.107.95.106 listed in list.dnswl.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: kd413uuh0b.storage.googleapis.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.95.106 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 ARC_SIGNED Message has a ARC signature

0.0 ARC_VALID Message has a valid ARC signature

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

1.0 HK_RANDOM_FROM From username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[artado_jmlzrdxybpm(at)nvduw2axyqgs.onmicrosoft.com]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

-0.0 T_SCC_BODY_TEXT_LINE No description available.

Subject: {SPAM?} Get a Rachael Ray Cucina Cookware Set for Your Valuable Input









(1) Notifications
























I1.18KL0LD35.4KI2.16KwhoissourceRank10.8MPIN0Summary reportDiagnosisDensity00n/a

Kroger Cookware Phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 12 Jan 2024 19:09:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rOTRY-000000008WA-06jT

for dave@doctor.nl2k.ab.ca;

Fri, 12 Jan 2024 19:08:16 -0700

Resent-From: The Doctor

Resent-Date: Fri, 12 Jan 2024 19:08:16 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-am6eur05on2118.outbound.protection.outlook.com ([40.107.22.118]:16608 helo=EUR05-AM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rOTJj-0000000083Z-2B1t

for doctor@doctor.nl2k.ab.ca;

Fri, 12 Jan 2024 19:00:15 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=FUsE+6bK+Fp0FGKq6RiU6C1AwTke351i6/iGIoP6D41NulAywByHD4L/pBcytapc4NBfwpoqKr5lIBUcjBGg/A3VsjygFwNlS3Gd2QkbEv0HA0qxAL+hIfazoZLdbRmd1pF7BbC6mBCGRpWP7384L3Pa6puZagDx7npuLAHeg8Q/Z+OPJrfsxAWq4SUMrm2LJlKPaMQrf8LizPPQyHSd0DqcIUMZwbIiD9TGOTElt5oMNP042LnfOfn9B5XZvm5fTTCYz7dwhIGhb6IoUTyfQWRaUdLkEWk+28WTuXwJ8kNwWcAFD8gN9uqhY1Ejwl/NYj8lQkqU8VGs0nN6cmqmTg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=5s/JrhR+8hr3NCZyczYZoJ6/+ocuXxvZUGwp/MQHOqo=;

b=RH0Cf2jYZpmLhK90TKzy2U69L83UvT4G5coVkyG4Hp9khIEa3LutBz8/GPhJsNFAar+w0i/nmtLQITFCwjsZ0RF1V3Bet50HQli4mVVtrSsHu6BkkHy324uZPEwSYDweqVXGaFlwOJP0LOW4IQBuAKE00hBDJTuJsFW8mKC9cGh8zNeg9dqUoVPTdk3ZfIfsg/wRZf0G77PdDlW1i6wJIPCMoK01DXXcSr+1zDEcO0TEiTwPmKYpUDapUfesPVD3mEj9JGEHv/ei4ydxvLficDE9O3ah1MFgjuPy857Y4Y9qmShigHEPhuN9YUCWyLV/k9qmiif0b5aXY3aXARTFAQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

45.79.214.223) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=t03ms.onmicrosoft.com; dmarc=none action=none

header.from=t03ms.onmicrosoft.com; dkim=none (message not signed); arc=none

(0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=T03MS.onmicrosoft.com;

s=selector1-T03MS-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=5s/JrhR+8hr3NCZyczYZoJ6/+ocuXxvZUGwp/MQHOqo=;

b=d40+gnlI61+56OpcjDzW4idP6HJTvnjSyGx27fVUQLDA5bE+hMStiyGWQMFy11NkbB72n6HGtfOlzAOhOgfAq8LsprTcCWCWJ4BIvwRQMKDBbElH+K2Ja8vTQq6XKLAKT5w4RcB8hdZI7TurTzhOv+ZmqGSzMhVr7oiTinO8Ki8Yo/gDbF9O1QZ2BI7InWwzG6f9rPmBoSRuXgdYWeIdkfhZB/SLU0m/wfHR8KadChNU2t0/RP19Qmd5SEoS8WcJLpqMyfo2u9LQPJkrsEFUabrO6IGYVZ42foIlJnKCmTMtuqygCwWBf1lIz8TMuqAWBkELtqkrlzj86o5/+s4A/g==

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 45.79.214.223)

smtp.mailfrom=T03MS.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=T03MS.onmicrosoft.com;

Importance: high

MIME-Version: 1.0

In-Reply-To:

From: Kroger Shipment

To: doctor@doctor.nl2k.ab.ca

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

CC: doctor@doctor.nl2k.ab.ca

Date: Sat, 13 Jan 2024 02:54:50 +0100

Subject: Make a Difference, Get Rewarded: Survey Now

Message-ID:

<3828a566-1310-4e4e-9b45-723d6b23a2e7@AM3PEPF0000A78E.eurprd04.prod.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: AM3PEPF0000A78E:EE_|DU0PR07MB8995:EE_

X-MS-Office365-Filtering-Correlation-Id: 8fd7d978-dfcd-4cb9-1da9-08dc13db13e6

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

eZMPPT4vpjqcEs5BY5e3Amn/A16PiSsc5MMFFDxUItyAaN1Y93clw65npU95WVx9zStYiDdv2lqXRDt0RfvI2wRh5F3poDPNOuhk/w9HZf6VjlEdyzN/xNjTw90eg1KcjW29akPO6IBk4pNF3SNJf8ElqmfWihlmfOUc+eiimerwPb2sDRu6WicFOXp6xM93mmMX+dtpSUQiPanCM6CU6rjCCkoo5u80PkCejFClAwlOs3z6KVFFqUjee2YfdE1ZJdi6pOtkN63b48FYP4F5bXyNeaWdG7q2iPyCUbEh/VCicbfxQIIdvvmuPbxmB1mytC5nAPpjwgkfjRSZgHS2eSZTGCBhdXKCx+CPqhAy2tqjF0OXuh3rmVRFvEt9Uqo+uPKf/HyNfr5TL9afUTfnjtJWPqq9BNbBIKDj8TJqN/s28OY/WAqz44Y57BabhJBWCbEwlzEu2WiC0QBwxq93uuOsNCpyp5vg45+wP8/lF1TKeURlI9dFJO+ZJdm7QyU4X0l0jDgYgEultpxbd6+6zwVv972uR+sbYpmGDQ2TbJA=

X-Forefront-Antispam-Report:

CIP:45.79.214.223;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.schinner.com;PTR:45-79-214-223.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(376002)(136003)(396003)(39860400002)(346002)(230922051799003)(1690799017)(451199024)(7200799017)(64100799003)(82310400011)(61400799012)(186009)(36840700001)(46966006)(40470700004)(478600001)(31696002)(41320700001)(47076005)(36860700001)(26005)(41300700001)(336012)(9686003)(40460700003)(40480700001)(5660300002)(166002)(70586007)(2906002)(70206006)(558084003)(8936002)(6916009)(42186006)(786003)(67280400001)(81166007)(4326008)(316002)(8400799017)(8676002)(34070700002)(86362001)(82740400003)(154513002);DIR:OUT;SFP:1102;

X-OriginatorOrg: T03MS.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jan 2024 01:58:03.0193

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 8fd7d978-dfcd-4cb9-1da9-08dc13db13e6

X-MS-Exchange-CrossTenant-Id: 797ffa7c-6432-40c5-8603-f3a97de60bb8

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=797ffa7c-6432-40c5-8603-f3a97de60bb8;Ip=[45.79.214.223];Helo=[mail.schinner.com]

X-MS-Exchange-CrossTenant-AuthSource:

AM3PEPF0000A78E.eurprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR07MB8995









(1) Notifications
























I1.18KL0LD35.4KI2.16KwhoissourceRank10.8MPIN0Summary reportDiagnosisDensity00n/a