Lowe's phish from Microsoft Outlook
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 24 Feb 2024 07:07:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rdsfq-00000000Gqx-3yuv
for dave@doctor.nl2k.ab.ca;
Sat, 24 Feb 2024 07:06:42 -0700
Resent-From: The Doctor
Resent-Date: Sat, 24 Feb 2024 07:06:42 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-tyzapc01on2119.outbound.protection.outlook.com ([40.107.117.119]:8758 helo=APC01-TYZ-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rdq2g-000000009Cf-2mEH
for doctor@doctor.nl2k.ab.ca;
Sat, 24 Feb 2024 04:18:10 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=He3LEX8Y3it+XjkmU/Ql6oZroiFh0bxe1bE2U5KIhornhSQbFskrZPGQLDS8b83AaDA1r+51ucYMhYve6Al3bsid+BsPjRL3pRwEYuZQdDnpO5A0mowXsOfvUz+KolxeGgf+ys27m16a9jzDP6Sjz7dvTOkJnHSTPQm+c5kdXcTcJZL0rTRtxBOJwL8TNHBWcT635JfplwJE2HgJRVk+y943H+hrRDHMFmJ4/c3Z2CcQZknh2zPq/qPw1PJ5yLLW1tTuypumiZ0gNA8J7ZTUCegf2DxizzCyAFBtXQjPk5Tt0Ne5vD+bj+GFny5PE5oZvSHpVEXozaaZekcJ/RwnIw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=EWdKZfoQX7X2PbUc2DAmw5UqY77XOdBx9VyHXHBuAwU=;
b=DCOXsFufp7gGcEjheJGS41gQNpKWMWhr0rrnR/+yjK+TUf5w8GcMuuPHemDmMwz24l+tlXmdIRDBzgwsk6BZDnuz8RDz1qOyaOb/OuQ8Y2gehozAZJngM15e2PGwMNL4JPZegQIdu2d4Hf0oiIU/MhOYXv0ZP9qOH3Rt1UfVJbXx8/fFuOJ+PTorRlB80aChLgvXmximFNoPpz+m5fZre94mX9ih4v4uKA6iiqeDhhjnPZ0Jvgj/B0dTFzBJ7hGGdZpy0OquCzRTI+m7FaTW38Gnc9U8ImNs/tzfKYtWGxn06M6jzmSh1jxNL8E/8b39ehGhavwsatjCjFAHDh37sg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
192.46.223.250) smtp.rcpttodomain=doctor.nl2k.ab.ca
smtp.mailfrom=smkkartinibtm.onmicrosoft.com; dmarc=none action=none
header.from=smkkartinibtm.onmicrosoft.com; dkim=none (message not signed);
arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=smkkartinibtm.onmicrosoft.com; s=selector1-smkkartinibtm-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=EWdKZfoQX7X2PbUc2DAmw5UqY77XOdBx9VyHXHBuAwU=;
b=vmEquBwqaGELoOVH5v4oQZ9/do5tcda3r7+DeZ76I0ho3wtpP0ml9LgFnoN0+HgNu9X85bRE5iAgAk97moGoGowqWijATrK8L/09qWrAWsoGmcU+XoxHs2xQinmtVHEQ7+nXtnZjnTL3wyUtqrmYlzH8zZznC4mWgqSmMJM41VfnOPnHbXANcuZyifdGTpdOyWNsmhsJutHkix1lbmyPRaaZoFZxvT9yxJzGWY0vhxjnW2mgXJPv1+oEWK4o5g4q3aExLUVzqvE1PCNMkvXF+L3v0Plx2RBblQriiqFo3s218HUQp1ErlQe4xc0MeZj9QMZni9FFonK5odBdCMaElw==
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 192.46.223.250)
smtp.mailfrom=smkkartinibtm.onmicrosoft.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none
header.from=smkkartinibtm.onmicrosoft.com;
Content-Type: multipart/alternative; charset="UTF-8";boundary="DntnxoEllGWrVddRM0fFdB"
x-priority: 1
X-Sender: email@smkkartinibtm.onmicrosoft.com
To: doctor
MIME-Version: 1.0
Reply-To: Lowe'S_Department_!!
Subject: Please_confirm_receipt!!
Delivered-To: doctor
From: Lowe'S_Department_!!
Date: Sat, 24 Feb 2024 12:59:25 +0200
Message-ID:
<79b2588c-ada6-4107-8ef6-56bd0674a669@SG1PEPF000082E5.apcprd02.prod.outlook.com>
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: SG1PEPF000082E5:EE_|OSQPR02MB7980:EE_
X-MS-Office365-Filtering-Correlation-Id: d866eb2f-0c71-4cda-d1cf-08dc3529fcd3
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
8E1cvbIclpE6Sg+TM6Jk4E0HV8eHy+CRgNo1oCUBYw1g8B2er1xbw0dsdtRrdwn+D67S6364fcAZgbAizIMgYVb+od9HSv6jEaXGpstmGfSIlP/zfIK7MnZWUiKn3jvAOGJdxuFWo/0U+sue/rUtB/G/3JcMWZeHyIlqFPHnN4oGiZhqvpSEtvLvv4UEi6oJFWxJTnc2niMvlJ775GANCJxQyc9lUbr3uCNaHxk1FyEq9AdgkUlc8tOGo6k8QR/zyYvJLiANjny7xu7+IuJPROyVAR/MiIhkn6ZBvxX9ObyJPPZsuy3ek7eFW27AloGt6bGr7jsl1A7PYshnvrTbzpIzNv7hy5BVEWHJiyPmVKQzrA06Q7B/uoX/ZaqaSErEZYKBK3wmrt+5+qHNSkqGdI/29zSq/EVdZD6f7Xd6Blw=
X-Forefront-Antispam-Report:
CIP:192.46.223.250;CTRY:CA;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.schowalter.net;PTR:192-46-223-250.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(36860700004)(7200799017)(40470700004)(46966006)(3613699003);DIR:OUT;SFP:1102;
X-OriginatorOrg: smkkartinibtm.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Feb 2024 11:16:02.6907
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: d866eb2f-0c71-4cda-d1cf-08dc3529fcd3
X-MS-Exchange-CrossTenant-Id: 2df0098f-30b1-415f-82e4-efdb8f1ecd0d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=2df0098f-30b1-415f-82e4-efdb8f1ecd0d;Ip=[192.46.223.250];Helo=[mail.schowalter.net]
X-MS-Exchange-CrossTenant-AuthSource:
SG1PEPF000082E5.apcprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: OSQPR02MB7980
X-Spam_score: 8.5
X-Spam_score_int: 85
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: ivgjktszxbipo ivgjktszxbipo ivgjktszxbipo ivgjktszxbipo gyy1u8us3v6pz
gyy1u8us3v6pz gyy1u8us3v6pz gyy1u8us3v6pz 2W0XrxBZNJja 2W0XrxBZNJja 2W0XrxBZNJja
2W0XrxBZNJja Vt7iwB2kQUwj7vjYA4mIocI0dxgGVRgduS26 [...]
Content analysis details: (8.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[40.107.117.119 listed in list.dnswl.org]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: topoffre.blob.core.windows.net]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.107.117.119 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.0 ARC_VALID Message has a valid ARC signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.0 ARC_SIGNED Message has a ARC signature
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[inbox.news(at)smkkartinibtm.onmicrosoft.com]
0.1 TW_XM BODY: Odd Letter Triples with XM
0.1 TW_JK BODY: Odd Letter Triples with JK
0.1 TW_VG BODY: Odd Letter Triples with VG
0.1 TW_IV BODY: Odd Letter Triples with IV
0.1 TW_SZ BODY: Odd Letter Triples with SZ
0.1 TW_GY BODY: Odd Letter Triples with GY
0.1 TW_ZX BODY: Odd Letter Triples with ZX
0.1 TW_GJ BODY: Odd Letter Triples with GJ
0.1 TW_KR BODY: Odd Letter Triples with KR
0.1 TW_MK BODY: Odd Letter Triples with MK
1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 TVD_SPACE_RATIO No description available.
0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
2.7 SCC_BODY_URI_ONLY Very short body with something maybe clickable
1.0 XPRIO Has X-Priority header
0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX
Subject: {SPAM?} Please_confirm_receipt!!
--IYOeP7Ghxh43J1UANpGObRifrNlGbIqh
Content-Type: multipart/alternative; boundary="DntnxoEllGWrVddRM0fFdB"
--DntnxoEllGWrVddRM0fFdB
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
ivgjktszxbipo ivgjktszxbipo ivgjktszxbipo ivgjktszxbipo
gyy1u8us3v6pz gyy1u8us3v6pz gyy1u8us3v6pz gyy1u8us3v6pz
2W0XrxBZNJja 2W0XrxBZNJja 2W0XrxBZNJja 2W0XrxBZNJja
Vt7iwB2kQUwj7vjYA4mIocI0dxgGVRgduS26cz4MTpXW6rEHLAuTwww47NQuKHkWUlMIzaWlNIgfNn4KIMEIbrJguETn5TEkKArs Vt7iwB2kQUwj7vjYA4mIocI0dxgGVRgduS26cz4MTpXW6rEHLAuTwww47NQuKHkWUlMIzaWlNIgfNn4KIMEIbrJguETn5TEkKArs Vt7iwB2kQUwj7vjYA4mIocI0dxgGVRgduS26cz4MTpXW6rEHLAuTwww47NQuKHkWUlMIzaWlNIgfNn4KIMEIbrJguETn5TEkKArs Vt7iwB2kQUwj7vjYA4mIocI0dxgGVRgduS26cz4MTpXW6rEHLAuTwww47NQuKHkWUlMIzaWlNIgfNn4KIMEIbrJguETn5TEkKArs
wXPU9yb39JQax wXPU9yb39JQax wXPU9yb39JQax wXPU9yb39JQax
gyy1u8us3v6pz gyy1u8us3v6pz ivgjktszxbipo gyy1u8us3v6pz
2W0XrxBZNJja 2W0XrxBZNJja MfhdJmFkyUFU 2W0XrxBZNJja
fbmkrwuxmp fbmkrwuxmp mYLHRyODhR mYLHRyODhR
--DntnxoEllGWrVddRM0fFdB
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
1">
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
![](3D"https://topoffre.blob.core.windows.net/topoffre/1.png")
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 24 Feb 2024 07:07:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rdsfq-00000000Gqx-3yuv
for dave@doctor.nl2k.ab.ca;
Sat, 24 Feb 2024 07:06:42 -0700
Resent-From: The Doctor
Resent-Date: Sat, 24 Feb 2024 07:06:42 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-tyzapc01on2119.outbound.protection.outlook.com ([40.107.117.119]:8758 helo=APC01-TYZ-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rdq2g-000000009Cf-2mEH
for doctor@doctor.nl2k.ab.ca;
Sat, 24 Feb 2024 04:18:10 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=He3LEX8Y3it+XjkmU/Ql6oZroiFh0bxe1bE2U5KIhornhSQbFskrZPGQLDS8b83AaDA1r+51ucYMhYve6Al3bsid+BsPjRL3pRwEYuZQdDnpO5A0mowXsOfvUz+KolxeGgf+ys27m16a9jzDP6Sjz7dvTOkJnHSTPQm+c5kdXcTcJZL0rTRtxBOJwL8TNHBWcT635JfplwJE2HgJRVk+y943H+hrRDHMFmJ4/c3Z2CcQZknh2zPq/qPw1PJ5yLLW1tTuypumiZ0gNA8J7ZTUCegf2DxizzCyAFBtXQjPk5Tt0Ne5vD+bj+GFny5PE5oZvSHpVEXozaaZekcJ/RwnIw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=EWdKZfoQX7X2PbUc2DAmw5UqY77XOdBx9VyHXHBuAwU=;
b=DCOXsFufp7gGcEjheJGS41gQNpKWMWhr0rrnR/+yjK+TUf5w8GcMuuPHemDmMwz24l+tlXmdIRDBzgwsk6BZDnuz8RDz1qOyaOb/OuQ8Y2gehozAZJngM15e2PGwMNL4JPZegQIdu2d4Hf0oiIU/MhOYXv0ZP9qOH3Rt1UfVJbXx8/fFuOJ+PTorRlB80aChLgvXmximFNoPpz+m5fZre94mX9ih4v4uKA6iiqeDhhjnPZ0Jvgj/B0dTFzBJ7hGGdZpy0OquCzRTI+m7FaTW38Gnc9U8ImNs/tzfKYtWGxn06M6jzmSh1jxNL8E/8b39ehGhavwsatjCjFAHDh37sg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
192.46.223.250) smtp.rcpttodomain=doctor.nl2k.ab.ca
smtp.mailfrom=smkkartinibtm.onmicrosoft.com; dmarc=none action=none
header.from=smkkartinibtm.onmicrosoft.com; dkim=none (message not signed);
arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=smkkartinibtm.onmicrosoft.com; s=selector1-smkkartinibtm-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=EWdKZfoQX7X2PbUc2DAmw5UqY77XOdBx9VyHXHBuAwU=;
b=vmEquBwqaGELoOVH5v4oQZ9/do5tcda3r7+DeZ76I0ho3wtpP0ml9LgFnoN0+HgNu9X85bRE5iAgAk97moGoGowqWijATrK8L/09qWrAWsoGmcU+XoxHs2xQinmtVHEQ7+nXtnZjnTL3wyUtqrmYlzH8zZznC4mWgqSmMJM41VfnOPnHbXANcuZyifdGTpdOyWNsmhsJutHkix1lbmyPRaaZoFZxvT9yxJzGWY0vhxjnW2mgXJPv1+oEWK4o5g4q3aExLUVzqvE1PCNMkvXF+L3v0Plx2RBblQriiqFo3s218HUQp1ErlQe4xc0MeZj9QMZni9FFonK5odBdCMaElw==
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 192.46.223.250)
smtp.mailfrom=smkkartinibtm.onmicrosoft.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none
header.from=smkkartinibtm.onmicrosoft.com;
Content-Type: multipart/alternative; charset="UTF-8";boundary="DntnxoEllGWrVddRM0fFdB"
x-priority: 1
X-Sender: email@smkkartinibtm.onmicrosoft.com
To: doctor
MIME-Version: 1.0
Reply-To: Lowe'S_Department_!!
Subject: Please_confirm_receipt!!
Delivered-To: doctor
From: Lowe'S_Department_!!
Date: Sat, 24 Feb 2024 12:59:25 +0200
Message-ID:
<79b2588c-ada6-4107-8ef6-56bd0674a669@SG1PEPF000082E5.apcprd02.prod.outlook.com>
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: SG1PEPF000082E5:EE_|OSQPR02MB7980:EE_
X-MS-Office365-Filtering-Correlation-Id: d866eb2f-0c71-4cda-d1cf-08dc3529fcd3
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
8E1cvbIclpE6Sg+TM6Jk4E0HV8eHy+CRgNo1oCUBYw1g8B2er1xbw0dsdtRrdwn+D67S6364fcAZgbAizIMgYVb+od9HSv6jEaXGpstmGfSIlP/zfIK7MnZWUiKn3jvAOGJdxuFWo/0U+sue/rUtB/G/3JcMWZeHyIlqFPHnN4oGiZhqvpSEtvLvv4UEi6oJFWxJTnc2niMvlJ775GANCJxQyc9lUbr3uCNaHxk1FyEq9AdgkUlc8tOGo6k8QR/zyYvJLiANjny7xu7+IuJPROyVAR/MiIhkn6ZBvxX9ObyJPPZsuy3ek7eFW27AloGt6bGr7jsl1A7PYshnvrTbzpIzNv7hy5BVEWHJiyPmVKQzrA06Q7B/uoX/ZaqaSErEZYKBK3wmrt+5+qHNSkqGdI/29zSq/EVdZD6f7Xd6Blw=
X-Forefront-Antispam-Report:
CIP:192.46.223.250;CTRY:CA;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.schowalter.net;PTR:192-46-223-250.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(36860700004)(7200799017)(40470700004)(46966006)(3613699003);DIR:OUT;SFP:1102;
X-OriginatorOrg: smkkartinibtm.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Feb 2024 11:16:02.6907
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: d866eb2f-0c71-4cda-d1cf-08dc3529fcd3
X-MS-Exchange-CrossTenant-Id: 2df0098f-30b1-415f-82e4-efdb8f1ecd0d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=2df0098f-30b1-415f-82e4-efdb8f1ecd0d;Ip=[192.46.223.250];Helo=[mail.schowalter.net]
X-MS-Exchange-CrossTenant-AuthSource:
SG1PEPF000082E5.apcprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: OSQPR02MB7980
X-Spam_score: 8.5
X-Spam_score_int: 85
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: ivgjktszxbipo ivgjktszxbipo ivgjktszxbipo ivgjktszxbipo gyy1u8us3v6pz
gyy1u8us3v6pz gyy1u8us3v6pz gyy1u8us3v6pz 2W0XrxBZNJja 2W0XrxBZNJja 2W0XrxBZNJja
2W0XrxBZNJja Vt7iwB2kQUwj7vjYA4mIocI0dxgGVRgduS26 [...]
Content analysis details: (8.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[40.107.117.119 listed in list.dnswl.org]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: topoffre.blob.core.windows.net]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.107.117.119 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.0 ARC_VALID Message has a valid ARC signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.0 ARC_SIGNED Message has a ARC signature
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[inbox.news(at)smkkartinibtm.onmicrosoft.com]
0.1 TW_XM BODY: Odd Letter Triples with XM
0.1 TW_JK BODY: Odd Letter Triples with JK
0.1 TW_VG BODY: Odd Letter Triples with VG
0.1 TW_IV BODY: Odd Letter Triples with IV
0.1 TW_SZ BODY: Odd Letter Triples with SZ
0.1 TW_GY BODY: Odd Letter Triples with GY
0.1 TW_ZX BODY: Odd Letter Triples with ZX
0.1 TW_GJ BODY: Odd Letter Triples with GJ
0.1 TW_KR BODY: Odd Letter Triples with KR
0.1 TW_MK BODY: Odd Letter Triples with MK
1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 TVD_SPACE_RATIO No description available.
0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
2.7 SCC_BODY_URI_ONLY Very short body with something maybe clickable
1.0 XPRIO Has X-Priority header
0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX
Subject: {SPAM?} Please_confirm_receipt!!
--IYOeP7Ghxh43J1UANpGObRifrNlGbIqh
Content-Type: multipart/alternative; boundary="DntnxoEllGWrVddRM0fFdB"
--DntnxoEllGWrVddRM0fFdB
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
ivgjktszxbipo ivgjktszxbipo ivgjktszxbipo ivgjktszxbipo
gyy1u8us3v6pz gyy1u8us3v6pz gyy1u8us3v6pz gyy1u8us3v6pz
2W0XrxBZNJja 2W0XrxBZNJja 2W0XrxBZNJja 2W0XrxBZNJja
Vt7iwB2kQUwj7vjYA4mIocI0dxgGVRgduS26cz4MTpXW6rEHLAuTwww47NQuKHkWUlMIzaWlNIgfNn4KIMEIbrJguETn5TEkKArs Vt7iwB2kQUwj7vjYA4mIocI0dxgGVRgduS26cz4MTpXW6rEHLAuTwww47NQuKHkWUlMIzaWlNIgfNn4KIMEIbrJguETn5TEkKArs Vt7iwB2kQUwj7vjYA4mIocI0dxgGVRgduS26cz4MTpXW6rEHLAuTwww47NQuKHkWUlMIzaWlNIgfNn4KIMEIbrJguETn5TEkKArs Vt7iwB2kQUwj7vjYA4mIocI0dxgGVRgduS26cz4MTpXW6rEHLAuTwww47NQuKHkWUlMIzaWlNIgfNn4KIMEIbrJguETn5TEkKArs
wXPU9yb39JQax wXPU9yb39JQax wXPU9yb39JQax wXPU9yb39JQax
gyy1u8us3v6pz gyy1u8us3v6pz ivgjktszxbipo gyy1u8us3v6pz
2W0XrxBZNJja 2W0XrxBZNJja MfhdJmFkyUFU 2W0XrxBZNJja
fbmkrwuxmp fbmkrwuxmp mYLHRyODhR mYLHRyODhR
--DntnxoEllGWrVddRM0fFdB
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
1">
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
![](3D"https://topoffre.blob.core.windows.net/topoffre/2.jpg")
--DntnxoEllGWrVddRM0fFdB--