Dewalt Canadian Tire Phish from MIcrosoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 26 Feb 2024 13:16:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rehNd-00000000PPW-4Aay

for dave@doctor.nl2k.ab.ca;

Mon, 26 Feb 2024 13:15:17 -0700

Resent-From: The Doctor

Resent-Date: Mon, 26 Feb 2024 13:15:17 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm6nam11rlnn2079.outbound.protection.outlook.com ([40.95.38.79]:9312 helo=NAM11-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

id 1reelf-00000000KEK-2oPh

for doctor@doctor.nl2k.ab.ca;

Mon, 26 Feb 2024 10:27:59 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=XoIzPixUBZa20G3QggIEjEitfctJ1PTokhkNXRt6N1l5vOIMm6EKia57Hg4WHQd/0Q9oaDDsU2pOefGDW6LDyTVAUAkS7TB8PZ9QfXMeuhOPSLqnf+DEX0h+agx6VWfLjQT/5pj0XyufQhUw3hKbw6rUUTPJypI7BTdICW7X9zNJxWUbBuMkGFIfDe1OReu3OlhPEQTmqnm8WdaXZrjhhxRW7DX9bE6f3Fd2gaR4WKsZH23XWloc/qRyQcbVH4pqupoCpkZFWQwSZ6Q44oWtfDyY3QruOgTlfmt2ilvAKSyV6lG09xym25hplLjEy0U/zXacRy+gEFi/7YOlo9W24g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=UbK2/awdFIEfx6xfge2K7FC+9l9hM8H4b4IAHskuWTg=;

b=VSwUYGPwkkoTvVOdbYQVlyBMImnACeuwnjoU5hBAM5DnuR+EYL3cyIohSKjkvoEtbFpdBaWaOZRflKS0m0IBocbHDFO/nbvh9d7zhnE5s49GwJmZFHDdkvSYdu/t108W9f4pvCDGE5o9AvQbR4JGYQoGOMz6jAQtHvdbSsYF0gSo3ANjnu52qlAgQEId/mTM3+3FYuCanSBvjQ5Fxs1NupECQZ+LuFHxrMtJCuYFx42H23PjxcLjJ52cuxNpYPHzySSHbJravkp3iuLVP9dkF5vwubVs3NTvl+utMstCf3k9npmVcuu41+SHF48oMg8VkvvWI2zsbwyMIuZvJuOT5w==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

173.230.147.222) smtp.rcpttodomain=doctor.nl2k.ab.ca smtp.helo=gal.lres.sbs;

dmarc=none action=none header.from=gal.lres.sbs; dkim=none (message not

signed); arc=none (0)

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 173.230.147.222)

smtp.helo=gal.lres.sbs; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=gal.lres.sbs;

Subject: Make an Impact, Get a Dewalt EXTREME Drill Today

MIME-Version: 1.0

X-TOI-MSGID: <101741384667062.AC354F821938C.1705442930402@gal.lres.sbs>

From: Canadian Tire Department

In-Reply-To:

To: doctor@doctor.nl2k.ab.ca

Content-Transfer-Encoding: 8bit

Content-Type: text/html; charset="UTF-8"

CC: doctor@doctor.nl2k.ab.ca

Date: Mon, 26 Feb 2024 17:25:53 +0000

Message-ID:

<1ca38385-1e75-493e-8aa0-4278caca705f@BL6PEPF0001AB58.namprd02.prod.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BL6PEPF0001AB58:EE_|IA1PR20MB6477:EE_

X-MS-Office365-Filtering-Correlation-Id: 11f57cb1-c7fd-4d92-3e25-08dc36effbff

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

5nHiRWpeyoRIk5t49fZc8Qaysu8cL0dTnBwsbVlOOZH4mC8q6ovn53z/jzi9wbKxHQ3yRH2N8fRk/JRnZM/gW5gkRl3xwWtWDdgRL9RWwf8yEMIl9tR1aFjsEs3s5Uok18c0AHz4L96P67mEbLLslH/ofSrSKOuMMPt22s4NssHj69RO4Kbz5rUxc0AL6v2s0lgGPF/NbIYgpXTBAYT4a9EsZvzhwQQpN3hUbCLwu+r2LVAnV909LFLn9TB0O9dFpOS5+JOU8ZAmbohpwTaALyVf2lZdzGodgAHKxCaBJEn8aYwRse+lCbNXhrToaY19SH5dorAOHQ9S7L0mKH9Lqy5h+YAUBKRE5qjvNU1cOL/35ogO5vKuUQPaVzruVViL6YXfsyRAxEUlw/vXs9IDjavByteuuGtOsjD5oSsuWvi8UVBsjdbZdjVEHfIH2XUGXlQzAY4D+eml4xo7sRLdOMf5lq7DyJ/GdBFjOSwpzFKJwciiQ5KKsaRtw02Uqvv7fU+mswemIge5Xgsb1bh4EnPHo+3p69Etm/VgIDGbrLGRD13wX453Lqnd2yHWGzoDnDvNxsIk+Xj0+TXBsohucm0ehEDsODPj52sUuvF7cXJtYHzG/6+ZI+dyZ27EliwQ2mmpTIzXhtvW5tSKBhefjloDDxs+li2UAxTkBsNBidUkH07JylXDQhTxOZZQpUzvLmy0+BFKvL5MlsFXJzE3/2fZb+oVOhPl5tNE7Oj6nco=

X-Forefront-Antispam-Report:

CIP:173.230.147.222;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:gal.lres.sbs;PTR:173-230-147-222.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(35950700004);DIR:OUT;SFP:1022;

X-OriginatorOrg: gal.lres.sbs

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Feb 2024 17:25:53.0316

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 11f57cb1-c7fd-4d92-3e25-08dc36effbff

X-MS-Exchange-CrossTenant-Id: f55e1df8-735b-45e3-bec7-b3d3e251697f

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f55e1df8-735b-45e3-bec7-b3d3e251697f;Ip=[173.230.147.222];Helo=[gal.lres.sbs]

X-MS-Exchange-CrossTenant-AuthSource:

BL6PEPF0001AB58.namprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR20MB6477

X-Spam_score: 5.1

X-Spam_score_int: 51

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: (1) Notifications ▂▃Welcome ▃▂ 🅲🅾🅽🅶🆁🅰🆃🆄🅻🅰🆃🅸🅾🅽🆂!





Content analysis details: (5.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.95.38.79 listed in list.dnswl.org]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=NAM11-DM6-obe.outbound.protection.outlook.com;ip=40.95.38.79;r=doctor.nl2k.ab.ca]

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

0.0 NUMERIC_HTTP_ADDR URI: Uses a numeric IP address in URL

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Make an Impact, Get a Dewalt EXTREME Drill Today















(1) Notifications





















































▂▃Welcome ▃▂







🅲🅾🅽🅶🆁🅰🆃🆄🅻🅰🆃🅸🅾🅽🆂!
























Government of Cnada Phish in French from Zomro B.V. Doetinchem, Gelderland, Netherlands

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 26 Feb 2024 13:16:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rehO9-00000000PQF-1fYe

for dave@doctor.nl2k.ab.ca;

Mon, 26 Feb 2024 13:15:49 -0700

Resent-From: The Doctor

Resent-Date: Mon, 26 Feb 2024 13:15:49 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vm4910852.25ssd.had.wf ([45.82.70.137]:49612 helo=mails.xpunch.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1refmW-00000000MBX-2WPq

for root@nl2k.ab.ca;

Mon, 26 Feb 2024 11:32:56 -0700

Received: by mails.xpunch.com (Postfix, from userid 48)

id F0FFC47E53E; Mon, 26 Feb 2024 20:30:57 +0200 (EET)

To: root@nl2k.ab.ca

Subject: =?UTF-8?B?Tm91dmVhdSh4KSBkb2N1bWVudChzKSBkaXNwb25pYmxlKHMp?=

X-PHP-Originating-Script: 0:index.php

Date: Mon, 26 Feb 2024 18:25:10 +0000

From: =?UTF-8?B?Q2FuYWRh?=

Reply-To: root@abideinchrist.com

Message-ID: <60b0e6ee052b7e6025264d2880da75d4@abideinchrist.com>

List-Unsubscribe: mailto:bounce942-a6qExM3Lgo0Arjp@abideinchrist.com?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1bd4a70e97cd439f926024c10c82fb451"

X-Spam_score: 5.1

X-Spam_score_int: 51

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Gouvernement du Canada Document en ligne Veuillez voir votre

document en tout sécurité à l’aide du code de confirmation suivant.

Ce code expirera après 12 heures. 050916



Content analysis details: (5.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.6 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)

[45.82.70.137 listed in bl.mailspike.net]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=apache%40xpunch.com;ip=45.82.70.137;r=doctor.nl2k.ab.ca]

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.2 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} =?UTF-8?B?Tm91dmVhdSh4KSBkb2N1bWVudChzKSBkaXNwb25pYmxlKHMp?=



This is a multi-part message in MIME format.



--1bd4a70e97cd439f926024c10c82fb451

Content-Type: text/plain; charset=UTF-8



















































Gouvernement du Canada











Document en ligne















Veuillez voir votre document en tout sécurité à l’aide du code de confirmation suivant. Ce code expirera après 12 heures.Â

050916













Veuillez ne pas répondre au présent courriel.











Â

Avertissement

Ce message est confidentiel et est à l'usage exclusif du destinataire identifié ci-dessus. Toute autre personne est, par les présentes, avisée qu'il lui est strictement interdit de le diffuser, de le distribuer, d'en dévoiler le contenu ou de le reproduire. Si vous avez reçu cette communication par erreur, veuillez en informer l'expéditeur par courrier électronique immédiatement et détruire l'original de ce message ainsi que toute copie.

Â





--1bd4a70e97cd439f926024c10c82fb451

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable




DER-COLLAPSE: collapse; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT=

: 0px; MARGIN: 0px; PADDING-RIGHT: 0px" cellSpacing=3D0 cellPadding=3D0 wid=

th=3D"100%" bgColor=3D#f0f0f0 border=3D0>




Tahoma, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM=

: none; FONT-WEIGHT: 400; COLOR: rgb(36,36,36); FONT-STYLE: normal; ORPHANS=

: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(240,240,240);=

TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: norma=

l; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text=

-decoration-style: initial; text-decoration-color: initial">




Tahoma, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM=

: none; FONT-WEIGHT: 400; COLOR: rgb(36,36,36); FONT-STYLE: normal; ORPHANS=

: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(240,240,240);=

TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: norma=

l; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text=

-decoration-style: initial; text-decoration-color: initial">




Tahoma, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM=

: none; FONT-WEIGHT: 400; COLOR: rgb(36,36,36); FONT-STYLE: normal; ORPHANS=

: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(240,240,240);=

TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: norma=

l; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text=

-decoration-style: initial; text-decoration-color: initial">


ign=3Dtop align=3Dcenter>


Spacing=3D0 cellPadding=3D0 width=3D600 border=3D0>






DING-BOTTOM: 20px; PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20=

px">

ign=3Dtop align=3Dcenter>


-RIGHT: rgb(66,66,66) thin solid; WIDTH: 600px; BORDER-COLLAPSE: collapse; =

BORDER-BOTTOM: rgb(66,66,66) thin solid; BORDER-LEFT: rgb(66,66,66) thin so=

lid" cellSpacing=3D0 cellPadding=3D0 width=3D600 border=3D0>






















ign=3Dtop align=3Dcenter>


Spacing=3D0 cellPadding=3D0 width=3D"100%" border=3D0>






OR: rgb(255,255,255); PADDING-BOTTOM: 20px; PADDING-TOP: 20px; PADDING-LEFT=

: 20px; PADDING-RIGHT: 20px" vAlign=3Dtop align=3Dcenter>
-DECORATION: none; BORDER-TOP: 0px; FONT-FAMILY: inherit; BORDER-RIGHT: 0px=

; VERTICAL-ALIGN: top; BORDER-BOTTOM: 0px; COLOR: ; OUTLINE-WIDTH: medium; =

PADDING-BOTTOM: 0px; PADDING-TOP: 0px; OUTLINE-STYLE: none; PADDING-LEFT: 0=

px; BORDER-LEFT: 0px; MARGIN: 0px; OUTLINE-COLOR: invert; LINE-HEIGHT: 15px=

; PADDING-RIGHT: 0px; font-stretch: inherit; font-feature-settings: inherit=

; font-optical-sizing: inherit; font-kerning: inherit; font-variation-setti=

ngs: inherit" alt=3DCanada src=3D"https://clegc-gckey.gc.ca/j/wet/assets/wm=

ms.png" width=3D160 data-imagetype=3D"External">
<=

/TD>

ign=3Dtop align=3Dcenter>


lSpacing=3D0 cellPadding=3D0 width=3D"100%" border=3D0>






OR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 20px; PADDING-LEFT: 40=

px; PADDING-RIGHT: 40px" vAlign=3Dtop align=3Dcenter>


0px; FONT-FAMILY: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -=

apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; WHI=

TE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; FON=

T-WEIGHT: 600; COLOR: rgb(66,66,66); FONT-STYLE: normal; ORPHANS: 2; WIDOWS=

: 2; DISPLAY: inline !important; LETTER-SPACING: normal; BACKGROUND-COLOR: =

rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-va=

riant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickne=

ss: initial; text-decoration-style: initial; text-decoration-color: initial=

'>Gouvernement du Canada


ign=3Dtop align=3Dcenter>


Spacing=3D0 cellPadding=3D0 width=3D"20%" border=3D0>






DER-BOTTOM: rgb(66,66,66) thin solid; PADDING-BOTTOM: 20px; PADDING-TOP: 0p=

x; PADDING-LEFT: 40px; PADDING-RIGHT: 40px" vAlign=3Dtop width=3D"26%" alig=

n=3Dcenter>
#333333 1px solid; HEIGHT: 47px; FONT-FAMILY: arial black, helvetica, sans-=

serif; BORDER-RIGHT: #333333 1px solid; WIDTH: 258px; BORDER-BOTTOM: #33333=

3 1px solid; FONT-WEIGHT: normal; COLOR: #ffffff; PADDING-BOTTOM: 12px; TEX=

T-ALIGN: center; PADDING-TOP: 12px; PADDING-LEFT: 18px; BORDER-LEFT: #33333=

3 1px solid; DISPLAY: inline-block; LETTER-SPACING: 0px; LINE-HEIGHT: norma=

l; PADDING-RIGHT: 18px; BACKGROUND-COLOR: #79b9e1; border-radius: 6px" href=

=3D"https://367b6313-2b32-47dc-96e6-6c230801acdc.usrfiles.com/ugd/367b63_e8=

072974894e4946bd18634a0f9955aa.pdf" target=3D_blank>Document en ligne
TD>

ign=3Dtop align=3Dcenter>


width=3D"100%" border=3D0>






SE: collapse; FONT-WEIGHT: 400; COLOR: rgb(51,51,51); PADDING-BOTTOM: 20px;=

PADDING-TOP: 20px; PADDING-LEFT: 40px; PADDING-RIGHT: 40px" vAlign=3Dtop a=

lign=3Dcenter>


R-RIGHT: 0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: 0px; FONT-WEIGHT: 40=

0; COLOR: rgb(102,102,102); PADDING-BOTTOM: 15px; TEXT-ALIGN: left; PADDING=

-TOP: 15px; PADDING-LEFT: 35px; BORDER-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT:=

25px; PADDING-RIGHT: 35px; BACKGROUND-COLOR: rgb(255,255,255); font-stretc=

h: inherit; font-feature-settings: inherit; font-optical-sizing: inherit; f=

ont-kerning: inherit; font-variation-settings: inherit">

Veuillez voir votre document en tout s=C3=A9curit=

=C3=A9 =C3=A0 l=E2=80=99aide du code de confirmation suivant. Ce code expir=

era apr=C3=A8s 12 heures.=C2=A0




BORDER-BOTTOM: 0px; COLOR: ; PADDING-BOTTOM: 15px; PADDING-TOP: 15px; PADD=

ING-LEFT: 35px; BORDER-LEFT: 0px; MARGIN: 0px; PADDING-RIGHT: 35px; BACKGRO=

UND-COLOR: rgb(255,255,255)">
ZE: 36px; BORDER-TOP: 0px; FONT-FAMILY: inherit; BORDER-RIGHT: 0px; VERTICA=

L-ALIGN: baseline; BORDER-BOTTOM: 0px; FONT-WEIGHT: bold; COLOR: rgb(28,88,=

138); PADDING-BOTTOM: 15px; PADDING-TOP: 15px; PADDING-LEFT: 25px; BORDER-L=

EFT: 0px; MARGIN: 0px; DISPLAY: inline-block; PADDING-RIGHT: 25px; font-str=

etch: inherit; font-feature-settings: inherit; font-optical-sizing: inherit=

; font-kerning: inherit; font-variation-settings: inherit">
000ff>050916

ign=3Dtop align=3Dleft>


Spacing=3D0 cellPadding=3D0 width=3D"100%" border=3D0>






SE: collapse; FONT-WEIGHT: 400; COLOR: rgb(255,255,255); PADDING-BOTTOM: 20=

px; PADDING-TOP: 20px; PADDING-LEFT: 40px; PADDING-RIGHT: 40px" vAlign=3Dto=

p align=3Dleft>

Veuillez ne pas r=C3=A9pondre au pr=C3=A9sent cour=

riel.


ign=3Dtop align=3Dcenter>


width=3D600 border=3D0>





=C2=A0




l, sans-serif; BACKGROUND: white; WHITE-SPACE: normal; WORD-SPACING: 0px; T=

EXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: norma=

l; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px; LETTER-SPACING: normal; TEXT-INDENT:=

0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-te=

xt-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-s=

tyle: initial; text-decoration-color: initial">
pt; FONT-FAMILY: cambria, serif; COLOR: red">

newline>Avertissement




KGROUND: white; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: non=

e; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORPHANS: 2; WID=

OWS: 2; LETTER-SPACING: normal; LINE-HEIGHT: 10pt; TEXT-INDENT: 0px; font-v=

ariant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-wi=

dth: 0px; text-decoration-thickness: initial; text-decoration-style: initia=

l; text-decoration-color: initial">
LY: cambria, serif; COLOR: black">Ce message est confidentiel et est =C3=

=A0 l'usage exclusif du destinataire identifi=C3=A9 ci-dessus. Toute autre =

personne est, par les pr=C3=A9sentes, avis=C3=A9e qu'il lui est strictement=

interdit de le diffuser, de le distribuer, d'en d=C3=A9voiler le contenu o=

u de le reproduire. Si vous avez re=C3=A7u cette communication par erreur, =

veuillez en informer l'exp=C3=A9diteur par courrier =C3=A9lectronique imm=

=C3=A9diatement et d=C3=A9truire l'original de ce message ainsi que toute c=

opie.




l, sans-serif; BACKGROUND: white; WHITE-SPACE: normal; WORD-SPACING: 0px; T=

EXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: norma=

l; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px 0px 12pt; LETTER-SPACING: normal; TEX=

T-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -=

webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-dec=

oration-style: initial; text-decoration-color: initial">
ONT-SIZE: 10pt; COLOR: rgb(204,0,0)">=C2=A0







--1bd4a70e97cd439f926024c10c82fb451--



Dewalt Canadian Tire Phish from MIcrosoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 26 Feb 2024 13:15:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rehMz-00000000PNH-0Pn0

for dave@doctor.nl2k.ab.ca;

Mon, 26 Feb 2024 13:14:37 -0700

Resent-From: The Doctor

Resent-Date: Mon, 26 Feb 2024 13:14:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm6nam11rlnn2068.outbound.protection.outlook.com ([40.95.38.68]:25056 helo=NAM11-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

id 1redur-00000000IQY-1cud

for cyrus@nl2k.ab.ca;

Mon, 26 Feb 2024 09:33:25 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=SzhUnotZ9AqExx0l9m58t7lILugtfPBHDGN/2XNFlDcebY/Iyt26HzoPJU3qFA/chkOO4e2AaaOAyMC+WDwvShIHMDJQ0gTnDhcSwcup05atcZrCp3Ncr+aUaPUvG8BBRRkO+gOW1jfJvKf020l1OWTN5kb8qOdNhA5vYgYxrxYo5tOHwt5S5Zgw5xRT1AzEw+5y17fwC05xcKOU4DJAcNS/iXLbpGke9sFDEKfvHM0bio8z30goigQG/YJlg/zf1cFuvoaKlihGiUOL14h1q3QQfvPg5eB+URjDR8u2+MOVGOvnCN/tVVNJgDH51B9aUBkNowDYTHt3kc+R9MOOig==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=UbK2/awdFIEfx6xfge2K7FC+9l9hM8H4b4IAHskuWTg=;

b=cUGmubnHoWtyBv3mdaVBlTEMOOwKALDvf1T93KsqBK7qQqcYMpyMN1Gsd/ZaKuZ53eRc+47W1r+rF5++Qd9BcZj1tN0SRbeSFQBvkqOtq3ugng8f4oTpfKxUCSS4y0cJVuBgi04vXufc+A8HtbmmkgOKX5/O3YVDgPkfGG1Dh/42WokvSobOtPbVjbdYAfhd93e1mr+SWaw3+UmcfLk212bWwifQzbjgp63zf1VDbj6aW8I8RcJHab5Hb4mNVOvAPkCftwic9jWT7PFPkLUKO2qPmY6diRprzgc+a/mNoWf0p4fKRO+YdVHX7P+SqQ92jAbjA9X0qaK2XNLKEVHXuw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

173.230.147.222) smtp.rcpttodomain=nl2k.ab.ca smtp.helo=aal.lres.sbs;

dmarc=none action=none header.from=aal.lres.sbs; dkim=none (message not

signed); arc=none (0)

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 173.230.147.222)

smtp.helo=aal.lres.sbs; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=aal.lres.sbs;

Subject: Make an Impact, Get a Dewalt EXTREME Drill Today

MIME-Version: 1.0

X-TOI-MSGID: <101741867707062.AC354F821938C.1705442930402@aal.lres.sbs>

From: Canadian Tire Department

In-Reply-To:

To: cyrus@nl2k.ab.ca

Content-Transfer-Encoding: 8bit

Content-Type: text/html; charset="UTF-8"

CC: cyrus@nl2k.ab.ca

Date: Mon, 26 Feb 2024 16:31:18 +0000

Message-ID:

<30319f4f-55cb-40ad-b4b4-f3a0cb78bf73@CH2PEPF00000099.namprd02.prod.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: CH2PEPF00000099:EE_|LV8P220MB1556:EE_

X-MS-Office365-Filtering-Correlation-Id: a60479a6-7c34-441b-448b-08dc36e85bf1

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

uKegQWSjsttXFuF8AcSCtiGmkc2NMCvYSgC+dhOFx/wPQcq7ACZtkvN+Yd93oTFyK+lhBrqIYoFwgifAMWCxpzKGy36IBZqn0qKsdHKNVU0G+/8LvWohO9zDaGLS/zaCvzCgXoFjKj9q4z7jw0kxkeFP13+nnfuK8hY4wMOiYKiWGIEM/a9WpLDiB2nVD079r08zqP0MEayMJMX4hxntLMuUfwdlEZXAeVjtvCxOR4wL2PqFcPH6Mtz3wCDpW9V4CAgo43A9AlWUWTejY6qjZo6tozSVMcGvJN6fQZNhusZiih7gTRNEr4eb8rcnOyP0cbcdJxj4ye7MAc3pXL/c7NDVUkkC0E+lvcTuu4B5R7z16nldYFC6QcDXeDwqvJ7awmirOiZMngvZP30KSVxYLObgfJqZMMK/Ryq+xoGgCCYqbLQ0hDdsc85UiQpQZbS2eCj4EMukx3pvb4GJ/HQ/PI6CKHBWy9bgycdgufkBcZSubBmi6Pju4iy30kvo+m5imb9hVej7lvcg58Uw5DvdD0QGEAB2Trj01iKQPD8upe7W2ilikQr7eDhWxCZk1jndSVJ/fdUnJVf/xhzQ5wowSpQf1QNymRqEkLBKY+85Qdbm7v6hy2r/gZGXisYOc2wB4La4UJvsJPkiu2YhB/Yvltlm/md6zNDPO1t/lE5C8wmk2/u/aQsW4NnzuO5NuRUZyE2bet5WSCAAIFLUQX3d6FcKmkSXkbxX67EWwAe3a68=

X-Forefront-Antispam-Report:

CIP:173.230.147.222;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:aal.lres.sbs;PTR:173-230-147-222.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(35950700004);DIR:OUT;SFP:1022;

X-OriginatorOrg: aal.lres.sbs

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Feb 2024 16:31:18.0118

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: a60479a6-7c34-441b-448b-08dc36e85bf1

X-MS-Exchange-CrossTenant-Id: bd07f877-fda5-4bc6-9759-92d8571c2a42

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=bd07f877-fda5-4bc6-9759-92d8571c2a42;Ip=[173.230.147.222];Helo=[aal.lres.sbs]

X-MS-Exchange-CrossTenant-AuthSource:

CH2PEPF00000099.namprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV8P220MB1556















(1) Notifications





















































▂▃Welcome ▃▂







🅲🅾🅽🅶🆁🅰🆃🆄🅻🅰🆃🅸🅾🅽🆂!
























Dewalt Canadian Tire Phish from MIcrosoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 26 Feb 2024 13:17:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rehOn-00000000PRd-1SNL

for dave@doctor.nl2k.ab.ca;

Mon, 26 Feb 2024 13:16:29 -0700

Resent-From: The Doctor

Resent-Date: Mon, 26 Feb 2024 13:16:29 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm6nam10hn2226.outbound.protection.outlook.com ([52.100.156.226]:50177 helo=NAM10-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

id 1rehNl-00000000PKJ-2ZVX

for root@nk.ca;

Mon, 26 Feb 2024 13:15:30 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=LuCwU33zgvn7t+pRqOPPYW+6utM/RihjQY4kZBsM9vHeMrmeNkjIHxUGGEyS20NjMc3vj1piQEjJ6e6UYF5CUwO6fArRXjthx6keApM26yZ9Sn+OZqIen8Z6doq3tvohIqrBn8enVwgie8x180or0KHO36jZXBWEAimTqvhSRXw51TnvqRasuFM0YW9MdjH8DwBEiyKCWWgA4EZsVwxuVYsLxfdglr+NtMkMHwKHkIdFuBKK5U+4Ys1YPuSGxXgy94//Snj9ZcL089Vo3ahI5jLyvTZ4vFDglluakABB+cd355MMJeoAOzamiqxAsz9MG5NgeC8XXQ0E97bklUqiMQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=LwLGWwoDP82aHlgPZ3dh5iiyTbLMw1mm41tE1LykYJo=;

b=XB6mOmZktGcN613O6Q3oLlGWQ6b7iQx6Z85qx1S0G7SVD9uNZLP3925DrZPq5aO6jg3sClHIzJz6yqyA9m21jHWHcTCW9FXj5smQSgsYvrVRphB5UbMBjweSsg6OU4tMqQx9E/PMS8SURPVkW+6lNCIxXL/rMdNPh62oTCiGLmrZBhiletg2BqMlkW//AQQssSswNLfbDr+aToGtw/RgJLn6dzAUjvb6lkjbKgkOsds9PLMM/t6aQzXCDUoe0PEa14Vko5yRCSgo5yqbNSTasYwFAML0bq28D5pVyaR6AFeo9F3smwUXKzN8/qX+aQCtoVAYBPkBqHol1SKBeWPNKw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=permerror (sender ip

is 172.105.152.135) smtp.rcpttodomain=nk.ca smtp.helo=qmpj.lukychosetp.sbs;

dmarc=none action=none header.from=qmpj.lukychosetp.sbs; dkim=none (message

not signed); arc=none (0)

Received: from CH5PR05CA0019.namprd05.prod.outlook.com (2603:10b6:610:1f0::27)

by BL3PR13MB5146.namprd13.prod.outlook.com (2603:10b6:208:339::13) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7316.36; Mon, 26 Feb

2024 20:13:24 +0000

Received: from SN1PEPF0002BA4D.namprd03.prod.outlook.com

(2603:10b6:610:1f0:cafe::f7) by CH5PR05CA0019.outlook.office365.com

(2603:10b6:610:1f0::27) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7339.25 via Frontend

Transport; Mon, 26 Feb 2024 20:13:23 +0000

X-MS-Exchange-Authentication-Results: spf=permerror (sender IP is

172.105.152.135) smtp.helo=qmpj.lukychosetp.sbs; dkim=none (message not

signed) header.d=none;dmarc=none action=none

header.from=qmpj.lukychosetp.sbs;

Received-SPF: PermError (protection.outlook.com: domain of

qmpj.lukychosetp.sbs used an invalid SPF mechanism)

Received: from qmpj.lukychosetp.sbs (172.105.152.135) by

SN1PEPF0002BA4D.mail.protection.outlook.com (10.167.242.70) with Microsoft

SMTP Server id 15.20.7292.25 via Frontend Transport; Mon, 26 Feb 2024

20:13:23 +0000

Subject: "message for root"

MIME-Version: 1.0

X-TOI-MSGID: <101741576207062.AC354F821938C.1705442930402@qmpj.lukychosetp.sbs>

From: Canadian Tire Department

In-Reply-To:

To: root@nk.ca

Content-Transfer-Encoding: 8bit

Content-Type: text/html; charset="UTF-8"

CC: root@nk.ca

Date: Mon, 26 Feb 2024 20:13:23 +0000

Message-ID:



X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SN1PEPF0002BA4D:EE_|BL3PR13MB5146:EE_

X-MS-Office365-Filtering-Correlation-Id: cf478d09-e94d-4758-cb7c-08dc37076244

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

S9E+qjcIq2rVgFH63tTe7gbnpjVDlOYV0vBTwCvwE2KujKuMg1rd2P+HrMPPjAkM3iL9h2afziZdTOfA2b6p5P/3ZWNCPUKQX7oKKmArTt0EOa5DpMOFJWiCRf/uw03IXUWA30u+1xkoF5n3GoCpY6KSFf3f12pI4/MWjzUlfvO79UYFku7b1ZOvRrnd3mg9MmXJ+UtEC197n/aYz1NWZNQPjeRgE+Vg7TL0ItP+8ouJzltxOs+W534a6Ijl3dkh1aTjSR8at3j3ck0CpBRQr1TL7ywteHpTlMraHGUAF85Rg12IWnvpm1/RGnd3o7GWo7t48IYZetoZH4ZWGcr7vtarEHOgzTrsQ8ZDPAlZsE0LIPBy4U2OmsohGyOwI7NYrC6LDdlAf/JqTJrG04J9ZM8SH1jjuFwH2vBzvjK4dcTfc6kvRBraWTaby5MjlldiOSNLFZxmgaHIgemqoS2JMLl6aF3KQQXAszT4Qxyyq5a0yAPx/CHP9WrJ6qmTZYK/FRczJlF5BanlJ+CStfbDvKzLVmMPTdIlbiJJ06WdOA1jNQ+5SvvhaSiZlRx4msQbe4WCKK5YO2CGJngIZXNF6Dy/txsaohe7QktG86eyFD0T4ZBt0NqHewJQtVVH9yIYCvXDS8WcPzk3YxkzeZXwaRQ/Xn96xiTPk+tXl7SxAY3u36uQtpzXJ5S10QwBPuwoGYXI7wzzPF21yrTG/+5yu15DP05nIPB4/Q6XXfxoWzQ=

X-Forefront-Antispam-Report:

CIP:172.105.152.135;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:qmpj.lukychosetp.sbs;PTR:172-105-152-135.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(35950700004)(15920700032);DIR:OUT;SFP:1501;

X-OriginatorOrg: qmpj.lukychosetp.sbs

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Feb 2024 20:13:23.1648

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: cf478d09-e94d-4758-cb7c-08dc37076244

X-MS-Exchange-CrossTenant-Id: beb48577-e4da-482d-ad17-be7c9f875854

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=beb48577-e4da-482d-ad17-be7c9f875854;Ip=[172.105.152.135];Helo=[qmpj.lukychosetp.sbs]

X-MS-Exchange-CrossTenant-AuthSource:

SN1PEPF0002BA4D.namprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL3PR13MB5146











(1) Notifications





















































▂▃▅▇█▓▒░𝙳𝙴𝚆𝙰𝙻𝚃 𝟸𝟶𝟶 𝙿𝚒𝚎𝚌𝚎 𝙼𝚎𝚌𝚑𝚊𝚗𝚒𝚌𝚜 𝚃𝚘𝚘𝚕 𝚂𝚎𝚝 𝚂𝚞𝚛𝚙𝚛𝚒𝚜𝚎░▒▓█▇▅▃▂







ミ★ "Shape Our Future & Win a Featured Product" ★彡

































































Tupperware Phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 26 Feb 2024 00:07:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1reV4X-00000000BtV-07xA

for dave@doctor.nl2k.ab.ca;

Mon, 26 Feb 2024 00:06:45 -0700

Resent-From: The Doctor

Resent-Date: Mon, 26 Feb 2024 00:06:44 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-tycjpn01on2119.outbound.protection.outlook.com ([40.107.114.119]:33816 helo=JPN01-TYC-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1reSRM-000000006fR-2PbS

for doctor@doctor.nl2k.ab.ca;

Sun, 25 Feb 2024 21:18:12 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=YCi6Ixv1t2Fby+CZjH/5r5NWcybJz40v6ayvqh6FzkPULpsS9Hkagm+SQrDxbIFHwayaRK8rS8SrDf6rJ8/AfEhu8HwokWxnEV1hWPlvcLkvntwa9fYaKU64ECTsoBiJIkyXDqWDYjqyw4slgsRfCU28xmx8BJPM9W0uqlEFBIPKEcI9pB66bsrz8mtf8dL+KBgztmmvgAw+Ihb6KLMaokUw77T+qPeJFfYaiVvlhHlqzZei3GKtlH9FwpI7qHjunMOMlz11ID1Yqf6tAHS9Q7TKrwMWRs4YIFJEiJi+g7afp6fdye4uGC67KcrrRxZ2IRc6naSbRqVaYj9M9rBv1w==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=pt1Toczi58H16nS3keElahBKZ3mT61kZ3gPQnERYKwM=;

b=eMIJIZDf1+elYrb/ldLDmh60q4nQ2ZQHVjh1wUmQPPye8fg0AeyZjFGrdd6BMQVEGFj2hK+lrgeAK9ik3sL1iWxu9Txx9GDZJhOPbH30TnERMdI0OEXp3SyyXPZce2Q6HceDO4sijdjtt5qXLaVT9Hy3spuw+hWuumykTocY90SPpH/w5YTXnOyq2eO8M+9bfH3sFYvzmfaWcTEceZodrReQkmL01s6f8KIIHtqmamSgky+yptYSxgYo2YMmzvdPR7VFrrCMDceDpW4n7uXFaoNcVVA8VPuR4fyo6PJgUgBb2smsOYeZuSd32gO70qH807JJiBR1FsZBsEhqtFBIZQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

185.185.70.183) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=edwnv.bardoni.org; dmarc=none action=none

header.from=edwnv.bardoni.org; dkim=none (message not signed); arc=none (0)

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 185.185.70.183)

smtp.mailfrom=edwnv.bardoni.org; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=edwnv.bardoni.org;

Subject: =?UTF-8?B?V2luIGEgMzYgUGllY2UgVHVwcGVyd2FyZSBNb2R1bGFyIFNldCBieSBUYWtpbmcgT3VyIFN1cnZleQ==?=

To: doctor@doctor.nl2k.ab.ca

Importance: high

MIME-Version: 1.0

In-Reply-To:

Content-Type: multipart/alternative; charset="UTF-8";boundary="PART.XpD6vDv.eeyrnafn"

X-TOI-MSGID: <975764404.50C54DFF5EA54.1708919819820@fritsch.com>

CC: doctor@doctor.nl2k.ab.ca

From: =?UTF-8?B?MzYgUGllY2UgVHVwcGVyd2FyZSBNb2R1bGFyIFNldCBSZXdhcmRz?=

Date: Mon, 26 Feb 2024 04:56:59 +0100

Message-ID:

<62b555dd-d3bc-4bee-9918-c2815fbc30c1@TYO1EPF00005026.JPNP286.PROD.OUTLOOK.COM>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: TYO1EPF00005026:EE_|OS3P286MB1496:EE_

X-MS-Office365-Filtering-Correlation-Id: 7d35d137-f933-46c2-254c-08dc3681a67e

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

gMKdaJWPG5sAk50OMFYXdcpTB6UJHbdYBhCV2xrwh+IeOWo201U6TE0MXtr1pMdk8PIhzE3Z9csqst75hon2VoZMHOhsE9i5CySQt7N5g7FjaO16xv4mnmStV6G6yXJRMj+Rjyh0RdDl1AWPyQqSTVZLN5fsAjauqcwmkjwM2y4cv/UsoUNI4uNV71GIA2rkjukKG7mDE1SSRN/iIjuod4OvIiY1nGokT+MjBLJUXouxIAq+Zl7yZIQVtTBFd/4yw1tnJzCN6vaeEpw08iS31zDBGVNasb/FPn5/haiRtSQ8jXFkqM2BDrQr6WiTLqEhweyNtx/DmN+qiRtR/tsbNUOFMXQjd8mTPTDWvtd4C0a9WE/h5Sx09tq0zjUyBPEEXWlSTZR6aCg9ZLeWVX8VmE232jU5uWq1N5iQzHHL2TCqeHxBgHQVzfJLsvNniS3OG7N09O29vDaaV6n9iv2yeECTJ/DHPd6AHQ2bc1EiAK9oyM6bJQ0CoG1oNJAMfa05G2mQGf2jaUfbNHidFL+hYgUlg0IQ0Du+zgVJYYWcbCRxy9ZBv67rNERBpIj8jYzARPDlnsuf0UWuXuXUza4qYywakpGaKh3RC2tV1ch0KBEhs4t7ikVAZlf9INS3/UPGAsIw2n9hX1aIrs1QCTRO77blQ4H9XG6xZRb/RpWtGK2os1MZJxVaaz5n8Ls0UlYwtFL0VJa/tABMOMKssjXVDNeIHT/CX2chXTYiq5BBkVE=

X-Forefront-Antispam-Report:

CIP:185.185.70.183;CTRY:RU;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.fritsch.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230031)(36860700004);DIR:OUT;SFP:1102;

X-OriginatorOrg: edwnv.bardoni.org

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Feb 2024 04:16:04.5640

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 7d35d137-f933-46c2-254c-08dc3681a67e

X-MS-Exchange-CrossTenant-Id: e522fa8d-a21a-41cc-8f49-a0a5215aa74e

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e522fa8d-a21a-41cc-8f49-a0a5215aa74e;Ip=[185.185.70.183];Helo=[mail.fritsch.com]

X-MS-Exchange-CrossTenant-AuthSource: TYO1EPF00005026.JPNP286.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: OS3P286MB1496

X-Spam_score: 5.3

X-Spam_score_int: 53

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: If you wish to unsubscribe from future mailings please click

here, email ecpcompliance@yahoo.com, or write to: 11525a Stonehollow Dr #100,

Austin, TX 78758 click here to remove yourself from our emails list



Content analysis details: (5.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: mochkilaton.blob.core.windows.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.107.114.119 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.114.119 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

Subject: {SPAM?} =?UTF-8?B?V2luIGEgMzYgUGllY2UgVHVwcGVyd2FyZSBNb2R1bGFyIFNldCBieSBUYWtpbmcgT3VyIFN1cnZleQ==?=



--PART.XpD6vDv.eeyrnafn

Content-Transfer-Encoding: 7bit

Content-Type: text/html; charset="UTF-8"









































































If you wish to unsubscribe from future mailings please click here, email ecpcompliance@yahoo.com,
or write to:Â

11525a Stonehollow Dr #100, Austin, TX 78758










click here to remove yourself from our emails list












--PART.XpD6vDv.eeyrnafn--