Canadian Tire Dewalt Phishing Contest from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 27 Feb 2024 20:52:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rfAyJ-0000000014Z-0MHa

for dave@doctor.nl2k.ab.ca;

Tue, 27 Feb 2024 20:51:07 -0700

Resent-From: The Doctor

Resent-Date: Tue, 27 Feb 2024 20:51:07 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm6nam12on2138.outbound.protection.outlook.com ([40.107.243.138]:25185 helo=NAM12-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from <4O4OY8430@etfvbypq.iode.sbs>)

id 1rf5YG-000000006WO-0jxb

for sales@nk.ca;

Tue, 27 Feb 2024 15:03:56 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=Xwx9QPOlYovFrLFLoj0jZWKWS5tduXUApCLBbJQ+J7C6tReAustYt0sPdV1bVpwTH60SyEKq3akNj7cZ0f6rW11VfH0zUISyA0U8AR7EVzaRTxxBAvzO/kDby6IU9hP72hz16i7Gkv24lwYa1qZNTPYzbT2f87Yd74okfGr4dM4kFhJFiHcArrqB6ySypVGyUohMrR6nJEERcHZwQ2PEcU+ukCsj6BBsZL4XDF+ZyrKUmo3aRNUoqmVJfurw7v7vdkWQgaXmiq/cerUkNykfNhCz+Kc9RQtMuxc1N15Lln+0VmaZvpOl/3TaPDo37c6kTSK2+r8Hnm9dwzVEkwQJng==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=a3EBv0M5RCMe6s80tO87UTO6yl2LGNGWLg7ZkqJtJgM=;

b=F0UoB+bMqTAHFZJ3XkjcQmYmDGcqVLwLWCxfJoO/jV7aZSpvtBI5iUUmyEsanzmlMgAjR4FQSbEg0zBO4IEf8SATrf0rrogNYEhp8rFhx39H3W1keA2yt/56dJDCfHz0NOEXdnRUwK0xxNw9w5/Nm6clM3DUAZgl2TTMl9N/DOIqvLpofyiCVxGCZxIZGpPDgprgi+p4/DoL+BUlfBdVpzS7ZCBTmWgHqwYIJMG1Hl/flYW+6p2+HPQTEZ+aw1FsHml3Oz1++XRanPWX/CsDGxWAgU/iAUYJ7soBVLxagmWBKDnqP1nLxadf6qqGR+atqNc12w4YCP63EsptIFRomw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=etfvbypq.iode.sbs; dmarc=pass action=none

header.from=etfvbypq.iode.sbs; dkim=pass header.d=etfvbypq.iode.sbs; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=rdhdfhsddbhsdgbdgd.onmicrosoft.com;

s=selector1-rdhdfhsddbhsdgbdgd-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=a3EBv0M5RCMe6s80tO87UTO6yl2LGNGWLg7ZkqJtJgM=;

b=kqMNkED6g2HFasZ9w9jN+iPA9kUYQRAXAvXDtAq667DJ9jGS3Rmbeeb6N8Pn02rgrzzE1JgA2n4/ReL/+lZP5y999jERtolvuOKUgNiyogW2JAIPcDlubskn9CkTWtnMTPIAWISwrPhOBu6wPP15niimNdwE2RFi5hglyXy9PjoloB36ElDrbdLL5XGOQETSVD3IEQaZllAcqN3ow2dS+h3vqaESzq8hCgsMdbmmZ95o0eHrXpbSOiYbO2ztAh+wlFsiOXbLvJwACPMxK0LYSu71LqGwNZa9NKQR6La/getQdGx0T+fKZAIoAmZPTyexoqgXGazBZC2gZX5hdWaXHQ==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=etfvbypq.iode.sbs;

From: "Todays Winner!" <4O4OY8430@etfvbypq.iode.sbs>

Subject: Please verify

To: sales@nk.ca

Cc: sales@outlook.com

Content-Type: multipart/alternative;

boundary="_642e65c6-fb11-498f-860c-d409ff26a76a_"

Date: Tue, 27 Feb 2024 22:01:45 +0000

X-ClientProxiedBy: YT4PR01CA0382.CANPRD01.PROD.OUTLOOK.COM

(2603:10b6:b01:fd::19) To SJ2P221MB1276.NAMP221.PROD.OUTLOOK.COM

(2603:10b6:a03:575::15)

Message-ID:



X-Message-Flag: Flag for follow up

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SJ2P221MB1276:EE_|CH3P221MB1119:EE_

X-MS-Office365-Filtering-Correlation-Id: 406981a8-d521-4c62-c5c5-08dc37dfb20b

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

xVT2y1INEh+4vMANhOGiEpFrP8RYB9rtWnHIW3s97I8+oods3T7zg7SETy32HEKpGxdiqWTfTXSz2Ujkh2eDA/z6XBf9Vrs0JzxfEmUcOyke/aH8G3SXN+oEZsbaEBSOEwxqopuPbRbS6lA7ZeHQHR4CUWWyAJUItNIynbHAP7hwHxezuO5sOb+cUKxpvjFdhHoozMxeJbLuUqGsJBPC7PGxiaLViAjG7fDdUC35o0pEFpvpMP5eYyv/T3B3c5qptuN221w0QYebMEskZuIzjb6cwAECGeQeGL8Y4Jim5sxMAjA3B+Wzo5AmH9fkrNSMyDdlkPee9ZE7lZAfaN//HgT/DZnP04NEH9CgUX8aXhcDn6ayZ0Mi/eEatTtz+rFfsFzzh9ySPVU146S0LTKmMAJGUl+g2HSfJS/FzIodJnetOH8PvPgv6kcLCdh6l7RRnt2O56KuXcPNMFi0/TodgJ9T3kVqgLB+SDmwv0aiVzYmraeIVnxEVOyxPvgC98E1mAroYWtffbfAGKZgjKqI9If73PqrDjpMpwrANhSRZC0V+9tbnsNIoGk1XUY1W5KbvzG6MmDe1wxG/P/TogNr1H6V36XjEQzOIqO3/J9GiYtJ5ACRXZuTHtEXcI1LUzTfQ0xTz7u4kePygvTn1f8UnlH9PJpfKA2oS/9cDqU52+fHyNWx4mDCPY0d+IhNflfS

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SJ2P221MB1276.NAMP221.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230031)(37730700002);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?eVRIVVZPTjdCUmZRTndoUVp6UTJLQkE4N0xKalhZbHUvT29SWkd0MGYyOXhh?=

=?utf-8?B?NHFyZU9tVFRFN2k1Qkd0cUY1TjN4Q3p0OHhjQTNiZU9xNU1SOXpvMDdLRStk?=

=?utf-8?B?N01WdlhyTWJoYndOdGdraTFaMHE1UFFtRUFQQnAwN1JYN1pJMFFjVmdiS3F0?=

=?utf-8?B?alJ2L0w0TTNSTCtVeWhjUitpbjBXQ0hBNnRqOWU0SFlMWmlNTUxUVERNY1Zm?=

=?utf-8?B?Y2RETnVlVVVMWEthNENCTzk1V1ZxUnQxNlZJVm5tMTV0dEJ2bkNIa1J5UTJy?=

=?utf-8?B?UGZGUWNKYzR4UXp6Kys1UUJ0ckd5Z2FWV0xUbHFyaUp3b0FaL1FnR3Fmc1BN?=

=?utf-8?B?NVphV2ZDTlRpOERTWFVXNElWb29kTlhMNlNmbCsvL1hOU3A4SklXaFFWQkkx?=

=?utf-8?B?M3BxUS9XRHlvb2tJTkc2NjZzbjVoeGhjcHhib3JRaFVwNzljTDQva2I1QXA5?=

=?utf-8?B?VEhlWWtreTdsNVdEOTZSWWsreGQ0dzlVN3ZNYjRoS2ZRMGEwUVl0OTZXVWpW?=

=?utf-8?B?T0NkOWpzNGdVM0tYOUFvU2pXaW00T2RuUkhnU0JmcWFob2ExV0oyMTNEcVNu?=

=?utf-8?B?Q2N0SDQzNThXZ0tDbXlOMEoyU3M4c0RReWxkRzcrNVNEYWYvQVBEZ3NPQTlm?=

=?utf-8?B?azhqQTJSRWZpYnpDT2ZPdDlSWlh0cDVVVGk1OXNheE5hUU1EYnFpc0UwOVNS?=

=?utf-8?B?OFgra2U0VTNxTU5aUXUxczg3ZWRDbVhQeWxRekI4alJRRTZXSmFhTUlTK0ZT?=

=?utf-8?B?YjhkMmt6N2NiY0MzTjJMSythcHFXMlpJS0k3NmZtayt5MmhMYUVpWnVmVy92?=

=?utf-8?B?SkZNUk9MOTRuMk42OUNDdGt6ODM4LzFFS1REcXpubXFRWFE2ckZwRU9lVWFZ?=

=?utf-8?B?Qk5FVHF1TVhiZDhxOWhLeTNZSHUrTXFwUU9DUjRMNWY5R25qbTdVWHM3bVVN?=

=?utf-8?B?bnNWMTY3OW5oL0FFRjFaMGVoNjB0L0V6VUdjd0FiKzJ6eE1PVjFlamphUkpR?=

=?utf-8?B?YlNsVUc1bzJYcEFuNDZ1UU5HSUhPRkVhcENuUkIyNlBSRm1FaWZKQ2U0bVFI?=

=?utf-8?B?dFJaWFdGSVJXZDdKRWlVUUszSDFZdXdNRkZXZXFoY3hKM1kxTFFEcC9BL0Nv?=

=?utf-8?B?NGRCdzN5TmRXTUFJQTl1ZVBXOEE3L0VrSkxrb3VvaXorNXFnMCtFdmQ4dUd2?=

=?utf-8?B?V1hNZ0N0cU53Q1Bla1F5Y2I1cE95Zmd3MjV4NWJnRnFEeDdpS0o4YWhRRCsw?=

=?utf-8?B?d2NrajExSmROZUFkMTRiTHNqYWRGSkNzZ1hkaEgzdWF0R01ZcGtNWXRUWkhP?=

=?utf-8?B?RHZTNjZTYzhTTWI3S3N5SUxLci9vV3pkeFZoVHR6dytyRnNQa1VlZkk3QnMw?=

=?utf-8?B?akdUZGo2ZHFoYkhQTlhkaXZaUkRsNDZpekFIYzg1aWZ0ckpwQ20yTHlZT2tT?=

=?utf-8?B?NUQvS2V6OFNBa1Zqc1loTkI3SHVXL3hYY1VCK3lMV0tyNW4wYWNlVnNGNHJq?=

=?utf-8?B?cXZ3MkpvU2xXM240RFA0Ykx6MG5uRWZBSTQ4aTE0THdzbHAyd0RFeTRBWDJa?=

=?utf-8?B?RElvMDRLdnlTVnpxdXl4U0ZIWllXWnRIQktpbHNTcG9GTmt2dVYrY3FvQjd3?=

=?utf-8?B?cjB2YkNUSjJ0QkVyMitpY1hCNXN2VGFQSGQ0YnE3bDdoSFRTRjBUN2FLc3d0?=

=?utf-8?B?VUU4TTliSUtjZ0UyQTJMdVArV3hNQ2FIMEdtMXpKZW9iYWI3YklKNW0yc3B2?=

=?utf-8?B?OUw2dUVWaEtlV1BBVVgvOFltWnM5dnc4NGhOZFh5b3hlVjRPS2JBVGVqNEI0?=

=?utf-8?B?TlRsUzdWMWtCTmRMYlFBQUg0bXFtTUtYVVBJQjRuMVc5anUrUGYwWGNuTUJm?=

=?utf-8?B?NVhVOUdJWkU1NFZtRVloS1RWYUN0enhUeUZNQmJnUjlBR2Y4UXBCc0g5UUJL?=

=?utf-8?B?UWl5UUdOYWxYRGJvNjZXekJLV1pYQUM1dTBCMW5tTzQ4STl5NWV5QVRiT0pI?=

=?utf-8?B?ZW8xdHF6TldVei9mZ2FFcjduNTV1WlVVRVhSVmxwMWtXTXJUMVp2NkIvNjFL?=

=?utf-8?B?bEROT3FqczZIMEpjTWgwRzg1TlZmcDBsTnppY0pIdXp0eHNBZm53bExoUXd5?=

=?utf-8?B?RXpsSmliOWJkOStUZWhUTm1aVDIzd1NrZHY3TXZQdm1kOFNQSDNTajJkUEtQ?=

=?utf-8?B?Ymc9PQ==?=

X-OriginatorOrg: etfvbypq.iode.sbs

X-MS-Exchange-CrossTenant-Network-Message-Id: 406981a8-d521-4c62-c5c5-08dc37dfb20b

X-MS-Exchange-CrossTenant-AuthSource: SJ2P221MB1276.NAMP221.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Feb 2024 22:01:48.5175

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: d105c4c4-d029-4c45-9d3a-f6dcf1abd65e

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: 1Q9vbbpdsl6kxUQ0EetUIhm8vFymWrYmnW0jgmFveqcAZ29jBVFFPb/QhqYEb74IeTUgPH2VHHr5XhtIW21OhqMVGlhUJ9uwFPbCTkX2MAM=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3P221MB1119

X-Spam_score: 11.2

X-Spam_score_int: 112

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Make an Impact, Get a DEWALT 200 Piece Mechanics Tool Set

Today Make an Impact, Get a DEWALT 200 Piece Mechanics Tool Set Today



Content analysis details: (11.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.107.243.138 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.243.138 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_VALID Message has a valid ARC signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_SIGNED Message has a ARC signature

1.0 HK_LOTTO_NAME No description available.

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.7 SCC_BODY_URI_ONLY Very short body with something maybe clickable

0.0 T_REMOTE_IMAGE Message contains an external image

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} Please verify



--_642e65c6-fb11-498f-860c-d409ff26a76a_

Content-Type: text/plain; charset="UTF-8";









--_642e65c6-fb11-498f-860c-d409ff26a76a_

Content-Type: text/html; charset="UTF-8";





Make an Impact, Get a DEWALT 200 Piece Mechanics Tool Set Today


Make an Impact, Get a DEWALT 200 Piece Mechanics Tool Set Today

















--_642e65c6-fb11-498f-860c-d409ff26a76a_--

Walmart Samsung Phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 27 Feb 2024 20:54:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rfB0M-000000002WD-49jo

for dave@doctor.nl2k.ab.ca;

Tue, 27 Feb 2024 20:53:14 -0700

Resent-From: The Doctor

Resent-Date: Tue, 27 Feb 2024 20:53:14 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-bn7nam10hn2247.outbound.protection.outlook.com ([52.100.155.247]:3361 helo=NAM10-BN7-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rfA1l-000000008sm-0qrW

for root@nk.ca;

Tue, 27 Feb 2024 19:50:42 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=MV6VzMyLXepryhy2FxKldn6RyEagpzhKyW9XAZosoPpK1pw9yaQCaStHOVwTcjxLWHhCrFljzva97FRWl8c6cksHQfYvGN2/3G6N2ZrLFKoC5xEoyHBBXLwzunDYk9FtqU1hfPV/sdElEpvT+uxy2NcxxMXNeMFi/IKTQR/eAgoWrLsOegjAI724zv3ATSsjy4IEMDbs+8+Zu1HhTkZhHTqd7aRsUbwXEnZ7ORMmxvDkVA3PsgKQrcJDZKoLbnBeqbYIhmJvawftqXRDOGz3K0uzOfXmkLUQ5OQ8yS4yrue5nc+2BCvVDhykUr5Nj5D5235v1bTgQIY+N9Uy43n+aQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=bC4Domvb3t4rmBaKUTp4O8NUZURMTBRKmPpWyqrTGKI=;

b=PODi1yl/CVcDQ6O0jbir0YpVTdoNHdreq6I7VvZNe1Ww1zUBU/UyPtpbS+NtJNFjBt6Q6D4oiDyLK7V/cpxA2Qv/7SdjhTIKdGB6Zptrb0ngTqmCgm8TREDIuVSBoTygFtKK/M+cft+najyjybEe96X+yy6NM5V2+BhfQsv62/tqeiJYUgC4biQ/Cn22p68Atj7aoOf6D359d+BhxoowNQA2SMmqwAAkW70BW/6UDTs7OiqgbV1O9NbsowASENj0hhWijDPBXOjfgA/7ijdgvvV6zGgAu+5fBrro67koywbF1knlPu+xdBedR0qNog9Pw0MUNCwsvWiOaQixZXtrXA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=teaioj.qxan.sbs; dmarc=pass action=none

header.from=teaioj.qxan.sbs; dkim=pass header.d=teaioj.qxan.sbs; arc=none

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=teaioj.qxan.sbs;

From: "Samsung S22"

Subject: Lucky chance to receive a FREE Samsung s22

To: root@nk.ca

Cc: root@outlook.com

Content-Type: multipart/alternative;

boundary="_380e2bf2-d5ce-42e8-b747-e45dbf9d85cd_"

Date: Wed, 28 Feb 2024 02:48:22 +0000

X-ClientProxiedBy: MW4PR04CA0084.namprd04.prod.outlook.com

(2603:10b6:303:6b::29) To SA0PR19MB4491.namprd19.prod.outlook.com

(2603:10b6:806:b6::8)

Message-ID:



X-Message-Flag: Flag for follow up

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SA0PR19MB4491:EE_|PH8PR19MB6595:EE_

X-MS-Office365-Filtering-Correlation-Id: 9ad06bd0-cde5-45ee-e1c5-08dc3807bbc8

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?NEdVZncxd0lOc25rMVRtTkIzQjFGUjZwSUs0c01PNFAvRXYzdDN2K2MyaHg4?=

=?utf-8?B?Skt5QURKQ09nTzZWUG5pK3d6QWZ2Zmo3dFppS0lZSHhrRHVFRS9LOVNKUDlQ?=

=?utf-8?B?OVFkNVJ1TkhCRHorK3FSVWg0dldrWmVtalNKOFNLd2Rqb2twbWZjQzQrU1Fj?=

=?utf-8?B?aWlDamI1SXQxYVdLak84dXFTMWY1TTh1K2V4Qnlad2kvSkZXWUxQNjRXQW96?=

=?utf-8?B?a2tralRQNERWMnQvclJ6NFY4T1VKVUZCZUNUR1JJMEx6TVpHdE9LU0s0U0JP?=

=?utf-8?B?dGI4U0RCVTBEMkg4amk0bUpkcFZUN3M1NE0yM3Q3V1hyOERQaFZpaHQzWUd3?=

=?utf-8?B?TjdMUGo4QitsemxyRHFxNENZMzNVMGYyQXhab2R5ajl2RzdhaXhBZHRoUG8x?=

=?utf-8?B?OThWelA0VUEzZlRRUWxGMndGb1Zra2NVVzQzOEp6Z1BLaGU2MTFXdnpReUww?=

=?utf-8?B?NnpGK2FTR2R3aXZaQUhhLzk2ZUVJUk1MQkNVZlFIU1AvR3NHYnlWT2RQRWZY?=

=?utf-8?B?TE9jYjdxNFQ3aUNUN1doUVQwOE0rR3NFK3R2WmpTU1U3SjRqWThkVDV0Zmd3?=

=?utf-8?B?OG9TRnRaL2R2UVgvakFYME9FSzJNZm1Dem00ellqTnRJQk5wd1dkdlhuM2lB?=

=?utf-8?B?MFg0M2Nud2NFaUIvVjZvVWtZRTdxMmdWZWZvY1Jiblkxcm9IZ0lOTWpNSU0v?=

=?utf-8?B?ZjlJbjdwQTQyYmFOSkRUWjBsaUVFV09ZaXU4TkFHTUxFV1BxYVY5dUJvWndk?=

=?utf-8?B?dXovQm1mSTZCU3BLdlA2NlUza05uZUNSVFE1V1RXVzVvbTg2V1VzbUxtUUp4?=

=?utf-8?B?V3UzTlFxbmZSQzdmZlo5KytUcGVaVTRtWEhTRUtjU0ovUnc3dW5DWHZEV2Rw?=

=?utf-8?B?M0VKbVdFcjFtYUZPK3BoRFpMdzVCZVN5UnAwNkUyWGhYMmozdGVmWnpYWDZS?=

=?utf-8?B?RmFwMzZqc3FDSEpJZFM2WUlqcnRNT1NNOEdtVUlzT2o4UmVSaWhncUxNYzhM?=

=?utf-8?B?QTBET2MvWnVicHBTSWhxVUhTdDQzZ3ZTTXh5UU1LRWpVa0pySHFlZXFNdkFp?=

=?utf-8?B?ZzM0Qk9aYWhuaGFMa0JtOTR4VVQ4SzJlVCtMMVJxaGkzYkp5ZUROWkxHSVZM?=

=?utf-8?B?Z25MY2NTTkowU29MeHdKSHE4cFlzQnQ5UjZJRFIxNjVwUGxZcUdUcGYxOWRB?=

=?utf-8?B?S0lKRFBTYjlVbDhYUkZ5aFZVTG1aRWwvUXRnQk9EN0RucWRiOHE0MmN3c3VU?=

=?utf-8?B?dVpqYXVIcEpiQmtzL3ZDV1VyTWVPbXFmNDhkUVNYemFmYVowcy9xS1pHWEpK?=

=?utf-8?B?MTZZM2lQSnFFUG5nelYwY0wwM1Z2S0dvNXN2d0Y5OWxzb0ZMUzJJN3lpTldE?=

=?utf-8?B?VTJmaVlUOFhqV1ZPWHBkaHlEWnFMK3krWjdLeDFvaTBBT3dVYUV5dEhlNG5J?=

=?utf-8?B?THdSOWQ2SitCdFpaZkVERTB4RDFjSEpMRG41Ni95VngwVER5MGdPTk9LNnFr?=

=?utf-8?B?ZklPQXFza3FVSEJMU2tCV3o4Y3RaWVVTdTVRRGxCdnBXMjJ3ZXcwWHBIRTZj?=

=?utf-8?Q?eSHhLHLbthThqbJlkBzqriiqiOK8ZHLIT+4Bpaz/tbmJXG?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:SA0PR19MB4491.namprd19.prod.outlook.com;PTR:;CAT:OSPM;SFS:(13230031)(37730700002);DIR:OUT;SFP:1501;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?eVBlTFZaTktQRzFydFA4NkdQdjd6SER6K3hGaG8wMkZRWFN5SEt4QjVsRm9P?=

=?utf-8?B?MnJCN2diQlZCbHJpM0RoM3doTVhkK01vS29wMmd2NmtQUERGQWRtT1J0KzJX?=

=?utf-8?B?c1NlZlpZaU1DZFQ2TXIzVjhyeWp2WXM4aE9IWlFheXlDWlV5R3U0Q29CY2xX?=

=?utf-8?B?UnBUVlNsMnp6Yk9GR3dNajhyZ2lLYUpacnN0ZzFScWx1c3EvWjJoR213RWVk?=

=?utf-8?B?NXdnMmMvMm9EQVZWTVdmTTdSd0VZVml3UEltUEh1bXc3VHFRcE55UHZIMXFr?=

=?utf-8?B?R21GbjNuaW9FaUpFZVNsNTVaOXNqSlBvZk16bFpKR3BJeGUrcXBZU2dETEJk?=

=?utf-8?B?OTBMWXJxMkZpeFkwcU1hYmN6UnRiNVBlZXB0THY2S2Rpekd4RHBseGkzU1gw?=

=?utf-8?B?OTZRQ29JTndSV3NYWkF5eThSSlltOGxjalhJZXFQWHZRWk01WUt1eGVPcURS?=

=?utf-8?B?dGRid2hpaDEzc0pKMGxpVE1YaUJqUmh6ekk4ajJ3MFd3ZGFzbmdFZTR0ZTY2?=

=?utf-8?B?THdmczJaUndMMmIxSkNDV1lzSnVZaWpTZ2Rzc3k0dWh5UFZFQnA1cWhkV3VS?=

=?utf-8?B?azdNZjIrcUpZck9zYkVoUHFEOVBLNEhiWm13YWJ5WkhqOGl4UVViczF5SnI0?=

=?utf-8?B?VU9NQ3E5dlpHQVVacmM0a3hFUVl3VWc5Tmt2MDczbmF5WTZORElmUlM2Y081?=

=?utf-8?B?b0YzM1pxQjR2SG1yaHdkWkxXNS9pT3BqRlBjakdSelQrN1NEWDN3Tkc2SWxq?=

=?utf-8?B?ZHpmQXB5QnhKdGRYTGJYTjdCTEtoTzF1Qk5CK2l3bGNRdzFNWTR1OUlUWlhq?=

=?utf-8?B?RUh1eFU0SWJ2Z0J6c2NLTGd3KzdZUHVCRkQ2ZldmdU4xejJ5VFVsYVJLeENQ?=

=?utf-8?B?dU4raWVLVjlmK2xDK3NJd1dqR3o2RzU2R3g2TWJTYzgrdTVyR2VRbHFIN3Vv?=

=?utf-8?B?UkFxWHBIaTJmV3RJWWs0ZXNxeEJOWDhuTEIzRld3VGNKeEY5Z0c1VEcvcVFE?=

=?utf-8?B?aWhZNnN2NWx6TTJnbUFuOG1zeDVVeW5qN0F2aFlLQytTR3Exdk0wSFBVQ2Rq?=

=?utf-8?B?MFh5dElHczJOUHYzUWtyQXBrY3JpeWtqZmRHS3lzYnZ5amRqTzQ5WWlkdDl4?=

=?utf-8?B?SGFWT0paZWExRitZV2xja2ZSc2dBeVZpY1RZb1JVUk0xMEtpMjRlOEtzN3g5?=

=?utf-8?B?RzI3TmVWeU1vKzE4QUMvcklSL3UyeVNJdWpjcnFGbGVYODVTZWovamJUeXJp?=

=?utf-8?B?ci9XMjUvUUNvRnZXa3FqSjl2UUNxZGxkNEpoLzVidnlRWDkySElWd0NzOHpU?=

=?utf-8?B?TFlPSGwwV1RlSG5idFhEblE0RFFpRWUyb0l4SllPR2dQMGhEUzhrRHdIcHZp?=

=?utf-8?B?dU5TNkpYeHVtcnEydWpwZXBIT3pmeHlwajlLR0M1MXlUWHpnY1ZnS21BeFFX?=

=?utf-8?B?NDUvd21LYityem1JTFJrQ2t6dWRISERndGJTRTlWSytsSlAyUGFMTWRmUjdB?=

=?utf-8?B?bnlHd2dSSVFHNEJ2QTBJaFZ1WUMrZEdxaXFKWjFNbUkyMGhpbERxZEdoUFVR?=

=?utf-8?B?dkhFSXVyRWw0VXVmaDV3OVppdGtKYjlSRXU2Vmp4NFVwMWoyY1FFdWtsQkFw?=

=?utf-8?B?UG8vQTV3RHlqQmJWN1NjMWhQQkc5YnRNUlBZdkJncVhKNTJMT3RRcWR2MXdM?=

=?utf-8?B?ZFlzTFF5S1N0SEJPaXNYQkdWcmRPT0hNaUlPZnhBMDNtT0hrd3IzVW0ybTlG?=

=?utf-8?B?OFVKM1JJeG5IdVlrVW9UVmJsTllEZXVORk9YMVV3K21BNzBNYjYzQWZOd3cv?=

=?utf-8?B?SDhOQ2UzY3BKWnplbExaelhIUktUZmN5UDdzUm9KenpOalpVQ0xpa1d2eUE1?=

=?utf-8?B?V2NHWXVqQncxVGpNSkNHOFRQU2FjcnBSa291blFEMGpzZXdpb043K0I3TkVo?=

=?utf-8?B?OFdjTnViSkRpOUZEVFI4OUdJWTZNOHdPazZiUWpHUWJtSkxsdnMxS3RVeUhw?=

=?utf-8?B?bVB2V01NMklybnhURU11cDFrRTNSN2h1bVFmNUJYUlN6V29zZ1lUTUpmUi9H?=

=?utf-8?B?czhBWC83OFh2WlRhTXUzcjFHckF6NHoxMkwvaG9uMTVjOFJ0UHZueHdXUHpa?=

=?utf-8?B?TkN5UHFrSmdDUzB2c2hvdnZHY2lkNENWNVBXTVpwK090VU9TTWxlUmRvYXIz?=

=?utf-8?B?T2c9PQ==?=

X-OriginatorOrg: teaioj.qxan.sbs

X-MS-Exchange-CrossTenant-Network-Message-Id: 9ad06bd0-cde5-45ee-e1c5-08dc3807bbc8

X-MS-Exchange-CrossTenant-AuthSource: SA0PR19MB4491.namprd19.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Feb 2024 02:48:24.7414

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: ccad54f1-2d89-48a4-ae39-652ebdb8a017

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: DQH9gwJtu8RmC77QEe3OL1bpvVX1HEnIFIrTLHPCFweJWx2cJy9Ym8fcONa4ImnsrBvd2a84LbtKv+K4VQeGyAMSDpEf/XedwF7+ZQjUI6s=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR19MB6595

X-Spam_score: 13.2

X-Spam_score_int: 132

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Welcome [Samsung s22 customer, Exclusive Rewards For you

Your Name Came Up For a Samsung s22 customer Survey



Content analysis details: (13.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: ggfhdfhfghdfg45ghdgf.page.link]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.100.155.247 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.155.247 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

1.0 HK_RANDOM_FROM From username looks random

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.7 SCC_BODY_URI_ONLY Very short body with something maybe clickable

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} Lucky chance to receive a FREE Samsung s22



--_380e2bf2-d5ce-42e8-b747-e45dbf9d85cd_

Content-Type: text/plain; charset="UTF-8";









--_380e2bf2-d5ce-42e8-b747-e45dbf9d85cd_

Content-Type: text/html; charset="UTF-8";





Welcome [Samsung s22 customer, Exclusive Rewards For you


Your Name Came Up For a Samsung s22 customer Survey

















--_380e2bf2-d5ce-42e8-b747-e45dbf9d85cd_--

Canadian Tire Dewalt Phishing Contest from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 27 Feb 2024 22:38:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rfCdN-000000007Vh-3sKl

for dave@doctor.nl2k.ab.ca;

Tue, 27 Feb 2024 22:37:37 -0700

Resent-From: The Doctor

Resent-Date: Tue, 27 Feb 2024 22:37:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-bn8nam12hn2218.outbound.protection.outlook.com ([52.100.165.218]:38928 helo=NAM12-BN8-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rfC0W-00000000Jo1-428y

for root@nk.ca;

Tue, 27 Feb 2024 21:57:32 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=QVThtycCy7+UsHCh6TYl/g+R1g5lAX4BbFN3hvrn1MrlGI+SYOSYcgg/oEb5hOEcXDIjtrhQKUn5jz8iwIQm46j34mwJDYC74UEF6lqXuk/c4fKO43Ry03Ya6BJoX4J2lyPvHCBBi8Mn86l78aAeNrIryQ4wEG1ioPTzObZDyQke9IR7NDTRKNkx4gnxLR+VH1cnH0WaoahxEwTnS4MOQKrDttI+X/LOvz2AWepKFBSzuDD0I25YjiPIeLVpCymovuSAxUeqn7LD/gvNHTzgsehBfisev19IH8fi7FpCt27An4DkS6YWYuLjDilpbIu0Bt7XQgGL2x7uODC6GQF5Aw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=ukNoTOvg5arcVpzF7RI2JwteUxVRHA71NUgRmZ70qYg=;

b=nruRCBK0rjui5N2Lg7hANB6c6EQz1tfmYynx34zBJNmnCq/qpDA5lT4w8Vuq+FLfcWww9vqtuavNQk7Fm7oSBAasuYU5k6AqipwedpmYxpXfXqyk85xvdKwfB8aN1YsdBy69QxKR7ZJQuk8aQGPGtiGKcZ8zpWCmu+eiQcAiIPbF2bw44U5HYa1jF9IAKXgc9tfcoMnv8VctnyU7e/o4Yerud8O7xi7yHoM+EK4PctsR9YVrJAbKuaLFrk36uv4bee/rov69hw6nvc02tGN4VWfL/zbhDvUJol3ev4hNLNNvwslz+hdzlJMHcKZKzZiEfvSK0iHxrfPVAPU9dxLN0g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=ydlpolq.pokl.sbs; dmarc=pass action=none

header.from=ydlpolq.pokl.sbs; dkim=pass header.d=ydlpolq.pokl.sbs; arc=none

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=ydlpolq.pokl.sbs;

From: "Todays Winner!"

Subject: Please verify

To: root@nk.ca

Cc: root@outlook.com

Content-Type: multipart/alternative;

boundary="_d58efc02-0739-4689-a14f-193728d7249e_"

Date: Wed, 28 Feb 2024 04:50:23 +0000

X-ClientProxiedBy: YT2PR01CA0009.CANPRD01.PROD.OUTLOOK.COM

(2603:10b6:b01:38::14) To SA1P220MB1240.NAMP220.PROD.OUTLOOK.COM

(2603:10b6:806:3c8::17)

Message-ID:



X-Message-Flag: Flag for follow up

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SA1P220MB1240:EE_|BL1P220MB0852:EE_

X-MS-Office365-Filtering-Correlation-Id: de438a50-4c8d-4fa9-ad67-08dc38197ad6

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?NThJSXJha2R0azc2dThDYVhwVzJ2MHZYSlA2a2N2dEFQVXp4OXdFOWlrVjZj?=

=?utf-8?B?TmdjN1BOSXMzeXZpZGIwRVZxYzBKWkNwWEdBZkg1VXlPS2YyZ1JiM2ovdzhm?=

=?utf-8?B?Z3JXRXhnOXNrUXE4Q3F1TGtkUjRtWHJLQW5rUzBTOGp3VmZsYmdYQ1JBQ1VK?=

=?utf-8?B?S2UwMHdlcnI3Q28wUHh3a3FhRlhmVTlSWEhlKzJUU2lNblFpVW1pQjZoS3dG?=

=?utf-8?B?NmVCNFl3TldvRVhTM0dFUXQ2cFpHZ2ttaDAvd0h5N3hwcThhUXoxTGhxVHox?=

=?utf-8?B?V09seTZSSDIwOXhhRk9TamNDdjFuaDdsaFRReWVzbHdYd1NLMkdqUEF0Z1dP?=

=?utf-8?B?OFBzRmFyaUQyd3RzSmtVVHQ3bjZId1pRVnRVSk13SkRrdEU4NzM1YXpNaVhz?=

=?utf-8?B?ZW1kL0tqNXBpbDVOdTA5MDVkZGNvcXlkYWpsQm1BYlZxVnhUUzJPQlNTemFu?=

=?utf-8?B?dUZmM3FEME0xUWtaUnh1d0o3cVJPOFJXZmdpRzg0THVNczlwOU0wVWF0YXVy?=

=?utf-8?B?cEIrK2JvR1hwTEQ2dnRDK2pSYmYzZW5lRzBTdGNYSmdHMS95SGlEVGRZU0VQ?=

=?utf-8?B?dkMvSElUMzV2ODNQdFlHNFRCZFBRT1ljSHFKdVk5cE1BUDNFclo1SDJSRnRD?=

=?utf-8?B?SDE4RCtLaG1OckNKcS9vdmFDT1ZOVGtMNXJDNkpQNXVVRnNNbFJueXhwUFE4?=

=?utf-8?B?Z2s2bTE3M2tiemh2SktTOUh5b2RUVVBqMEsxOXJhV2o3MnZpckxqdTlsbHly?=

=?utf-8?B?M29qdlN4eUdWMmtpc1pmYk1QSEpaNVIrbmpRWlcwNFc2VldGdVpzL1U3SlpH?=

=?utf-8?B?Qk1XUGtKeXBsZlFWbWVuWjlOQUdpV1BFbFlGTWdLMTArL3AxZ2xoMjRKREMx?=

=?utf-8?B?L3hZZjZUZVhHSU16Q3BNSFV5Y2U3UG9LNjlwbXA3dXhUMDMweE92eDM1VWZP?=

=?utf-8?B?YWFrSUdSVEJjd2I0SmhvTHFVcEdXMVVtVWRaRmU0K0gyOHhUQ3RBU2JOV29i?=

=?utf-8?B?OVJmU1lTTlpQdUNHQ2U2dno3MXNnUVJqeDJzcWp6QkFJUG83SWJXTi9zR1cv?=

=?utf-8?B?RUtGdkxkbUpXU1FMUDN5a1ZhaU1uS1pKeE9UYUFVaW5YV1R2U2tTQk9NZGk4?=

=?utf-8?B?M21sUXNkQWg5V01ZWXBvTFFsTUNETWlQL25TZjlINDNSTmFyUm9qeWp3ZXQz?=

=?utf-8?B?clAwSFFrOElLQzBKSEZuZUNEUHVjMzN1Zkk0T0xHdW03UkVvU2NXNG84UWJl?=

=?utf-8?B?N0lUVmNrWVk1SElDVE44U0hQV2xYY1hXNGVOOUJvR01FQS96M3Y4S1dyeENn?=

=?utf-8?B?b1NiYktvVk4vSUd0UTYzeFNENkNnYWFaRWZOeVZiZ0xVNFFKVXVvUkNLcnJO?=

=?utf-8?B?enZoT3ladG1hbWpuKzdhNUlTWkVEVkt4aUZWcUdpUUZZaFoyODBvU0RwanRN?=

=?utf-8?B?VWpzQWNoU1dnS0g4RTBKcWdyVzFuaDVzVVpDenNpZjBOdXFReVZuZ0lCWHFa?=

=?utf-8?B?VHdoWDh4aXBsYlhLL21acDVxdVo2MHkyeVNiOXdEbjdNUlhDSXVUak1XNUR6?=

=?utf-8?B?Wm9DbEJEcERBS2lMNHhVMnpmY0ppc0NJcFI1b3BCTG04LzZ5d1duOXZ1MkdS?=

=?utf-8?B?VHFaQmZ6TEhhbGFVK3ppY0NNeXduYzI0YXZ5MkZWV0txUzBjd0I3R2tXM2lm?=

=?utf-8?B?akl0enF3eU0yeEdZRDk2Z2VyS0RpSEpaNmlwSU50RVh1RGRBeGwzVys0UGJP?=

=?utf-8?B?N25SSndQUGRra05tSTdRNXFmY0NJM1FVMGlTa1VoK2hCM21PRXVqM0xDVlBE?=

=?utf-8?Q?0pOdNrcCBFrPZ9v+9W/tyAvnRb3Vita3QDDIo=3D?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:SA1P220MB1240.NAMP220.PROD.OUTLOOK.COM;PTR:;CAT:OSPM;SFS:(13230031)(37730700002);DIR:OUT;SFP:1501;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?RmhwMFh1YTJOdGpPYjNaZSt6UndRQndBR3Jlck1sMUJTOFc0N1FJTEkybXZT?=

=?utf-8?B?RmRFZWlBZDk5eHdrU05iL1NKVERjVjBsUlV4eFFvVC8vOGF1aG9pREJYdkgw?=

=?utf-8?B?TnB5MHhPb21LZzJUV3pJUHhjQWI2VnUzZ0JzbmNSUjhicW9hNU5QY2NtU014?=

=?utf-8?B?WU1RQk1GcitGd2JhOVRkZUFmclp2MElmM0NOZVFzZmc0MXlJVjJoMHBXU01m?=

=?utf-8?B?a2l4ZlJza2NxQmMwQVlYSWc5TEhuN3ppN01mYTN1VkowNGx4WEpwamNOSU5u?=

=?utf-8?B?Y2pQNXhjT0EzalB5dGpCQ1JwdDBNS2NoYnVFS1ViUkRiSDhnZW5UZjJ0K2tm?=

=?utf-8?B?TDhiSXRNcllyNUJPZUdMbjZyaCtwZFc5SWJ1OTRYT2xhbzFjZ3UyVTZmbitN?=

=?utf-8?B?enhGWDJsVUtHNmo0VmpSZ0NPek80NkhpcjR6R2hvd2dqOS94WG44NnY0Z0xq?=

=?utf-8?B?V3FGY3FiOXFzM3JOQUdoZUFpZDV5b2lxN2lyTEcvZVRrYXFobkplNS9Cc3hD?=

=?utf-8?B?Y0RjdjFBazl1biswR2FTZElsdVY2NzlJTkg2VmRSS295WWw0ck80U3Q3SXhC?=

=?utf-8?B?emcrZjlUdjJ4WjZ4Q3QxTUM5LzEyUkFYZjk4R2NBQk1vNUxUdUgvKzUxY3k2?=

=?utf-8?B?L3FjVEhYR0tqZWMrVnRsVUljeU5zS3k2RTR5QUZtYWY1ZkpJZkh4anVoOWJV?=

=?utf-8?B?YmNmMjVNR2p2Y1d1VXBqT1dvdmFWZVVQUTZncEZUR1crZENXMGdDMk9xbEFG?=

=?utf-8?B?elltemN3emx6TnIvZnhrRkJmcWllZGtKMU5EZEVBQS9DN0F2V3pmRjgyWlEx?=

=?utf-8?B?enA0YTVjTllLU1lSTis1RFdZbytRd1hjOTBCclhTVUVhZzR2NzFrNk9VMVAz?=

=?utf-8?B?UStxVFhJeHlRYzhqak8xQVYxSm5mNzdUSzhlUlhZVHBpT3dCMDl6WEFOai9o?=

=?utf-8?B?M2NyUGRFYmdYdFVTSURkRndrNytvelVQR2ZONllvSExObkNwbWVRY1hJaC9U?=

=?utf-8?B?UUtHeWxMQzllL3llcE1tRjJVWmNIZmNCTnB3N3VKRGtWUDljRzJ0SGh3aW4y?=

=?utf-8?B?aG85TkdSTkR1MXNjNFBIUS81WGd5VU5MSkFwQ2R3bXdTWXR6RVlRbG5WZCty?=

=?utf-8?B?czNZTkF2RkdHSEo0QWJQMWswTWRUbU9CNVBEYWQrZitUcmcwaWdMMENvQkUz?=

=?utf-8?B?NWJPcG4yazVINUFNZkJ2ZytXcTAzSC8yQTF2cU9XQWxjdVRTTnhtZ3hoVDlm?=

=?utf-8?B?dkVqK0U0L0tQK09oY1JRV0lWTWdCeFlMM0NWdTc1eGpYcGthNzAybW1CeEJ6?=

=?utf-8?B?RGpUMjZZbFpzdUowaDBMZ0RCVnhqS0ZZd2t2U3dLS1ltWjc4TDJIcWpxdVRu?=

=?utf-8?B?aDd0aldvendUYWJqK2w2NGYxblFxQTk5Wng1U25WYXlmKzNEbUpaaFR5NkdZ?=

=?utf-8?B?dTFhWm03YjZlR01wVnlDenVpb25ESkozb1NTY1RCNEU3NVMvWUJjR1B4cmZ3?=

=?utf-8?B?dlNYQjNvZ2o3MzUwUGRlNFFVQ3BiQS9qeUFxbWMxQzVCeFp4WnBMdzFyUmdQ?=

=?utf-8?B?VUhsT1NpMUZwcjlEVTdLQ0ZvbjBKZ1Z2dCs3MXpsKzY4R3o5cWFHUGV5VXg4?=

=?utf-8?B?aGUwOXFoYmdQcTNhZmdSZWFsQ0Q4OU1OL1I2djRIYjFCbUZGM0VhMkFXaGFR?=

=?utf-8?B?SHBtT1VWcTA0Tlc3OEJkdkVqdDFSci9oY1B3UWZrUHNYaUFtL2R0MjZ0N1FH?=

=?utf-8?B?STF0SlIyUzlYL0djTm8vUjBmMGYxVkIwWVhoYlRwam1CUmZSKzJpRnJIVjFH?=

=?utf-8?B?VjZmN0FGNEFaNXBlWER1S2tkSzBPM2xTbE43ZEl0WFA0U3ZJNGEzQi9Mb1B1?=

=?utf-8?B?QVZVZTNUSTRXS3hXSVVNcllyNzBrSk14dTByZnBiWUY2WkRONDA0MWgrNHVS?=

=?utf-8?B?Nm5KNWtYYk9Gb1d4MnBFV2pwV1pmL0xWTUo0RHdUcGxub3pJa3pIRSt2Tzlz?=

=?utf-8?B?K3lLRVZCbHQvQmFQZWM5dkFESm44TG5nbkozMzN2RHBXUkpKamJWem1XMW5s?=

=?utf-8?B?QlZ6dWZoTS9seEVzMlhOZ0JENS9qcDB5dWgrL1B4TmJyU2lCY3dOckk5eDJh?=

=?utf-8?B?VWVqUnRRZHhjcGpGWENYbndnSjMrNHl1aHJDa0padjUrVWluOElVeTVnQmda?=

=?utf-8?B?MFE9PQ==?=

X-OriginatorOrg: ydlpolq.pokl.sbs

X-MS-Exchange-CrossTenant-Network-Message-Id: de438a50-4c8d-4fa9-ad67-08dc38197ad6

X-MS-Exchange-CrossTenant-AuthSource: SA1P220MB1240.NAMP220.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Feb 2024 04:55:26.6402

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: f476fd8b-85fe-48a7-bdab-a8d9c3125079

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: SGWGsSvjBuyCkuNeLF5m/jR10JllSB9+EUxIbvWD6/7nR0/swajRuruXT9hXtD3JEPGjN3Sw7PKcJ+42G+xFVQmesWLA1RFiOiHBhoWauFk=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1P220MB0852

X-Spam_score: 13.1

X-Spam_score_int: 131

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Make an Impact, Get a DEWALT 200 Piece Mechanics Tool Set

Today Make an Impact, Get a DEWALT 200 Piece Mechanics Tool Set Today



Content analysis details: (13.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.100.165.218 listed in list.dnswl.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: abdelali5hju4gt54g.page.link]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.165.218 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

1.0 HK_LOTTO_NAME No description available.

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

2.7 SCC_BODY_URI_ONLY Very short body with something maybe clickable

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} Please verify



--_d58efc02-0739-4689-a14f-193728d7249e_

Content-Type: text/plain; charset="UTF-8";









--_d58efc02-0739-4689-a14f-193728d7249e_

Content-Type: text/html; charset="UTF-8";





Make an Impact, Get a DEWALT 200 Piece Mechanics Tool Set Today


Make an Impact, Get a DEWALT 200 Piece Mechanics Tool Set Today

















--_d58efc02-0739-4689-a14f-193728d7249e_--

e-bike phishing from Ashburn, Virginia, United States

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 28 Feb 2024 07:34:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rfL0O-0000000021O-0ErA

for dave@doctor.nl2k.ab.ca;

Wed, 28 Feb 2024 07:33:56 -0700

Resent-From: The Doctor

Resent-Date: Wed, 28 Feb 2024 07:33:55 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from fujisushingrill.com ([194.213.18.180]:57063)

by doctor.nl2k.ab.ca with esmtp (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rfJYA-000000001PV-2ptU

for support@nk.ca;

Wed, 28 Feb 2024 06:00:46 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mail; d=jyy0591.com;

h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding;

bh=VvvdZWTQwkOLCQW/wW3HqTIpznE=;

b=O1GdrqK+T7OTGPsGsKR0y79TjDc4F3fum5pHWR/0uZgSOro7NJiiIeb+lfNkW+SuNVT17o3ZcR6f

hjXQOsS2JpyXg0EOGwAogCDhmtcf85V++cY6FltaMfW7pijemEuG/U4c3FwXI6IktPAbK1h4HF+i

3dc1wmlma/nrZMwPBo8=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=mail; d=jyy0591.com;

b=YWdWkyu1Bnp9yXWFnycURLBoi4c9kwdV+AiEgtx8mnCNFlAJpTWDeH6MQAmmlzMq3usIwwlXc3Q4

m+ApSOzTn6bn3YYbDCFNtuqKPp1/FGU8PqWmWKYSTG9DjOQdtLNxZaghfnxBjdLbeMneohuSJOxx

nlbUsIxILextwYHby30=;

To: support@nk.ca

Subject: new ebikes arrived in our warehouse

Message-ID: <9cd6e34484c7e598a91998d952dada96@jyy0591.com>

Date: Wed, 28 Feb 2024 13:44:22 +0100

From: "Jason Garrison"

Reply-To: jasonebike@jyy0591.com

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 8bit

X-Spam_score: 9.0

X-Spam_score_int: 90

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Our factory specializes in manufacturing electric bicycles.

We are excited to introduce our 20-inch 500W ebike, designed to make your

road trips easier and safer. This ebike features a base of a 500W motor folding

design, equipped with a hydraulic shock absorb [...]



Content analysis details: (9.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: jyy0591.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 SPF_HELO_NEUTRAL SPF: HELO does not match SPF record (neutral)

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[194.213.18.180 listed in wl.mailspike.net]

1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)

[194.213.18.180 listed in ix.dnsbl.manitu.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.6 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image area

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} new ebikes arrived in our warehouse











Hi,

Our factory specializes in manufacturing electric

bicycles.

We are excited to introduce our 20-inch 500W ebike,

designed to make your road trips easier and safer.
This ebike

features a base of a 500W motor folding design, equipped with a hydraulic

shock absorber front fork and oil disc brakes to ensure your daily riding

safety.
Its 20×4.0-inch fat tires are perfect for various

riding terrains, coupled with an upgraded SHIMANO 7-speed system allowing

speeds of up to 28 MPH.

Our electric mountain bike promises a

comfortable riding experience for you.
It boasts a 500W High-Speed

Brushless Gear Motor, removable 48V 10Ah lithium battery, and front and

rear oil disc brakes. Charging takes just 4-6 hours,
with a top

speed of 28MPH. The bike also offers 3 Working Modes to suit your

preferences.



src="https://www.ouhepower.com/wp-content/uploads/2021/11/leopard-fat-tyre-ebike-1.jpg"

width="1020" height="767" />



Should you require a

sample of this E-bike, we can ship from our warehouse in Germany to all

Europe countries. 
Prices vary based on the shipping address, so

please confirm accordingly.

For those interested in purchasing

container loads of our ebikes, we can provide FOB prices.
Kindly

inform us of your destination port. A 20ft container loads 95 pcs, a 40ft

container loads 200 pcs, and a 40ft HQ loads 250 pcs.


Our

electric bike is equipped with a powerful 48V 500W brushless gear motor,

capable of assisting you to travel at 28 MPH,
making it ideal for

conquering any road on your trip.
Featuring a foldable fat tire

design and a 10Ah battery, this ebike can travel up to 30 miles on a full

charge in pure electric mode.
The battery is conveniently removable

for recharging at home or the office.

With high-quality oil

brakes and a Shimano 7-speed system, you can easily adjust speeds for any

road type. Additionally,
our ebike includes smart cruise control,

maintaining a constant speed in electric mode for 8 seconds.
Equipped

with a high-quality LCD display, our mountain ebike provides accurate

power, speed, and travel distance readings.
Safety features include

a bright headlight and rear brake light for night riding.

Our

city commuter electric bike features a stylish 6061 aluminum alloy frame

with adjustable handlebars and seat height for a customized riding

experience.
Its foldable design makes it convenient to transport in

your car, while the 20×4.0-inch fat tire is suitable for various

environments.
Our mountain folding electric bicycle comes 95 percent

pre-assembled for easy assembly.
It also includes a one-year

warranty on the electric motor and battery.

Thanks,


Jason Garrison
The Electric Bike Manufacture



/>











/>











/>











/>











/>











/>











/>











/>











/>











/>











/>











/>











/>











/>











/>











/>











/>











/>











/>











/>











/>











/>






welcome