Muama Ryoko Phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 02 Mar 2024 12:20:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgUt1-000000007Gl-0dL4

for dave@doctor.nl2k.ab.ca;

Sat, 02 Mar 2024 12:19:07 -0700

Resent-From: The Doctor

Resent-Date: Sat, 2 Mar 2024 12:19:07 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm6nam11hn2203.outbound.protection.outlook.com ([52.100.172.203]:48710 helo=NAM11-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgTf1-00000000OSd-2dw9

for sales@nk.ca;

Sat, 02 Mar 2024 11:00:39 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=TiWAcVXEOL4A5GKwxfJiwbq0vfVy0R9Tk2nvYsuwavfLs6ZY/XIGy7PJ079oNSrwS1OyTy4dMyLF4oSpHSet4CuLuwdpC1D65j6n55mtf93Ixpk0sQa3UqICXi0cm2Whr5nhHYWVgyB/rGSxutsuXB3ctNJm/Aokc1QwHp5vHk0q+NZuKCHLcUegfCmdM0kyanfp4sD4zsLYFBCs6Ma+zqDmYVt/jpaVLIF+VO9nN+LMgn+OzhZAkGZUxAJDpI47z044Kf+UJIO6i8QlmwsZtWVQBcN2x+/46elcT6dllRwgyVGTtTaj5+Kj5mNrlMKJBpWbvAYg7+EdB8JztVUzBg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=cO/weyi62fH6XkfxXavzMhmEom6IyudE4pKtVXk4H4E=;

b=XFpRPb18mP4WWrE/IqaIIBSc7WodFdI/rIiK6WVJaoqFL1Hj/XX5UyyACLQAVTnlwojimxXZ9ydsapvLmbRT2yKyYqd80ItQZE6NhV6DqdpKky+foe9H4XySwvDsdLfrrlrtGdxTbufQbDEQ7Ky2hsDfE17XIPClODH6Y/nFye2Sc548XR5rIegvYBUc1Iv0IyDMdx2M7akQUEbxv7bA5klTeXKnG96SZTdfZEXm/XqtFrTjhoJ5qm8FA9VtI/su1107I9fnxMQea5j/W4rsmsKX+crsuUWat3MPuF0ZNzBlWcRO7zpI50Wk2H/K9qXU6jVRBoVgIlbBWErIjXEnSg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=nygmpmnklu.mnbv.homes; dmarc=pass action=none

header.from=nygmpmnklu.mnbv.homes; dkim=pass header.d=nygmpmnklu.mnbv.homes;

arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=st0swuspuprlcr6.onmicrosoft.com;

s=selector1-st0swuspuprlcr6-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=cO/weyi62fH6XkfxXavzMhmEom6IyudE4pKtVXk4H4E=;

b=OJDQB8rvF0d46L3S6EOcJNOZ1vO11mG5nMbFFUReKFBiro6rD/FI5DgvHwpEdZleyRyH66CjTV0hsC97kiDTON9pLyq81Vqh08R8dXvpymygudwoC1xgA2mIAq4ryugz+4USzz1m4Wpp/72PCLvB6B6azrS1AWf1C/tvZ3+OAFt49+E2+BkuWz2KPX08FMJqwHQVvbT/u/U0MO8VTCSaN6FTBttBq/8rLRCa8nWqsdrpdhu6f0InVfjzkN/rebbY7crglUA3kvjsi6v7nDpr6dLEpo+hcA5M625lnlDriApS1f2MHYS+CwYNBJShqTxwfvxDGI8UbtIuU0UjR4tmmg==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=nygmpmnklu.mnbv.homes;

Subject: Everyone is going crazy over this high-speed portable Wi-Fi router!

X-TOI-MSGID: <865115882573922.EV604D759482C.0830616648565W3Z7DK73@nygmpmnklu.mnbv.homes>

From: =?UTF-8?B?TXVhbWEgUnlva28=?=

In-Reply-To: <5k5tknryvrzsy8wggmkp451vh5uanss81sicpqgpb@nygmpmnklu.mnbv.homes>

To: sales@nk.ca

Content-Transfer-Encoding: 8bit

Content-Type: text/html; charset="UTF-8"

CC: sales@nk.ca

Date: 03-02-2024

X-ClientProxiedBy: BL1PR13CA0104.namprd13.prod.outlook.com

(2603:10b6:208:2b9::19) To DM8PR17MB4934.namprd17.prod.outlook.com

(2603:10b6:8:3b::24)

Message-ID:



MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: DM8PR17MB4934:EE_|SA1PR17MB6503:EE_

X-MS-Office365-Filtering-Correlation-Id: bdb446e4-18d7-4687-60f3-08dc3ae25e3e

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?V3JSeHRVekc4RFVlb3p4bWhLcGtCUnpOSTJud3U1VEdSN000N2lmT1o2ak9h?=

=?utf-8?B?V2ZLMUQrejEzKy9mcDBHM0JqdS9qYVJORldSRHhtNWxnVWRxd0R0UVFiQTFi?=

=?utf-8?B?WlZhZ3JpSjExMzViVEFxSVZieDd0bUQ4K1ZWY3RjNVEzeGpHRld1WEN2RER0?=

=?utf-8?B?SGpmTEFieFR2WEJJanF3M1RRZ2FZUk1oYTJ2TEp3VU1xcjU0Qk9OMkdtRVpF?=

=?utf-8?B?MlZMa1ZWUTVTTkdVdTVBTjFGMXpSOUxlMkhKK2lNNWZQZEZXcGFmODdaaER1?=

=?utf-8?B?M0J6cXI3N2dGOGZyY2RsWGhQM0NBUnovekxwcjVLc1VWclNnSVZlSEd0cHdK?=

=?utf-8?B?REcyV1VPd0FRQm1vb2NqQUFHL0RtN0lsN01lVVdpYTQ3dW43bmQvbWVnS25j?=

=?utf-8?B?VDh1eksxbklEY2pRUUhzYXN5RWNrK3FXRVJvVjlOLytyZmRrWTgyQWs5bTdI?=

=?utf-8?B?TE1zZUI2YjBaemV3SUNQaXhtZWgrMHJ6K2FRUUdzWFZZUyt3cUdOeGlxMk9B?=

=?utf-8?B?cXFMN1MxaFBpR0FjZmhISWM5RVBYMEpIMysrQ20yNjQ2ZzkrMkV1b1N6VWkz?=

=?utf-8?B?dnZ3N0tQeTU1KzJFL2tHNzJxUmVpR25oaXUxd3ZKVGZGVkFFQUREaE1vQTFv?=

=?utf-8?B?L29JTDRtZmczZWcwRVRLY1VhRFl4RjN5ekFJS3pIbkVHWVV4ZVUvVkdBOW9S?=

=?utf-8?B?TVZsS3ZPOGovMDU2eDdBbEY0V2xFTzl0Z1BzM29DSjNmbDNCdU5nUVJrRE1S?=

=?utf-8?B?L0pRUkJ6VVFzajk4K3E4VWI1S084OXRRV3FGTHpPUHhyaUJES1oyaHZCY2lJ?=

=?utf-8?B?WTQ1dldxSWNVNnNzaHRkYzVobFdFRXZZcmQzemcvVlQ4V3FsOGh1R0pBV3Z0?=

=?utf-8?B?ODAxV3lKclRXaDVtdnBGTHg5bCtTY21ZbTlwYkxuenlKaEdFK3hhY2tIazVn?=

=?utf-8?B?QjJOTGlJV0xzVjhndmcvaEwremNDMWtsOGRROW1qci85UmhiczBDcG5yN0ZF?=

=?utf-8?B?Y1dqK2psUmhIT2xSSGdSb2lkSWt6MmpXWG40dTlQTkliUzBwLzc5cGk3MFFj?=

=?utf-8?B?MDdUNEJ0KzhQUlo0VGFTTTZJTFFrZFMzeWJQc2NPMWdhWTNKS0tPakpYSVc3?=

=?utf-8?B?b1RuRkx6R0xlWFBiZDA0LzBXMHVBSWNSRXhGQUpXSnFMMlJFZklteVNsMjNy?=

=?utf-8?B?QnNRbWJmZkNXNkJiYWxNbWNPVFluWjJpdlFNd1VsQm9RaEhRZWI2dXRQSzdJ?=

=?utf-8?B?VmR0ZTNuZG5DVnRwc0lxMWdHZUZUdEFrVmV5T1oyUk9BbHBEYmtvNnRYajZS?=

=?utf-8?B?RXREOWoyaHozeGJWSW5GdGlVZzg2d0Fld3k5OGdaekc5cGpqZmtkT1k4YTE4?=

=?utf-8?B?REFDM1dkbzlhdUNYVGJ6WDJrMXRQa0x2Y0UzNGROZW5aMC9LUkhRcTVvMGUw?=

=?utf-8?B?SXNjcWVuc2ZtVFRHYTZtblpkOE1aVmdZV2N5TDhzK0t0dFVQT2UrdkRkbCtL?=

=?utf-8?B?RGlpbVY5ZGlhMFU0YS8rQlFPM0FmZDE2WkRPVWI5TlliUnBxNTBIVUE5R01X?=

=?utf-8?B?cTI2dmRkSTFtSU1GUUg2QmwyNE05dzNYY1MxdklXOEZRdXhrcmFzdHB5b09V?=

=?utf-8?B?QVpxTmJncDFlTFRjRmFWNm56aVhPZGc9PQ==?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:DM8PR17MB4934.namprd17.prod.outlook.com;PTR:;CAT:OSPM;SFS:(13230031)(376005)(41320700004)(37730700002);DIR:OUT;SFP:1501;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?N0t1dmoyVXdrQUt3RmcvblBWanFHeVVGTldYWWYzc0daankvQnBVMXVoQ2V3?=

=?utf-8?B?YmtnWFFucDJIdHVHR0N1ZGNaTUR3ckxoYXgwY0xETXMvZjJIUWZ6L2hNQW01?=

=?utf-8?B?L0tLUDBjZWlnaFNTV3lkYzh2WFVjY1o4VSthMnlUVnYrOWI5N292VzRyZGxO?=

=?utf-8?B?MC80SWRmNlpZbnVqOC9sUDNTYk5IZkFhV3NOZUlMY0pFU3Z4TC9ETWI1UlNn?=

=?utf-8?B?V2N4czJSdjV3R1hIV1Q1bkVUOXpwSCtyT1pqRlNTNWRBc1pRZ2RNcDNnL0Y0?=

=?utf-8?B?TVZWWW5zZ2t4Vk5RL2pEWVJweUJGWjFxSWRJWDF4cU1NZHVZRDY1SHg0ckFi?=

=?utf-8?B?YWtNKy8vOXFkMjBkcDUzRzNaS0JpM1dTbC95djI4Z2NvbzU1N1Q0WGprampl?=

=?utf-8?B?NnBYbWwrVnBjMk9udlNVYlpEd2o0aWRjRGovMEoxZEJVNEpIT2hmUGNyQVlp?=

=?utf-8?B?elZuLzJ1b0NuYzBjQXZTU0c1SmhjbzkrdExRUllwRm9Oclg2bmdvenc2ZE5k?=

=?utf-8?B?akUxdXlNTE8zbzhHVlBjSnBMczNEV2J4Zi9rbWxtVHlwOGloRHFmUHFhZ1ky?=

=?utf-8?B?QjE1cEM1WlVoSFNhVVgvUWRhMjRQbDF2ZUh3SE96YVhPdXlMQVNRcXB6S2t3?=

=?utf-8?B?bWNkeTluU1FrMzVmRTZIVUtDamVPbUw0ZCtnWUJCRlRoMEI2NXdoNFFhWita?=

=?utf-8?B?bXJnYTRQVjFDWHRHSWN0N01EbmVRa2tFd2dIVXdmV2hBUVdOdnpOZUhBeGt6?=

=?utf-8?B?c0tLVmJ0RXV2bTFoUVYvdFNvMUgrVEJjOHNMc3JURkU2bll3TGpuVHBiZUI2?=

=?utf-8?B?Qm9Oc0k2Z3VIazFRd0ttRGMwV05abDhzOURTL3FQQWV1N2prdmU1WHAxRVcr?=

=?utf-8?B?cXBCcjk5dVdlc1VkUEpCSjZza05ZWkNJZjMydHIzbWZVNW9zT05GQWxRQ3lr?=

=?utf-8?B?c0F5SGFuVStGRm1QZk0xalJSNHB2TXJVYm5EZ0ptcmx2bzFUM2pQT0tuOVFO?=

=?utf-8?B?RjJxZVN2QWNwa2hNdnQrVVI1QzFmQ1dFdmNUMHh4ZGkwa2c5RzlaSHF0UlM4?=

=?utf-8?B?MUlPdDJIWm0yVS9lRHY3NXpMcXhtRkpmSkpJR1cvM0dLOWRhSnQxY1dQcXV6?=

=?utf-8?B?b3hTSVVaUDNZSFB6a3FtSzNHdVpIRmRCcnd2QjEzQkxma2dXWUswcklteGZW?=

=?utf-8?B?WWFuVEFWRTQrYTgxWCs3NFJXT3JEL1FSZ283QkdVdEQzNUlHeEszMXNRSGRj?=

=?utf-8?B?L01QNGJhYmNwamhuY2tJSHJ2YmhqRTdHZ2N2ODdBT3FUTTEzVTJLdkh5dHFq?=

=?utf-8?B?bHpPTjJaY21icEtiUVQ0UUVzYWw4VWRscjJqcmlaKzkwanR5NThCa3U0d3RJ?=

=?utf-8?B?dWEvSEtJRTFCZlQ1VXZIZDBnSlg0STg4QTRWMzNMTG9QL1JYU0xDVUlRcWMz?=

=?utf-8?B?dEdld2gwUU1hNTU4TDNuVzZVSVpxZ2Z3cDhaWUUxcTVkcS96Lzd1eWJzRDZa?=

=?utf-8?B?RTVJZzExeVdZSFlpUXVJQ0FzNXJ1UktTbWJua21JVW05TnBLaGs0NUZGcWpY?=

=?utf-8?B?ak9BSDFWeGk2RGJMQmV0RTVaSDJERVJzem9nNmN5ZUpmbUlhWXhoRVVsZlFI?=

=?utf-8?B?YnltN2IyREtEeGlIV1dxZXoydDFUWXpYdU8rcGhiODBQVWRrZ2hZdFhyV21k?=

=?utf-8?B?L0N6UmN0R3ptQ2JJN1dlME95U1p0MlZNeldWWnR6bmZVZE52cWN2dzJlc0p1?=

=?utf-8?B?UnVLblEwZVpESG8vU1EwQkRRZGJibkFQbFowc00zeHhTVWlPV1YyN2NUUDRZ?=

=?utf-8?B?N002MlFIdFV0TWVsTjlNdzVZK0JZZmw2SXJNNC9vOEJQL3VPK1pFZ2I3LzQ3?=

=?utf-8?B?NXJhY0xKRXF0Y0U1cTBaSlpNanJPenpyeFNlN1pkZThNVXdDNXo0WkJWOEZU?=

=?utf-8?B?L1NuaWpZbWtrc2lJdjA2MlFQWlFFWllxbHR4NlJOZmJtTFNYL1dmTjRNd3pI?=

=?utf-8?B?ajR4Q0ZoTzdnSHg2K3dGa09NLzVWT0lwdk5aam9HV3pVWmtCWC93cnUxNlFq?=

=?utf-8?B?RjIrdFErTHVCb2hRVHl0TDZ4VndBTFBucStqZCsrN2QrNE93ZWowUDhLWmp0?=

=?utf-8?B?cXhaYW1KWHhKZ1E2dkphRzhqdS9qN3ovT3diRURyenVsZmhDSGdmdmtQL1J1?=

=?utf-8?B?alE9PQ==?=

X-OriginatorOrg: nygmpmnklu.mnbv.homes

X-MS-Exchange-CrossTenant-Network-Message-Id: bdb446e4-18d7-4687-60f3-08dc3ae25e3e

X-MS-Exchange-CrossTenant-AuthSource: DM8PR17MB4934.namprd17.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Mar 2024 17:58:29.8627

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 42eac952-c4d1-4f7e-8089-ceff8667854b

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: dGj687+mNahDs5tkJnopZL4S3dsvbf1mys1+jhTxUjsmrxj0o+702q5QaV3QNnfn3ciSznOQaopVLsCAufQhjW/CzCHPqEKVoh+3fUTBFsY=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR17MB6503

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: (1) Notifications New Gadget Provides Wireless Internet Connection

Anywhere, Anytime! Have a Free & Insanely Fast WI-FI Connection...Even in

the Mountains



Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.100.172.203 listed in list.dnswl.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: etw9eg6wegt4wet9g4s.page.link]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.172.203 listed in wl.mailspike.net]

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_VALID Message has a valid ARC signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_SIGNED Message has a ARC signature

0.4 INVALID_DATE Invalid Date: header (not RFC 2822)

0.5 FROM_DOMAIN_NOVOWEL From: domain has series of non-vowel letters

0.6 INVALID_DATE_TZ_ABSURD Invalid Date: header (timezone does not exist)

1.4 BUG6152_INVALID_DATE_TZ_ABSURD No description available.

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 FORGED_SPF_HELO No description available.

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Everyone is going crazy over this high-speed portable Wi-Fi router!





(1) Notifications





















































New Gadget Provides Wireless Internet Connection Anywhere, Anytime!







Have a Free & Insanely Fast WI-FI Connection...Even in the Mountains






















Apple Keto Phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 02 Mar 2024 08:55:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgRgs-000000005az-0wna

for dave@doctor.nl2k.ab.ca;

Sat, 02 Mar 2024 08:54:22 -0700

Resent-From: The Doctor

Resent-Date: Sat, 2 Mar 2024 08:54:22 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-bn8nam12hn2244.outbound.protection.outlook.com ([52.100.165.244]:42145 helo=NAM12-BN8-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from <070FJA433@rtiyianacd.pnsx.sbs>)

id 1rgQ5C-000000002Pt-18XH

for sales@nk.ca;

Sat, 02 Mar 2024 07:11:26 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=VSeu7Tig8AY9E8aoxdPMR0JhivZ9yHGf5KtPHcpckXQzQZ1R5Dna5uZFyhsfI5aopISf4j9j3Ib+4DagOpWrqH4WOfy4CXdfiCu/jjUDHi1AsOML0tnidk3Dst8mKz2uSx06+dSWTrnFf023YZ4z9txvudG6jbXlZvMMahohXf8BjcC+IZZywnVCl7SWPZWfisWy7SqnrHcD+7ivrkouaMHNqvuldL9Be1GsWqbD5zTgdfEyYhlQ6NFBV0NpYNSuyiodHTzs8yQBXrSuQam5qeEW6Kiq88l4wqwvDdgXRFQ2Q1xuDjOnBHUJsvQB61lrYAZgBqy6RD6oAFJ2nTAooQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=h5cIlOeMP94TAe3qRkHZ8l08f/hcu2gn/5LQNHmJ3SM=;

b=L6RhkyoYL9hfgF5hq4fVcRG5IlZqEDxgNNY3wKdgHKVhNCsaPzBPXgmaXcgitTKRllcEil04AAO3kUNE8JbFgW7xNjG6DkomeC1UzY1dB3QB68BlQBbqziPMHw1HCWK+Zhcb0zz2wXENdbyBSnu07Wde5yGbHKatM4qU0dYpLf4BIPHQBcH/i6G+1+EU4/fIvXxfvSGgL5ZmCnvd7czxHdc7RCfXPllvcpncF2QHM5ySjYung+MVet+BspgmkUidpG3JLBxfRZJ9zRccOYx3DYMjuNJ2heFleY687elJxlDWTYczCa89FQvCqR1aEC7/dpCZRMeUZ2w/BrRhgQoGSg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=rtiyianacd.pnsx.sbs; dmarc=pass action=none

header.from=rtiyianacd.pnsx.sbs; dkim=pass header.d=rtiyianacd.pnsx.sbs;

arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=shv08yuep28ugfhx1au5.onmicrosoft.com;

s=selector1-shv08yuep28ugfhx1au5-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=h5cIlOeMP94TAe3qRkHZ8l08f/hcu2gn/5LQNHmJ3SM=;

b=gPucsj0qHuJymmPAg0tu9ayC0vMp1GWPSpf7oaWGtPB8RVi5irEBr/PlOCZ8Lrc8/kYnv7D9xQ66Jq2O3d2xbAw3Ru6DSnSVgziVFMTAbHiKmrz/mZZOAAhtjWqHwe6AfhOF4ZV7n9u5UDJvkHFzxHYhiZZzOodIDgBRUkKgoUIAfaUzYmBX7248qN+kbmJ6oNqpW/4ZUXAOa0D8Ma4gtNmelrIPDJp6nKIOCzsrtAc1ZpLaw7Gxc2aAxsdDPGE43DcmeMKtD/lGxSUYD4ZtG0zsFsYJYrPVYBB9px3B6fwqLpFc0exz449zeSE+QIltiopvoEf7HhnlpmreRvHaXw==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=rtiyianacd.pnsx.sbs;

From: "=?UTF-8?B?PT9VVEYtOD9RP0FwcGxlIEtldG8gV2VpZ2h0IExvc3M/PQ==?=" <070FJA433@rtiyianacd.pnsx.sbs>

Subject: =?UTF-8?Q?Order Confirmation - Apple Keto?=

To: sales@nk.ca

Cc: sales@outlook.com

Content-Type: multipart/alternative;

boundary="_c89e2870-495e-4297-a008-38f69efa0a5e_"

Date: Sat, 02 Mar 2024 14:04:13 +0000

X-ClientProxiedBy: YT4PR01CA0051.CANPRD01.PROD.OUTLOOK.COM

(2603:10b6:b01:111::19) To MN2PR19MB3853.namprd19.prod.outlook.com

(2603:10b6:208:1e3::7)

Message-ID:



X-Message-Flag: Flag for follow up

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: MN2PR19MB3853:EE_|DS0PR19MB7537:EE_

X-MS-Office365-Filtering-Correlation-Id: 04c45101-0053-459d-ed04-08dc3ac257f9

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?Wi9Lbm54VVRTYy9temM0S1NzRmpLTFJMczlWR0kzamlBdnl5Q3pCN1ZtbFln?=

=?utf-8?B?K3BRa2MzZUVGMytEcnJ1N2k2TUk1MUpXbkhvOGdPWHJrWnVVZ3F3eVE2WENs?=

=?utf-8?B?QkU1TUo0d05pUU1Xd3VkQmFZaXFsK1RFNlRKSU5DRlFUZU1sUVNhSWFLK09v?=

=?utf-8?B?OFJ1OEc1OWtNdXdMdEQvcWxFSkZPcktsOVMvdkJOdGhMS09lWGhuOUhReEtN?=

=?utf-8?B?YWhDSEMxcy9kSG02UU12UGYyVlZHYXNhc204WFJMdFFuS3BFZ3ZmeHc3bjFP?=

=?utf-8?B?aWtKa2FQVXdhL0hSZnNWcUMxQTN2MTdyZW8wY0NYdU1KZlZIb1M2a2JWdC80?=

=?utf-8?B?eTNZVzI1VHh3KzVyNi9CdlhCT085OXJtVFlpdFVPa2dFQzN6OUl2dTUvTnlK?=

=?utf-8?B?UTYrZDZNQW1FaHk5Z1BXYTZMSFYxbTZGRHBoSDVub0lWSDRYZGhabWZGd0hB?=

=?utf-8?B?cEl4cEJ2L2loemFCVjJQc3FHVytwOXh3T01mSnV0VVVYcDJOY21UUm0xS1Fr?=

=?utf-8?B?eitjYjVaUk1tYTRFUmJCbG9zQzhOcTk2L29wNWV3ajg1Y2FWMVVNdXVFcUNa?=

=?utf-8?B?ZWpid2Y2ajUrWUU2K29XUWM5aVk3OWlEZVh1endTOXF5UnVBU0Y2ekdyemFG?=

=?utf-8?B?cEphZHdnYTBtRDg0K1gvbHVaMTlDZ3ZsR1BrWjkvUW9LU1MvZ1dLaTVHd3ph?=

=?utf-8?B?OTBCTm5wU1lsWCtKZEIxWXg3azc4WFhZOW5kSm0zWWM3TUVDM1RGcVNpUEwy?=

=?utf-8?B?OXBQWmN4d3JtUXhnQUFEOHJkNWVFNnY4ZEcyMnRTbU9IVVZwNXVtbEhMK0sy?=

=?utf-8?B?YnVRbzZOekJiZUlCczhZMXV3bm1YN1JhSkd4bnMraGhxRmtzWGE0SmN5MVJ3?=

=?utf-8?B?STZhbDVlQ3VQRVlmMnhvYmI1d3RVYmhVMmJJYWJhL1laejRvSlc1WTNsTlRI?=

=?utf-8?B?Lzcva0NOUXRybmlnYXdTUHFIS0tuYkRvdlVkaWpoakd0bUJNTXQxWkN5azgv?=

=?utf-8?B?OHFsMit2bGJTMXhQRndnM2pkTnYvdkVwWTd6S1Q4YTBpTGc0QlB4OE1TRExZ?=

=?utf-8?B?eEFTT1BwOUlkQ2NGTi9XYktBenFsc2VXNUhNd2F1TzFYQmhtRmRoeUlIM2lV?=

=?utf-8?B?M2hyVUtZYmhJdFhoUGNlS3Q3c3JTdlBEbFk5c29sZkVWOVhrYVp5M3JoTWha?=

=?utf-8?B?dHY2UWt1dWk4SGtQL0RCeUFUN3ErSVRUTnJlcXM2dkd6ZjdUdU1mSjdMUHZh?=

=?utf-8?B?aW5XcmNaa1J0SmRxM1d1VWxnZVpsMytZNHhsWnB3aEJPOTR2VlVCK0phNE1u?=

=?utf-8?B?RjJtdXh3TzdaZDNZelRhMEJLMmdQakF3YVJONmpuREFPQjQ2dml6eW16SWNw?=

=?utf-8?B?aVJLQ2ZnbDZwWlNwWDQyUnVVNk5XS0VJYzJhbGtkOWZuNzhTZURCYUlEcG8y?=

=?utf-8?B?Y1d1Vzl1aEN0SzBpQWIzWUhpOXVHbVM2cWdIQW9sOTFXYTY3WVBNNEhBRzRj?=

=?utf-8?B?OGZmMXhyaXQ5TXFNN2tLcXNZMWZGcDF2NnpQSTBHVGt1bUYyQ3dpc2ExNXd2?=

=?utf-8?B?T1p4WDNZZmlVVmJPRlFiZ3ZsQ1V4bEJrWlV6Ty84S0hvSkFOQTZZUjFvSnQy?=

=?utf-8?B?NWVaVHlRSGNrVmM3ZzdsTlh5MGx2Z2c9PQ==?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:MN2PR19MB3853.namprd19.prod.outlook.com;PTR:;CAT:OSPM;SFS:(13230031)(376005)(41320700004)(22042699003)(37730700002);DIR:OUT;SFP:1501;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?ZVpMdW84c28zRUhLMzdpNXdVWDVoT3pWdUJuMHhodTkwdFFiUHdmMEJ2T0lZ?=

=?utf-8?B?Yy83R3Q1c0lEbnMwamREMTZEdzJzbFBHa3dxUkZpMWt4NjRjVGdSVzRiZUph?=

=?utf-8?B?Y2hGMjl6VUJBdGdQcmdWYlRlQWM3NlVCN0xGbUsyQ0JBTFBGd2VieUZTRWFL?=

=?utf-8?B?YkVWNm9qd0tIeFdvSVFKMjhXMm5vQmwvYnIrNmtBa2V1b2l5bHlmWnB0UVdt?=

=?utf-8?B?Y3dUcEtGdlBTUlpQTWdGZlJ4WCtyZy9vbnZlT3QrNnNjd1V1NWNKRmlIT2tQ?=

=?utf-8?B?dWdKOXJET1QwTGlsM2MwdWVXOWRsM2txVWdiZnBibGN0TFdabE1PZTRrZnUy?=

=?utf-8?B?dXJtSDFIN2Rzbjh6aVA0YVp6UVNrVXlyL2ZIMjQvRDQwaEVkSHFJdU9PUFlF?=

=?utf-8?B?WndBMkNuNWNhcisxQUVEbmJadFFFbVB0L3liYUxXdHh3V2lkQ3lFV0ozT2Rv?=

=?utf-8?B?dVVyM2xSakFNbDN2VjVyemlSN0xGSlNuQW9CRmFpRjlXQlJ1STk2WUxTeHlD?=

=?utf-8?B?YVQ2WnJTM2RBSnh4MHpyMUliUUpGWkRxR3NTTzZ3d2hEeU1QN29sRG93RDVu?=

=?utf-8?B?WXRROFBQSEVsaGFDVnh4MktOVzd3d1NpMzJzWm53NDVwdk5CKytxQXFQVHB0?=

=?utf-8?B?d2JYd1l4WHpyTUs4dW1Ca3I1aWVUUXYwUlJKRVNsTXE5WWpnVkhrL1BqZE9Z?=

=?utf-8?B?ZkZFRTRoS0xpa3JrUkJXa3E0Q0JDem5VZlBUdm1aUnZHM3h2eGg1UDZqc085?=

=?utf-8?B?YUtodC9MSHZkc3dES0ZnaWJTbUhJQ3lxK1o3ZVhPUFF3NkZQczk4dUNtQldU?=

=?utf-8?B?VUYycXUvaGNLN1l1ejNaeFZReU1ZWldKcXRsbldQYWRuMEo2ZlZETjZGYkQx?=

=?utf-8?B?L1BXaDd3Q1pPTE5ienZkY2duZEdwMUp1NldzQUlNZy9SV0NhZkRxdWZDakww?=

=?utf-8?B?MC9zd0ZUVVNaelN0TEh4Zm1EUktpWnVUcWUyOFpORDFGdHRJUWtQYXVIMjNh?=

=?utf-8?B?dGtDd1UrTU9xekRrVkhnbmNlTHd1K2hEWTY4RExONjY4N2doZ1hRZWJ1ZFZU?=

=?utf-8?B?ZHBHTkxsZ0xsVkRRK0RTOFVuY3lCZ1pqaG1EVzd1aVJrUkdlZjYxRmtFWDYx?=

=?utf-8?B?Zm9VZnd1akVGK09RN01lUDhJMHRvdjh1VWlVLzVoUWFQaTFEYVhQSU1zQ09j?=

=?utf-8?B?SWNyVlRXRUQ0eUdYRUNFNVVTeUxyMjRUeXVaekk2Y2pQRE0vMmY5Zk1teVBG?=

=?utf-8?B?b21pcmF4S1lvdUdMZXh3ZzkyS21xUEpnNTBHREhMQ2ZIN0plVzFJY1FMKzh0?=

=?utf-8?B?MVoweURtY3BrRUZIaFlPem9wNC9oa2pCRVl1RHBNNy9EMHIzdytPUWFmdEN3?=

=?utf-8?B?dWkxWlNTcU1kMjd6RlBENEt1T2wyc1l1MTltbXQrQ3FWVkVFbWlLaGVnYURH?=

=?utf-8?B?SmpHVTFwRjAwZnhiUHVuem1EcTdQeno5Q1IwaHFLeXFwRk82cDlHSmVnaVVM?=

=?utf-8?B?c2VwM0p4aGVvL3NiM25XR1BkWFYxbVZrM3A1eHRBc2w4N0JwTGdVZGFWZVdD?=

=?utf-8?B?SFp2THQrNW9Ud0h1elFJWVRYUE1URW5TZ2dNc2NzTVpYNmtGY0Z1bjc2aUNx?=

=?utf-8?B?ZzM3RERvN0FNV3hDNkVlY1pVd25oY1ZnN01wZVI0Q2F4T3B0TGtaQW9vcEk4?=

=?utf-8?B?clh6azdWMVZIMXcrNllLN0hpZVc4dTlLY1hWYk5pb0dDUzFGSEJ3M1VkN0Nz?=

=?utf-8?B?dStKR0l6SjRaV280eXRtMHhlbnYwZHZQeTF4cHVaYzQyb0htN2c1b28zZVZv?=

=?utf-8?B?YnZLTlFrRFhUV0lRTG5RYlhLcXAvMU9BT3BxR1lqV1gzS0tWdi9sb2Z3WC9l?=

=?utf-8?B?SXJTaWVnd3RqZXM5RVdGOXFyT1hGVzhUL3pKeDV6VllyY0lydmNJNmlRUExj?=

=?utf-8?B?QjFtYVBFRFljcGNWVE1Nc2VpTjZCK2NNMVArNVM0NU1CUU5NbExSWGFyN25O?=

=?utf-8?B?NytsZVFXRmlQejZjaEZlNnNNRHJweXVTYnpDbkZaM0xZaTQvN01rL1NYL1Bt?=

=?utf-8?B?ZnBKZDBuVUJjQlpjdGxxQlNjbTk0eG02TmNMTldpUW9mTTZvQ2lvUVdDWWwy?=

=?utf-8?B?WVoxVVoyRnpibzJhMThnWlZhT3VVUWxZTEljbEFpQnR5THVYMTZWWEpHWWQ2?=

=?utf-8?B?Q2c9PQ==?=

X-OriginatorOrg: rtiyianacd.pnsx.sbs

X-MS-Exchange-CrossTenant-Network-Message-Id: 04c45101-0053-459d-ed04-08dc3ac257f9

X-MS-Exchange-CrossTenant-AuthSource: MN2PR19MB3853.namprd19.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Mar 2024 14:09:15.4430

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 58ca2ded-1478-4fe1-b52f-57c8dfe3a955

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: E4C1MBcLeifkw9sLUtkbydHj4eqivQIj9I5Wcy2WyO2iGcHVuN4WF7q5HyO2gfnXFMInTTryGuGWIVszVw1zHOXOFQHWkcYfVPO6q9tslVA=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR19MB7537

X-Spam_score: 12.8

X-Spam_score_int: 128

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Order Verification - Apple Keto Shipment Pending - Apple

Keto



Content analysis details: (12.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.165.244 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.100.165.244 listed in list.dnswl.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: jigfsdsfjksd.page.link]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_VALID Message has a valid ARC signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_SIGNED Message has a ARC signature

0.0 BAD_ENC_HEADER Message has bad MIME encoding in the header

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.6 FROM_STARTS_WITH_NUMS From: starts with several numbers

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.7 SCC_BODY_URI_ONLY Very short body with something maybe clickable

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.0 T_REMOTE_IMAGE Message contains an external image

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} =?UTF-8?Q?Order Confirmation - Apple Keto?=



--_c89e2870-495e-4297-a008-38f69efa0a5e_

Content-Type: text/plain; charset="UTF-8";









--_c89e2870-495e-4297-a008-38f69efa0a5e_

Content-Type: text/html; charset="UTF-8";





Order Verification - Apple Keto


Shipment Pending - Apple Keto

















--_c89e2870-495e-4297-a008-38f69efa0a5e_--

Lowe's Phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 02 Mar 2024 08:55:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgRhB-000000005ge-2myg

for dave@doctor.nl2k.ab.ca;

Sat, 02 Mar 2024 08:54:41 -0700

Resent-From: The Doctor

Resent-Date: Sat, 2 Mar 2024 08:54:41 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm6nam12on2133.outbound.protection.outlook.com ([40.107.243.133]:22080 helo=NAM12-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgQDy-000000004uE-0aBh

for doctor@doctor.nl2k.ab.ca;

Sat, 02 Mar 2024 07:20:30 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=c94ajN1ATscCPofv/YwDUmgr2HY14ZX+MAKAu8xRtHeVY+EfH8Us4Fm4oqrSgs9FAHnlrjjHndJi99rQDOsc6htASMpfXG0gzp47ffnpR150DNZRNInkq6dXGHrLKnUyqhfLTXiXM+qy5mCLom1DJwF+Rptg7dznb6+XgOHTSJawSvjlG0q7CLnB9eNhs2iQgCRaIywmXTtPQW2t2CYdWB/PHV5C6ghgBi8Z3QY5VGJcribnbtgGqse2zU8LWKRkQBIdVvOdX9y6HGXv8BYE5aMRm1h7Q0gFu449C0oVe1fc5HMKI2Z2SKY4nC2HJScromTlFksub3F7szWFZBmyTw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=90OslhU8lh5uUK33BGMWckL6kcNUYPONTvYHQQ6GJKI=;

b=gZZmDRENIhc2QHDRqdV4M2CCvJ3U5GxB33jkKWixc02B5gtbwKxkY5BiYQIIvlmTlzOIEjNUehQ/VzXFOXOgSEvy2rwYxSD4/+HhCtfWSI5WzT3XmBbySc5/lGwwVK5rEm6A3pq868uc4gZtX+a+ugSaBTvMqfQOceTFsMZie1FK5wegngY4rPFO97UIFHeZUcm8Xozm4KU1z9YSG9ZI5P/YAOnHm6stzm4nIfLdNe2meubixzBvsbRxewSqSTNTqgWYNcec3HdVpkmC9EuUCDzv1eInq3E2WZMWohGTup9GfmKegFYqNVTNoOcwX3BjLxlPB3P0lqfCVEl7g1VGfQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

172.105.40.168) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=usxl.onmicrosoft.com; dmarc=none action=none

header.from=usxl.onmicrosoft.com; dkim=none (message not signed); arc=none

(0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=liceovicentepalacioscl.onmicrosoft.com;

s=selector1-liceovicentepalacioscl-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=90OslhU8lh5uUK33BGMWckL6kcNUYPONTvYHQQ6GJKI=;

b=NQol9GOePcjd+0ymwVNt3d9tO8vj8zDlleaTlf2wxKu7Aancyp1umFn3EurBpSItnmdzIkuVB6pbz0SrHthu3LyTQqNjFLfgZZowVNpvPLV/DZKbwC0uhAbpfrpz7/K9arMw1mi1pY/PG4kq2P6c668kCQt/F/UcwiGT++OgKF0=

Received: from BL0PR02CA0042.namprd02.prod.outlook.com (2603:10b6:207:3d::19)

by CPUP152MB5033.LAMP152.PROD.OUTLOOK.COM (2603:10d6:103:16c::5) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7249.34; Sat, 2 Mar

2024 14:18:24 +0000

Received: from MN1PEPF0000ECD5.namprd02.prod.outlook.com

(2603:10b6:207:3d:cafe::25) by BL0PR02CA0042.outlook.office365.com

(2603:10b6:207:3d::19) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7339.34 via Frontend

Transport; Sat, 2 Mar 2024 14:18:23 +0000

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 172.105.40.168)

smtp.mailfrom=usxl.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=usxl.onmicrosoft.com;

Received-SPF: Fail (protection.outlook.com: domain of usxl.onmicrosoft.com

does not designate 172.105.40.168 as permitted sender)

receiver=protection.outlook.com; client-ip=172.105.40.168;

helo=usxl.onmicrosoft.com;

Received: from usxl.onmicrosoft.com (172.105.40.168) by

MN1PEPF0000ECD5.mail.protection.outlook.com (10.167.242.133) with Microsoft

SMTP Server id 15.20.7362.11 via Frontend Transport; Sat, 2 Mar 2024 14:18:22

+0000

Date: Sat, 02 Mar 2024 14:18:21 +0000

MIME-Version: 1.0

Sender: contact@usxl.onmicrosoft.com

Thread-Topic: =?UTF-8?Q?Your Reward =E2=9C=94=EF=B8=8F?= 9Zk6V8Hk

X-MS-Has-Attach: yes

msip_labels:

Content-Type: multipart/related; boundary="OcDgJZswEvFf5BmdveRiFSyzNwndx4RR"; type="multipart/alternative"

Accept-Language: fr-FR, en-US

From: Lowe's

Subject: =?UTF-8?Q?Your Reward =E2=9C=94=EF=B8=8F?=

X-MS-TNEF-Correlator:

CC: doctor@aol.com

Content-Language: fr-FR

Thread-Index: woVJhMz3xkMiip7y5AdBaTJVmkdV0O==

To: doctor@aol.com

Message-ID:

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: MN1PEPF0000ECD5:EE_|CPUP152MB5033:EE_

X-MS-Office365-Filtering-Correlation-Id: 407983f4-1af5-465a-fab5-08dc3ac39e55

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

wwALExBK2GimRs5KNRRMfyKRVz0CrX6yCs9WzzW4ONIT4YpRvRHNrH/aS0l9CgHpJj66/QvbgLX5nrnHLUk9ZPrzbplWnGvDINjShI0BAV4b3SLXinkPjZXI+ZbCaz8H4MsHUB6/v8e1C1mGFJdOcH64M1S3d9/rDgvh8c9bFuuTfZqNvF+Fnqz6CRpJzDy3rM/a2YdJF5CadZ2O5NtMxXsH+bB0d6Y1YCI9JbSWkOFh4Axckm2JOPFOjPVnXUqgAhq4PDQ/JlBTLwbxb1rmpX9ThMxAILlTqsW4WQ6ELNq+3KFl7DcgxvzNLwUWtgLMi6HTFLkDyPKHLKOJE7h8ENvQzokZVzBmBLFLQeurA9fRgfChabLJWjr5PDKK3Xz2WUVvcQjlu0rAMDWRBFcBCQkZukTm7fuRwK6sLmWm/EgX4hriCAqo5l7AaPgBVYwak9Q/CY/yz9L+3/GQAXJHAXqfrs3mUEU65i22feIc3Ype9adhwmgmH0K/STLJGmdZwJQUqJIi5cCRXtbsB920Ma0a6UBKtFdOMCda+avb1A7UzS3G1SXp/2gw5e8S8bjVOrzgWp/xvm7HqNCt8OZLu5b7gM2OugYklA8Q9JdR9nMC8E1Pt1Mll5DXdvP7J0hlGlQMDyXOx5Idx6PgOsc+5ffsbclxXF/9AxaDt6gYFjCp5iWp8NdglB4xqEwljmARhV9n68WjbGg6bkxEKtdGrA==

X-Forefront-Antispam-Report:

CIP:172.105.40.168;CTRY:IN;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:usxl.onmicrosoft.com;PTR:172-105-40-168.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(376005)(61400799018)(82310400014)(34020700007)(36860700004)(41320700004);DIR:OUT;SFP:1102;

X-OriginatorOrg: usxl.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Mar 2024 14:18:22.4705

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 407983f4-1af5-465a-fab5-08dc3ac39e55

X-MS-Exchange-CrossTenant-Id: aad980c3-b21b-4b8d-a781-8bfdd8af16bf

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aad980c3-b21b-4b8d-a781-8bfdd8af16bf;Ip=[172.105.40.168];Helo=[usxl.onmicrosoft.com]

X-MS-Exchange-CrossTenant-AuthSource:

MN1PEPF0000ECD5.namprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CPUP152MB5033

X-Spam_score: 9.7

X-Spam_score_int: 97

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: JS4ynZglMRnJ2 DoniYvaCwkPhk 2cCvF7qaeovPX 92fAKub5oumAL gIYKwuJOdA9fo

S7vIH5cnUmM5b Jb7TU5LvqCwmz qfILLbvuRbOR6 aLfqW7BNM3QTO YU08Gmei2fNXB 1or9Zbsnprham

ZxpJ5J4B1qEu8 d4V3xT5GLr9np 10LNZqDL4mmZi kRk0 [...]



Content analysis details: (9.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.243.133 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.107.243.133 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_VALID Message has a valid ARC signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_SIGNED Message has a ARC signature

0.0 BAD_ENC_HEADER Message has bad MIME encoding in the header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[support.wgf1ifjb7rb(at)usxl.onmicrosoft.com]

3.0 SCC_CANSPAM_2 BODY: Interesting compliance language

0.1 TW_PR BODY: Odd Letter Triples with PR

0.1 TW_WM BODY: Odd Letter Triples with WM

0.1 TW_BV BODY: Odd Letter Triples with BV

0.1 TW_RJ BODY: Odd Letter Triples with RJ

0.1 TW_QA BODY: Odd Letter Triples with QA

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} =?UTF-8?Q?Your Reward =E2=9C=94=EF=B8=8F?=





--OcDgJZswEvFf5BmdveRiFSyzNwndx4RR

Content-Type: multipart/alternative; boundary="KYfWqR8M1q7arHjlLvGevQ"



--KYfWqR8M1q7arHjlLvGevQ

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



JS4ynZglMRnJ2 DoniYvaCwkPhk 2cCvF7qaeovPX 92fAKub5oumAL

gIYKwuJOdA9fo S7vIH5cnUmM5b Jb7TU5LvqCwmz qfILLbvuRbOR6

aLfqW7BNM3QTO YU08Gmei2fNXB 1or9Zbsnprham ZxpJ5J4B1qEu8

d4V3xT5GLr9np 10LNZqDL4mmZi kRk0VFCY3rjrN erYqsCtUutwI0



--KYfWqR8M1q7arHjlLvGevQ

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: 7bit























































Makita 6-pc Combo Kit Exclusive Rewards For You





















If you no longer wish to receive these emails, you may

unsubscribe





by clicking here or by writing to












--KYfWqR8M1q7arHjlLvGevQ--

--OcDgJZswEvFf5BmdveRiFSyzNwndx4RR--

metamask phish from Liquid Web, L.L.C Lansing, Michigan, United States

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 02 Mar 2024 07:06:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgPzK-000000001Ie-38ks

for dave@doctor.nl2k.ab.ca;

Sat, 02 Mar 2024 07:05:18 -0700

Resent-From: The Doctor

Resent-Date: Sat, 2 Mar 2024 07:05:18 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cloudhost-11124935.us-midwest-2.nxcli.net ([199.189.225.118]:24832 helo=cloudhost-11129392.us-midwest-2.nxcli.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgGtg-00000000JAG-3KwT

for sales@nk.ca;

Fri, 01 Mar 2024 21:22:59 -0700

Received: (qmail 20248 invoked by uid 10022); 2 Mar 2024 04:03:52 +0000

Date: Sat, 2 Mar 2024 04:02:00 +0000

To: sales@nk.ca

From: =?UTF-8?B?TdC1dGFN0LBzaw==?=

Reply-To: metamask@2fa.io

Subject: =?UTF-8?Q?=D0=90ccount_S=D0=B5curity_Notific=D0=B0tion?=

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1f947f73e223f614cfc19dbb7d212b0ff"

Content-Transfer-Encoding: 8bit

X-Spam_score: 11.7

X-Spam_score_int: 117

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Account Security Notification body { font-family: Arial, sans-serif;

background-color: #f4f4f4; margin: 0; padding: 0; } .container { max-width:

600px; margin: 20px auto; padding: 20px; background-color: #ffffff; box-shadow:

0 0 [...]



Content analysis details: (11.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)

[199.189.225.118 listed in ix.dnsbl.manitu.net]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 TVD_PH_BODY_ACCOUNTS_POST No description available.

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.8 TVD_PH_BODY_META_ALL No description available.

0.2 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.9 URI_PHISH Phishing using web form

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} =?UTF-8?Q?=D0=90ccount_S=D0=B5curity_Notific=D0=B0tion?=



This is a multi-part message in MIME format.



--1f947f73e223f614cfc19dbb7d212b0ff

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit





Account Security Notification





body { font-family: Arial, sans-serif; background-color: #f4f4f4; margin: 0; padding: 0; } .container { max-width: 600px; margin: 20px auto; padding: 20px; background-color: #ffffff; box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } img { max-width: 100%; height: auto; } h1 { text-align: center; color: #333333; } p { color: #555555; line-height: 1.5; } .cta-button { display: inline-block; padding: 10px 20px; font-size: 16px; font-weight: bold; text-align: center; text-decoration: none; background-color: #007BFF; color: #ffffff; border-radius: 5px; }











Important Account Security Notification

Â

We hope this email finds you well. Our security systems have detected some

unusual activity on your account, leading us to take action to protect your

account.

For your safety, your account has been temporarily disabled. To restore

access and enhance the security of your account, we strongly advise you to

activate Two-Factor Authentication (2FA) without delay.

Click the button below to activate 2FA:

Activate

2FA

If you encounter any challenges or have concerns, our dedicated support team

is ready to assist you.

Your prompt attention to this matter is highly appreciated, as it contributes

to the continued security of your account.

Best regards,© 2024 MetaMask. All rights reserved.

This email is part of our ongoing commitment to ensuring the utmost security

for your account. If you did not initiate this action, please contact us

immediately.





--1f947f73e223f614cfc19dbb7d212b0ff

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit





Account Security Notification













Company Logo



Important Account Security Notification



Â



We hope this email finds you well. Our security systems have detected some

unusual activity on your account, leading us to take action to protect your

account.



For your safety, your account has been temporarily disabled. To restore

access and enhance the security of your account, we strongly advise you to

activate Two-Factor Authentication (2FA) without delay.



Click the button below to activate 2FA:



Activate

2FA



If you encounter any challenges or have concerns, our dedicated support team

is ready to assist you.



Your prompt attention to this matter is highly appreciated, as it contributes

to the continued security of your account.



Best regards,
© 2024 MetaMask. All rights reserved.



This email is part of our ongoing commitment to ensuring the utmost security

for your account. If you did not initiate this action, please contact us

immediately.









--1f947f73e223f614cfc19dbb7d212b0ff--

UPS Phish from Microsoft

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 01 Mar 2024 19:18:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgEwC-00000000939-1bUL

for dave@doctor.nl2k.ab.ca;

Fri, 01 Mar 2024 19:17:20 -0700

Resent-From: The Doctor

Resent-Date: Fri, 1 Mar 2024 19:17:20 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-co1nam11hn2231.outbound.protection.outlook.com ([52.100.173.231]:11456 helo=NAM11-CO1-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from <6XP2EX49@vpepqgrp.sbjd.sbs>)

id 1rgETX-00000000LDq-2jMt

for root@nk.ca;

Fri, 01 Mar 2024 18:47:47 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=BX3UdtlEbmn4o9Lf4xgZCG9b9mC6TwrvDTOiF0u1YMg/7W2PbK9iuweAjUG81FfbeMF6X/cfg73zvGl9M5x2MeVY5ZCOVUBX2Giw4m8vRS4D0gQOMYhXMzFAo5zYQR0gzPtcJZDmxrDDTBelcRBolfTOZLI92HKt0rZvzerKOlYN5p8+S/Uch9a0BSjF7BGe6Gf5Zkbu/2rstCQTqjqdmz1IOveYbareYZcoeBYKxHEhXNmi1Bl2c+fg18qk/YwIIA8nGgy8P30QPdH3a+Cx/rWcpLj6cuc4aDDiiLkD7h/Bdr0VjL5hUXgT3lpGd+LU5UGu6iwCkKu/q7bV2+QmMA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=g12LZBKD7QQOyWdo9cYP3AC0h+nBQT8l+OMqZ+Ke5Ws=;

b=bmkFOR4IjcdmpLJzqcBMXTJ+VFoLyaLt3Cp0ttE98qTXockZjSeV3DJvZE8hSzlfpJc99JJVzsCrbviiq7/zHUqGD1H6p22xKS/is/pOapLAr5HQ3HPNHcprVVDCEPmTG7vZ+kZqnhAb7HL935hUur1UPZdWWK8+sZAP2jQqsessvSxVPBN4PWk2UGb054vkKuRDU8IrNhAf+2tUl00rc2E65cU/TaQTDa7khtZPjF871jZsJsmFc45C5Z7AvoRauEFulZMB+YSt77eFe5o588egXuFKnLeHBNdeaEWyYsS7/Q7AsLOdR/BQxqUpxPWlb76I+7ORAPRIUaDADLu+iQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=vpepqgrp.sbjd.sbs; dmarc=pass action=none

header.from=vpepqgrp.sbjd.sbs; dkim=pass header.d=vpepqgrp.sbjd.sbs; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dsgxcbsghfbdfnfdzfvf.onmicrosoft.com;

s=selector1-dsgxcbsghfbdfnfdzfvf-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=g12LZBKD7QQOyWdo9cYP3AC0h+nBQT8l+OMqZ+Ke5Ws=;

b=Et/t/WVL0S+Df6zPbzEC3GWteFV3qU4aV81ngNN2DdNa8ckRRqKTcovtZZBE3uRL/QQKyvim6XKrPr/NKFON0Ys7gaxIT0VVEzI3d5cGm7GMTF1CRfmVsX7x0bFuKpHhZFakikJUCBNNzwqcttFoMbjyCYH69Ejf562hzwV1Boe2q/0fv1Z/OE5I4nCWShacQ5byqTINtOS5//ZrxQtPz4pk42CyH4TX5TnD0cgryzvhXAne2rQxv3m6LNP0Jm5X2YbCU1PUWYwsbvvNpfPHHhdUrTJdAOF3EQSHOp0Maj8rVUPKLTGrqdv+gEz/91yRP7wJJ/v3F5LeFiF2dOyhVw==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=vpepqgrp.sbjd.sbs;

From: "Your order" <6XP2EX49@vpepqgrp.sbjd.sbs>

Subject: Your package is ready to ship!

To: root@nk.ca

Cc: root@outlook.com

Content-Type: multipart/alternative;

boundary="_9930d270-4535-4277-a883-0326ef836320_"

Date: Sat, 02 Mar 2024 01:40:37 +0000

X-ClientProxiedBy: YT1PR01CA0135.CANPRD01.PROD.OUTLOOK.COM

(2603:10b6:b01:2f::14) To EA2P223MB0836.NAMP223.PROD.OUTLOOK.COM

(2603:10b6:303:24f::20)

Message-ID:



X-Message-Flag: Flag for follow up

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: EA2P223MB0836:EE_|SJ1P223MB0531:EE_

X-MS-Office365-Filtering-Correlation-Id: 07725e4d-7fbe-4a6e-a3ad-08dc3a5a776b

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?VzVtZmRaNHR1UjZlS1NpMTVnSmc3SVhCV2dLREJZOEdNd3lad1lBNWxDMk9y?=

=?utf-8?B?eS9ONnU5STFWWDNGeWozVTFBZ2xseGRzOXRGU2xEaUpQeU5oSEZsakhXckV4?=

=?utf-8?B?a1N0bXZVSE5Lb0MySnRGcUlvNFp1OTdBUlNaTlNoN3dBRTdwT2wyZlpHVzNr?=

=?utf-8?B?dGtiL0tuREhLd3VpY3JFUnFvTUMybE5jSUx2MEZTaitmWFpoWmxaZDJ5Vkha?=

=?utf-8?B?UTNwQjh6b28wQU9ZNTVmMkFXd0tkV3FTSXAydjhETjZHdnJ6Ynh0OHNuZ0hX?=

=?utf-8?B?SW5CdlhvdTFFc3gyQTcvUmVwSEFWem1LY2dBOE5rbTFUeW5pNUY0emVjbUNa?=

=?utf-8?B?Vm43aWllK05GL2FBV3B6dnFiS1lGNnVoQVd2MloraEhwLzU0VW5xUHdSeXRF?=

=?utf-8?B?akVnSnlBNlpTbTNCK2dTRTQvQXFRa0M3b2EyRm5YdFROdllPQ21UZFkyZEpy?=

=?utf-8?B?OVJ4cHFCd1JaNys3NHV0Q2F4aFRrNFd5T0xkNHF6UmVhUXd4b01KKzlKRmdw?=

=?utf-8?B?bGE5L09SdEJXNW5XRXZ4WU9JY2tRbXd1SG9TYkQ0Q0tQVVhRS1o4S21BZklH?=

=?utf-8?B?WkFFeDF3Z2w3RkFacmNWRlJIbHdyOG5iSS96WFlFdmRacW1kY1ZadmcySGFp?=

=?utf-8?B?STdZQTVsQjczTnpOSEt3YzV3bFZXVnJtWDN1VEtORXJ5K3RCUXRYeUZtaXB6?=

=?utf-8?B?YVc0VngrV0FHM0dkRVd3dlhPR1FRTkpncXNkaThzcDVoQXpGaGFlR0VDVldj?=

=?utf-8?B?TXVTNlc3dC9tdTBLbkhrSGVJSlo4QnozN0JDR043cG5QbXR6M004NnY5QXFZ?=

=?utf-8?B?WFlHd1U3c3MwKzhjWTZCTjRVTXA5b2tUdFlMNnZjRFluby9SWTZqM1hKcVZm?=

=?utf-8?B?d013RDh0WXBKcFpkcTFNVUIweklDZ2dxT2h2Q3IrTUJRYmMwMEJZN0UyUmk1?=

=?utf-8?B?cjcySUdDc2tnVEg4Z3l2UWJGdnBmWXZQVEQ4SHM4TngrUS9veGM0eFk3L2RU?=

=?utf-8?B?U1RTQ2hFOThoMFBNQ1dwbG03eVFEanZ3TFhEcXQ1WDEzdnh6V0p3ajEyRFNG?=

=?utf-8?B?bE8zeTc5a3RZZXNaVXVnTk5DYzl5OWNGcHJjT1krL2tLclNhRXZURmJYTEZF?=

=?utf-8?B?NHFZcURqWnZMczN2UEpTZll1WWhKbDFwQlFHY0Uwd0tvRUdFZlV5eXhNdDkr?=

=?utf-8?B?dk5pdm1ZTzl6K09iT1hDVFpxcUFzNlNZcXhTRHRiRk1QdnhpRW41dlBUZ2Vl?=

=?utf-8?B?TWduM1dEOGVYUWFZc2Z4dHBLK2lqbEFyTFBTUDRLRDFla1dwTm5UWmxqektJ?=

=?utf-8?B?aWNnZG84cHlKd2sxZmw0bnVwWTRxamcwaS94ckEzTDl2ZkJhNW05OXh3cW44?=

=?utf-8?B?RmlQczRicVZpWWx3Q0hhcEt1dWNGeldOTDExdEtkdWhQVDEvYWR6Uis4TTNy?=

=?utf-8?B?OVNKc2gxS3JQUVRKb21QQW03eTU0c25zZXhQWUVUK3lZcExBbVA1RWtoTU8v?=

=?utf-8?B?dXNtWTlpRU5XK2lYOThqZ0llSmprUTVaaEN1NGlRTFBvQjBtZ0ZuYjhnTmc5?=

=?utf-8?B?V05ibnU3YVpqYmZRd3hlcUVhWmFCWkpxRldxVEZDVFF6QmZDcmdHc2dGMW5y?=

=?utf-8?B?Qk1mOVFCR3FlVUFXUFI2M29Ca0IvbW1GL2IzWWs4Lzg4WHYrNGc5NkRacWlk?=

=?utf-8?B?aGV5dkZSSGUrYXZOcjlXenlVc2VqM05WQmwxby9Bam5jckttcDZ5bkFXUGk1?=

=?utf-8?B?a2RiaWg5NWc4dWZOVzRHQlN2RDFUQVRHZHRBUW5nV21xbmt1OGRaWEdVNXVH?=

=?utf-8?B?cGdETCtDWEEwcUlCNTBBRFBEVHhOb2VJSGFSSHl1QkttaEdpT29ETHYyc1pU?=

=?utf-8?B?ZWZ4OUpVR3BUQjRoSXdudm5iY24xd3N2VkREenNEdVZHd3ZZNjJzcXFRVzYr?=

=?utf-8?B?K2xVN2xLanpnSVlUaURabjc1OG9aUW5rZDk0Wk0zd1pYNDMrc0NWLzdlbjVL?=

=?utf-8?B?czZQbnlQeHVtUUVKSlBzRm54K3NsMXFTZW9kTlNtMGdyYlB0SXVONXpxdEVC?=

=?utf-8?B?U1RYYkdNcklhZ3J4WUZqY3F2TkRSbWRDUUhtbTB1RlNZdkl2NlRaR0lBTmNL?=

=?utf-8?B?ZkpUdXljSnlubnd3V05WM24rTm90ZUE2SmdNTjdJYytlNHlhT1o5RHJGTFNG?=

=?utf-8?B?ZVQwcVRiRkg4YkhYSTRQaFRnVmVtQmhYK0hUU0wrTVM3c01oeHhMY3dqeDhu?=

=?utf-8?B?QjNEVC9kNEhqd2U2WlJEeTdQdDdRPT0=?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:7;SRV:;IPV:NLI;SFV:SPM;H:EA2P223MB0836.NAMP223.PROD.OUTLOOK.COM;PTR:;CAT:OSPM;SFS:(13230031)(41320700004)(376005)(22042699003)(37730700002);DIR:OUT;SFP:1501;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?NGcrcE5FN2pDMjRWbWlDY2VkcEtUdFJsUkVoaGt5T0o4czI2TkxuTk9UYlZB?=

=?utf-8?B?UVk2SVFRV1plTEpLdzVVOS9HNDRzVkVHZno0b3BrV3ZpR3ViaElEdU9YN1lm?=

=?utf-8?B?Z01WSDhOMXBhc2dRZUxNOEpERjRZUEV4V3YyQUVzaWgzWVZna2VEb1VnOENN?=

=?utf-8?B?RjJVOTdtK1d4T0RhNmdkUEwxbEdtQUVaNWl3VGJ6UkNXWGpoR0c2VHZNRzZp?=

=?utf-8?B?SDZQRjdhZzg4YkZWcDVnUWNRMFd6TE40SWwzSXIyQ3BTK0ZkRHM3V2JEVUw3?=

=?utf-8?B?MG5rRksxU2JzY21TMkIwc2JTMkFKaWFUOW5RaTliVTlyeWlqb3gzelplS3RI?=

=?utf-8?B?UmVQM21CV1NMQ29NQlVKdGRIL210bXpMNWM2NFNTbzkvcnVJNUcrOFVjaHAy?=

=?utf-8?B?SE9uWCt2NlBkVURRNTdkVTUrU0J4WDVlYkc1Sko1N0JXbDBCV0lZSGF6cnNr?=

=?utf-8?B?b3l1ODhOK3hHOVJBZHZmNHllcUZVek5odmFqRE5Wb2cyVWh6SGQ0bGNMaHRp?=

=?utf-8?B?RUVpb3h3WnJNQjNKUE1uRU1WOGkya2ZYaE1zQTl3bFpuRVlCazZPZ1VqWTl0?=

=?utf-8?B?cUNISHR0U0pvZkFQNUFFVGtjMEhLWDlwV1VpM0ZmcnRuUXMvRFNoMXF6a0Ji?=

=?utf-8?B?Vy9MNnBoSkIwWWRvNjU0Rmg2RWVDVTVuSHFzbFBxQ2Qycy93RndVVk41M2JX?=

=?utf-8?B?ZGtGWXpzVTZsNzRVb28remlva3RUWkliZE1yZXdEaFYvdjlxcUx5UGlPNktG?=

=?utf-8?B?aUd0V1JkZmQ3ZUVvemhSNmtXMXFqZWFVWkVXakp5M0Y0Z1lDTW16UldVdHhB?=

=?utf-8?B?YURaZkFPUWhIRkNUbC9VZTN6OEhsbi90YjlVa0txVWR3cVVDSC9wYTJRczlX?=

=?utf-8?B?L0NlaEUxSC9BN3lhRFF2enAvK0VwNVF2OTFJU0xIaXEyT2lnTnhyUVFjQXpW?=

=?utf-8?B?MEc4T3YzZ2dWakxVNGFrK0IwTWVRMThjSjhmQTg0d3dKdzRwS2tLUjBTd2lI?=

=?utf-8?B?blNKRFQ1ZG9zbmFickRta09SVXVPWGlOLzRjemh0NTRpT3Jka2tXRkkrSFNq?=

=?utf-8?B?dG03bGZIRHowYkRPTFp1b2pJN1d3YTBtbWRJcXUrczEwSWNTTFFoZU5OcjR4?=

=?utf-8?B?eGN3cnoweFo5bzBBV3g1MWVwdlBrUWhmcFRIbnlLNi9xWlppblJ0by9wcmJZ?=

=?utf-8?B?bml4MWh1dkNKSGwreWlUZ2E0eTUyeVBtci8xSVBTRVZyd0lLa3REKytmTDJD?=

=?utf-8?B?QWp2dUwwY3ZMYk1CMnFvNXJzZ1NYa2ExZnY5U09GMytjVGZvN0Mxc0FzTytG?=

=?utf-8?B?YVlUNVhFcFByNk9RSmd0SlIyYUFIeWtlTERTR1lLdERGamZUS0dUUVZkT2FY?=

=?utf-8?B?djlPZ2hhUTVVd1kxdTcxSkU2ZmFZWUhjRkpseUZTSjNZUzk0NjFzRnJBYTlZ?=

=?utf-8?B?RE95M0RKdWxUd2JDdHpUY0tVUjRUN3VDaEt2cThNamVSY1Z6aHFrV3JrRUVh?=

=?utf-8?B?Yk9zb2ppQWxOenpUOXhnSFFkOTJVTERLbWFOYUl2YUFrSEFzWjl6cllDaWFo?=

=?utf-8?B?Z3FRTFNmZXFWUUNFaTI3d05sRlBkMG1vUmlUYjNkb1BLMVB1em1mdUEwYS9G?=

=?utf-8?B?d1p5VUVXWktPUEZaQWdEUC9DQi92VnNkKzhOeXdMRE9oU2RFWkw4VkdXUzdK?=

=?utf-8?B?eWNvNGxrcVhQWkZSQ3VpRVVIOUoxL3d0WE95bUVuTEgzUGUyazBzaHRwbFJ4?=

=?utf-8?B?dVZ4VmdNUlMvUGkrL2xscmlUKy9hWHRuMDZDYjVKTnozS3ErSWU3THFYc2dh?=

=?utf-8?B?RENHSTRoQzlJcjgzWWl3R0l0ZTFldS9PM05QeW9jekVSVjRteWVXQ2dDbi9C?=

=?utf-8?B?aDg3c3g0NjRra1FsZEtWQ1lyemc4d056cEV0d3JyS2VldEFJQ1QySTViZVRu?=

=?utf-8?B?dXpHSHNOcXp2VFN0WUlwWW9XTEgwQS9lQTQxZXdrVGw2cDhKTmliVzZXOTkr?=

=?utf-8?B?VnVqQk5KTGhSYWFTY3FRREhNN1JTOG9kV1BtUVFEdlV3RXFpMFkzVmg0OHVX?=

=?utf-8?B?amNrQjhXbmI4Qjltd1NGQURqaHlFenJrRkVJNjdyODRLYlZuVEgvT3BRNWpI?=

=?utf-8?B?OG5QMG91MHJaR3JGNEFBSTBXMWVGb2xrS1lNcWIzR3R6VzUzMW9xL2hFUDd6?=

=?utf-8?B?dnc9PQ==?=

X-OriginatorOrg: vpepqgrp.sbjd.sbs

X-MS-Exchange-CrossTenant-Network-Message-Id: 07725e4d-7fbe-4a6e-a3ad-08dc3a5a776b

X-MS-Exchange-CrossTenant-AuthSource: EA2P223MB0836.NAMP223.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Mar 2024 01:45:40.5246

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 6ee2a083-378c-4b2d-b73d-b7e1f0bc88de

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: jbJszDLieDFd6aiOtAKDadVCmZI2f1s+SiuB4ioozMbWSSK1IoLQyjqLVNim6Wj6vVycvl+QUlixxtgotvIdHjoUTJN5NGV1RLsek+Dv2gY=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ1P223MB0531

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: There is $2.00 left in shipping costs, payment must be made

within 24 hours. - NOT allowed to use trademarks - NO UPS



Content analysis details: (9.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.100.173.231 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.173.231 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_VALID Message has a valid ARC signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_SIGNED Message has a ARC signature

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.7 SCC_BODY_URI_ONLY Very short body with something maybe clickable

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} Your package is ready to ship!



--_9930d270-4535-4277-a883-0326ef836320_

Content-Type: text/plain; charset="UTF-8";









--_9930d270-4535-4277-a883-0326ef836320_

Content-Type: text/html; charset="UTF-8";





There is $2.00 left in shipping costs, payment must be made within 24 hours.


- NOT allowed to use trademarks - NO UPS

















--_9930d270-4535-4277-a883-0326ef836320_--