X-Rated Google Groups Spam nina coulibaly <ninacoulibaly215@gmail.com> from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 02 Mar 2024 07:08:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgQ1D-000000001pf-1Vxd

for dave@doctor.nl2k.ab.ca;

Sat, 02 Mar 2024 07:07:15 -0700

Resent-From: The Doctor

Resent-Date: Sat, 2 Mar 2024 07:07:15 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f66.google.com ([209.85.161.66]:60687)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgNQk-000000007xP-35ss

for doctor@doctor.nl2k.ab.ca;

Sat, 02 Mar 2024 04:21:30 -0700

Received: by mail-oo1-f66.google.com with SMTP id 006d021491bc7-5a04fb5e689so1444708eaf.1

for ; Sat, 02 Mar 2024 03:19:32 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1709378366; x=1709983166; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=dffFd4iIeT7qRZGgAJZbxYl9fTL9h/vsOGvN/pCbcf4=;

b=huUe8LJzDxi1izxOIJNzH4KKt3B3uKzoVdQSm1osh+hRmWg6ifgAdBqEXunVtzVLfP

uFNPinx1XwrmwYmB2SpCyhczMwe2cSczGrgoGe7OL+1P6E+18XquYGcaXWHzdszX8n6C

RzPU4sa+Bo2QrJUX/PzOwJfwaphniijKItS/bjsh/R3L7mptiF7Ar8U+DeDYyknCP+62

htnOSz6TEDw3jEr/gCKcTCmzNZ8NcGzRGCdkETXjS/399gMKs6mVP/greuRPZfE7R6Gx

KBX5S0zcgO5cVsILN0Dz91SWlvVrv86MXN2YbYSnxE93jGMc1suKmq64qbH0YbyeVhEZ

mcCQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1709378366; x=1709983166;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=dffFd4iIeT7qRZGgAJZbxYl9fTL9h/vsOGvN/pCbcf4=;

b=rPL7NU07cvtaRn4m+1HtgsWODWUcc/+DyVx6aYZuh//zspj0b6OWkoGTHNH8pO0y+x

5eYD+Rt6yO8wqsXTW1F8alprn9ThPRPAJpWQR9ZLAofJwXsuN9iukYYPv1bG2f3aMSx0

UFyRnuBV5l0pkd622z6NAWnUW2khRCZHICQt+AyEMBtsdu37U6wQwm7AaTjYcPGilTLk

o0bfW5Fu+Sd7V3h+gdrsOHouk1yGCsaGM3mXmJrMSAQ62RvKe6bjOxf9MbDpvOnyu8mE

74cqaR54D7tW/m9lh1eBQ5UrVkbz8Jc3WD33nDhScaJitE5fQbrvoetSI0O7Jn3QZyk2

K9NA==

X-Forwarded-Encrypted: i=1; AJvYcCXmhlNVLJfGIprZkNkkF4rHK2FARfGs60NSpZVOvvIpsEHIqoo0ObsVKWOVgwoh1XC8xlXP2V0PU0rN1jpUbQrOYapOJ8WM4M0=

X-Gm-Message-State: AOJu0YzyF7v/Vjxagj/i3C6EdPiBhsMYYTNfSNWTOY6rAenrspld72Na

oWfMJPCAfMavqwcazRjsjyIlyMWGKQmCjs4o0mWp3ggyEny6HZQfDinMX3K5+yGVgouu/onU2z9

JCfblEuoCI1ReT3lxKwy6NPs13u85TKSH5NFqaQ==

X-Google-Smtp-Source: AGHT+IH9MUM7mdOQwm4lwNB+3NLXYQsp8uqTAOoSf6v3FKqhqifZ7sIe14mzwo7yRf819pmaTQjjQnnODcIYNdKs0+M=

X-Received: by 2002:a67:fd96:0:b0:472:6e23:1f3d with SMTP id

k22-20020a67fd96000000b004726e231f3dmr3521412vsq.1.1709368091575; Sat, 02 Mar

2024 00:28:11 -0800 (PST)

MIME-Version: 1.0

Reply-To: ninacoulibaly03@hotmail.com

From: nina coulibaly

Date: Sat, 2 Mar 2024 08:27:58 +0000

Message-ID:

Subject: From Nina Coulibaly

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000e38ec00612a9453a"

Bcc: doctor@doctor.nl2k.ab.ca



--000000000000e38ec00612a9453a

Content-Type: text/plain; charset="UTF-8"



Dear,



I am interested to invest with you in your country with total trust and I

hope you will give me total support, sincerity and commitment. Please get

back to me as soon as possible so that I can give you my proposed details

of funding and others.



Best Regards.



Mrs Nina Coulibaly



--000000000000e38ec00612a9453a

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=C2=A0

smartmail=3D"gmail_signature">Dear,

I am interested to invest with y=

ou in your country with total trust and I hope you will give me total suppo=

rt, sincerity and commitment. Please get back to me as soon as possible so =

that I can give you my proposed details of funding and others.

Best =

Regards.

Mrs Nina Coulibaly




--000000000000e38ec00612a9453a--

metamask phish from Liquid Web, L.L.C Lansing, Michigan, United States

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 02 Mar 2024 07:06:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgPzK-000000001Ie-38ks

for dave@doctor.nl2k.ab.ca;

Sat, 02 Mar 2024 07:05:18 -0700

Resent-From: The Doctor

Resent-Date: Sat, 2 Mar 2024 07:05:18 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cloudhost-11124935.us-midwest-2.nxcli.net ([199.189.225.118]:24832 helo=cloudhost-11129392.us-midwest-2.nxcli.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgGtg-00000000JAG-3KwT

for sales@nk.ca;

Fri, 01 Mar 2024 21:22:59 -0700

Received: (qmail 20248 invoked by uid 10022); 2 Mar 2024 04:03:52 +0000

Date: Sat, 2 Mar 2024 04:02:00 +0000

To: sales@nk.ca

From: =?UTF-8?B?TdC1dGFN0LBzaw==?=

Reply-To: metamask@2fa.io

Subject: =?UTF-8?Q?=D0=90ccount_S=D0=B5curity_Notific=D0=B0tion?=

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1f947f73e223f614cfc19dbb7d212b0ff"

Content-Transfer-Encoding: 8bit

X-Spam_score: 11.7

X-Spam_score_int: 117

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Account Security Notification body { font-family: Arial, sans-serif;

background-color: #f4f4f4; margin: 0; padding: 0; } .container { max-width:

600px; margin: 20px auto; padding: 20px; background-color: #ffffff; box-shadow:

0 0 [...]



Content analysis details: (11.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)

[199.189.225.118 listed in ix.dnsbl.manitu.net]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 TVD_PH_BODY_ACCOUNTS_POST No description available.

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.8 TVD_PH_BODY_META_ALL No description available.

0.2 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.9 URI_PHISH Phishing using web form

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} =?UTF-8?Q?=D0=90ccount_S=D0=B5curity_Notific=D0=B0tion?=



This is a multi-part message in MIME format.



--1f947f73e223f614cfc19dbb7d212b0ff

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit





Account Security Notification





body { font-family: Arial, sans-serif; background-color: #f4f4f4; margin: 0; padding: 0; } .container { max-width: 600px; margin: 20px auto; padding: 20px; background-color: #ffffff; box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } img { max-width: 100%; height: auto; } h1 { text-align: center; color: #333333; } p { color: #555555; line-height: 1.5; } .cta-button { display: inline-block; padding: 10px 20px; font-size: 16px; font-weight: bold; text-align: center; text-decoration: none; background-color: #007BFF; color: #ffffff; border-radius: 5px; }











Important Account Security Notification

Â

We hope this email finds you well. Our security systems have detected some

unusual activity on your account, leading us to take action to protect your

account.

For your safety, your account has been temporarily disabled. To restore

access and enhance the security of your account, we strongly advise you to

activate Two-Factor Authentication (2FA) without delay.

Click the button below to activate 2FA:

Activate

2FA

If you encounter any challenges or have concerns, our dedicated support team

is ready to assist you.

Your prompt attention to this matter is highly appreciated, as it contributes

to the continued security of your account.

Best regards,© 2024 MetaMask. All rights reserved.

This email is part of our ongoing commitment to ensuring the utmost security

for your account. If you did not initiate this action, please contact us

immediately.





--1f947f73e223f614cfc19dbb7d212b0ff

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit





Account Security Notification













Company Logo



Important Account Security Notification



Â



We hope this email finds you well. Our security systems have detected some

unusual activity on your account, leading us to take action to protect your

account.



For your safety, your account has been temporarily disabled. To restore

access and enhance the security of your account, we strongly advise you to

activate Two-Factor Authentication (2FA) without delay.



Click the button below to activate 2FA:



Activate

2FA



If you encounter any challenges or have concerns, our dedicated support team

is ready to assist you.



Your prompt attention to this matter is highly appreciated, as it contributes

to the continued security of your account.



Best regards,
© 2024 MetaMask. All rights reserved.



This email is part of our ongoing commitment to ensuring the utmost security

for your account. If you did not initiate this action, please contact us

immediately.









--1f947f73e223f614cfc19dbb7d212b0ff--

Shoppers savings spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 02 Mar 2024 07:06:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgPzh-000000001Om-0PGl

for dave@doctor.nl2k.ab.ca;

Sat, 02 Mar 2024 07:05:41 -0700

Resent-From: The Doctor

Resent-Date: Sat, 2 Mar 2024 07:05:41 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-bn8nam12on2124.outbound.protection.outlook.com ([40.107.237.124]:40672 helo=NAM12-BN8-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgHLD-000000001Eh-14gc

for sales@nk.ca;

Fri, 01 Mar 2024 21:51:23 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=J/mzVH2CZWYQ+s9/j2ZNBkAu3/f0+EU3Oescirju4Wv219dtVE7kNprmB91qeXbEeYi3q/PfvjeadWdzfVYFH61mUR3eIB7Pa0j2lDWqnemL7jWloe/nJ0QAqOqQYmBbMh2GDEhdGylzCOvGR8YCk75hq3tdhDU7jhEjqqYHK95TbP4GpqetBdUhMV1gr9BsdqaY8aKJZIDeEtOtFjWr0xPzdMpxVSfWV02pDzU8QTMThRfZibkNXYQZ9K7FyAS01RlILZ92DLtuu1zfKB3MuoTxGd9QX487Fr3nCchBrDQplmKEvB8bkOQe0cMb25m7a0p9Zyahk8GJ0hsae0w71A==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=OES2B6bb7Zn2xgMwoZ5hjzcC1lnv+p9JO5acJpPousE=;

b=NE8PRXVsg2ZS2tfHgaWngq0m5G3wXgMhy1CMpGQWY6qQQrN9T9KydbKKacN8znlYH6PQTaKu9G6ySinUDEwKJUIMUkR6hl9230L7JhzauFrRypwI+6tXVxnXu4pTmlFnEUbScihouYwyjr4dOXpzdyrNN2HBBOVG4nDHe7S88Leq7vNhvs7cF+gApMhGwzy54WUvjBIQrAD1l8UfyLsnZsn2oL+xfiA8ZvrnW8mLeqiwIXhir5pez1OUkghOuyRQdKTv/6jfqq9NUIVtnzOI02VqyqAspak4vqiW7ZKwK3xFiZigw/rldMTtvSzCMWuaDj583P5kd+z0cTSqpiZbqw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=dvooiig.fdhsufusdya.motorcycles; dmarc=pass action=none

header.from=dvooiig.fdhsufusdya.motorcycles; dkim=pass

header.d=dvooiig.fdhsufusdya.motorcycles; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dsmshu3voqdksgmiqm5g53.onmicrosoft.com;

s=selector1-dsmshu3voqdksgmiqm5g53-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=OES2B6bb7Zn2xgMwoZ5hjzcC1lnv+p9JO5acJpPousE=;

b=UDHDPNwy13Pr7xg+7NxB+/qTBYGTJpJL/qMhgnq3H03ov/sXjnd1z9kkFbAxDLGiseaqsHE0K9VP8u2IAcVUfzWrVzwD0Rwwp0NKKWqS2An8dBU+DQc+OFytNgt7LzeuHGPkP3IgwvGqwdze4TajEJ53G3bafGwcXt4p2stlZBbkaNKfyR6GUXfApJ9KWalvqLi1HrAdc91AfCCo5R8BtlL3cNi8JqAT8b6zFDoGJGe9HuMs95lrpiTWPhLVv+TyVykhD5wvRIQbp5L4NGMnhMJtts0/V3+kTQQSPi7KE0xUTsBQr8gfOQWt/KYrB3HOjVTPKumiHq9H1d5ox9/TsQ==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none

header.from=dvooiig.fdhsufusdya.motorcycles;

From: "=?UTF-8?B?U2hvcHBlciBTYXZpbmdz?="

Subject: =?UTF-8?B?SW1wb3J0YW50IGluZm9ybWF0aW9u?=

To: sales@nk.ca

Cc: sales@outlook.com

Content-Type: multipart/alternative;

boundary="_b9fc1059-6ef9-42df-aae3-c35d6f8b1f02_"

Date: Sat, 02 Mar 2024 04:49:15 +0000

X-ClientProxiedBy: CH0PR03CA0420.namprd03.prod.outlook.com

(2603:10b6:610:11b::25) To DM6PR15MB3322.namprd15.prod.outlook.com

(2603:10b6:5:16f::21)

Message-ID:



X-Message-Flag: Flag for follow up

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: DM6PR15MB3322:EE_|MW3PR15MB4057:EE_

X-MS-Office365-Filtering-Correlation-Id: c08bc090-8824-4ae4-7c58-08dc3a741d72

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

Wp32fi5Wxgtv2q256qIHSNRzwZVAGsGV8jYfQ4QdcK/F+hiFzKiqlMZ63U50jcO/IdLCuPW0UNpgdf5NruDbxLX3IlAUghp1t5qnBtlAGE0tTV2hVhxP/tLlRa9qW1Pdyoc8zhJn3ojSWt8elYGzrM09F2ZA3GtABd6AI/25QkVQGwP1phlAHeJCsf/tG08e6Sj1Ndv7dKl2arJ9ITOACtH6HGcBG+OJPimUs0mbm+BL0qBF215Q6bETy/o2D7ierxK8gtRE6WfaG6Nd58CWqRJ5457KnaGhWLkz3MGjJM1rUJN6JvrFhaMJWA631hIA3Pbc8IHAddZM3etdK5aKGmlRCrxWBeXbODeTE7ExX8o03jZbkobAl+YdnAP9HvCw+Hyjyc619jHF8uTRFsWPF8H1uq/Nn2eHy96nZnjij9iG8jRVYdNuHAS1GYD0W9ZM4So7XtoodviAzfvnscCW+ySLpfJJFrnZ0ZPY/fu2NL4dGadf14I8IZJpwfqjhW8lgwyczOigUHR1zy8I/83XcvX1Oq71kwb/5SsbxXaFn7elEL9HvgxmlB4xl/asrxUTY3NRewIU2+8qah1Sj/RLkJ6MSQNDCygl3PSqUHmx+Xi6TyUN2K7cdN/CXdEtkPRQ8fi1ezSEtGh/zpsdrd/zg9GXDjGRvFjwED34UOM0TEc=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DM6PR15MB3322.namprd15.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(376005)(41320700004)(37730700002);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?dEx6RUJqVTVWMHR5OGZGWWdIMm5SU1dRa0RxQkFxME1Sd0I2WVQrVm96VUc3?=

=?utf-8?B?N3FMQ0I0amdheFBtd1ZYdUk4NGRCcFNpVVlMWkVJR0JTYncySitNbEJHRlNW?=

=?utf-8?B?dGtWcCsrdzNjQThXbVl4ZmY2cUx1K2JVR281MGx3VE53cmRtOERkakswWkh3?=

=?utf-8?B?QmY5SnJwSmc1QXQ0TFVHYTYxWTl4ei9FbU1SS2h0QnlLbmpQY1ROR080T1hk?=

=?utf-8?B?QVFSVXFjN1JNT1FFVjlZSUd0OE1yT3JnSmg1Q2JJN3hUNDFTdC9KSUlKS0tO?=

=?utf-8?B?bFprVVpXWmNxczdOczdoZ2JVdURiU0Fmekt2eGpaRGYvUnNpNlFpeC8xRjBw?=

=?utf-8?B?Tkd2ZCt0YU9tNUMrNEI3ejg3V1V2Slg5dSs2TlA2cmY5Rm10R2ZOV3oxTUFw?=

=?utf-8?B?YnBxV0NVQnZTd0M2UkdWYytJMjlSciswajFkQ1lTbUJxREZOaFEzdkp0QndT?=

=?utf-8?B?NDY0Q0pjNVBDdnNYOU10dkNOTEdKS1ZkZFZnWWtad25nTFZXYmRSNDc4dGxO?=

=?utf-8?B?bXFIUDJBaGFRQ1dpTEZhTlY5K1VPdFU2K3hFV0hPS3JxYnFQa1B2VWF5VXBU?=

=?utf-8?B?RDNmbGludkNBOWIvZCt6Yll0cFhTVnRua0NrV3JraXorL1RlRHIvamhtMHNM?=

=?utf-8?B?OE0vcVQ5R2FxV3pWRFBySHRkdm9nMzFVT01rZU5yN3FuWlVEUGNDcDZlYzd5?=

=?utf-8?B?VVJHM3VKZlBoclREMzhyZWI3cG11QjhreFNyazB3V2hxSmI1TUFCeU9FNWcw?=

=?utf-8?B?eTlqNzQzZkR6OTJoV0swOGQwb1R2by8wOXY3RXVXeFRleGpPVllaSUJtMU14?=

=?utf-8?B?S1RvUmhiT05HUlVtbnZmNG5ZZFp0ekNxSmZId3ltTlZJQnhWRkVTWCtOMXhS?=

=?utf-8?B?clVLblA5WUZ2bXUxVmdqT0QvTEhrb3pOQzRUczA5U3l4dkRINUhXM05GRWJ2?=

=?utf-8?B?Z0liQmo5WkFaWHloSFZ5aGlOemVLZWxNZlUveEc5Q2ozUUoyZk5pTmp6QXZZ?=

=?utf-8?B?Z25NcXRvOFBBTm5tNjdTMTNZaWVrbTcwMUVaaFAxL21aRVhDc0w5UVB0bnds?=

=?utf-8?B?L1c3UXVRTTJmNWxzaU5jVWM1QTdybDlycFkrOXNWaTd6RndJWG8xbDl5dW9B?=

=?utf-8?B?NU5vZGdPRGp6KzVOK2VBLzVkTHRkc1U3SXkzeDZjeWhHQWlacU5UMkxGWkFo?=

=?utf-8?B?bmFmLzBWbGxPUXBMdnltUEdwR2ZWU2JLamtVb0Vza1BxQUFjZkpGc05rdDRD?=

=?utf-8?B?N0FHVXpWeVg2d2NBc0lTNmZCVXpGbWFoLzB2Q3p1UkxXUEVhS1NhV05ja2p3?=

=?utf-8?B?Nm9uUloxYnFHU0E2MmNadWlaVlJMN21nSlNSaVhESElPUnpZeDJxVGtpVzE5?=

=?utf-8?B?Zk9OTk14TzJmQzRWMU5Kb3RLdkZ4RzFjUzhweUJySUN4SWlaTnNvUitIWWc2?=

=?utf-8?B?Tk9IT2tGNFNrN1hjbVRQWGI5RjM3ZUNycS94aFJvRkxpbmM1NjBqVXNUZHFy?=

=?utf-8?B?emtDekVETWhHSS9wZG9xQ2FRdTdTYWo4M0U5eXZUNjFoY2VlTThWUU5vNGwr?=

=?utf-8?B?OG9LWmU4aWRjTnh2ZGxXOUxITk5aN2VEY1ptUGNpZDRETmZvWnNkNFVlYUoz?=

=?utf-8?B?KzllTzcyYTdLT3NiRktENkV1cnJucjlRcndZR3YvT3dxb0dNZlpVV0UyTU11?=

=?utf-8?B?UncxWEx6aHk4UVdJRVNiSVVjdnh1dXY0bGlZTDEyTVIwdXo2TmhGTlhSUUl6?=

=?utf-8?B?R3daOEtuUDV2NzNTWkdoeFlGMnl2M2tmNkxsUmFJbHF5aE1UUkxrVXk5ZmRm?=

=?utf-8?B?b2oydWlQWW1vU2U1UDNpUjJSeGpPVm1HWnZLb3dja1p1dFcwQnEwWlJ2MFdD?=

=?utf-8?B?YzNqWTNFWDdTWno4QlZSdUVoRnoxSGFyTVh4a1ZSWFhhQkMrNGZ2RnFyT3oz?=

=?utf-8?B?dkhmV3hVZlI1V2JWQzVoM0hCTGg1Sk42V3UrTzJEV0pRRW1LcWNOUUdJdkIz?=

=?utf-8?B?U3dOMndrT253cDBSMHJoSG5GdWZCUURXOGZPMGpKNmlkL2VmZzZ6cWhzY1ZS?=

=?utf-8?B?Tm1QbVdhaTBXbXpvRTRlRWlYUWhzeVhGVWpEL2FvcmF0QUVYQXJGa0RoeTlR?=

=?utf-8?B?YlluUDhUNDIzd01JTGdsOWtNajZPR1pIdG1vMEdMREdvSHRkeTlPa2dGZXBE?=

=?utf-8?Q?tC/H6IVAFX7MWIUrVMp1oeboIhsgKIFdw4tLh+qDfzvC?=

X-OriginatorOrg: dvooiig.fdhsufusdya.motorcycles

X-MS-Exchange-CrossTenant-Network-Message-Id: c08bc090-8824-4ae4-7c58-08dc3a741d72

X-MS-Exchange-CrossTenant-AuthSource: DM6PR15MB3322.namprd15.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Mar 2024 04:49:16.5249

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 5c7640e3-518a-483d-94fc-1f2f3697f035

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: /R7IGCcZ4SU6ZsS5QvhUm0D+LZ0htsLW3Hb1RP5nhRUzY15cHY3pnTfLnG0qJdAivNhn34eqyDRLaFKdMR8//Y3I4FS+jI4KEXlWGH+FbcMTU01XNh4vprf9FvHzMzNh6/KDEjXc5PFwvtjSgfOuTg==

X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW3PR15MB4057

X-Spam_score: 11.7

X-Spam_score_int: 117

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: You've been selected



Content analysis details: (11.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.107.237.124 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.237.124 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_VALID Message has a valid ARC signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_SIGNED Message has a ARC signature

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

3.4 HTML_SHORT_CENTER HTML is very short with CENTER tag

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

2.7 SCC_BODY_URI_ONLY Very short body with something maybe clickable

0.0 T_REMOTE_IMAGE Message contains an external image

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} =?UTF-8?B?SW1wb3J0YW50IGluZm9ybWF0aW9u?=



--_b9fc1059-6ef9-42df-aae3-c35d6f8b1f02_

Content-Type: text/plain; charset="UTF-8";









--_b9fc1059-6ef9-42df-aae3-c35d6f8b1f02_

Content-Type: text/html; charset="UTF-8";






You've been selected

















--_b9fc1059-6ef9-42df-aae3-c35d6f8b1f02_--

UPS Phish from Microsoft

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 01 Mar 2024 19:18:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgEwC-00000000939-1bUL

for dave@doctor.nl2k.ab.ca;

Fri, 01 Mar 2024 19:17:20 -0700

Resent-From: The Doctor

Resent-Date: Fri, 1 Mar 2024 19:17:20 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-co1nam11hn2231.outbound.protection.outlook.com ([52.100.173.231]:11456 helo=NAM11-CO1-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from <6XP2EX49@vpepqgrp.sbjd.sbs>)

id 1rgETX-00000000LDq-2jMt

for root@nk.ca;

Fri, 01 Mar 2024 18:47:47 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=BX3UdtlEbmn4o9Lf4xgZCG9b9mC6TwrvDTOiF0u1YMg/7W2PbK9iuweAjUG81FfbeMF6X/cfg73zvGl9M5x2MeVY5ZCOVUBX2Giw4m8vRS4D0gQOMYhXMzFAo5zYQR0gzPtcJZDmxrDDTBelcRBolfTOZLI92HKt0rZvzerKOlYN5p8+S/Uch9a0BSjF7BGe6Gf5Zkbu/2rstCQTqjqdmz1IOveYbareYZcoeBYKxHEhXNmi1Bl2c+fg18qk/YwIIA8nGgy8P30QPdH3a+Cx/rWcpLj6cuc4aDDiiLkD7h/Bdr0VjL5hUXgT3lpGd+LU5UGu6iwCkKu/q7bV2+QmMA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=g12LZBKD7QQOyWdo9cYP3AC0h+nBQT8l+OMqZ+Ke5Ws=;

b=bmkFOR4IjcdmpLJzqcBMXTJ+VFoLyaLt3Cp0ttE98qTXockZjSeV3DJvZE8hSzlfpJc99JJVzsCrbviiq7/zHUqGD1H6p22xKS/is/pOapLAr5HQ3HPNHcprVVDCEPmTG7vZ+kZqnhAb7HL935hUur1UPZdWWK8+sZAP2jQqsessvSxVPBN4PWk2UGb054vkKuRDU8IrNhAf+2tUl00rc2E65cU/TaQTDa7khtZPjF871jZsJsmFc45C5Z7AvoRauEFulZMB+YSt77eFe5o588egXuFKnLeHBNdeaEWyYsS7/Q7AsLOdR/BQxqUpxPWlb76I+7ORAPRIUaDADLu+iQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=vpepqgrp.sbjd.sbs; dmarc=pass action=none

header.from=vpepqgrp.sbjd.sbs; dkim=pass header.d=vpepqgrp.sbjd.sbs; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dsgxcbsghfbdfnfdzfvf.onmicrosoft.com;

s=selector1-dsgxcbsghfbdfnfdzfvf-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=g12LZBKD7QQOyWdo9cYP3AC0h+nBQT8l+OMqZ+Ke5Ws=;

b=Et/t/WVL0S+Df6zPbzEC3GWteFV3qU4aV81ngNN2DdNa8ckRRqKTcovtZZBE3uRL/QQKyvim6XKrPr/NKFON0Ys7gaxIT0VVEzI3d5cGm7GMTF1CRfmVsX7x0bFuKpHhZFakikJUCBNNzwqcttFoMbjyCYH69Ejf562hzwV1Boe2q/0fv1Z/OE5I4nCWShacQ5byqTINtOS5//ZrxQtPz4pk42CyH4TX5TnD0cgryzvhXAne2rQxv3m6LNP0Jm5X2YbCU1PUWYwsbvvNpfPHHhdUrTJdAOF3EQSHOp0Maj8rVUPKLTGrqdv+gEz/91yRP7wJJ/v3F5LeFiF2dOyhVw==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=vpepqgrp.sbjd.sbs;

From: "Your order" <6XP2EX49@vpepqgrp.sbjd.sbs>

Subject: Your package is ready to ship!

To: root@nk.ca

Cc: root@outlook.com

Content-Type: multipart/alternative;

boundary="_9930d270-4535-4277-a883-0326ef836320_"

Date: Sat, 02 Mar 2024 01:40:37 +0000

X-ClientProxiedBy: YT1PR01CA0135.CANPRD01.PROD.OUTLOOK.COM

(2603:10b6:b01:2f::14) To EA2P223MB0836.NAMP223.PROD.OUTLOOK.COM

(2603:10b6:303:24f::20)

Message-ID:



X-Message-Flag: Flag for follow up

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: EA2P223MB0836:EE_|SJ1P223MB0531:EE_

X-MS-Office365-Filtering-Correlation-Id: 07725e4d-7fbe-4a6e-a3ad-08dc3a5a776b

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?VzVtZmRaNHR1UjZlS1NpMTVnSmc3SVhCV2dLREJZOEdNd3lad1lBNWxDMk9y?=

=?utf-8?B?eS9ONnU5STFWWDNGeWozVTFBZ2xseGRzOXRGU2xEaUpQeU5oSEZsakhXckV4?=

=?utf-8?B?a1N0bXZVSE5Lb0MySnRGcUlvNFp1OTdBUlNaTlNoN3dBRTdwT2wyZlpHVzNr?=

=?utf-8?B?dGtiL0tuREhLd3VpY3JFUnFvTUMybE5jSUx2MEZTaitmWFpoWmxaZDJ5Vkha?=

=?utf-8?B?UTNwQjh6b28wQU9ZNTVmMkFXd0tkV3FTSXAydjhETjZHdnJ6Ynh0OHNuZ0hX?=

=?utf-8?B?SW5CdlhvdTFFc3gyQTcvUmVwSEFWem1LY2dBOE5rbTFUeW5pNUY0emVjbUNa?=

=?utf-8?B?Vm43aWllK05GL2FBV3B6dnFiS1lGNnVoQVd2MloraEhwLzU0VW5xUHdSeXRF?=

=?utf-8?B?akVnSnlBNlpTbTNCK2dTRTQvQXFRa0M3b2EyRm5YdFROdllPQ21UZFkyZEpy?=

=?utf-8?B?OVJ4cHFCd1JaNys3NHV0Q2F4aFRrNFd5T0xkNHF6UmVhUXd4b01KKzlKRmdw?=

=?utf-8?B?bGE5L09SdEJXNW5XRXZ4WU9JY2tRbXd1SG9TYkQ0Q0tQVVhRS1o4S21BZklH?=

=?utf-8?B?WkFFeDF3Z2w3RkFacmNWRlJIbHdyOG5iSS96WFlFdmRacW1kY1ZadmcySGFp?=

=?utf-8?B?STdZQTVsQjczTnpOSEt3YzV3bFZXVnJtWDN1VEtORXJ5K3RCUXRYeUZtaXB6?=

=?utf-8?B?YVc0VngrV0FHM0dkRVd3dlhPR1FRTkpncXNkaThzcDVoQXpGaGFlR0VDVldj?=

=?utf-8?B?TXVTNlc3dC9tdTBLbkhrSGVJSlo4QnozN0JDR043cG5QbXR6M004NnY5QXFZ?=

=?utf-8?B?WFlHd1U3c3MwKzhjWTZCTjRVTXA5b2tUdFlMNnZjRFluby9SWTZqM1hKcVZm?=

=?utf-8?B?d013RDh0WXBKcFpkcTFNVUIweklDZ2dxT2h2Q3IrTUJRYmMwMEJZN0UyUmk1?=

=?utf-8?B?cjcySUdDc2tnVEg4Z3l2UWJGdnBmWXZQVEQ4SHM4TngrUS9veGM0eFk3L2RU?=

=?utf-8?B?U1RTQ2hFOThoMFBNQ1dwbG03eVFEanZ3TFhEcXQ1WDEzdnh6V0p3ajEyRFNG?=

=?utf-8?B?bE8zeTc5a3RZZXNaVXVnTk5DYzl5OWNGcHJjT1krL2tLclNhRXZURmJYTEZF?=

=?utf-8?B?NHFZcURqWnZMczN2UEpTZll1WWhKbDFwQlFHY0Uwd0tvRUdFZlV5eXhNdDkr?=

=?utf-8?B?dk5pdm1ZTzl6K09iT1hDVFpxcUFzNlNZcXhTRHRiRk1QdnhpRW41dlBUZ2Vl?=

=?utf-8?B?TWduM1dEOGVYUWFZc2Z4dHBLK2lqbEFyTFBTUDRLRDFla1dwTm5UWmxqektJ?=

=?utf-8?B?aWNnZG84cHlKd2sxZmw0bnVwWTRxamcwaS94ckEzTDl2ZkJhNW05OXh3cW44?=

=?utf-8?B?RmlQczRicVZpWWx3Q0hhcEt1dWNGeldOTDExdEtkdWhQVDEvYWR6Uis4TTNy?=

=?utf-8?B?OVNKc2gxS3JQUVRKb21QQW03eTU0c25zZXhQWUVUK3lZcExBbVA1RWtoTU8v?=

=?utf-8?B?dXNtWTlpRU5XK2lYOThqZ0llSmprUTVaaEN1NGlRTFBvQjBtZ0ZuYjhnTmc5?=

=?utf-8?B?V05ibnU3YVpqYmZRd3hlcUVhWmFCWkpxRldxVEZDVFF6QmZDcmdHc2dGMW5y?=

=?utf-8?B?Qk1mOVFCR3FlVUFXUFI2M29Ca0IvbW1GL2IzWWs4Lzg4WHYrNGc5NkRacWlk?=

=?utf-8?B?aGV5dkZSSGUrYXZOcjlXenlVc2VqM05WQmwxby9Bam5jckttcDZ5bkFXUGk1?=

=?utf-8?B?a2RiaWg5NWc4dWZOVzRHQlN2RDFUQVRHZHRBUW5nV21xbmt1OGRaWEdVNXVH?=

=?utf-8?B?cGdETCtDWEEwcUlCNTBBRFBEVHhOb2VJSGFSSHl1QkttaEdpT29ETHYyc1pU?=

=?utf-8?B?ZWZ4OUpVR3BUQjRoSXdudm5iY24xd3N2VkREenNEdVZHd3ZZNjJzcXFRVzYr?=

=?utf-8?B?K2xVN2xLanpnSVlUaURabjc1OG9aUW5rZDk0Wk0zd1pYNDMrc0NWLzdlbjVL?=

=?utf-8?B?czZQbnlQeHVtUUVKSlBzRm54K3NsMXFTZW9kTlNtMGdyYlB0SXVONXpxdEVC?=

=?utf-8?B?U1RYYkdNcklhZ3J4WUZqY3F2TkRSbWRDUUhtbTB1RlNZdkl2NlRaR0lBTmNL?=

=?utf-8?B?ZkpUdXljSnlubnd3V05WM24rTm90ZUE2SmdNTjdJYytlNHlhT1o5RHJGTFNG?=

=?utf-8?B?ZVQwcVRiRkg4YkhYSTRQaFRnVmVtQmhYK0hUU0wrTVM3c01oeHhMY3dqeDhu?=

=?utf-8?B?QjNEVC9kNEhqd2U2WlJEeTdQdDdRPT0=?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:7;SRV:;IPV:NLI;SFV:SPM;H:EA2P223MB0836.NAMP223.PROD.OUTLOOK.COM;PTR:;CAT:OSPM;SFS:(13230031)(41320700004)(376005)(22042699003)(37730700002);DIR:OUT;SFP:1501;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?NGcrcE5FN2pDMjRWbWlDY2VkcEtUdFJsUkVoaGt5T0o4czI2TkxuTk9UYlZB?=

=?utf-8?B?UVk2SVFRV1plTEpLdzVVOS9HNDRzVkVHZno0b3BrV3ZpR3ViaElEdU9YN1lm?=

=?utf-8?B?Z01WSDhOMXBhc2dRZUxNOEpERjRZUEV4V3YyQUVzaWgzWVZna2VEb1VnOENN?=

=?utf-8?B?RjJVOTdtK1d4T0RhNmdkUEwxbEdtQUVaNWl3VGJ6UkNXWGpoR0c2VHZNRzZp?=

=?utf-8?B?SDZQRjdhZzg4YkZWcDVnUWNRMFd6TE40SWwzSXIyQ3BTK0ZkRHM3V2JEVUw3?=

=?utf-8?B?MG5rRksxU2JzY21TMkIwc2JTMkFKaWFUOW5RaTliVTlyeWlqb3gzelplS3RI?=

=?utf-8?B?UmVQM21CV1NMQ29NQlVKdGRIL210bXpMNWM2NFNTbzkvcnVJNUcrOFVjaHAy?=

=?utf-8?B?SE9uWCt2NlBkVURRNTdkVTUrU0J4WDVlYkc1Sko1N0JXbDBCV0lZSGF6cnNr?=

=?utf-8?B?b3l1ODhOK3hHOVJBZHZmNHllcUZVek5odmFqRE5Wb2cyVWh6SGQ0bGNMaHRp?=

=?utf-8?B?RUVpb3h3WnJNQjNKUE1uRU1WOGkya2ZYaE1zQTl3bFpuRVlCazZPZ1VqWTl0?=

=?utf-8?B?cUNISHR0U0pvZkFQNUFFVGtjMEhLWDlwV1VpM0ZmcnRuUXMvRFNoMXF6a0Ji?=

=?utf-8?B?Vy9MNnBoSkIwWWRvNjU0Rmg2RWVDVTVuSHFzbFBxQ2Qycy93RndVVk41M2JX?=

=?utf-8?B?ZGtGWXpzVTZsNzRVb28remlva3RUWkliZE1yZXdEaFYvdjlxcUx5UGlPNktG?=

=?utf-8?B?aUd0V1JkZmQ3ZUVvemhSNmtXMXFqZWFVWkVXakp5M0Y0Z1lDTW16UldVdHhB?=

=?utf-8?B?YURaZkFPUWhIRkNUbC9VZTN6OEhsbi90YjlVa0txVWR3cVVDSC9wYTJRczlX?=

=?utf-8?B?L0NlaEUxSC9BN3lhRFF2enAvK0VwNVF2OTFJU0xIaXEyT2lnTnhyUVFjQXpW?=

=?utf-8?B?MEc4T3YzZ2dWakxVNGFrK0IwTWVRMThjSjhmQTg0d3dKdzRwS2tLUjBTd2lI?=

=?utf-8?B?blNKRFQ1ZG9zbmFickRta09SVXVPWGlOLzRjemh0NTRpT3Jka2tXRkkrSFNq?=

=?utf-8?B?dG03bGZIRHowYkRPTFp1b2pJN1d3YTBtbWRJcXUrczEwSWNTTFFoZU5OcjR4?=

=?utf-8?B?eGN3cnoweFo5bzBBV3g1MWVwdlBrUWhmcFRIbnlLNi9xWlppblJ0by9wcmJZ?=

=?utf-8?B?bml4MWh1dkNKSGwreWlUZ2E0eTUyeVBtci8xSVBTRVZyd0lLa3REKytmTDJD?=

=?utf-8?B?QWp2dUwwY3ZMYk1CMnFvNXJzZ1NYa2ExZnY5U09GMytjVGZvN0Mxc0FzTytG?=

=?utf-8?B?YVlUNVhFcFByNk9RSmd0SlIyYUFIeWtlTERTR1lLdERGamZUS0dUUVZkT2FY?=

=?utf-8?B?djlPZ2hhUTVVd1kxdTcxSkU2ZmFZWUhjRkpseUZTSjNZUzk0NjFzRnJBYTlZ?=

=?utf-8?B?RE95M0RKdWxUd2JDdHpUY0tVUjRUN3VDaEt2cThNamVSY1Z6aHFrV3JrRUVh?=

=?utf-8?B?Yk9zb2ppQWxOenpUOXhnSFFkOTJVTERLbWFOYUl2YUFrSEFzWjl6cllDaWFo?=

=?utf-8?B?Z3FRTFNmZXFWUUNFaTI3d05sRlBkMG1vUmlUYjNkb1BLMVB1em1mdUEwYS9G?=

=?utf-8?B?d1p5VUVXWktPUEZaQWdEUC9DQi92VnNkKzhOeXdMRE9oU2RFWkw4VkdXUzdK?=

=?utf-8?B?eWNvNGxrcVhQWkZSQ3VpRVVIOUoxL3d0WE95bUVuTEgzUGUyazBzaHRwbFJ4?=

=?utf-8?B?dVZ4VmdNUlMvUGkrL2xscmlUKy9hWHRuMDZDYjVKTnozS3ErSWU3THFYc2dh?=

=?utf-8?B?RENHSTRoQzlJcjgzWWl3R0l0ZTFldS9PM05QeW9jekVSVjRteWVXQ2dDbi9C?=

=?utf-8?B?aDg3c3g0NjRra1FsZEtWQ1lyemc4d056cEV0d3JyS2VldEFJQ1QySTViZVRu?=

=?utf-8?B?dXpHSHNOcXp2VFN0WUlwWW9XTEgwQS9lQTQxZXdrVGw2cDhKTmliVzZXOTkr?=

=?utf-8?B?VnVqQk5KTGhSYWFTY3FRREhNN1JTOG9kV1BtUVFEdlV3RXFpMFkzVmg0OHVX?=

=?utf-8?B?amNrQjhXbmI4Qjltd1NGQURqaHlFenJrRkVJNjdyODRLYlZuVEgvT3BRNWpI?=

=?utf-8?B?OG5QMG91MHJaR3JGNEFBSTBXMWVGb2xrS1lNcWIzR3R6VzUzMW9xL2hFUDd6?=

=?utf-8?B?dnc9PQ==?=

X-OriginatorOrg: vpepqgrp.sbjd.sbs

X-MS-Exchange-CrossTenant-Network-Message-Id: 07725e4d-7fbe-4a6e-a3ad-08dc3a5a776b

X-MS-Exchange-CrossTenant-AuthSource: EA2P223MB0836.NAMP223.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Mar 2024 01:45:40.5246

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 6ee2a083-378c-4b2d-b73d-b7e1f0bc88de

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: jbJszDLieDFd6aiOtAKDadVCmZI2f1s+SiuB4ioozMbWSSK1IoLQyjqLVNim6Wj6vVycvl+QUlixxtgotvIdHjoUTJN5NGV1RLsek+Dv2gY=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ1P223MB0531

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: There is $2.00 left in shipping costs, payment must be made

within 24 hours. - NOT allowed to use trademarks - NO UPS



Content analysis details: (9.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.100.173.231 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.173.231 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_VALID Message has a valid ARC signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_SIGNED Message has a ARC signature

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.7 SCC_BODY_URI_ONLY Very short body with something maybe clickable

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} Your package is ready to ship!



--_9930d270-4535-4277-a883-0326ef836320_

Content-Type: text/plain; charset="UTF-8";









--_9930d270-4535-4277-a883-0326ef836320_

Content-Type: text/html; charset="UTF-8";





There is $2.00 left in shipping costs, payment must be made within 24 hours.


- NOT allowed to use trademarks - NO UPS

















--_9930d270-4535-4277-a883-0326ef836320_--