Health spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 03 Mar 2024 17:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgw9S-000000007lC-4AkM

for dave@doctor.nl2k.ab.ca;

Sun, 03 Mar 2024 17:25:54 -0700

Resent-From: The Doctor

Resent-Date: Sun, 3 Mar 2024 17:25:54 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-tyzapc01hn2235.outbound.protection.outlook.com ([52.100.223.235]:49892 helo=APC01-TYZ-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgu7M-00000000Lnb-3wVJ

for root@nk.ca;

Sun, 03 Mar 2024 15:15:41 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=h5WTkvg3QKVS5MH9hoMTWbBLRMI6CkJhmPWuenfuW+EteDhVwBALLzzXwknTf92N7IM5p37WcQKL6QfcF8g60A2dO+fH5bqjwWi7Ff6tL9JFj0mju+6UDdbUIitia6qZGdVXVJ1BpyGgay1RTvkUG0SBurKny74MXPPX7ObuKMxuLqhkJmLgCFPVKJ5qwI5MHYQfS9rApUh5jRj+syLltpymqljxqXZxIYgJcSNAxkaZckGf7S62e9jUkmCQoodOrJpxHoGxEc/EKl0Jydk5Db4sfiJCWD8InxrHuRWRHMO1j/JuEEVGVROEa3ZKezB36nrQgrtuusW94HyJ7OazCQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=vrxqUZKR4rhf5cctcqgQKmQs9IVd2FJEH8pvzFqs9GE=;

b=VbK1ofsOF0ggUOJ0Ywb4u3I1ZTP31f46HFY9svHF/zXHvvYYidDm7UvRiIWFY/TrY2B1xUhwp3tn0M0l+B0f8ySDo8ME+SmbYXa7t8b5hh6UpSnL0kwfD2m6FmSE3PezpkeX3XHu1gu9kIF4k02f0Ojyq6tZfs2Rd6Gfn0IWMCB/PZsFLwLnQ881s+38c+bwWHjEhV2uf/GjU8mes0AnILNAJWU3LE3MEDEDXFGIBxttjorM0Dxp+rY7cucStmvTVlP1qOf1S3MKOpEbzM/OEjjskJAG3quCC20t1x1DEYiz2gH/q8My5G6Rf2hjGXibW/RhhQssOErWBV8xeNkyCw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is

172.232.134.178) smtp.rcpttodomain=nk.ca

smtp.mailfrom=1fcgjgdyujyjhdhfst.decisionmakers.online; dmarc=bestguesspass

action=none header.from=1fcgjgdyujyjhdhfst.decisionmakers.online; dkim=none

(message not signed); arc=none (0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=slgzsefsqlkflks147.onmicrosoft.com;

s=selector1-slgzsefsqlkflks147-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=vrxqUZKR4rhf5cctcqgQKmQs9IVd2FJEH8pvzFqs9GE=;

b=Nd3LqpSswUyCe9zCaMAWrti+hi3NxrjpZvvCkSKGhnS2XJNQ1wIo/imphBZCTcJ8wKT6wp+QM8gOF2atHrMNGdk0v+RX1wuvR0fUKcAV7swOmLsSWPSZOa3tTcvHiAWCaAiapkKT6nlmofjGYFDdMRFpYW1Jh1PtYoV9EjhksQHYtwoKKGFIN8zrJad3sJZ7DVaisnVOeh+zt6SSw/myGIV75x4OXNAFy0YiTNK7oqrcKxQXHbgC7FSQwpjnVAq+Id3m2anFvfFQLpc7CWFKRzStzzK0nuoFNsxE3ZIyBjG45ouTibAr3dAIQ35Qv2psDO/ebh+Jj5wABKPB5tUbjA==

Received: from SG2PR01CA0118.apcprd01.prod.exchangelabs.com

(2603:1096:4:40::22) by TY0PR04MB5765.apcprd04.prod.outlook.com

(2603:1096:400:21b::6) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7339.38; Sun, 3 Mar

2024 22:13:32 +0000

Received: from SG2PEPF000B66CC.apcprd03.prod.outlook.com

(2603:1096:4:40:cafe::4f) by SG2PR01CA0118.outlook.office365.com

(2603:1096:4:40::22) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7339.38 via Frontend

Transport; Sun, 3 Mar 2024 22:13:32 +0000

X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 172.232.134.178)

smtp.mailfrom=1fcgjgdyujyjhdhfst.decisionmakers.online; dkim=none (message

not signed) header.d=none;dmarc=bestguesspass action=none

header.from=1fcgjgdyujyjhdhfst.decisionmakers.online;

Received-SPF: Pass (protection.outlook.com: domain of

1fcgjgdyujyjhdhfst.decisionmakers.online designates 172.232.134.178 as

permitted sender) receiver=protection.outlook.com; client-ip=172.232.134.178;

helo=1fcgjgdyujyjhdhfst.decisionmakers.online; pr=C

Received: from 1fcgjgdyujyjhdhfst.decisionmakers.online (172.232.134.178) by

SG2PEPF000B66CC.mail.protection.outlook.com (10.167.240.25) with Microsoft

SMTP Server id 15.20.7362.11 via Frontend Transport; Sun, 3 Mar 2024 22:13:30

+0000

From: "=?UTF-8?Q?Health offer?="

Subject: =?UTF-8?B?TWFraW5nIGl0IGltcG9zc2libGUgdG8ga2lsbCBhZnRlciB5b3XigJl2ZSBhcHBsaWVkIHRoZSBvaWwgb24geW91ciBuYWlscy4=?=

To: root@nk.ca

Sender: DGgEQktjSFBB@1fcgjgdyujyjhdhfst.decisionmakers.online

Cc: root@outlook.com

Content-Type: multipart/alternative;

boundary="_85c85369-cf60-4b21-95bc-ba3768a82be4_"

Date: Sun, 03 Mar 2024 22:13:01 +0000

MIME-Version: 1.0

Message-ID:

<405aeaaf-0a8c-4e60-9727-37d25dc5106e@SG2PEPF000B66CC.apcprd03.prod.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SG2PEPF000B66CC:EE_|TY0PR04MB5765:EE_

X-MS-Office365-Filtering-Correlation-Id: b1a6cc60-59fc-40cb-6fd5-08dc3bcf28ea

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?d0ZsZ3ZkVS9MWnBVMmtnZ1pCU2NUc0owLzY4S1hjbEU4eGluY0g1NTBsUkZQ?=

=?utf-8?B?YS9jTDhkQjJZSmh5VGs3VE55U2VSWTVmZnpGSDhFd1NsMy9IK3pTbUlkVHhO?=

=?utf-8?B?RDliRXlISzVtV0RoUllJZVVFUFZIaHFKMXhuSTZHWVYrVDZEUmZrUDJBcGlq?=

=?utf-8?B?cmNrNzdCMlBOamU5OUh6UzdESWRXMVlzNUtYM2xVMm05THlVa2w3aDdkT0sx?=

=?utf-8?B?NTQzN1o4N3Rpajd6M0YwL3d6RzlkbzFEbERuOHFVajMyTVowNENWbFIvZitp?=

=?utf-8?B?Mzh3eUoxRUV1eHJwWW42MWhHdkpjTkZ1d2Q2WElPeVF6QXRaQlA4a05PS3Jo?=

=?utf-8?B?c0F4SzdtaTVCSGVnYlhsUngvUzNFMm10NEJqWFdzeEQvSkdJOVpxOEpDQmpa?=

=?utf-8?B?Y01oUmRqdE9Ia2VIaVRScFN0ZGxSOURCM1licG5hWUdMeFdRd1hmQkNVZU9p?=

=?utf-8?B?Ukpvb1pMejNNL2M1d0F3WDdSYTlWZk9MZ254TjJmN0NvL3JuZDEyNmxOWW43?=

=?utf-8?B?OGxJYzI2UE55ekN0aHY1VWZOZVdXcm5YWEl5T1M1VmZDMXFZUkE5bGpmMkFn?=

=?utf-8?B?VGxOK2xKU1JPNFV1Vm5xTWhZZTdoTzMwWUpTa1JjUDVEajdsd1hidnRtQlJS?=

=?utf-8?B?aC85MnBPQ2p1VWtGcXhTOEpvZGl0aDh3WENKT2pvLy9CQXNseVN3R01GZFpX?=

=?utf-8?B?NkF3OWsrRnhuUVN4eWNZeG5WQ1l3ckh4K1RTOFY5VHl1KzFLV2pWRjJEalV2?=

=?utf-8?B?MVBzdzBEWDFKdzF4TmpvZVZIRmJjZDFxVnkzVXQzVXdxcmhuZjRhL3VEMG9D?=

=?utf-8?B?UEhnV2luQTd5dWtlREdIdGtHdFVCYkcwVTJQVmRmUGprUnRoY1NNN0paM1E1?=

=?utf-8?B?Smd2QWU0ck5MSW1tZUgvblkyK3BxS2ZaUUJMV1ZxK3hrdmpQWXBVZElLQjRz?=

=?utf-8?B?WmhSbDdPNThUNkRpZFpaWndjUDk2bDRqODRNcWN6ZStRcHQ5MVo2YWt5SzBK?=

=?utf-8?B?ZlZxTXdqQ3dmdFlDT3RWQ01lMXFleXQxajA2SE00aCtHajR5dm50RkczWnNm?=

=?utf-8?B?SjNIR0VqTUdXeXpJUXJLRWV3cTZyNEIyelZSN0JKN0dyYXk1U2VLam9NUWJo?=

=?utf-8?B?U29uNGFZelc5dU95UEhPUTUzZkZ5NjZQaWV1V25yYUJHWWRjeTVLSFhwbkM1?=

=?utf-8?B?QWVISm5Bd1ZsampFNkVvZFhHZkNBQXpUK0JnNmJXdVZLK3NzSGNVb0poNmxY?=

=?utf-8?B?dDIzTnZGdWNjalJWTTJ0Y1FibGRETXdNMHZLNGxreW1BN3JGb0Q4UEdxVnZ3?=

=?utf-8?B?T2thV2VpWUExRUhGWlJSblZ2UkU5U3NDQkpGVnlXbXN6MkNmWnBKL1E0Q2xG?=

=?utf-8?B?eVFzVllJTjA3dGxTQVc4V1ZOeXZVZ0lXRmJNUmZmQ20zdTJxSVVnc3ptYmxK?=

=?utf-8?B?b0w0Ym0zNFB5N2hySksvSE1hZk5RSjZ4SDdpNEcrNmp1bDdKeEVrNWtlL0Jl?=

=?utf-8?B?L05wODRjSFFFUVBnODA2TWNnczVxZ2dxNE0xa1hPanc3dDdSRDR1ODdmdjBK?=

=?utf-8?B?eGNjQ0NzUFNUMnZ2bTR3bFl0RVAvRFVhbzl6bXd0bnNIZzdMbkc2QWRSMHN6?=

=?utf-8?B?SVJ5NkxJMnBVWlVtdXh2dDFYTndrMGhyRFNQa1poakVRQlNMdCszS2xwVXBp?=

=?utf-8?B?R1ZhSXhqWExPVDZHZEJZaWJPdk56R2xTV2dBWGdwUkFuODFBSXRha0dQMDhP?=

=?utf-8?B?bXhKYU85eEVaYnpreWZlTEhqeWRZdjNCVTRTQU5UVFlFZkgrVXFwM0VIb2N1?=

=?utf-8?B?UE8yMHl2QS9SZTBTd2V2eVZ6Nk1mdWw1c2wxSHJDVkxaUGE3SmUwc3VldG5B?=

=?utf-8?B?ZGRVYytBRzJlSDBKeWIyQ1NWenEvcnNwQ2VqNXVIMXk5YTN3WlVNQXllV1Ri?=

=?utf-8?B?UVpacDJzdHk2aVVMUVBtRVQ3Tmk1Q1k3UDFuaUFtU0tPNC9tdjVDZE1PdkJm?=

=?utf-8?B?RGRDSFhkbTJnPT0=?=

X-Forefront-Antispam-Report:

CIP:172.232.134.178;CTRY:SE;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:1fcgjgdyujyjhdhfst.decisionmakers.online;PTR:172-232-134-178.ip.linodeusercontent.com;CAT:OSPM;SFS:(13230031)(376005)(34070700005)(61400799018)(82310400014)(41320700004)(36860700004);DIR:OUT;SFP:1501;

X-OriginatorOrg: 1fcgjgdyujyjhdhfst.decisionmakers.online

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Mar 2024 22:13:30.6583

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: b1a6cc60-59fc-40cb-6fd5-08dc3bcf28ea

X-MS-Exchange-CrossTenant-Id: 9141e3d4-a023-490a-a3ad-adcbf644e590

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=9141e3d4-a023-490a-a3ad-adcbf644e590;Ip=[172.232.134.178];Helo=[1fcgjgdyujyjhdhfst.decisionmakers.online]

X-MS-Exchange-CrossTenant-AuthSource:

SG2PEPF000B66CC.apcprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY0PR04MB5765

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Scientists at the Infectious Disease Society of America have

discovered that tea tree oil can actually worsen foot fungus… Scientists

at the Infectious Disease Society of America have discovered that tea tree

oil can actually worsen foot fungus…



Content analysis details: (8.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.100.223.235 listed in list.dnswl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: 213.232.235.2]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.223.235 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_VALID Message has a valid ARC signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_SIGNED Message has a ARC signature

0.0 BAD_ENC_HEADER Message has bad MIME encoding in the header

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} =?UTF-8?B?TWFraW5nIGl0IGltcG9zc2libGUgdG8ga2lsbCBhZnRlciB5b3XigJl2ZSBhcHBsaWVkIHRoZSBvaWwgb24geW91ciBuYWlscy4=?=



--_85c85369-cf60-4b21-95bc-ba3768a82be4_

Content-Type: text/plain; charset="UTF-8";









--_85c85369-cf60-4b21-95bc-ba3768a82be4_

Content-Type: text/html; charset="UTF-8";







Scientists at the Infectious Disease Society of America have discovered that tea tree oil can actually worsen foot fungus…







Scientists at the Infectious Disease Society of America have discovered that tea tree oil can actually worsen foot fungus…



 



Making it impossible to kill after you’ve applied the oil on your nails.



Moreover, it seems that especially when used like this, tea tree oil can destroy your nails in just a couple of hours… 






Click here to find out:



Doctors Warn: Tea Tree Oil Actually Makes Fungus Impossible To Kill









src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6CVowIg-8fAZFsc8Hv6BiPcWjlv1WCHw-jNmEe1Ck3heKfBzMeeJwr2vlXQDF39Ss3ELm_lwgXctfbNs_8fT0oIUY-hzXcAwR4dAjO1_hBjl57hSAgAf_gGyCVxW8bMVBTUz4poUmFHV8mZhVuJ1osKuYH2Z7aMjBZ_T6q2Fp9whXOBB9WIZ9A3iBxiw/w640-h310/dfar.png">





src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjII835OD3VySuVQCZqK27eTEfKG3DyyScYQr22AdAtq5Uq5pLpM74MxqNVl5vf1YS6GFLbcRG-GTqkpZ6p9i1BHHaitNxwsAN256TIjvEixy0nmtYmHQiri6HMZ5prvZxh05D_CUGYsi4oLuVhO0O5CBWhklWgI_lHECIJ_M44MO4cvDkZjIDNh9VUqfA/w640-h48/dfar%20unsb.png" cekcUcHAgBxp>












--_85c85369-cf60-4b21-95bc-ba3768a82be4_--

Health spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 03 Mar 2024 17:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgw9A-000000007fX-1FpS

for dave@doctor.nl2k.ab.ca;

Sun, 03 Mar 2024 17:25:36 -0700

Resent-From: The Doctor

Resent-Date: Sun, 3 Mar 2024 17:25:36 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastasiaazon11021006.outbound.protection.outlook.com ([52.101.128.6]:24965 helo=HK3PR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgt4R-000000002Py-3THk

for sales@nk.ca;

Sun, 03 Mar 2024 14:08:36 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=IlmXjM130FU3SWRL2bHmXPvpTTvLwwshA7u/3buReSF/cn+sphJaYGtFIPAyUdnPf6HvREH86lNJpjBbid8Gu+yWb3f2YZ5a6U7RvUFY0MpT5fFZCZhcfV1KSp6SDbXFGf90Ty2QJvxPbjCtX/VjdS3hYGBylG4rUDJru8IWbejwCuYOU53awZ86VEwseWMmqzzlGuYui/aaB6nOY4gRwLibBm7eNKe1pPzSyJQ4d3AmNYTBzm22SYw+69pYczJspN15MgqOf4Xjux9BHKSZFzwvyKXZ2Id78vpIvsZArFEImUE3u635KtuAJcE9N2ywtnEau2lEYqW1XOc+zfS/Fg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=PVpiMUm5uKApEHDO740ytmQw8EdQ61+5P+Jj+ixGGJ4=;

b=QnTJZwVICJF2fT9THv+JLhW/JSYa7ZVG3PABQEW9iYBnTlzVuuxQyU/+S5Cks4PlzXIzhXYdvMH9u9Ld885VYNSxRA0r9urxfEz3HdQYqzL0c7y0ZAXasRjpAWZ/pVht6RxYunSlv2mMs5cNZ71m5diH7vr35nSEsoiVmnP6Or0bwg8qTVtyz1FbwLeyYZZeU52ADKy/GSev9IK73KRAv1pA9U3zU76UKfB/ZUqV76maxQZecQuQqMQl/kSO+x7t6X0m5Vmx5VqOQmruXUGZwMqzCR4b2HNyirSqRFgaz3mUf/aQipff4OsO2UwIpn0YrJbfpzwnCdxf48fuqiOAXw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is

172.232.134.178) smtp.rcpttodomain=nk.ca

smtp.mailfrom=1fcgjgdyujyjhdhfst.decisionmakers.online; dmarc=bestguesspass

action=none header.from=1fcgjgdyujyjhdhfst.decisionmakers.online; dkim=none

(message not signed); arc=none (0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=slgzsefsqlkflks147.onmicrosoft.com;

s=selector1-slgzsefsqlkflks147-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=PVpiMUm5uKApEHDO740ytmQw8EdQ61+5P+Jj+ixGGJ4=;

b=hJ1JmWls9/l7C/YAxVni7+m6zrglI3dVdSsMdxMOg3di2gIiB/wzAek+Nzj828+Rq0l+B4a+OtkpUKrUv56Eghcw1q4mCbgn6TUqs2WtDMT9VXhUuWyue3vtlqxZZlcET4gMAIfO6GDEPylUAq7lSwOq/kOcUK94JkV2kr5YrkslAJnkUemgiUGhdFA0rCbHKz9D7H4ugX2XlHXOKUT0YQzV/yYTCwdq7YgCsZ1z6KSFRrUhFO7vJLEfeI/164X2VXZpAViBNXOG82MNaU0rs2zwrCiqe1gkWdxfOxPxr+BBjbzpgpuWkoFJVQFfvC9K+utbt7DFphiqF0Xo6qj9mg==

Received: from SI2PR04CA0013.apcprd04.prod.outlook.com (2603:1096:4:197::6) by

TYZPR04MB8399.apcprd04.prod.outlook.com (2603:1096:405:dc::7) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.7339.32; Sun, 3 Mar 2024 21:06:27 +0000

Received: from SG2PEPF000B66CF.apcprd03.prod.outlook.com

(2603:1096:4:197:cafe::45) by SI2PR04CA0013.outlook.office365.com

(2603:1096:4:197::6) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7339.38 via Frontend

Transport; Sun, 3 Mar 2024 21:06:27 +0000

X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 172.232.134.178)

smtp.mailfrom=1fcgjgdyujyjhdhfst.decisionmakers.online; dkim=none (message

not signed) header.d=none;dmarc=bestguesspass action=none

header.from=1fcgjgdyujyjhdhfst.decisionmakers.online;

Received-SPF: Pass (protection.outlook.com: domain of

1fcgjgdyujyjhdhfst.decisionmakers.online designates 172.232.134.178 as

permitted sender) receiver=protection.outlook.com; client-ip=172.232.134.178;

helo=1fcgjgdyujyjhdhfst.decisionmakers.online; pr=C

Received: from 1fcgjgdyujyjhdhfst.decisionmakers.online (172.232.134.178) by

SG2PEPF000B66CF.mail.protection.outlook.com (10.167.240.23) with Microsoft

SMTP Server id 15.20.7362.11 via Frontend Transport; Sun, 3 Mar 2024 21:06:25

+0000

From: "=?UTF-8?Q?Health offer?="

Subject: =?UTF-8?B?TWFraW5nIGl0IGltcG9zc2libGUgdG8ga2lsbCBhZnRlciB5b3XigJl2ZSBhcHBsaWVkIHRoZSBvaWwgb24geW91ciBuYWlscy4=?=

To: sales@nk.ca

Sender: eWGDrvzOAqFY@1fcgjgdyujyjhdhfst.decisionmakers.online

Cc: sales@outlook.com

Content-Type: multipart/alternative;

boundary="_c5c3d281-a834-4c06-a424-3683f5f8b585_"

Date: Sun, 03 Mar 2024 21:06:18 +0000

MIME-Version: 1.0

Message-ID:

<7f3993fd-b36c-4dd4-976d-5233919d333c@SG2PEPF000B66CF.apcprd03.prod.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SG2PEPF000B66CF:EE_|TYZPR04MB8399:EE_

X-MS-Office365-Filtering-Correlation-Id: 378de14a-225a-4229-6be8-08dc3bc5c9e6

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

J+8tYw3eUIlve7qF8iHQZ5zDv/rlifoyXsmoij97yHV5sJXSO+o4RAFuzcrtuoF7+xpxel2LhV4W+NM0XF/94CUwVpAV5HgQCgmUMBMNzWylpXTef06iU2sQ2LHlC3fwlhx/9tmpu8Wd+LUNASU8zJx/Wcrklc2hEn+T+3q1lDcToAZcW9OzmvMnxBLKMbHT0pSNrPMASJAV3P5qZJ3a6rul3B8KLi2R4DbF3A4IcTSUkCZN3IDwt546YsF6swKWJyzd1cUB0Ql/Un5V17t7Z6BcNEkFnT8fm/bw+0NwN5bnG9pdeFh6x4rAuIW1Lo5qP8tbbZWKgMJ5M0kMnw9mcbUzuQxYfj0+KbOl+bj5ibPmtWRZtWkK+kFC+vpl63+uzlUMdZJOL9w9VrQEX3xWHzDaAQmGIqJaFsj5arsFQ0Sgqr2qSTJLXERRAeS1vQfZYXUpg8xJEC/bsi9EoclbGW5nDm18njXTe7EZwIrDS+wf3db/ZmRNm5POnkv7Dpg7VdZnP8rppSM3R8j6rFVtnhFJ+plz3hl/UK+SAEXU/fGvrX24PMeFTLoOAn6/nqeFJuuKMt4vq2AMBACRBfA9lK5QElGn2JiIIUy1HnW+nLiZpjr1pooSPORguZlxkJb4BeNvlF7xQpJRQjIV7idLIBdgQU7NJg2mHUbutJegKzeKpNDjYSr/QgJwon4efAj7egDSiO0HE8QX69JZdlrnrQ==

X-Forefront-Antispam-Report:

CIP:172.232.134.178;CTRY:SE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:1fcgjgdyujyjhdhfst.decisionmakers.online;PTR:172-232-134-178.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(34070700005)(61400799018)(376005)(82310400014)(36860700004)(41320700004);DIR:OUT;SFP:1102;

X-OriginatorOrg: 1fcgjgdyujyjhdhfst.decisionmakers.online

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Mar 2024 21:06:25.7778

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 378de14a-225a-4229-6be8-08dc3bc5c9e6

X-MS-Exchange-CrossTenant-Id: 9141e3d4-a023-490a-a3ad-adcbf644e590

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=9141e3d4-a023-490a-a3ad-adcbf644e590;Ip=[172.232.134.178];Helo=[1fcgjgdyujyjhdhfst.decisionmakers.online]

X-MS-Exchange-CrossTenant-AuthSource:

SG2PEPF000B66CF.apcprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYZPR04MB8399

X-Spam_score: 8.9

X-Spam_score_int: 89

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Scientists at the Infectious Disease Society of America have

discovered that tea tree oil can actually worsen foot fungus… Scientists

at the Infectious Disease Society of America have discovered that tea tree

oil can actually worsen foot fungus…



Content analysis details: (8.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: 213.232.235.2]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.101.128.6 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.101.128.6 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_VALID Message has a valid ARC signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_SIGNED Message has a ARC signature

0.0 BAD_ENC_HEADER Message has bad MIME encoding in the header

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_REMOTE_IMAGE Message contains an external image

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} =?UTF-8?B?TWFraW5nIGl0IGltcG9zc2libGUgdG8ga2lsbCBhZnRlciB5b3XigJl2ZSBhcHBsaWVkIHRoZSBvaWwgb24geW91ciBuYWlscy4=?=



--_c5c3d281-a834-4c06-a424-3683f5f8b585_

Content-Type: text/plain; charset="UTF-8";









--_c5c3d281-a834-4c06-a424-3683f5f8b585_

Content-Type: text/html; charset="UTF-8";







Scientists at the Infectious Disease Society of America have discovered that tea tree oil can actually worsen foot fungus…







Scientists at the Infectious Disease Society of America have discovered that tea tree oil can actually worsen foot fungus…



 



Making it impossible to kill after you’ve applied the oil on your nails.



Moreover, it seems that especially when used like this, tea tree oil can destroy your nails in just a couple of hours… 






Click here to find out:



Doctors Warn: Tea Tree Oil Actually Makes Fungus Impossible To Kill









src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6CVowIg-8fAZFsc8Hv6BiPcWjlv1WCHw-jNmEe1Ck3heKfBzMeeJwr2vlXQDF39Ss3ELm_lwgXctfbNs_8fT0oIUY-hzXcAwR4dAjO1_hBjl57hSAgAf_gGyCVxW8bMVBTUz4poUmFHV8mZhVuJ1osKuYH2Z7aMjBZ_T6q2Fp9whXOBB9WIZ9A3iBxiw/w640-h310/dfar.png">





src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjII835OD3VySuVQCZqK27eTEfKG3DyyScYQr22AdAtq5Uq5pLpM74MxqNVl5vf1YS6GFLbcRG-GTqkpZ6p9i1BHHaitNxwsAN256TIjvEixy0nmtYmHQiri6HMZ5prvZxh05D_CUGYsi4oLuVhO0O5CBWhklWgI_lHECIJ_M44MO4cvDkZjIDNh9VUqfA/w640-h48/dfar%20unsb.png" QQNpYMmGHDGG>












--_c5c3d281-a834-4c06-a424-3683f5f8b585_--

Health spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 03 Mar 2024 17:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgw8u-000000007ae-29vX

for dave@doctor.nl2k.ab.ca;

Sun, 03 Mar 2024 17:25:20 -0700

Resent-From: The Doctor

Resent-Date: Sun, 3 Mar 2024 17:25:20 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-bn8nam04on2097.outbound.protection.outlook.com ([40.107.100.97]:24576 helo=NAM04-BN8-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rgsbm-00000000Jqd-2qDs

for root@nk.ca;

Sun, 03 Mar 2024 13:38:58 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=X4zMCsbzE8Udj14xI1qz3ly9XBx7oix0p3AZzbwB9QnwxW0ZuEQLzrs2sD1oGTfOV7XRWRryD1fAB+lCPmAlqNgY7nSHxldr27gGCi3WE6GkBsmhuABqb1jCMYBrqExwIsi4xM4TitTglDZSzc8gDjwRUzEMhefw7Sh/LuInXCx1dvPApx70Q+jDPzGh9G5toCbtNuJspsWGTEyT7r0sNFZPP+YrHWltZk9X3NNT/f1q3CMAsGITSjoe+KF+lcyVCeoARYoF9hE+W3niKuJm+Ug0C2WcHgDiBASOYwtSizgzxVDTyg6BdAHrKNfMzJE8jtWTbXd/PwbquBHRyMxpLQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=0P1M9f23SqMJ61ZnqRC5PY2BH2BYgoLgbjpV5Y7WE/E=;

b=LHFefJu35CYJ3plUNSW4fXnsKt68M1cpRCTCpEccIxH/2OU6E/8BpD7bmw/Kxl3rtYxX66/nk2BGHs2ZX8jg3c08aYiCRImVl7LJJsZk5/ShycwYA2rQggAcvXykONPCxHavylFfaV3+sKHcxMv1zG2xcWDxTku5SKmO/jDTHWK3uEg5kaIOd0U0J2B/DUfCfeZl23S081rDP0bhdBuhQOf5GwthQZRfjBzsr/ox2D3Vd2gZdC8OHnpTek2mDnZGegRhfGd9pwxbhozlUHQZX5vWkoPQWekD/u1vCMyKjVfSi59BwbAb4QNS63nPV4wUt/BAHpopOtGcxAQ1eQ2waA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=tldsgjm.psld.sbs; dmarc=pass action=none

header.from=tldsgjm.psld.sbs; dkim=pass header.d=tldsgjm.psld.sbs; arc=none

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=tldsgjm.psld.sbs;

From: "New Health_News"

Subject: Stop your-pain now!

To: root@nk.ca

Cc: root@outlook.com

Content-Type: multipart/alternative;

boundary="_84f911c3-9953-4c5f-b506-376ae10419f6_"

Date: Sun, 03 Mar 2024 20:36:48 +0000

X-ClientProxiedBy: YT4PR01CA0461.CANPRD01.PROD.OUTLOOK.COM

(2603:10b6:b01:d6::29) To CY5PR19MB6169.namprd19.prod.outlook.com

(2603:10b6:930:2e::18)

Message-ID:



X-Message-Flag: Flag for follow up

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: CY5PR19MB6169:EE_|SA0PR19MB4351:EE_

X-MS-Office365-Filtering-Correlation-Id: c921e22b-4f76-477b-a826-08dc3bc1a7a1

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

7mwBobIK0CcqEMMdyhip2X3YQsZndjA97vvBs8Qt38QyGCFvPBbCC4g6l6VyzZONsfZN17DeIP7NPB6Wh++3tWoO6g32yCQwezjeW7rLa4LZvIRMttoO2NvbbS/xmIekFEHFa56FoA0ftzCFiySltDdVZlW6WkpoPn+wzSpQkoVbp9UeWwJ17GBljZUDT6iiHa7m2RgsraWi9jiZDFDKUH7aB2G0/Pos5dhmu/Bi2hKyFXKE5/0cTHkGMN3dMO2i9nE6QLlb/qM2Smg7wQ6yem1Ypt+Putyz8r1Pakb+EHMPoip6zeVyWI6jCxLW7QNt+CeDgwNETNL6qm5Og4CGx73P3BxVqv4Bf1Yjk23q2gxatonvcSM6upaalETNWecmDNiEa6uCsmwBCwxmrZiDM9Y09n8ZuG0c5hdIBpW/PnhbTnOBID7bMvADrXcFU9s3GQ5ybxx7HvoQUL2b4HVqOI7ozGRV8mKjzNbyDl7CHV1KsB28G3u7CwQMti9Q99FVn9ouF92nBgSpYFIhXf6GtB0hg7TOAxOUmljnowZxjvsxtzCFi2+RgTFxamuWuENb1F15HNCdszaqwle4n+m9UWL9cUBOk1AWGyQ46gOy/bk7HEBswbaZCeaW9evW/YLuBgOIjlSNXsfYc0c2LfVWMUjpvvM2AKv1XBjA2lQ7str2R0VSmEbrkTtxsZ9+o85Q

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CY5PR19MB6169.namprd19.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(376005)(41320700004)(22042699003)(37730700002);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?UmVTZzdINi9lSEtyZ1FDb0I4VnhLZU9MWVppVEppSDhtMnZ3NE1xOEtsbDM5?=

=?utf-8?B?cDZCRnpNdGhwMFF2OTJZRGdLdVF0cHI2QnMvTzFwNFNKU296QnFFK3RWRCs1?=

=?utf-8?B?OHcxTS9KdlNwZmN6aGthUGVPNEtlQlBCNmJva1FlZnNDZFRHdElHR2R5UEFr?=

=?utf-8?B?eWtrMGozd0JFekNFRkYwcW5DOWJZUlJ4dit0ejVmMm5sdkZnUEVER3pOWTJo?=

=?utf-8?B?UHo5enVnWmhCREFPaVhtTlh5UFRZb25lR2QzTWNvYm5JMDhqcEczVktRV05J?=

=?utf-8?B?Nk9jM200c01OU1RBcFpZZEdGMUdUV3c3NmNEaGZ3MzlzNG9RMndnQjMxVzk4?=

=?utf-8?B?NFlvd2JFaFdUc09PQ0lPdGthaDhkY2xyQ0pIOUE3RUVIb1hnMUk0aXR1eUpj?=

=?utf-8?B?MTd2Z3pGczk2VlpIWUVOdXlKK0dHMnhpR01CMFoxUUU0cklXMUlQV3pKYnpM?=

=?utf-8?B?d21PQWpGSHN2MVE3Rmp6YldGSzBhbkluTENyenhhNGdVcVc3TEI5aFJydVRB?=

=?utf-8?B?aWhuT2ovQjhpTnpVblpRVFAzK3JKbWJsN3p2VDdQWFBXem5mYkJzZkM3R01j?=

=?utf-8?B?b3NGeVZOL1VkNUR0ZnhCRzJNWkN3TzdYM2tkYnZGOGVTUlhncEdLQXFWRjcy?=

=?utf-8?B?ajQweDR0Y2d3d1oxNUMySk4yOWtqaWRrU1pxd3A3U2hUcHFwWnZKcEJtR0gw?=

=?utf-8?B?SkZ2NnYvdk9WRUM1TUpGb0lxOEV5elh1b3hJOUUyTFh0ZFZVemtEMVZGbWpu?=

=?utf-8?B?bmFPYjVKUjBlclBGRWc4UGdFa1RidFpZZDB1T24weVRvaXBkb1Z0WlUyaVhS?=

=?utf-8?B?MTd6TU5tRWhoSHBud082ZDhCbjhqUCt3aTZMM3ZnT3p5N1hTcXFDVFJzaVQz?=

=?utf-8?B?ZEVRL3puWk5qdmk4V1dTdWlWT1l2Y0xFbHFjUnRmc3VYKzQ1QlJOMXYyeU5h?=

=?utf-8?B?VEJWZURnY1pZMDY3VnpoSzFjb2cyak5JRGFKbXhEQWFFYVNVVTBzaHVwdUZl?=

=?utf-8?B?RGFFYzJWdm1IZDhGbFVEbTJiQ04velRrTmFEYlk3MnBmRnU2bGd3MHZLeXBs?=

=?utf-8?B?RnBLTkJXd05OSU4xUEZVdGxBelRXMjVLVUN4N0RHQU91T3JsZ1gxbmkzS3Zv?=

=?utf-8?B?ajJCTWM4UFNnRFVvbmg1QUp3c2VLUlJzaDQ1UG9FRFFUb203VFZkdFFBN1M5?=

=?utf-8?B?ZGJCekR6S21SQVJZL2w3QjZpVnVmM0dZcDFhSnRxWHZJeVgwN1VEVVZwSXBU?=

=?utf-8?B?bkdndWhtOG5ZTmI1cUJjdDhKVFJ1UUlzUmgwRGFZaXRTeGNuMTZGdmhib2R0?=

=?utf-8?B?UjQ1dW9EVDUwWVpmRHc5K3hPem5ibXhxbUpKWVlVdURtejYrb1JpQUZHMC85?=

=?utf-8?B?bUhnZGt4VENUV01SUFA4VnYyTnRvUGhtZ0d0WDZTbVZ1ZWJqVUxocmJRSWZ3?=

=?utf-8?B?U0wzejFNaitJVnhBbUg0Zml6b0pIT0hadzdTMlR4Vm5GTm4rZVVRdmpocTBn?=

=?utf-8?B?WkdSRUxSZDUyZGVXMWExditUWnRQRTZoN3AvYXlVR0plY3pzcjBPWGdMSEtE?=

=?utf-8?B?TEgzV3BmNkZOMDV4MjJJK2VXZEFkWUIzeDByaFh5a3pOeXdFRUcvclZNZndn?=

=?utf-8?B?WkJDY05yNEdnYlVvWEQyM01vVCtBdm1ua201NlZYVklOM0FLYUhoNmh1dC8v?=

=?utf-8?B?Nk5Na1ZheWFxMnZwd3hkQnhJSjA2b0hoKzRITUhVcVdqcE5ubjZQRk9WZGVm?=

=?utf-8?B?Yk0vSDNQU1NwcWQvNHk2c1hwYk8wN1ZTTmxLdlJyUGV3MEdEaENjVDFYL29U?=

=?utf-8?B?eXZaZDVLZWNJVk56Q0VmUXMxbHNTMUZRU3VMTlI0MVNhOXNsV29BUFhKSkdS?=

=?utf-8?B?QUZZeWROZSt6ay9EM0V5bEk5YnlMQ3NiVlVoaUpuWllwRElSWXJ3eU5DSHFk?=

=?utf-8?B?ZXN4cjJrN09ydjhKMklYZ0plL3liNmNNK0JORzdtTmRCSHppZkxJc0ZSUjQr?=

=?utf-8?B?UVR6VEtvYkc2YzFkcDQzL2tXai9BV3JaU2dBME0wOHhVUXgrK3NqSDVMblM2?=

=?utf-8?B?ZmFCSk9EcXdYY0ZGSDNNMU82YW9MQTgxYk9yM1dmV2pyL3FwMk9TZXVxbVA2?=

=?utf-8?B?RUJhT0szK1dMMzF2Uk9XQ1ZsTE1sY1Rnb1AzcDFHR2VGTHdhZWI4V1BZNHNx?=

=?utf-8?B?dGc9PQ==?=

X-OriginatorOrg: tldsgjm.psld.sbs

X-MS-Exchange-CrossTenant-Network-Message-Id: c921e22b-4f76-477b-a826-08dc3bc1a7a1

X-MS-Exchange-CrossTenant-AuthSource: CY5PR19MB6169.namprd19.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Mar 2024 20:36:50.9855

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: b399de52-139e-47a7-ba69-8de7506e4b3d

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: 2zofNmBqZmfuB4cQOwawQQihxgk5nGX01jVrjF7XLPs0ToAuWOxZbmcHg44PpuNnq57w8BQS+QSePMk01M0zshmaeb4RzXYipW9Xy96O3i0=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR19MB4351

X-Spam_score: 6.6

X-Spam_score_int: 66

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: This unbelievable remedy has helped millions! The unlikely

source of the amazing pain-cure!



Content analysis details: (6.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.107.100.97 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.100.97 listed in wl.mailspike.net]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.5 FROM_DOMAIN_NOVOWEL From: domain has series of non-vowel letters

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.0 FORGED_SPF_HELO No description available.

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

2.7 SCC_BODY_URI_ONLY Very short body with something maybe clickable

Subject: {SPAM?} Stop your-pain now!



--_84f911c3-9953-4c5f-b506-376ae10419f6_

Content-Type: text/plain; charset="UTF-8";









--_84f911c3-9953-4c5f-b506-376ae10419f6_

Content-Type: text/html; charset="UTF-8";





This unbelievable remedy has helped millions!


The unlikely source of the amazing pain-cure!

















--_84f911c3-9953-4c5f-b506-376ae10419f6_--

Health spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 04 Mar 2024 08:27:03 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rh9sB-00000000DiG-3nFJ

for dave@doctor.nl2k.ab.ca;

Mon, 04 Mar 2024 08:04:59 -0700

Resent-From: The Doctor

Resent-Date: Mon, 4 Mar 2024 08:04:59 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-psaapc01on2134.outbound.protection.outlook.com ([40.107.255.134]:45152 helo=APC01-PSA-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rh8pN-00000000BdL-34Jt

for root@nk.ca;

Mon, 04 Mar 2024 06:58:05 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=dbMzJzBUG5cCEn56RpaTIJIW4zXFZu4+IqNZ3+/Z51I9hqrwgQH6ikteR0JgRDrPQNPPVJQwtDW8sZMsyY0loFSLujFtpDAa1AHw9bxCMAj+sc77OApW8CEBJ5Spb5PI1b2FHYdMFtJgU22fOptO3rSvgzmwJzA6Z/+17iNNLsetnf18PIzD1fppTIS02Toplj7ef73PPM8/bmhJ+dyguTeIzTHlN/lPXipgIAmPIDrxnWeUb6asg1QZ5hgVxIXM9X+yuZnHZA+4xrBYjk5gnYyv/rp5sf3tFpnpc2RqXhchwCpt5ujQQ9GACbtqpNVtSE6zEnueD2S7PP6/X/pH7g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=zwnmIsUahO7bu1Rl8EIL3m4tIOYIlxsia7Eyy2zf8/Y=;

b=OZV9zADiC3uGkq2GmJYHIfvReoqpUWDufAT+QLvaR8s1QHba14O/Pddx5+M+gtUqUCfrfR9PZ0J5N1fB6Mt85Q2krLVgp/fZx4raM8FuqRQfXenmRY3stgjrIaW5zqRP3tIOizmRwo9t0AGuRPGnkwCrIm93UYqlw9qOv0RpPwOBsuTdA9ZCp3ji1BrOMSjLCnwj08jTYl8DedxVfPVtpJiCYiIjaZ6jP3/egO9oBAs1uod53gbYs+g13CuACnXsK713DnVZqUFkh6H1CVPxWP1rBnFpLh6aOKYNcVUiV1Duq2j7sEV+IWW997KfOc5iFrYFKrsdkvgJW7gjpiWtVg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is

172.105.21.95) smtp.rcpttodomain=nk.ca

smtp.mailfrom=15dguhgfjg.volcanicallyactive.store; dmarc=bestguesspass

action=none header.from=15dguhgfjg.volcanicallyactive.store; dkim=none

(message not signed); arc=none (0)

Received: from PU1PR06CA0012.apcprd06.prod.outlook.com (2603:1096:803:2a::24)

by KL1PR02MB7142.apcprd02.prod.outlook.com (2603:1096:820:110::8) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7339.37; Mon, 4 Mar

2024 13:55:58 +0000

Received: from HK2PEPF00006FAE.apcprd02.prod.outlook.com

(2603:1096:803:2a:cafe::e6) by PU1PR06CA0012.outlook.office365.com

(2603:1096:803:2a::24) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7339.38 via Frontend

Transport; Mon, 4 Mar 2024 13:55:58 +0000

X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 172.105.21.95)

smtp.mailfrom=15dguhgfjg.volcanicallyactive.store; dkim=none (message not

signed) header.d=none;dmarc=bestguesspass action=none

header.from=15dguhgfjg.volcanicallyactive.store;

Received-SPF: Pass (protection.outlook.com: domain of

15dguhgfjg.volcanicallyactive.store designates 172.105.21.95 as permitted

sender) receiver=protection.outlook.com; client-ip=172.105.21.95;

helo=15dguhgfjg.volcanicallyactive.store; pr=C

Received: from 15dguhgfjg.volcanicallyactive.store (172.105.21.95) by

HK2PEPF00006FAE.mail.protection.outlook.com (10.167.8.4) with Microsoft SMTP

Server id 15.20.7362.11 via Frontend Transport; Mon, 4 Mar 2024 13:55:56

+0000

From: "=?UTF-8?Q?Health Affiliate ?="

Subject: =?UTF-8?Q?It started out innocently enough=E2=80=A6?=

To: root@nk.ca

Sender: PPSQKbbJGbao@15dguhgfjg.volcanicallyactive.store

Cc: root@outlook.com

Content-Type: multipart/alternative;

boundary="_0d86c7ae-d398-44d8-a83a-ea346be680c6_"

Date: Mon, 04 Mar 2024 13:55:50 +0000

MIME-Version: 1.0

Message-ID:

<216b8b6f-446c-44d1-9844-be3ed975c33b@HK2PEPF00006FAE.apcprd02.prod.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: HK2PEPF00006FAE:EE_|KL1PR02MB7142:EE_

X-MS-Office365-Filtering-Correlation-Id: 5ed605b4-f43c-4dbe-a267-08dc3c52d126

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

5rx5J/SerCKe1XAJYHgLjNvXqr0vmtGo10Wo5MeNAHy1zxLTFMZDrxKwKrgrNv97dVTGNT3Ejey+yCh5Kt4xZ5fExI/3pt/AA4kMsdA76TQjL+GMHmkCUWG/thvkP9HhefQzfWbnVYTSsa4/FxYBSmle/v1IlK/3EfbMxUJP095EXCkxadctiDXp67XwT71E4eQ50DxhDHLUdYzyfeUGKznap2YqTm82ZfPlyYcK1SUvhgw+0rLqWCogTaTxFsaBV1qeg07H501v3fplFT5xfNIksx65MV0TSnqRH/j4DwzbJpNvMbqQXA+X9XiFVn6KRTZwrektdwfkWIqk+UxWq2JXoVBQNlkQwSZgkCqgdjnunUcL0vbQn6ahJMP5nrxUyQsFuU4wnvJZOLFyI6PvN2NQxe/DWpC4AF5oghEjX3FRRHtxRv5F/3cLW0zJM2b3Z2WqkamY1oK6fJp2m0jMrcgsyG67NTYsl6clhcfy/pc/+Sf3CEG3MQV8Q5IUXIa4PXy7d7vEY3/+WYG85avT/Nxiwef2wepupGD5V4G0MbEaaJ3Tdks8b1/UwjhtgSJsW3gShdAid6tqCGGkKzSSPm+hlp4COT+IcTIm9sixF966A/SDcy3gj/hrY3j1t+i3/VW0Wf0WV0VwxAO+J71JgoT//EKe60kJdfdf/Y814pPw+OP5uRrKh2oUM6R5CI4HHQSUjbe1U2f5HR6gX9rjYA==

X-Forefront-Antispam-Report:

CIP:172.105.21.95;CTRY:CA;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:15dguhgfjg.volcanicallyactive.store;PTR:172-105-21-95.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(36860700004)(41320700004)(82310400014)(34070700005)(376005)(61400799018);DIR:OUT;SFP:1102;

X-OriginatorOrg: 15dguhgfjg.volcanicallyactive.store

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Mar 2024 13:55:56.9191

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 5ed605b4-f43c-4dbe-a267-08dc3c52d126

X-MS-Exchange-CrossTenant-Id: 495b80d5-d650-4a23-be96-124d50507823

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=495b80d5-d650-4a23-be96-124d50507823;Ip=[172.105.21.95];Helo=[15dguhgfjg.volcanicallyactive.store]

X-MS-Exchange-CrossTenant-AuthSource:

HK2PEPF00006FAE.apcprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: KL1PR02MB7142

X-Spam_score: 5.4

X-Spam_score_int: 54

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Find Out How To Save Your Brain And Your Memories Today!

It started out innocently enough… Working with limited resources in rural

China, a doctor by the name of Chung T’Hsu sought to cure the ringing in

his ears that was driving him mad.



Content analysis details: (5.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.107.255.134 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.255.134 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.0 BAD_ENC_HEADER Message has bad MIME encoding in the header

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} =?UTF-8?Q?It started out innocently enough=E2=80=A6?=



--_0d86c7ae-d398-44d8-a83a-ea346be680c6_

Content-Type: text/plain; charset="UTF-8";









--_0d86c7ae-d398-44d8-a83a-ea346be680c6_

Content-Type: text/html; charset="UTF-8";





















Find Out How To Save Your Brain And Your Memories Today!















It started out innocently enough…





 





Working with limited resources in rural China, a doctor by the name of Chung T’Hsu sought to cure the ringing in his ears that was driving him mad.





 





He turned to traditional Chinese medicines, but took the exact ingredient specifications from Western studies





 





Finally, he did it, creating a treatment that cured 322 people within 7 days!





 





But instead of allowing the treatment to go public, the Chinese government classified it as a “state secret” and made his life a living hell.





 





Sound familiar?





 





That’s what happens to our best doctors here as well. They’re either paid off or threatened to keep their life-saving cures buried. Anything to keep the drug cartel that is modern Big Pharma happy and rich.





 





But I won’t allow myself to be intimidated by them anymore. I don’t know how long I’ll be able to keep this up, so click on the presentation below and find out the truth about tinnitus!











src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiL1o2jCAlZn4c0dHaLcWVZk4LzXppCEMqoWLwgEsqeKISUs4Jt06QNMFVTORVNJHv2NFghquBBbOrm3_jJgbeER42Ox3Xdh9FQR5hzXzp5nswSu3sZ7jOGecHFsgDBfXQyQTlEL5PD_Xv84OulqVVWsUP-ii16LXGXT3rSciQBuuJrN4joay6XhssoHCVa/w640-h276/oreil.png">





src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9qk_Bqd0Son6yvjIzpe_H-qslfUoDZkjpDqJeKQqv8uloP-_oN-TrFrGff9zwS_2cLQkY2owEYINMOixva5qYhyphenhyphenTvJpnxyhqEN4ZH_8sxApKgkFniuTU3ID-VQywCABeIVx6PxRW3QgfuRtoALiZk-dSS9r22DTA-fCJRkuWL-H08oKuL1ql-V8iKPfKw/w640-h18/oreil%20unsb.png" rHazSthpbAFr>











































--_0d86c7ae-d398-44d8-a83a-ea346be680c6_--

Synoshi phish from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 04 Mar 2024 08:27:03 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rh9s4-00000000DgA-3fnT

for dave@doctor.nl2k.ab.ca;

Mon, 04 Mar 2024 08:04:52 -0700

Resent-From: The Doctor

Resent-Date: Mon, 4 Mar 2024 08:04:52 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm6nam10rlnn2070.outbound.protection.outlook.com ([40.95.32.70]:13216 helo=NAM10-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

id 1rh72c-0000000048J-3Dva

for root@nk.ca;

Mon, 04 Mar 2024 05:03:42 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=EGG2IJB9QBioa/ooi25S8m+QMSttvQR5SsIPXYnp1YTeY+rHuRsqBOD4NyAEejC9irgP8g9f4MA1pM/znZZQRiuwkWKeWPCLDvbEVTmNghFIlIOzYCN5NDRQlY8xxKs+U+36IpoI50Vfo8fzBeLR9GWHSrFBuXL+lLv+Hohq/CQ20IbGbFCdPiqQGBA/lPbdYrkBkzoDaUzlTJ4fWQ/VYhcYwKOZ2w+OoMwYhgFTOtsMMouxnDG2BGDfkuuD4iDHbCOnQnV5Y/PfCgRiuUBpQwq4ozwuyenYnwKdNuX0E7ap1k+wgRoxpPtZkyGIrcp4/b6Xtgy4ZaeaZLiJb3F9gQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=HbmpoI6R4W7uuZRX6ZAVTp02i/ZPas/sPeXgwFClwbI=;

b=b7TnP+7Nm9Uq3C6MXRSpNa3NU/PeVrAMHchRaZtEhvdGWKKJdpNuZ1PnL2oFjnwfqevG8yVxl8s/3wqBJnruQsd8dZVpwBh1cH0QyZJvyNxMAhn9RA4lBoudcJ4YIS/FzjL3pb3bboBmVVnl38TGbkd9Pqk3JMiNnFvCNPS61mK7EITd5GclhZLM9o/FmNfVQUUPaVLVvMiIGMtaB0xO13K42vun7HQT6OghDq1MM5ngy7nvXBeqvVa1vIJI4R3h76Fx1qRx53maji86fum/zg+jlm04NrRDuOAMggrGknR6mN0mjGihzZX/CKkA0XM2mHq3bVKUq28c7j3VPh2Tow==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

45.138.51.222) smtp.rcpttodomain=nk.ca smtp.helo=vnpoipiyuimio.kfdf.sbs;

dmarc=none action=none header.from=vnpoipiyuimio.kfdf.sbs; dkim=none (message

not signed); arc=none (0)

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 45.138.51.222)

smtp.helo=vnpoipiyuimio.kfdf.sbs; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=vnpoipiyuimio.kfdf.sbs;

Subject: The EASY Way To CLEAN Everything SMARTLY!

MIME-Version: 1.0

X-TOI-MSGID: <101741870567062.AC354F821938C.1705442930402@vnpoipiyuimio.kfdf.sbs>

From: Synoshi

In-Reply-To:

To: root@nk.ca

Content-Transfer-Encoding: 8bit

Content-Type: text/html; charset="UTF-8"

CC: root@nk.ca

Date: 03-04-2024

Message-ID:

<582ef823-bd27-488b-8316-b1281139ba67@DM6NAM12FT070.eop-nam12.prod.protection.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: DM6NAM12FT070:EE_|SJ2PR11MB7476:EE_

X-MS-Office365-Filtering-Correlation-Id: 3c7dc143-61e1-4424-87f6-08dc3c42d56d

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?RXF6S0FudGRra29GTXc4STNjYkdUYzA0dGJqNmlrOUF6NVRzdVdSd1hXN1l0?=

=?utf-8?B?UHJUY25oVlRhdGxQL0tGaFhnVGhHRzhDc0dJanhSN1BDRjhrNktLVUNsejZF?=

=?utf-8?B?M0dzY0tqN0twZGZ2ZW1rTkZvK2pBY3IzN01xc1NKQTljSHJyZVJhOHQzQXlZ?=

=?utf-8?B?MUF0MVFaSVpCUkQvNWtUM2hXL05Rc29oU3c1VE9UODI0MmM2S2U3U21iT0ZJ?=

=?utf-8?B?K3RURzZ4cXRzNFU3clM5dHdUNnlRbFc2WUxkZGloNVVRYXBicm9nYkxMcVNW?=

=?utf-8?B?UzV1ZHpzaFByWG9DWUdqRUdZc3c1blJSYWVMVnQwb0NBb08zNEN5NUtzUEMr?=

=?utf-8?B?TStvOG5BWXNrd05VbjF4dzhQUXhHT2J5bzNWdnZHYnp3VkZJeENVSnRjU2tX?=

=?utf-8?B?QksrQmR0QnlYMThFSDFISmNKQWJxRkNGL0laL1Azcmd2dTJvbzNlREx4SzNQ?=

=?utf-8?B?cm9qMllBMjc4YXYxMXlFclpPbDBiWUswNE1Ud2lwTW1UNU9nVllsZTloQlAr?=

=?utf-8?B?MzVYTUNoS29lZjNaYmp6S3o0YlI1Q0dZY3FIUkQ4bnlzaVZLSFgxanpYbUUw?=

=?utf-8?B?TkNleE15dkhNVUdzQ2FZUEVjL0xqVXJ2a0VwclJ3aDlHdnAvTjhaYTkrUG1P?=

=?utf-8?B?UFljZXJyNFFMd1AyVlU0cG1DVFl6ZVh0ck9oQXd0alhsR3BCNXVINDBYYkVh?=

=?utf-8?B?Nlc4a3pPZWFVVzEvaWFma2FMMXdTS2ZneS9BZnR1cEtxMUkrV3RVU0NuK2FB?=

=?utf-8?B?RzBxOFJlNVI3Tk5zYlNraTJwZ3VVaXYxRHQ2cXduNUhZdTFMd1U4VG12M1FG?=

=?utf-8?B?cE9zdXM1YkRYdmxTemdNNXJXNHc4NTY1a2NNckQreGEzYU5KQWEwZVFVNEln?=

=?utf-8?B?TlBTVzVNNHhSWGhVN1VyN1J5ZVFHdE5TR2dITHNXbEtGTThCOEdCVzlGbVBx?=

=?utf-8?B?VFhMZWgxNjRNRmUyeFpaWWdRRlFnek5DcmlwRDh6ZVRuRTE2L1lXb2dNYmpy?=

=?utf-8?B?YjYxRC9jY2RFN0hFNDljN2VkSlFreEIzSGlyS2duWnVCcEVLOEhUZzFpVElO?=

=?utf-8?B?RDZUMlptU2Z1enlGbm5Rbjc1ZHJiQTVvejBNcHp4OEhhbVllSmlyOFp4dDhn?=

=?utf-8?B?QVJhTmdKdThML1JGYjhldTJ0M3lnOTNpZEdzYjVES1kyOGxZZDF1KzZWenNh?=

=?utf-8?B?N2JncXFnTllMdFRST3hkd08yVDNIM3pwRlR6SnFxcWdTSXA4QlE0aDVkWlpT?=

=?utf-8?B?K2NYY3VBR3ptQ01wdmtBa2hFRlgvelNueTcwQlFkcEdOZ00weWUrUGlVMldP?=

=?utf-8?B?S2Yvclk2SjUvVGZicW1iVUZOOFJVYy9CWVhwVU1YWFRBV0pDNU91T1poSFhJ?=

=?utf-8?Q?LL6HYCzHzCIl7a4aGJXcpaNQ2UydWvWw=3D?=

X-Forefront-Antispam-Report:

CIP:45.138.51.222;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:vnpoipiyuimio.kfdf.sbs;PTR:msgbase.thatsneo.com;CAT:NONE;SFS:(13230031)(41320700004)(82310400014)(34020700007)(61400799018)(376005)(35950700004)(22042699003);DIR:OUT;SFP:1022;

X-OriginatorOrg: vnpoipiyuimio.kfdf.sbs

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Mar 2024 12:01:32.3188

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 3c7dc143-61e1-4424-87f6-08dc3c42d56d

X-MS-Exchange-CrossTenant-Id: 8f708045-0f41-4b53-b2c7-abd03754f2c1

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=8f708045-0f41-4b53-b2c7-abd03754f2c1;Ip=[45.138.51.222];Helo=[vnpoipiyuimio.kfdf.sbs]

X-MS-Exchange-CrossTenant-AuthSource:

DM6NAM12FT070.eop-nam12.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR11MB7476

X-Spam_score: 11.9

X-Spam_score_int: 119

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: (1) Notifications Synoshi Deep Cleaning Made Easy



Content analysis details: (11.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.95.32.70 listed in list.dnswl.org]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=NAM10-DM6-obe.outbound.protection.outlook.com;ip=40.95.32.70;r=doctor.nl2k.ab.ca]

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.4 INVALID_DATE Invalid Date: header (not RFC 2822)

0.6 INVALID_DATE_TZ_ABSURD Invalid Date: header (timezone does not exist)

1.4 BUG6152_INVALID_DATE_TZ_ABSURD No description available.

1.0 HK_RANDOM_FROM From username looks random

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} The EASY Way To CLEAN Everything SMARTLY!











(1) Notifications





















































Synoshi







Deep Cleaning Made Easy






















Health spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 04 Mar 2024 08:27:03 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rh9rp-00000000Dbl-1Mcd

for dave@doctor.nl2k.ab.ca;

Mon, 04 Mar 2024 08:04:37 -0700

Resent-From: The Doctor

Resent-Date: Mon, 4 Mar 2024 08:04:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastasiaazon11021007.outbound.protection.outlook.com ([52.101.128.7]:27112 helo=HK3PR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rh7n3-00000000I3G-3a9v

for sales@nk.ca;

Mon, 04 Mar 2024 05:51:39 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=GcaAFR+CXqs/ACJ+DTW/UHWO7HpC29qLtoXkSjPNnaIA5DnfReylQdsuR5v76vDh+Tu0QPgHiVZTcQtgOR9dN5yF+NR7YJ57giw4lqrHdpyyxDhEQgr/NrTVEbT6pc2FWgKun4cknvarawnHv6lEOoMoTEaDZUyGg4m2FW2lRJAHTdmulkHJqr1PVg32YboRncanbfs0nlykRRC1Mjh69Ots2XQAsWOdGG4HsXU8fg9FauXe81i3D0MTG+Z0zbb3ZiECMfe42MeGEQ8efZl6X4DwtBpTGXZhqJOFg/DQMJMo/XyaBHRacz/Ks6F2JalpA8e+0UxaKfY9xJJrs9rOow==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=WWh2DvyHd8AqC7m7Q8at6hMQbQJB6A1bmhld67mPdbY=;

b=JJc5hhzdo3Xp/SEwsoYI2qgyYw/HCqA3ueGwWGHEwer0y2bISZM+G7HfDm9auovUll+kQMVtn9z60G5hNN5iOSsx3QjcXb6F5OI7V/tiCEACaAmcoYJioG+vowrSSYDksB+Ckr9oTPgoTZ+p0r18lwj5tX0IRiLvYZSnRNvR3NatF7iBxBMrzjTv21Si2FOAIQRqDOx/vfKljtAuyDYKb+flc9jXRWgdMvPP7Fb0TM8mSGfYS7yJGG+Rv0rZk7BZllUbZ0IXUvsCPDkvyMIIsFaP7QG94mB+icRWxTVLMUNgh5Fl1JzhBVJy9hxt0GwgKQJE9P5TIp2GdCV1fWTHHA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is

172.105.21.95) smtp.rcpttodomain=nk.ca

smtp.mailfrom=15dguhgfjg.volcanicallyactive.store; dmarc=bestguesspass

action=none header.from=15dguhgfjg.volcanicallyactive.store; dkim=none

(message not signed); arc=none (0)

Received: from SG2PR02CA0014.apcprd02.prod.outlook.com (2603:1096:3:17::26) by

TY0PR02MB6218.apcprd02.prod.outlook.com (2603:1096:400:273::12) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7339.37; Mon, 4 Mar

2024 12:49:29 +0000

Received: from SG1PEPF000082E3.apcprd02.prod.outlook.com

(2603:1096:3:17:cafe::61) by SG2PR02CA0014.outlook.office365.com

(2603:1096:3:17::26) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7339.38 via Frontend

Transport; Mon, 4 Mar 2024 12:49:29 +0000

X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 172.105.21.95)

smtp.mailfrom=15dguhgfjg.volcanicallyactive.store; dkim=none (message not

signed) header.d=none;dmarc=bestguesspass action=none

header.from=15dguhgfjg.volcanicallyactive.store;

Received-SPF: Pass (protection.outlook.com: domain of

15dguhgfjg.volcanicallyactive.store designates 172.105.21.95 as permitted

sender) receiver=protection.outlook.com; client-ip=172.105.21.95;

helo=15dguhgfjg.volcanicallyactive.store; pr=C

Received: from 15dguhgfjg.volcanicallyactive.store (172.105.21.95) by

SG1PEPF000082E3.mail.protection.outlook.com (10.167.240.6) with Microsoft

SMTP Server id 15.20.7362.11 via Frontend Transport; Mon, 4 Mar 2024 12:49:27

+0000

From: "=?UTF-8?Q?Health Affiliate ?="

Subject: =?UTF-8?Q?It started out innocently enough=E2=80=A6?=

To: sales@nk.ca

Sender: YedqQhZrZafh@15dguhgfjg.volcanicallyactive.store

Cc: sales@outlook.com

Content-Type: multipart/alternative;

boundary="_80786f1d-6ee3-4249-abe5-8080ca445fa0_"

Date: Mon, 04 Mar 2024 12:48:50 +0000

MIME-Version: 1.0

Message-ID:

<5b11febe-f98b-4884-9e53-ddebb15372d7@SG1PEPF000082E3.apcprd02.prod.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SG1PEPF000082E3:EE_|TY0PR02MB6218:EE_

X-MS-Office365-Filtering-Correlation-Id: 5114fd84-0c79-4adc-a92b-08dc3c498742

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

MCdMAb5zrSWV4DP0Pqnx509lokpK4SvuNTp6OSUPOeEwRDppg98ifdr3SzwjFhVHLtCht2vU3tsWnW6L5F3FF1dEZW2UX1bCbi8g7DN5AHlqLCoQdOyZjnLuV9U/7F7wsNtqddNJNT380tn9NoRRs65GWWf+4o1jDjyIABwuyQP1Ak9/S3XarWr6XdlCyWCEkQWAHw+nEi8VAjvSbOQoFakaXOdfUYXr4pwc8eO0Do/PDOA9uNj74H/O4pSKMhiY282gAn+kRfT7cSxdIP3TxO1EZkIlC3Ac9mPJ2DuSevazUNS1VlI06PHvejdlF+UJiKI0byq8Q340cVcEsAQtxwtta22Jaz5YBjiBjhUjcKsT87740Y7Wrf8DQYthpmuExdVw2ezKPK9GFuRDD4Ojf+GNQUJQpDovad56zlkw0yYiNzSTk0ktnnb+rybsKhULrlkTsSitZBc6Q9EJBcXPCLDcevOSXoVKy/P8jKsdDBfLcZgebyCtfTNEgIz74WACqUq1iCPQKQzp0FxEX4He57zhfnBE1QXFeDk2Y0zdw4Y29lvEYAgISfKIolxnYCmk0zo+fpfWswyuR2k1weVVoPVTXXSLa9aAb+sRFVV+QqzPnBw/nEOpTrgj8MK0MWHEpE0SS6O6Rjo8NVD060DJVed2lOjcK8k/DBrL8TmHkIO4gWOsdVYkQkG6S9DetCVDX7qMP9aCIJ8uc7+iO6Ri5w==

X-Forefront-Antispam-Report:

CIP:172.105.21.95;CTRY:CA;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:15dguhgfjg.volcanicallyactive.store;PTR:172-105-21-95.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(82310400014)(41320700004)(34070700005)(61400799018)(36860700004)(376005);DIR:OUT;SFP:1102;

X-OriginatorOrg: 15dguhgfjg.volcanicallyactive.store

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Mar 2024 12:49:27.4652

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 5114fd84-0c79-4adc-a92b-08dc3c498742

X-MS-Exchange-CrossTenant-Id: 495b80d5-d650-4a23-be96-124d50507823

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=495b80d5-d650-4a23-be96-124d50507823;Ip=[172.105.21.95];Helo=[15dguhgfjg.volcanicallyactive.store]

X-MS-Exchange-CrossTenant-AuthSource:

SG1PEPF000082E3.apcprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY0PR02MB6218

X-Spam_score: 5.4

X-Spam_score_int: 54

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Find Out How To Save Your Brain And Your Memories Today!

It started out innocently enough… Working with limited resources in rural

China, a doctor by the name of Chung T’Hsu sought to cure the ringing in

his ears that was driving him mad.



Content analysis details: (5.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.101.128.7 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.101.128.7 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.0 BAD_ENC_HEADER Message has bad MIME encoding in the header

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_REMOTE_IMAGE Message contains an external image

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} =?UTF-8?Q?It started out innocently enough=E2=80=A6?=



--_80786f1d-6ee3-4249-abe5-8080ca445fa0_

Content-Type: text/plain; charset="UTF-8";









--_80786f1d-6ee3-4249-abe5-8080ca445fa0_

Content-Type: text/html; charset="UTF-8";





















Find Out How To Save Your Brain And Your Memories Today!















It started out innocently enough…





 





Working with limited resources in rural China, a doctor by the name of Chung T’Hsu sought to cure the ringing in his ears that was driving him mad.





 





He turned to traditional Chinese medicines, but took the exact ingredient specifications from Western studies





 





Finally, he did it, creating a treatment that cured 322 people within 7 days!





 





But instead of allowing the treatment to go public, the Chinese government classified it as a “state secret” and made his life a living hell.





 





Sound familiar?





 





That’s what happens to our best doctors here as well. They’re either paid off or threatened to keep their life-saving cures buried. Anything to keep the drug cartel that is modern Big Pharma happy and rich.





 





But I won’t allow myself to be intimidated by them anymore. I don’t know how long I’ll be able to keep this up, so click on the presentation below and find out the truth about tinnitus!











src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiL1o2jCAlZn4c0dHaLcWVZk4LzXppCEMqoWLwgEsqeKISUs4Jt06QNMFVTORVNJHv2NFghquBBbOrm3_jJgbeER42Ox3Xdh9FQR5hzXzp5nswSu3sZ7jOGecHFsgDBfXQyQTlEL5PD_Xv84OulqVVWsUP-ii16LXGXT3rSciQBuuJrN4joay6XhssoHCVa/w640-h276/oreil.png">





src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9qk_Bqd0Son6yvjIzpe_H-qslfUoDZkjpDqJeKQqv8uloP-_oN-TrFrGff9zwS_2cLQkY2owEYINMOixva5qYhyphenhyphenTvJpnxyhqEN4ZH_8sxApKgkFniuTU3ID-VQywCABeIVx6PxRW3QgfuRtoALiZk-dSS9r22DTA-fCJRkuWL-H08oKuL1ql-V8iKPfKw/w640-h18/oreil%20unsb.png" pMsreqjdDWxN>











































--_80786f1d-6ee3-4249-abe5-8080ca445fa0_--