Synoshi phish from Microsoft Outlook

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 04 Mar 2024 08:27:03 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rh9s4-00000000DgA-3fnT

for dave@doctor.nl2k.ab.ca;

Mon, 04 Mar 2024 08:04:52 -0700

Resent-From: The Doctor

Resent-Date: Mon, 4 Mar 2024 08:04:52 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm6nam10rlnn2070.outbound.protection.outlook.com ([40.95.32.70]:13216 helo=NAM10-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

id 1rh72c-0000000048J-3Dva

for root@nk.ca;

Mon, 04 Mar 2024 05:03:42 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=EGG2IJB9QBioa/ooi25S8m+QMSttvQR5SsIPXYnp1YTeY+rHuRsqBOD4NyAEejC9irgP8g9f4MA1pM/znZZQRiuwkWKeWPCLDvbEVTmNghFIlIOzYCN5NDRQlY8xxKs+U+36IpoI50Vfo8fzBeLR9GWHSrFBuXL+lLv+Hohq/CQ20IbGbFCdPiqQGBA/lPbdYrkBkzoDaUzlTJ4fWQ/VYhcYwKOZ2w+OoMwYhgFTOtsMMouxnDG2BGDfkuuD4iDHbCOnQnV5Y/PfCgRiuUBpQwq4ozwuyenYnwKdNuX0E7ap1k+wgRoxpPtZkyGIrcp4/b6Xtgy4ZaeaZLiJb3F9gQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=HbmpoI6R4W7uuZRX6ZAVTp02i/ZPas/sPeXgwFClwbI=;

b=b7TnP+7Nm9Uq3C6MXRSpNa3NU/PeVrAMHchRaZtEhvdGWKKJdpNuZ1PnL2oFjnwfqevG8yVxl8s/3wqBJnruQsd8dZVpwBh1cH0QyZJvyNxMAhn9RA4lBoudcJ4YIS/FzjL3pb3bboBmVVnl38TGbkd9Pqk3JMiNnFvCNPS61mK7EITd5GclhZLM9o/FmNfVQUUPaVLVvMiIGMtaB0xO13K42vun7HQT6OghDq1MM5ngy7nvXBeqvVa1vIJI4R3h76Fx1qRx53maji86fum/zg+jlm04NrRDuOAMggrGknR6mN0mjGihzZX/CKkA0XM2mHq3bVKUq28c7j3VPh2Tow==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

45.138.51.222) smtp.rcpttodomain=nk.ca smtp.helo=vnpoipiyuimio.kfdf.sbs;

dmarc=none action=none header.from=vnpoipiyuimio.kfdf.sbs; dkim=none (message

not signed); arc=none (0)

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 45.138.51.222)

smtp.helo=vnpoipiyuimio.kfdf.sbs; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=vnpoipiyuimio.kfdf.sbs;

Subject: The EASY Way To CLEAN Everything SMARTLY!

MIME-Version: 1.0

X-TOI-MSGID: <101741870567062.AC354F821938C.1705442930402@vnpoipiyuimio.kfdf.sbs>

From: Synoshi

In-Reply-To:

To: root@nk.ca

Content-Transfer-Encoding: 8bit

Content-Type: text/html; charset="UTF-8"

CC: root@nk.ca

Date: 03-04-2024

Message-ID:

<582ef823-bd27-488b-8316-b1281139ba67@DM6NAM12FT070.eop-nam12.prod.protection.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: DM6NAM12FT070:EE_|SJ2PR11MB7476:EE_

X-MS-Office365-Filtering-Correlation-Id: 3c7dc143-61e1-4424-87f6-08dc3c42d56d

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?RXF6S0FudGRra29GTXc4STNjYkdUYzA0dGJqNmlrOUF6NVRzdVdSd1hXN1l0?=

=?utf-8?B?UHJUY25oVlRhdGxQL0tGaFhnVGhHRzhDc0dJanhSN1BDRjhrNktLVUNsejZF?=

=?utf-8?B?M0dzY0tqN0twZGZ2ZW1rTkZvK2pBY3IzN01xc1NKQTljSHJyZVJhOHQzQXlZ?=

=?utf-8?B?MUF0MVFaSVpCUkQvNWtUM2hXL05Rc29oU3c1VE9UODI0MmM2S2U3U21iT0ZJ?=

=?utf-8?B?K3RURzZ4cXRzNFU3clM5dHdUNnlRbFc2WUxkZGloNVVRYXBicm9nYkxMcVNW?=

=?utf-8?B?UzV1ZHpzaFByWG9DWUdqRUdZc3c1blJSYWVMVnQwb0NBb08zNEN5NUtzUEMr?=

=?utf-8?B?TStvOG5BWXNrd05VbjF4dzhQUXhHT2J5bzNWdnZHYnp3VkZJeENVSnRjU2tX?=

=?utf-8?B?QksrQmR0QnlYMThFSDFISmNKQWJxRkNGL0laL1Azcmd2dTJvbzNlREx4SzNQ?=

=?utf-8?B?cm9qMllBMjc4YXYxMXlFclpPbDBiWUswNE1Ud2lwTW1UNU9nVllsZTloQlAr?=

=?utf-8?B?MzVYTUNoS29lZjNaYmp6S3o0YlI1Q0dZY3FIUkQ4bnlzaVZLSFgxanpYbUUw?=

=?utf-8?B?TkNleE15dkhNVUdzQ2FZUEVjL0xqVXJ2a0VwclJ3aDlHdnAvTjhaYTkrUG1P?=

=?utf-8?B?UFljZXJyNFFMd1AyVlU0cG1DVFl6ZVh0ck9oQXd0alhsR3BCNXVINDBYYkVh?=

=?utf-8?B?Nlc4a3pPZWFVVzEvaWFma2FMMXdTS2ZneS9BZnR1cEtxMUkrV3RVU0NuK2FB?=

=?utf-8?B?RzBxOFJlNVI3Tk5zYlNraTJwZ3VVaXYxRHQ2cXduNUhZdTFMd1U4VG12M1FG?=

=?utf-8?B?cE9zdXM1YkRYdmxTemdNNXJXNHc4NTY1a2NNckQreGEzYU5KQWEwZVFVNEln?=

=?utf-8?B?TlBTVzVNNHhSWGhVN1VyN1J5ZVFHdE5TR2dITHNXbEtGTThCOEdCVzlGbVBx?=

=?utf-8?B?VFhMZWgxNjRNRmUyeFpaWWdRRlFnek5DcmlwRDh6ZVRuRTE2L1lXb2dNYmpy?=

=?utf-8?B?YjYxRC9jY2RFN0hFNDljN2VkSlFreEIzSGlyS2duWnVCcEVLOEhUZzFpVElO?=

=?utf-8?B?RDZUMlptU2Z1enlGbm5Rbjc1ZHJiQTVvejBNcHp4OEhhbVllSmlyOFp4dDhn?=

=?utf-8?B?QVJhTmdKdThML1JGYjhldTJ0M3lnOTNpZEdzYjVES1kyOGxZZDF1KzZWenNh?=

=?utf-8?B?N2JncXFnTllMdFRST3hkd08yVDNIM3pwRlR6SnFxcWdTSXA4QlE0aDVkWlpT?=

=?utf-8?B?K2NYY3VBR3ptQ01wdmtBa2hFRlgvelNueTcwQlFkcEdOZ00weWUrUGlVMldP?=

=?utf-8?B?S2Yvclk2SjUvVGZicW1iVUZOOFJVYy9CWVhwVU1YWFRBV0pDNU91T1poSFhJ?=

=?utf-8?Q?LL6HYCzHzCIl7a4aGJXcpaNQ2UydWvWw=3D?=

X-Forefront-Antispam-Report:

CIP:45.138.51.222;CTRY:DE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:vnpoipiyuimio.kfdf.sbs;PTR:msgbase.thatsneo.com;CAT:NONE;SFS:(13230031)(41320700004)(82310400014)(34020700007)(61400799018)(376005)(35950700004)(22042699003);DIR:OUT;SFP:1022;

X-OriginatorOrg: vnpoipiyuimio.kfdf.sbs

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Mar 2024 12:01:32.3188

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 3c7dc143-61e1-4424-87f6-08dc3c42d56d

X-MS-Exchange-CrossTenant-Id: 8f708045-0f41-4b53-b2c7-abd03754f2c1

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=8f708045-0f41-4b53-b2c7-abd03754f2c1;Ip=[45.138.51.222];Helo=[vnpoipiyuimio.kfdf.sbs]

X-MS-Exchange-CrossTenant-AuthSource:

DM6NAM12FT070.eop-nam12.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR11MB7476

X-Spam_score: 11.9

X-Spam_score_int: 119

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: (1) Notifications Synoshi Deep Cleaning Made Easy



Content analysis details: (11.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.95.32.70 listed in list.dnswl.org]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=NAM10-DM6-obe.outbound.protection.outlook.com;ip=40.95.32.70;r=doctor.nl2k.ab.ca]

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.4 INVALID_DATE Invalid Date: header (not RFC 2822)

0.6 INVALID_DATE_TZ_ABSURD Invalid Date: header (timezone does not exist)

1.4 BUG6152_INVALID_DATE_TZ_ABSURD No description available.

1.0 HK_RANDOM_FROM From username looks random

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

Subject: {SPAM?} The EASY Way To CLEAN Everything SMARTLY!











(1) Notifications





















































Synoshi







Deep Cleaning Made Easy