Ukrainian dating spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 25 Mar 2024 08:12:12 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rol3P-00000000Hmt-1xIb

for dave@doctor.nl2k.ab.ca;

Mon, 25 Mar 2024 08:11:59 -0600

Resent-From: The Doctor

Resent-Date: Mon, 25 Mar 2024 08:11:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-db5eur01olkn2058.outbound.protection.outlook.com ([40.92.64.58]:57902 helo=EUR01-DB5-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rog4j-00000000L4J-1gdC

for doctor@nl2k.ab.ca;

Mon, 25 Mar 2024 02:53:05 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=MH7bkGjiyQSl20J7qV8QpHgH5aevdQFFGkkDhzG7/odU5rpedljKILBKIEhtzbXIUb8NU8CL8LoIJAGqs+gFpfQQi9yuLrzMd26iwMMMkPSUadpRzROgE8H0x7BXPyS5uYngTTIozuAxNsqJktVwSmi4AEYeB89JPhov3Lv2KLph+Bl8WBYuJEo8zi5+GzUnBzJxz9g8JO2XOvdSTr1FCZYjKsCLJ73gxkg8GrJnfeGQjj3rZxpWYgrNa1h4OTWTyD1+0UJXMVcVcSmxBafRQkDZjrv/wy19vMqBN9xxeL+ZVDNMe8xQkzck+hqhWmGuwJAJ3XMppJBkK8J39B+0pA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=qR7O3vY1cVzhLsLbI1IBsSHgkINLGqo+GAH9XJ5LYHY=;

b=fFtDUl5R4GkUJiCkHtC5qsxftRMoGZdXtb6BLjFto+gn34vBM8ULOWekxMa9sDfvmY+U3XiRqMwbGRnv+UNmrf3bhRDkGTQnB/YZr+JkO1kUBBJfSL9bDekgMb/QcUEteaVxyL0u2cFUQ1iIo0xvTRzRW6Go0+wc1Xd3566cSILiYCaHXJVlvOFlX3KVeNlbM/v1bVZJhmDpUZZQtcGfpE751FYdsd1dRRAgicBBHuJoJe6Dw+3bcP2wkFqAicCpPaEZAL/00W+Ze5pQUr3xcd1X1L8kleXpzVZDh1Q3hAwUwEQvQ0fUoxcynvwSNeGHOU33ui966c86McEV4u7HtQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=qR7O3vY1cVzhLsLbI1IBsSHgkINLGqo+GAH9XJ5LYHY=;

b=kBDHxpJ4DgtTd8/URJ4D7/ANhz1/Ei1OkyjNmgPkU88mln+lKe+rND+og2kpMm9XcPzyvVZWxRCRj8s5g13nZlUS/vyObr8x2tJs8iv3ILM3LP8DQv8iLWjiAzZTwJXM/q8MjRT9RRHHtd3HcHsSsaAr8CLa9MJcj1NFLHm+lkeV+QXAgs47L4NuBf0GbKmaVXv0GgPIBjiMaLMrlOHcrkRlEOOQiYzgjxvR4IuyuicnbHvrX52+zZcM9hdXV1624OVy8uI8zna/18xTiN0QroXEPCkH8VpWRnIJvUiu1qqtrKQGlUok0eplEmG6E/pBiTibtjoI2ajQS3YI+N5cUw==

Received: from PRAP250MB0687.EURP250.PROD.OUTLOOK.COM (2603:10a6:102:29d::17)

by AS1P250MB0456.EURP250.PROD.OUTLOOK.COM (2603:10a6:20b:4a6::20) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7409.31; Mon, 25 Mar

2024 08:50:54 +0000

Received: from PRAP250MB0687.EURP250.PROD.OUTLOOK.COM

([fe80::13f9:9138:f4aa:8fc3]) by PRAP250MB0687.EURP250.PROD.OUTLOOK.COM

([fe80::13f9:9138:f4aa:8fc3%6]) with mapi id 15.20.7386.025; Mon, 25 Mar 2024

08:50:54 +0000

Content-Type: multipart/alternative; boundary="===============7290883388350981176=="

Subject: =?utf-8?q?New_like_on_your_post_=F0=9F=91=8D?=

From: LoveLinkr

CC: LoveLinkr

Date: Mon, 25 Mar 2024 08:50:40 +0000

X-TMN: [vjvXAHOtCxUjbOhaVt3AODAKivFvM5Lj]

X-ClientProxiedBy: FR3P281CA0094.DEUP281.PROD.OUTLOOK.COM

(2603:10a6:d10:a1::9) To PRAP250MB0687.EURP250.PROD.OUTLOOK.COM

(2603:10a6:102:29d::17)

Message-ID:



MIME-Version: 1.0

X-MS-Exchange-MessageSentRepresentingType: 1

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: PRAP250MB0687:EE_|AS1P250MB0456:EE_

X-MS-Office365-Filtering-Correlation-Id: be952cfe-3e5d-4b0c-57ac-08dc4ca8ae1d

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

2fv9r8YYEofUFZbUyvmC/awKav6yzNBjMKZA2EzFbivjdFXeu2OpJ5q9EYkVqdEO82U7H9L32bDHfm1IZIOyiW7rQRu3gBz+iP+byVzG+Q+xPAo1Jh6YOtFoffo9cNpVspwlso+mtipTCnkDc6zmczCs0UzADvIT70Yu/VMFXIWCN2N/AekFy5UzCRGNHtKd3gzzahU+VwtE+RlTnZHt52K/drsCHtO7sL3Y7m/f0IET4efYGNzzC/2norBdAAxK7IdXXo3U5/lKSnP/LSuCBvi/D8nfTneY0hTH4yrIRuc+QIfkh2lTCTfU6w+HRlAC/VmkREzCAOJ9x7E3VIlaHkp1Z5U0jlLy5wYh4tBhxyGM2fgO+kSWvuafCOLrF5VF97sPxHfUq1sT8VmnFAX+4ymtmhkIOlPvqusC8LOvEeft5sDo3KVCqIEOv71hvQT88JLzNJMWrvIl3hVCuFzIPV/Cc8jq4N6tVWxCSPwAeC+OWpBV6T4VJw9SbKxfvIdvcb89lSdeGd02l+RRSOtCmlFJk8WOCnYURJT+4hye8WYROxCU+8KwXgTiwB40RFX2hK+uF+kgBaI3VnN7ez/hmibpd0sjXhWAWH7QBJ6r4xukEZFmSEktqqfzYXzIKMNznmpDkWHGs1lypx34bEI06fTIG4sIu4zGUWX2uwSNE2MQzdeJITvWTBBMWX7eS6S1mfYUyQjVjPcY9hushuUJ16+dYdW1WfxHEzJGJO0WNITe4dxT/UzkAPkJZ55m2hLRTFKN6Zwl6fYErwPN9Pk9Wg==

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?TU1lOFF3c3JZMDJKMFFremNzZlZWaDhqb2lqdldqWFRLcHdMU09WL2hsdTRI?=

=?utf-8?B?MmJmV004V0VyVWxkc0VFcVBOV0ZucVdCNzI3a01RMWl5dm1oam5mM1VsRmdN?=

=?utf-8?B?ZHVSbStqeDJUK1VCV1YweEU2QVVOd1kyQXZJeEF6TlozemIyYkVGY09VbTkw?=

=?utf-8?B?WHVJT21wMW4zaEM2Z1hWZnlBUGlXYTVpSENyWjNsR2I2UHZudFExR2JzcW9O?=

=?utf-8?B?ME9PKzZ4V2Y1TzJYSHNvZEQ1SEVFNWlDL3QxYTFLRlV0RmpoK3FKTjFOYTVR?=

=?utf-8?B?VHRKK0JqdU9oVi93M2htVWdWR1pQanNmc0lEY2JlclA3YzZneUFmYlM2NEs5?=

=?utf-8?B?cTBKSFZIQ1BmdkNCMGo2czJWM0s5MzV2ak1zVGZzVHZTTVdaVzNFQ0JiZUl4?=

=?utf-8?B?ZU9Ud0MxSVpBV2Zkb2RuazNWZm9sR0l1aEUzeUZmVUtoNzNOSTFlTEFwWWpk?=

=?utf-8?B?dHFZb0ZPeXUyTk1Sdkc5eWIrNFpCd1RLMUlLbk54eEVOWTdCRkNGcXJRQlBp?=

=?utf-8?B?RDJIU202eGhDQlN1alpEWks0czJIdXVlNnF0bGxHVk5qcElVRkt3VGY1anpD?=

=?utf-8?B?ZUM1eVNYemF2MmQvT2lTcS96Y2RTbFNRNzlubzFsUm9pT0lDb3hja3pySnBs?=

=?utf-8?B?Q3JFWmtwSlRlSjhZZUJITTBBNmxlRGVBb2w5T2dnaHBDY3B6SzE5b1ovckE1?=

=?utf-8?B?VnZDNHlWZFYvdFVyZyttSHIzVDFhWnRsZjVCT296Yi9EaWUvVitFTHFwdmVq?=

=?utf-8?B?WXdjZitwRzlEWTIyclpCc2YwSTR2SXE2dkY5N1ozYU8vaXpiZ3RyMFBXZHhm?=

=?utf-8?B?VlRwTjVtNmJxbXhPQmFPUlB4alNEWisrd2NVenFDNWJOY1pDUUNWM0o2QW03?=

=?utf-8?B?YWtkcVNRbjZIb1Z1cUZCS005SnVJSzB6YzFuUWpZT3dzUWVZbVNWODNlV013?=

=?utf-8?B?a1BpcUFWblk4ZU5zV1BUZmNSWFhUUFoyeG4wSUphOHFTcCtmK20rNjdTQ0F6?=

=?utf-8?B?dXdRWFoxMi9OdTgzaXR4OUkvbngzckZKU3hyNWpRZDFvRnBROWI1ZFE4TzVJ?=

=?utf-8?B?SHRrNDlXTHRZWVoza05SKzFueE9ycDZKYWZ6NlVjd1Z1WjJWMXJzVm91b3ZB?=

=?utf-8?B?SGR3YVMrTlBLTnpaYVc4R1lXaVlHOE94VGlrRm1WTldlbURMcjZOSm5mL1Nj?=

=?utf-8?B?NklkSld3OXJ6VVFaeEFvN2VnN2FhVWF0eTZkUm1IT0ZYRml1ZXlvaVRvSWhW?=

=?utf-8?B?QjFHSFpob0cwd0FQRW1lYnJiNytDbkJ4QmpRSlJhb3h6YVl4bkxUTFNmank0?=

=?utf-8?B?aC9PYVFNa2ZPN1RhZThYcXNWK1YzU0xoUHpiVHZxZEFkTmZyc2s1MkZkK0s1?=

=?utf-8?B?YjBHc0VzUVJpRXNtb1BRMkh2T3NYdE1MbUh1Rkoyclhjdkx0QlFSQS9kNW9U?=

=?utf-8?B?bUo0K084a1RpZngzc1JiOHVveXg3ZTk3RzBNSllQN2JoZTFxU1BjSzgxaHdS?=

=?utf-8?B?UHBWRm9pSEN1alVVSWFqVFhNMUpTT1NNZy9kbUV0Mk4xMzZGblIrYnh4RzZl?=

=?utf-8?B?Q01teTJ5eGJPSzBnd1FsOXdMWlFXN0poRC9zQ21jN3JOWTNzbzJyaW02cERO?=

=?utf-8?B?cTZUNmMyVElld1RCb2pPc3pUWUZlS0t1WVI0ZktVUnRuUUVCc2ZxcmxWalVD?=

=?utf-8?B?d3hIL0N3dGpuOXd3dHpkNmdMQ3lZTjkvK0Z3RnpkSmphYVNGVnJHN3dRPT0=?=

X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-e3d53.templateTenant

X-MS-Exchange-CrossTenant-Network-Message-Id: be952cfe-3e5d-4b0c-57ac-08dc4ca8ae1d

X-MS-Exchange-CrossTenant-AuthSource: PRAP250MB0687.EURP250.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Mar 2024 08:50:54.5292

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:

00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS1P250MB0456

X-Spam_score: 6.7

X-Spam_score_int: 67

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Document Are you interested in making connections with Ukrainian

women nearby? Are you seeking a distinctive platform to meet singles? Discover

UkrainianGirls, where you can indulge in meaningful conversations unlike

those found on conventional dating sites!



Content analysis details: (6.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.92.64.58 listed in list.dnswl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: shorturl.ac]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.64.58 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_VALID Message has a valid ARC signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.0 ARC_SIGNED Message has a ARC signature

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[kearstynriccardo1988696(at)hotmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[kearstynriccardo1988696(at)hotmail.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

Subject: {SPAM?} =?utf-8?q?New_like_on_your_post_=F0=9F=91=8D?=

X-Antivirus: AVG (VPS 240325-0, 3/24/2024), Inbound message

X-Antivirus-Status: Clean



--===============7290883388350981176==

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: base64



PCFET0NUWVBFIGh0bWw+PGh0bWwgbGFuZz0iZW4iPjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVpdj0i

Q29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPgo8bWV0YSBu

YW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxl

PTEuMCI+Cjx0aXRsZT5Eb2N1bWVudDwvdGl0bGU+CjwvaGVhZD4KPGJvZHk+CjxwIHN0eWxlPSJ0

ZXh0LWFsaWduOmNlbnRlciI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy45OTk5OTk5OTk5OTk5

OThwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkFyaWFsLHNhbnMtc2VyaWYiPjxzcGFuIHN0

eWxlPSJjb2xvcjojMDAwMDAwIj48c3Ryb25nPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTZweCI+

QXJlIHlvdSBpbnRlcmVzdGVkIGluIG1ha2luZyBjb25uZWN0aW9ucyB3aXRoIFVrcmFpbmlhbiB3

b21lbiBuZWFyYnk/PC9zcGFuPjxicj4KPGJyPgo8aW1nIHNyYz0iaHR0cHM6Ly9saDctdXMuZ29v

Z2xldXNlcmNvbnRlbnQuY29tL21mUFljeFVibThUUzJIUFNwdnFodFpEYXV3R240YXJkNFpkdF9H

M0x4YmxaR25tOTBadDJXa3N3dDJMX2p6UDhPbEFvUEMtYmdBYnhzMjZKc2U4Z0ZiazhudGdRdmM1

N0ZsOE16TWd1R2ZXR2FKQlpmbHZWZGpGMTBNNXlRUzQxdUJKVE1fWTl4TnJCWUFzZnE4bXFlN28i

IHN0eWxlPSJoZWlnaHQ6MjY1cHg7IHdpZHRoOjYyNHB4Ij48L3N0cm9uZz48L3NwYW4+PC9zcGFu

Pjwvc3Bhbj48L3A+Cgo8cCBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPjxzcGFuIHN0eWxlPSJm

b250LXNpemU6MTZweCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkFyaWFsLHNhbnMtc2VyaWYi

PjxzcGFuIHN0eWxlPSJjb2xvcjojMDAwMDAwIj48c3Ryb25nPkFyZSB5b3Ugc2Vla2luZyBhIGRp

c3RpbmN0aXZlIHBsYXRmb3JtIHRvIG1lZXQgc2luZ2xlcz8gRGlzY292ZXIgPGEgaHJlZj0iaHR0

cHM6Ly9yYi5neS85ZDN5OW4iPlVrcmFpbmlhbkdpcmxzPC9hPiwgd2hlcmUgeW91IGNhbiBpbmR1

bGdlIGluIG1lYW5pbmdmdWwgY29udmVyc2F0aW9ucyB1bmxpa2UgdGhvc2UgZm91bmQgb24gY29u

dmVudGlvbmFsIGRhdGluZyBzaXRlcyE8L3N0cm9uZz48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3A+

Cgo8cD4mbmJzcDs8L3A+Cgo8cCBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPjxzdHJvbmc+PHNw

YW4gc3R5bGU9ImZvbnQtc2l6ZToxMHB4Ij7irIfirIcmbmJzcDs8c3BhbiBzdHlsZT0iZm9udC1m

YW1pbHk6QXJpYWwsc2Fucy1zZXJpZiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDAwMDAiPkJyb3dz

ZSBwcm9maWxlcyBvZiB0aGVzZSB0aHJlZSBsYWRpZXMgYW5kIG1vcmUgdmlhIHRoaXMgbGluayA8

L3NwYW4+PC9zcGFuPuKsh+Kshzwvc3Bhbj48L3N0cm9uZz48L3A+Cgo8cCBzdHlsZT0idGV4dC1h

bGlnbjpjZW50ZXIiPjxhIGhyZWY9Imh0dHA6Ly9zaG9ydHVybC5hYy83ZGcwaCIgc3R5bGU9InRl

eHQtZGVjb3JhdGlvbjpub25lIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjE4cHQiPjxzcGFuIHN0

eWxlPSJmb250LWZhbWlseTpBcmlhbCxzYW5zLXNlcmlmIj48c3BhbiBzdHlsZT0iY29sb3I6IzEx

NTVjYyI+PHN0cm9uZz5Mb3ZlTGlua3I8L3N0cm9uZz48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L2E+

PC9wPgoKPHA+Jm5ic3A7PC9wPgoKPHAgc3R5bGU9InRleHQtYWxpZ246Y2VudGVyIj48c3BhbiBz

dHlsZT0iZm9udC1zaXplOjE4cHgiPjxzdHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkFy

aWFsLHNhbnMtc2VyaWYiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAwMDAwIj48c3Ryb25nPlJlZ2lz

dGVyIG5vdyBhdCBubyBjb3N0LCBmb3IgYSBsaW1pdGVkIHRpbWUgb25seSEgU2VpemUgdGhpcyBv

cHBvcnR1bml0eSBiZWZvcmUgaXQgZGlzYXBwZWFycyE8L3N0cm9uZz48L3NwYW4+PC9zcGFuPjwv

c3Ryb25nPjwvc3Bhbj48YnI+CiZuYnNwOzwvcD4KCjxwIHN0eWxlPSJ0ZXh0LWFsaWduOmNlbnRl

ciI+Jm5ic3A7PC9wPgoKPHAgc3R5bGU9InRleHQtYWxpZ246Y2VudGVyIj48YnI+Cjxicj4KVG8g

b3B0IG91dCBvZiByZWNlaXZpbmcgb3VyIHVwY29taW5nIHByb21vdGlvbnMsIGNsaWNrIHRoZSA8

YSBocmVmPSJodHRwOi8vdC5seS9IRVVkdCI+dW5zdWJzY3JpYmUgbGluazwvYT4uPHNwYW4gc3R5

bGU9ImZvbnQtc2l6ZToyMnB4Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6QXJpYWwsc2Fucy1z

ZXJpZiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDAwMDAiPiA8L3NwYW4+PC9zcGFuPjwvc3Bhbj48

L3A+Cgo8cD4mbmJzcDs8L3A+Cgo8cD4mbmJzcDs8L3A+Cgo8cD48c3Ryb25nPjxzdHJvbmc+Jm5i

c3A7PC9zdHJvbmc+PC9zdHJvbmc+PC9wPgoKPHAgc3R5bGU9InRleHQtYWxpZ246Y2VudGVyIj48

c3Ryb25nPjxzdHJvbmc+Jm5ic3A7PC9zdHJvbmc+PC9zdHJvbmc+PC9wPgoKPHAgc3R5bGU9InRl

eHQtYWxpZ246Y2VudGVyIj48c3Ryb25nPjxzdHJvbmc+Jm5ic3A7PC9zdHJvbmc+PC9zdHJvbmc+

PC9wPgo8L2JvZHk+CjwvaHRtbD4=



--===============7290883388350981176==--

Ukrainian dating spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 25 Mar 2024 08:13:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rol3V-00000000HnK-2Aox

for dave@doctor.nl2k.ab.ca;

Mon, 25 Mar 2024 08:12:05 -0600

Resent-From: The Doctor

Resent-Date: Mon, 25 Mar 2024 08:12:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-bn7nam10olkn2088.outbound.protection.outlook.com ([40.92.40.88]:18849 helo=NAM10-BN7-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rogBq-00000000LWu-0xyu

for doctor@nl2k.ab.ca;

Mon, 25 Mar 2024 03:00:26 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=kjFDo04M3SBhaG5hDHrJ/b/Kk3+ske4HiE5zv4RTAUTEHguL+oAaGeuZ7XHB8KElVGGTBNrrLefAKblA5cRkr0QFsdZKqfhpw4DqaByHJJDDM5zvDpuiCw2M8+cnwCsV0CLVkG/HE1VXZBGjf9SyI2uaK9GIafffxu42/YF0CTI/xYVJ7lJLA9EhDRi99l4rYLlAL7ivBXcZJPpJK4xXjXXtB9R+CV9dirZ07vU7hhIdnGh9iQM/c02IYzEeZuyJtu9oliY8UPcmBuLK0EtYHVnAw+RFpFje2DLBxNWE1CUHuP3aI3nvjjTo9UzRzK38dVQHnifFwl7jWyDu07XXKg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=seJ6Sdk87eq3Tut9JCUqvrH3vmS2lsc5mwkPCZVoFU4=;

b=lFnFsxoHRxQAOHSm7iFJbjXzux1CV7dvpwDAmrUsxsIFVxdID/xqRDMkU7m9GUsGq6vmcZ61DsJpZhTAAUyW0fR0p7723WDiDa8xEVDi9m/hAM3+wTSY2lzASbMaG7JZxJt1Hjp/7ApAeXMVTsZfwzgTeRuamzgkMGG5sa3/MLF7RMPzWUCBna744gF7BX7Ovh4smFg+OsYFQLyaJG3shJnFmPiw2kj9XntqzvtruCLXAkZ7Z0Dfv3FvhEJGpQNXFyZSAASo93PfRZKdKmtxSNqWVE0mcUQdKlcF1XfoonpxgTsSJ53H+qFWBPEmWq9Mc4/ya4OoXW0OTMdlEljXag==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=seJ6Sdk87eq3Tut9JCUqvrH3vmS2lsc5mwkPCZVoFU4=;

b=F0pC6w3sh8Q0mFvtqSA0CTQtF4Ykn6lBNuNyYDJYd0x4QPP0ConYjW4ckyBp65m8jfpHYxlqhrBwnFluOklTk3PdjzaYirsLcNfJBdj0FLvEAK6BR9k/s+2jNVLo6xBrd6a9uLS4s5IQ48zDXKEUmWdmRJoqpbsA9RKdPas1JvEr6/9NfHrP8FJz88i6IvQRuR3+g+rDj09TFdf3EsqSNTghV5Nq65CaLGA01C+djDJwUapSUswLFOn4Y4Zk0ewxHBhCv3NtK52Yx7TkV+lBQ4xAbb8vEiZLDNZWrgqFFRGc62jBuhP4In9Xd6HS7zI2dqF2d9bEMFnAfOUMshLuhw==

Received: from BN8PR12MB3010.namprd12.prod.outlook.com (2603:10b6:408:63::32)

by MN0PR12MB5977.namprd12.prod.outlook.com (2603:10b6:208:37c::22) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7409.31; Mon, 25 Mar

2024 08:58:08 +0000

Received: from BN8PR12MB3010.namprd12.prod.outlook.com

([fe80::6cc4:f48b:8f41:596a]) by BN8PR12MB3010.namprd12.prod.outlook.com

([fe80::6cc4:f48b:8f41:596a%6]) with mapi id 15.20.7409.031; Mon, 25 Mar 2024

08:58:08 +0000

Content-Type: multipart/alternative; boundary="===============8701990277900836242=="

Subject: =?utf-8?q?New_post_in_your_area_=F0=9F=93=8D?=

From: LoveLinkr

CC: LoveLinkr

Date: Mon, 25 Mar 2024 08:57:22 +0000

X-TMN: [k4V18d7GlcsJQt8TkfFJsk8q3d3sX2C+]

X-ClientProxiedBy: FR4P281CA0290.DEUP281.PROD.OUTLOOK.COM

(2603:10a6:d10:e7::20) To BN8PR12MB3010.namprd12.prod.outlook.com

(2603:10b6:408:63::32)

Message-ID:



MIME-Version: 1.0

X-MS-Exchange-MessageSentRepresentingType: 1

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BN8PR12MB3010:EE_|MN0PR12MB5977:EE_

X-MS-Office365-Filtering-Correlation-Id: 647e0b3f-6574-4941-fe3e-08dc4ca9aefa

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

oQnfRWeyhzMzPuNfj8Fkro82UXNYMNTq2+weCFv6MtM8TSV6OyBHUtDdoeJdY173LtP79cpDSgmg4O4xrfqbwGBgRsWakwAnLjeTzSNxzZGivhzvCcrbGtq4uuZnSx1be0yotITf/QVA0zUyO7Q2lMa/6JTZWSM82lMKcbF3xNHIrwYBkgawE2OZVih44RZ6oxp9SX32KJdo/ZYY2hdCYuAcLY57dCXqPmz3xB7a2/OkD2Js++aTbAo0dP/XKe+W9eylTIe38+PNknRvVp118HSaZjbkEaV9Ar8Ky6aJXhTZpJCVfTUWwYQjiJ2xNtfeXzmiJUYmB5W8SAtQ0fW3+jY1V8D5WscjoStFxisxnPhc1G9odyaoNULxnzFb63pAFbhKpxR+x5NJBAp1dtzuLw/qFRpsfn4ImzQ4YxZ1JocPtTSqlxlA0ErPM3xOMi8zSnYWdbEJ8GNlumPWCPATXg1iay2Hxld5zn0kNo+Z1C9Vz7VmWl/mDM4LH9dx+Hn0e19SbCGYHBx2fQrKatQ5MMra3ZDciqoJY15GEGU717k2jjerZyYWGZuy52lagfypbE7dnZdCzpHK2nFZuf/8BLOx2Fu9cIB7OOkcVnQFFC4C7f3h13eBNpWB0srhsQU5tUgWv+upknf8T6l6S9ZT7n+SeEk2PR5kbCD3EmvhhzUVpSWMmPB+6hKGmTs7yjj6aME6BL8nsNwTEXwyfLiodDBgllH9sDQsq8E1ZXKiCCH5gTJ0upIeHpqFAVJbGc9oMzhzFsRQ+tKnQCnSg2zSPw==

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?bUJFblF1M3cwalE3Nmp6aVpzVzlKUGttZGRhc2lBdlV1NGZlVEZMVnJLTUFK?=

=?utf-8?B?K2NBMy82Sm1zZlNuM2ZEWnhFVXUzMkhXQ0hWeUdvRjlVbnVXcFcwNmxaTncy?=

=?utf-8?B?RVd2NWNxbWt6YytjRnl2OUZ6ME93UzhGdjFDMm0xNVRuTUJZaTVmOXNZV2NT?=

=?utf-8?B?ZzFOeWVxaHVRanNKb1d1T2hFQ1dqSDY1eWhJeTlWZjIwNFVpbW1GR3p0VmRl?=

=?utf-8?B?K1hrb2tDZlBURUluVUh4aXRKemg5cWdIUGlGVnJJc1YrTlhsdEFxVjkxUm5I?=

=?utf-8?B?SkdRQ1hJbEJUYzBkbFRpVnIxdG5xQklBa0xOVW9TcmxJcEE1T3p5d09pcjgv?=

=?utf-8?B?Z1FDdmlJcVdTVUIwbm1wN1d4eHN1b29JSTU2YW5JRmVoeW1TMytxTXI5STZE?=

=?utf-8?B?QmM4aWxOek9LQlRWQkZHOTBGU0R3WjRJYXFRMFZ1dWlKZ0R3RkE0U0dFV0Jq?=

=?utf-8?B?ZHIySzM1OUFJcEZEdFQzYmVMWkwzSDBPZEVYVnp4KzU4c29yUXVlRy9ib1dI?=

=?utf-8?B?RnJ1S3hVRS9iVVBuWGk1aGY0REJGY2Y1NVRvNVZDQWxTMkV2OW83bk52dW01?=

=?utf-8?B?MEVvSTRMK2MweHlmaHkzQVg1bUh6RzFieXBYUUpEWVJiYnRNTEIwTWdKSity?=

=?utf-8?B?NVFWUHI1Tnd3ZEFqUk1zOU93YnpuL0o0b1NOT2pUTkJHZEgwcFdGQU9qV0Yz?=

=?utf-8?B?cGx4UWFHUkNjcExja1lpazQvcEIxa1dTSDdOMnB2bnRnUy9jeW5GbWR0TjN2?=

=?utf-8?B?Ujg3a0l1N0xaZjZSWTQyZ3lSeVJMVFdHbmtsSzhkYytRRW5vZjhJWWVOSTJS?=

=?utf-8?B?bzJIWWQ5QXI4VEtyL0t3TGRTVnFLRjdyQXBvV21sMFlFMXdsclZlczFVeUU1?=

=?utf-8?B?Y29OcjZncTVtakdWemZRWExoVEVadUc4YWNQWFYzK1NDMlFlREg0eVRpT2pa?=

=?utf-8?B?eDN1ZEJoaDJJTDRUTHB5bCt2a21PUENBelF0bk85U21UN3cwSjd1bSt4L09R?=

=?utf-8?B?SkpGSGhZQ3RHNkZ1Q1JoTGZORnBzdlROUHZMTXcwTDM3WTBYYWRjWXZKQ3Br?=

=?utf-8?B?cERhbVMxTzJIYlptR244M2MrVnREaUViS1NBZ0RqRlRqU21jazdSOHRETXRv?=

=?utf-8?B?WDZwOXd1TWd5TFBXT2dWaWlOR29XS1dKbVVvMDdXQlVUdWFMQzJLdjF6ZEx6?=

=?utf-8?B?SUttcGRDcStvU1BWZXNKa3hyZjNnYWE3TWhoLzNWTXNjd0RlaWx6bnNTNXo0?=

=?utf-8?B?VTN5U0FLMmFYNTdxZ2lQdmpKQWdnRTN5SlNEN3Q3dVlLYk56azNPSlVRc3cv?=

=?utf-8?B?N3AzSWxiV2pETUVITjFFWVpUODE2dlVlOWhIaWVIMHdaaXpiN0dUV2NBTnRL?=

=?utf-8?B?OGxrdHdNNFdQQXBSYmsybnhHSVpTR2NBTi9Ud01vVjAyN0crZDVseEx0bTdu?=

=?utf-8?B?N2o1ZkErUHZhWnl4N2gya0x0QnJ5V3JEVXdnQTJHbVJpN3ZrNk1CWGlYNWpu?=

=?utf-8?B?MXV2MnhYNE9RS21Qc0FGYTRZTWJWcGFGbUcwN203M1d3T2cyVFNRS0x2T2g2?=

=?utf-8?B?bnV3RDJ1Z2xCWEZYKyt6Vlp2TVdvbGZMUEZZb1ZycEE4eE5ra2ZVTHZpOGFU?=

=?utf-8?B?QXdZWFpXOFh5eGhmMEFqQlRUdzFUZ2lPbVJLVW1idkxoSGlyZlQ2bFRNYVBt?=

=?utf-8?Q?ljaAznAIjowbjNVokGTQ?=

X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-71ea3.templateTenant

X-MS-Exchange-CrossTenant-Network-Message-Id: 647e0b3f-6574-4941-fe3e-08dc4ca9aefa

X-MS-Exchange-CrossTenant-AuthSource: BN8PR12MB3010.namprd12.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Mar 2024 08:58:07.3650

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:

00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN0PR12MB5977

X-Spam_score: 6.7

X-Spam_score_int: 67

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Document Are you interested in making connections with Ukrainian

women nearby? Are you seeking a distinctive platform to meet singles? Discover

UkrainianGirls, where you can indulge in meaningful conversations unlike

those found on conventional dating sites!



Content analysis details: (6.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: shorturl.ac]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.92.40.88 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.40.88 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_VALID Message has a valid ARC signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.0 ARC_SIGNED Message has a ARC signature

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[pitzerdiya666(at)hotmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[pitzerdiya666(at)hotmail.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

Subject: {SPAM?} =?utf-8?q?New_post_in_your_area_=F0=9F=93=8D?=

X-Antivirus: AVG (VPS 240325-0, 3/24/2024), Inbound message

X-Antivirus-Status: Clean



--===============8701990277900836242==

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: base64



PCFET0NUWVBFIGh0bWw+PGh0bWwgbGFuZz0iZW4iPjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVpdj0i

Q29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPgo8bWV0YSBu

YW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxl

PTEuMCI+Cjx0aXRsZT5Eb2N1bWVudDwvdGl0bGU+CjwvaGVhZD4KPGJvZHk+CjxwIHN0eWxlPSJ0

ZXh0LWFsaWduOmNlbnRlciI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy45OTk5OTk5OTk5OTk5

OThwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkFyaWFsLHNhbnMtc2VyaWYiPjxzcGFuIHN0

eWxlPSJjb2xvcjojMDAwMDAwIj48c3Ryb25nPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTZweCI+

QXJlIHlvdSBpbnRlcmVzdGVkIGluIG1ha2luZyBjb25uZWN0aW9ucyB3aXRoIFVrcmFpbmlhbiB3

b21lbiBuZWFyYnk/PC9zcGFuPjxicj4KPGJyPgo8aW1nIHNyYz0iaHR0cHM6Ly9saDctdXMuZ29v

Z2xldXNlcmNvbnRlbnQuY29tL21mUFljeFVibThUUzJIUFNwdnFodFpEYXV3R240YXJkNFpkdF9H

M0x4YmxaR25tOTBadDJXa3N3dDJMX2p6UDhPbEFvUEMtYmdBYnhzMjZKc2U4Z0ZiazhudGdRdmM1

N0ZsOE16TWd1R2ZXR2FKQlpmbHZWZGpGMTBNNXlRUzQxdUJKVE1fWTl4TnJCWUFzZnE4bXFlN28i

IHN0eWxlPSJoZWlnaHQ6MjY1cHg7IHdpZHRoOjYyNHB4Ij48L3N0cm9uZz48L3NwYW4+PC9zcGFu

Pjwvc3Bhbj48L3A+Cgo8cCBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPjxzcGFuIHN0eWxlPSJm

b250LXNpemU6MTZweCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkFyaWFsLHNhbnMtc2VyaWYi

PjxzcGFuIHN0eWxlPSJjb2xvcjojMDAwMDAwIj48c3Ryb25nPkFyZSB5b3Ugc2Vla2luZyBhIGRp

c3RpbmN0aXZlIHBsYXRmb3JtIHRvIG1lZXQgc2luZ2xlcz8gRGlzY292ZXIgPGEgaHJlZj0iaHR0

cHM6Ly9yYi5neS85ZDN5OW4iPlVrcmFpbmlhbkdpcmxzPC9hPiwgd2hlcmUgeW91IGNhbiBpbmR1

bGdlIGluIG1lYW5pbmdmdWwgY29udmVyc2F0aW9ucyB1bmxpa2UgdGhvc2UgZm91bmQgb24gY29u

dmVudGlvbmFsIGRhdGluZyBzaXRlcyE8L3N0cm9uZz48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3A+

Cgo8cD4mbmJzcDs8L3A+Cgo8cCBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPjxzdHJvbmc+PHNw

YW4gc3R5bGU9ImZvbnQtc2l6ZToxMHB4Ij7irIfirIcmbmJzcDs8c3BhbiBzdHlsZT0iZm9udC1m

YW1pbHk6QXJpYWwsc2Fucy1zZXJpZiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDAwMDAiPkJyb3dz

ZSBwcm9maWxlcyBvZiB0aGVzZSB0aHJlZSBsYWRpZXMgYW5kIG1vcmUgdmlhIHRoaXMgbGluayA8

L3NwYW4+PC9zcGFuPuKsh+Kshzwvc3Bhbj48L3N0cm9uZz48L3A+Cgo8cCBzdHlsZT0idGV4dC1h

bGlnbjpjZW50ZXIiPjxhIGhyZWY9Imh0dHA6Ly9zaG9ydHVybC5hYy83ZGcwaCIgc3R5bGU9InRl

eHQtZGVjb3JhdGlvbjpub25lIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjE4cHQiPjxzcGFuIHN0

eWxlPSJmb250LWZhbWlseTpBcmlhbCxzYW5zLXNlcmlmIj48c3BhbiBzdHlsZT0iY29sb3I6IzEx

NTVjYyI+PHN0cm9uZz5Mb3ZlTGlua3I8L3N0cm9uZz48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L2E+

PC9wPgoKPHA+Jm5ic3A7PC9wPgoKPHAgc3R5bGU9InRleHQtYWxpZ246Y2VudGVyIj48c3BhbiBz

dHlsZT0iZm9udC1zaXplOjE4cHgiPjxzdHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkFy

aWFsLHNhbnMtc2VyaWYiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAwMDAwIj48c3Ryb25nPlJlZ2lz

dGVyIG5vdyBhdCBubyBjb3N0LCBmb3IgYSBsaW1pdGVkIHRpbWUgb25seSEgU2VpemUgdGhpcyBv

cHBvcnR1bml0eSBiZWZvcmUgaXQgZGlzYXBwZWFycyE8L3N0cm9uZz48L3NwYW4+PC9zcGFuPjwv

c3Ryb25nPjwvc3Bhbj48YnI+CiZuYnNwOzwvcD4KCjxwIHN0eWxlPSJ0ZXh0LWFsaWduOmNlbnRl

ciI+Jm5ic3A7PC9wPgoKPHAgc3R5bGU9InRleHQtYWxpZ246Y2VudGVyIj48YnI+Cjxicj4KVG8g

b3B0IG91dCBvZiByZWNlaXZpbmcgb3VyIHVwY29taW5nIHByb21vdGlvbnMsIGNsaWNrIHRoZSA8

YSBocmVmPSJodHRwOi8vdC5seS9IRVVkdCI+dW5zdWJzY3JpYmUgbGluazwvYT4uPHNwYW4gc3R5

bGU9ImZvbnQtc2l6ZToyMnB4Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6QXJpYWwsc2Fucy1z

ZXJpZiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDAwMDAiPiA8L3NwYW4+PC9zcGFuPjwvc3Bhbj48

L3A+Cgo8cD4mbmJzcDs8L3A+Cgo8cD4mbmJzcDs8L3A+Cgo8cD48c3Ryb25nPjxzdHJvbmc+Jm5i

c3A7PC9zdHJvbmc+PC9zdHJvbmc+PC9wPgoKPHAgc3R5bGU9InRleHQtYWxpZ246Y2VudGVyIj48

c3Ryb25nPjxzdHJvbmc+Jm5ic3A7PC9zdHJvbmc+PC9zdHJvbmc+PC9wPgoKPHAgc3R5bGU9InRl

eHQtYWxpZ246Y2VudGVyIj48c3Ryb25nPjxzdHJvbmc+Jm5ic3A7PC9zdHJvbmc+PC9zdHJvbmc+

PC9wPgo8L2JvZHk+CjwvaHRtbD4=



--===============8701990277900836242==--

Nigerian Spam from Microsoft outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 24 Mar 2024 12:24:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1roSUt-00000000N32-1Nji

for dave@doctor.nl2k.ab.ca;

Sun, 24 Mar 2024 12:23:07 -0600

Resent-From: The Doctor

Resent-Date: Sun, 24 Mar 2024 12:23:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lo4gbr01rlhn2145.outbound.protection.outlook.com ([40.95.115.145]:3239 helo=GBR01-LO4-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1roPQl-00000000G42-0Goe

for sales@nk.ca;

Sun, 24 Mar 2024 09:06:42 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=BXfg6JA+JAmsBfUvcZqd/Gfy7hwpH6DIJ9bjRi5/FRLxSSoQ2huzW8Kl3dX8DkLpoyXObZSfZ6hm0FZNKXdrdLaCoDu4Y2dzrzmr45zxT9mk6spa1sXXHelBYtPvsi2WgtoKYuYBVwWEaiBNGue4NUFEpXq5gJDmzr8zFIGqpzChjCskXIe0VQQD5L/GfkNhAmF0A0puIV2h9haHMhZDHHeVOya9tBXlIBaMiFZPLuSvx6IE4253hhwRwyRNbTsWH6DQODZL1yHF28wlQzxKHn41ha/q0Y5J91rhQaDqJre3bq2NbVJmzoKbWN8D/V/njcRDGtW5zBZW1Bin5cOucA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=KOYlofxoeno+mXY12bZn7zRugj7bRZ3E5xvL3LShNPo=;

b=N555ANbRiN1pYo/HBUPDvMV5vDg8u+gFeveu70m0MpB+wq9gGil5w+vOWtzA8/gQ0nX38uvsrHRTyg7Zw99rMlSNXNQcZLLaHQgjtbpLUvfV9+Bp1DfDoe5w+49XGisTJKkDK4K23FQuxJREv6FZNZXB30jWbs2M74YheuuHLQ+5W3d7rn2+cm5lXn80NSOp3huHNTD/+wtHMmno5UX4P0pzJw1Qrv14E2HWAegrJswHDDjOIUVyfwHX5jAVe9KzDj3rUZ/42C6cbBUTn4Ur2Nb4n7JxCbpR8pHwQuaxvCmhYLY4utzWtNh6IC5rHIn2zol7DrdxHWgBwOo20/Rx8w==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

193.39.172.206) smtp.rcpttodomain=nisanthinc.com smtp.mailfrom=office.net;

dmarc=none action=none header.from=office.net; dkim=none (message not

signed); arc=none (0)

Received: from LO4P123CA0528.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:2c5::10)

by LO6P123MB7303.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:33c::16) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7409.31; Sun, 24 Mar

2024 15:04:35 +0000

Received: from LO1PEPF000022FD.GBRP265.PROD.OUTLOOK.COM

(2603:10a6:600:2c5:cafe::7b) by LO4P123CA0528.outlook.office365.com

(2603:10a6:600:2c5::10) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7409.13 via Frontend

Transport; Sun, 24 Mar 2024 15:04:35 +0000

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 193.39.172.206)

smtp.mailfrom=office.net; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=office.net;

Received-SPF: None (protection.outlook.com: office.net does not designate

permitted sender hosts)

Received: from ebyst.gwynedd.llyw.cymru (193.39.172.206) by

LO1PEPF000022FD.mail.protection.outlook.com (10.167.240.21) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.7409.10 via Frontend Transport; Sun, 24 Mar 2024 15:04:35 +0000

Received: from HQ-EX19-1.gwynedd.rhwydwaith (172.18.4.3) by

HQ-EX19-1.gwynedd.rhwydwaith (172.18.4.3) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.1258.28; Sun, 24 Mar 2024 15:04:32 +0000

Received: from User (172.18.4.86) by HQ-EX19-1.gwynedd.rhwydwaith (172.18.4.3)

with Microsoft SMTP Server id 15.2.1258.28 via Frontend Transport; Sun, 24

Mar 2024 15:04:30 +0000

Reply-To:

From: Federal Reserve Bank

Subject: Dead Or ALIVE....4s

Date: Sun, 24 Mar 2024 08:04:29 -0700

MIME-Version: 1.0

Content-Type: text/html; charset="Windows-1251"

Content-Transfer-Encoding: 7bit

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Message-ID: <11a10617-b4eb-4685-866e-2dc8ffee7ef7@HQ-EX19-1.gwynedd.rhwydwaith>

To: Undisclosed recipients:;

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: LO1PEPF000022FD:EE_|LO6P123MB7303:EE_

X-MS-Office365-Filtering-Correlation-Id: c9297250-8174-4635-acd4-08dc4c13b829

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?windows-1251?Q?dIyOeQ3nrogoZqKgwud3Od6wqLNT9DcZyVouLuvLO/3M2bYRwduhiHnA?=

=?windows-1251?Q?RUGrZD+qLAUlkCgE4V+lAB7nwP1qpX9IpTwwPNa4/Cys/2eBQ3fM7bDN?=

=?windows-1251?Q?fmQj2YrxN9unFe/NYavx64mDu8KgT2bzemsUoM6pS5XiPxHRiJCNUKuu?=

=?windows-1251?Q?5SwxvqcQGIDANWChaXWB8mwzcGI1kb0Ht6qKMVnFQDS3NrBBY/V83JYE?=

=?windows-1251?Q?QFTQiOKGodYDB9ort6uLNtlypxMnWb+NFeNLdo0SGzOgr5hl3plJfEh4?=

=?windows-1251?Q?5bh7467C0pH3cVw/ysDPTQ6fu56u5zy9SlLCSb6XoW0tRR2G33ALAZMB?=

=?windows-1251?Q?7GiwT01XqBgqMHSyLLPsKs54nJ01YLKlJEY9ZIoQIObGPudrZKJcVgG0?=

=?windows-1251?Q?5BwiIiRUO8Tvd9VGKQkuxDmctLe9KM8rJylgBWz2hRDSQWATD+QUtYg/?=

=?windows-1251?Q?BtfUBymk6J3qwlkJQsxVF7oF/yT2pWXrWGX6w7rgoOF4BL3ewkwIgLKp?=

=?windows-1251?Q?NIR7xH1XHlKukjlYkAsc4rddFtGjzbF2caWTAQ8OEvzP+c90ULqo8lvo?=

=?windows-1251?Q?UewADpanBoVGDkBm3hq9XZPB+alu6ZfJZ7goMQoPGivvhEWn92/qUWAb?=

=?windows-1251?Q?+QKzLZvxuWl0JTfoZrNht7EKX3BPe73FG6RH49DzUcfPxGnSL1IZMna9?=

=?windows-1251?Q?9yNpJLPiy5OTSkvFW8eres2Az/mrTr/BXkcXNaa93HYPFwDCdfh57DWL?=

=?windows-1251?Q?V8Ee/JjOMietf9q7nGWSXygHmPrtbf5VWAqYCzTV+Q0AD010G9i0oU3v?=

=?windows-1251?Q?248khS+3QmrAAtkS5rH6HRexadAm2DEL910xaXx54fxkNwqnFN529Uyb?=

=?windows-1251?Q?REG1gWd57ejpPDVGbMwobp1IIgbZQq1b1y8QTlYPVAiKwt3Cpj+N4cDy?=

=?windows-1251?Q?lRwquV8urPlbWKdhD/2+fldbS1cP44YkHy5M7hUKWjaThLq56yK1wPf0?=

=?windows-1251?Q?Iazkspb3ZTsICYH40i3jVK24Ehn62QzpDD9GpcOwk0i0vseZRn1r0bIr?=

=?windows-1251?Q?hcYH/xOpe3L9tP9FkVNOwmOiFnNqSWs/z3he9c1dx/gPnLCyZ8UO9Sui?=

=?windows-1251?Q?4GV+zXwnkkIQcLNcfjv3y6Zzslnbrz/SWIObRfGtWSZNhCaHdAtBwtkT?=

=?windows-1251?Q?09QUHAyKlvSH3ohOnJE7P7ULJ3BLrk6+g2nXI4fMPLE6iI3PUxaV2qu8?=

=?windows-1251?Q?U6w7X7V95OOcjKkxPA4=3D?=

X-Forefront-Antispam-Report:

CIP:193.39.172.206;CTRY:GB;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:ebyst.gwynedd.llyw.cymru;PTR:systemau.gwynedd.llyw.cymru;CAT:OSPM;SFS:(13230031)(61400799018)(82310400014)(7416005)(48200799009)(376005)(35950700004)(2700400011);DIR:OUT;SFP:1023;

X-OriginatorOrg: cyngorgwynedd.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Mar 2024 15:04:35.6658

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: c9297250-8174-4635-acd4-08dc4c13b829

X-MS-Exchange-CrossTenant-Id: 99841289-67fd-4e8e-b813-12b22f782ece

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=99841289-67fd-4e8e-b813-12b22f782ece;Ip=[193.39.172.206];Helo=[ebyst.gwynedd.llyw.cymru]

X-MS-Exchange-CrossTenant-AuthSource: LO1PEPF000022FD.GBRP265.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO6P123MB7303

X-Spam_score: 30.8

X-Spam_score_int: 308

X-Spam_bar: ++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Beneficiary, We wish to inform you that a power of attorney

was forwarded to our office this morning, by two gentlemen regarding your

unclaimed fund of $5.5 Million Dollar. One of them is an American citizen

named [...]



Content analysis details: (30.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=GBR01-LO4-obe.outbound.protection.outlook.com;ip=40.95.115.145;r=doctor.nl2k.ab.ca]

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam

0.0 NSL_RCVD_FROM_USER Received from User

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamtash1949(at)gmail.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.95.115.145 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[40.95.115.145 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.95.115.145 listed in wl.mailspike.net]

2.7 UNCLAIMED_MONEY BODY: People just leave money laying around

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

1.9 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.2 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Dead Or ALIVE....4s













Dear Beneficiary,




 




We wish to inform you that a power of attorney was forwarded to our office this morning, by two gentlemen regarding your unclaimed fund of $5.5 Million Dollar. One of them is an American citizen named Mr. Robert Porter and the other is Mr. Wilhelm Berg a Swedish citizen.




 




The document claims these gentlemen to be your authorized representatives, and the power of attorney states that you are already deceased. It further states that your death was due to lung cancer, with your date of death being March 27th, 2019.




 




They have now submitted a new account to replace the receiving account that was in the original claim of funds. These funds have remained unclaimed for quite some time and the need for resolution is pressing.




 




Below is the new account they have submitted.




 




Account Name: Robert Porter /Wilhelm Berg




Account: 5007-29 438 66




IBAN-nr: SE4150000000050072943866




Bic-kod: ESSESESS




Skandinaviska Enskilda Banken. (SEB :-)




SWEDEN.




 




In the event that you are in fact still alive, we ask that you confirm your existence by responding to this email. You are to view this as a matter requiring immediately attention and response. We have 48 hours monitoring of all activities within Federal Reserve Bank.




 




We have contacted the bank in the Sweden asking them to wait for further directives from Federal Reserve Bank, prior to authorizing any withdrawals in any form. Our request is based entirely on our attempt to verify that you are in fact deceased, before money is wrongly disbursed.




 




Finally, we forewarn you that if we do not hear back from you shortly, we will have to assume that you are in fact deceased and Federal Reserve Bank will proceed with release funds to the above newly submitted account.




 




Sincerely,




 




Lorie K. Logan (frbdallasdistrict@outlook.com)




Federal Reserve System2200 N Pearl St, Dallas, TX 75201, USA




 




 




Nigerian Spam from Microsoft outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 24 Mar 2024 12:24:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1roSUo-00000000N1Q-3AYi

for dave@doctor.nl2k.ab.ca;

Sun, 24 Mar 2024 12:23:02 -0600

Resent-From: The Doctor

Resent-Date: Sun, 24 Mar 2024 12:23:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-cwxgbr01rlhn2156.outbound.protection.outlook.com ([40.95.114.156]:25314 helo=GBR01-CWX-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1roPKo-00000000FdT-3VeS

for root@nk.ca;

Sun, 24 Mar 2024 09:00:34 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=fwlnAHyk2yQaT1/JSsfT31KXE+Yz7puieZIE1BrjR8/k8O4Ql9S75lFGP4FfEtKKYCFtJ979sHA0EyUlTlnZTRlfHCrVKsXo9ae8ipolS+5M2YVfpfHWb2gx6KGI84+1WoCdfuJpt5wfkBkVlbJhPItiqIAWvydyBtdxO9/SFY1OAfRWlzAKdDf1A7sEcgr6r0Vz7z02WLDklaweUdxqfXo5ITqZMOfQ4OidbIVouPHFHhJGSMq/6s80mZAwa0kmc1UslVIDhGxxWPwFxlOT78Lw/DO9IP7r/ZwowTXwuYHvh3O6Kcpvb+z9/jub0QLbSU9Hntp5Qae+Ay9MLR0gKQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=KOYlofxoeno+mXY12bZn7zRugj7bRZ3E5xvL3LShNPo=;

b=oMqqzv2eEIAykOC5pQawUjKSTkVi/OJMHp4xXqx1DdLiO47kawSkvVgmZy0+62fxDyMWaWhNjUswVeajdutHzUuxngavbDaVcbBMbYSDHasZ2lwEqBfeBHICGc959Fxh+4AHfFG0blisLVv0ELMk8UWFYfrqepTSkRaD+h+jnyMsagPdf30dH4Nd0S0A1/NGzL8t7o6r83CR8rHwg6wBAQSjJmjqqWwZSXtofIRMZXY48pqFq084v5x6S71IXmngazbQjAwCjzDx+R+e61XddJWM6M/FndvfcaYV1AVtP37PYJHhZpnCyxd/5ByOGNNkHHtSgRK/xAzMnvVPNs7ysw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

193.39.172.206) smtp.rcpttodomain=nfi.ren.nic.in smtp.mailfrom=office.net;

dmarc=none action=none header.from=office.net; dkim=none (message not

signed); arc=none (0)

Received: from LO4P265CA0279.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:37a::18)

by LO6P123MB6597.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:2b6::10) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7409.30; Sun, 24 Mar

2024 14:58:28 +0000

Received: from LN2PEPF000100CA.GBRP265.PROD.OUTLOOK.COM

(2603:10a6:600:37a:cafe::7c) by LO4P265CA0279.outlook.office365.com

(2603:10a6:600:37a::18) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7409.13 via Frontend

Transport; Sun, 24 Mar 2024 14:58:28 +0000

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 193.39.172.206)

smtp.mailfrom=office.net; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=office.net;

Received-SPF: None (protection.outlook.com: office.net does not designate

permitted sender hosts)

Received: from ebyst.gwynedd.llyw.cymru (193.39.172.206) by

LN2PEPF000100CA.mail.protection.outlook.com (10.167.240.4) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.7409.10 via Frontend Transport; Sun, 24 Mar 2024 14:58:27 +0000

Received: from HQ-EX19-1.gwynedd.rhwydwaith (172.18.4.3) by

HQ-EX19-1.gwynedd.rhwydwaith (172.18.4.3) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.1258.28; Sun, 24 Mar 2024 14:58:23 +0000

Received: from User (172.18.4.86) by HQ-EX19-1.gwynedd.rhwydwaith (172.18.4.3)

with Microsoft SMTP Server id 15.2.1258.28 via Frontend Transport; Sun, 24

Mar 2024 14:58:22 +0000

Reply-To:

From: Federal Reserve Bank

Subject: Dead Or ALIVE....4s

Date: Sun, 24 Mar 2024 07:58:21 -0700

MIME-Version: 1.0

Content-Type: text/html; charset="Windows-1251"

Content-Transfer-Encoding: 7bit

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Message-ID:

To: Undisclosed recipients:;

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: LN2PEPF000100CA:EE_|LO6P123MB6597:EE_

X-MS-Office365-Filtering-Correlation-Id: f7d09b9f-c5ad-4669-b1dc-08dc4c12dcd6

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?windows-1251?Q?Hg6rtWKZVcJ1PFdKmMUz2XqadsisPQYhRSOO/VQ7WeVRS3E8DBnaqcH5?=

=?windows-1251?Q?KZbGZqEctGFT1YCsbyeeMGr0nYk/O1iEtmOu4KXJQstSXAIOL0QhjOzy?=

=?windows-1251?Q?UgCxadT6LwYLuwYbz4jd9OgTCZNctNUZjTjx4p2Xx1UAeA2mFWUJ2G/i?=

=?windows-1251?Q?2Hr2njs88+L0Q5Pau8xj9CSmDfr9FUPFWpEPvYuVJ0adWgfenTeh0aG0?=

=?windows-1251?Q?jaXU9l5Uqxz5rO8N8+Mg604cZrMXPnj9Vti4kt5+Z4LE6KCuyFfGjcp9?=

=?windows-1251?Q?aHTVhTcAeZfX40l0zgyXHu7a7xl6Vp1LWeYOgBrBtn0dmVkLkUof+mSB?=

=?windows-1251?Q?m7lvbib+xknc8IEDQpMKO8M7vhTKAjB1CX7bEFCQPa+7fqmiU5isoQSl?=

=?windows-1251?Q?z1KlR80z+03wBwKBYRddsV7uqoguVdydETj30QDTdNNlF9HCWcDZB8AI?=

=?windows-1251?Q?2+0O6FnpCtjzQC0hBdWGQ5XMxuQ3Y0kCXYrLcJvJGu/HKtX7/IlPIxeI?=

=?windows-1251?Q?kooSfSUb0oXuLzt0sTAh3R5jDC3cfnLS4Bv3lzvB5EtIqvWgAV+aVhKT?=

=?windows-1251?Q?M3jCQEadFzCP6V55A5yzZAnijXYOpq0rJNs5i8oksQWfBgvxR8U/b4j3?=

=?windows-1251?Q?Ll990554J3953UMrDVjNiwlRrj4YO0HV/Jp8eJAe9DCy2mIDKHQSMWWy?=

=?windows-1251?Q?YYzGiOFH0xVl+FsbPbngp9eqnPKxhm0KzoNsFlVuO7zu9/xWPswYck+t?=

=?windows-1251?Q?1p5KgsBqgCsDQgW/dt3SsxAD/lIk4p5+aqHBNuz7CNi597cDW1xZzhuf?=

=?windows-1251?Q?GVb2F4MqM40KPkxYZRMvxa3cVv8b7y0oeQtVQqLsLxCSp/GICGwJvmyw?=

=?windows-1251?Q?aItqjceYb7bgmwnqSDiIozjB1aeFb+BZ5f46mUw5rbREA+38s+uMq7fS?=

=?windows-1251?Q?0WH/zB31QLf/91LeIE6wKyBRhgyAy5DEcdCmaJKQlVFN5JOflNo9W+VQ?=

=?windows-1251?Q?+Qz7soHxpzdQTY0p1hlToXhUNUnqTTpcYMQyBEH/f7N/zNB+BEdifSdT?=

=?windows-1251?Q?ucMGGJezMZ0Uo/Pvfjix84lWhhy7Kn8gKfkbgVyrwPv+0EGdUAQXpRmY?=

=?windows-1251?Q?iykFJH04VpdSVCukfn6zO9uaZBJQ3gVkBp2AMoQHTeciZcZGFvJhgmOJ?=

=?windows-1251?Q?/cZrte12PhZaRloaKa7Y1uUg9mtSm1mV2pQSSUvGd9IRhUvnc+7W5+RP?=

=?windows-1251?Q?hx/ej+pn/+jepo+pvaJ70eN0GvinP5EOy8Z1DKAG6OhIPsY8HaRk3Da0?=

=?windows-1251?Q?97DOOA=3D=3D?=

X-Forefront-Antispam-Report:

CIP:193.39.172.206;CTRY:GB;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:ebyst.gwynedd.llyw.cymru;PTR:systemau.gwynedd.llyw.cymru;CAT:OSPM;SFS:(13230031)(61400799018)(48200799009)(82310400014)(35950700004)(32650700005)(7416005)(376005)(2700400011);DIR:OUT;SFP:1023;

X-OriginatorOrg: cyngorgwynedd.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Mar 2024 14:58:27.7166

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: f7d09b9f-c5ad-4669-b1dc-08dc4c12dcd6

X-MS-Exchange-CrossTenant-Id: 99841289-67fd-4e8e-b813-12b22f782ece

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=99841289-67fd-4e8e-b813-12b22f782ece;Ip=[193.39.172.206];Helo=[ebyst.gwynedd.llyw.cymru]

X-MS-Exchange-CrossTenant-AuthSource: LN2PEPF000100CA.GBRP265.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO6P123MB6597

X-Spam_score: 30.8

X-Spam_score_int: 308

X-Spam_bar: ++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Beneficiary, We wish to inform you that a power of attorney

was forwarded to our office this morning, by two gentlemen regarding your

unclaimed fund of $5.5 Million Dollar. One of them is an American citizen

named [...]



Content analysis details: (30.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.95.114.156 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[40.95.114.156 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.95.114.156 listed in wl.mailspike.net]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=GBR01-CWX-obe.outbound.protection.outlook.com;ip=40.95.114.156;r=doctor.nl2k.ab.ca]

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam

0.0 NSL_RCVD_FROM_USER Received from User

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamtash1949(at)gmail.com]

2.7 UNCLAIMED_MONEY BODY: People just leave money laying around

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.2 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

1.9 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Dead Or ALIVE....4s













Dear Beneficiary,




 




We wish to inform you that a power of attorney was forwarded to our office this morning, by two gentlemen regarding your unclaimed fund of $5.5 Million Dollar. One of them is an American citizen named Mr. Robert Porter and the other is Mr. Wilhelm Berg a Swedish citizen.




 




The document claims these gentlemen to be your authorized representatives, and the power of attorney states that you are already deceased. It further states that your death was due to lung cancer, with your date of death being March 27th, 2019.




 




They have now submitted a new account to replace the receiving account that was in the original claim of funds. These funds have remained unclaimed for quite some time and the need for resolution is pressing.




 




Below is the new account they have submitted.




 




Account Name: Robert Porter /Wilhelm Berg




Account: 5007-29 438 66




IBAN-nr: SE4150000000050072943866




Bic-kod: ESSESESS




Skandinaviska Enskilda Banken. (SEB :-)




SWEDEN.




 




In the event that you are in fact still alive, we ask that you confirm your existence by responding to this email. You are to view this as a matter requiring immediately attention and response. We have 48 hours monitoring of all activities within Federal Reserve Bank.




 




We have contacted the bank in the Sweden asking them to wait for further directives from Federal Reserve Bank, prior to authorizing any withdrawals in any form. Our request is based entirely on our attempt to verify that you are in fact deceased, before money is wrongly disbursed.




 




Finally, we forewarn you that if we do not hear back from you shortly, we will have to assume that you are in fact deceased and Federal Reserve Bank will proceed with release funds to the above newly submitted account.




 




Sincerely,




 




Lorie K. Logan (frbdallasdistrict@outlook.com)




Federal Reserve System2200 N Pearl St, Dallas, TX 75201, USA