Phish | Entries from Sunday, May 12. 2024

Aeroplan Phish

Posted by Dave Yadallee on Sunday, May 12. 2024

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 May 2024 12:29:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s6DvY-00000000Hvf-1OgE

for dave@doctor.nl2k.ab.ca;

Sun, 12 May 2024 12:28:04 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 May 2024 12:28:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 218.8.218.46.rev.sfr.net ([46.218.8.218]:63334 helo=sewan.fr)

by doctor.nl2k.ab.ca with esmtp (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s6Cr7-000000007Fz-3haR

for doctor@netknow.ca;

Sun, 12 May 2024 11:19:30 -0600

From: "Sharefile By Aeroplan"

To: doctor@netknow.ca

Subject: An encrypted sharefile message was securely sent to you by Aeroplan.

Date: 12 May 2024 18:47:02 +0200

Message-ID: <20240512184701.DEA9C2FE46CA8481@sewan.fr>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 17.2

X-Spam_score_int: 172

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview:

Content analysis details: (17.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[46.218.8.218 listed in will-spam-for-food.eu.org]

[46.218.8.218 listed in will-spam-for-food.eu.org]

[46.218.8.218 listed in will-spam-for-food.eu.org]

[46.218.8.218 listed in will-spam-for-food.eu.org]

[46.218.8.218 listed in will-spam-for-food.eu.org]

[46.218.8.218 listed in will-spam-for-food.eu.org]

[46.218.8.218 listed in will-spam-for-food.eu.org]

[46.218.8.218 listed in will-spam-for-food.eu.org]

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[46.218.8.218 listed in psbl.surriel.com]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[46.218.8.218 listed in dnsbl.ahbl.org]

[46.218.8.218 listed in dnsbl.ahbl.org]

[46.218.8.218 listed in dnsbl.ahbl.org]

[46.218.8.218 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[46.218.8.218 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[46.218.8.218 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[46.218.8.218 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[46.218.8.218 listed in dnsbl.ahbl.org]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=communications%40sewan.fr;ip=46.218.8.218;r=doctor.nl2k.ab.ca]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=sewan.fr;ip=46.218.8.218;r=doctor.nl2k.ab.ca]

0.0 TVD_RCVD_IP Message was received from an IP address

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.2 SARE_HTML_IMG_ONLY FULL: Short HTML msg, IMG and A HREF, maybe naught

else

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

2.0 MIXED_HREF_CASE Has href in mixed case

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} An encrypted sharefile message was securely sent to you by Aeroplan.

mz/aero1.png">

I1.16KL0LD37.6KI2.25KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Aeroplan Phish

Posted by Dave Yadallee on Sunday, May 12. 2024

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 May 2024 12:29:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s6Dvf-00000000IUy-3XXP

for dave@doctor.nl2k.ab.ca;

Sun, 12 May 2024 12:28:11 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 May 2024 12:28:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 218.8.218.46.rev.sfr.net ([46.218.8.218]:56678 helo=sewan.fr)

by doctor.nl2k.ab.ca with esmtp (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s6DBE-00000000Abq-0a10

for doctor@nl2k.ab.ca;

Sun, 12 May 2024 11:40:16 -0600

From: "Sharefile By Aeroplan"

To: doctor@nl2k.ab.ca

Subject: An encrypted sharefile message was securely sent to you by Aeroplan.

Date: 12 May 2024 19:07:49 +0200

Message-ID: <20240512190749.E10FEB2007E1D7D9@sewan.fr>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 17.2

X-Spam_score_int: 172

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview:

Content analysis details: (17.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[46.218.8.218 listed in will-spam-for-food.eu.org]

[46.218.8.218 listed in will-spam-for-food.eu.org]

[46.218.8.218 listed in will-spam-for-food.eu.org]

[46.218.8.218 listed in will-spam-for-food.eu.org]

[46.218.8.218 listed in will-spam-for-food.eu.org]

[46.218.8.218 listed in will-spam-for-food.eu.org]

[46.218.8.218 listed in will-spam-for-food.eu.org]

[46.218.8.218 listed in will-spam-for-food.eu.org]

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[46.218.8.218 listed in psbl.surriel.com]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[46.218.8.218 listed in dnsbl.ahbl.org]

[46.218.8.218 listed in dnsbl.ahbl.org]

[46.218.8.218 listed in dnsbl.ahbl.org]

[46.218.8.218 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[46.218.8.218 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[46.218.8.218 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[46.218.8.218 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[46.218.8.218 listed in dnsbl.ahbl.org]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=communications%40sewan.fr;ip=46.218.8.218;r=doctor.nl2k.ab.ca]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=sewan.fr;ip=46.218.8.218;r=doctor.nl2k.ab.ca]

0.0 TVD_RCVD_IP Message was received from an IP address

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.2 SARE_HTML_IMG_ONLY FULL: Short HTML msg, IMG and A HREF, maybe naught

else

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

2.0 MIXED_HREF_CASE Has href in mixed case

0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} An encrypted sharefile message was securely sent to you by Aeroplan.

mz/aero1.png">

I1.16KL0LD37.6KI2.25KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Costco Phish

Posted by Dave Yadallee on Sunday, May 12. 2024

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 11 May 2024 17:29:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s5w97-00000000AT9-1urZ

for dave@doctor.nl2k.ab.ca;

Sat, 11 May 2024 17:28:53 -0600

Resent-From: The Doctor

Resent-Date: Sat, 11 May 2024 17:28:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [69.48.179.234] (port=57786 helo=ufufl.edu)

by doctor.nl2k.ab.ca with esmtp (Exim 4.97.1 (FreeBSD))

id 1s5vKX-000000002IJ-361c

for root@nl2k.ab.ca;

Sat, 11 May 2024 16:36:43 -0600

Authentication-Results: gmx.net; dkim=pass header.i=@kashflow.com

Received: from o7.mail.kashflow.com ([167.89.31.18]) by mx-ha.gmx.net

(mxgmx009 [212.227.15.9]) with ESMTPS (Nemesis) id 1Mi439-1saHvy2OkT-00ham5

for ; Sat, 11 May 2024 22:03:12 +0200

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kashflow.com;

h=content-transfer-encoding:content-type:from:mime-version:subject:

reply-to:to:cc:content-type:from:subject:to;

s=s1; bh=BklniVy++LhpSYS6lEqflCtJkmQO3YzyJFYzPZvoPFA=;

b=Xp0uP/WYFVIOiFvYWeGO5IqX3gTOKITQi+YurifhYq9S9CR7NTDqpSnHKFQBZKjXYH5/

m4g0tcnrLljTlnWEbkbFf6cD/cfORbrnVYWpJIvp6bkBPVyh+9J4+qaFSe58fGOnmjOMTY

Zz9/25XcrERHPw9HwLQZjm90sQoCIpq5UNgTLSCkFQS4bcA8Bv09KomFNwK90b660QwYrX

7Rx/4r3uihXTeor3Ddx0i2qVFPiHLVxgyuI8IDxAfP0OioKQu24k9UwsITtJScy9wLPeAY

VNlzYWlcHpL1HiV6WXIrpyx18QoTbiw4I4sKBttBpHTgQTnEIocYqLCcoT3zjrQQ==

Received: by filterdrecv-659c47b755-5hbf2 with SMTP id filterdrecv-659c47b755-5hbf2-1-663FCEFE-39

2024-05-11 20:03:10.343690913 +0000 UTC m=+1027331.041704379

Received: from MjI5NDY5MQ (unknown)

by geopod-ismtpd-8 (SG) with HTTP

id MFloDmTsQm6S_GKrhzo5tA

Sat, 11 May 2024 20:03:10.161 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=us-ascii

Date: Sat, 11 May 2024 22:33:57 +0000

From: Message from Costco

Mime-Version: 1.0

Message-ID:

X-Mailer: Microsoft CDO for Windows 2000

X-MimeOLE: Produced By Microsoft MimeOLE V6.1.7601.283975

X-MailerIO: 283975:5679166295

Subject: You have been selected for a Tupperware set

Reply-To: Message from Costco

X-SG-EID:

=?us-ascii?Q?u001=2E2dU4z=2FWtPTn3IAI+T2Wk4rvV3ZRgQiRb6uQtLjAeBz8I+62Z7902wcH7S?=

=?us-ascii?Q?8fD6XRA2e97MRDccekaCDMOwcl73OFS2iufs6FE?=

=?us-ascii?Q?7jfchMMOrfdO+nOYAEd+elx16LgcH6aCR6BjDlu?=

=?us-ascii?Q?wpUi8G5cTfYi2=2FVhKWVa+WPOi+fhOFBSESC12jm?=

=?us-ascii?Q?KFw+uyQG1PHQJYxiFP0RNdV=2FGC5ZwCtWkgxzJGT?=

=?us-ascii?Q?riMawO7k2idw3VHvSX4yCzepELsvIvD5HePp2Hg?=

=?us-ascii?Q?2pLeih97P=2F2sIyGtt19L5tlGCQ=3D=3D?=

To: ranjibolidaamine@alphafrau.de

X-Entity-ID: u001.PG5NHUku19G2mCTQK1EQEw==

X-GMX-Antispam: 0 (Mail was not recognized as spam); Detail=V3;

X-Spam-Flag: NO

UI-InboundReport: notjunk:1;M01:P0:cR88t8oZy7Q=;em1agBtcBhLphVL/dYDgA10UG6ik

r0XNf8hrklJW1pYklX2v8YV3ttFuZxNJJz5X2KEoJX6DPRJN3r92sWmdWjuwXA4Ze5586Opdo

cxmPhjWorqExlD9EC2UkN1ibY8s9jH43EhXy77+zvKJJP+DVBuCJ5Y/yFp5oUlCnR5ypCnoKF

GM7rYOD1hSRmzdtNw5fp4tc8AhCZGzqkRGTddFQDpE4dCpBGmYwkMq51ZST0dpItfhHdxCPG3

Ka3sTJ3lzbOLq4MfRZfVVbr5pePKuGrvjZOzc4RO+yKkxTjhGM8d6v7zE3ZTWGBXQT6PhshIk

u5m3+jcUUuhaxUVODGEkQlTsJ6j9ocXJUC/hQUWM5UrMPrLszWDmvaMxz6QHo7vlO7ShEC96A

AxDKhCfpf6Np2z45XuJMXyQlBPmEqsaU8ecl6rD2SHSkVdwm9UJlrSMyXFyjtgl3/2R76woQ7

oxtxAq0/BTsHL2XRvJAnjDzqYpiD/44TI64h14zJH0u0r/N2F8IHq+DwiILj6kpSWVoFTQtYA

uLzR4/4I4GKmcNHsb6/+c9/UMSkBJjVR55K9wkfFptgKCd2V+cTHRsfPyFpmmcEALhPjmITh0

+CuKBoxO5sUT62bbCPDMAE5TnGZlgF9MHzN+V+W1IKarBTirButX9/Eu4LCw+JsZCUMJ/e9Eb

6dUGxewm2w42nPT1hAR4vqlTqswOuxke9GK4sXdA/l4jb/ygea5eVzTXZQpVwLoBBYdq0eZoO

K4E6gqPHROynIucNCxwmerHG1PebyriaSSTGrdc9lZcDGZHieJMzDplUoAEn7sbYM40miWnCA

nwG1OH5fvzP59nQL4JgDYJWPe3umzGOT4gE2g3aK+zNnKJFm0fAom/BvWHsZunsFl28EJbdSQ

q21EH1DJ736esngTglmILsWA0f0THj6YT8rOI296lLrNxoxv2W4EK6mOt630hfFS9na56jOC6

dSk4UCokRzWRXv3RzXcNoLbfwBpaq6TFkBvwxWEzUC+7XESDktyfEy4ioOQ/+w3kXSRKsFdgr

ymBOj9nuNmACQgGK66oZNH/5752wAVcA7eXAje6Y+FjA5qSpa33MjHU6KOldaE425PDkpSoDR

YuPy2yTahPgD/8XyOsRY8CoaTkLFEgPNg35NYe7YMCR54C2qrHEfuzrgGr2eyMijrJbYh8lb3

VbE9fyeSSBBpgHByFNk/x6pyGi125rWwv6BILo6KN3fvh4Cy0JSDxR3ulcnGs3xzs5DDQUBJ9

xbZ7355VxJqmeHN4XbIUop2wpZZ1iWShu5xYFfv+Lqq9ATDnzKycCnqKEWwmKFZ4RecO/Ht2G

1ECuiYDyrKKNm0olQHz5cohxEBQXcxscSgPeTtI7KSJWyZ1U384oIAVfNuuYg9wP2tt8l3R+D

kbwG82Oj4IhecWxL2zNz80hmUFArbSLUn2hFk7Jui4bWNZGCtULs3s7B/UHnGsqGTKuR8Z9cY

OHSu9Dgtf1FP3M8cpOtsXRSgEDQJb18l7OWc2CfudW504a4YU+YLWmvl3DMDHh28c3C8X2L3Y

G20h8dZqhnqLoAxWWSrypO8yGX+5k1jRawvjdhv0GpOZ4ExrDh+TrAzlfk0G3yWJWqfKUqKvO

BaHBSRy+kDis5t3vr1/mi12tgb8b4um1OEHkPLp1ubxop5MwdWTbU35T9ZwZGOCK1OgpElrDF

mD24kuFLhXuN5/Ifm+4hkGed+p5R/YKW6YZ4L1hyDYWCtSj1dhbTLJISIA+4NryDd8mZm+MGE

20ZA7uLtWukiPr1eq0sDsrhJd3OYCmsbj/rzxSU9NqvCSICf//hCOJaZQTZLOAQUH+Ti6NJcf

g5Nym6MmMwSFxtLdy0GjeQ2I/KFdi28jVkb7RY/qhZ3gCNIL9825e+j/Sl2d+BHcZ2qbm1MKD

45rO/T0XucP3QPJ4S4bOiPIfEMZG9VxNKcQknZD5E4zNEFsPPQt4gGluNpqUjgU+0Ucf8IXDT

3cM+HiU73LQM+xrAtU8iV9VH4V8v/YSGztOf0O5DTZdH9lfiCWk09/OTkUPqE31WzY4L42M8/

k6BQG5G8wMdU1MWWkOQiGk8ix8i3OHk3YrXgb2dO4TfLxbicqcmRzSttPhWGe0WXV8yLdAv2V

1pl10oXn8xbI0pIuTotVRGwc5drh0KUKLksdIw06L0oUTXO5BKPVsxmQ7NJf7sKYyVnYUgfVN

k61VFzVP3pGDhwBQDdyQmDcR2IzIgSg8r9ZMyBpQHZNy7r2E3x+OW2wrEXYW4eEj6sgggrn0x

Wft6wrQrLm+p29qVZ6CsTlhTZpBNAl/5Y10munu/DHG+BIYx4wwk9F6NXTc+6hwkjFIBzedng

QBL+ZJH5G15ZkF3ODfoM6xn5OKV8COLRRevdlQDyYfOjKclk4MOHE0BzyyUlr5AhNPK4T23f2

9b8+RV+9gOqkne7SDJj8Lbrx/NhO8S+C9xiNOd2ogS8Y6w4eOy2GnAzn/W0z/sydB4wyCjl3c

jgV7YRaTAbSEEoA16d0F+2XZJbP0BkTgt+2tm+YV1v8gYl1nDWBndZ70Dj/mEFT0uTLllgQvE

kAxZISKRZNQGCFCnDfUWxdQzpq1O4mdVRiC3bQcqWpqGXoXaw3UCs/aFraOJl+2w9BgEZKQtp

Gr/3+viEGJzR/0VCXA7Jr0mqpcX10f+anaNP148nHFLgLaeFbnYhfLc2R2K1xocu3iyQTZ1EV

LzA2NZFi9BX4v34TyfrpJ3nJVWYwVlviOg/ubz5uwNvYbp0oKgqSEHhkE9yuoe5BsVxcPXkJ0

F5UZQ4CugcnGAHF7hlUGO4uYZ2iAZ+wSlZKifspvY3EsNmaE1dE8eKioFWdKbpEybOF/OR+kS

rrAiXnuaW3vR1ktwqJqlDgxq7OhPDYvadn+nb/2D/e5Uosi/yXCCBA9TO9ZkvraqWvjmTXFrM

Mib/S0Y6HisaDrjf1ec6NimaBN74xC+r1T7/yTUxSl1QlLxpyhSiVy75I+14IF3IamAOn2wzE

PBnQ8UsaZUkeOXC45IMyVMMaSdmjN/M0ZWmlVsIo3wGv0vTHIXPy/hMX7oemy7Vi9tkujmUWt

rXB6AsN7MtfZoT4BZfl8S3cvxeE9vRmAON3s2QvSgewYMA48eGnGO0ZnrTfj+W+cL7oFiTbsw

tOTW3i/XU6Vk3etxaFjAPwXikxTiwOrSdz/4qFbQWSBKqAWfaasRpJRGCC9H02nhr4qRw9NY6

+o1ahArlUxXbS06RvntMiTHFwaDHKVomy3OIrUA1SFWEVgTwBNa2IZvVyDevxWfLHrrVlOlU0

22V4GizL6e1r6QYcnVtxLokI5b4+n2w6aTRmNA1h1R4hhLkcjlnR9jJWdGcRUrwkkoYG+ZB43

Nls6wNbYP3sEKXTkiyh8BEG3IfDs17EjbnMGI+lJtzDdgvQo3ssf+vVkFea1tF2RN1o8Oft8+

nbI2holYOKz9sMyUmFAALY6KLIlGKI9ChDw3nguXrAmnA3n0qidsk00/p37fH4ZmYUchqtkeV

/9vUzzRrQSP3/MbrRGbxc129v0m7YzHlFFQ4kt9hnQuQjgDVSrx6VyfM7IxefGUkUaz3bTcAb

PZibV8ENHdswwadXP+8AF1gWGXweqQjfspJ9ucX6AGSQgwcOy+tqZeBUx9VxtPABKBs/8ZXNy

DLbN8GBkNv5wRgrcf203z97ZT25NfzVv133MTho9lae0LJdvGn2lCgsa+b2Wb0xO8dFRVUP2M

pS2H2sOE49mMSHBKfWkKNiehi/lCrwTA4sqWCgAR75HgroiTgq9GXrviCSDXGRpty0SCDd8G5

DrdW7e9SlRwV4gVpxTgmY4DOw1IqHgG9VM3VhlYf3sIrgVEwdVvpAK+57BdU0sUw4oW/rn97y

FFukWWpKxf8jb/XKPqZYwyqi6eTuWFCiq1FTdUtSZ+Obk6lE85aEVGbBu1cOKQ+JZnxR0BPpz

HITE/Re/w7Lx2asf66sRv3VnfIFWUneScNWzCrfeYM2inEDoHjdw/y9EE0HYic4TsyID/Yyz7

id16SYjVNbQsdvUYbCP1zqKBr/FC9LbwvZ/ByxNchs51G9IKiEiTafCNhVEjGPg+E1EX/4nbl

er7S3RSlU5cLIbAavTNOeX2zzrVXF6LF5rozPjmVxfD/FIeNbYfVl85I6RwWe2Y8RnkhCYr2p

WgDtFCoiT0X6p7LaQ4foSKwukmfB4DrfdYDQ3Ipph7frs2yPMaE03otvMbxcmFkxAdHgmAoyW

vK20Ze2eFSbPAAVsdm+mK674iqA/yrAPvp7lAW41QOhYS8PSMAKjRiaqhesK71g8LkguNaK+r

sn2aWC1IBjHSF7DLrtlrzvn/idLgDxnRFEYWE2IjjWvJfjQvb/5MgO/wx0TdxtZYGecLloNf2

WaDmNdfoB5So6QdfUGK4H73wq/YKvrjYqBW6fY4JvJjzoWReYP4kJ+uj+yjo8mLOd5VAEPLCu

LSyo/q4N2KS8Yjn/gxTkM2wPvnxRDjI8+Rpev7ZxQ7qVOfFSJ3DdrN3EzgalhWZQWarqt5xMg

s83moYemCAT+tFdCFJXzo1yphKVBKIohCrshO7zGl59laDTIUucJAViccMmg0vQsNVwL05XAo

0+eXD3n2Zx2fYfL6h36AkAS/lgorZJhzvAnFbJ3Yo5O3x6taXnCULK7DdQS6Ou8mu+8QhR7cq

+8/5ivqAz5y8AS+E+4Ffn09ik7flrSfLRy4qHYYNbXv7S6CV8ZkYPxic/fCs/UEwlPMKVuPfT

ZLKGRz7QBuFLMqHVSe0h4FrEekxUPPp/V80RWcl/GfwkkJWqpUlFdqBWsTP24ABAho7AYdC3o

1AHRZeVyKOSzErQzsq5E9WnPd3cL7iYtwit8BEmXuhV9cXGeKqkt3peaiEcQ7uxBPsCPe/lEW

FafmGbSyy3wgbctPyJfSR1Bl1N93KVvLzE6pqPauc/SIlJ2Pavpp4bBXe+581p2cMQq0tFG7M

+e40xLMsOlpJnH71WuDyVo77qxL61InsjbXf2uV3HwtOsogGpB3x2uncSDjYM6WFdTuqCPaY4

rvXM4MhGMK2QyD8hGPhR1XNoOF0sPbVTjvMcQhl5sQ1OtwNGZRVC0xr

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Congratulations! Complete the short survey and you will receive

Tupperware set

Content analysis details: (10.9 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[167.89.31.18 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

[69.48.179.234 listed in will-spam-for-food.eu.org]

[69.48.179.234 listed in will-spam-for-food.eu.org]

[69.48.179.234 listed in will-spam-for-food.eu.org]

[69.48.179.234 listed in will-spam-for-food.eu.org]

[69.48.179.234 listed in will-spam-for-food.eu.org]

[69.48.179.234 listed in will-spam-for-food.eu.org]

[69.48.179.234 listed in will-spam-for-food.eu.org]

[69.48.179.234 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[167.89.31.18 listed in dnsbl.ahbl.org]

[167.89.31.18 listed in dnsbl.ahbl.org]

[167.89.31.18 listed in dnsbl.ahbl.org]

[167.89.31.18 listed in dnsbl.ahbl.org]

[69.48.179.234 listed in dnsbl.ahbl.org]

[69.48.179.234 listed in dnsbl.ahbl.org]

[69.48.179.234 listed in dnsbl.ahbl.org]

[69.48.179.234 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[167.89.31.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[167.89.31.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[167.89.31.18 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[167.89.31.18 listed in dnsbl.ahbl.org]

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 NO_RDNS2 Sending MTA has no reverse DNS

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} You have been selected for a Tupperware set

t.com/o/Youtube%2FCashflow%2Fvalidation.html?alt=3Dmedia" rel=3D"noopener n=

oreferrer" target=3D"_blank">Congratulations! Complete the short survey and=

you will receive Tupperware set

/open?upn=3Du001.rqzHQNRnP7vfPGBwNskJDxgyGOCjyIBKNd5G2K6spce2p094XKTaPPnjOj=

NcaEfZpLZyN4tPCZpicaBJN4Rgzdxds0x6y05HW271svUsso9FpGCmEMsYt09wEZTL8VGy6HauC=

a-2B2BD72PN900lw2F1QYl4Vv0HI8apskiXU8gXmYWNc8Y9HpKPWWCSutQGuUqYfB02hV0h0w2y=

46kjmlUV8-2Fyk7NWNvtBKsW-2B0K3ups-3D" alt=3D"" width=3D"1" height=3D"1" bor=

der=3D"0" style=3D"height:1px !important;width:1px !important;border-width:=

0 !important;margin-top:0 !important;margin-bottom:0 !important;margin-righ=

t:0 !important;margin-left:0 !important;padding-top:0 !important;padding-bo=

ttom:0 !important;padding-right:0 !important;padding-left:0 !important;"/>

I1.16KL0LD37.6KI2.25KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Costco Phish

Posted by Dave Yadallee on Sunday, May 12. 2024

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 11 May 2024 17:29:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s5w90-00000000ASU-2UGw

for dave@doctor.nl2k.ab.ca;

Sat, 11 May 2024 17:28:46 -0600

Resent-From: The Doctor

Resent-Date: Sat, 11 May 2024 17:28:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [69.48.183.119] (port=35424 helo=studentaast.edu)

by doctor.nl2k.ab.ca with esmtp (Exim 4.97.1 (FreeBSD))

id 1s5vAV-000000000jg-3upZ

for sales@nk.ca;

Sat, 11 May 2024 16:26:57 -0600

Authentication-Results: gmx.net; dkim=pass header.i=@kashflow.com

Received: from o7.mail.kashflow.com ([167.89.31.18]) by mx-ha.gmx.net

(mxgmx009 [212.227.15.9]) with ESMTPS (Nemesis) id 1Mi439-1saHvy2OkT-00ham5

for ; Sat, 11 May 2024 22:03:12 +0200

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kashflow.com;

h=content-transfer-encoding:content-type:from:mime-version:subject:

reply-to:to:cc:content-type:from:subject:to;

s=s1; bh=BklniVy++LhpSYS6lEqflCtJkmQO3YzyJFYzPZvoPFA=;

b=Xp0uP/WYFVIOiFvYWeGO5IqX3gTOKITQi+YurifhYq9S9CR7NTDqpSnHKFQBZKjXYH5/

m4g0tcnrLljTlnWEbkbFf6cD/cfORbrnVYWpJIvp6bkBPVyh+9J4+qaFSe58fGOnmjOMTY

Zz9/25XcrERHPw9HwLQZjm90sQoCIpq5UNgTLSCkFQS4bcA8Bv09KomFNwK90b660QwYrX

7Rx/4r3uihXTeor3Ddx0i2qVFPiHLVxgyuI8IDxAfP0OioKQu24k9UwsITtJScy9wLPeAY

VNlzYWlcHpL1HiV6WXIrpyx18QoTbiw4I4sKBttBpHTgQTnEIocYqLCcoT3zjrQQ==

Received: by filterdrecv-659c47b755-5hbf2 with SMTP id filterdrecv-659c47b755-5hbf2-1-663FCEFE-39

2024-05-11 20:03:10.343690913 +0000 UTC m=+1027331.041704379

Received: from MjI5NDY5MQ (unknown)

by geopod-ismtpd-8 (SG) with HTTP

id MFloDmTsQm6S_GKrhzo5tA

Sat, 11 May 2024 20:03:10.161 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=us-ascii

Date: Sat, 11 May 2024 22:23:44 +0000

From: Message from Costco

Mime-Version: 1.0

Message-ID:

X-Mailer: Microsoft CDO for Windows 2000

X-MimeOLE: Produced By Microsoft MimeOLE V6.1.7601.261828

X-MailerIO: 261828:2182724361

Subject: You have been selected for a Tupperware set

Reply-To: Message from Costco

X-SG-EID:

=?us-ascii?Q?u001=2E2dU4z=2FWtPTn3IAI+T2Wk4rvV3ZRgQiRb6uQtLjAeBz8I+62Z7902wcH7S?=

=?us-ascii?Q?8fD6XRA2e97MRDccekaCDMOwcl73OFS2iufs6FE?=

=?us-ascii?Q?7jfchMMOrfdO+nOYAEd+elx16LgcH6aCR6BjDlu?=

=?us-ascii?Q?wpUi8G5cTfYi2=2FVhKWVa+WPOi+fhOFBSESC12jm?=

=?us-ascii?Q?KFw+uyQG1PHQJYxiFP0RNdV=2FGC5ZwCtWkgxzJGT?=

=?us-ascii?Q?riMawO7k2idw3VHvSX4yCzepELsvIvD5HePp2Hg?=

=?us-ascii?Q?2pLeih97P=2F2sIyGtt19L5tlGCQ=3D=3D?=

To: ranjibolidaamine@alphafrau.de

X-Entity-ID: u001.PG5NHUku19G2mCTQK1EQEw==

X-GMX-Antispam: 0 (Mail was not recognized as spam); Detail=V3;

X-Spam-Flag: NO

UI-InboundReport: notjunk:1;M01:P0:cR88t8oZy7Q=;em1agBtcBhLphVL/dYDgA10UG6ik

r0XNf8hrklJW1pYklX2v8YV3ttFuZxNJJz5X2KEoJX6DPRJN3r92sWmdWjuwXA4Ze5586Opdo

cxmPhjWorqExlD9EC2UkN1ibY8s9jH43EhXy77+zvKJJP+DVBuCJ5Y/yFp5oUlCnR5ypCnoKF

GM7rYOD1hSRmzdtNw5fp4tc8AhCZGzqkRGTddFQDpE4dCpBGmYwkMq51ZST0dpItfhHdxCPG3

Ka3sTJ3lzbOLq4MfRZfVVbr5pePKuGrvjZOzc4RO+yKkxTjhGM8d6v7zE3ZTWGBXQT6PhshIk

u5m3+jcUUuhaxUVODGEkQlTsJ6j9ocXJUC/hQUWM5UrMPrLszWDmvaMxz6QHo7vlO7ShEC96A

AxDKhCfpf6Np2z45XuJMXyQlBPmEqsaU8ecl6rD2SHSkVdwm9UJlrSMyXFyjtgl3/2R76woQ7

oxtxAq0/BTsHL2XRvJAnjDzqYpiD/44TI64h14zJH0u0r/N2F8IHq+DwiILj6kpSWVoFTQtYA

uLzR4/4I4GKmcNHsb6/+c9/UMSkBJjVR55K9wkfFptgKCd2V+cTHRsfPyFpmmcEALhPjmITh0

+CuKBoxO5sUT62bbCPDMAE5TnGZlgF9MHzN+V+W1IKarBTirButX9/Eu4LCw+JsZCUMJ/e9Eb

6dUGxewm2w42nPT1hAR4vqlTqswOuxke9GK4sXdA/l4jb/ygea5eVzTXZQpVwLoBBYdq0eZoO

K4E6gqPHROynIucNCxwmerHG1PebyriaSSTGrdc9lZcDGZHieJMzDplUoAEn7sbYM40miWnCA

nwG1OH5fvzP59nQL4JgDYJWPe3umzGOT4gE2g3aK+zNnKJFm0fAom/BvWHsZunsFl28EJbdSQ

q21EH1DJ736esngTglmILsWA0f0THj6YT8rOI296lLrNxoxv2W4EK6mOt630hfFS9na56jOC6

dSk4UCokRzWRXv3RzXcNoLbfwBpaq6TFkBvwxWEzUC+7XESDktyfEy4ioOQ/+w3kXSRKsFdgr

ymBOj9nuNmACQgGK66oZNH/5752wAVcA7eXAje6Y+FjA5qSpa33MjHU6KOldaE425PDkpSoDR

YuPy2yTahPgD/8XyOsRY8CoaTkLFEgPNg35NYe7YMCR54C2qrHEfuzrgGr2eyMijrJbYh8lb3

VbE9fyeSSBBpgHByFNk/x6pyGi125rWwv6BILo6KN3fvh4Cy0JSDxR3ulcnGs3xzs5DDQUBJ9

xbZ7355VxJqmeHN4XbIUop2wpZZ1iWShu5xYFfv+Lqq9ATDnzKycCnqKEWwmKFZ4RecO/Ht2G

1ECuiYDyrKKNm0olQHz5cohxEBQXcxscSgPeTtI7KSJWyZ1U384oIAVfNuuYg9wP2tt8l3R+D

kbwG82Oj4IhecWxL2zNz80hmUFArbSLUn2hFk7Jui4bWNZGCtULs3s7B/UHnGsqGTKuR8Z9cY

OHSu9Dgtf1FP3M8cpOtsXRSgEDQJb18l7OWc2CfudW504a4YU+YLWmvl3DMDHh28c3C8X2L3Y

G20h8dZqhnqLoAxWWSrypO8yGX+5k1jRawvjdhv0GpOZ4ExrDh+TrAzlfk0G3yWJWqfKUqKvO

BaHBSRy+kDis5t3vr1/mi12tgb8b4um1OEHkPLp1ubxop5MwdWTbU35T9ZwZGOCK1OgpElrDF

mD24kuFLhXuN5/Ifm+4hkGed+p5R/YKW6YZ4L1hyDYWCtSj1dhbTLJISIA+4NryDd8mZm+MGE

20ZA7uLtWukiPr1eq0sDsrhJd3OYCmsbj/rzxSU9NqvCSICf//hCOJaZQTZLOAQUH+Ti6NJcf

g5Nym6MmMwSFxtLdy0GjeQ2I/KFdi28jVkb7RY/qhZ3gCNIL9825e+j/Sl2d+BHcZ2qbm1MKD

45rO/T0XucP3QPJ4S4bOiPIfEMZG9VxNKcQknZD5E4zNEFsPPQt4gGluNpqUjgU+0Ucf8IXDT

3cM+HiU73LQM+xrAtU8iV9VH4V8v/YSGztOf0O5DTZdH9lfiCWk09/OTkUPqE31WzY4L42M8/

k6BQG5G8wMdU1MWWkOQiGk8ix8i3OHk3YrXgb2dO4TfLxbicqcmRzSttPhWGe0WXV8yLdAv2V

1pl10oXn8xbI0pIuTotVRGwc5drh0KUKLksdIw06L0oUTXO5BKPVsxmQ7NJf7sKYyVnYUgfVN

k61VFzVP3pGDhwBQDdyQmDcR2IzIgSg8r9ZMyBpQHZNy7r2E3x+OW2wrEXYW4eEj6sgggrn0x

Wft6wrQrLm+p29qVZ6CsTlhTZpBNAl/5Y10munu/DHG+BIYx4wwk9F6NXTc+6hwkjFIBzedng

QBL+ZJH5G15ZkF3ODfoM6xn5OKV8COLRRevdlQDyYfOjKclk4MOHE0BzyyUlr5AhNPK4T23f2

9b8+RV+9gOqkne7SDJj8Lbrx/NhO8S+C9xiNOd2ogS8Y6w4eOy2GnAzn/W0z/sydB4wyCjl3c

jgV7YRaTAbSEEoA16d0F+2XZJbP0BkTgt+2tm+YV1v8gYl1nDWBndZ70Dj/mEFT0uTLllgQvE

kAxZISKRZNQGCFCnDfUWxdQzpq1O4mdVRiC3bQcqWpqGXoXaw3UCs/aFraOJl+2w9BgEZKQtp

Gr/3+viEGJzR/0VCXA7Jr0mqpcX10f+anaNP148nHFLgLaeFbnYhfLc2R2K1xocu3iyQTZ1EV

LzA2NZFi9BX4v34TyfrpJ3nJVWYwVlviOg/ubz5uwNvYbp0oKgqSEHhkE9yuoe5BsVxcPXkJ0

F5UZQ4CugcnGAHF7hlUGO4uYZ2iAZ+wSlZKifspvY3EsNmaE1dE8eKioFWdKbpEybOF/OR+kS

rrAiXnuaW3vR1ktwqJqlDgxq7OhPDYvadn+nb/2D/e5Uosi/yXCCBA9TO9ZkvraqWvjmTXFrM

Mib/S0Y6HisaDrjf1ec6NimaBN74xC+r1T7/yTUxSl1QlLxpyhSiVy75I+14IF3IamAOn2wzE

PBnQ8UsaZUkeOXC45IMyVMMaSdmjN/M0ZWmlVsIo3wGv0vTHIXPy/hMX7oemy7Vi9tkujmUWt

rXB6AsN7MtfZoT4BZfl8S3cvxeE9vRmAON3s2QvSgewYMA48eGnGO0ZnrTfj+W+cL7oFiTbsw

tOTW3i/XU6Vk3etxaFjAPwXikxTiwOrSdz/4qFbQWSBKqAWfaasRpJRGCC9H02nhr4qRw9NY6

+o1ahArlUxXbS06RvntMiTHFwaDHKVomy3OIrUA1SFWEVgTwBNa2IZvVyDevxWfLHrrVlOlU0

22V4GizL6e1r6QYcnVtxLokI5b4+n2w6aTRmNA1h1R4hhLkcjlnR9jJWdGcRUrwkkoYG+ZB43

Nls6wNbYP3sEKXTkiyh8BEG3IfDs17EjbnMGI+lJtzDdgvQo3ssf+vVkFea1tF2RN1o8Oft8+

nbI2holYOKz9sMyUmFAALY6KLIlGKI9ChDw3nguXrAmnA3n0qidsk00/p37fH4ZmYUchqtkeV

/9vUzzRrQSP3/MbrRGbxc129v0m7YzHlFFQ4kt9hnQuQjgDVSrx6VyfM7IxefGUkUaz3bTcAb

PZibV8ENHdswwadXP+8AF1gWGXweqQjfspJ9ucX6AGSQgwcOy+tqZeBUx9VxtPABKBs/8ZXNy

DLbN8GBkNv5wRgrcf203z97ZT25NfzVv133MTho9lae0LJdvGn2lCgsa+b2Wb0xO8dFRVUP2M

pS2H2sOE49mMSHBKfWkKNiehi/lCrwTA4sqWCgAR75HgroiTgq9GXrviCSDXGRpty0SCDd8G5

DrdW7e9SlRwV4gVpxTgmY4DOw1IqHgG9VM3VhlYf3sIrgVEwdVvpAK+57BdU0sUw4oW/rn97y

FFukWWpKxf8jb/XKPqZYwyqi6eTuWFCiq1FTdUtSZ+Obk6lE85aEVGbBu1cOKQ+JZnxR0BPpz

HITE/Re/w7Lx2asf66sRv3VnfIFWUneScNWzCrfeYM2inEDoHjdw/y9EE0HYic4TsyID/Yyz7

id16SYjVNbQsdvUYbCP1zqKBr/FC9LbwvZ/ByxNchs51G9IKiEiTafCNhVEjGPg+E1EX/4nbl

er7S3RSlU5cLIbAavTNOeX2zzrVXF6LF5rozPjmVxfD/FIeNbYfVl85I6RwWe2Y8RnkhCYr2p

WgDtFCoiT0X6p7LaQ4foSKwukmfB4DrfdYDQ3Ipph7frs2yPMaE03otvMbxcmFkxAdHgmAoyW

vK20Ze2eFSbPAAVsdm+mK674iqA/yrAPvp7lAW41QOhYS8PSMAKjRiaqhesK71g8LkguNaK+r

sn2aWC1IBjHSF7DLrtlrzvn/idLgDxnRFEYWE2IjjWvJfjQvb/5MgO/wx0TdxtZYGecLloNf2

WaDmNdfoB5So6QdfUGK4H73wq/YKvrjYqBW6fY4JvJjzoWReYP4kJ+uj+yjo8mLOd5VAEPLCu

LSyo/q4N2KS8Yjn/gxTkM2wPvnxRDjI8+Rpev7ZxQ7qVOfFSJ3DdrN3EzgalhWZQWarqt5xMg

s83moYemCAT+tFdCFJXzo1yphKVBKIohCrshO7zGl59laDTIUucJAViccMmg0vQsNVwL05XAo

0+eXD3n2Zx2fYfL6h36AkAS/lgorZJhzvAnFbJ3Yo5O3x6taXnCULK7DdQS6Ou8mu+8QhR7cq

+8/5ivqAz5y8AS+E+4Ffn09ik7flrSfLRy4qHYYNbXv7S6CV8ZkYPxic/fCs/UEwlPMKVuPfT

ZLKGRz7QBuFLMqHVSe0h4FrEekxUPPp/V80RWcl/GfwkkJWqpUlFdqBWsTP24ABAho7AYdC3o

1AHRZeVyKOSzErQzsq5E9WnPd3cL7iYtwit8BEmXuhV9cXGeKqkt3peaiEcQ7uxBPsCPe/lEW

FafmGbSyy3wgbctPyJfSR1Bl1N93KVvLzE6pqPauc/SIlJ2Pavpp4bBXe+581p2cMQq0tFG7M

+e40xLMsOlpJnH71WuDyVo77qxL61InsjbXf2uV3HwtOsogGpB3x2uncSDjYM6WFdTuqCPaY4

rvXM4MhGMK2QyD8hGPhR1XNoOF0sPbVTjvMcQhl5sQ1OtwNGZRVC0xr

X-Spam_score: 12.2

X-Spam_score_int: 122

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Congratulations! Complete the short survey and you will receive

Tupperware set

Content analysis details: (12.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[167.89.31.18 listed in dnsbl.ahbl.org]

[167.89.31.18 listed in dnsbl.ahbl.org]

[167.89.31.18 listed in dnsbl.ahbl.org]

[167.89.31.18 listed in dnsbl.ahbl.org]

[69.48.183.119 listed in dnsbl.ahbl.org]

[69.48.183.119 listed in dnsbl.ahbl.org]

[69.48.183.119 listed in dnsbl.ahbl.org]

[69.48.183.119 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[167.89.31.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[167.89.31.18 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[167.89.31.18 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[167.89.31.18 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[69.48.183.119 listed in will-spam-for-food.eu.org]

[69.48.183.119 listed in will-spam-for-food.eu.org]

[69.48.183.119 listed in will-spam-for-food.eu.org]

[69.48.183.119 listed in will-spam-for-food.eu.org]

[69.48.183.119 listed in will-spam-for-food.eu.org]

[69.48.183.119 listed in will-spam-for-food.eu.org]

[69.48.183.119 listed in will-spam-for-food.eu.org]

[69.48.183.119 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

[167.89.31.18 listed in will-spam-for-food.eu.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[69.48.183.119 listed in wl.mailspike.net]

1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)

[69.48.183.119 listed in ix.dnsbl.manitu.net]

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} You have been selected for a Tupperware set

t.com/o/Youtube%2FCashflow%2Fvalidation.html?alt=3Dmedia" rel=3D"noopener n=

oreferrer" target=3D"_blank">Congratulations! Complete the short survey and=

you will receive Tupperware set

/open?upn=3Du001.rqzHQNRnP7vfPGBwNskJDxgyGOCjyIBKNd5G2K6spce2p094XKTaPPnjOj=

NcaEfZpLZyN4tPCZpicaBJN4Rgzdxds0x6y05HW271svUsso9FpGCmEMsYt09wEZTL8VGy6HauC=

a-2B2BD72PN900lw2F1QYl4Vv0HI8apskiXU8gXmYWNc8Y9HpKPWWCSutQGuUqYfB02hV0h0w2y=

46kjmlUV8-2Fyk7NWNvtBKsW-2B0K3ups-3D" alt=3D"" width=3D"1" height=3D"1" bor=

der=3D"0" style=3D"height:1px !important;width:1px !important;border-width:=

0 !important;margin-top:0 !important;margin-bottom:0 !important;margin-righ=

t:0 !important;margin-left:0 !important;padding-top:0 !important;padding-bo=

ttom:0 !important;padding-right:0 !important;padding-left:0 !important;"/>

I1.16KL0LD37.6KI2.25KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Canada Post Phish

Posted by Dave Yadallee on Sunday, May 12. 2024

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 11 May 2024 17:29:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s5w8v-00000000ARq-1BeX

for dave@doctor.nl2k.ab.ca;

Sat, 11 May 2024 17:28:41 -0600

Resent-From: The Doctor

Resent-Date: Sat, 11 May 2024 17:28:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtpout01-ext2.partage.renater.fr ([194.254.240.33]:59136)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s5v2z-00000000PZQ-0OZu

for root@nk.ca;

Sat, 11 May 2024 16:18:59 -0600

Received: from zmtaauth01.partage.renater.fr (zmtaauth01.partage.renater.fr [194.254.240.25])

by smtpout10.partage.renater.fr (Postfix) with ESMTP id 2397566AF8

for ; Sun, 12 May 2024 00:16:09 +0200 (CEST)

Received: from zmtaauth01.partage.renater.fr (localhost [127.0.0.1])

by zmtaauth01.partage.renater.fr (Postfix) with ESMTPS id 00190140122

for ; Sun, 12 May 2024 00:16:08 +0200 (CEST)

Received: from localhost (localhost [127.0.0.1])

by zmtaauth01.partage.renater.fr (Postfix) with ESMTP id B33BF140125

for ; Sun, 12 May 2024 00:16:08 +0200 (CEST)

DKIM-Filter: OpenDKIM Filter v2.10.3 zmtaauth01.partage.renater.fr B33BF140125

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=etu.univ-orleans.fr;

s=75C661D4-E48C-49B6-AFC7-D2E4031D8F72; t=1715465768;

bh=S3HWZjLbSfDMue7Hzz4+tJA7Ed2lqxBvuqHh0rYyn5w=;

h=MIME-Version:From:To:Date:Message-Id;

b=i35mfcktH2WX94xT+extikX3dEwLE5OFlXyelFoecX9NwWORNgzcGNta9tkwma2BV

QicDfcrmTHrKrqlGzh2PiMy4l+gyrNabDiBu7QvfbwQUCDcr9K016cgKduuCk4LX5X

oum6ga90HW6nnLdkKwDPIOSh6QKvjYKNSolLwNmbX0v6Ji9BSusuUbvIZ/hwShKEId

Ax4SGc16RbFGou5GZa/pSiqii1EarRI0wPmuK07xJc1Bj2kaTuO8XqV51xQzBZK4eY

kETpL6+CTza2sqsIruYfTx5aLyvIqAh7EyEJ92mWoLDtZcyIElF51BYMtHb54BzX8F

jasHabGATfiXw==

Received: from zmtaauth01.partage.renater.fr ([127.0.0.1])

by localhost (zmtaauth01.partage.renater.fr [127.0.0.1]) (amavis, port 10026)

with ESMTP id 4o6YZqxGXS9X for ;

Sun, 12 May 2024 00:16:08 +0200 (CEST)

Received: from 197.14.34.24 (unknown [194.254.241.250])

by zmtaauth01.partage.renater.fr (Postfix) with ESMTPA id 01D84140122

for ; Sun, 12 May 2024 00:16:07 +0200 (CEST)

MIME-Version: 1.0

From: "Services"

To: root@nk.ca

Date: 11 May 2024 18:16:07 -0400

Subject: You have (1) notification

Content-Type: multipart/alternative;

boundary=--boundary_15029_c92b2e36-68ce-4990-897f-4899a288958a

Message-Id: <20240511221608.01D84140122@zmtaauth01.partage.renater.fr>

X-Virus-Scanned: clamav-milter 0.103.8 at clamav01

X-Virus-Status: Clean

X-Renater-Ptge-SpamState: clean

X-Renater-Ptge-SpamScore: 0

X-Renater-Ptge-SpamCause: gggruggvucftvghtrhhoucdtuddrgedvledrvdeguddgtdejucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecutffgpfetvffgtfenuceurghilhhouhhtmecufedttdenucenucfjughrpegghffvfffutgfksegrtdefredttdejnecuhfhrohhmpedfufgvrhhvihgtvghsfdcuoehpohhsthhmrghsthgvrhdqohhstggrrhdrshgrmhgrrhgrsegvthhurdhunhhivhdqohhrlhgvrghnshdrfhhrqeenucggtffrrghtthgvrhhnpeeghfefudettdeggeekuddtfeegheejheeuleeigefhteduvdeludffjeeikeefieenucffohhmrghinheptggrnhgruggrphhoshhtqdhpohhsthgvshgtrghnrggurgdrtggrpdgujhdrrhgrughiohdrsghrnecukfhppeduleegrddvheegrddvgedurddvhedtnecuvehluhhsthgvrhfuihiivgepudegnecurfgrrhgrmhepihhnvghtpeduleegrddvheegrddvgedurddvhedtpdhhvghlohepudeljedrudegrdefgedrvdegpdhmrghilhhfrhhomhepphhoshhtmhgrshhtvghrqdhoshgtrghrrdhsrghmrghrrgesvghtuhdruhhnihhvqdhorhhlvggrnhhsrdhfrhdpnhgspghrtghpthhtohepuddprhgtphhtthhopehrohhothesnhhkrdgtrg

X-Spam_score: 12.2

X-Spam_score_int: 122

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview:

aria-label="Corps du message" class="x_XbIp4 x_jmmB7 x_GNqVo x_yxtKT x_allowTextSelection">