nk.ca credential phishing from google.com

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 30 Oct 2024 07:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1t69Au-000000007Gn-0Xxn

for dave@doctor.nl2k.ab.ca;

Wed, 30 Oct 2024 07:55:52 -0600

Resent-From: The Doctor

Resent-Date: Wed, 30 Oct 2024 07:55:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 151.204.83.34.bc.googleusercontent.com ([34.83.204.151]:60852 helo=[10.88.0.7])

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1t63SY-000000009Lh-2PIl

for doctor@nl2k.ab.ca;

Wed, 30 Oct 2024 01:49:50 -0600

Content-Type: multipart/related; boundary="===============1537524454102955470=="

MIME-Version: 1.0

From: "Nl2k ."

To: doctor@nl2k.ab.ca

Subject: =?utf-8?q?doctor=40nl2k=2Eab=2Eca=3A_Password_Expiration_Notice?=

X-Priority: 2

X-Spam_score: 12.3

X-Spam_score_int: 123

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Message Center. Password expire doctor@nl2k.ab.ca



Content analysis details: (12.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Error: open resolver; ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[34.83.204.151 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

[34.83.204.151 listed in dnsbl.ahbl.org]

[34.83.204.151 listed in dnsbl.ahbl.org]

[34.83.204.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to

dbl.spamhaus.org was blocked due to usage of an

open resolver. See

https://www.spamhaus.org/returnc/pub/

[URI: obinnaoffordire.wixsite.com]

[URI: beri5271.emlnk.com]

0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query to

zen.spamhaus.org was blocked due to usage of an

open resolver. See

https://www.spamhaus.org/returnc/pub/

[34.83.204.151 listed in zen.spamhaus.org]

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.

See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URI: emlnk.com]

[URI: wixsite.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: beri5271.emlnk.com/54.82.80.250]

[URI: beri5271.emlnk.com/54.235.205.181]

[URI: beri5271.emlnk.com/54.225.69.136]

[URI: beri5271.emlnk.com/34.237.253.202]

[URI: obinnaoffordire.wixsite.com/34.144.206.118]

[URI: dns1.p07.nsone.net/198.51.44.7]

[URI: dns2.p07.nsone.net/198.51.45.7]

[URI: dns3.p07.nsone.net/198.51.44.71]

[URI: dns4.p07.nsone.net/198.51.45.71]

[URI: ns-1160.awsdns-17.org/205.251.196.136]

[URI: ns-1642.awsdns-13.co.uk/205.251.198.106]

[URI: ns-174.awsdns-21.com/205.251.192.174]

[URI: ns-895.awsdns-47.net/205.251.195.127]

0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL

was blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[34.83.204.151 listed in list.dnswl.org]

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

0.1 TO_IN_SUBJ To address is in Subject

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} =?utf-8?q?doctor=40nl2k=2Eab=2Eca=3A_Password_Expiration_Notice?=



--===============1537524454102955470==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PGh0bWw+PGhlYWQ+CiAgICA8bWV0YSBuYW1lPSJHRU5FUkFUT1IiIGNvbnRlbnQ9Ik1TSFRNTCAx

MS4wMC4xMDU3MC4xMDAxIj4KICAgIDxtZXRhIGh0dHAtZXF1aXY9IlgtVUEtQ29tcGF0aWJsZSIg

Y29udGVudD0iSUU9ZWRnZSI+CiAgICA8L2hlYWQ+CiAgICA8Ym9keT4KICAgIDxkaXYgc3R5bGU9

ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyB3aWR0aDogNjAwcHg7IGNvbG9yOiBy

Z2IoMzQsIDM0LCAzNCk7IHRleHQtdHJhbnNmb3JtOiBub25lOyB0ZXh0LWluZGVudDogMHB4OyBs

ZXR0ZXItc3BhY2luZzogbm9ybWFsOyBmb250LWZhbWlseTogQXJpYWwsIEhlbHZldGljYSwgc2Fu

cy1zZXJpZjsgZm9udC1zaXplOiBzbWFsbDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXdlaWdo

dDogNDAwOyB3b3JkLXNwYWNpbmc6IDBweDsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgYm94LXNpemlu

ZzogYm9yZGVyLWJveDsgb3JwaGFuczogMjsgd2lkb3dzOiAyOyBiYWNrZ3JvdW5kLWNvbG9yOiBy

Z2IoMjU1LCAyNTUsIDI1NSk7IGZvbnQtdmFyaWFudC1saWdhdHVyZXM6IG5vcm1hbDsgZm9udC12

YXJpYW50LWNhcHM6IG5vcm1hbDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0

LWRlY29yYXRpb24tdGhpY2tuZXNzOiBpbml0aWFsOyAKICAgIHRleHQtZGVjb3JhdGlvbi1zdHls

ZTogaW5pdGlhbDsgdGV4dC1kZWNvcmF0aW9uLWNvbG9yOiBpbml0aWFsOyI+CiAgICA8ZGl2IHN0

eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgcGFkZGluZzogNTBweCAzMHB4

IDMwcHg7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7Ij4KICAgIDxkaXYgc3R5bGU9ImJvcmRlci1j

b2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+CiAgICA8

dGFibGUgd2lkdGg9IjEwMCUiIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4

KTsgYm9yZGVyLWNvbGxhcHNlOiBjb2xsYXBzZTsiPgogICAgPHRib2R5IHN0eWxlPSJib3JkZXIt

Y29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPgogICAg

PHRyIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgYm94LXNpemluZzog

Ym9yZGVyLWJveDsiPgogICAgPHRkIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwg

MjM4KTsgbWFyZ2luOiAwcHg7IHRleHQtYWxpZ246IHJpZ2h0OyBmb250LXNpemU6IDIycHg7IGZv

bnQtd2VpZ2h0OiA2MDA7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7Ij5NZXNzYWdlIENlbnRlci48

L3RkPjwvdHI+PC90Ym9keT48L3RhYmxlPjwvZGl2PgogICAgPGRpdiBzdHlsZT0iYm9yZGVyLWNv

bG9yOiByZ2IoMjM4LCAyMzgsIDIzOCk7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7Ij4mbmJzcDs8

L2Rpdj4KICAgIDxkaXYgc3R5bGU9ImJhY2tncm91bmQ6IGJsYWNrOyBib3JkZXItY29sb3I6IHJn

YigyMzgsIDIzOCwgMjM4KTsgcGFkZGluZzogNXB4OyBjb2xvcjogd2hpdGU7IGJveC1zaXppbmc6

IGJvcmRlci1ib3g7Ij5QYXNzd29yZCBleHBpcmUgZG9jdG9yQG5sMmsuYWIuY2E8L2Rpdj4KICAg

IDxkaXYgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBib3gtc2l6aW5n

OiBib3JkZXItYm94OyI+Jm5ic3A7PC9kaXY+CiAgICA8ZGl2IHN0eWxlPSJib3JkZXItY29sb3I6

IHJnYigyMzgsIDIzOCwgMjM4KTsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPgogICAgPHRhYmxl

IHdpZHRoPSIxMDAlIiBzdHlsZT0iYm9yZGVyLWNvbG9yOiByZ2IoMjM4LCAyMzgsIDIzOCk7IGJv

cmRlci1jb2xsYXBzZTogY29sbGFwc2U7Ij4KICAgIDx0Ym9keSBzdHlsZT0iYm9yZGVyLWNvbG9y

OiByZ2IoMjM4LCAyMzgsIDIzOCk7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7Ij4KICAgIDx0ciBz

dHlsZT0iYm9yZGVyLWNvbG9yOiByZ2IoMjM4LCAyMzgsIDIzOCk7IGJveC1zaXppbmc6IGJvcmRl

ci1ib3g7Ij4KICAgIDx0ZCBzdHlsZT0iYm9yZGVyLWNvbG9yOiByZ2IoMjM4LCAyMzgsIDIzOCk7

IG1hcmdpbjogMHB4OyBwYWRkaW5nOiA1cHg7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7IiBjb2xz

cGFuPSIyIj5Zb3VyIFBhc3N3b3JkIGV4cGlyZXMgZG9jdG9yQG5sMmsuYWIuY2EuIFBsZWFzZSBm

b2xsb3cgdGhlIHBvcnRhbCBiZWxvdyB0byBjb250aW51ZSB3aXRoIHlvdXIgY3VycmVudCBwYXNz

d29yZC48L3RkPjwvdHI+CiAgICA8dHIgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4

LCAyMzgpOyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+CiAgICA8dGQgc3R5bGU9ImJvcmRlci1j

b2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBtYXJnaW46IDBweDsgcGFkZGluZzogNXB4OyBib3gt

c2l6aW5nOiBib3JkZXItYm94OyI+UmVjaXBpZW50OjwvdGQ+CiAgICA8dGQgc3R5bGU9ImJvcmRl

ci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBtYXJnaW46IDBweDsgcGFkZGluZzogNXB4OyB0

ZXh0LWFsaWduOiByaWdodDsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPmRvY3RvckBubDJrLmFi

LmNhPC90ZD48L3RyPgogICAgPHRyIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwg

MjM4KTsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPgogICAgPHRkIHN0eWxlPSJib3JkZXItY29s

b3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgbWFyZ2luOiAwcHg7IHBhZGRpbmc6IDVweDsgYm94LXNp

emluZzogYm9yZGVyLWJveDsiPkRhdGU6PC90ZD4KICAgIDx0ZCBzdHlsZT0iYm9yZGVyLWNvbG9y

OiByZ2IoMjM4LCAyMzgsIDIzOCk7IG1hcmdpbjogMHB4OyBwYWRkaW5nOiA1cHg7IHRleHQtYWxp

Z246IHJpZ2h0OyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+MDc6NDk6MzUgQU08L3RkPjwvdHI+

CiAgICA8dHIgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBib3gtc2l6

aW5nOiBib3JkZXItYm94OyI+CiAgICA8dGQgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwg

MjM4LCAyMzgpOyBtYXJnaW46IDBweDsgcGFkZGluZzogNXB4OyBib3gtc2l6aW5nOiBib3JkZXIt

Ym94OyI+VGltZTo8L3RkPgogICAgPHRkIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIz

OCwgMjM4KTsgbWFyZ2luOiAwcHg7IHBhZGRpbmc6IDVweDsgdGV4dC1hbGlnbjogcmlnaHQ7IGJv

eC1zaXppbmc6IGJvcmRlci1ib3g7Ij4/PC90ZD48L3RyPjwvdGJvZHk+PC90YWJsZT48L2Rpdj4K

ICAgIDxkaXYgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBib3gtc2l6

aW5nOiBib3JkZXItYm94OyI+Jm5ic3A7PC9kaXY+CiAgICA8ZGl2IHN0eWxlPSJib3JkZXItY29s

b3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPgogICAgPHRh

YmxlIHdpZHRoPSIxMjAiIHN0eWxlPSJiYWNrZ3JvdW5kOiByZ2IoMCwgMTAzLCAxODQpOyBib3Jk

ZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgY29sb3I6IHdoaXRlOyBib3JkZXItY29sbGFw

c2U6IGNvbGxhcHNlOyI+CiAgICA8dGJvZHkgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwg

MjM4LCAyMzgpOyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+CiAgICA8dHIgc3R5bGU9ImJvcmRl

ci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+CiAg

ICA8dGQgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBtYXJnaW46IDBw

eDsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPgogICAgPGEgc3R5bGU9ImJvcmRlci1jb2xvcjog

cmdiKDIzOCwgMjM4LCAyMzgpOyBjb2xvcjogd2hpdGU7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7

IGJhY2tncm91bmQtY29sb3I6IHRyYW5zcGFyZW50OyB0ZXh0LWRlY29yYXRpb24tbGluZTogbm9u

ZTsiIGhyZWY9Imh0dHBzOi8vb2Jpbm5hb2Zmb3JkaXJlLndpeHNpdGUuY29tL3NvLzYxUEJIUHZW

RS9jP3c9d3YyRENGNkk0b1V0QXdobzljMTdXeTB4OUF1TmJaalMwTGhTREI2YkthVS5leUoxSWpv

aWFIUjBjSE02THk5dFlXeHNaV0ZpYkdVdGNtVnRhVzVwYzJObGJuUXRZbTlpWTJGMExtZHNhWFJq

YUM1dFpTOGlMQ0p5SWpvaVpqUXlNR1E0TWpjdE1qZGtZUzAwTUdaakxXSXpaVEl0TXpoaE16SXhN

VFEwTVdKbUlpd2liU0k2SW0xaGFXd2lMQ0pqSWpvaU5HVXlaalV6TmpJdFlqYzFNaTAwT0dObExX

RTBNakF0WWpBd09XVTVaamxpTXpkakluMCM/ZW1haWw9Wkc5amRHOXlRRzVzTW1zdVlXSXVZMkU9

IiB0YXJnZXQ9Il9ibGFuayIgCiAgICByZWw9Im5vcmVmZXJyZXIiIGRhdGEtc2FmZXJlZGlyZWN0

dXJsPSJodHRwczovL3d3dy5nb29nbGUuY29tL3VybD9xPWh0dHBzOi8vYmVyaTUyNzEuZW1sbmsu

Y29tL2x0LnBocD94JTNEM1R4dG1yVUZVcVBVVDU1cUExY3dqUGFrX1pOLnl2a1dyLVppWDZMSVNw

ZWVGWmFoX3hBd1VlbXZQYVdaaU5BfmxmWXZiSFhIJTIzJTI1N0JlbWFpbCUyNTdEJmFtcDtzb3Vy

Y2U9Z21haWwmYW1wO3VzdD0xNzMwMzIwNTg3NjY0MDAwJmFtcDt1c2c9QU92VmF3MGF1enpHcTY3

MzNSUHg5Z1ZXMHNLZCI+Q29udGludWU8L2E+PC90ZD48L3RyPjwvdGJvZHk+PC90YWJsZT48L2Rp

dj48L2Rpdj48L2Rpdj4KICAgIDxkaXYgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4

LCAyMzgpOyBjb2xvcjogcmdiKDM0LCAzNCwgMzQpOyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsgdGV4

dC1pbmRlbnQ6IDBweDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgZm9udC1mYW1pbHk6IEFyaWFs

LCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogc21hbGw7IGZvbnQtc3R5bGU6IG5v

cm1hbDsgZm9udC13ZWlnaHQ6IDQwMDsgd29yZC1zcGFjaW5nOiAwcHg7IHdoaXRlLXNwYWNlOiBu

b3JtYWw7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7IG9ycGhhbnM6IDI7IHdpZG93czogMjsgYmFj

a2dyb3VuZC1jb2xvcjogcmdiKDI1NSwgMjU1LCAyNTUpOyBmb250LXZhcmlhbnQtbGlnYXR1cmVz

OiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7IC13ZWJraXQtdGV4dC1zdHJva2Ut

d2lkdGg6IDBweDsgdGV4dC1kZWNvcmF0aW9uLXRoaWNrbmVzczogaW5pdGlhbDsgCiAgICB0ZXh0

LWRlY29yYXRpb24tc3R5bGU6IGluaXRpYWw7IHRleHQtZGVjb3JhdGlvbi1jb2xvcjogaW5pdGlh

bDsiPiZuYnNwOzwvZGl2PgogICAgPHNwYW4gc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwg

MjM4LCAyMzgpOyBjb2xvcjogcmdiKDM0LCAzNCwgMzQpOyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsg

dGV4dC1pbmRlbnQ6IDBweDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgZm9udC1mYW1pbHk6IEFy

aWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogc21hbGw7IGZvbnQtc3R5bGU6

IG5vcm1hbDsgZm9udC13ZWlnaHQ6IGJvbGRlcjsgd29yZC1zcGFjaW5nOiAwcHg7IHdoaXRlLXNw

YWNlOiBub3JtYWw7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7IG9ycGhhbnM6IDI7IHdpZG93czog

MjsgYmFja2dyb3VuZC1jb2xvcjogcmdiKDI1NSwgMjU1LCAyNTUpOyBmb250LXZhcmlhbnQtbGln

YXR1cmVzOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7IC13ZWJraXQtdGV4dC1z

dHJva2Utd2lkdGg6IDBweDsgdGV4dC1kZWNvcmF0aW9uLXRoaWNrbmVzczogaW5pdGlhbDsgCiAg

ICB0ZXh0LWRlY29yYXRpb24tc3R5bGU6IGluaXRpYWw7IHRleHQtZGVjb3JhdGlvbi1jb2xvcjog

aW5pdGlhbDsiPk5vdGU6PC9zcGFuPgogICAgPHNwYW4gc3R5bGU9ImNvbG9yOiByZ2IoMzQsIDM0

LCAzNCk7IHRleHQtdHJhbnNmb3JtOiBub25lOyB0ZXh0LWluZGVudDogMHB4OyBsZXR0ZXItc3Bh

Y2luZzogbm9ybWFsOyBmb250LWZhbWlseTogQXJpYWwsIEhlbHZldGljYSwgc2Fucy1zZXJpZjsg

Zm9udC1zaXplOiBzbWFsbDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXdlaWdodDogNDAwOyB3

b3JkLXNwYWNpbmc6IDBweDsgZmxvYXQ6IG5vbmU7IGRpc3BsYXk6IGlubGluZSAhaW1wb3J0YW50

OyB3aGl0ZS1zcGFjZTogbm9ybWFsOyBvcnBoYW5zOiAyOyB3aWRvd3M6IDI7IGJhY2tncm91bmQt

Y29sb3I6IHJnYigyNTUsIDI1NSwgMjU1KTsgZm9udC12YXJpYW50LWxpZ2F0dXJlczogbm9ybWFs

OyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAw

cHg7IHRleHQtZGVjb3JhdGlvbi10aGlja25lc3M6IGluaXRpYWw7IHRleHQtZGVjb3JhdGlvbi1z

dHlsZTogCiAgICBpbml0aWFsOyB0ZXh0LWRlY29yYXRpb24tY29sb3I6IGluaXRpYWw7Ij48c3Bh

bj4mbmJzcDs8L3NwYW4+Jm5ic3A7VGhlIGNvbnRlbnQgb2YgdGhpcyBlbWFpbCBpcyBjb25maWRl

bnRpYWwgYW5kIGludGVuZGVkIGZvciB0aGUgcmVjaXBpZW50IHNwZWNpZmllZCBpbiBtZXNzYWdl

IG9ubHkuIEl0IGlzIHN0cmljdGx5IGZvcmJpZGRlbiB0byBzaGFyZSBhbnkgcGFydCBvZiB0aGlz

IG1lc3NhZ2Ugd2l0aCBhbnkgdGhpcmQgcGFydHksIHdpdGhvdXQgYSB3cml0dGVuIGNvbnNlbnQg

b2YgdGhlIHNlbmRlci4gSWYgeW91IHJlY2VpdmVkIHRoaXMgbWVzc2FnZSBieSBtaXN0YWtlLCBw

bGVhc2UgcmVwbHkgdG8gdGhpcyBtZXNzYWdlIGFuZCBmb2xsb3cgd2l0aCBpdHMgZGVsZXRpb24s

IHNvIHRoYXQgd2UgY2FuIGVuc3VyZSBzdWNoIGEgbWlzdGFrZSBkb2VzIG5vdCBvY2N1ciBpbiB0

aGUgZnV0dXJlLjwvc3Bhbj48L2JvZHk+PC9odG1sPg==



--===============1537524454102955470==--

Canada Revenue agency phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 30 Oct 2024 13:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1t6E9B-000000006hA-2eyu

for dave@doctor.nl2k.ab.ca;

Wed, 30 Oct 2024 13:14:25 -0600

Resent-From: The Doctor

Resent-Date: Wed, 30 Oct 2024 13:14:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [192.177.111.99] (port=59924 helo=gki.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

(envelope-from )

id 1t6E1K-0000000061x-30EV

for postmaster@nl2k.ab.ca;

Wed, 30 Oct 2024 13:06:25 -0600

From: Canada Revenue Agency - Agence du revenu du Canada

To: postmaster@nl2k.ab.ca

Subject: INTERAC e-Transfer: Your deposit has not yet been processed

Date: 30 Oct 2024 12:06:12 -0700

Message-ID: <20241030120612.7CFFB62C97E7D273@gki.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 18.0

X-Spam_score_int: 180

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Refund Notification: Transaction #8697BN87 Dear Recipient,





Content analysis details: (18.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Error: open resolver; ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.177.111.99 listed in will-spam-for-food.eu.org]

[192.177.111.99 listed in will-spam-for-food.eu.org]

[192.177.111.99 listed in will-spam-for-food.eu.org]

[192.177.111.99 listed in will-spam-for-food.eu.org]

[192.177.111.99 listed in will-spam-for-food.eu.org]

[192.177.111.99 listed in will-spam-for-food.eu.org]

[192.177.111.99 listed in will-spam-for-food.eu.org]

[192.177.111.99 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[192.177.111.99 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.177.111.99 listed in dnsbl.ahbl.org]

[192.177.111.99 listed in dnsbl.ahbl.org]

[192.177.111.99 listed in dnsbl.ahbl.org]

[192.177.111.99 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.177.111.99 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.177.111.99 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.177.111.99 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.177.111.99 listed in dnsbl.ahbl.org]

0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to

dbl.spamhaus.org was blocked due to usage of an

open resolver. See

https://www.spamhaus.org/returnc/pub/

[URI: cdn.adscientificindex.com]

[URI: i0tc000.com]

0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query to

zen.spamhaus.org was blocked due to usage of an

open resolver. See

https://www.spamhaus.org/returnc/pub/

[192.177.111.99 listed in zen.spamhaus.org]

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.

See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URI: i0tc000.com]

[URI: adscientificindex.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: dahlia.ns.cloudflare.com/173.245.58.89]

[URI: dahlia.ns.cloudflare.com/172.64.32.89]

[URI: dahlia.ns.cloudflare.com/108.162.192.89]

[URI: jack.ns.cloudflare.com/172.64.33.121]

[URI: jack.ns.cloudflare.com/108.162.193.121]

[URI: jack.ns.cloudflare.com/173.245.59.121]

[URI: cdn.adscientificindex.com/104.21.16.131]

[URI: cdn.adscientificindex.com/172.67.212.184]

[URI: b.dnspod.com/43.161.3.75]

[URI: b.dnspod.com/36.155.149.59]

[URI: b.dnspod.com/163.177.5.79]

[URI: c.dnspod.com/112.80.181.159]

[URI: c.dnspod.com/43.134.249.75]

[URI: c.dnspod.com/125.94.59.175]

[URI: a.dnspod.com/43.130.172.75]

[URI: a.dnspod.com/117.135.128.175]

[URI: a.dnspod.com/43.134.249.74]

[URI: a.dnspod.com/117.89.178.151]

[URI: i0tc000.com/34.88.44.156]

0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL

was blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[192.177.111.99 listed in list.dnswl.org]

0.3 OFFER_2 BODY: Offers you Something (2)

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 SARE_HTML_INV_TAG3 Message contains invalid HTML tag

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.7 SARE_HTML_INV_TAG2 Message contains invalid HTML tag

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

Subject: {SPAM?} INTERAC e-Transfer: Your deposit has not yet been processed






=2Ew3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">






" />










padding: 0;

text-align: center;

background-color: #ededf1" class=3D"full-padding">


table-layout: fixed;

margin: 0 auto; min-width: 320px;

width: 100%;

background-color: #ededf1;

text-align: center" class=3D"wrapper" cellpadding=3D"0" cellspa=

cing=3D"0" role=3D"presentation">








margin: 20px 0" class=3D"header">




" alt=3D"CRA Logo" width=3D"165" style=3D"max-width:165px">


















font-family: Ubuntu, sans-serif">Refund Notification: Transacti=

on #8697BN87




font-family: 'PT Serif', Georgia, serif">Dear Recipient,




font-family: 'PT Serif', Georgia, serif">We are pleased to info=

rm you that a refund of $2,680.42 CAD has been successfull=

y processed.




font-family: 'PT Serif', Georgia, serif">To receive the refund,=

please select your bank and complete the deposit process. Note that this r=

efund offer is valid until November 1st, 2024.




color: #ffffff !important;

border-radius: 4px;

padding: 12px 24px;

text-decoration: none;

display: inline-block;

font-family: 'PT Serif', Georgia, serif" class=3D"btn">


color: #ffffff !important;

border-radius: 4px;

padding: 12px 24px;

text-decoration: none;

display: inline-block;

font-family: 'PT Serif', Georgia, serif" href=3D"https://i0tc00=

0.com" class=3D"btn">Deposit Your Refund




font-family: 'PT Serif', Georgia, serif">Best regards,
Jacin=

ta McIntyre
Canada Revenue Agency









3D"Signature"
60px" src=3D"https://cdn.adscientificindex.com/logos/26805.jpg">


























">Manage Preferences  |  

Unsu=

bscribe



















Web / SEO / App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 30 Oct 2024 07:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1t69C0-000000007OW-09j0

for dave@doctor.nl2k.ab.ca;

Wed, 30 Oct 2024 07:57:00 -0600

Resent-From: The Doctor

Resent-Date: Wed, 30 Oct 2024 07:56:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-bn8nam04olkn2053.outbound.protection.outlook.com ([40.92.47.53]:6977 helo=NAM04-BN8-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1t67rx-00000000LxC-3HM3

for sales@nk.ca;

Wed, 30 Oct 2024 06:32:23 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=FPRydxVvBYsOkqwmzI4yvTvlT7ZU/odp9mlrUFHY5EOQeJ/ZuCDVMUWLxE+GlWMTRohL8ex9VNvfxX3RxTD3Iqq9Ycmb0HpaCUrsQTG8QSNlfGy4jHlKArrAaFFuc+31HLo3q7jHDRIaZNvkV8ERy5axQjSI703ZvAz2GyCg0jlDw3p21/Hoee5RL264VIQerkmYDtB+LG38nbkmFd3CSqsUoEbFmBJHYjTKEEYJc/Ow0tGybPFldOOboUab37dEKvY78WYW+8b2yngC53pAMW9SInp2THzP+DW0He5q1u+GGGedgGN90+mAg143y/7BoUSpGyEarn3VoB8mYkopPg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=+zZQv5GY5ShE9PBdSq3iYEI+8j4tP13DVWf8mO80rMo=;

b=VjCVTukAJH7UU2I9LegoFELe474OnthpiJYA0224hUJZO9MXhWYksZD56uPm2yUSy5CSGyDt37YWeFx0/SVTDDx6jsJqD+4mwv2TTTj8s0++ZAoubZj7xBLMzfqgLipK3VA2MM3g21m3TBa1Yots+s2XTNhaxoZWmq05SQ20qCjZIom+eNp6wk9EvGYjqI2VPvJqJBj544vddhCi1bPhBBqlUP32J+FzCXCTfXqSWZvZUjofC/XDt7v+689Dy0VvroSxO0+8s8i+Foh/X2eHtD8QmgVFs2ZkZa6sszhrZKsp4KTQwPNgP15zkTYOUp1inzjcIGP32xrsUH1zPGicmQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=+zZQv5GY5ShE9PBdSq3iYEI+8j4tP13DVWf8mO80rMo=;

b=nZyQelZ+IchMR+Bz4I27WvpGZxuVGCzO02RrKa/5CUFzfexIkFxA8O9HMM5rsEuIMw7zSnlNdP/Dss7puSXBYmkfQMIj9oOrOaYRI33KVA0JfnIgEmv5G/nMJa7ITceaeq3Gr6KKMjqZW7ntc+981/6BfO4wlxHvtMrM4nUxT/eIPfHfhhPG4KoZ2iuPgxTd/yb4djFGdkl2rMUcOR8zNlBXIK3BwwVEeLF65jvfjAKalvW4W4GbQTp7ZnmoFHblgLdXYKrVD+pKaJHosaC2w72/0Fg5tU529SlErMc1hf2FrmLp0J9udqbiFXoTEkSoTGkW1Fc88LnlHOqFwbP5+A==

Received: from BYAPR14MB3256.namprd14.prod.outlook.com (2603:10b6:a03:d8::29)

by SA1PR14MB6649.namprd14.prod.outlook.com (2603:10b6:806:33a::12) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8093.32; Wed, 30 Oct

2024 11:54:57 +0000

Received: from BYAPR14MB3256.namprd14.prod.outlook.com

([fe80::6299:f2c6:4466:7269]) by BYAPR14MB3256.namprd14.prod.outlook.com

([fe80::6299:f2c6:4466:7269%5]) with mapi id 15.20.8093.021; Wed, 30 Oct 2024

11:54:57 +0000

From: Dolly Wood

To: "sales@nk.ca"

Subject: Re

Thread-Topic: Re

Thread-Index: AQHbKsKKqrfJkFnobUukPeBqRxl4eQ==

Date: Wed, 30 Oct 2024 11:54:57 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: BYAPR14MB3256:EE_|SA1PR14MB6649:EE_

x-ms-office365-filtering-correlation-id: 3d293bb3-06bb-487f-e69e-08dcf8d9acef

x-microsoft-antispam:

BCL:0;ARA:14566002|8060799006|19110799003|15080799006|38102599003|461199028|7092599003|8062599003|102099032|3412199025|440099028;

x-microsoft-antispam-message-info:

=?us-ascii?Q?NmIBZOv2WwXcXtJ54Gh9WNWZGGkOetkGT9JcXXGQ7SqTcQkTMm/YLmCw8aMa?=

=?us-ascii?Q?bJbubP0b+CYWAoNjUkdulWAGU2Vei44d0ByJofQhzxyf9ZCO3morPoNi/v/y?=

=?us-ascii?Q?k8IdmIPyi8cZfzay79FD9yGWr9JJJFKomRt5noQ9KArWJZ/W7zJ+NHIVxeof?=

=?us-ascii?Q?3mqk6+syyPNHFqvr4LYJOkHVCw/YhDB797pKlcofVQZz1SRg845pTDc3Ypop?=

=?us-ascii?Q?0QQDmC5eJ3G/hxQiT19mVlq76VvwioPCzs8RsYJ9Y+omu6qHGa+db2vBecag?=

=?us-ascii?Q?ydmpHOTfHI8D5ilXPHmUK2aYUFILlteSMF4V8x33WmuNG6pyOeOJISCWkz2A?=

=?us-ascii?Q?ODHNG+PbXFq8TGgYJPqhbs15zzh3tdvS7uVsPZgg2D3eix/OhNROo/IbUkMV?=

=?us-ascii?Q?28Q3hZpNllNsQ0gyJeQvLwWi0oiORmWzqEI4OemiT7XL7AmcVK7kEc+uGUZI?=

=?us-ascii?Q?nmc0iDRXP1AMlIfwYutcslHtDYcMJMz4SiJzGTTvthQ5VD4pNcfb7uqUpuUV?=

=?us-ascii?Q?0m4VfHyw04WOKQZ334gcM/He96w8dmOeBumXDMuFBWYW9dfqtSRgPD0EoISC?=

=?us-ascii?Q?avReTUGdPRCPhbsxLDUG9jQuGGZMgTzYIGOH5oG2lCFhFgxyNU9UK7evR6N3?=

=?us-ascii?Q?qx4qv2iHzLvDPrGjwhzClddbeYy9OgnTfkcraSZbZG4V+wY8uiKtyRoL9qjH?=

=?us-ascii?Q?Yjd5GRnHZfEvEGGVKh/hAb894q7MOUmTi3CyacpvH34crFogrewGeevKJIKK?=

=?us-ascii?Q?1F/LrCBGjt+xiJmfJTaMKRck9+X9C4oTodooOn7B5uH8S/r5EzciO4vQzinF?=

=?us-ascii?Q?S1Zij8By9M73a2cfQzfOVlKdZVCzqEPijng7Lwu+VpmupjOSjFwkUvKWJr35?=

=?us-ascii?Q?fK1Lu7c7FeUFA7b5vBOu0a4IYiZ80irwEF4+CNwWkGPuQo2xpptw22LBUI+4?=

=?us-ascii?Q?RbMj0GuR/IUB0zfY2UOfHEa/4n1/TkmVvk/pbk+B/sVGUhhVbfYCH1uGL6HN?=

=?us-ascii?Q?CJfO4ynARowUg0g3gy4zZmKdmUw4xysyM8+02y9pzzDl7mOECqEPNogy33ek?=

=?us-ascii?Q?xGU7FTQR?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?us-ascii?Q?VsymI65wt/estDvU+ZDcimPV59d50v/1dkBJurv9rWKPz3pm9S2hufy80zUr?=

=?us-ascii?Q?7dgvK4BpFo5rdFO3s7styRQDgTgZlmuxuxNvapJp1lvsBL1j2SprQrYaq0gQ?=

=?us-ascii?Q?PRSW9r+DO0Jjhrg6Zmxxh4Katvyib4HQ3zI0VutiDhljZOMmC/0EgjKzc3OV?=

=?us-ascii?Q?tJZqZ0NX1lxZumO4D9fYs9Hkj7LQXOLYQOeYFQIPHgLnoe/C82SCOGMxh+ea?=

=?us-ascii?Q?ohHk+m7+s0KKbfC3Z1UjH8ZP9mqLHQKT4ppJdaBE/hi9NmhaAt72XvICZOOl?=

=?us-ascii?Q?BnCP58fqtItF3AL2EDjpp2lOairJUyWnH3aaAL7VtAq7tmGFPfVAILNpw/5p?=

=?us-ascii?Q?8Cfv9NDhhnlYOH7biIarWfc5u2jCusTjOPtkahSUzEXTBxGFdDFtaUiSSo//?=

=?us-ascii?Q?i6MqZZUDFJGEJ5OjWHg51iFBdv79MhCvzsyoVTCNiKc33+rF7vKyXwDOWl3Z?=

=?us-ascii?Q?86KRSQX6fagqYZpM+Q+BtTNKNwsl7eAYuP6ns1U79GNkOh7kOja8mqs/dHIc?=

=?us-ascii?Q?unfzKW1TMrW9249CPF3GCRsuLHux5o37Ok9QUqkK6WsYDOK7b4lpDyYjW3T2?=

=?us-ascii?Q?2zN21xdfBbZfMP1DxTtdGqoUtjt50gQD1kyNw4jeAviD53h59Co6U/S8ig7u?=

=?us-ascii?Q?rtViDRDLZxg4UcXpe3jZ9SRLRz7dms6F2RkWvUvWiwesmXJOgg/qPN9sqneZ?=

=?us-ascii?Q?Chx2YGKd4uefT0hXkjrtoWWfzCkfWva+OoI+p5kgNIMQ/c/sk3J1dlogPwzd?=

=?us-ascii?Q?p+WXLIabvHEwE77DhuChH5JMVcqVt6aBe7jJ/FurP5gMh8zfZYU7ilL399AC?=

=?us-ascii?Q?czx+mk1DLyDOSBeUyNcTR6DN0bdWLXEwp+dzUpk8ON5R+gqgblOjbZBhVLIS?=

=?us-ascii?Q?cz10FoyEiR9gwM9y5v50c65UjpvtLR75hzU6rUBKtE0hisFVAYGtwN4bCVSt?=

=?us-ascii?Q?eoLcLvhFJ4SVvg9Es181TIfLN5gzbDfue4r0Dy2v7Oh2d16kHN9UPNSWu7GJ?=

=?us-ascii?Q?tiob/SOQ2BiQ8uqSTOeEaay1ElDbd2+55IwUvYcbE3VjBs91bDiB/Ayf2Zph?=

=?us-ascii?Q?oYOCLxHrgkp3d1YBr5TH5YmLkuqnUtArW0DueQqatO+F4I+rae8VWiGcqZGk?=

=?us-ascii?Q?X9y+xeL9lxA+LnooCy2O7a0cOQsKKmPJaIuJ9gt0SQ40FGO+LGhkrbAG7Q4j?=

=?us-ascii?Q?6geL6fqyfm37/yuUakwxozOg64RNVDyAEREh2gJWHTlG6oEN3/6bvMjU36E?=

=?us-ascii?Q?=3D?=

Content-Type: multipart/alternative;

boundary="_000_BYAPR14MB3256FA4490269788E2EE74F098542BYAPR14MB3256namp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: BYAPR14MB3256.namprd14.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 3d293bb3-06bb-487f-e69e-08dcf8d9acef

X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Oct 2024 11:54:57.2369

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR14MB6649

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Sales, I was wondering if you got a chance to review my

previous email. Please suggest if there is any update for us. Our Services,

May I send you the (Very Low SEO Cost) Samples of our work and a price list...!





Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Error: open resolver; ]

[Error: open resolver; ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10b6:a03:d8:0:0:0:29 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:d8:0:0:0:29 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:d8:0:0:0:29 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:d8:0:0:0:29 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:d8:0:0:0:29 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:d8:0:0:0:29 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:d8:0:0:0:29 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:d8:0:0:0:29 listed in]

[will-spam-for-food.eu.org]

[40.92.47.53 listed in will-spam-for-food.eu.org]

[40.92.47.53 listed in will-spam-for-food.eu.org]

[40.92.47.53 listed in will-spam-for-food.eu.org]

[40.92.47.53 listed in will-spam-for-food.eu.org]

[40.92.47.53 listed in will-spam-for-food.eu.org]

[40.92.47.53 listed in will-spam-for-food.eu.org]

[40.92.47.53 listed in will-spam-for-food.eu.org]

[40.92.47.53 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[2603:10b6:a03:d8:0:0:0:29 listed in]

[sbl-xbl.spamhaus.org]

[40.92.47.53 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[2603:10b6:a03:d8:0:0:0:29 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:d8:0:0:0:29 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:d8:0:0:0:29 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:d8:0:0:0:29 listed in]

[dnsbl.ahbl.org]

[40.92.47.53 listed in dnsbl.ahbl.org]

[40.92.47.53 listed in dnsbl.ahbl.org]

[40.92.47.53 listed in dnsbl.ahbl.org]

[40.92.47.53 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[2603:10b6:a03:d8:0:0:0:29 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[2603:10b6:a03:d8:0:0:0:29 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[2603:10b6:a03:d8:0:0:0:29 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[2603:10b6:a03:d8:0:0:0:29 listed in]

[dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.47.53 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_VALID Message has a valid ARC signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[dolly.wood2018(at)outlook.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[dolly.wood2018(at)outlook.com]

0.0 HTML_MESSAGE BODY: HTML included in message

Subject: {SPAM?} Re



--_000_BYAPR14MB3256FA4490269788E2EE74F098542BYAPR14MB3256namp_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Hi Sales,





I was wondering if you got a chance to review my previous email. Please sug=

gest if there is any update for us.





Our Services, May I send you the (Very Low SEO Cost) Samples of our work an=

d a price list...!





Thank You !!



Dolly Wood



--_000_BYAPR14MB3256FA4490269788E2EE74F098542BYAPR14MB3256namp_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable








>





Hi Sales,








I was wondering if you got a chance to review my previous email. Please =

suggest if there is any update for us.








Our Services, May I send you the (Very Low=

SEO Cost) Samples of our work and a price list...!








Thank You !!



Dolly Wood









--_000_BYAPR14MB3256FA4490269788E2EE74F098542BYAPR14MB3256namp_--

interac phish from Microsoft

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 30 Oct 2024 07:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1t69Bc-000000007MV-2Vig

for dave@doctor.nl2k.ab.ca;

Wed, 30 Oct 2024 07:56:36 -0600

Resent-From: The Doctor

Resent-Date: Wed, 30 Oct 2024 07:56:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-bmxind01on2061.outbound.protection.outlook.com ([40.107.239.61]:13695 helo=IND01-BMX-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1t665h-000000007nU-0GGQ

for sales@nk.ca;

Wed, 30 Oct 2024 04:38:28 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=Jj4nT4JXXcrk8JWKAiXowmwoWVhUnHAPHuOldgOybtP9P38t6VEa3Rb6768QwdBHo5Y475+RL/aOl9WAIEyJIod2o1/69xje/Ajwg/V6CC4S3HQTYaqCwTbGrRaj1QKkRAK5qzXtHM7bAKkCwCUAx3L0R82F20eVfTN7hMH709HCqkfPgr4v6uOT5UdWfCCs5zS0rBSSXjzXbhA6gz5E67UhTFzdHcVGgmKoslsWbO5YqiScgQsM/Z5WNTDDO5hwNFlK0WkzxSy7++Ih9yi/FJCs4R9nw6YTLms7R8drnLWb8tHsvi3igMLlthC0C5iD+CV6INlF8PFwn1OExz+FxA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=cRmiLAojWy0nl8DUKKqKpQlf34zgZPPpFbQw2Wl8a8M=;

b=tf+DpMO05aQQIDSqY8fEp4NPqwJ3FAbDnN/J5yjZvONtMRNIXbymzrilU2/8ZAwYBFCbdO8QOpRHrSBkfFNpwYGpDfdoI0CFNVluWpI0j0VCDDRZjykP6HYcqxmvtHMsdzQdvQnhrgt5G6xo4GXZ36BIwJXy3+M6YmQQc6f8hO8fNu5UoPwR0CZK81PODrwJi30yvjEl8NXUkQvL2XQ4AgoarD0mkhT2BaVoTCc+eHIkS+Cf5C/vQHU6hWUlqwnWhXDhWDetz4MJOqGTYz1AwqbJXHLtZuvs7mQS6ewkn8F3jxTmhAgccb/hFVU+0iEHZWZW28S9cNB90VrZdr0p/w==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=welspun.com; dmarc=pass action=none header.from=welspun.com;

dkim=pass header.d=welspun.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Welspun.com;

s=selector2;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=cRmiLAojWy0nl8DUKKqKpQlf34zgZPPpFbQw2Wl8a8M=;

b=OsVeSHhmw6/u8/gIL5sdWqJQ1cn5Ki0F8NDvkDTFzQ5UCpsJiGRujOrsYBDaxAZpN1CZ2aqD3e3tkU7oZiaUycmznR8cWyoskB6XTQoNlZoRiKjPG6Mm70p0qcjoo6YDx4Joe+leJCUU8q9c1uDO5SkJqvdXyjVnCKn8Qx4YSi4=

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=welspun.com;

Received: from MAZP287MB0607.INDP287.PROD.OUTLOOK.COM (2603:1096:a01:112::10)

by PN2P287MB1127.INDP287.PROD.OUTLOOK.COM (2603:1096:c01:132::7) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8093.32; Wed, 30 Oct

2024 10:00:08 +0000

Received: from MAZP287MB0607.INDP287.PROD.OUTLOOK.COM

([fe80::70ef:646c:f199:2183]) by MAZP287MB0607.INDP287.PROD.OUTLOOK.COM

([fe80::70ef:646c:f199:2183%2]) with mapi id 15.20.8114.015; Wed, 30 Oct 2024

10:00:08 +0000

From: "Interac Notification Service"

Subject: "Notification: You Have Money from Interac e-Transfer"

To:

Content-Type: multipart/alternative; boundary="TpFoC9rZ2BkEsazT8rhaQYJ8E=_emMHIhV"

Date: Wed, 30 Oct 2024 02:35:27 -0700

Message-Id: <302720241035020A3B79CEC1$4E77A34AB9@welspun.com>

X-ClientProxiedBy: BL0PR01CA0017.prod.exchangelabs.com (2603:10b6:208:71::30)

To MAZP287MB0607.INDP287.PROD.OUTLOOK.COM (2603:1096:a01:112::10)

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: MAZP287MB0607:EE_|PN2P287MB1127:EE_

X-MS-Office365-Filtering-Correlation-Id: 5789a685-6ccf-440e-7310-08dcf8c63086

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|69100299015|1800799024|366016|376014|52116014|1032899013|2066899003|4076899003|8096899003|18082699012|38350700014;

X-Microsoft-Antispam-Message-Info:

=?iso-8859-1?Q?wSYRjlu386vcvTVyUc281da6veNz4zIMVvVcMaGzXYw2zOCEtjQN2lJLbv?=

=?iso-8859-1?Q?cyrmuvi/bxf91OIBG3P3Db3s+v5O8ljgeTsxilx4hjLX0r659jnYbhg9jx?=

=?iso-8859-1?Q?UxKaPCacjiDbLGrYJJwNySpQSN/F1YRAJ7QHZmVkFD31iiSbY3A3m+HuDu?=

=?iso-8859-1?Q?TGM/twyY/Q99Kppqx3u+y7avkrF/oKU3s6gJdX4JSHXXgwL72ZYuiOEoqc?=

=?iso-8859-1?Q?4THOJMEpWESnyy8GfFEE6xD0lWCAlu1hYRtP+g+AxaiqZKjp4TqdZlgAVK?=

=?iso-8859-1?Q?fQPdlRrnnLnlriIp26r/0gtq/TgT8cgx0E4xTXrDSjod8q951ccipxp1m/?=

=?iso-8859-1?Q?K5tI1YFKC4HqmzAhlBHW+WC/1ZV5C8AGhuuZySzeAzfm3XHhM8itCoF9X0?=

=?iso-8859-1?Q?8UAqLtVFtXV2g5vCICckRDRE0FpMMtkYXR8ro9oTSWiK+S8CeBj0fvE8Sq?=

=?iso-8859-1?Q?pek2r0iVCngvJdcrfHIHj0RBwk8q9+blnZcmiODDJBYLrXlnCwT1Xm5Aul?=

=?iso-8859-1?Q?qrsApLYwRIzy+ES/ydl8ey+HV8XiZistl1aGIqy4k1uhDloBmDd5zq2sjf?=

=?iso-8859-1?Q?Z62gspDXxTcRb41FH1TUn06m9w1qHW+PbYk60KOFiZd6WS3t0fOs8ghcSi?=

=?iso-8859-1?Q?Uq0BrZW4VJdSjsMo67copl+BXreLiNTF2BJAvNT3Nk6p7Jv3znA6CQOTGB?=

=?iso-8859-1?Q?Ysg1rHTjIsWJeLex2aCTx7XsAekOWyZAtbEVe4sgYGAVv9oiPVdcnoo9wh?=

=?iso-8859-1?Q?QlswuHtTPN02mG2G1QlTwYaezbJ9x4heXOvVkSOPIlESbwytcliTWi+/xR?=

=?iso-8859-1?Q?RmPJWGg1xswpgYZTKlC6ia0ITaubimDQ6paKPEg5oDzW1el6tPrL0YYsqp?=

=?iso-8859-1?Q?9fT0uiBX/GkGLkr2MIsVYgDjL3jxS8k5XRXzZm1uCrxcCsEDCVRII8SMOt?=

=?iso-8859-1?Q?WMPvlgvOSEfJkhMAU+iEXucnMl9AQA9uja8KmPJogRSvcqy+Jv08HPY1F9?=

=?iso-8859-1?Q?8XeXe1MA2G+C8OWrFdpLicVJNT/7abqascCUk2Y/iTw9Lh1i/my74PdYI0?=

=?iso-8859-1?Q?Z7nsF3psb6J/Ll73iXYt/tsM+i3g/72l1zd/Xt3ROIP6aK+7XRYHxsv81p?=

=?iso-8859-1?Q?3FVgRi19y9nWK7+XpPUlUWGZ7DC3wFrAuRtPHvrP4Qh+geA/DhFPQlEM8O?=

=?iso-8859-1?Q?eaPdrcnNymyfp0ZLS2UhbcqVvDlYBs2I17N5UyLXVG3Rey54TQCw1QcH/i?=

=?iso-8859-1?Q?wcIHXmfZMrhP0rRZRlg2JHgWIp5kB3HBJY2PVA1c+6HWw83hKtlKgyGOqb?=

=?iso-8859-1?Q?mx78HBY93Q8bzE6Qg/3fHeyKgOxikMF1u5SnZ/wem3npPjZEUJ2yQv1vGM?=

=?iso-8859-1?Q?WwnGq5qNlucNmgjA4rCobOOxboDvj54w=3D=3D?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MAZP287MB0607.INDP287.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(69100299015)(1800799024)(366016)(376014)(52116014)(1032899013)(2066899003)(4076899003)(8096899003)(18082699012)(38350700014);DIR:OUT;SFP:1101;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?iso-8859-1?Q?i2mae6ZNuyS5ZR1J50E4AZ70cRfmvc7DtqfBA/2ErNvEmAkYLWcUfvUlT5?=

=?iso-8859-1?Q?6qYsYJ1fQLlCoO0G9DaOSr+s+eTZCVQ2C8FA/tggSc5h1KFMRJkxmHSt1C?=

=?iso-8859-1?Q?9U5OBcwqH5EVOOpymuGS72tUVlOl5GXp9ZhTV9FAG7iUoO1TR+uVyOYKxL?=

=?iso-8859-1?Q?sbAh0+1DBVzdsC2iOhEdJfV28nIags4k3SCKLkq/g9c+yrsZxB/ASgatVY?=

=?iso-8859-1?Q?m1EX5CAvO/5/f8iuJpvaCFWY4MwiitrzK8E1Vio8vEMmFGMuD122dDeN/E?=

=?iso-8859-1?Q?9dekiR9Fqnb7Pwf+5ghRJ6aQCOli/kV4jvlrCwrYwjf2ol6plnTY78dgJF?=

=?iso-8859-1?Q?ZyionAAwqMpNmaQbcn0qF7oz7rojz6QlXYMT1QE4BaeHIbPV+seeMfZ/vi?=

=?iso-8859-1?Q?wev4hdUnc+VwP6lTLEn1lDUBLcJeCKs7uOQrhc4ECxq86CKN9QsacjGzec?=

=?iso-8859-1?Q?7EhUAG4zjxUBtCJ7Vw4TfdoGBAiAB1XglzSKQQ+P/dDxyC8jfAUkMSZqg7?=

=?iso-8859-1?Q?Opax3oixEpfia8UnujbZY35JtlF+/u75VDPOi/X1riWrMsh/2MsSq7n8iB?=

=?iso-8859-1?Q?+f3avR/LgcdPVYcA278yMi642wfzVN5UBmzTgJ0b0b7CwdBt36i3CoDSPb?=

=?iso-8859-1?Q?sLXqOqbJFyQpbRk/Fxrji1to3pJbaAEEcrtuKOPvcLDmdmku15GryFjgLK?=

=?iso-8859-1?Q?ZE/Qk0Iw1Vscz6/0toeu1pusSvDg7cvqyP1rD7bIigtiNIXm1eoWjwURb2?=

=?iso-8859-1?Q?1P+yc3UMRo/vxk2cxaQiK08SnwPXjQ+g3sDVx5TaygE2W3D09BPWow90+t?=

=?iso-8859-1?Q?50SZHDdsoTd4JFiPioArY/H1IRg4zp1WZt8A7133zbiU1Hj1oPnlEiTmtI?=

=?iso-8859-1?Q?+xh0EN3nn5QjzwNeo7RZJwP8RJAQQ6gsS3ENgnIpyRkkmQAB8D7jesN5om?=

=?iso-8859-1?Q?UZMnNWoRH7K0fXGh3ODbIJSMmXMW0tVJVzb7q2j5chGDYCeksGahB290Gm?=

=?iso-8859-1?Q?LM0z1+0SJAt+q1FtFnXeujnp4N09J14OKREEuYi6lum206ttK4UJ8RqiWG?=

=?iso-8859-1?Q?zU04JU8duZ4kiriPeV3pCa9G3LPzCrMM4k8UHE1sX06bEnspsarVkmMViz?=

=?iso-8859-1?Q?A0hJpYf0H6IMEn9xDc0IYIyklXc2vjpseuzBS8Og1A4+we1RdXRRVnZDR5?=

=?iso-8859-1?Q?isui0qZlaPj9W+RQFE6BB6dTwFPg0cN01r9wYmUT6RXhg23XRHoraYaqWO?=

=?iso-8859-1?Q?c7asVcV4cNPqr3UEChG3mk9S1F1R2v66XOr66SwuDbG0Ykt1n67GZTFD/J?=

=?iso-8859-1?Q?74i/P2m6kR2/F/xoOVPUPqzDSM0W7Fd3hDYCNFLXQcqnXozfq9epTkNORx?=

=?iso-8859-1?Q?LYXSgX3i5xJ3AmD4LKiSiByb1iQ8eFpp7QaEb1vobmlyaAWgZ4VCy8fAEm?=

=?iso-8859-1?Q?Fx8cWEw4pSjMlMlEsSWXBMZ2gsMVsAhqSl54waY/qytSe7s/70XvpnHXtq?=

=?iso-8859-1?Q?+lwoEDk9EVVmtAufTtoPnSbVfEFvuC+Dy39DPflWIXek8Cc44OvtjmYZ5j?=

=?iso-8859-1?Q?cNHqL21OV6f5Nwfu+tO/iFVDu+9nSERr8b4DIIh4BamB9X8PFcFq35zHAJ?=

=?iso-8859-1?Q?pXI0awWYPGt0Hcx/0mVWfUdxAv7pjy9I8XrEZrGF6FQryI7OVNVbDAow?=

=?iso-8859-1?Q?=3D=3D?=

X-OriginatorOrg: Welspun.com

X-MS-Exchange-CrossTenant-Network-Message-Id: 5789a685-6ccf-440e-7310-08dcf8c63086

X-MS-Exchange-CrossTenant-AuthSource: MAZP287MB0607.INDP287.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Oct 2024 09:35:28.3515

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 5b4308bc-4f16-4e8d-aab0-26cc3b6f4bec

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: uYMvJ9qMiLdDnJwG5ypryicnpflarnfN/jTAj5lDEl2+V+AofQcVXSJEJ99wi6lupH/dV8IJEB20b+DuWAO0xdr2Z5GfjNI+5MiuHgbV1FQ=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PN2P287MB1127

X-Spam_score: 13.4

X-Spam_score_int: 134

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [INTERAC] View in browser
[...]



Content analysis details: (13.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Error: open resolver; ]

[Error: open resolver; ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:a01:112:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:a01:112:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:a01:112:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:a01:112:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:a01:112:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:a01:112:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:a01:112:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:a01:112:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[40.107.239.61 listed in will-spam-for-food.eu.org]

[40.107.239.61 listed in will-spam-for-food.eu.org]

[40.107.239.61 listed in will-spam-for-food.eu.org]

[40.107.239.61 listed in will-spam-for-food.eu.org]

[40.107.239.61 listed in will-spam-for-food.eu.org]

[40.107.239.61 listed in will-spam-for-food.eu.org]

[40.107.239.61 listed in will-spam-for-food.eu.org]

[40.107.239.61 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[2603:1096:a01:112:0:0:0:10 listed in]

[sbl-xbl.spamhaus.org]

[40.107.239.61 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[2603:1096:a01:112:0:0:0:10 listed in]

[dnsbl.ahbl.org]

[2603:1096:a01:112:0:0:0:10 listed in]

[dnsbl.ahbl.org]

[2603:1096:a01:112:0:0:0:10 listed in]

[dnsbl.ahbl.org]

[2603:1096:a01:112:0:0:0:10 listed in]

[dnsbl.ahbl.org]

[40.107.239.61 listed in dnsbl.ahbl.org]

[40.107.239.61 listed in dnsbl.ahbl.org]

[40.107.239.61 listed in dnsbl.ahbl.org]

[40.107.239.61 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[2603:1096:a01:112:0:0:0:10 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[2603:1096:a01:112:0:0:0:10 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[2603:1096:a01:112:0:0:0:10 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[2603:1096:a01:112:0:0:0:10 listed in]

[dnsbl.ahbl.org]

0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to

dbl.spamhaus.org was blocked due to usage of an

open resolver. See

https://www.spamhaus.org/returnc/pub/

[URI: etransfer-content.interac.ca]

[URI: etransfer-notification.interac.ca]

[URI: www.interac.ca]

[URI: interv2.s3.us-west-1.amazonaws.com]

[URI: welspun.com]

[URI: etransfer.interac.ca]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.239.61 listed in wl.mailspike.net]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: welspun.com/93.190.143.74]

[URI: etransfer-content.interac.ca/99.86.57.119]

[URI: etransfer-content.interac.ca/99.86.57.39]

[URI: etransfer-content.interac.ca/99.86.57.73]

[URI: etransfer-content.interac.ca/99.86.57.11]

[URI: www.interac.ca/45.60.115.208]

[URI: etransfer-notification.interac.ca/99.86.57.42]

[URI: etransfer-notification.interac.ca/99.86.57.82]

[URI: etransfer-notification.interac.ca/99.86.57.107]

[URI: etransfer-notification.interac.ca/99.86.57.23]

[URI: interv2.s3.us-west-1.amazonaws.com/3.5.163.155]

[URI: etransfer.interac.ca/45.223.2.85]

[URI: interv2.s3.us-west-1.amazonaws.com/52.219.120.1]

[URI: interv2.s3.us-west-1.amazonaws.com/52.219.193.42]

[URI: ns-1366.awsdns-42.org/205.251.197.86]

[URI: interv2.s3.us-west-1.amazonaws.com/52.219.117.1]

[URI: ns-1567.awsdns-03.co.uk/205.251.198.31]

[URI: ns-423.awsdns-52.com/205.251.193.167]

[URI: ns-694.awsdns-22.net/205.251.194.182]

[URI: ns-1321.awsdns-37.org/205.251.197.41]

[URI: ns-1670.awsdns-16.co.uk/205.251.198.134]

[URI: ns-27.awsdns-03.com/205.251.192.27]

[URI: ns-967.awsdns-56.net/205.251.195.199]

[URI: interv2.s3.us-west-1.amazonaws.com/52.219.192.42]

[URI: interv2.s3.us-west-1.amazonaws.com/52.219.220.226]

[URI: interv2.s3.us-west-1.amazonaws.com/52.219.117.82]

[URI: interv2.s3.us-west-1.amazonaws.com/52.219.113.25]

[URI: ns2.netcore.co.in/46.101.116.29]

[URI: ns1.netcore.co.in/202.162.229.11]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_VALID Message has a valid ARC signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.3 LONGWORD BODY: Uses overlong words

0.1 TW_HD BODY: Odd Letter Triples with HD

0.6 MEGALONGWORD BODY: Uses really overlong words

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

0.1 TW_SX BODY: Odd Letter Triples with SX

0.1 TW_WV BODY: Odd Letter Triples with WV

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_REMOTE_IMAGE Message contains an external image

2.0 TVD_PH_BODY_META No description available.

0.3 XFER_LOTSA_MONEY Transfer a lot of money

Subject: {SPAM?} "Notification: You Have Money from Interac e-Transfer"



--TpFoC9rZ2BkEsazT8rhaQYJ8E=_emMHIhV

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



[INTERAC] View in browser
nterac.ca/ViewInBrowser.do?tokens=3DeNrVV12PozYU_Sso2odWmiYQCCTFrX1gTBMWYA6=

yJahnsXGYmi6iyV1DGHxA1LTYIQ2Gl3-6HNU2KMr--555x78_tkTzlNWMSIPGFOMooZx0dKYiqL=

ye2koElyEuXkZhLTFrX1gTBMWYA6yJahnsXGYmi6iyV1DGHxA1LTYOcZJxIeHpXKi9vZjLbPpow=

rKkk0jcgskTMf_fKaPOa7mWs6vu163tLboNCyF3M0d7zVcjE3vcByViZygvVijVAYBou5tbbdle=

O7lu25brhCrhnCLc7hI1HqIJNbc2reTHIp9inN-nc-76ZvOY6JovWTFrX1gTBMWYA6yJahnsXGY=

mi6iyV1DGHxA1LTY09uxj0z9caY5PwweOALU3zizX71OyboBJY0kjZnCpUy7gV9fX6cJpXExVfE=

0EtmM8lmWqdnHNYmeAyHkr6Vp2nEiKY-O-vvc3fr3Qb3alrF3ma-DzG7SO1dK0t9KWqiqWnCm5R=

jkRbL0ulYbFmaEpbAnKgslMqBdQeULi-hdnRzsZoUGg-UMLoFJjIsyz4VUk9uEpAXt5kGb05ICM=

D2wu4P-3ZzTy7dSTwXsdu0ba8LhysZWnEhKYTMXisFmohgwMZcUsgI4dTLmmIwqVn5WRv-khi4Y=

7jItfcde2u7Ccm3vikoN054CwyecxMR4kgD2QBqZ2LOUVtl0UhmzgrVp-4FpOaG3WLpABdt1F74=

X-sgLQhSizcYKkIWcZRjMN2HordzQWS_hN1q4aAm74Ar0RVe1otgblHSSk1OmySbpoUyJHMH6P_=

arzyizU_RRZQ7qrzgCi6OyOue9hHRAiKs2UmS75r0nsWHTWHzM-2fXmk9fVL38tQDUxyXsEqYWf=

ROG8ENrODopRVRZ4IxmonbvbiOq17cPCGUvvJYLFrBze1BzcXrsM6gBfE1LTYISz_mt1AkIPcJW=

SHDTXq7sMCb6KowVfKV3L_nmoxWjTsg0wj9ayGl7isxNgXmZ7fYvJJyXVYPgi1q9DoG6J_0Kb_W=

aqfClga99QY0LShDwzac47tqtolqcAaYOL0y1M9f5jvxWe66GEIvp482ZhGh-M717cPCGUvvJYL=

FrBze1BzcXrsM6gBfE1LTYlzvb_8fLWqx_uH5GBHowN-vF-a4QPxn2wvd_trqCpM-uhAySmkmmS=

xrgsKo4qWequVlAea58_q3NgBhjpY0NjANjb0BjQS6c7oo5n1hv_qsyulkcNpNp-bSA9uKqBsxk=

3eyNyG-8TSC7TidxHTd4ASKJHlDtYahl-NaDWfOsYyHgP-RdGu4HZ9Yur2s6ulxnsQp-Ov70__3=

wL_lb5dt-gRiZKoGZcRqpxNvOabhUkH8wpyLMV50BTGhlBeyb7-J4zDGn5i_-xtFpux3LM4qrVq=

a1LfB6in6NRs62SRrl2Wstp_p_98ScyLtg9>

Hi sales@nk.ca,



Lynn Dion sent you $1450.65 (CAD) on 10/30/2024 - 2:35 AM.



Deposit your money at:

[RBC Royal Bank]

Or

Select a different financial institution
naws.com/interv1.html>

Expires: 10/30/2024 - 2:35 AM



What if you could deposit transfers without answering any questions? Sign u=

p for Autodeposit in your online banking - the safe and convenient way to r=

eceive funds straight to your bank account.



=A9 2000 - 2024 Interac Corp. All rights reserved.

Terms of Use

=AE Trade-marks of Interac Corp.



This message (including any attachments) is confidential and privileged. An=

y review, copying, disclosure, re-transmission, dissemination or other use =

of, or taking of any action in reliance upon this message by any person oth=

er than the intended recipient is prohibited. If you have received this mes=

sage in error, you are requested to delete it from your system and contact =

the sender by replying to this message immediately. The Sender is not liabl=

e for erroneous transmission of this message.



--TpFoC9rZ2BkEsazT8rhaQYJ8E=_emMHIhV

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable










1">




0">






























































































lt=3D"INTERAC" src=3D"http://etransfer-notification.interac.ca/images/own/e=

transfer_top_banner.png">
ewInBrowser.do?tokens=3DeNrVV12PozYU_Sso2odWmiYQCCTFrX1gTBMWYA6yJahnsXGYmi6=

iyV1DGHxA1LTYIQ2Gl3-6HNU2KMr--555x78_tkTzlNWMSIPGFOMooZx0dKYiqLye2koElyEuXk=

ZhLTFrX1gTBMWYA6yJahnsXGYmi6iyV1DGHxA1LTYOcZJxIeHpXKi9vZjLbPpowrKkk0jcgskTM=

f_fKaPOa7mWs6vu163tLboNCyF3M0d7zVcjE3vcByViZygvVijVAYBou5tbbdleO7lu25brhCrh=

nCLc7hI1HqIJNbc2reTHIp9inN-nc-76ZvOY6JovWTFrX1gTBMWYA6yJahnsXGYmi6iyV1DGHxA=

1LTY09uxj0z9caY5PwweOALU3zizX71OyboBJY0kjZnCpUy7gV9fX6cJpXExVfE0EtmM8lmWqdn=

HNYmeAyHkr6Vp2nEiKY-O-vvc3fr3Qb3alrF3ma-DzG7SO1dK0t9KWqiqWnCm5RjkRbL0ulYbFm=

aEpbAnKgslMqBdQeULi-hdnRzsZoUGg-UMLoFJjIsyz4VUk9uEpAXt5kGb05ICMD2wu4P-3ZzTy=

7dSTwXsdu0ba8LhysZWnEhKYTMXisFmohgwMZcUsgI4dTLmmIwqVn5WRv-khi4Y7jItfcde2u7C=

cm3vikoN054CwyecxMR4kgD2QBqZ2LOUVtl0UhmzgrVp-4FpOaG3WLpABdt1F74X-sgLQhSizcY=

KkIWcZRjMN2HordzQWS_hN1q4aAm74Ar0RVe1otgblHSSk1OmySbpoUyJHMH6P_arzyizU_RRZQ=

7qrzgCi6OyOue9hHRAiKs2UmS75r0nsWHTWHzM-2fXmk9fVL38tQDUxyXsEqYWfROG8ENrODopR=

VRZ4IxmonbvbiOq17cPCGUvvJYLFrBze1BzcXrsM6gBfE1LTYISz_mt1AkIPcJWSHDTXq7sMCb6=

KowVfKV3L_nmoxWjTsg0wj9ayGl7isxNgXmZ7fYvJJyXVYPgi1q9DoG6J_0Kb_WaqfClga99QY0=

LShDwzac47tqtolqcAaYOL0y1M9f5jvxWe66GEIvp482ZhGh-M717cPCGUvvJYLFrBze1BzcXrs=

M6gBfE1LTYlzvb_8fLWqx_uH5GBHowN-vF-a4QPxn2wvd_trqCpM-uhAySmkmmSxrgsKo4qWequ=

VlAea58_q3NgBhjpY0NjANjb0BjQS6c7oo5n1hv_qsyulkcNpNp-bSA9uKqBsxk3eyNyG-8TSC7=

TidxHTd4ASKJHlDtYahl-NaDWfOsYyHgP-RdGu4HZ9Yur2s6ulxnsQp-Ov70__3wL_lb5dt-gRi=

ZKoGZcRqpxNvOabhUkH8wpyLMV50BTGhlBeyb7-J4zDGn5i_-xtFpux3LM4qrVqa1LfB6in6NRs=

62SRrl2Wstp_p_98ScyLtg9">View

in browser




Hi sales@nk.ca,



Lynn Dion sent you $1450.65 (CAD) on 10/30/2024 - 2:35 AM.


Deposit your money at:

g alt=3D"RBC Royal Bank" src=3D"https://etransfer-content.interac.ca/en/log=

o_CA000003.png">


Or

interv1.html">Select a different financial institution
Expires: 10/30/2024 - 2:3=

5 AM

What if you could deposit transfers without answering any questions? Sig=

n up for Autodeposit in your online banking - the safe and convenient way t=

o receive funds straight to your bank account.


=A9 2000 - 2024 Interac Corp. All rights reserved.


Term=

s of Use


=AE Trade-marks of Interac Corp.






This message (including any attachments) is confidential and privileged. An=

y review, copying, disclosure, re-transmission, dissemination or other use =

of, or taking of any action in reliance upon this message by any person oth=

er than the intended recipient is

prohibited. If you have received this message in error, you are requested =

to delete it from your system and contact the sender by replying to this me=

ssage immediately. The Sender is not liable for erroneous transmission of t=

his message.







--TpFoC9rZ2BkEsazT8rhaQYJ8E=_emMHIhV--

nk.ca credential phishing from google.com

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path: <>

Envelope-to: dave@nk.ca

Delivery-date: Wed, 30 Oct 2024 01:45:00 -0600

Received: from 151.204.83.34.bc.googleusercontent.com ([34.83.204.151]:56272 helo=[10.88.0.7])

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1t63NT-0000000091M-0hVp

for dave@nk.ca;

Wed, 30 Oct 2024 01:44:46 -0600

Content-Type: multipart/related; boundary="===============3492897464608062168=="

MIME-Version: 1.0

From: "Nagindas Khandwala College ."

To: dave@nk.ca

Subject: =?utf-8?q?dave=40nk=2Eca=3A_Password_Expiration_Notice?=

X-Priority: 2

X-Spam_score: 12.7

X-Spam_score_int: 127

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Message Center. Password expire dave@nk.ca



Content analysis details: (12.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.4 MISSING_DATE Missing Date: header

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[34.83.204.151 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

[34.83.204.151 listed in dnsbl.ahbl.org]

[34.83.204.151 listed in dnsbl.ahbl.org]

[34.83.204.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Error: open resolver; ]

0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to

dbl.spamhaus.org was blocked due to usage of an

open resolver. See

https://www.spamhaus.org/returnc/pub/

[URI: beri5271.emlnk.com]

[URI: obinnaoffordire.wixsite.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: beri5271.emlnk.com/34.237.253.202]

[URI: obinnaoffordire.wixsite.com/34.144.206.118]

[URI: dns2.p07.nsone.net/198.51.45.7]

[URI: beri5271.emlnk.com/54.225.69.136]

[URI: dns4.p07.nsone.net/198.51.45.71]

[URI: dns3.p07.nsone.net/198.51.44.71]

[URI: dns1.p07.nsone.net/198.51.44.7]

[URI: ns-1642.awsdns-13.co.uk/205.251.198.106]

[URI: ns-1160.awsdns-17.org/205.251.196.136]

[URI: beri5271.emlnk.com/54.82.80.250]

[URI: beri5271.emlnk.com/54.235.205.181]

[URI: ns-174.awsdns-21.com/205.251.192.174]

[URI: ns-895.awsdns-47.net/205.251.195.127]

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

0.1 TO_IN_SUBJ To address is in Subject

1.0 XPRIO Has X-Priority header

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} =?utf-8?q?dave=40nk=2Eca=3A_Password_Expiration_Notice?=



--===============3492897464608062168==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PGh0bWw+PGhlYWQ+CiAgICA8bWV0YSBuYW1lPSJHRU5FUkFUT1IiIGNvbnRlbnQ9Ik1TSFRNTCAx

MS4wMC4xMDU3MC4xMDAxIj4KICAgIDxtZXRhIGh0dHAtZXF1aXY9IlgtVUEtQ29tcGF0aWJsZSIg

Y29udGVudD0iSUU9ZWRnZSI+CiAgICA8L2hlYWQ+CiAgICA8Ym9keT4KICAgIDxkaXYgc3R5bGU9

ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyB3aWR0aDogNjAwcHg7IGNvbG9yOiBy

Z2IoMzQsIDM0LCAzNCk7IHRleHQtdHJhbnNmb3JtOiBub25lOyB0ZXh0LWluZGVudDogMHB4OyBs

ZXR0ZXItc3BhY2luZzogbm9ybWFsOyBmb250LWZhbWlseTogQXJpYWwsIEhlbHZldGljYSwgc2Fu

cy1zZXJpZjsgZm9udC1zaXplOiBzbWFsbDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXdlaWdo

dDogNDAwOyB3b3JkLXNwYWNpbmc6IDBweDsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgYm94LXNpemlu

ZzogYm9yZGVyLWJveDsgb3JwaGFuczogMjsgd2lkb3dzOiAyOyBiYWNrZ3JvdW5kLWNvbG9yOiBy

Z2IoMjU1LCAyNTUsIDI1NSk7IGZvbnQtdmFyaWFudC1saWdhdHVyZXM6IG5vcm1hbDsgZm9udC12

YXJpYW50LWNhcHM6IG5vcm1hbDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0

LWRlY29yYXRpb24tdGhpY2tuZXNzOiBpbml0aWFsOyAKICAgIHRleHQtZGVjb3JhdGlvbi1zdHls

ZTogaW5pdGlhbDsgdGV4dC1kZWNvcmF0aW9uLWNvbG9yOiBpbml0aWFsOyI+CiAgICA8ZGl2IHN0

eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgcGFkZGluZzogNTBweCAzMHB4

IDMwcHg7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7Ij4KICAgIDxkaXYgc3R5bGU9ImJvcmRlci1j

b2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+CiAgICA8

dGFibGUgd2lkdGg9IjEwMCUiIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4

KTsgYm9yZGVyLWNvbGxhcHNlOiBjb2xsYXBzZTsiPgogICAgPHRib2R5IHN0eWxlPSJib3JkZXIt

Y29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPgogICAg

PHRyIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgYm94LXNpemluZzog

Ym9yZGVyLWJveDsiPgogICAgPHRkIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwg

MjM4KTsgbWFyZ2luOiAwcHg7IHRleHQtYWxpZ246IHJpZ2h0OyBmb250LXNpemU6IDIycHg7IGZv

bnQtd2VpZ2h0OiA2MDA7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7Ij5NZXNzYWdlIENlbnRlci48

L3RkPjwvdHI+PC90Ym9keT48L3RhYmxlPjwvZGl2PgogICAgPGRpdiBzdHlsZT0iYm9yZGVyLWNv

bG9yOiByZ2IoMjM4LCAyMzgsIDIzOCk7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7Ij4mbmJzcDs8

L2Rpdj4KICAgIDxkaXYgc3R5bGU9ImJhY2tncm91bmQ6IGJsYWNrOyBib3JkZXItY29sb3I6IHJn

YigyMzgsIDIzOCwgMjM4KTsgcGFkZGluZzogNXB4OyBjb2xvcjogd2hpdGU7IGJveC1zaXppbmc6

IGJvcmRlci1ib3g7Ij5QYXNzd29yZCBleHBpcmUgZGF2ZUBuay5jYTwvZGl2PgogICAgPGRpdiBz

dHlsZT0iYm9yZGVyLWNvbG9yOiByZ2IoMjM4LCAyMzgsIDIzOCk7IGJveC1zaXppbmc6IGJvcmRl

ci1ib3g7Ij4mbmJzcDs8L2Rpdj4KICAgIDxkaXYgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIz

OCwgMjM4LCAyMzgpOyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+CiAgICA8dGFibGUgd2lkdGg9

IjEwMCUiIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgYm9yZGVyLWNv

bGxhcHNlOiBjb2xsYXBzZTsiPgogICAgPHRib2R5IHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigy

MzgsIDIzOCwgMjM4KTsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPgogICAgPHRyIHN0eWxlPSJi

b3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgYm94LXNpemluZzogYm9yZGVyLWJveDsi

PgogICAgPHRkIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgbWFyZ2lu

OiAwcHg7IHBhZGRpbmc6IDVweDsgYm94LXNpemluZzogYm9yZGVyLWJveDsiIGNvbHNwYW49IjIi

PllvdXIgUGFzc3dvcmQgZXhwaXJlcyBkYXZlQG5rLmNhLiBQbGVhc2UgZm9sbG93IHRoZSBwb3J0

YWwgYmVsb3cgdG8gY29udGludWUgd2l0aCB5b3VyIGN1cnJlbnQgcGFzc3dvcmQuPC90ZD48L3Ry

PgogICAgPHRyIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgYm94LXNp

emluZzogYm9yZGVyLWJveDsiPgogICAgPHRkIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgs

IDIzOCwgMjM4KTsgbWFyZ2luOiAwcHg7IHBhZGRpbmc6IDVweDsgYm94LXNpemluZzogYm9yZGVy

LWJveDsiPlJlY2lwaWVudDo8L3RkPgogICAgPHRkIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigy

MzgsIDIzOCwgMjM4KTsgbWFyZ2luOiAwcHg7IHBhZGRpbmc6IDVweDsgdGV4dC1hbGlnbjogcmln

aHQ7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7Ij5kYXZlQG5rLmNhPC90ZD48L3RyPgogICAgPHRy

IHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgYm94LXNpemluZzogYm9y

ZGVyLWJveDsiPgogICAgPHRkIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4

KTsgbWFyZ2luOiAwcHg7IHBhZGRpbmc6IDVweDsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPkRh

dGU6PC90ZD4KICAgIDx0ZCBzdHlsZT0iYm9yZGVyLWNvbG9yOiByZ2IoMjM4LCAyMzgsIDIzOCk7

IG1hcmdpbjogMHB4OyBwYWRkaW5nOiA1cHg7IHRleHQtYWxpZ246IHJpZ2h0OyBib3gtc2l6aW5n

OiBib3JkZXItYm94OyI+MDc6NDQ6MTggQU08L3RkPjwvdHI+CiAgICA8dHIgc3R5bGU9ImJvcmRl

ci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+CiAg

ICA8dGQgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBtYXJnaW46IDBw

eDsgcGFkZGluZzogNXB4OyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+VGltZTo8L3RkPgogICAg

PHRkIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgbWFyZ2luOiAwcHg7

IHBhZGRpbmc6IDVweDsgdGV4dC1hbGlnbjogcmlnaHQ7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7

Ij4/PC90ZD48L3RyPjwvdGJvZHk+PC90YWJsZT48L2Rpdj4KICAgIDxkaXYgc3R5bGU9ImJvcmRl

ci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+Jm5i

c3A7PC9kaXY+CiAgICA8ZGl2IHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4

KTsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPgogICAgPHRhYmxlIHdpZHRoPSIxMjAiIHN0eWxl

PSJiYWNrZ3JvdW5kOiByZ2IoMCwgMTAzLCAxODQpOyBib3JkZXItY29sb3I6IHJnYigyMzgsIDIz

OCwgMjM4KTsgY29sb3I6IHdoaXRlOyBib3JkZXItY29sbGFwc2U6IGNvbGxhcHNlOyI+CiAgICA8

dGJvZHkgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBib3gtc2l6aW5n

OiBib3JkZXItYm94OyI+CiAgICA8dHIgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4

LCAyMzgpOyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+CiAgICA8dGQgc3R5bGU9ImJvcmRlci1j

b2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBtYXJnaW46IDBweDsgYm94LXNpemluZzogYm9yZGVy

LWJveDsiPgogICAgPGEgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBj

b2xvcjogd2hpdGU7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7IGJhY2tncm91bmQtY29sb3I6IHRy

YW5zcGFyZW50OyB0ZXh0LWRlY29yYXRpb24tbGluZTogbm9uZTsiIGhyZWY9Imh0dHBzOi8vb2Jp

bm5hb2Zmb3JkaXJlLndpeHNpdGUuY29tL3NvLzYxUEJIUHZWRS9jP3c9d3YyRENGNkk0b1V0QXdo

bzljMTdXeTB4OUF1TmJaalMwTGhTREI2YkthVS5leUoxSWpvaWFIUjBjSE02THk5dFlXeHNaV0Zp

YkdVdGNtVnRhVzVwYzJObGJuUXRZbTlpWTJGMExtZHNhWFJqYUM1dFpTOGlMQ0p5SWpvaVpqUXlN

R1E0TWpjdE1qZGtZUzAwTUdaakxXSXpaVEl0TXpoaE16SXhNVFEwTVdKbUlpd2liU0k2SW0xaGFX

d2lMQ0pqSWpvaU5HVXlaalV6TmpJdFlqYzFNaTAwT0dObExXRTBNakF0WWpBd09XVTVaamxpTXpk

akluMCM/ZW1haWw9WkdGMlpVQnVheTVqWVE9PSIgdGFyZ2V0PSJfYmxhbmsiIAogICAgcmVsPSJu

b3JlZmVycmVyIiBkYXRhLXNhZmVyZWRpcmVjdHVybD0iaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS91

cmw/cT1odHRwczovL2Jlcmk1MjcxLmVtbG5rLmNvbS9sdC5waHA/eCUzRDNUeHRtclVGVXFQVVQ1

NXFBMWN3alBha19aTi55dmtXci1aaVg2TElTcGVlRlphaF94QXdVZW12UGFXWmlOQX5sZll2YkhY

SCUyMyUyNTdCZW1haWwlMjU3RCZhbXA7c291cmNlPWdtYWlsJmFtcDt1c3Q9MTczMDMyMDU4NzY2

NDAwMCZhbXA7dXNnPUFPdlZhdzBhdXp6R3E2NzMzUlB4OWdWVzBzS2QiPkNvbnRpbnVlPC9hPjwv

dGQ+PC90cj48L3Rib2R5PjwvdGFibGU+PC9kaXY+PC9kaXY+PC9kaXY+CiAgICA8ZGl2IHN0eWxl

PSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgY29sb3I6IHJnYigzNCwgMzQsIDM0

KTsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHRleHQtaW5kZW50OiAwcHg7IGxldHRlci1zcGFjaW5n

OiBub3JtYWw7IGZvbnQtZmFtaWx5OiBBcmlhbCwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250

LXNpemU6IHNtYWxsOyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtd2VpZ2h0OiA0MDA7IHdvcmQt

c3BhY2luZzogMHB4OyB3aGl0ZS1zcGFjZTogbm9ybWFsOyBib3gtc2l6aW5nOiBib3JkZXItYm94

OyBvcnBoYW5zOiAyOyB3aWRvd3M6IDI7IGJhY2tncm91bmQtY29sb3I6IHJnYigyNTUsIDI1NSwg

MjU1KTsgZm9udC12YXJpYW50LWxpZ2F0dXJlczogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczog

bm9ybWFsOyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQtZGVjb3JhdGlvbi10

aGlja25lc3M6IGluaXRpYWw7IAogICAgdGV4dC1kZWNvcmF0aW9uLXN0eWxlOiBpbml0aWFsOyB0

ZXh0LWRlY29yYXRpb24tY29sb3I6IGluaXRpYWw7Ij4mbmJzcDs8L2Rpdj4KICAgIDxzcGFuIHN0

eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgY29sb3I6IHJnYigzNCwgMzQs

IDM0KTsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHRleHQtaW5kZW50OiAwcHg7IGxldHRlci1zcGFj

aW5nOiBub3JtYWw7IGZvbnQtZmFtaWx5OiBBcmlhbCwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBm

b250LXNpemU6IHNtYWxsOyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtd2VpZ2h0OiBib2xkZXI7

IHdvcmQtc3BhY2luZzogMHB4OyB3aGl0ZS1zcGFjZTogbm9ybWFsOyBib3gtc2l6aW5nOiBib3Jk

ZXItYm94OyBvcnBoYW5zOiAyOyB3aWRvd3M6IDI7IGJhY2tncm91bmQtY29sb3I6IHJnYigyNTUs

IDI1NSwgMjU1KTsgZm9udC12YXJpYW50LWxpZ2F0dXJlczogbm9ybWFsOyBmb250LXZhcmlhbnQt

Y2Fwczogbm9ybWFsOyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQtZGVjb3Jh

dGlvbi10aGlja25lc3M6IGluaXRpYWw7IAogICAgdGV4dC1kZWNvcmF0aW9uLXN0eWxlOiBpbml0

aWFsOyB0ZXh0LWRlY29yYXRpb24tY29sb3I6IGluaXRpYWw7Ij5Ob3RlOjwvc3Bhbj4KICAgIDxz

cGFuIHN0eWxlPSJjb2xvcjogcmdiKDM0LCAzNCwgMzQpOyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsg

dGV4dC1pbmRlbnQ6IDBweDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgZm9udC1mYW1pbHk6IEFy

aWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogc21hbGw7IGZvbnQtc3R5bGU6

IG5vcm1hbDsgZm9udC13ZWlnaHQ6IDQwMDsgd29yZC1zcGFjaW5nOiAwcHg7IGZsb2F0OiBub25l

OyBkaXNwbGF5OiBpbmxpbmUgIWltcG9ydGFudDsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgb3JwaGFu

czogMjsgd2lkb3dzOiAyOyBiYWNrZ3JvdW5kLWNvbG9yOiByZ2IoMjU1LCAyNTUsIDI1NSk7IGZv

bnQtdmFyaWFudC1saWdhdHVyZXM6IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsg

LXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb24tdGhpY2tuZXNz

OiBpbml0aWFsOyB0ZXh0LWRlY29yYXRpb24tc3R5bGU6IAogICAgaW5pdGlhbDsgdGV4dC1kZWNv

cmF0aW9uLWNvbG9yOiBpbml0aWFsOyI+PHNwYW4+Jm5ic3A7PC9zcGFuPiZuYnNwO1RoZSBjb250

ZW50IG9mIHRoaXMgZW1haWwgaXMgY29uZmlkZW50aWFsIGFuZCBpbnRlbmRlZCBmb3IgdGhlIHJl

Y2lwaWVudCBzcGVjaWZpZWQgaW4gbWVzc2FnZSBvbmx5LiBJdCBpcyBzdHJpY3RseSBmb3JiaWRk

ZW4gdG8gc2hhcmUgYW55IHBhcnQgb2YgdGhpcyBtZXNzYWdlIHdpdGggYW55IHRoaXJkIHBhcnR5

LCB3aXRob3V0IGEgd3JpdHRlbiBjb25zZW50IG9mIHRoZSBzZW5kZXIuIElmIHlvdSByZWNlaXZl

ZCB0aGlzIG1lc3NhZ2UgYnkgbWlzdGFrZSwgcGxlYXNlIHJlcGx5IHRvIHRoaXMgbWVzc2FnZSBh

bmQgZm9sbG93IHdpdGggaXRzIGRlbGV0aW9uLCBzbyB0aGF0IHdlIGNhbiBlbnN1cmUgc3VjaCBh

IG1pc3Rha2UgZG9lcyBub3Qgb2NjdXIgaW4gdGhlIGZ1dHVyZS48L3NwYW4+PC9ib2R5PjwvaHRt

bD4=



--===============3492897464608062168==--

Web / SEO / App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 30 Oct 2024 07:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1t69Ad-000000007FF-0SUN

for dave@doctor.nl2k.ab.ca;

Wed, 30 Oct 2024 07:55:35 -0600

Resent-From: The Doctor

Resent-Date: Wed, 30 Oct 2024 07:55:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f65.google.com ([209.85.216.65]:48377)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1t62JG-0000000048t-3KRY

for root@nk.ca;

Wed, 30 Oct 2024 00:36:42 -0600

Received: by mail-pj1-f65.google.com with SMTP id 98e67ed59e1d1-2e2eb9dde40so5033213a91.0

for ; Tue, 29 Oct 2024 23:36:02 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=phpteamates-com.20230601.gappssmtp.com; s=20230601; t=1730270156; x=1730874956; darn=nk.ca;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=fv/Xk4I85jVLgPWDZvfcttT3rguHUTU6MFSoYe/nSxc=;

b=VG1J6gc+e+mF1c+9FBZ4nUoCVrSO2QLoHj+f8mKBdqin2rJF5+1rrIFmfFVUIhA7Tu

zd2fs7BqFRo3EaZl3fye+/eSDddR3AK0812p/yIlhRtdI2Pon54Kgdfl+eQwn9+pyRpt

iZ5hsPjt3ser7R3srZXr/hbohDuuCNqOl/fv4c6sEIs+dKShRKQHximZsv/qZ4e7kEIb

4onAHkv5YuzWaSQXG8nMZZhHlQ+ngX9Hv2rScbv3uA9hzHg55hqbPW2+/DtXgC488yZ5

SJKkE6LlQG0RS+hAGPktbkXCK9Gn4PUuzR1MBkb2pAjHPhRG5NFj0Pwyuk0JXSsqPRJl

sJ5w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1730270156; x=1730874956;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=fv/Xk4I85jVLgPWDZvfcttT3rguHUTU6MFSoYe/nSxc=;

b=eC+55ZVDEKSpCH3gW+m5Kz8Hs7juaX3lujHF7Wu7fIp7W55RG3tLzz8BTSvaDVEAja

zNzCSr4aS/JDDoY48KuekKqAFTFI5IIMNgRMd9FS2qB33x4CMW9ehtSxKYO4cQOMqfLg

0449Aht7V/ABoNGI8kBdzZuX3lxSIMdt2qW/jjo3bQ0unvieY2ClkLG0QOfpTrjJnQ5w

YBAz47JMaK5xBZh9YAkrNWxZ7OaYJbSB4C3dwgOk3K3lXomMrn8m641rtIccDvm9W8/k

YFTJGhtv1WTu684+KtRUWCM+ExGJ05YyOLWm4kg4070SKddYblKSZ0U6oH1kTox7mUUt

z4RQ==

X-Gm-Message-State: AOJu0YxF1arjBkUGU5PIGL5Q+TdFYeuJDrd1/7fQIdVpzW2LLyMO2fQL

jH8UAaAtSzxXhufI+ebw/TaGb32tdK9ffP9HbZwLbTueSUD1O/ae+zUadGcaje0Mb4v6raeF7aZ

3QYM=

X-Google-Smtp-Source: AGHT+IEYAUqg7phq88paOt/Uu0pUBx1XCUiaPOYTLU61lTH6oZGpvPC3SjGIsyZC4xN3fEdKrUMLJA==

X-Received: by 2002:a17:90b:1091:b0:2e2:857e:fcfb with SMTP id 98e67ed59e1d1-2e8f107b9d9mr16013740a91.19.1730270155912;

Tue, 29 Oct 2024 23:35:55 -0700 (PDT)

Received: from Vikash ([2401:4900:1c23:30a3:2da5:dc8d:464:d54f])

by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-2e92fa634b3sm795001a91.27.2024.10.29.23.35.54

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Tue, 29 Oct 2024 23:35:55 -0700 (PDT)

From: "Chanchal"

To:

Subject: App Developer

Date: Wed, 30 Oct 2024 11:49:19 +0530

Message-ID: <86f601db2a95$fdd06bb0$f9714310$@com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_86F7_01DB2AC4.1788A7B0"

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: AdspzOHuykstUYjkS4SErhrcvz7whg==

Content-Language: en-us

X-Spam_score: 12.0

X-Spam_score_int: 120

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I am Chanchal, App Development Manager and I work with

155+experienced IT professionals. If you are looking for creating an app

for your business. So we can create. We make different type apps.



Content analysis details: (12.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Error: open resolver; ]

[Error: open resolver; ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[will-spam-for-food.eu.org]

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[will-spam-for-food.eu.org]

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[will-spam-for-food.eu.org]

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[will-spam-for-food.eu.org]

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[will-spam-for-food.eu.org]

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[will-spam-for-food.eu.org]

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[will-spam-for-food.eu.org]

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[will-spam-for-food.eu.org]

[209.85.216.65 listed in will-spam-for-food.eu.org]

[209.85.216.65 listed in will-spam-for-food.eu.org]

[209.85.216.65 listed in will-spam-for-food.eu.org]

[209.85.216.65 listed in will-spam-for-food.eu.org]

[209.85.216.65 listed in will-spam-for-food.eu.org]

[209.85.216.65 listed in will-spam-for-food.eu.org]

[209.85.216.65 listed in will-spam-for-food.eu.org]

[209.85.216.65 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[sbl-xbl.spamhaus.org]

[209.85.216.65 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[dnsbl.ahbl.org]

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[dnsbl.ahbl.org]

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[dnsbl.ahbl.org]

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[dnsbl.ahbl.org]

[209.85.216.65 listed in dnsbl.ahbl.org]

[209.85.216.65 listed in dnsbl.ahbl.org]

[209.85.216.65 listed in dnsbl.ahbl.org]

[209.85.216.65 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[2401:4900:1c23:30a3:2da5:dc8d:464:d54f listed in]

[dnsbl.ahbl.org]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[209.85.216.65 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.216.65 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.65 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.8 FROM_FMBLA_NEWDOM28 From domain was registered in last 14-28 days

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.6 J_CHICKENPOX_43 BODY: 4alpha-pock-3alpha

0.0 HTML_MESSAGE BODY: HTML included in message

Subject: {SPAM?} App Developer



This is a multi-part message in MIME format.



------=_NextPart_000_86F7_01DB2AC4.1788A7B0

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,







I am Chanchal, App Development Manager and I work with 155+experienced IT

professionals. If you are looking for creating an app for your business. So

we can create.



We make different type apps.







Sell and Buy apps, Booking apps, Fashion Apps, Fitness apps, Healthcare

apps, Wedding apps, Taxi App, Restaurant Apps.etc







If you are interested Please share your contact details like Whatsapp /

Skype.







Our pricing is very reasonable.







Thanks



Chanchal,







Business Consultant ( India )









------=_NextPart_000_86F7_01DB2AC4.1788A7B0

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">

class=3DWordSection1>

Hi,


class=3DMsoNoSpacing> 

I am =

Chanchal, App Development Manager and I work with 155+experienced =

IT professionals. If you are looking for creating an app for your =

business. So we can create.

We make different =

type apps.

 


class=3DMsoNoSpacing>Sell and Buy apps, Booking apps, Fashion Apps, =

Fitness apps, Healthcare apps, Wedding apps, Taxi App, Restaurant =

Apps…etc

 


class=3DMsoNoSpacing>If you are interested Please share your contact =

details like Whatsapp / Skype.


class=3DMsoNoSpacing> 

Our =

pricing is very reasonable.


class=3DMsoNoSpacing> 


class=3DMsoNoSpacing>Thanks


class=3DMsoNoSpacing>Chanchal,


class=3DMsoNoSpacing> 


class=3DMsoNoSpacing>Business Consultant ( India )


class=3DMsoNormal> 



------=_NextPart_000_86F7_01DB2AC4.1788A7B0--



Promotional phish from OVH

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 30 Oct 2024 07:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1t69AW-000000007EJ-29wR

for dave@doctor.nl2k.ab.ca;

Wed, 30 Oct 2024 07:55:28 -0600

Resent-From: The Doctor

Resent-Date: Wed, 30 Oct 2024 07:55:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [141.227.132.164] (port=55109 helo=oas.samhsa.gov)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

(envelope-from )

id 1t61ru-0000000024F-27T6

for doctor@nl2k.ca;

Wed, 30 Oct 2024 00:08:39 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nl2k.ca;

h=Date:From:To:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding; i=doctor@nl2k.ca;

bh=Nstll08tlW8aQ7CbFQjc1d80s2Q=;

b=GwADwXEAAyi6QkrX5m0Ewrl77DJJAIPD+oOv+vDA0SRa6ChxJCgsyRlHEEwSm57pdMx7F/RIqizE

7pGZpz+XmSbSooXZPowHIQO7GtQO5iKhgYosw1hD3chV5n6clbIY4Js89AyaJsOtHR+dQFa+0fJV

LlLWWlX7krmk4MeQ6J/UMcTghnfNLr4+Zjz9u12DS5xxpwB5rpSJa/RPeDgO31Goy9CMeudhYhmh

0w6Gx0q2kEOYI6IzcqskXeqffID7n9cgwGMH5XKHfiz0W4ziAod5VB1u96lgV2uiR+xBvW3Ri7P2

ioXaHUuhcQnizjvPp/+CMtmXfzfGC87HDYS8Jg==

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nl2k.ca;

b=ZUueFXxNuVChrYEh0TohCTMGTKwxr9rp2M4F08U5uPYwyN+dEHYnrXG1kWK5kEjdpFvEUSxPWFQA

S4JJFFGg8BH2EVjxWG6BMoYgj0smi6MC+uplOizfOlvwgYdR0j+0WKEgsXmILbeDpSl5aM/QT8G5

IquXX550YM7GOIV72OqHs25uhjhGrt1OVP7Rm9XD1ahgFvF2+1H4qN2I8rBO2tPK5jNlT8uEQvuA

6enIRlwzRpn/asZQD2/rjFTxn+TecjnUVqZ6Hp0OD1GqsoulD7veEJiijTvNTLQ80z0IYLVa8KkI

j1IIgiUAPFTXLqf/oABkgJxnq/NzLiPAsRXmSA==;

Date: Wed, 30 Oct 2024 06:07:40 +0000

From: doctor

To: doctor@nl2k.ca

Subject: Just for you !!!!!!

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

Feedback-ID: ::1.us-east-1.FGOMu7cyRDQ+---11964131---6727---+DpDV8A4nRy0mhfXJECb4JrfNEF47z4w=:AmazonSES

X-Spam_score: 19.5

X-Spam_score_int: 195

X-Spam_bar: +++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: doctor--Welcome_To_My_Email--doctor@nl2k.ca - 4notskhdpzd12109wozrr901lnwjrtqgtiuoza6728notskhdpzd11964131ixhxrjm3710fefsyfmqnyhoq4

doctor@nl2k.ca- ww-Welcome_To_My_Email-ww This Promo Just for you !!!!!!



Content analysis details: (19.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query to

zen.spamhaus.org was blocked due to usage of an

open resolver. See

https://www.spamhaus.org/returnc/pub/

[141.227.132.164 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[141.227.132.164 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[141.227.132.164 listed in dnsbl.ahbl.org]

[141.227.132.164 listed in dnsbl.ahbl.org]

[141.227.132.164 listed in dnsbl.ahbl.org]

[141.227.132.164 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[141.227.132.164 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[141.227.132.164 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[141.227.132.164 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[141.227.132.164 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Error: open resolver; ]

0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to

dbl.spamhaus.org was blocked due to usage of an

open resolver. See

https://www.spamhaus.org/returnc/pub/

[URI: nl2k.ca]

[URI: fonts.googleapis.com]

[URI: ikjynlqbt.opened4email.site]

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.

See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URI: googleapis.com]

[URI: nl2k.ca]

[URI: opened4email.site]

[URI: 141.227.132.164]

0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL

was blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[141.227.132.164 listed in list.dnswl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: nl2k.ca/204.209.81.1]

[URI: ikjynlqbt.opened4email.site/15.204.57.221]

[URI: ns4.google.com/216.239.38.10]

[URI: dns1.registrar-servers.com/156.154.132.200]

[URI: fonts.googleapis.com/142.251.33.106]

[URI: ns3.google.com/216.239.36.10]

[URI: ns1.google.com/216.239.32.10]

[URI: ns2.google.com/216.239.34.10]

[URI: gallifrey.nl2k.ca/204.209.81.3]

[URI: dns2.registrar-servers.com/156.154.133.200]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=doctor%40nl2k.ca;ip=141.227.132.164;r=doctor.nl2k.ab.ca]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[141.227.132.164 listed in will-spam-for-food.eu.org]

[141.227.132.164 listed in will-spam-for-food.eu.org]

[141.227.132.164 listed in will-spam-for-food.eu.org]

[141.227.132.164 listed in will-spam-for-food.eu.org]

[141.227.132.164 listed in will-spam-for-food.eu.org]

[141.227.132.164 listed in will-spam-for-food.eu.org]

[141.227.132.164 listed in will-spam-for-food.eu.org]

[141.227.132.164 listed in will-spam-for-food.eu.org]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

0.0 HTML_IMAGE_RATIO_08 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.2 HTML_TITLE_SUBJ_DIFF No description available.

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.7 THIS_AD "This ad" and variants

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

0.0 TO_EQ_FM_SPF_FAIL To == From and external SPF failed

0.0 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF

failed

0.0 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

Subject: {SPAM?} Just for you !!!!!!




w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">


ft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:office">










"stylesheet" type=3D"text/css"/>

<br /><br /> doctor--Welcome_To_My_Email--doctor@nl2k.ca<br /><br /> - 4notskhdpzd12109wozrr901lnwjrtqgtiuoza6728notskhdpzd11964131=<br /><br /> ixhxrjm3710fefsyfmqnyhoq4 doctor@nl2k.ca-<br /><br /> ww-Welcome_To_My_Email-ww<br /><br />




0">


yle=3D"line-height: inherit;">


ht: inherit;">


ight: inherit;">


ttp://schema.org/EmailMessage" style=3D"font-family: 'Helvetica Neue',Helve=

tica,Arial,sans-serif; box-sizing: border-box; font-size: 14px; -webkit-fon=

t-smoothing: antialiased; -webkit-text-size-adjust: none; width: 100% !impo=

rtant; height: 100%; line-height: 1.6em; background-color: #fff; margin: 0;=

">


12109wozrr901lnwjrtqgtiuoza6728notskhdpzd11964131ixhxrjm3710=

fefsyfmqnyhoq4" style=3D"text-decoration: none;">


al,sans-serif; box-sizing: border-box; font-size: 14px; max-width: 650px; d=

isplay: block; margin: 0 auto; padding: 20px;">


42;font-family: 'Helvetica Neue',Helvetica,Arial,sans-serif; box-sizing: bo=

rder-box; font-size: 14px; margin: 0;" width=3D"100%">


sizing: border-box; font-size: 14px; margin: 0;text-align:center;">




ng: border-box; font-size: 14px; margin: 0;">








ial,sans-serif; box-sizing: border-box; font-size: 18px; vertical-align: to=

p; margin: 0; padding: 0 0 20px;" valign=3D"top">


serif;color:white;">

This Promo Just for you !!!!!!



ial,sans-serif; box-sizing: border-box; font-size: 14px; text-align:center;=

vertical-align: top; margin: 0; padding: 10px 0 10px;" valign=3D"top">
ass=3D"btn-primary" href=3D"http://141.227.132.164/4notskhdpzd=

12109wozrr901lnwjrtqgtiuoza6728notskhdpzd11964131ixhxrjm3710fefsyfmqnyhoq=

4" style=3D"font-family: 'Montserrat',Helvetica,Arial,sans-serif; b=

ox-sizing: border-box; font-size: 14px; color:#000; text-decoration: none; =

line-height: 2em; font-weight: bold; text-align:

center; cursor: pointer;

display: inline-block; border-radius: 5px; text-transform: capitalize; back=

ground-color: #FDFD04; margin: 0; border-color: #FDFD04; border-style: soli=

d; border-width: 10px 20px;">Click Her!



901lnwjrtqgtiuoza6728notskhdpzd11964131ixhxrjm3710fefsyfmqnyhoq4" wid=

th=3D"0" height=3D"0">
































































text-align:center;margin-top:300px">If you no longer wish to receive these =

emails,
you can unsubscribe by clicking
12109wozrr901lnwjrtqgtiuoza6728notskhdpzd11964131=

ixhxrjm3710fefsyfmqnyhoq4" style=3D"color: blue;">here

pan>








You can unsubscribe at a=

ny time.
wozrr901lnwjrtqgtiuoza6728notskhdpzd11964131ixhxrjm3710fefsyfmqnyhoq4" st=

yle=3D"color: blue;">To leave










Korean source Google Spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 29 Oct 2024 23:38:00 -0600

Received: from mail-lj1-f181.google.com ([209.85.208.181]:60813)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1t61Ni-00000000PpW-1LIa

for dave@doctor.nl2k.ab.ca;

Tue, 29 Oct 2024 23:37:11 -0600

Received: by mail-lj1-f181.google.com with SMTP id 38308e7fff4ca-2fb50e84ec7so46000431fa.1

for ; Tue, 29 Oct 2024 22:36:33 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1730266586; x=1730871386; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=MWHTjNqn0AMawbL1NyNPibfZjtf/hWjcKOjQ3RYAHp8=;

b=EnXIuhfYCMQ79mb+plD8ZQ5sAek3zEWmPWLjRPjXMbLrSUxn0O2KknQUQAM/HAqKub

sA9kTSlrF5sWwHe1MZSGXwwVZJL2O8Ps627hqcBDZn+jF/mz8ehIxRVrk+WHpjT8IjWp

35virhxd0zVcw6m5b3Uo+muSgloH/XswGwhO+UM7rEYYmETCSaA8BnTrkaokjqM9txNE

upkN1Qp01SH/qptXIGk5AgGnK3Ek2Xc0QENxyyozyB2raFp06l0oDBxjFNi5a+7S1Vlu

bWzwfuHxcXpvdM1+55czL8XK32uT81NFzRzQ43oPTfKih+gnWgd0LxzsgGpqGla7TzOT

C+Fw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1730266586; x=1730871386;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=MWHTjNqn0AMawbL1NyNPibfZjtf/hWjcKOjQ3RYAHp8=;

b=Hdk3EhDBPrcE6oYCln/r37GHWdOS+yXcwOUKjmqw5nab0oD4UqC83Tex5i+jCNqKjm

oond7ghaQB15Gt5u4ZYQ6WE6Ps5UPG6dg7t8cARUFx3//xUDvx3Znvjwa2WULck0HSWD

XvboQuGHPEbbdInrn+MhLBkB06ha4CsZSXdYuZiltervdw56FWCqQU4fnk0rZTgHoXwP

nsmhNUSsmksc5vWEDY44pw2xDhvQcKoFb3EpCRkYV+1CEoiL53drLkShsaSinG9nkprU

a4REoJ51jupuJfubAUT/idL2Ndn5tBYhdmvp4xiSvsnw4H5gACwlR7KWMZrE/UwqSfc9

c2kg==

X-Forwarded-Encrypted: i=1; AJvYcCUv6OLyTGE8BCOy7SdXVgwmEgs08CT8IY9TDvgLtlsng6A6725zMBdK7hfoYTvetGzB+yU7@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YwzqrNWOOmdYI6Xc8GMB265YCThWSBwtclNftcdmq/UAns3Gnou

VQyRmHmT9rf9Bw51glryKx9byLks51wwEBa7hYugEm1A8yOAyxSOwLJvuy3SAwwM3lBLWlBWX7X

tvEgue1Bp7NPkHoqXEly1Q9ZLTLY=

X-Google-Smtp-Source: AGHT+IHl0sxf4JpK5sOaFXGIWjN3DkgxwD9rrSwQ1tIzrJ57vPcEGNgD8Ynx6u2mskbAPD6HYcbEiS8DDJ46yCbPDnc=

X-Received: by 2002:a2e:be1f:0:b0:2fa:bf53:1dad with SMTP id

38308e7fff4ca-2fcbe0781ddmr64728601fa.31.1730266585615; Tue, 29 Oct 2024

22:36:25 -0700 (PDT)

MIME-Version: 1.0

From: Mrs Kim Yoon

Date: Tue, 29 Oct 2024 22:36:14 -0700

Message-ID:

Subject: Greetings

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000033d4e60625ab1507"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 10.6

X-Spam_score_int: 106

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings, I wonder why you continue neglecting my emails.

Please, acknowledge the receipt of this message in reference to the subject

above as I intend to send to you the details of the mail. Sometimes, try

to [...]



Content analysis details: (10.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[209.85.208.181 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.181 listed in dnsbl.ahbl.org]

[209.85.208.181 listed in dnsbl.ahbl.org]

[209.85.208.181 listed in dnsbl.ahbl.org]

[209.85.208.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.181 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.181 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.181 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query to

zen.spamhaus.org was blocked due to usage of an

open resolver. See

https://www.spamhaus.org/returnc/pub/

[209.85.208.181 listed in zen.spamhaus.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.181 listed in wl.mailspike.net]

0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL

was blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[209.85.208.181 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.208.181 listed in will-spam-for-food.eu.org]

[209.85.208.181 listed in will-spam-for-food.eu.org]

[209.85.208.181 listed in will-spam-for-food.eu.org]

[209.85.208.181 listed in will-spam-for-food.eu.org]

[209.85.208.181 listed in will-spam-for-food.eu.org]

[209.85.208.181 listed in will-spam-for-food.eu.org]

[209.85.208.181 listed in will-spam-for-food.eu.org]

[209.85.208.181 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Error: open resolver; ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[fofficefille(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 HK_NAME_FM_MR_MRS No description available.

Subject: {SPAM?} Greetings



--00000000000033d4e60625ab1507

Content-Type: text/plain; charset="UTF-8"



Greetings,



I wonder why you continue neglecting my emails. Please, acknowledge the

receipt of this message in reference to the subject above as I intend to

send to you the details of the mail. Sometimes, try to check your spam box

because most of these correspondences fall out sometimes in SPAM folder.



Best regards,



Mrs Seo Yoon Kim.



--00000000000033d4e60625ab1507

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings,

I wonder why you continue neglecting my =

emails. Please, acknowledge the receipt of this message in reference to the=

subject above as I intend to send to you the details of the mail. Sometime=

s, try to check your spam box because most of these correspondences fall ou=

t sometimes in SPAM folder.

Best regards,

Mrs Seo Yoon Kim. <=

/div>



--00000000000033d4e60625ab1507--

nk.ca credential phishing from google.com

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 29 Oct 2024 20:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1t5ytM-00000000GMw-2t10

for dave@doctor.nl2k.ab.ca;

Tue, 29 Oct 2024 20:57:04 -0600

Resent-From: The Doctor

Resent-Date: Tue, 29 Oct 2024 20:57:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 151.204.83.34.bc.googleusercontent.com ([34.83.204.151]:59274 helo=[10.88.0.7])

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1t5xMd-000000009v1-02E5

for doctor@nl2k.ab.ca;

Tue, 29 Oct 2024 19:19:21 -0600

Content-Type: multipart/related; boundary="===============6791593084869751737=="

MIME-Version: 1.0

From: "Nl2k ."

To: doctor@nl2k.ab.ca

Subject: =?utf-8?q?doctor=40nl2k=2Eab=2Eca=3A_Password_Expiration_Notice?=

X-Priority: 2

X-Spam_score: 12.7

X-Spam_score_int: 127

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Message Center. Password expire doctor@nl2k.ab.ca



Content analysis details: (12.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.4 MISSING_DATE Missing Date: header

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[34.83.204.151 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

[34.83.204.151 listed in dnsbl.ahbl.org]

[34.83.204.151 listed in dnsbl.ahbl.org]

[34.83.204.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.83.204.151 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

[34.83.204.151 listed in will-spam-for-food.eu.org]

0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to

dbl.spamhaus.org was blocked due to usage of an

open resolver. See

https://www.spamhaus.org/returnc/pub/

[URI: obinnaoffordire.wixsite.com]

[URI: beri5271.emlnk.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: obinnaoffordire.wixsite.com/34.144.206.118]

[URI: dns3.p07.nsone.net/198.51.44.71]

[URI: beri5271.emlnk.com/34.237.253.202]

[URI: beri5271.emlnk.com/54.82.80.250]

[URI: ns-1160.awsdns-17.org/205.251.196.136]

[URI: ns-174.awsdns-21.com/205.251.192.174]

[URI: dns4.p07.nsone.net/198.51.45.71]

[URI: dns2.p07.nsone.net/198.51.45.7]

[URI: dns1.p07.nsone.net/198.51.44.7]

[URI: beri5271.emlnk.com/54.225.69.136]

[URI: beri5271.emlnk.com/54.235.205.181]

[URI: ns-1642.awsdns-13.co.uk/205.251.198.106]

[URI: ns-895.awsdns-47.net/205.251.195.127]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Error: open resolver; ]

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.0 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

0.1 TO_IN_SUBJ To address is in Subject

1.0 XPRIO Has X-Priority header

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} =?utf-8?q?doctor=40nl2k=2Eab=2Eca=3A_Password_Expiration_Notice?=



--===============6791593084869751737==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PGh0bWw+PGhlYWQ+CiAgICA8bWV0YSBuYW1lPSJHRU5FUkFUT1IiIGNvbnRlbnQ9Ik1TSFRNTCAx

MS4wMC4xMDU3MC4xMDAxIj4KICAgIDxtZXRhIGh0dHAtZXF1aXY9IlgtVUEtQ29tcGF0aWJsZSIg

Y29udGVudD0iSUU9ZWRnZSI+CiAgICA8L2hlYWQ+CiAgICA8Ym9keT4KICAgIDxkaXYgc3R5bGU9

ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyB3aWR0aDogNjAwcHg7IGNvbG9yOiBy

Z2IoMzQsIDM0LCAzNCk7IHRleHQtdHJhbnNmb3JtOiBub25lOyB0ZXh0LWluZGVudDogMHB4OyBs

ZXR0ZXItc3BhY2luZzogbm9ybWFsOyBmb250LWZhbWlseTogQXJpYWwsIEhlbHZldGljYSwgc2Fu

cy1zZXJpZjsgZm9udC1zaXplOiBzbWFsbDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXdlaWdo

dDogNDAwOyB3b3JkLXNwYWNpbmc6IDBweDsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgYm94LXNpemlu

ZzogYm9yZGVyLWJveDsgb3JwaGFuczogMjsgd2lkb3dzOiAyOyBiYWNrZ3JvdW5kLWNvbG9yOiBy

Z2IoMjU1LCAyNTUsIDI1NSk7IGZvbnQtdmFyaWFudC1saWdhdHVyZXM6IG5vcm1hbDsgZm9udC12

YXJpYW50LWNhcHM6IG5vcm1hbDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0

LWRlY29yYXRpb24tdGhpY2tuZXNzOiBpbml0aWFsOyAKICAgIHRleHQtZGVjb3JhdGlvbi1zdHls

ZTogaW5pdGlhbDsgdGV4dC1kZWNvcmF0aW9uLWNvbG9yOiBpbml0aWFsOyI+CiAgICA8ZGl2IHN0

eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgcGFkZGluZzogNTBweCAzMHB4

IDMwcHg7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7Ij4KICAgIDxkaXYgc3R5bGU9ImJvcmRlci1j

b2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+CiAgICA8

dGFibGUgd2lkdGg9IjEwMCUiIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4

KTsgYm9yZGVyLWNvbGxhcHNlOiBjb2xsYXBzZTsiPgogICAgPHRib2R5IHN0eWxlPSJib3JkZXIt

Y29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPgogICAg

PHRyIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgYm94LXNpemluZzog

Ym9yZGVyLWJveDsiPgogICAgPHRkIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwg

MjM4KTsgbWFyZ2luOiAwcHg7IHRleHQtYWxpZ246IHJpZ2h0OyBmb250LXNpemU6IDIycHg7IGZv

bnQtd2VpZ2h0OiA2MDA7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7Ij5NZXNzYWdlIENlbnRlci48

L3RkPjwvdHI+PC90Ym9keT48L3RhYmxlPjwvZGl2PgogICAgPGRpdiBzdHlsZT0iYm9yZGVyLWNv

bG9yOiByZ2IoMjM4LCAyMzgsIDIzOCk7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7Ij4mbmJzcDs8

L2Rpdj4KICAgIDxkaXYgc3R5bGU9ImJhY2tncm91bmQ6IGJsYWNrOyBib3JkZXItY29sb3I6IHJn

YigyMzgsIDIzOCwgMjM4KTsgcGFkZGluZzogNXB4OyBjb2xvcjogd2hpdGU7IGJveC1zaXppbmc6

IGJvcmRlci1ib3g7Ij5QYXNzd29yZCBleHBpcmUgZG9jdG9yQG5sMmsuYWIuY2E8L2Rpdj4KICAg

IDxkaXYgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBib3gtc2l6aW5n

OiBib3JkZXItYm94OyI+Jm5ic3A7PC9kaXY+CiAgICA8ZGl2IHN0eWxlPSJib3JkZXItY29sb3I6

IHJnYigyMzgsIDIzOCwgMjM4KTsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPgogICAgPHRhYmxl

IHdpZHRoPSIxMDAlIiBzdHlsZT0iYm9yZGVyLWNvbG9yOiByZ2IoMjM4LCAyMzgsIDIzOCk7IGJv

cmRlci1jb2xsYXBzZTogY29sbGFwc2U7Ij4KICAgIDx0Ym9keSBzdHlsZT0iYm9yZGVyLWNvbG9y

OiByZ2IoMjM4LCAyMzgsIDIzOCk7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7Ij4KICAgIDx0ciBz

dHlsZT0iYm9yZGVyLWNvbG9yOiByZ2IoMjM4LCAyMzgsIDIzOCk7IGJveC1zaXppbmc6IGJvcmRl

ci1ib3g7Ij4KICAgIDx0ZCBzdHlsZT0iYm9yZGVyLWNvbG9yOiByZ2IoMjM4LCAyMzgsIDIzOCk7

IG1hcmdpbjogMHB4OyBwYWRkaW5nOiA1cHg7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7IiBjb2xz

cGFuPSIyIj5Zb3VyIFBhc3N3b3JkIGV4cGlyZXMgZG9jdG9yQG5sMmsuYWIuY2EuIFBsZWFzZSBm

b2xsb3cgdGhlIHBvcnRhbCBiZWxvdyB0byBjb250aW51ZSB3aXRoIHlvdXIgY3VycmVudCBwYXNz

d29yZC48L3RkPjwvdHI+CiAgICA8dHIgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4

LCAyMzgpOyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+CiAgICA8dGQgc3R5bGU9ImJvcmRlci1j

b2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBtYXJnaW46IDBweDsgcGFkZGluZzogNXB4OyBib3gt

c2l6aW5nOiBib3JkZXItYm94OyI+UmVjaXBpZW50OjwvdGQ+CiAgICA8dGQgc3R5bGU9ImJvcmRl

ci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBtYXJnaW46IDBweDsgcGFkZGluZzogNXB4OyB0

ZXh0LWFsaWduOiByaWdodDsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPmRvY3RvckBubDJrLmFi

LmNhPC90ZD48L3RyPgogICAgPHRyIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIzOCwg

MjM4KTsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPgogICAgPHRkIHN0eWxlPSJib3JkZXItY29s

b3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgbWFyZ2luOiAwcHg7IHBhZGRpbmc6IDVweDsgYm94LXNp

emluZzogYm9yZGVyLWJveDsiPkRhdGU6PC90ZD4KICAgIDx0ZCBzdHlsZT0iYm9yZGVyLWNvbG9y

OiByZ2IoMjM4LCAyMzgsIDIzOCk7IG1hcmdpbjogMHB4OyBwYWRkaW5nOiA1cHg7IHRleHQtYWxp

Z246IHJpZ2h0OyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+MDE6MTk6MDIgQU08L3RkPjwvdHI+

CiAgICA8dHIgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBib3gtc2l6

aW5nOiBib3JkZXItYm94OyI+CiAgICA8dGQgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwg

MjM4LCAyMzgpOyBtYXJnaW46IDBweDsgcGFkZGluZzogNXB4OyBib3gtc2l6aW5nOiBib3JkZXIt

Ym94OyI+VGltZTo8L3RkPgogICAgPHRkIHN0eWxlPSJib3JkZXItY29sb3I6IHJnYigyMzgsIDIz

OCwgMjM4KTsgbWFyZ2luOiAwcHg7IHBhZGRpbmc6IDVweDsgdGV4dC1hbGlnbjogcmlnaHQ7IGJv

eC1zaXppbmc6IGJvcmRlci1ib3g7Ij4/PC90ZD48L3RyPjwvdGJvZHk+PC90YWJsZT48L2Rpdj4K

ICAgIDxkaXYgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBib3gtc2l6

aW5nOiBib3JkZXItYm94OyI+Jm5ic3A7PC9kaXY+CiAgICA8ZGl2IHN0eWxlPSJib3JkZXItY29s

b3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPgogICAgPHRh

YmxlIHdpZHRoPSIxMjAiIHN0eWxlPSJiYWNrZ3JvdW5kOiByZ2IoMCwgMTAzLCAxODQpOyBib3Jk

ZXItY29sb3I6IHJnYigyMzgsIDIzOCwgMjM4KTsgY29sb3I6IHdoaXRlOyBib3JkZXItY29sbGFw

c2U6IGNvbGxhcHNlOyI+CiAgICA8dGJvZHkgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwg

MjM4LCAyMzgpOyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+CiAgICA8dHIgc3R5bGU9ImJvcmRl

ci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBib3gtc2l6aW5nOiBib3JkZXItYm94OyI+CiAg

ICA8dGQgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4LCAyMzgpOyBtYXJnaW46IDBw

eDsgYm94LXNpemluZzogYm9yZGVyLWJveDsiPgogICAgPGEgc3R5bGU9ImJvcmRlci1jb2xvcjog

cmdiKDIzOCwgMjM4LCAyMzgpOyBjb2xvcjogd2hpdGU7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7

IGJhY2tncm91bmQtY29sb3I6IHRyYW5zcGFyZW50OyB0ZXh0LWRlY29yYXRpb24tbGluZTogbm9u

ZTsiIGhyZWY9Imh0dHBzOi8vb2Jpbm5hb2Zmb3JkaXJlLndpeHNpdGUuY29tL3NvLzYxUEJIUHZW

RS9jP3c9d3YyRENGNkk0b1V0QXdobzljMTdXeTB4OUF1TmJaalMwTGhTREI2YkthVS5leUoxSWpv

aWFIUjBjSE02THk5dFlXeHNaV0ZpYkdVdGNtVnRhVzVwYzJObGJuUXRZbTlpWTJGMExtZHNhWFJq

YUM1dFpTOGlMQ0p5SWpvaVpqUXlNR1E0TWpjdE1qZGtZUzAwTUdaakxXSXpaVEl0TXpoaE16SXhN

VFEwTVdKbUlpd2liU0k2SW0xaGFXd2lMQ0pqSWpvaU5HVXlaalV6TmpJdFlqYzFNaTAwT0dObExX

RTBNakF0WWpBd09XVTVaamxpTXpkakluMCM/ZW1haWw9Wkc5amRHOXlRRzVzTW1zdVlXSXVZMkU9

IiB0YXJnZXQ9Il9ibGFuayIgCiAgICByZWw9Im5vcmVmZXJyZXIiIGRhdGEtc2FmZXJlZGlyZWN0

dXJsPSJodHRwczovL3d3dy5nb29nbGUuY29tL3VybD9xPWh0dHBzOi8vYmVyaTUyNzEuZW1sbmsu

Y29tL2x0LnBocD94JTNEM1R4dG1yVUZVcVBVVDU1cUExY3dqUGFrX1pOLnl2a1dyLVppWDZMSVNw

ZWVGWmFoX3hBd1VlbXZQYVdaaU5BfmxmWXZiSFhIJTIzJTI1N0JlbWFpbCUyNTdEJmFtcDtzb3Vy

Y2U9Z21haWwmYW1wO3VzdD0xNzMwMzIwNTg3NjY0MDAwJmFtcDt1c2c9QU92VmF3MGF1enpHcTY3

MzNSUHg5Z1ZXMHNLZCI+Q29udGludWU8L2E+PC90ZD48L3RyPjwvdGJvZHk+PC90YWJsZT48L2Rp

dj48L2Rpdj48L2Rpdj4KICAgIDxkaXYgc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwgMjM4

LCAyMzgpOyBjb2xvcjogcmdiKDM0LCAzNCwgMzQpOyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsgdGV4

dC1pbmRlbnQ6IDBweDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgZm9udC1mYW1pbHk6IEFyaWFs

LCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogc21hbGw7IGZvbnQtc3R5bGU6IG5v

cm1hbDsgZm9udC13ZWlnaHQ6IDQwMDsgd29yZC1zcGFjaW5nOiAwcHg7IHdoaXRlLXNwYWNlOiBu

b3JtYWw7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7IG9ycGhhbnM6IDI7IHdpZG93czogMjsgYmFj

a2dyb3VuZC1jb2xvcjogcmdiKDI1NSwgMjU1LCAyNTUpOyBmb250LXZhcmlhbnQtbGlnYXR1cmVz

OiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7IC13ZWJraXQtdGV4dC1zdHJva2Ut

d2lkdGg6IDBweDsgdGV4dC1kZWNvcmF0aW9uLXRoaWNrbmVzczogaW5pdGlhbDsgCiAgICB0ZXh0

LWRlY29yYXRpb24tc3R5bGU6IGluaXRpYWw7IHRleHQtZGVjb3JhdGlvbi1jb2xvcjogaW5pdGlh

bDsiPiZuYnNwOzwvZGl2PgogICAgPHNwYW4gc3R5bGU9ImJvcmRlci1jb2xvcjogcmdiKDIzOCwg

MjM4LCAyMzgpOyBjb2xvcjogcmdiKDM0LCAzNCwgMzQpOyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsg

dGV4dC1pbmRlbnQ6IDBweDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgZm9udC1mYW1pbHk6IEFy

aWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogc21hbGw7IGZvbnQtc3R5bGU6

IG5vcm1hbDsgZm9udC13ZWlnaHQ6IGJvbGRlcjsgd29yZC1zcGFjaW5nOiAwcHg7IHdoaXRlLXNw

YWNlOiBub3JtYWw7IGJveC1zaXppbmc6IGJvcmRlci1ib3g7IG9ycGhhbnM6IDI7IHdpZG93czog

MjsgYmFja2dyb3VuZC1jb2xvcjogcmdiKDI1NSwgMjU1LCAyNTUpOyBmb250LXZhcmlhbnQtbGln

YXR1cmVzOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7IC13ZWJraXQtdGV4dC1z

dHJva2Utd2lkdGg6IDBweDsgdGV4dC1kZWNvcmF0aW9uLXRoaWNrbmVzczogaW5pdGlhbDsgCiAg

ICB0ZXh0LWRlY29yYXRpb24tc3R5bGU6IGluaXRpYWw7IHRleHQtZGVjb3JhdGlvbi1jb2xvcjog

aW5pdGlhbDsiPk5vdGU6PC9zcGFuPgogICAgPHNwYW4gc3R5bGU9ImNvbG9yOiByZ2IoMzQsIDM0

LCAzNCk7IHRleHQtdHJhbnNmb3JtOiBub25lOyB0ZXh0LWluZGVudDogMHB4OyBsZXR0ZXItc3Bh

Y2luZzogbm9ybWFsOyBmb250LWZhbWlseTogQXJpYWwsIEhlbHZldGljYSwgc2Fucy1zZXJpZjsg

Zm9udC1zaXplOiBzbWFsbDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXdlaWdodDogNDAwOyB3

b3JkLXNwYWNpbmc6IDBweDsgZmxvYXQ6IG5vbmU7IGRpc3BsYXk6IGlubGluZSAhaW1wb3J0YW50

OyB3aGl0ZS1zcGFjZTogbm9ybWFsOyBvcnBoYW5zOiAyOyB3aWRvd3M6IDI7IGJhY2tncm91bmQt

Y29sb3I6IHJnYigyNTUsIDI1NSwgMjU1KTsgZm9udC12YXJpYW50LWxpZ2F0dXJlczogbm9ybWFs

OyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAw

cHg7IHRleHQtZGVjb3JhdGlvbi10aGlja25lc3M6IGluaXRpYWw7IHRleHQtZGVjb3JhdGlvbi1z

dHlsZTogCiAgICBpbml0aWFsOyB0ZXh0LWRlY29yYXRpb24tY29sb3I6IGluaXRpYWw7Ij48c3Bh

bj4mbmJzcDs8L3NwYW4+Jm5ic3A7VGhlIGNvbnRlbnQgb2YgdGhpcyBlbWFpbCBpcyBjb25maWRl

bnRpYWwgYW5kIGludGVuZGVkIGZvciB0aGUgcmVjaXBpZW50IHNwZWNpZmllZCBpbiBtZXNzYWdl

IG9ubHkuIEl0IGlzIHN0cmljdGx5IGZvcmJpZGRlbiB0byBzaGFyZSBhbnkgcGFydCBvZiB0aGlz

IG1lc3NhZ2Ugd2l0aCBhbnkgdGhpcmQgcGFydHksIHdpdGhvdXQgYSB3cml0dGVuIGNvbnNlbnQg

b2YgdGhlIHNlbmRlci4gSWYgeW91IHJlY2VpdmVkIHRoaXMgbWVzc2FnZSBieSBtaXN0YWtlLCBw

bGVhc2UgcmVwbHkgdG8gdGhpcyBtZXNzYWdlIGFuZCBmb2xsb3cgd2l0aCBpdHMgZGVsZXRpb24s

IHNvIHRoYXQgd2UgY2FuIGVuc3VyZSBzdWNoIGEgbWlzdGFrZSBkb2VzIG5vdCBvY2N1ciBpbiB0

aGUgZnV0dXJlLjwvc3Bhbj48L2JvZHk+PC9odG1sPg==



--===============6791593084869751737==--