Intelcom phish from hostafrica.com

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 09:18:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHQ9a-00000000KVi-1cth

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 09:17:06 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 09:17:06 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [102.218.215.216] (port=55860 helo=positiveesolutions.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHPVV-000000009Ag-2iVt

for games@nl2k.ab.ca;

Sat, 30 Nov 2024 08:35:46 -0700

Received: by positiveesolutions.com (Postfix, from userid 33)

id BD3B2FDE53; Sat, 30 Nov 2024 17:14:38 +0200 (SAST)

To: games@nl2k.ab.ca

Subject: DragonFly - Please review your missed shipment!

Date: Sat, 30 Nov 2024 17:10:01 +0200

From: Intelcom Express

Reply-To: noreply@dragonflyshipping.ca

Message-ID: <742345008dfe2f378d27ef02db8ede9c@dragonflyshipping.ca>

List-Unsubscribe: mailto:bounce930-D52MRtsutv0iIVW@dragonflyshipping.ca?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1dab32d60da24c6a0c0c9c8682fcadcb0"

Content-Transfer-Encoding: 8bit

X-Spam_score: 18.9

X-Spam_score_int: 189

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Apologies, but we need to inform you that our delivery attempts

was unsuccessful as we couldn't reach you. Your package is awaiting delivery,

and for a nominal fee of CAD 2.11, you can reschedule it t [...]



Content analysis details: (18.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

[102.218.215.216 listed in dnsbl.ahbl.org]

[102.218.215.216 listed in dnsbl.ahbl.org]

[102.218.215.216 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[102.218.215.216 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[102.218.215.216 listed in zen.spamhaus.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ltc8h.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[102.218.215.216 listed in wl.mailspike.net]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

Subject: {SPAM?} DragonFly - Please review your missed shipment!



This is a multi-part message in MIME format.



--1dab32d60da24c6a0c0c9c8682fcadcb0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



















Â



Apologies, but we need to inform you that our delivery attempts was unsuccessful as we couldn't reach you. Your package is awaiting delivery, and for a nominal fee of CAD 2.11, you can reschedule it to a time that suits you best.



To proceed with rescheduling your delivery, kindly click on the button provided below:



Reschedule Delivery



Thank you for choosing Intelcom.



Â









This email was sent from an automated system. Please do not reply.



© 2024 Intelcom. All rights reserved.









--1dab32d60da24c6a0c0c9c8682fcadcb0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit



















Â





Apologies, but we need to inform you that our delivery attempts was unsuccessful as we couldn't reach you. Your package is awaiting delivery, and for a nominal fee of CAD 2.11, you can reschedule it to a time that suits you best.





To proceed with rescheduling your delivery, kindly click on the button provided below:





Reschedule Delivery





Thank you for choosing Intelcom.





Â





















--1dab32d60da24c6a0c0c9c8682fcadcb0--



nk.ca credential phishing from google.com

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 07:45:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHOhd-0000000078F-3aDb

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 07:44:09 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 07:44:09 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 219.177.199.35.bc.googleusercontent.com ([35.199.177.219]:33344 helo=[10.88.0.5])

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tHKTG-00000000Mdt-46ON

for root@nk.ca;

Sat, 30 Nov 2024 03:13:10 -0700

Content-Type: multipart/related; boundary="===============9147796936855588233=="

MIME-Version: 1.0

From: "Nagindas Khandwala College ."

To: root@nk.ca

Subject: =?utf-8?q?MailBox_Requesting_Authentication!_For_root=40nk=2Eca_=3A?=

X-Priority: 2

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Root , You have an important mailbox update, please

click below to mailbox update complete. Update Mailbox You have 24 hours to

complete the update to avoid being logged out of your mailbox. Dis [...]



Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.199.177.219 listed in sbl-xbl.spamhaus.org]

[35.199.177.219 listed in sbl-xbl.spamhaus.org]

0.7 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL

[35.199.177.219 listed in zen.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.199.177.219 listed in zen.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

[35.199.177.219 listed in dnsbl.ahbl.org]

[35.199.177.219 listed in dnsbl.ahbl.org]

[35.199.177.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: ipfs.io/209.94.90.1]

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

3.2 URI_IPFSIO References Interplanetary File System PtP content via

ipfs.io, likely phishing

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.1 TO_IN_SUBJ To address is in Subject

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.2 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

1.0 XPRIO Has X-Priority header

0.0 URI_IPFS References Interplanetary File System PtP content, probable

phishing

Subject: {SPAM?} =?utf-8?q?MailBox_Requesting_Authentication!_For_root=40nk=2Eca_=3A?=



--===============9147796936855588233==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PEhUTUw+PEhFQUQ+DQo8TUVUQSBuYW1lPUdFTkVSQVRPUiBjb250ZW50PSJNU0hUTUwgMTEuMDAu

OTYwMC4xOTU5NyI+PC9IRUFEPg0KPEJPRFk+DQo8VEFCTEUgc3R5bGU9IkZPTlQtU0laRTogMTRw

eDsgRk9OVC1GQU1JTFk6IGFyaWFsOyBCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlOyBDT0xPUjog

cmdiKDQ0LDU0LDU4KSIgY2VsbFNwYWNpbmc9MCBjZWxsUGFkZGluZz0wIHdpZHRoPSIxMDAlIiBh

bGlnbj1jZW50ZXIgYmdDb2xvcj0jZjVmN2Y4IGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gt

U0laSU5HOiBib3JkZXItYm94Ij4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+

DQo8VEQgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giIGhlaWdodD0zMCB2QWxpZ249dG9w

IGFsaWduPWNlbnRlcj4mbmJzcDs8L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJv

cmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiB2QWxpZ249dG9w

IHdpZHRoPTYwMCBhbGlnbj1jZW50ZXI+DQo8VEFCTEUgc3R5bGU9Ik1BWC1XSURUSDogNjAwcHg7

IEJPUkRFUi1UT1A6IHJnYigyNDAsMjQxLDI0NikgMXB4IHNvbGlkOyBCT1JERVItUklHSFQ6IHJn

YigyNDAsMjQxLDI0NikgMXB4IHNvbGlkOyBCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlOyBCT1JE

RVItQk9UVE9NOiByZ2IoMjQwLDI0MSwyNDYpIDFweCBzb2xpZDsgQk9SREVSLUxFRlQ6IHJnYigy

NDAsMjQxLDI0NikgMXB4IHNvbGlkIiBjZWxsU3BhY2luZz0wIGNlbGxQYWRkaW5nPTAgYWxpZ249

Y2VudGVyIGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4N

CjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJPWC1TSVpJ

Tkc6IGJvcmRlci1ib3g7IE1BWC1XSURUSDogNjAwcHgiIGJnQ29sb3I9I2ZmZmZmZiB2QWxpZ249

dG9wIHdpZHRoPTYwMCBhbGlnbj1jZW50ZXI+DQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xMQVBT

RTogY29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCB3aWR0aD0iMTAwJSIgYWxp

Z249Y2VudGVyIGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94

Ij4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJPWC1T

SVpJTkc6IGJvcmRlci1ib3giIHZBbGlnbj10b3AgYWxpZ249Y2VudGVyPg0KPFRBQkxFIHN0eWxl

PSJCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlIiBjZWxsU3BhY2luZz0wIGNlbGxQYWRkaW5nPTAg

d2lkdGg9IjkyJSIgYWxpZ249Y2VudGVyIGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gtU0la

SU5HOiBib3JkZXItYm94Ij4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8

VEQgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giIHZBbGlnbj10b3AgYWxpZ249Y2VudGVy

Pg0KPFRBQkxFIHN0eWxlPSJCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlIiBjZWxsU3BhY2luZz0w

IGNlbGxQYWRkaW5nPTAgd2lkdGg9IjEwMCUiIGFsaWduPWNlbnRlcj4NCjxUQk9EWSBzdHlsZT0i

Qk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1i

b3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWlnaHQ9MzA+Jm5ic3A7

PC9URD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHls

ZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCIgaGVpZ2h0PTMyPiZuYnNwOzwvVEQ+PC9UUj4NCjxU

UiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJPWC1TSVpJTkc6

IGJvcmRlci1ib3giIHZBbGlnbj10b3A+DQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xMQVBTRTog

Y29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCB3aWR0aD0iOTAlIj4NCjxUQk9E

WSBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6

IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94OyBGT05ULVNJ

WkU6IDEycHg7IEZPTlQtRkFNSUxZOiBSb2JvdG8sIEFyaWFsOyBDT0xPUjogcmdiKDUxLDUxLDUx

KTsgTElORS1IRUlHSFQ6IDE4cHgiIHZBbGlnbj10b3A+PFNQQU4gc3R5bGU9IkJPWC1TSVpJTkc6

IGJvcmRlci1ib3g7IEZPTlQtV0VJR0hUOiBib2xkZXIiPkRlYXIgUm9vdCAsPC9TUEFOPjwvVEQ+

PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9URD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBi

b3JkZXItYm94Ij4NCjxURCBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCIgdkFsaWduPXRv

cD4NCjxUQUJMRSBzdHlsZT0iQk9SREVSLUNPTExBUFNFOiBjb2xsYXBzZSIgY2VsbFNwYWNpbmc9

MCBjZWxsUGFkZGluZz0wIHdpZHRoPSIxMDAlIiBib3JkZXI9MD4NCjxUQk9EWSBzdHlsZT0iQk9Y

LVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3gi

Pg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWlnaHQ9MjU+Jm5ic3A7PC9U

RD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHlsZT0i

Qk9YLVNJWklORzogYm9yZGVyLWJveDsgRk9OVC1TSVpFOiAxM3B4OyBGT05ULUZBTUlMWTogUm9i

b3RvLCBBcmlhbDsgQ09MT1I6IHJnYigxMDIsMTAyLDEwMik7IExJTkUtSEVJR0hUOiAxOXB4Ij5Z

b3UgaGF2ZSBhbiBpbXBvcnRhbnQgbWFpbGJveCB1cGRhdGUsIHBsZWFzZSBjbGljayBiZWxvdyB0

byBtYWlsYm94IHVwZGF0ZSBjb21wbGV0ZS48L1REPjwvVFI+PC9UQk9EWT48L1RBQkxFPjwvVEQ+

PC9UUj4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJP

WC1TSVpJTkc6IGJvcmRlci1ib3giIGhlaWdodD0yMCB2QWxpZ249dG9wIGFsaWduPWxlZnQ+Jm5i

c3A7PC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1T

SVpJTkc6IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiB2

QWxpZ249dG9wIGFsaWduPWNlbnRlcj4mbmJzcDsgDQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xM

QVBTRTogY29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCBhbGlnbj1jZW50ZXIg

Ym9yZGVyPTA+DQo8VEJPRFkgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPg0KPFRSIHN0

eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHlsZT0iQk9YLVNJWklORzogYm9y

ZGVyLWJveCIgYmdDb2xvcj0jZjM1NjVkIGhlaWdodD00MCB3aWR0aD0yODggYWxpZ249Y2VudGVy

PjxBIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94OyBGT05ULUZBTUlMWTogUm9ib3RvLCBB

cmlhbDsgVEVYVC1UUkFOU0ZPUk06IHVwcGVyY2FzZTsgQ09MT1I6IHJnYigyNTUsMjU1LDI1NSk7

IERJU1BMQVk6IGJsb2NrOyBMSU5FLUhFSUdIVDogNDBweDsgQkFDS0dST1VORC1DT0xPUjogdHJh

bnNwYXJlbnQ7IHRleHQtZGVjb3JhdGlvbi1saW5lOiBub25lIiBocmVmPSJodHRwczovL2lwZnMu

aW8vaXBmcy9iYWZ5YmVpZWFveWF4YnFscno3ZWY2aTM3ZGhyZW13NzVtMnN0Z2Z6anVhYmNrcHNh

aDJlNm5xenp3bT9maWxlbmFtZT1zcGxlcC5odG1sI3Jvb3RAbmsuY2EiIHJlbD1ub3JlZmVycmVy

IHRhcmdldD1fYmxhbms+VXBkYXRlIE1haWxib3g8L0E+PC9URD48L1RSPjwvVEJPRFk+PC9UQUJM

RT48L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPg0KPFREIHN0

eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWlnaHQ9MjAgdkFsaWduPXRvcCBhbGlnbj1s

ZWZ0PiZuYnNwOzwvVEQ+PC9UUj4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+

DQo8VEQgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giIHZBbGlnbj10b3A+DQo8VEFCTEUg

c3R5bGU9IkJPUkRFUi1DT0xMQVBTRTogY29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRp

bmc9MCB3aWR0aD0iMTAwJSIgYm9yZGVyPTA+DQo8VEJPRFkgc3R5bGU9IkJPWC1TSVpJTkc6IGJv

cmRlci1ib3giPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHls

ZT0iQk9YLVNJWklORzogYm9yZGVyLWJveDsgRk9OVC1TSVpFOiAxM3B4OyBGT05ULUZBTUlMWTog

Um9ib3RvLCBBcmlhbDsgQ09MT1I6IHJnYigxMDIsMTAyLDEwMik7IExJTkUtSEVJR0hUOiAxOXB4

Ij5Zb3UgaGF2ZSAyNCBob3VycyB0byBjb21wbGV0ZSB0aGUgdXBkYXRlIHRvIGF2b2lkIGJlaW5n

IGxvZ2dlZCBvdXQgb2YgeW91ciBtYWlsYm94LjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9U

RD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHlsZT0i

Qk9YLVNJWklORzogYm9yZGVyLWJveDsgQk9SREVSLUJPVFRPTTogcmdiKDIzOCwyMzgsMjM4KSAx

cHggc29saWQiIGhlaWdodD0yNT4mbmJzcDs8L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJ

Tkc6IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWln

aHQ9MjM+Jm5ic3A7PC9URD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94

Ij4NCjxURCBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCIgdkFsaWduPXRvcD5EaXNjbGFp

bWVyIA0KPFAgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3g7IE1BUkdJTi1UT1A6IDBweCI+

Jm5ic3A7PC9QPg0KPFAgc3R5bGU9J0JPWC1TSVpJTkc6IGJvcmRlci1ib3g7IEZPTlQtU0laRTog

OHB0OyBGT05ULUZBTUlMWTogIkNlbnR1cnkgR290aGljIiwgInRpbWVzIHJvbWFuIiwgc2VyaWY7

IENPTE9SOiByZ2IoOTIsODgsODgpOyBNQVJHSU4tVE9QOiAwcHg7IExJTkUtSEVJR0hUOiAxMHB0

JyBhbGlnbj1jZW50ZXI+VGhpcyBlbWFpbCZuYnNwO2lzIGludGVuZGVkIHNvbGVseSBmb3ImbmJz

cDtyb290QG5rLmNhPFNQQU4gc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPiZuYnNwOzwv

U1BBTj48U1BBTiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+Jm5ic3A7PC9TUEFOPg0K

Jm5ic3A7b25seS4gSXQgY29udGFpbnMgY29uZmlkZW50aWFsIGFuZC9vciBwcml2aWxlZ2VkIGlu

Zm9ybWF0aW9uLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50IG9yIGhhdmUg

cmVjZWl2ZWQgdGhpcyBlbWFpbCBpbiBlcnJvciwgeW91IG11c3Qgbm90IGNvcHksIGRpc3RyaWJ1

dGUsIGRpc2Nsb3NlIG9yIHRha2UgYW55IGFjdGlvbiBpbiByZWxpYW5jZSBvbiBhbnkgcGFydCBv

ZiBpdC4gSW4gc3VjaCBhIGNhc2UsIHlvdSBzaG91bGQgaW5mb3JtIHVzIGltbWVkaWF0ZWx5IGFu

ZCBkZWxldGUgdGhpcyBlbWFpbC48L1A+DQo8UCBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJv

eDsgRk9OVC1GQU1JTFk6IFRhaG9tYSwgVmVyZGFuYSwgU2Vnb2UsIHNhbnMtc2VyaWY7IENPTE9S

OiByZ2IoNTcsNjEsNzEpOyBURVhULUFMSUdOOiBjZW50ZXI7IE1BUkdJTjogMHB4OyBMSU5FLUhF

SUdIVDogMS4yIj4mbmJzcDs8L1A+DQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xMQVBTRTogY29s

bGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCB3aWR0aD0iOTAlIj4NCjxUQk9EWSBz

dHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJv

cmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94OyBGT05ULVNJWkU6

IDEycHg7IEZPTlQtRkFNSUxZOiBSb2JvdG8sIEFyaWFsOyBGT05ULVdFSUdIVDogNjAwOyBDT0xP

UjogcmdiKDUxLDUxLDUxKTsgTElORS1IRUlHSFQ6IDE4cHgiIHZBbGlnbj10b3A+bmsuY2EgJm5i

c3A7QWRtaW5pc3RyYXRvciBTZXJ2aWNlcy4gQWxsIFJpZ2h0cyBSZXNlcnZlZDwvVEQ+PC9UUj48

L1RCT0RZPjwvVEFCTEU+PC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48L1REPjwvVFI+DQo8VFIg

c3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBi

b3JkZXItYm94IiBoZWlnaHQ9MzI+Jm5ic3A7PC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48L1RE

PjwvVFI+PC9UQk9EWT48L1RBQkxFPjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9CT0RZPjwv

SFRNTD4=



--===============9147796936855588233==--

AliExpress phish from Microsoft

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 18:15:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHC4W-00000000P0f-0pHY

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 18:14:56 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 18:14:56 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vi1eur03on2133.outbound.protection.outlook.com ([40.107.103.133]:29024 helo=EUR03-VI1-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHA44-00000000Ab1-1Z5O

for root@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 16:06:26 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=f3tbDlz2JO0MFMGDN4dgy+xF6yTwd2AIdv6u15OK3UeXKLpK5NlKVcXbPVMfe0YIquFBr1absCk1xFUKax8fswmXTAOsqFa7XOTUJDu8Pj9AAX5kKqeQWAX6dTDXLTHBS98L13fx5Nhj0MH1q90MZ8RcysycQmU97aFGjHmzkSoIUDeSuvRb///IZtPlmRqESPd2QVJ+HbcHYRaPdKDfOBcj5j/ZTF3lPeJuYZgdqyO6r3Ttdn2PpMZ2+zYEtfoc9Ky+8e2hJ15eD6c5ZsUb6qx3mX6h5zQ792RKZqoKKn8j6g2UsyQAbOrwhLoNBXq+BLmQGUG9+a8xZ1Xqj1vNHQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=+azpsvXIkauUHTC169M87G2qL/zrElN3GLrDYAQ1sSw=;

b=MrPoLIsPZQYpVGzSJvzON1h76j6+JMKIKMMXxBUU89YGqceTZ/FOlfhJ2Y4zsh2RyNzaTiUF/m6En7gNgBLb/1g8fbvHwPm0NBj+ICqayF84ietByIgjlylVbBd1Z3FQtOOza4184mJT9GCkN8w06g5IR2bqkFMeMqA5/RqEjtrz85f8lYafltmUDCXKoqCqWCqrvcFDsil5Fn5VZhMSa08Zjc0SxY9vW+1d9iFwxaTAYmL7u9KqbNSpTFYM6suQH7Bo32QuLeRmQLho+eVk3GcXkFX9oVrPhTu/6jN62WIDAXp11FD7bHcltX6oTk298t5oslZkO533YLEMuSDVKA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=giovanaalme.info; dmarc=pass action=none

header.from=giovanaalme.info; dkim=pass header.d=giovanaalme.info; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=GiovanaAlme.info;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=+azpsvXIkauUHTC169M87G2qL/zrElN3GLrDYAQ1sSw=;

b=UaEHe0o8PIdBByHAHoNCqqIkuZvX5W0unDYiKE/P7ZuFrkelV7k0vGC1FEY6c/1tiHce6jA/6PmKCDXPd1oAckKZSLFV1U3DIUsdvD/FyZP+tYkvS4F+9b1SZVKfQTHwc4V8Eth+2XxVVlWs20WWrbX2VHGxNrsL++w1IPFHRiLAcEIwjLmVQrGzGoxpIZf0fhX2lmpeYD0+3odufDTMJRWo5hrEJtn00Xwyka65hnHYcO7YzLiYoPkhOaQHdf5awj2cmwD33fl8y/3DlgqN5eY/Imn9hkcAVeIhPPp43nT35TMIIWOxmVMynuj+o6mhTRDh8GNR2peOlhQHXw+rYA==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=GiovanaAlme.info;

Received: from AM0P189MB0770.EURP189.PROD.OUTLOOK.COM (2603:10a6:208:19d::23)

by AM0P189MB0788.EURP189.PROD.OUTLOOK.COM (2603:10a6:208:191::13) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8207.15; Fri, 29 Nov

2024 23:04:17 +0000

Received: from AM0P189MB0770.EURP189.PROD.OUTLOOK.COM

([fe80::d144:16fd:8c72:758b]) by AM0P189MB0770.EURP189.PROD.OUTLOOK.COM

([fe80::d144:16fd:8c72:758b%6]) with mapi id 15.20.8207.014; Fri, 29 Nov 2024

23:04:17 +0000

Content-Type: text/html

To:

Subject: 🌟 Black Friday Starts NOW!

From: "AliExpress"

Date: Fri, 29 Nov 2024 23:04:16 +0000

X-ClientProxiedBy: MW4P220CA0026.NAMP220.PROD.OUTLOOK.COM

(2603:10b6:303:115::31) To AM0P189MB0770.EURP189.PROD.OUTLOOK.COM

(2603:10a6:208:19d::23)

Message-ID:



Importance: high

X-Priority: 1

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: AM0P189MB0770:EE_|AM0P189MB0788:EE_

X-MS-Office365-Filtering-Correlation-Id: 5d4af6ef-1db3-4471-f0ce-08dd10ca26bd

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|41320700013|69100299015|376014|1800799024|1032899013|4076899003|8096899003|2066899003|37730700002;

X-Microsoft-Antispam-Message-Info:

=?us-ascii?Q?p2lsl0mPRqdlWlMfMG2k5gp58H3lNbkZM1rVFT+Ps6KzrpvXi36ZHVUbQ9cz?=

=?us-ascii?Q?9VY0lOwfk2mLG+Jg4L//QQvp3Sb3G9KU11krc4li76LxN2t17EYyiapnhi8u?=

=?us-ascii?Q?LEgTVthpmTp35B6G0qG3RMaCuVA2z11OyyaiFpEy74cvWgk6B4dSCEIXmZ3D?=

=?us-ascii?Q?Ww+Zf2p+ZD39nlfZTdGMFddJPsFPRQiQZ49cEzClJVsGVG7HHikoDJLvSrmv?=

=?us-ascii?Q?+2z8ziCenTcSzHaEzEwcTlDh5E5+62kBSewptNy5+yS35kn8kwNNVOuJokxo?=

=?us-ascii?Q?TCwbgpDpLGofJl7rizWfT1XWrAXrT6V6/UgEE7SIN17XSPwI9xXK5ZiOqoLe?=

=?us-ascii?Q?Thp5PjlsbRbxBJInbkaBCTYnltcSY5mfP89Up7dY1lrVqoTiVx9leBnEZVSO?=

=?us-ascii?Q?4WReKS/9VkEJEaZTJEa/OFdH7PC/0RIuF6glbQUraP7U/pTgW5VLzXh+3T6I?=

=?us-ascii?Q?qPRKH0iM/3plQAwAqjceU44Ct+6APQkZMiDDxxaOO5n5GI5ToxJ1RHQCfWEG?=

=?us-ascii?Q?sxG42MDWTFTu86OqHKvCHFaV5YK3rAI/EvmIOakyBmLzjVuYkNhK4WwBJgLx?=

=?us-ascii?Q?DNgQC64dqyAFInsBvHsJDlC6l80BHNWgsHRB0EMN95IDx2udHgR1Cpbi9Z1N?=

=?us-ascii?Q?fth0zI5jN4pcNcLFlgSl8QBTZBIl0TC/rJQomc7gU1vrtnHZyZjvIb+L8PWX?=

=?us-ascii?Q?Toch2Yw2WL4PmwtHJtkDubKbdrPWlLtYJ6r8EqMTpauq/z9x8odbQSesLw0k?=

=?us-ascii?Q?qxqPf/OyVviJTqakD6UNkY8DyL4qIivHPiMq0rLQvyZZwITEPvlgAG2BQyon?=

=?us-ascii?Q?+JkVW/oda8MWRv4oAFk7MCuTGChKIs2d2Xk7BqBWK18KyaH+2X/MadmN9uLs?=

=?us-ascii?Q?P0tuh+IP95YCUTkYGwM6ASXFu32/QI0H0jxS+wRq8LIiCY6Q8BoRr1JTh3pB?=

=?us-ascii?Q?uKn2BrTvm0OQuF01bsE9sFFLX7eqsPN7l4JrMMFA1Z8UoPy6QMcaNeRlonj0?=

=?us-ascii?Q?nD+6KuxHYQCB3Iie0NFKc761bORGhDe8W6k/5UIVNPMzGgrIwPgLwX1tBUes?=

=?us-ascii?Q?fCQp6od7Is3XvxSrbGf2TWhIxC1iAg=3D=3D?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM0P189MB0770.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(41320700013)(69100299015)(376014)(1800799024)(1032899013)(4076899003)(8096899003)(2066899003)(37730700002);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?us-ascii?Q?VA5XqvKzVVjjX5fKQh6IZSTwgJsMcvugKbeLKaeIMEecd4p1+0RdDFVFEj8C?=

=?us-ascii?Q?zDDFQtGHhhVtIY3PYzFbwKGJfG5i8WKHnPOEy89fhXTyLNXBBpOjYvHVnDCx?=

=?us-ascii?Q?nYsxMfZFxdn1IChN/Xmz1N4HimkRWw45lxf52JbBxxOFcsE1oOzYWGhCou6A?=

=?us-ascii?Q?ZFinhYyPTcQ7i2VbZ7r9fAgsk4P/w8Qj7uAUC1paWTsOQ+S+YaNKJx+VnBzd?=

=?us-ascii?Q?I7fkhXKtvjiSOlv7RrzXeoXZLG1DRyb7u/BnvGdCyQNWKjsYN1dOJZ9hxs1Q?=

=?us-ascii?Q?mREsO6aOTd9wNniSV9oJrjkappYsf2ONbH6kYUvN37bUfLXPf4tJyBA+mgic?=

=?us-ascii?Q?Uo+44eXkwxFGw1+DY8OcjOAwf1DaxzW7TCpUx2CbAKQOeRzDHfHZr0kykVE3?=

=?us-ascii?Q?qT6T4TsSY46CVwjP/cofTWbsDRDdWkhR1pzZv+TXgJp3ETXjwAeQw/3LsE+q?=

=?us-ascii?Q?Xl9jY1he/6mB1Oxk/jUj4sJRpJyfNrQSBaS3MN9s8IxD2DkrX2Kl6A/UpZjB?=

=?us-ascii?Q?UgwA18HHjVRTLfcVTTT90/mANoY455E1P4PCAfMpNZk+Nbhy/g/cA4+F+spb?=

=?us-ascii?Q?993yoh39ysDwIB4GuIfYIP0oepbJC1Jrde5/1ZhrjC5Y8T+SN8blTRPsk0DN?=

=?us-ascii?Q?B2QEJ/RcCialKjz7NlPSlvl49XbZ0RUIzvmrPZhyY8A86kR/c/6ZGzcS7/xn?=

=?us-ascii?Q?doKkN2BlqirzJtLud/iVcU3rhFZ1rwU5Tjjv8Oqebu97vGi98DxeMGNKX2dt?=

=?us-ascii?Q?OH+t7AGEpXk6o63/Lk9UODz0GZ3zeHRSvAs62g4cQRqGmN6oYZMg2o5atgVA?=

=?us-ascii?Q?/EBOrBb/cfRE+jPzaccss6fT3VKmQkcakOglB+Wa1mWQ+9ogapp2D27emjnI?=

=?us-ascii?Q?d13q5+Tzr/1joYr14VR+WRPG4rAc5uvh2pZ/iBzw/mXWJ3s6q7ATFiMsGw0H?=

=?us-ascii?Q?UZsCk04IDA7uIQUl18MccukX+P5JWG5IobiYUL76joXz+2FvTp20Tz04pNam?=

=?us-ascii?Q?+g8ZEdvVtjXXHrArP8+A/cqz+7ho905aBQoYmwaUdOE/i8UaLMbia5pdJk2u?=

=?us-ascii?Q?Ba6kftlgbh+NNopxy8SoCCYiDiRLk/CmF7ZdBW2iFMMhVFbcnipyoY8D5aev?=

=?us-ascii?Q?T+xB76VNZXvuP6vDDAE/nlUiMCAaQlqbVPDZ4k8MH+nRpf1hH7HtXqVSDhu8?=

=?us-ascii?Q?3SgAJo3P/4mb8DSzD4s/oYpupoEd5GpMNJOs1r0kgeGuxN9ofV6Xe6GcnLZa?=

=?us-ascii?Q?5/bE/5GgKWyCcnZFaeJhE7oBPqapO+mvNHom0GNgSWgzwfLrZdk9mTg4HXEk?=

=?us-ascii?Q?YX5nl/M2JrOcD9H3QNXcgpEmus5k3g0BP/L/PZCyLIA8V3/t5y/bF6evulq+?=

=?us-ascii?Q?b9eyJ/n8OzdFXYyeFWYOpVQ70OJTTSP64wlRv/A4DpX6GfSFM/SRQvAiVvdU?=

=?us-ascii?Q?IiEOeM85LuxpGRakh7Nm89S8ZW1nrW7gLYSCE9qeOVDJ3bVjVZpxW9/S4aWF?=

=?us-ascii?Q?4JXMbV2IPy0ylytxhujU9NXUkPyaRe3clcyOWa5oS0Wp9/7MAdA8JFpNTX1k?=

=?us-ascii?Q?hgh904OX0SO5jQF7swYiu2cHzBYfFbLkqYSfuTBuVHNqXAwnIQ6AxzjdvEF+?=

=?us-ascii?Q?LmWFfP30VqnPt8n3VC2E2rw=3D?=

X-OriginatorOrg: GiovanaAlme.info

X-MS-Exchange-CrossTenant-Network-Message-Id: 5d4af6ef-1db3-4471-f0ce-08dd10ca26bd

X-MS-Exchange-CrossTenant-AuthSource: AM0P189MB0770.EURP189.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Nov 2024 23:04:17.6506

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: e5327ab5-1590-4b56-a638-22076be599a2

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: d3+s+O4645EVxjGAOe6oJl7VuVFTxpN7k+1qbVdLslpbOnTLUSSrFaOEuhTzW/NjlgQ7b2rS+orev8TkIE6rkgdU1909nISH6NadYnCb9eUlqN/IkeKiGCLJBWor7Mxp

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0P189MB0788

X-Spam_score: 18.2

X-Spam_score_int: 182

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (18.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

[40.107.103.133 listed in dnsbl.ahbl.org]

[40.107.103.133 listed in dnsbl.ahbl.org]

[40.107.103.133 listed in dnsbl.ahbl.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[dnsbl.ahbl.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[dnsbl.ahbl.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[dnsbl.ahbl.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: giovanaalme.info]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.103.133 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.3 MIME_8BIT_HEADER Message header contains 8-bit character

1.0 FORGED_SPF_HELO No description available.

1.1 IMG_ONLY_FM_DOM_INFO HTML image-only message from .info domain

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 🌟 Black Friday Starts NOW!













image





image






Alibaba phish from Microsoft Outlook

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 18:15:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHC4P-00000000Oz3-0mEf

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 18:14:49 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 18:14:49 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vi1eur05on2117.outbound.protection.outlook.com ([40.107.21.117]:36416 helo=EUR05-VI1-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH9kn-000000009fK-33Ul

for root@nk.ca;

Fri, 29 Nov 2024 15:46:30 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=T+0BMWhhpDeOjliLth7y6fUoZmxVETa6lUIGRGKIcjT2BwulsD/JsVjrrvySyFtLLTUuq+6h7ZsxuCMx6hMfYRHFNZT7m1MKV20tB77+5d72/MsoizJNE7ZzAERn6q/4dcht3tFV0YxQi/VFovhtv5B5MdDiFlexQz/yXtqVOKD6Q+JGoHUaanNTa7UIg6d1ROX3oYCIEPHPpgaJkcjbzTbh9rzWMzsNKAzZZDANHiPwMRv7MTPGDafqf4RRHEePUcne6CcAFiXWzApmUufvNWqJ77L7Z91FJym+Y7ClP5qL8DEhfQEjP/RofrFCjK9lNrf5u211x+IOLRHiU8ujew==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=+azpsvXIkauUHTC169M87G2qL/zrElN3GLrDYAQ1sSw=;

b=fp1Kjx53ybajiJA52ujDwgM6VFBwMZftef/0QM522+hk92IaflHQZM9sjRR3mAI0YPa9VbCNXYSLiQl/5MNg6JB1gTVU2KYkaa4RRKpU62cxc+jTZ2BWQ/5YTRcKfVP2kT6MdXuC6voKibPTsyn9blQHKcu0N17yxOpj9hopqDfxhdc0qt5UyICfc38u7yJjfYRsdOuGfXw1XX2TzmTelxLtuIBDO6O/S3AOcbRTCMWEKshEJFmckhDY1eEriPMahppipqJ7MKHb4KUxjEwWQdOb1gbDN5wCHMn7MDcDp8/jEd1xwM2+x6eQKbvTifSB26LdUIVKzv9a4g+rEDrsYQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=giovanaalme.info; dmarc=pass action=none

header.from=giovanaalme.info; dkim=pass header.d=giovanaalme.info; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=GiovanaAlme.info;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=+azpsvXIkauUHTC169M87G2qL/zrElN3GLrDYAQ1sSw=;

b=NT7u9ictZf/siv/UnOREGPWCAHuStvARMAGBAzMo7jAku99BFXCSKewThK91NDInWBoM9Eq1bw4kQMZvsT1/Z/O5VzpulpmNmlB+GzldC2MGYCVPl+YLoovAc1rTc8cX9CAiJxX7EWNixweBskFrShTwRUFBJVKehqAIL1whzLFNv3Byf8nwWX2nge7tctgtsdBDOmrZVx4sshUCzo43qt6ZOrTufiHQpmYh6Ui3tm9v3LxT1gQ/v7c6PWJ1DBwNNFEDVaI0hS4kDvf0kQqgCDmbBZ+8o9R/kquNqbNhj2XBtEP5Ui2MMYP0iGpLcQvSgxFDKs4QP6c1pAvu3YYUiQ==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=GiovanaAlme.info;

Received: from HE1P189MB0443.EURP189.PROD.OUTLOOK.COM (2603:10a6:7:58::15) by

GV1P189MB2292.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:97::5) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.8207.13; Fri, 29 Nov 2024 22:44:20 +0000

Received: from HE1P189MB0443.EURP189.PROD.OUTLOOK.COM

([fe80::43c2:3ef1:14cd:ffd2]) by HE1P189MB0443.EURP189.PROD.OUTLOOK.COM

([fe80::43c2:3ef1:14cd:ffd2%6]) with mapi id 15.20.8207.010; Fri, 29 Nov 2024

22:44:20 +0000

Content-Type: text/html

To:

Subject: 🌟 Black Friday Starts NOW!

From: "AliExpress"

Date: Fri, 29 Nov 2024 22:44:19 +0000

X-ClientProxiedBy: SGBP274CA0023.SGPP274.PROD.OUTLOOK.COM (2603:1096:4:b0::35)

To HE1P189MB0443.EURP189.PROD.OUTLOOK.COM (2603:10a6:7:58::15)

Message-ID:



Importance: high

X-Priority: 1

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: HE1P189MB0443:EE_|GV1P189MB2292:EE_

X-MS-Office365-Filtering-Correlation-Id: 039cc91a-3d94-4667-fa5a-08dd10c75d29

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|1032899013|1800799024|41320700013|69100299015|376014|4076899003|2066899003|8096899003|37730700002;

X-Microsoft-Antispam-Message-Info:

=?us-ascii?Q?RgaPRJUrasqx/sbWO7XP0t/Lfk2iieZBtWy0MP4ZAGJ+zVEWXbfAZNaAcCdu?=

=?us-ascii?Q?bkYGLV08rnUbOPenpZ4YiWmVlBUH6OYhLWzENbCSRUiLH0RDYJ7iv6PV0tlt?=

=?us-ascii?Q?XzvFeW5h+Bdgv80V2cicNnHxcaHWW89vGhTMFbK1PDRkuGz4b5AbU9ZpVAsR?=

=?us-ascii?Q?Qt3aESTbk3ycQwq4ktVHQFCP93kgSN5aBAbC+Y3vvGq8QYvNEx8Yh9XU2MUa?=

=?us-ascii?Q?Xj+hGR5ejAeiSEH2ZepnuWynyoRtLCxaxcgMC5k1y4J7f1uX+FjoXqHnPdrX?=

=?us-ascii?Q?3lVhGEuwjZe9rdQfPuKA9f3qjXtdY1QWpODayRSzH8Ehnyye2CCoaz3S15ZA?=

=?us-ascii?Q?GREInkJe3J7Ko+LmeRQ751FxMLK3cquj03F/yXb4JYO3aPchbpcvsX2k6fKB?=

=?us-ascii?Q?xbE4QyDtUZLkNmsZOCK5ilo2fhEdQgS5iAPQAQGjqUBO+rQtvRVnh6ELB9PV?=

=?us-ascii?Q?feFxUV/OmnXRdI9VIOUE6wfhyhNPYkSB0uJJYqrQFwNTqQcJ6blVqL36GX6g?=

=?us-ascii?Q?oW3d9XeLc7Ub0Xsz2BsPTACWJ2iS4HGyxX3T55lGoTSagGkKDFkSV7K9SgNn?=

=?us-ascii?Q?ll6U3DYwZGTGpkZcPzlfvB4sgT2p7FiS2w37AS+e/89CZMB+Z7D66cesjjzj?=

=?us-ascii?Q?vNeS/p0pKI0YKCrMUNyA6D0a55lT4y3pi5Ofvg+rll4V2oDHKEikRB4tv5XF?=

=?us-ascii?Q?guX6UJszBhzPN5rpzj457F4ttx6SBoO7USTivwSD0pWL8C92eo/UUgBzwmtJ?=

=?us-ascii?Q?rv8SxwMOVYlMLCM0E4tMM8mKiXQSC7+K0FhU49Q+T6uhk8Fo0k2ocD6I9BKd?=

=?us-ascii?Q?r3wuZDUD5ePQqHuXv0BO1R2CQRq/cvvDwxkiHunkbpoA++fUTTogzNngE5WK?=

=?us-ascii?Q?zSm8vSpyFzbERvbiru4fkt1IdoczxNjN4p6N4JnuZOcm+8a5texaL5CpbW9R?=

=?us-ascii?Q?k4Khv19A+SAPNa1ul1cUmq/PEa/CRrM1cqrV6H+AZQmTd9MlYA0/DV8sJn8/?=

=?us-ascii?Q?PaabQf52dULz0SeIa5W255jRBy4fRmeXvf036thRsB76QveOvhIaKJCQHZzq?=

=?us-ascii?Q?S/rc/UxUGGFjsKPFiMwp2J71Vsasxg=3D=3D?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:HE1P189MB0443.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1032899013)(1800799024)(41320700013)(69100299015)(376014)(4076899003)(2066899003)(8096899003)(37730700002);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?us-ascii?Q?a2MrLjWdytujXkPXxCEtsI/fslgmVP3+Hc4pi+bBStLfLuG+5hWvZ8gxRTPO?=

=?us-ascii?Q?Qzl44TmKuw0boRwqTMSqJ2J0lxRtrXwvhpldeSz9nCqCZvF+n3wxAzvZ19XG?=

=?us-ascii?Q?6+Sx8M722q1tt4NYqrWbhyg/eTnMOlUahd3IY4YbHaC2Ps53cd5SFOQDxcyO?=

=?us-ascii?Q?NVO2gW+1AMkUVWW8hf0kzSJl8KvWzEhU1dSy7FFJX8SgF8B/vXXRzvORY0LR?=

=?us-ascii?Q?rZ2BkPKSKg4NkGzr0qO0nFqPcD/pvr8phmuv7KKAAy3BO4SdJh43ZTSBKsGm?=

=?us-ascii?Q?UqymChCjyvJWRssNU1AQW3xEyJDANyAdzPAdc8TnXmtMvaW1MA/RfFlnp1q7?=

=?us-ascii?Q?0nn4WecwIt/LmQBK6nlVIUtKBVAqQweeuJWUWFnVpw8VpZjHf99Y9sxZ6Ird?=

=?us-ascii?Q?E8gsthWxZ0V42lvUfaAtDKQtxX7amTb3MqFa9fVG5H3dh3aHqPG4ljOdPUk9?=

=?us-ascii?Q?HWNhDrp8uAWYf30Q3hLvfHH1c4GHvnqGFFeDne6xPr6EX4pcwiJWRS3/wZM/?=

=?us-ascii?Q?ifWPLdKb/meHu/hg9/apMdI0xu3nUp9jkTgfwhLeRY8OW34+HpHN2X38qg0U?=

=?us-ascii?Q?4Q1lLqwS6Ufz18VQdUaEsEPHQIEInJxfrmPxMQcx8mNFDKa5MZlBVqmVuouD?=

=?us-ascii?Q?qdq0VqRWUePq0Iz5HNeHGG/AisBg2JVS8eglWYIczvb6IacMR+tBAlPnfJfY?=

=?us-ascii?Q?52MqyOGtZHULGu0mOM8Mmwr5NNnkfLHW5Zb23npFWY8DnBseVyPQ1IeRzdHN?=

=?us-ascii?Q?DUUvqz9Jz46ryGfI8Ss33jT97HhiUAvEbpQyPwx/jjSDfbZKel1Z3IGCUDNS?=

=?us-ascii?Q?v48OkOlXuhGgaK5gjDAf1gIG6kZOCl5TRWl+7KprSvuXaAp5YLOWVdaP7thm?=

=?us-ascii?Q?J2zvftJ7GNFQCtUEg7TJwynlbmW3Ttl3l8cHcfPntL8i8VDychvUh8BPkXIM?=

=?us-ascii?Q?F/8aZddVKokg7tvAApyu7xY8P3/ElliThUX+0FeENTgtXxNFvkP1emMJlQ6C?=

=?us-ascii?Q?gr1hxy2TZMD/DtJDHVnEeuxgSuoTM6gd7KwGIvk+1JCY9TKtPWcS6sgZ+3eh?=

=?us-ascii?Q?VQNDofsET0AQ72f3F3oZSjJooamp2XDIaT88m4tGmAaL06b5r6qhpZcvZWH1?=

=?us-ascii?Q?J7zY4Vk+VdOg7ThGu+6uLlWc3wgL4xttmHumvl7SOAA1ojrFtU0X9QGtJxec?=

=?us-ascii?Q?riM6damgWw8HES7mwahSoMOxJifk9kv5KDkpW5cifKQkQ3DBVviaJIWKyRnL?=

=?us-ascii?Q?4ByB9qGi8UDc4PYKMhy6gdFper68NeQWlmf0+rNuGPik3jI0G0Ma/gc3QTUG?=

=?us-ascii?Q?otbMxUegtbtQhQhWszl8KSxZZKrGDr+ilwBql2Eu0/gEHITPolj6zEgyC3Sx?=

=?us-ascii?Q?EHNN91lyUSqVsIyectlG90M8nkYa/+seNNDEQOH9ockpdmVHSzfLOzid+mYk?=

=?us-ascii?Q?V7ZNeNRR5IU5F+FKnJU/+H5IUW9YvvFZkJFmbTGp9DLP6DZXj6G9wVvPD815?=

=?us-ascii?Q?tlxsD2DCHL/kTali5SwT6F1ytqgDLJeQOJ4SeVvyykZ0S+wPnsMRYF1lfa0F?=

=?us-ascii?Q?wboqAhex3ct4yFjI+S5aGMUCeQsZT0YAopPcfxrSu+ctxpgtIZ63UuRUD3Q1?=

=?us-ascii?Q?5jJL7oPKay66PQAiJJgwel4=3D?=

X-OriginatorOrg: GiovanaAlme.info

X-MS-Exchange-CrossTenant-Network-Message-Id: 039cc91a-3d94-4667-fa5a-08dd10c75d29

X-MS-Exchange-CrossTenant-AuthSource: HE1P189MB0443.EURP189.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Nov 2024 22:44:20.4907

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: e5327ab5-1590-4b56-a638-22076be599a2

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: DdroZ0dxfo3mlsrTEhkv1rfpZDpx0MI4GLzR6McEkoHCCuN7MFC+iLlrJS0pHST1qlZ8fBeKeZ6xgFjz7qW7NlHmedLvXh09vL0UPMLWBa/6gf9XuAgkSqkCzjuKlkpv

X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1P189MB2292

X-Spam_score: 18.2

X-Spam_score_int: 182

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (18.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

[40.107.21.117 listed in dnsbl.ahbl.org]

[40.107.21.117 listed in dnsbl.ahbl.org]

[40.107.21.117 listed in dnsbl.ahbl.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: giovanaalme.info]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.21.117 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags

0.3 MIME_8BIT_HEADER Message header contains 8-bit character

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 FORGED_SPF_HELO No description available.

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

1.1 IMG_ONLY_FM_DOM_INFO HTML image-only message from .info domain

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 🌟 Black Friday Starts NOW!













image





image






Costco Phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 18:15:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHC4D-00000000OwO-4BTv

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 18:14:37 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 18:14:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 82.83.155.104.bc.googleusercontent.com ([104.155.83.82]:50488 helo=sncf-connect.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHAOY-00000000MZy-3DWk

for root@mail.nl2k.ab.ca;

Fri, 29 Nov 2024 16:27:35 -0700

Received: by sncf-connect.com (Postfix, from userid 1000)

id A3CCA485775; Fri, 29 Nov 2024 22:12:40 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sncf-connect.com; s=20230601; t=1726561367; x=1727166167; dara=sncf-connect.com;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=Nll/WDt2gQK3B1pLcBWnOeDo4ix8zlwU6y4wcQbET3e8Ud4yKxxayR97VfQaD/yEUB

/3lzrmI9aVrjMBKp4UBbzQEFy1CJ9o5KInk0Ue6G3N45uCA3KibMcA+hx3xlrX+tiQ7d

l5cSlBY1buJ29w5kVEMdgyVnBY3wARaW9fTRpkr29z3//BpwF1Ky4QG4nx42bq+y7GI/

fjLekQhu1kX0dCBNKI5S3BR9X+KLbFHRgJDrW5MAxF2G695yFOfybboVnR7bbN1LHnNC

VvJ4XTu8y6sgmXes+FmgCvhR0+deazi4IyT4hcGkUr3tgAZa7ZBs7/amS6XWB4t3ECbo

ThZA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1726561367; x=1727166167;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=hKeB+IPnwQCcgtmF/hdw8S8R1s6Ma7WWp9Kzfw6x8bdfXSg3eKLVGu1tp8GHKbCiF8

KD3+7DgE3aTLFVqHFJWorhQAU1kw6iaNZOqIq8LVHess6499p84z9qr9GgSNmmDdSmfT

Of+JW8FjnLMsA4uJ+e1HMQwkEtvU6aN6UCegBZI6UDXC7bCG4E66F7ygIkEN9Sb+jU7g

QMbQYlq1vGWQqXN0LcHOeootC1R4sKfMC9H635FcQcjFV/rhkLs/kH4S1dTfhQs+DKo7

BwBla4YFwO7tuS7S9sYYpPyK1ZdI+vQ4Y52FOUKnMZN+AL3BhWPAb5aPNkElNYJ6G7CI

mTAg==

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@sncf-connect.com header.s=20230601 header.b="Nll/WDt2";

spf=pass (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=sncf-connect.com;

dara=pass header.i=@sncf-connect.com

To: root@mail.nl2k.ab.ca

From: "Support"

Subject: 500$ Costco voucher back in stock, with ZERO cost

List-Unsubscribe-Post: List-Unsubscribe=One-Click

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

Message-Id: <20241129231257.A3CCA485775@sncf-connect.com>

Date: Fri, 29 Nov 2024 22:12:40 +0000 (UTC)

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Don't miss out on this incredible opportunity to stock

your pantry.



Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[104.155.83.82 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[104.155.83.82 listed in zen.spamhaus.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: upsearching.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: upsearching.com]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: upsearching.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: upsearching.com]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 500$ Costco voucher back in stock, with ZERO cost











 
















































































     
  Hello





Don't miss out on this incredible opportunity to stock your pantry.





Enter the contest today and you will be in draw to win $500 to spend at Costco, absolutely free!
 






























 

















  Click Here  


 
  This contest is not sponsored or organized by mentioned brand  










Costco Phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 14:06:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH8Af-0000000064D-2Txs

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 14:05:01 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 14:05:01 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 82.83.155.104.bc.googleusercontent.com ([104.155.83.82]:40000 helo=sncf-connect.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH86h-000000005sQ-3Tny

for root@nl2k.ab.ca;

Fri, 29 Nov 2024 14:01:00 -0700

Received: by sncf-connect.com (Postfix, from userid 1000)

id BF2B422ADEC; Fri, 29 Nov 2024 20:34:42 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sncf-connect.com; s=20230601; t=1726561367; x=1727166167; dara=sncf-connect.com;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=Nll/WDt2gQK3B1pLcBWnOeDo4ix8zlwU6y4wcQbET3e8Ud4yKxxayR97VfQaD/yEUB

/3lzrmI9aVrjMBKp4UBbzQEFy1CJ9o5KInk0Ue6G3N45uCA3KibMcA+hx3xlrX+tiQ7d

l5cSlBY1buJ29w5kVEMdgyVnBY3wARaW9fTRpkr29z3//BpwF1Ky4QG4nx42bq+y7GI/

fjLekQhu1kX0dCBNKI5S3BR9X+KLbFHRgJDrW5MAxF2G695yFOfybboVnR7bbN1LHnNC

VvJ4XTu8y6sgmXes+FmgCvhR0+deazi4IyT4hcGkUr3tgAZa7ZBs7/amS6XWB4t3ECbo

ThZA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1726561367; x=1727166167;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=hKeB+IPnwQCcgtmF/hdw8S8R1s6Ma7WWp9Kzfw6x8bdfXSg3eKLVGu1tp8GHKbCiF8

KD3+7DgE3aTLFVqHFJWorhQAU1kw6iaNZOqIq8LVHess6499p84z9qr9GgSNmmDdSmfT

Of+JW8FjnLMsA4uJ+e1HMQwkEtvU6aN6UCegBZI6UDXC7bCG4E66F7ygIkEN9Sb+jU7g

QMbQYlq1vGWQqXN0LcHOeootC1R4sKfMC9H635FcQcjFV/rhkLs/kH4S1dTfhQs+DKo7

BwBla4YFwO7tuS7S9sYYpPyK1ZdI+vQ4Y52FOUKnMZN+AL3BhWPAb5aPNkElNYJ6G7CI

mTAg==

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@sncf-connect.com header.s=20230601 header.b="Nll/WDt2";

spf=pass (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=sncf-connect.com;

dara=pass header.i=@sncf-connect.com

To: root@nl2k.ab.ca

From: "Support"

Subject: 500$ Costco voucher back in stock, with ZERO cost

List-Unsubscribe-Post: List-Unsubscribe=One-Click

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

Message-Id: <20241129204515.BF2B422ADEC@sncf-connect.com>

Date: Fri, 29 Nov 2024 20:34:42 +0000 (UTC)

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Don't miss out on this incredible opportunity to stock

your pantry.



Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[104.155.83.82 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[104.155.83.82 listed in zen.spamhaus.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: upsearching.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: upsearching.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: upsearching.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: upsearching.com]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 500$ Costco voucher back in stock, with ZERO cost











 
















































































     
  Hello





Don't miss out on this incredible opportunity to stock your pantry.





Enter the contest today and you will be in draw to win $500 to spend at Costco, absolutely free!
 






























 

















  Click Here  


 
  This contest is not sponsored or organized by mentioned brand  










Costco Phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 14:05:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH8AY-0000000063R-1m6g

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 14:04:54 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 14:04:54 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 82.83.155.104.bc.googleusercontent.com ([104.155.83.82]:58984 helo=sncf-connect.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH83M-000000005lK-1a8D

for doctor@nl2k.ab.ca;

Fri, 29 Nov 2024 13:57:32 -0700

Received: by sncf-connect.com (Postfix, from userid 1000)

id 02B55216D37; Fri, 29 Nov 2024 20:24:41 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sncf-connect.com; s=20230601; t=1726561367; x=1727166167; dara=sncf-connect.com;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=Nll/WDt2gQK3B1pLcBWnOeDo4ix8zlwU6y4wcQbET3e8Ud4yKxxayR97VfQaD/yEUB

/3lzrmI9aVrjMBKp4UBbzQEFy1CJ9o5KInk0Ue6G3N45uCA3KibMcA+hx3xlrX+tiQ7d

l5cSlBY1buJ29w5kVEMdgyVnBY3wARaW9fTRpkr29z3//BpwF1Ky4QG4nx42bq+y7GI/

fjLekQhu1kX0dCBNKI5S3BR9X+KLbFHRgJDrW5MAxF2G695yFOfybboVnR7bbN1LHnNC

VvJ4XTu8y6sgmXes+FmgCvhR0+deazi4IyT4hcGkUr3tgAZa7ZBs7/amS6XWB4t3ECbo

ThZA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1726561367; x=1727166167;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=hKeB+IPnwQCcgtmF/hdw8S8R1s6Ma7WWp9Kzfw6x8bdfXSg3eKLVGu1tp8GHKbCiF8

KD3+7DgE3aTLFVqHFJWorhQAU1kw6iaNZOqIq8LVHess6499p84z9qr9GgSNmmDdSmfT

Of+JW8FjnLMsA4uJ+e1HMQwkEtvU6aN6UCegBZI6UDXC7bCG4E66F7ygIkEN9Sb+jU7g

QMbQYlq1vGWQqXN0LcHOeootC1R4sKfMC9H635FcQcjFV/rhkLs/kH4S1dTfhQs+DKo7

BwBla4YFwO7tuS7S9sYYpPyK1ZdI+vQ4Y52FOUKnMZN+AL3BhWPAb5aPNkElNYJ6G7CI

mTAg==

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@sncf-connect.com header.s=20230601 header.b="Nll/WDt2";

spf=pass (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=sncf-connect.com;

dara=pass header.i=@sncf-connect.com

To: doctor@nl2k.ab.ca

From: "Support"

Subject: 500$ Costco voucher back in stock, with ZERO cost

List-Unsubscribe-Post: List-Unsubscribe=One-Click

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

Message-Id: <20241129204255.02B55216D37@sncf-connect.com>

Date: Fri, 29 Nov 2024 20:24:41 +0000 (UTC)

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Don't miss out on this incredible opportunity to stock

your pantry.



Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[104.155.83.82 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[104.155.83.82 listed in zen.spamhaus.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: upsearching.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: upsearching.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: upsearching.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: upsearching.com]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 500$ Costco voucher back in stock, with ZERO cost











 
















































































     
  Hello





Don't miss out on this incredible opportunity to stock your pantry.





Enter the contest today and you will be in draw to win $500 to spend at Costco, absolutely free!
 






























 

















  Click Here  


 
  This contest is not sponsored or organized by mentioned brand  










RBC PHish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 28 Nov 2024 13:58:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGlZm-00000000EaW-2d2X

for dave@doctor.nl2k.ab.ca;

Thu, 28 Nov 2024 13:57:26 -0700

Resent-From: The Doctor

Resent-Date: Thu, 28 Nov 2024 13:57:26 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f48.google.com ([209.85.218.48]:53393)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGiiD-00000000Nhv-134D

for root@nl2k.ab.ca;

Thu, 28 Nov 2024 10:54:01 -0700

Received: by mail-ej1-f48.google.com with SMTP id a640c23a62f3a-aa532dcb470so61649866b.2

for ; Thu, 28 Nov 2024 09:52:10 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1732816322; x=1733421122; darn=nl2k.ab.ca;

h=date:to:from:subject:mime-version:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=HEf44/l6PiFzRURH3Fp3+O+bIFugP/f77rgIjBnVuPI=;

b=KpYNHh8sxL9Y4ET1SIDnRZWUMyc+lj8sQf6DDxfcDbRJrdrjb8COYRg7DB3UoHH/Eo

uHsO//3uZNtvFUvq718/7yaCt+X+CSbeK5iKa6/yePgefMF4SGw6HhyNZG4pC6PPMDTN

SU5sbsoW7q74IACYErk3jZSllZUR+9a1cg6+/KiLxSb2nB9ChHx5EIu8luhTRuaD9rMc

J1DVEOPsHx0x7qozN18NIUhaQZu5BhLiGj+s6UMseTy4wXPx3qMksyJFaTGn9LhAl+Og

M9oJgxnV8yorcoPh8DbZ/5zBdCydtknM+4CT+lyXKTL+WY5EM1NqKEmhxJCUVUmeOW5M

braw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732816322; x=1733421122;

h=date:to:from:subject:mime-version:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=HEf44/l6PiFzRURH3Fp3+O+bIFugP/f77rgIjBnVuPI=;

b=FeAd7uOpgZAeyIMQH6C6XYkcbOE+ZJWfcRlCa6MMz/NQLCvJbMMm3xIl+XLf3Zyfid

f08wWSJDnCRYoftjFlUAF4F43sajhP73n3zuOk1/gm5v/Xxa7PLdIT8AeJbMnjpFAbTm

4Y6nQ0yMgTNtlUQ7kZsAq2PNbV26hG42oMbSqWrcpitYKjJClKekR5lsnsWnMkuhloMi

+klaITLzkZBayLAF+ZdUpsOF9WLFPjAtfhA4a46wz3TZ9gU8EzZITA7+LXSgHJEggMHC

Z4LrVtTUkbTkVKYoszBw2zh5OntMKzvhtoIFIYNP5C9rmyuo7BM1n5STl3QQu4SWwbCR

pe3w==

X-Gm-Message-State: AOJu0YwOQP3pGbsBjzz5M5V5lktF91F7IwOQamC/f0PpV99hDnKcapX/

Z0Fk0mX4oWMJ52KiUW/NGknvE6VsV+Zoy0WGgTq+nuWEb0DiIoQCTWZXEw==

X-Gm-Gg: ASbGnctet45gT8oQIK03gxUDFAWV4DLFl17vG13hh9+6Jf/tCCObZuLxYUiekYaGXeI

s1R+JbzJ3v5Kf0l1GWD09I+ybUhvV84inWbv9ZHcIj0eFb0DvXLj1t+TM0zlqc+gxKdwoIWHqm8

BTOjVqdAZVRGr6fKVH8lmXoAAAHvLGN1KF2+qp1Yu6KnLePu5c7S14Vs8e/TTK5GMz8A9X1JxqV

LL8Tcn/O65rrynoAEU1BKYZx3Aurjohqse6T/UoUcSGBVB38is=

X-Google-Smtp-Source: AGHT+IHoIufc/ESdi0KrMs9ZwjYjQm4IQTliI6C+4MB3yoHM4a3eJ0FS1YUboPoxjeOQY2aCLJLekQ==

X-Received: by 2002:a05:6402:402a:b0:5d0:9054:b119 with SMTP id 4fb4d7f45d1cf-5d09054b1d4mr6902738a12.21.1732816322438;

Thu, 28 Nov 2024 09:52:02 -0800 (PST)

Received: from rbc-pc ([2a03:94e3:231b:4b15:876a:f240:e65a:d254])

by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-5d097dd690dsm970935a12.46.2024.11.28.09.52.01

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 28 Nov 2024 09:52:02 -0800 (PST)

Message-ID: <6748adc2.500a0220.e739c.4396@mx.google.com>

Content-Type: multipart/mixed; boundary="===============6015699579118558816=="

MIME-Version: 1.0

Subject: Time to verify your email address

From: RBC Royal Bank

To: root@nl2k.ab.ca

Date: Thu, 28 Nov 2024 09:52:00 -0800

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear RBC Bank Client, The following RBC Bank e-Alert(s) is(are)

available: Confirm your email address to finalize your verification



Content analysis details: (7.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

[209.85.218.48 listed in dnsbl.ahbl.org]

[209.85.218.48 listed in dnsbl.ahbl.org]

[209.85.218.48 listed in dnsbl.ahbl.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in dnsbl.ahbl.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in dnsbl.ahbl.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in dnsbl.ahbl.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.48 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.218.48 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[dahiruyauba5(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[dahiruyauba5(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

Subject: {SPAM?} Time to verify your email address



--===============6015699579118558816==

Content-Type: multipart/related; boundary="===============4290740746946701581=="

MIME-Version: 1.0



--===============4290740746946701581==

Content-Type: multipart/alternative; boundary="===============2630340500869453248=="

MIME-Version: 1.0



--===============2630340500869453248==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBXMyBIVE1MLy9FTiI+PGh0bWw+Cjxo

ZWFkPgo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsg

Y2hhcnNldD1pc28tODg1OS0xIj48L2hlYWQ+Cjxib2R5PgoJCglEZWFyIFJCQyBCYW5rIENsaWVu

dCw8YnI+PGJyPgoKVGhlIGZvbGxvd2luZyBSQkMgQmFuayBlLUFsZXJ0KHMpIGlzKGFyZSkgYXZh

aWxhYmxlOjxicj4KCTxicj4KQ29uZmlybSB5b3VyIGVtYWlsIGFkZHJlc3MgdG8gZmluYWxpemUg

eW91ciB2ZXJpZmljYXRpb248YnI+Cgk8YnI+ClRvIGVuc3VyZSB1bmludGVycnVwdGVkIHNlcnZp

Y2UsIGNvbmZpcm0geW91ciBlbWFpbCBhZGRyZXNzIGZvbGxvd2luZyBvdXIgcmVjZW50IHNlY3Vy

aXR5IHVwZGF0ZS48YnI+Cgk8YnI+ClRvIGZpbmFsaXplIHRoZSB2ZXJpZmljYXRpb24gcHJvY2Vz

cywgbG9nIGluIHRvIFJCQyBPbmxpbmUgQmFua2luZyB0aHJvdWdoIHRoZSBsaW5rIGJlbG93OgoJ

PGJyPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly90YXVucWtwZi5ibG9nc3BvdC5jb20vIj5WYWxpZGF0

ZSBhbmQgY29uZmlybSB5b3VyIGVtYWlsPC9hPjxicj4KCgk8YnI+UGVyc29uYWxpemUgeW91ciBl

bWFpbCBub3RpZmljYXRpb24gb3B0aW9ucyBpbiBSQkMgT25saW5lIEJhbmtpbmcsIHNlbGVjdCAm

cXVvdDtQcm9maWxlIGFuZCBQcmVmZXJlbmNlcyZxdW90OyB3aXRoaW4gdGhlIEJhbmtpbmcgc2Vj

dGlvbiB1bmRlciBNeSBBY2NvdW50cy48YnI+PGJyPgoKCURvIG5vdCBzZW5kIHByaXZhdGUgaW5m

b3JtYXRpb24gdGhyb3VnaCByZWd1bGFyIGVtYWlsLCBhcyBpdCBpcyBub3Qgc2VjdXJlLiBVc2Ug

dGhlIHNlY3VyZSBSQkMgUm95YWwgQmFuayBPbmxpbmUgQmFua2luZyBtZXNzYWdlIGNlbnRlciB0

byBzYWZlbHkgY29tbXVuaWNhdGUgd2l0aCB1cywgb3IgY29udGFjdCB1cyBieSA8YSBocmVmPSIj

Ij5waG9uZTwvYT4uPGJyPjxicj4KCglPdXRzaWRlIENhbmFkYSBhbmQgdGhlIFUuUy46ICBDYWxs

IHVzIHVzaW5nIG91ciA8YSBocmVmPSIjIj5JbnRlcm5hdGlvbmFsIFRvbGwtRnJlZSBTZXJ2aWNl

czwvYT4KCglUaGlzIGlzIGFuIGF1dG9tYXRlZCBtZXNzYWdlIHNlbnQgZnJvbSBhbiB1bm1vbml0

b3JlZCBlbWFpbCBhZGRyZXNzLiBSZXBsaWVzIHdpbGwgbm90IGJlIHJlYWQuPGJyPjxicj4KCgle

UkJDIEJhbmsgaXMgb2ZmZXJlZCBieSBSb3lhbCBCYW5rIG9mIENhbmFkYS4KCgk8L2JvZHk+Cjwv

aHRtbD4=



--===============2630340500869453248==--



--===============4290740746946701581==--



--===============6015699579118558816==--

RBC hish from Cisco

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: DAVE@nk.ca

Delivery-date: Thu, 28 Nov 2024 04:19:00 -0700

Received: from esa.hc490-56.ca.iphmx.com ([216.71.135.41]:58347)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGcXg-000000001RQ-2bKu

for DAVE@nk.ca;

Thu, 28 Nov 2024 04:18:48 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;

d=rbc.com; q=dns/txt; s=RBC; t=1732792720;

x=1764328720;

h=from:to:cc:reply-to:subject:mime-version:date:message-id;

bh=CUBrLh52TEWYQciw1f5VBmzH4G/JSSHwnP9/Fw8Rghg=;

b=4UYi0Qj1j8SMDHCxptkUxtEdYe2fFafrz9lCYTHjFwe1IiGOQYuhE/lR

T800lq6paoQCNbcfZv7DhEgPmM51YpccBCgPwKLBDdBiIV0M8RgMcKHEe

cGWWtLkA4KhcVdHRqqgS4N8KxmRAVxfUbQLTw89hlhOdgmqam2TCPbKpT

eBEkdzlJxHu+X1L4ogXqam0Zrxuepk6ra1RJoO2ibqC6a44pu9tsg7eTO

669AH3KOPJM7O+5kiRA4Hj/1nnw5sgF7REJgtMrbesuMnG8li+m6vnQzC

bRcLhnoJ3+7GPQrhJbA3PD1MlQP3ariG8uHUq0Ir7wSToK8ahT91NWmFy

Q==;

X-CSE-ConnectionGUID: dmwYpuQZSGa9lsy1gFcyQg==

X-CSE-MsgGUID: o/yYNGpETuK7JRzpYTXD3w==

X-IronPort-AV: E=Sophos;i="6.12,192,1728964800";

d="gif'147?scan'147,208,217,147";a="155846202"

Received: from unknown (HELO esagcc03.fg.rbc.com) ([170.175.193.86])

by esa4.hc490-56.ca.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 28 Nov 2024 06:16:43 -0500

X-CSE-ConnectionGUID: HSyaPt9+TreV5BZJ+pSj0A==

X-CSE-MsgGUID: Dw6T+9VVQ7Wkk3sk6Nn+xw==

X-IronPort-AV: E=Sophos;i="6.12,192,1728964800";

d="gif'147?scan'147,208,217,147";a="116583081"

Received: from ulxbi0p55.fg.rbc.com (HELO esagcc03.fg.rbc.com) ([10.172.221.184])

by esagcc03.fg.rbc.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 28 Nov 2024 06:16:17 -0500

X-CSE-ConnectionGUID: K/pFy6uETBarhNtyNePcMA==

X-CSE-MsgGUID: cL3xe4P/TDiLl/BWysGJVQ==

X-TRAFFIC: APPLICATION

X-ExtBanExmp: true

X-JOURNAL:

X-IronPort-AV: E=Sophos;i="6.12,192,1728964800";

d="gif'147?scan'147,208,217,147";a="116580535"

DisclaimerCode: True

X-TEMPLATE: FRENCH

ToScanDLP:

Received: from vbat.fg.rbc.com ([10.83.255.253])

by esagcc03.fg.rbc.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 28 Nov 2024 06:16:01 -0500

Received: from VANCOUVR.fg.rbc.com (VANCOUVR)

by VBAT.fg.rbc.com (VBAT [10.83.255.253])

for with ESMTP (IBM CSSMTP z/OS V02R05.00)

Id PAAPEML4.JOB17748.VBAT.20241128.031601.566943.877.1@fg.rbc.com ;

Thu, 28 Nov 2024 06:16:01 -0500

From: "RBC Royal Bank-Banque Royal-Customer support/Soutien a la clientele"

To:

CC:

Reply-to:

Comment: From VHPF Job:PAAPEML4 JOB17748 11/28/24 03:15:55

Subject: Payment Receipt Advise/Avis de Reception de paiement

Mime-Version: 1.0

Content-type: multipart/mixed;

boundary="RBCSA390.Nextpart.0x0zax1d.yzhvhy.01C0C43z.43wqxyf2_.VHPF_03:15:55.053858"

X-Mailer: Microsoft Outlook Express 6.00.3790.3959

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4325

Date: Thu, 28 Nov 2024 06:16:01 -0500

Message-ID:

X-CFilter-Loop: Reflected

X-Spam_score: 5.1

X-Spam_score_int: 51

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Payment Date/Date du paiement: 2024-11-27 A Direct Deposit

has been made to your account in the amount of/Un Dépôt Direct a été

fait à votre compte au montant de CAD $126.00 Reference/Référence [...]





Content analysis details: (5.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[170.175.193.86 listed in will-spam-for-food.eu.org]

[170.175.193.86 listed in will-spam-for-food.eu.org]

[170.175.193.86 listed in will-spam-for-food.eu.org]

[170.175.193.86 listed in will-spam-for-food.eu.org]

[170.175.193.86 listed in will-spam-for-food.eu.org]

[170.175.193.86 listed in will-spam-for-food.eu.org]

[170.175.193.86 listed in will-spam-for-food.eu.org]

[170.175.193.86 listed in will-spam-for-food.eu.org]

[216.71.135.41 listed in will-spam-for-food.eu.org]

[216.71.135.41 listed in will-spam-for-food.eu.org]

[216.71.135.41 listed in will-spam-for-food.eu.org]

[216.71.135.41 listed in will-spam-for-food.eu.org]

[216.71.135.41 listed in will-spam-for-food.eu.org]

[216.71.135.41 listed in will-spam-for-food.eu.org]

[216.71.135.41 listed in will-spam-for-food.eu.org]

[216.71.135.41 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[216.71.135.41 listed in dnsbl.ahbl.org]

[216.71.135.41 listed in dnsbl.ahbl.org]

[216.71.135.41 listed in dnsbl.ahbl.org]

[216.71.135.41 listed in dnsbl.ahbl.org]

[170.175.193.86 listed in dnsbl.ahbl.org]

[170.175.193.86 listed in dnsbl.ahbl.org]

[170.175.193.86 listed in dnsbl.ahbl.org]

[170.175.193.86 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[216.71.135.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[216.71.135.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[216.71.135.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[216.71.135.41 listed in dnsbl.ahbl.org]

-2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/, medium

trust

[216.71.135.41 listed in list.dnswl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format

1.0 ZMIde_OutlookExpress Outlook Express should not be used anymore

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

-0.1 DKIMWL_WL_HIGH DKIMwl.org - High trust sender

Subject: {SPAM?} Payment Receipt Advise/Avis de Reception de paiement



This is a multi-part message in MIME format.



--RBCSA390.Nextpart.0x0zax1d.yzhvhy.01C0C43z.43wqxyf2_.VHPF_03:15:55.053858

Content-type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable
















border=3D0

alt=3D"RBC">








Payment Date/Date du paiement: 2024-11-27



A Direct Deposit has been made to your account in the amount of/Un Dép=

ôt Direct

a été fait à votre compte au montant de CAD $126.00



Reference/Référence:



Direct Queries to/Queries direct à:

-----------------------------------

Payor/Créateur: DR. LINDA JEAN

Contact/Personne-ressource: Joy York

Email address/Addresse courriel: jyork@vancouverbreastcentre.com

Phone Number/numéro de téléphone: 604-879-4177 Ext:02=

28







This message has been automatically produced by a computerized system and w=

ill

not be monitored for your reply.

Ce message a été produit automatiquement par un système info=

rmatisé et aucune

résponse n'est attendue de votre part.



This e-mail may be privileged and/or confidential, and the sender does not =

waive

any related rights and obligations. Any distribution, use or copying of this

e-mail or the information it contains by other than an intended recipient is

unauthorized. If you received this e-mail in error, please advise the Payor=

(by

return e-mail or otherwise) immediately.



Ce courrier électronique est confidentiel et protégé. L'exp&=

#233;diteur ne renonce

pas aux droits et obligations qui s'y rapportent. Toute diffusion, utilisat=

ion

ou copie de ce message ou des renseignements qu'il contient par une personne

autre que le (les) destinataire(s) désigné(s) est interdite. Si v=

ous

recevez ce courrier électronique par erreur, veuillez à Créa=

teur aviser

immédiatement.



Registered trademarks of Royal Bank of Canada. RBC and Royal Bank are

registered trademarks of Royal Bank of Canada.



________________________________________=

_______________________________


">If you received this email in error, please advise the sender (by return =

email or otherwise) immediately. You have consented to receive the attached=

electronically at the above-noted email address; please retain a copy of t=

his confirmation for future reference.


e: 9pt;">Si vous recevez ce courriel par erreur, veuillez en aviser l'exp=

=E9diteur imm=E9diatement, par retour de courriel ou par un autre moyen. Vo=

us avez accept=E9 de recevoir le(s) document(s) ci-joint(s) par voie =E9lec=

tronique =E0 l'adresse courriel indiqu=E9e ci-dessus; veuillez conserver un=

e copie de cette confirmation pour les fins de reference future.

=





--RBCSA390.Nextpart.0x0zax1d.yzhvhy.01C0C43z.43wqxyf2_.VHPF_03:15:55.053858

Content-Type: image/gif; name="MVS390.gif"

Content-Transfer-Encoding: base64

Content-id:



R0lGODlhfACMAPcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgMDAwP8AAAD/AP//AAAA//8A/wD/

/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMwAAZgAAmQAAzAAA/wAzAAAzMwAzZgAzmQAzzAAz/wBm

AABmMwBmZgBmmQBmzABm/wCZAACZMwCZZgCZmQCZzACZ/wDMAADMMwDMZgDMmQDMzADM/wD/AAD/

MwD/ZgD/mQD/zAD//zMAADMAMzMAZjMAmTMAzDMA/zMzADMzMzMzZjMzmTMzzDMz/zNmADNmMzNm

ZjNmmTNmzDNm/zOZADOZMzOZZjOZmTOZzDOZ/zPMADPMMzPMZjPMmTPMzDPM/zP/ADP/MzP/ZjP/

mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm

zGZm/2aZAGaZM2aZZmaZmWaZzGaZ/2bMAGbMM2bMZmbMmWbMzGbM/2b/AGb/M2b/Zmb/mWb/zGb/

/5kAAJkAM5kAZpkAmZkAzJkA/5kzAJkzM5kzZpkzmZkzzJkz/5lmAJlmM5lmZplmmZlmzJlm/5mZ

AJmZM5mZZpmZmZmZzJmZ/5nMAJnMM5nMZpnMmZnMzJnM/5n/AJn/M5n/Zpn/mZn/zJn//8wAAMwA

M8wAZswAmcwAzMwA/8wzAMwzM8wzZswzmcwzzMwz/8xmAMxmM8xmZsxmmcxmzMxm/8yZAMyZM8yZ

ZsyZmcyZzMyZ/8zMAMzMM8zMZszMmczMzMzM/8z/AMz/M8z/Zsz/mcz/zMz///8AAP8AM/8AZv8A

mf8AzP8A//8zAP8zM/8zZv8zmf8zzP8z//9mAP9mM/9mZv9mmf9mzP9m//+ZAP+ZM/+ZZv+Zmf+Z

zP+Z///MAP/MM//MZv/Mmf/MzP/M////AP//M///Zv//mf//zP///yH5BAEAABAALAAAAAB8AIwA

AAj/AP/BiEGQIIwqBQsOTGiQocOECxlGhPhwosKKGB1abAiDyr+PIEOK/LiNiooYJ1OiXHlyoMqX

LGO4jDlTZc2VN1vG1Akzp8ydP3uiHElU5MGGSH8mjcj04lKnSqM2fUpVKtSpUj0WLboNBsyvO73C

SCGWLNizQNGqTct2rQqv/7ZtJTpwY1SOU/K6mCJlyt4pVI7ehUpRY0aJhwsjhqh1rsiuPGnipPLC

D6p70jLbyyxt2rQpNoH6HC26tNDTkl86pnv1IowpffhF21eP9j5otqP1ewEDq+/WVX8HB5519WOv

bb1OQVUPGr3n9PQ5h15P2pQUbbO71c7dLVy5xj9u/0SocDk/evuiq0+vL3q9fi6oaCSvuD7h+0nt

53fdOHxJ1G/1YY969cwWjT2zTbdPNFK8QAVZDkL4IAwRUjhhhRgiRxqAOJmWWnghCYbVCwO2Rxsq

WUzxgl/RrGfKKX2cImOMNMoI440xzojjKYOc4ocWdREnnFXB9WccZG1pEU17BfaBAnIqvHBKc88V

aGU0V2aJ5ZYLalmgdVB2J+ZZ34Eo0GAGUUHIefpUF19EL0iD3pzp1UnnnXbmiac0fmClH5qAWtSR

mXFpGNYLqLSIXh+9sUTFlOhBU0+kz7VXqYKSUqqppfTwM0WYG6YmamiqEfpbR36wGU2fUcUZjWz8

1P82W214yhrrgre+Sit7qwY53K9EFmcmkmCl4MeSkmYR5ltZ7MjHKc/ysUx00ZgS7Y3PxpgttJPS

I+mn24WrXZkgCkreQVOcd+IL58oU2LsOxjvFKenx05eDHeFLGbxSSMNePX3Sh1+gifFH6H+jTrHM

pAv2wVtkM9WlxbySWgdxWC7wAw2Tn4ZK6qgdnkaoQO0m9UIf/qIXTR+A+SoVKtKo+158w72Wsj69

BjvkzlcZuRqxaVGY6KQFTtMnmQJiWTFo46IgzcbfLjvm1CmRG57LFPWGaMr7SIOKiBJRsVzM0vQj

RWAVnTvFzQD7ObBdcId9sKEvNfrWyacgaM/RIbP/RCFfqLzCtEtQihWlC/ZMxw92Hzfet+ORpTSy

b8sVUldvlP24hctN1RVYo2nmu++KUpgyG7Vo8wzszj47BnRKyxkt9VviVv1WClr0gUofhOjOO8yK

eisN41QXb3tcZgpKBSr88Il1FVi/Df28sVZfWz230toeP6egbdj3i4WfdetzIUx4utFE88Lj7EeO

kxbSTCrdc+kxjGl11wUFsvv860/q5O1yFT/64D2dCUkm5lmPrWxloOYB6YCrg6C75ma7LGCJGflT

y+zC0i+o1UMZ1jIFKKwFLWxdZ4O1o5rVjBOkjqypHqhg10MUkrrDwGAQp9uHKaQgBT74kId5kdcU

/x74p7iBzz6DGpaGxuIKLClrQzBIhR/IAsXYOCcaz5qGNDYzDVQQIoiwmQaQONQ/j7VvcuXxV85+

84J+eI1zrjlFDtHDQFyl71Urk6EBI7g68m2FWDBwwdPqAa62TAFLqGAamToIHXrUwxQhnM78HCkN

LaTwkmFRAfLKlUbasGo/BHlBrMwmn0CtjT3o4QMP+WAKVP5rgAUsYsFA+ZMkgghhb3EabhgFuRcY

yGHtExqWoiOpU0hjmJxi0sqwY8Yyeuh/plKbGmMIOqu4ah+n+FRrtBa/PGlvTu1pEz+wUErV7fGc

tvRP4QQpKQxqUEDQsEchF3nM5thTUumTo4KWaf+8ftJuk1er5XJoY69SKgYGWfBXdc7mtnxZxo3N

a14q8iKFFm2PgLKsykHvk84jLTEFiVrQKdZ3GmF+yQWgOtQUUKBKVUphLymYV/34WbXeUHEsvcFp

b96yU8P574ymomFs0CMNZW2TQvaQlTQYuk3K8GWV0epDRec0znI6dS99wapf+LLVrKpIRRLs6M+W

dcgqZVODWEhcgezBMrK4dSwviOkU/GDMzBxoS4mrUh5jkIIVuYIzgAXsZgLbmd2ZBYUoWeFqLIIo

WsFSMOOLjWOrYyMYSWMZCMqebfCknsc2S7PXs01oRytaabCsLgLjiB+5YpKgwEAKGnsOmKpYT2L/

FqhLuIFOMtcjSUdiEQUoi616KqXb4hL3UpvpAxVNA0DVrkll9mDqUzqytjnqCZXhpOOCNmsiPqTP

Tiai067EC146RaOonyrZBJX4lUPehh7nRakGXSDH5rx3uLbF6zKk8axQpE9+mWrkgqIhx1Mso8AH

JrCCDSxHZF7RHrt7mN80CZ6Adg5ldcJfLPnzAi28ELvricbu/BCv0U2BDwwDZ6ekQYgSu3h0Jh7b

db2mxzRR0H9jCelz4ms3UXVECnK8r6WgwYe95GRFiSJugQYIVjLKZAsrcgEW8pYg+kWjxTtB41Kq

cE3otkxIlNEdmxTIoBq+JmmuPO+XedabP/Tj/xRZ+AvM0lxAsboOhYE8preEJwXEqiSmKBvmntUc

17H0gRl5fQ4+nTQ7w+H0sDHNG4t5A1xTzC+exPtnhVkoEei5a227wh4BIXsV6IktM97kxzKk2k3x

8iOR7DJXvvjShyxIVUVi865Ef9yiOi2jnOu9ZWsJ15Gq9et0z2GrNslIoT4gEzoLOmZ6rGwdReIE

p5Xpw1/1RjavxWhSnqLQsaw80pA19ydxqqTnqotK7qlIvZ1rNtfWo+KuxbDOMqFQszIbatFuV2Vf

Zdtn6rxaorxOSfL0myCVViXTSliDkZafcR25w4cnVgWUgRmViOmtjU9SOtHIC4oVbY8stPZ4m/9e

bC3VJBuCs3s9NDbo2xIKYhMR+ct4kWx5CXq67IaXH62kajZJbefyFS4Fx4wGMxXODGSr7N7MRqiD

lWza5dJuXiXqLXyhxUohZ+rjlMzC0kuVvPJMg3vAThOiek5HttZwujE4GdfGuyBq1oV6CvzXUilD

cwJ900Qw1CNTCj4SQLpgGgTOtN9QMLTpeEvZZknO2h8prebMT8S8ibhz8AmK6dRjEC+4XZId2UOG

TycaT/qKYh3DlLWpWuaDX7srZQXMGRrkNbFaahaYZ96lSoH39combKnFqo4M9URS2L26qMUoxBT9

jyeHgdMOFHmISV/HVEeF1X/6Fj68+qt8kPb/jqsFYMgrqT3SICkCl1EnWJ9Y4vi7mCajaZBTrrFn

Xc5utHFuldd4hjfUJX7l9VhUcHzdAydTUi/3cmJ5coDCcktHV0+JNF/HBHbwxVaFpnopkAqpEH0u

0HT31XGq1Ff01SLRAAooEFfX0UPvRWC8EyOSFE/zdHEAxWkHgSrnwQ98IHNLITZJBWL14nDwVgVU

sDnnknFstw/K4EM5wn6REg3LACt0p13fRBvpJzDPx1ov4V7QsFRSUxOvVSITZ28S5jHX53Rdo0X3

MEy3sWRc8nXQlin31TDqJzlB1RDXtFBvlxV94Er1podwxDmUIYB88CN+YGsJYlqogApd5DX9/8B2

sIJHtGEiDmhj7OU3HfQlFtdekFIPdlBPjteFbeVnibVwzXEKh8VO9dBWL7AiKOAXfOB5UiBVUgUt

0TAd9vBwqzcXygN8gBg+MIBhIfdygMc9wGREnzYgXZNer4EKnnSDvWFqGUMtnwIvVJAFqkIILUR4

j3FyOKEwDKNm3sgTwpSL0odDXlcdhLB9jVOA4AYuOfYqipcSvtQeCbeFpwNDwzYU9FdLMoFhbTdq

/Yd70hAYXKY7frh/+LYU9vc1CMQ80ZB26NZrOYOHQVYdDmKJEKh6lSFo8TSKXyEl00A8mncp8FVU

oYdnIIUlBHQ3TbQMdegonQiPVycFDGMxNP9YDWUnKHFHCHO3D6sWa67hBx1oENNzfK6WTTXmGjGQ

LhhpasxTiQwhJbTnYrDoWGejkerEP83mYNWhfSlVfUFxMonGKV3jMCgkJd/XGyhQYCkYIV+VAqXT

hnywO73jNdIwJRWjXCyhZQMpd3lyXtLlj51zjT+oHiZCYGt2EVLSGQ6iBahAL8pAYHl5XlIYmKBl

J/xgclrpURA3L1RyRQ4nlvQUg3plHSaxLK/VRddRCMCzVnaFIFZyP5JSmxvXJIyzi1vBkxqRQBnW

PA5zLqklE6bmlEAoahvmf6+gL1nQD3yAa1pwiH5gGc6mVIxYNjGjKwTFVFlocOPIfQgUaNP/RlTU

5EwBUpa6JSmJVH0UQg194hJUMA18SWxjwYAEtheviFU+1IY46RLndiqfJn6AJw3kBEeqNVThFV50

2CgdoQqWU0vUwJmEyWVyxGQdcaGUUVFWmJHBtpVjkmdVRkwQdkJqQZWbZ0+2xSfsSTuJVWxp8SjV

wZd1IwXK6DAot5Oz5C6yl3cOt2FGaTNW2C/zVnf44o8/GixxUg/TQDOtkoBXNng31kyJxXhOp0x2

xxYp4Gz7gAovhUPwJ2Ji2UzupZTY9iBcKE/L4pfmlC86pn8HclqltjXTEC9+cDNPB4BhRRmycWsu

0AfZcll1IpXdWXikSCYLt2cc95EkijGs/3k7oHmiYFqoiUUFx1IPp/BXWiSbuLFomaabRcGb4kND

oJaQKxacGkEFfwALgsdy5oVlRVQFhfAKMfMe2HmZdDSnWMiNIYFL7QOeP5Y4ZglzaGl9PPWNfACs

YTd2vkoFLgAzPESLMWI6ijOD/tmPaypUY/ZdMBdD7YJagoiUQKlNAPoar1AI+hIvc4keDgill4hJ

sNOJTKClnod5kopxx+pBvDQuL6CqZAVPlrpsE1aDKoeMRSSMX8U8obZ3R4StdKSwoeqt5aFza5Sr

UfpMwbR2uYgSL3Bs4Zh+Xyga7qgy5RZ1YrEi8ESHbaGmYeUaSFWQnrM1GYaaqzNQRKVNRf8ya7N4

CrmClr6hqyDxOv4UjCPpNynQLPZEYJsYNCpwSESjLLRTFn8TU7s3CDAjm4oGDX1BmjSYcqwXqrRE

dFrwB1gYd5ApM9y6sKGEYfjzVXnRLMakK5pVb50CZ3DjsyTxnVKaEz1mE7CROGcZk1zpKgXCB7qD

CtmwRXhkP/SjdSkqdh9irSsLd53jLmgGJgfUEdioMhFFNpepndqpYibiPA/ooe5KNVRwbGxVr1Jy

G0TmLDuiLTfSYBvXcagwjp7KGgQ7MDNUt7ERDffAfxsVjDFjCrgmOsa7L6Jjsq3WJrjKGBXrZHkL

ssdadb66eMc0PPsTNCXIMIySEyrLR+j/dBXm8WsGmhVRKZFsRiFO+kDsupH+ZDzKoWaF6hXHonRB

u3D2WzcUVnYQMZyk9rVp4xAiGTDAki4um6On6gdvBnsdeiR4a7HmyRaE8wKv8Ac95hP0mDfK+jER

sxNaIJ+KV63JA2+RG76qRQWAUL5NsTXou7JUYK7wZreFokG2c3E2zKLe8bQ6fMNh0QepEC6OZjs+

pb8C27V2EQOAsAV/oMRMvMRO3MQX6mmF8cRU3MRMbIScswU8yBTQUwVboAqqAAuxUA1g/AcW7Gl1

+7wsUQWxgDxy8cZuHMfVAAubEzlVYAhxDMd6jDxkHBiQExSoWg0VNsjIowpVADnf64+q/zAy/1AN

myMVVQAIjGzI46oKXLsV1aAzMgy0L0EFcqGTH0ENDqoKfxDGAlsNhxwWoOzGpDzKizwSqoBYMCDI

IjHHheCgtAzKqkAm+8tJSLTKH1ENN9jFMPDKIWHIRmkQsDASN0icnjwSWwCMXCu23hrJILEF/tvA

P/PALQEDhSASsUA3MkHLIaF637yrKeUzu6w/LgHMjbxTIdMR1SDMG/KfV2HMwTy5WzASFuwa+Cwe

o/sRhgBv/9wVJDwQVbAKKrzJfubNABXLX7EFKYcQdfMHx0HEq7wN61w3OllhdRy0vWxhGFHMtWwu

+ywSgLAU/0wyzisSfwDJeLyraEwcSP/E0P3zFucMEuHcE4aQcnqb0yShmhYdEtWwjylBzqG8Fs2U

yEzxz8LMH8tM1P230lHcEUD9ESnMHylnCCasyTdGJt9cYRB9cSRNEnHxB6o31P9ADXHRyoYwzz/b

yGgNFEayDXNduprGvxzl1FX9B2wtEoYANgax0nNBDWesEWp9zcO5uyO9ydy8EondyHMM14RcDXPd

wTj9R3FNEnYdzzH9s48sf9krwuVCwoN9S39gkNO10lYMCJ99zDNd1iERzdfag18dNGENEtVADWxd

YTrpx8kR2bxKO28d11xdNWqtDWeN11uLo4Yh2/lMBVGNzuoFEVQtnHUx3SAhIpH9D2L/C8ALO6gX

Xb2RvdNU4M7bAAuQ49DorLceMcj9/Bbv/bMbXb1kxNQKwdcy8QdcG9jbRNX998whwdWek3L0XMLt

S7q4/dBQ0tO1vAVkotb+MMNAkQIgMeEa/RKxIBd//Q/A7a63y8x3gYX6fYNci8pwc922DdjCKckl

7bUEI967+thtBs6GAgNEMdbkmNtBTSowcNI/e9f55s7/sM6YPdr8OMLBod9G2d3/QOD+LOJcPMtS

rhCvDRKxrDNe7NXtuuBirZpX/hEfnlgSHhepWVNwbdaB/RUb/hgorsNeUQWLzMsAtce4O9JMrhBV

QOQeLhUrHbZMbAiETckV0cZEMceG/7DEYFxh1f1kIwELqiDo2n23zlTeX7gFGR3MdXPlhAzHai7O

NlHcZm3Wno48jtMY20ANVHDmq+7O360zfE3QhRfOtUTYfxQL8rEzd1zEI+HIsK7THeHg22AIgTHd

21ANa/HFpXzLH/0ViT7KpTzQKiHnt7zsrVztDpra9XpxW1AIsbDIbzzHpPydHB0XyM7GWrzE1YDr

VA4Shx0oxDzT8wGxIoLG9k7v9o62xFnNw9zM/0ucn63FbdwRVUCERY6qRA3hvRq928HwSO5kqtcY

Rf3eVFAF/7A5y9wRm2bX/o7gHg++tY1OCK/bZf3jA43j3o3yE04Sb77tzP3yIO0VgP+wzF8e1mIB

A6sgF5uDybCw6v8+JBkFjG+To8h4g1+8m/wtEGLLxh+x844RC8Q+xPb98FT/x81kN1vQ05dMElqQ

AttQEuetAhK9DSqQ9MYxxz4v710d8mxfajBQyiCiCkX4Dy9g0RYcC0S40iu/1oceC2KLw+8L8zQc

7OB+Sx7+418fF9sAPU5OKGDs88ES9JIvPRf6B4WA1Iz8D1oQGH9gCCk88pm/q+YOCIAAPcWKGkdu

9X1DOLSjxKZc6pkvF36POYYw6aH/R5CuxFW972tfS9CDOR2R9W/N57df/OGRD67jxuu+Cq69BVxQ

8OISA8/v2pEeC21s549R/HsfEh0EHhIBAQA7QEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBA

QEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBA



--RBCSA390.Nextpart.0x0zax1d.yzhvhy.01C0C43z.43wqxyf2_.VHPF_03:15:55.053858--





RBC PHish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 28 Nov 2024 04:32:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGck8-000000001uc-45Xg

for dave@doctor.nl2k.ab.ca;

Thu, 28 Nov 2024 04:31:32 -0700

Resent-From: The Doctor

Resent-Date: Thu, 28 Nov 2024 04:31:32 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f41.google.com ([209.85.167.41]:55688)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGWSD-00000000A2y-2cuv

for root@nk.ca;

Wed, 27 Nov 2024 21:48:44 -0700

Received: by mail-lf1-f41.google.com with SMTP id 2adb3069b0e04-53dde4f0f23so296753e87.3

for ; Wed, 27 Nov 2024 20:46:42 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1732769195; x=1733373995; darn=nk.ca;

h=date:to:from:subject:mime-version:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=SlDe2klwEyzuOgOOXobGGEqVQpKkZ/q9m/krvaGhM2s=;

b=NzBYnzvLaMPGkOYp6OMgklMZImfyW8HcZGypXG1Z3nDM40AaxSqTymW0sd6JSGSuOG

82ozD7nZcmpoisxvPowWmaBr5jiv7NUhb6wdnAeibf+Jy0PSlOvku1BcHoy6OSCb/CJj

dxiTbdE5UfMg2qlVE62ZvB2h3o5O0e+2sAUXSXRne8URCCnub50d44XZ8BVhmVQ7lPYA

rXRWWszYu+s0lvphwq0n1OjH9in6leH6pGDTjG8F3vJcxbDXAL8PaLNzo7DfKaaatSlW

NrRkwX5iPlA1PBlkrD9fXv/B8UeBjYPdg57vfggTGW0GpaktshWMm8jX3XhgKTz/mIB+

aSMw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732769195; x=1733373995;

h=date:to:from:subject:mime-version:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=SlDe2klwEyzuOgOOXobGGEqVQpKkZ/q9m/krvaGhM2s=;

b=khgmm7rGbqVQynUHRsxOQpZ6a5+jg0oc8DLFyHhiObleadEj/JFLkHvw9E3b08t7Dx

HajhRKw9XKaL81A+MlO+5VzGPtSnZV1VDVsm4Ca5IzsdeOhsjzPap3aupNBPcVywjA+9

EezDEtg6YLuQpcLjHlWuKydQjFw91XsODZchQXMwiis8wJyRwjKCmAxDTIAVKzxhspjZ

KlIIpxEeHyXI0tY5tmbUh7KCZEGnjjxZ3ckQEeQp+U45XMM3yBQp86RujgRXYpliwZ+r

w+hiUjtkl5us792Le8HCLRskLif/+DEpD14Va5RL7E6oVlCPzYRXk3JYjIJf00nblUxV

cXOQ==

X-Gm-Message-State: AOJu0Yw7YlIoNjiPzPSpoyXw5rZeP1/O9Eb/rtv9fwbih60WkruOmki1

EXvCrbZ+Vwg/U/quZ/GcyfQcjCryAbH/Yp/bCHb9FXppKQWMno7rkUfdW93o

X-Gm-Gg: ASbGnct7eqXmtslw/cTHycVFGbdMEDOhEhAs7Ch3H0UW+KphwcOIf5s+1FGNiNCW+r6

sxEFqfdOXIOhZOFoJCRFUA32e0Q4epLV2UK9MfoV8Gcf8twVU2N3RBbkZIioabrR2n23OLECmSr

rJWJcXjfaYdxWMsAxWbE9wOtZODTWAWKop22aKQIyMkCHnhqWNAptfclzcRDU2bEhhBMZIdNFCh

Ef7QTCWChj1JspAAy7Y4779KmUc7uCMOutII2g7lZdf1fFwUFeL3oOZ2HXI

X-Google-Smtp-Source: AGHT+IEuyXgm0+t3iJLjWqBLD2Nd3yrrdtS8at5SyBsPRg3U3crLL0aSptSoxEI8Zk3FoLENZcX7UA==

X-Received: by 2002:a05:6512:2395:b0:53d:dbc4:3b8f with SMTP id 2adb3069b0e04-53df00d1110mr3073486e87.13.1732769195014;

Wed, 27 Nov 2024 20:46:35 -0800 (PST)

Received: from rbc-desktop ([2a03:94e0:2637:5ff9:d40:2dd5:5994:55cf])

by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-53df643edccsm63747e87.62.2024.11.27.20.46.31

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 27 Nov 2024 20:46:33 -0800 (PST)

Message-ID: <6747f5a9.c20a0220.b1bb.0957@mx.google.com>

Content-Type: multipart/mixed; boundary="===============0276486091727413758=="

MIME-Version: 1.0

Subject: Email verification link: Your RBC Account

From: RBC Royal Bank

To: root@nk.ca

Date: Wed, 27 Nov 2024 20:46:31 -0800

X-Spam_score: 6.6

X-Spam_score_int: 66

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear RBC Client, The following RBC e-Alert(s) is(are) available:

Please complete the email verification process



Content analysis details: (6.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.41 listed in dnsbl.ahbl.org]

[209.85.167.41 listed in dnsbl.ahbl.org]

[209.85.167.41 listed in dnsbl.ahbl.org]

[209.85.167.41 listed in dnsbl.ahbl.org]

[2a03:94e0:2637:5ff9:d40:2dd5:5994:55cf listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:5ff9:d40:2dd5:5994:55cf listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:5ff9:d40:2dd5:5994:55cf listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:5ff9:d40:2dd5:5994:55cf listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.41 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.41 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.41 listed in will-spam-for-food.eu.org]

[209.85.167.41 listed in will-spam-for-food.eu.org]

[209.85.167.41 listed in will-spam-for-food.eu.org]

[209.85.167.41 listed in will-spam-for-food.eu.org]

[209.85.167.41 listed in will-spam-for-food.eu.org]

[209.85.167.41 listed in will-spam-for-food.eu.org]

[209.85.167.41 listed in will-spam-for-food.eu.org]

[209.85.167.41 listed in will-spam-for-food.eu.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.41 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.41 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[buharibaladaura(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

Subject: {SPAM?} Email verification link: Your RBC Account



--===============0276486091727413758==

Content-Type: multipart/related; boundary="===============6121694430070237066=="

MIME-Version: 1.0



--===============6121694430070237066==

Content-Type: multipart/alternative; boundary="===============0136267907149991036=="

MIME-Version: 1.0



--===============0136267907149991036==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBXMyBIVE1MLy9FTiI+PGh0bWw+Cjxo

ZWFkPgo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsg

Y2hhcnNldD1pc28tODg1OS0xIj48L2hlYWQ+Cjxib2R5PgoJCglEZWFyIFJCQyBDbGllbnQsPGJy

Pjxicj4KClRoZSBmb2xsb3dpbmcgUkJDIGUtQWxlcnQocykgaXMoYXJlKSBhdmFpbGFibGU6PGJy

PgoJPGJyPgpQbGVhc2UgY29tcGxldGUgdGhlIGVtYWlsIHZlcmlmaWNhdGlvbiBwcm9jZXNzPGJy

PgoJPGJyPgpXZeKAmXZlIG1hZGUgc29tZSB1cGRhdGVzIHRvIG91ciBzZWN1cml0eSBwcmFjdGlj

ZXMuIENvbmZpcm0geW91ciBlbWFpbCB0byBtYWludGFpbiB5b3VyIGFjY291bnQuPGJyPgoJPGJy

PgpUbyBmaW5hbGl6ZSB0aGUgdmVyaWZpY2F0aW9uIHByb2Nlc3MsIGxvZyBpbiB0byBSQkMgT25s

aW5lIEJhbmtpbmcgdGhyb3VnaCB0aGUgbGluayBiZWxvdzoKCTxicj48YnI+CjxhIGhyZWY9Imh0

dHBzOi8vdGhlbWF4bHB0ZXVsLmJsb2dzcG90LmNvbS8iPkNvbXBsZXRlIGVtYWlsIHZlcmlmaWNh

dGlvbjwvYT48YnI+CgoJPGJyPlJldmlldyB5b3VyIGVtYWlsIGFsZXJ0IHNldHRpbmdzIGFuZCBt

YWtlIGNoYW5nZXMgaW4gUkJDIE9ubGluZSBCYW5raW5nLCBzZWxlY3QgJnF1b3Q7UHJvZmlsZSBh

bmQgUHJlZmVyZW5jZXMmcXVvdDsgbmF2aWdhdGUgdG8gdGhlIEJhbmtpbmcgdGFiIHVuZGVyIE15

IEFjY291bnRzLjxicj48YnI+CgoJRW1haWwgd2l0aG91dCBlbmNyeXB0aW9uIGlzIGluc2VjdXJl

IGZvciBwZXJzb25hbCBkZXRhaWxzLiBGb3Igc2FmZSBjb21tdW5pY2F0aW9uLCBzZW5kIHlvdXIg

bWVzc2FnZSB2aWEgdGhlIFJCQyBSb3lhbCBCYW5rIE9ubGluZSBCYW5raW5nIG1lc3NhZ2UgY2Vu

dGVyIG9yIGFub3RoZXIgc2VjdXJlIG9wdGlvbiwgb3IgY2FsbCB1cyBieSA8YSBocmVmPSIjIj5w

aG9uZTwvYT4uPGJyPjxicj4KCglPdXRzaWRlIENhbmFkYSBhbmQgdGhlIFUuUy46ICBSZWFjaCB1

cyB1c2luZyBvdXIgPGEgaHJlZj0iIyI+SW50ZXJuYXRpb25hbCBDdXN0b21lciBTZXJ2aWNlPC9h

PgoKCURvIG5vdCByZXBseSB0byB0aGlzIGVtYWlsLCBhcyB0aGUgYWNjb3VudCBpdCB3YXMgc2Vu

dCBmcm9tIGlzIHVuYXR0ZW5kZWQuPGJyPjxicj4KCgleUkJDIGlzIG9mZmVyZWQgYnkgUm95YWwg

QmFuay4KCgk8L2JvZHk+CjwvaHRtbD4=



--===============0136267907149991036==--



--===============6121694430070237066==--



--===============0276486091727413758==--

RBC PHish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 28 Nov 2024 04:32:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGcjy-000000001uA-09gX

for dave@doctor.nl2k.ab.ca;

Thu, 28 Nov 2024 04:31:22 -0700

Resent-From: The Doctor

Resent-Date: Thu, 28 Nov 2024 04:31:22 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f170.google.com ([209.85.208.170]:47476)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGVz7-000000008aS-37zx

for doctor@netknow.ca;

Wed, 27 Nov 2024 21:18:41 -0700

Received: by mail-lj1-f170.google.com with SMTP id 38308e7fff4ca-2ffa3e8e917so4161731fa.3

for ; Wed, 27 Nov 2024 20:16:38 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1732767391; x=1733372191; darn=netknow.ca;

h=date:to:from:subject:mime-version:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=s0KnP4b34eYlxMaS6tKZyqRpJKB67VQrKabESLAwPUc=;

b=U5eCqXEShAkc+NCGpjLbU4pL4L9ThyR8wrEyaxD3KOQEY+LmiZT12v+ybAVdujsxIL

Q/NuBjItmDnwMC23YLtrNGXoxBKiHhCZEkzuiDDY5+0BPSDEr3ortq6qKBJrZhX0NU2W

pyEFAXxOrpMBTJTOU4LUS0Ioi7WD9hgYk6Vzm2V0aMDT7WkEcsYqO7ZKeP4bwj4ZFoCt

oU8TyBFFIbn/Gx5ZYtas+ptVDEY9H2CquCdeaSTDys9T513kDJHFFb4jvCTVgUku/iFT

6iwTEx6ftHwLr8AB/+nWGYpIcCWzFs1SAzgT+flEczJihRtjoqhfsemly5o54aybd4VF

+rbQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732767391; x=1733372191;

h=date:to:from:subject:mime-version:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=s0KnP4b34eYlxMaS6tKZyqRpJKB67VQrKabESLAwPUc=;

b=Vr3ULyOkiAmsNUG+HlIBAhoy6b8P8krBid8r8xaHCkQZzu2XoiHk081fJ7gA1RRYHA

3G3YNmNjqSpFszyrv/BOjHDHfUMRWBNCXW/165QwdP4CPD1qiAcvXmevL6bdB6Ox1KWG

MP3543wibXGynElNKWMIolOYUY1Of0QE0mfaYmenPZkqfQWpZmLqh1h87KxptAVwLKAe

l81pCW4LPVltdxEiUtWXoWwKRZpW8KnTu/hWm69H8LrFDUEXJS2YCF5zaPQ952dUl7hv

DlfmDgHzMA/3SeDgMLscHwOpATxLx2N3xKB2PPL5/jMaO0E6bJZr/C1lRmYC3uR/p+zu

EToQ==

X-Gm-Message-State: AOJu0YyBG58cXOoXeCIYvpm2w5k+S/PgJCBafsONjR6KdTjeEf+vtoFP

9ZCjt0P2pK6znXl4pQJGh9N/lUPzIC8G9U5Mo9boAmNWdjFc43pN6WSvlQ==

X-Gm-Gg: ASbGncsChmDcXegpa0CTiCS06/Z7iLxtrfciZbLR5G162dP/7sD+iqqk0wKx4she7W9

X0Q/34tZbf9umEbFsn9yRlm8rwyZD78LtvVmxonjivWLhC61n/EL41yPrBzXTkmKwZWUON3G7+Y

TVxiEpAHs1PAXQ+nLJ4QoSJgasiosU0A9Hzy0+etZh6z+RAarbfM3JwKQIRarmR33RYsVB9OMo5

FC2Xr/i3+b339Zfwiqje5XNhbeAdQ1I2iKPuL++YTnJgWF9MnW/yIT+

X-Google-Smtp-Source: AGHT+IHQCopmdL2k+ljeYcnliAaGYkFqSJh0xZ7nUNvFec8QQCrmHZipAgi1u24IMNHaOoJhNpwWow==

X-Received: by 2002:a2e:b8c3:0:b0:2ff:c3d2:b0ab with SMTP id 38308e7fff4ca-2ffd6120f5fmr37965351fa.29.1732767390945;

Wed, 27 Nov 2024 20:16:30 -0800 (PST)

Received: from rbc-desktop ([2a03:94e0:2637:a37d:a879:344:7da2:c7])

by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-2ffdfbef6cbsm734791fa.42.2024.11.27.20.16.28

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 27 Nov 2024 20:16:29 -0800 (PST)

Message-ID: <6747ee9d.2e0a0220.2d609a.0bc8@mx.google.com>

Content-Type: multipart/mixed; boundary="===============3599855668112714759=="

MIME-Version: 1.0

Subject: Please verify your email address

From: RBC Royal Bank

To: doctor@netknow.ca

Date: Wed, 27 Nov 2024 20:16:27 -0800

X-Spam_score: 6.6

X-Spam_score_int: 66

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear RBC Client, The following RBC e-Alert(s) is(are) accessible:

Confirm your email address to finalize your verification



Content analysis details: (6.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

[209.85.208.170 listed in dnsbl.ahbl.org]

[209.85.208.170 listed in dnsbl.ahbl.org]

[209.85.208.170 listed in dnsbl.ahbl.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.170 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.170 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[asabeafrimpong(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

Subject: {SPAM?} Please verify your email address



--===============3599855668112714759==

Content-Type: multipart/related; boundary="===============7686648418944254050=="

MIME-Version: 1.0



--===============7686648418944254050==

Content-Type: multipart/alternative; boundary="===============7818777363425432827=="

MIME-Version: 1.0



--===============7818777363425432827==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBXMyBIVE1MLy9FTiI+PGh0bWw+Cjxo

ZWFkPgo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsg

Y2hhcnNldD1pc28tODg1OS0xIj48L2hlYWQ+Cjxib2R5PgoJCglEZWFyIFJCQyBDbGllbnQsPGJy

Pjxicj4KClRoZSBmb2xsb3dpbmcgUkJDIGUtQWxlcnQocykgaXMoYXJlKSBhY2Nlc3NpYmxlOjxi

cj4KCTxicj4KQ29uZmlybSB5b3VyIGVtYWlsIGFkZHJlc3MgdG8gZmluYWxpemUgeW91ciB2ZXJp

ZmljYXRpb248YnI+Cgk8YnI+ClRvIGNvbXBseSB3aXRoIHJlY2VudCB1cGRhdGVzIHRvIG91ciBz

ZWN1cml0eSB0ZXJtcywgcGxlYXNlIGNvbmZpcm0geW91ciBlbWFpbCBhZGRyZXNzLjxicj4KCTxi

cj4KVG8gZmluYWxpemUgdGhlIHZlcmlmaWNhdGlvbiBwcm9jZXNzLCBsb2cgaW4gdG8gUkJDIE9u

bGluZSBCYW5raW5nIHRocm91Z2ggdGhlIGxpbmsgYmVsb3c6Cgk8YnI+PGJyPgo8YSBocmVmPSJo

dHRwczovL3dpdGhpbmdrYXJhc2lra29jaGcuYmxvZ3Nwb3QuY29tLyI+Q29uZmlybSB5b3VyIGVt

YWlsIGZvciB2ZXJpZmljYXRpb248L2E+PGJyPgoKCTxicj5BZGp1c3QgeW91ciBlbWFpbCBub3Rp

ZmljYXRpb24gcHJlZmVyZW5jZXMgaW4gUkJDIE9ubGluZSBCYW5raW5nLCBzZWxlY3QgJnF1b3Q7

UHJvZmlsZSBhbmQgUHJlZmVyZW5jZXMmcXVvdDsgZnJvbSB0aGUgQmFua2luZyB0YWIgdW5kZXIg

TXkgQWNjb3VudHMuPGJyPjxicj4KCglFbWFpbCB3aXRob3V0IGVuY3J5cHRpb24gaXMgaW5zZWN1

cmUgZm9yIHBlcnNvbmFsIGRldGFpbHMuIEZvciBzYWZlIGNvbW11bmljYXRpb24sIHNlbmQgeW91

ciBtZXNzYWdlIHZpYSB0aGUgUkJDIFJveWFsIEJhbmsgT25saW5lIEJhbmtpbmcgbWVzc2FnZSBj

ZW50ZXIgb3IgYW5vdGhlciBzZWN1cmUgb3B0aW9uLCBvciBjb250YWN0IHVzIGJ5IDxhIGhyZWY9

IiMiPnBob25lPC9hPi48YnI+PGJyPgoKCU91dHNpZGUgQ2FuYWRhIGFuZCB0aGUgVS5TLjogIENv

bnRhY3QgdXMgdmlhIG91ciA8YSBocmVmPSIjIj5JbnRlcm5hdGlvbmFsIEN1c3RvbWVyIFNlcnZp

Y2VzPC9hPgoKCVRoaXMgZW1haWwgd2FzIHNlbnQgZnJvbSBhbiB1bm1vbml0b3JlZCBhY2NvdW50

OyBwbGVhc2UgZG8gbm90IHJlcGx5Ljxicj48YnI+CgoJXlJCQyBCYW5rIGlzIG9mZmVyZWQgYnkg

Um95YWwgQmFuayBvZiBDYW5hZGEuCgoJPC9ib2R5Pgo8L2h0bWw+



--===============7818777363425432827==--



--===============7686648418944254050==--



--===============3599855668112714759==--

RBC PHish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 28 Nov 2024 04:32:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGcjy-000000001uA-09gX

for dave@doctor.nl2k.ab.ca;

Thu, 28 Nov 2024 04:31:22 -0700

Resent-From: The Doctor

Resent-Date: Thu, 28 Nov 2024 04:31:22 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f170.google.com ([209.85.208.170]:47476)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGVz7-000000008aS-37zx

for doctor@netknow.ca;

Wed, 27 Nov 2024 21:18:41 -0700

Received: by mail-lj1-f170.google.com with SMTP id 38308e7fff4ca-2ffa3e8e917so4161731fa.3

for ; Wed, 27 Nov 2024 20:16:38 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1732767391; x=1733372191; darn=netknow.ca;

h=date:to:from:subject:mime-version:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=s0KnP4b34eYlxMaS6tKZyqRpJKB67VQrKabESLAwPUc=;

b=U5eCqXEShAkc+NCGpjLbU4pL4L9ThyR8wrEyaxD3KOQEY+LmiZT12v+ybAVdujsxIL

Q/NuBjItmDnwMC23YLtrNGXoxBKiHhCZEkzuiDDY5+0BPSDEr3ortq6qKBJrZhX0NU2W

pyEFAXxOrpMBTJTOU4LUS0Ioi7WD9hgYk6Vzm2V0aMDT7WkEcsYqO7ZKeP4bwj4ZFoCt

oU8TyBFFIbn/Gx5ZYtas+ptVDEY9H2CquCdeaSTDys9T513kDJHFFb4jvCTVgUku/iFT

6iwTEx6ftHwLr8AB/+nWGYpIcCWzFs1SAzgT+flEczJihRtjoqhfsemly5o54aybd4VF

+rbQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732767391; x=1733372191;

h=date:to:from:subject:mime-version:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=s0KnP4b34eYlxMaS6tKZyqRpJKB67VQrKabESLAwPUc=;

b=Vr3ULyOkiAmsNUG+HlIBAhoy6b8P8krBid8r8xaHCkQZzu2XoiHk081fJ7gA1RRYHA

3G3YNmNjqSpFszyrv/BOjHDHfUMRWBNCXW/165QwdP4CPD1qiAcvXmevL6bdB6Ox1KWG

MP3543wibXGynElNKWMIolOYUY1Of0QE0mfaYmenPZkqfQWpZmLqh1h87KxptAVwLKAe

l81pCW4LPVltdxEiUtWXoWwKRZpW8KnTu/hWm69H8LrFDUEXJS2YCF5zaPQ952dUl7hv

DlfmDgHzMA/3SeDgMLscHwOpATxLx2N3xKB2PPL5/jMaO0E6bJZr/C1lRmYC3uR/p+zu

EToQ==

X-Gm-Message-State: AOJu0YyBG58cXOoXeCIYvpm2w5k+S/PgJCBafsONjR6KdTjeEf+vtoFP

9ZCjt0P2pK6znXl4pQJGh9N/lUPzIC8G9U5Mo9boAmNWdjFc43pN6WSvlQ==

X-Gm-Gg: ASbGncsChmDcXegpa0CTiCS06/Z7iLxtrfciZbLR5G162dP/7sD+iqqk0wKx4she7W9

X0Q/34tZbf9umEbFsn9yRlm8rwyZD78LtvVmxonjivWLhC61n/EL41yPrBzXTkmKwZWUON3G7+Y

TVxiEpAHs1PAXQ+nLJ4QoSJgasiosU0A9Hzy0+etZh6z+RAarbfM3JwKQIRarmR33RYsVB9OMo5

FC2Xr/i3+b339Zfwiqje5XNhbeAdQ1I2iKPuL++YTnJgWF9MnW/yIT+

X-Google-Smtp-Source: AGHT+IHQCopmdL2k+ljeYcnliAaGYkFqSJh0xZ7nUNvFec8QQCrmHZipAgi1u24IMNHaOoJhNpwWow==

X-Received: by 2002:a2e:b8c3:0:b0:2ff:c3d2:b0ab with SMTP id 38308e7fff4ca-2ffd6120f5fmr37965351fa.29.1732767390945;

Wed, 27 Nov 2024 20:16:30 -0800 (PST)

Received: from rbc-desktop ([2a03:94e0:2637:a37d:a879:344:7da2:c7])

by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-2ffdfbef6cbsm734791fa.42.2024.11.27.20.16.28

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 27 Nov 2024 20:16:29 -0800 (PST)

Message-ID: <6747ee9d.2e0a0220.2d609a.0bc8@mx.google.com>

Content-Type: multipart/mixed; boundary="===============3599855668112714759=="

MIME-Version: 1.0

Subject: Please verify your email address

From: RBC Royal Bank

To: doctor@netknow.ca

Date: Wed, 27 Nov 2024 20:16:27 -0800

X-Spam_score: 6.6

X-Spam_score_int: 66

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear RBC Client, The following RBC e-Alert(s) is(are) accessible:

Confirm your email address to finalize your verification



Content analysis details: (6.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

[209.85.208.170 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

[209.85.208.170 listed in dnsbl.ahbl.org]

[209.85.208.170 listed in dnsbl.ahbl.org]

[209.85.208.170 listed in dnsbl.ahbl.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:a37d:a879:344:7da2:c7 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.170 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.170 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.170 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[asabeafrimpong(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

Subject: {SPAM?} Please verify your email address



--===============3599855668112714759==

Content-Type: multipart/related; boundary="===============7686648418944254050=="

MIME-Version: 1.0



--===============7686648418944254050==

Content-Type: multipart/alternative; boundary="===============7818777363425432827=="

MIME-Version: 1.0



--===============7818777363425432827==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBXMyBIVE1MLy9FTiI+PGh0bWw+Cjxo

ZWFkPgo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsg

Y2hhcnNldD1pc28tODg1OS0xIj48L2hlYWQ+Cjxib2R5PgoJCglEZWFyIFJCQyBDbGllbnQsPGJy

Pjxicj4KClRoZSBmb2xsb3dpbmcgUkJDIGUtQWxlcnQocykgaXMoYXJlKSBhY2Nlc3NpYmxlOjxi

cj4KCTxicj4KQ29uZmlybSB5b3VyIGVtYWlsIGFkZHJlc3MgdG8gZmluYWxpemUgeW91ciB2ZXJp

ZmljYXRpb248YnI+Cgk8YnI+ClRvIGNvbXBseSB3aXRoIHJlY2VudCB1cGRhdGVzIHRvIG91ciBz

ZWN1cml0eSB0ZXJtcywgcGxlYXNlIGNvbmZpcm0geW91ciBlbWFpbCBhZGRyZXNzLjxicj4KCTxi

cj4KVG8gZmluYWxpemUgdGhlIHZlcmlmaWNhdGlvbiBwcm9jZXNzLCBsb2cgaW4gdG8gUkJDIE9u

bGluZSBCYW5raW5nIHRocm91Z2ggdGhlIGxpbmsgYmVsb3c6Cgk8YnI+PGJyPgo8YSBocmVmPSJo

dHRwczovL3dpdGhpbmdrYXJhc2lra29jaGcuYmxvZ3Nwb3QuY29tLyI+Q29uZmlybSB5b3VyIGVt

YWlsIGZvciB2ZXJpZmljYXRpb248L2E+PGJyPgoKCTxicj5BZGp1c3QgeW91ciBlbWFpbCBub3Rp

ZmljYXRpb24gcHJlZmVyZW5jZXMgaW4gUkJDIE9ubGluZSBCYW5raW5nLCBzZWxlY3QgJnF1b3Q7

UHJvZmlsZSBhbmQgUHJlZmVyZW5jZXMmcXVvdDsgZnJvbSB0aGUgQmFua2luZyB0YWIgdW5kZXIg

TXkgQWNjb3VudHMuPGJyPjxicj4KCglFbWFpbCB3aXRob3V0IGVuY3J5cHRpb24gaXMgaW5zZWN1

cmUgZm9yIHBlcnNvbmFsIGRldGFpbHMuIEZvciBzYWZlIGNvbW11bmljYXRpb24sIHNlbmQgeW91

ciBtZXNzYWdlIHZpYSB0aGUgUkJDIFJveWFsIEJhbmsgT25saW5lIEJhbmtpbmcgbWVzc2FnZSBj

ZW50ZXIgb3IgYW5vdGhlciBzZWN1cmUgb3B0aW9uLCBvciBjb250YWN0IHVzIGJ5IDxhIGhyZWY9

IiMiPnBob25lPC9hPi48YnI+PGJyPgoKCU91dHNpZGUgQ2FuYWRhIGFuZCB0aGUgVS5TLjogIENv

bnRhY3QgdXMgdmlhIG91ciA8YSBocmVmPSIjIj5JbnRlcm5hdGlvbmFsIEN1c3RvbWVyIFNlcnZp

Y2VzPC9hPgoKCVRoaXMgZW1haWwgd2FzIHNlbnQgZnJvbSBhbiB1bm1vbml0b3JlZCBhY2NvdW50

OyBwbGVhc2UgZG8gbm90IHJlcGx5Ljxicj48YnI+CgoJXlJCQyBCYW5rIGlzIG9mZmVyZWQgYnkg

Um95YWwgQmFuayBvZiBDYW5hZGEuCgoJPC9ib2R5Pgo8L2h0bWw+



--===============7818777363425432827==--



--===============7686648418944254050==--



--===============3599855668112714759==--

Amex Fraud Phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 27 Nov 2024 16:45:20 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGRhl-00000000GOe-0FUC

for dave@doctor.nl2k.ab.ca;

Wed, 27 Nov 2024 16:44:21 -0700

Resent-From: The Doctor

Resent-Date: Wed, 27 Nov 2024 16:44:21 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.basa.school ([88.198.207.53]:36922 helo=elitzoo)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGRHU-000000001MF-2AgA

for doctor@nk.ca;

Wed, 27 Nov 2024 16:17:17 -0700

Received: from techno_group_usr by elitzoo with local (Exim 4.96)

(envelope-from )

id 1tGRFd-004bLq-0S

for doctor@nk.ca;

Thu, 28 Nov 2024 01:15:17 +0200

To: doctor@nk.ca

Subject: Action Needed: Verify Your Account to Restore Access

X-PHP-Originating-Script: 1009:ez.php

From: Amex Fraud Detection Team

Reply-To: support@techno-group.com.ua

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Message-Id:

Date: Thu, 28 Nov 2024 01:15:17 +0200

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Account Security Notification Account Security Alert



Content analysis details: (10.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[88.198.207.53 listed in dnsbl.ahbl.org]

[88.198.207.53 listed in dnsbl.ahbl.org]

[88.198.207.53 listed in dnsbl.ahbl.org]

[88.198.207.53 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[88.198.207.53 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[88.198.207.53 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[88.198.207.53 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[88.198.207.53 listed in dnsbl.ahbl.org]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.0 FSL_HELO_NON_FQDN_1 No description available.

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.5 HELO_NO_DOMAIN Relay reports its domain incorrectly

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.9 URI_PHISH Phishing using web form

1.0 ACCT_PHISHING Possible phishing for account information

Subject: {SPAM?} Action Needed: Verify Your Account to Restore Access













Account Security Notification















Adobe purchase order phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 27 Nov 2024 16:30:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGQKR-00000000KMr-1u7N

for dave@doctor.nl2k.ab.ca;

Wed, 27 Nov 2024 15:16:11 -0700

Resent-From: The Doctor

Resent-Date: Wed, 27 Nov 2024 15:16:11 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s1036210.srvape.com ([188.127.251.120]:43272)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGOA1-00000000DOv-43H9

for doctor@doctor.nl2k.ab.ca;

Wed, 27 Nov 2024 12:57:21 -0700

Received: from biz.oversaesbulker.com (localhost [IPv6:::1])

by s1036210.srvape.com (Postfix) with ESMTP id 7CC54299D10

for ; Wed, 27 Nov 2024 22:55:19 +0300 (MSK)

From: "=?UTF-8?B?UmVuw6kgQ2xhYXNzZW5zIC0gS8O2c3RlciBBZHZvY2F0ZW4gTi5WLiA8?= noreply"@biz.oversaesbulker.com>

To: doctor@doctor.nl2k.ab.ca

Subject: Fwd: Purchase order #PO-36739575.adobe

Date: 27 Nov 2024 21:55:19 +0200

Message-ID: <20241127215518.40C43C8A5815AFCB@biz.oversaesbulker.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.5

X-Spam_score_int: 135

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: #PO-36739575.xls File Size: 98kb | File Expiry: 3days View

Message: I am interested in some of your products. I want to place a trial

order on the products listed in the attached file. Kindly check a [...]



Content analysis details: (13.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[188.127.251.120 listed in will-spam-for-food.eu.org]

[188.127.251.120 listed in will-spam-for-food.eu.org]

[188.127.251.120 listed in will-spam-for-food.eu.org]

[188.127.251.120 listed in will-spam-for-food.eu.org]

[188.127.251.120 listed in will-spam-for-food.eu.org]

[188.127.251.120 listed in will-spam-for-food.eu.org]

[188.127.251.120 listed in will-spam-for-food.eu.org]

[188.127.251.120 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[188.127.251.120 listed in dnsbl.ahbl.org]

[188.127.251.120 listed in dnsbl.ahbl.org]

[188.127.251.120 listed in dnsbl.ahbl.org]

[188.127.251.120 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[188.127.251.120 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[188.127.251.120 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[188.127.251.120 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[188.127.251.120 listed in dnsbl.ahbl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: ipfs.io/209.94.90.1]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[188.127.251.120 listed in bb.barracudacentral.org]

2.4 FROM_UNBAL2 From with unbalanced angle brackets, '<' missing

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

3.2 URI_IPFSIO References Interplanetary File System PtP content via

ipfs.io, likely phishing

0.0 URI_IPFS References Interplanetary File System PtP content, probable

phishing

Subject: {SPAM?} Fwd: Purchase order #PO-36739575.adobe




w3.org/TR/html4/loose.dtd">












o, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLAPSE: col=

lapse; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(44,54,58); FONT-S=

TYLE: normal; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: norm=

al; BACKGROUND-COLOR: rgb(255,255,255); font-variant-ligatures: normal; fon=

t-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thi=

ckness: initial; text-decoration-style: initial;=20

text-decoration-color: initial" cellSpacing=3D0>















 
 



d; HEIGHT: 250px; BORDER-RIGHT: rgb(222,23,23) 1px solid; WIDTH: 400px; BOR=

DER-COLLAPSE: collapse; BORDER-BOTTOM: rgb(222,23,23) 1px solid; PADDING-BO=

TTOM: 10px; PADDING-TOP: 10px; PADDING-LEFT: 10px; BORDER-LEFT: rgb(222,23,=

23) 1px solid; PADDING-RIGHT: 10px; BACKGROUND-COLOR: rgb(255,255,255); bor=

der-radius: 3px 7px">








apse" cellSpacing=3D0 align=3Dcenter>






















FONT-SIZE: 13px; FONT-FAMILY: arial; COLOR: rgb(51,51,51)">
=3D"BOX-SIZING: border-box; FONT-WEIGHT: bolder">#PO-36739575.xls
<=

BR style=3D"BOX-SIZING: border-box">File Size: 98kb | File Expiry: 3days
PAN>
 



COLLAPSE: collapse; BACKGROUND-COLOR: rgb(194,1,1); border-radius: 15px" ce=

llSpacing=3D0>







 

FONT-SIZE: 13px; FONT-FAMILY: arial; COLOR: rgb(51,51,51)">
BOX-SIZING: border-box; FONT-SIZE: 13px; FONT-FAMILY: arial; COLOR: rgb(51,=

51,51)">
le=3D"BOX-SIZING: border-box; FONT-WEIGHT: bolder">Message:
=


I am interested in some of your produc=

ts.


I want to place a trial order on the products listed in the attached file. =

Kindly check and send your offer, and state your payment terms for trial or=

der.

=

Sender's Profile:
=20



  • Name: Islam Aoune=20

  • Position: Sales Manager=20

  • Company: Al-Yassar General Trading LLC=



-interchange-newline>



French langauge rental phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 27 Nov 2024 10:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGKU1-00000000Cg0-2bBi

for dave@doctor.nl2k.ab.ca;

Wed, 27 Nov 2024 09:01:41 -0700

Resent-From: The Doctor

Resent-Date: Wed, 27 Nov 2024 09:01:41 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pg1-f174.google.com ([209.85.215.174]:45095)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGJk9-00000000CWM-3RTq

for doctor@nk.ca;

Wed, 27 Nov 2024 08:14:22 -0700

Received: by mail-pg1-f174.google.com with SMTP id 41be03b00d2f7-7fbd76941ccso3524131a12.2

for ; Wed, 27 Nov 2024 07:12:33 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=escuelalicarayen-cl.20230601.gappssmtp.com; s=20230601; t=1732720347; x=1733325147; darn=nk.ca;

h=to:subject:message-id:date:from:reply-to:in-reply-to:references

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=QCNdSYcS+YbhzQrlRNorHbsjekBu1iBii7V9fIfbyM8=;

b=yqN9cMScIBc6o6lFicB7Er//4ippo6o7HjjqS8p//G2LF/kyrOcHRUvWCJo9V/Sten

jF1b7wG8QShxHrj3XsjEGbFaFZhIBLQxPbdFGD66P0537FwFjNvgKbyKoUScGKMzfvia

cJasV++9bqZRh8fd1WF/e/hlz0B1W92Q3ApYZZCUb0iLUlg4fYvYEOt9p8Qfyf9lg3Ry

4A5ojFuV4eNtlWlrSOPwrypToLzJ4xrVokCl6eRMQVkXI1xAXZuuuqSCflbsW+gaYkuN

CfQP5P/0c87VGdsERwSwzMu6dPILcUmTh4m5MGpjxp4wAN/swoJBQZW4YETBha1zGbij

4Bfg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732720347; x=1733325147;

h=to:subject:message-id:date:from:reply-to:in-reply-to:references

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=QCNdSYcS+YbhzQrlRNorHbsjekBu1iBii7V9fIfbyM8=;

b=kdoeW1nafXP/0da1Q1b2+PJAT3FWMBIVWCSpdXfyqvU8bLQfjpugvfACGep1/56lM6

f7dBKUMMxfzHEl5y89Y4rZTvc5EuaBwfOhloxzXuOaRItCYLttHZ8JFTR4bkmmPaLPSs

P7jN8uq3EUlJZvKuIolsJvl4qpLodWs50oBQXCkSe4A/KLnhJOiiq5xkXcwN3ezvW+m4

jkVFf9dL/iGfBu7H4tY+V9cbKroiKY0+6xTyQCQTutyXEZAQLo1A2jBIGadl8ZrDNg1k

7b+daAPCWyN6VFXbXjw5z38k2qe5vd8LB4sKnTV503wbH9bg/tfEB4QaGurJe95nZH7X

yuAg==

X-Forwarded-Encrypted: i=1; AJvYcCU6wrA3oK1g7w/LbwmKo8jF3Ko0WeMyQ4RbRxhUBge51r8Bhsoi7LF2g03kRL8jlr/iDXHAtoA=@nk.ca

X-Gm-Message-State: AOJu0YxoD+8oX78HbNTgFMaLm+aR927ShlAIE2kVa/JBf6VSM59ebUTp

UzV98SbH1tviUftQYTuTWmgzzgS4Zap/gtJG5cxmO6I6r+Gx93OehUfdE1V86AiSAkxz2+8DKcB

PMzoe071x9AXKNwbJiaiuPBrO+G5ZNcVo8lXXjA==

X-Gm-Gg: ASbGnctmXzeY7+dQfTENW9jcEMGHZ/m+b+rN3Fi79jjpXpDcSkO8DsPVgggoe42vQQ/

gL3PFfVK5nLMi875Um+qZZXIM20C0X+Eo

X-Google-Smtp-Source: AGHT+IHG1wyo9DYo/N2k0dg1nWt6DpASbK6ArOzB2N9zD6O7BvoUKxHkzNhnUv1LwdecwbEDsL7n8Yo56mNNHNS6/FE=

X-Received: by 2002:a17:90b:388a:b0:2ea:adaa:1a42 with SMTP id

98e67ed59e1d1-2ee08ecc3f2mr5482236a91.16.1732720346884; Wed, 27 Nov 2024

07:12:26 -0800 (PST)

MIME-Version: 1.0

References:



In-Reply-To:

Reply-To: immobiliergestion309@gmail.com

From: =?UTF-8?Q?Sebasti=EF=BF=BDn_Gianelli?=

Date: Wed, 27 Nov 2024 16:11:19 +0100

Message-ID:

Subject: =?UTF-8?Q?Loyer_Impay=C3=A9?=

To: gestionlocative@live.ca

Content-Type: multipart/mixed; boundary="000000000000c59bd60627e6643c"

Bcc: doctor@nk.ca

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ( VOIR PDF ) ( VOIR PDF )



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.215.174 listed in will-spam-for-food.eu.org]

[209.85.215.174 listed in will-spam-for-food.eu.org]

[209.85.215.174 listed in will-spam-for-food.eu.org]

[209.85.215.174 listed in will-spam-for-food.eu.org]

[209.85.215.174 listed in will-spam-for-food.eu.org]

[209.85.215.174 listed in will-spam-for-food.eu.org]

[209.85.215.174 listed in will-spam-for-food.eu.org]

[209.85.215.174 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.215.174 listed in dnsbl.ahbl.org]

[209.85.215.174 listed in dnsbl.ahbl.org]

[209.85.215.174 listed in dnsbl.ahbl.org]

[209.85.215.174 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.215.174 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.215.174 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.215.174 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.215.174 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.215.174 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.215.174 listed in wl.mailspike.net]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[immobiliergestion309(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} =?UTF-8?Q?Loyer_Impay=C3=A9?=



--000000000000c59bd60627e6643c

Content-Type: multipart/alternative; boundary="000000000000c59bd50627e6643a"



--000000000000c59bd50627e6643a

Content-Type: text/plain; charset="UTF-8"



( VOIR PDF )



--000000000000c59bd50627e6643a

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




gmail_quote">

x">
t:inherit;font-stretch:inherit;font-size:18pt;line-height:inherit;font-fami=

ly:inherit;margin:0px;padding:0cm;vertical-align:baseline;color:red">(=

=C2=A0VOIR=C2=A0PDF=C2=A0)









--000000000000c59bd50627e6643a--

--000000000000c59bd60627e6643c

Content-Type: application/pdf; name="RABAIS logement (1).pdf"

Content-Disposition: attachment; filename="RABAIS logement (1).pdf"

Content-Transfer-Encoding: base64

Content-ID:

X-Attachment-Id: f_m3xm8j870



JVBERi0xLjUKJeLjz9MKNyAwIG9iago8PAovVHlwZSAvRm9udERlc2NyaXB0b3IKL0ZvbnROYW1l

IC9UaW1lcyMyME5ldyMyMFJvbWFuCi9GbGFncyAzMgovSXRhbGljQW5nbGUgMAovQXNjZW50IDg5

MQovRGVzY2VudCAtMjE2Ci9DYXBIZWlnaHQgNjkzCi9BdmdXaWR0aCA0MDEKL01heFdpZHRoIDI2

MTQKL0ZvbnRXZWlnaHQgNDAwCi9YSGVpZ2h0IDI1MAovTGVhZGluZyA0MgovU3RlbVYgNDAKL0Zv

bnRCQm94IFstNTY4IC0yMTYgMjA0NiA2OTNdCj4+CmVuZG9iago4IDAgb2JqClsyNTAgMCAwIDAg

MCA4MzMgMCAxODAgMCAwIDAgMCAyNTAgMzMzIDI1MCAwIDUwMCAwIDUwMCA1MDAgNTAwIDAgMCA1

MDAgNTAwIDAgMjc4IDAgMCAwIDAgMCA5MjEgNzIyIDY2NyAwIDcyMiAwIDU1NiA3MjIgMCAzMzMg

MCAwIDYxMSA4ODkgNzIyIDAgNTU2IDcyMiA2NjcgNTU2IDAgMCA3MjIgMCAwIDAgMCAwIDAgMCAw

IDAgMCA0NDQgNTAwIDQ0NCA1MDAgNDQ0IDMzMyA1MDAgNTAwIDI3OCAyNzggMCAyNzggNzc4IDUw

MCA1MDAgNTAwIDUwMCAzMzMgMzg5IDI3OCA1MDAgNTAwIDAgMCA1MDAgNDQ0IDAgMCAwIDAgMCAw

IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg

MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw

IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg

MCAwIDAgMCAwIDAgMCAwIDAgMCA0NDQgMCAwIDAgMCAwIDAgMCA0NDQgNDQ0IDQ0NCAwIDAgMCAw

IDAgMCAwIDAgMCA1MDBdCmVuZG9iago2IDAgb2JqCjw8Ci9UeXBlIC9Gb250Ci9TdWJ0eXBlIC9U

cnVlVHlwZQovTmFtZSAvRjEKL0Jhc2VGb250IC9UaW1lcyMyME5ldyMyMFJvbWFuCi9FbmNvZGlu

ZyAvV2luQW5zaUVuY29kaW5nCi9Gb250RGVzY3JpcHRvciA3IDAgUgovRmlyc3RDaGFyIDMyCi9M

YXN0Q2hhciAyNDQKL1dpZHRocyA4IDAgUgo+PgplbmRvYmoKMTAgMCBvYmoKPDwKL1R5cGUgL0Zv

bnREZXNjcmlwdG9yCi9Gb250TmFtZSAvQXJpYWwsQm9sZEl0YWxpYwovRmxhZ3MgMzIKL0l0YWxp

Y0FuZ2xlIC0xMgovQXNjZW50IDkwNQovRGVzY2VudCAtMjEwCi9DYXBIZWlnaHQgNzI4Ci9BdmdX

aWR0aCA0NzkKL01heFdpZHRoIDE5NTAKL0ZvbnRXZWlnaHQgNzAwCi9YSGVpZ2h0IDI1MAovTGVh

ZGluZyAzMwovU3RlbVYgNDcKL0ZvbnRCQm94IFstNTYwIC0yMTAgMTM5MCA3MjhdCj4+CmVuZG9i

agoxMSAwIG9iagpbMjc4IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw

IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgNzIyIDAgMCAwIDc3OCAwIDI3OCAwIDAgMCAwIDcy

MiAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDU1NiAwIDAgMCAy

NzggMCAwIDAgODg5IDYxMSA2MTEgMCAwIDAgNTU2IDMzM10KZW5kb2JqCjkgMCBvYmoKPDwKL1R5

cGUgL0ZvbnQKL1N1YnR5cGUgL1RydWVUeXBlCi9OYW1lIC9GMgovQmFzZUZvbnQgL0FyaWFsLEJv

bGRJdGFsaWMKL0VuY29kaW5nIC9XaW5BbnNpRW5jb2RpbmcKL0ZvbnREZXNjcmlwdG9yIDEwIDAg

UgovRmlyc3RDaGFyIDMyCi9MYXN0Q2hhciAxMTYKL1dpZHRocyAxMSAwIFIKPj4KZW5kb2JqCjEz

IDAgb2JqCjw8Ci9UeXBlIC9Gb250RGVzY3JpcHRvcgovRm9udE5hbWUgL0FyaWFsLEJvbGQKL0Zs

YWdzIDMyCi9JdGFsaWNBbmdsZSAwCi9Bc2NlbnQgOTA1Ci9EZXNjZW50IC0yMTAKL0NhcEhlaWdo

dCA3MjgKL0F2Z1dpZHRoIDQ3OQovTWF4V2lkdGggMjYyOAovRm9udFdlaWdodCA3MDAKL1hIZWln

aHQgMjUwCi9MZWFkaW5nIDMzCi9TdGVtViA0NwovRm9udEJCb3ggWy02MjggLTIxMCAyMDAwIDcy

OF0KPj4KZW5kb2JqCjE0IDAgb2JqClsyNzggMCAwIDAgMCA4ODkgMCAwIDAgMCAwIDAgMjc4IDAg

MCAwIDU1NiAwIDAgNTU2IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCA2NjcgMCAw

IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgNTU2IDYx

MSA1NTYgNjExIDU1NiAzMzMgMCAwIDI3OCAwIDAgMjc4IDg4OSA2MTEgNjExIDAgMCAzODkgNTU2

IDMzMyA2MTEgNTU2IDAgMCA1NTZdCmVuZG9iagoxMiAwIG9iago8PAovVHlwZSAvRm9udAovU3Vi

dHlwZSAvVHJ1ZVR5cGUKL05hbWUgL0YzCi9CYXNlRm9udCAvQXJpYWwsQm9sZAovRW5jb2Rpbmcg

L1dpbkFuc2lFbmNvZGluZwovRm9udERlc2NyaXB0b3IgMTMgMCBSCi9GaXJzdENoYXIgMzIKL0xh

c3RDaGFyIDEyMQovV2lkdGhzIDE0IDAgUgo+PgplbmRvYmoKMTUgMCBvYmoKPDwKL1R5cGUgL0V4

dEdTdGF0ZQovQk0gL05vcm1hbAovY2EgMQo+PgplbmRvYmoKMTYgMCBvYmoKPDwKL1R5cGUgL0V4

dEdTdGF0ZQovQk0gL05vcm1hbAovQ0EgMQo+PgplbmRvYmoKMTcgMCBvYmoKPDwKL0ZpbHRlciAv

RmxhdGVEZWNvZGUKL0xlbmd0aCAzNjMyCj4+CnN0cmVhbQp4nMVdW28bxxV+F6D/sC9FySAcz/0S

BEFjOzZSxEUuRvsQ9MGWbNWBQimSKCD9tX2s+9wf0HPOLLlLcw8pVTOjAnUoitQ331zOnPt2T77v

vvzyyatn3z7v5JPv3izPutn7q8WLH+dffdU9ff6s++34SAqJ/4sxdrJzyYmku2gV/ufq3fHR3z7r

lsdHT18fHz15oTqlhLTd6/fHRwo+LTvVBS2ktl3w8Bvdvf4VPvfyp9CdXcNf7s7op9j/9PL46OfZ

07lys4vlL/OFnV3MtZ6truZ/717/+fjoG8D44fjo4UNSMgrpxkOikfQD6Lbhum9ePeu60TypIvNk

8P3xoLwXKcI8WSdUvPegdN3FM0oEuzOov8xdv0TXpZcIvgDf5YC74nBBBM3C3VYiqVQUJjQjqTS8

pTi4D3jglkj0/Xyh+rN3NV8YP/t1rkL+mX5ffh48fIMdWPl58FGExMH9Rms9X2g1e1ccOVphWOTy

RKPfQ/QEllnPLmhxL2+AsCtPWKsktG5GWMMOj56Du8Ed/m6e8i5eFQe3Urh2IktbDRcGB3dafimd

EZKd2/L0HHyDvXmyRKYFvSJpVZ5uiIK/EcrTjVJ4Fi5LZJLQpx9hA5/jqw94cPO5/Vh6OAbeanj9

GmWFY8REt5DCWNCVTn6evbspjqy1aCefjLYispu6/Jk1xu45ROXpmbBHAm6fWVArytP1UqiGdL0W

joV7e7FclmcY4T5tpymZBPr/IQWC9MLTQWsayaXi/K1OIrTTmK3RwjLT3cFeM5HE0pviuoTFy70h

TzA6eUPk+t1cp7V9UBoZzpBvSBTgeEsDBLBRALpQcrbclVb0u8IDWhvYKggZdmXIig4TXfeneQHO

cFif0xAfNBg9aY9aoRM3mJdZfV5EMACVgakJeU9cLOcOJ61XUMCeSPmfi+7b+cKTl+AZfaS4caFx

FZnh3uJE9YY7jM70Fu0JqE8jvfHiQ2a1WfcVGQf5df7IGxJzb/Ht/JLWBP+mQlsYiK7yB/OXBtwt

9XQDcHk1mNdZgv5j/KfXRnj+MK38xe/09eJuMAsT5ww3f+XPnpYkTKfhyAwl4+warxFDr8/xTVF8

IC6RWXwn3jueNlPE0zbt+5NKaHPvEdmHj8jwoslHMIQ+nSa4/GTwhm6/bx50KUwhRy9UZJAfuDEn

4RL5Ghk4knjvQdjh/+kHlHyflx6EUk7Y1Ixz73pk4G5RwF/cwAm8epAKN4kMuoZU7YjaCHoaB0cC

5uJ3DDnQ0j5Ixk7CBytMQ7YhCMXsIjSkpQaDBQ/tw2zNSegECrFrxxRMk8AxhZHI7DE4Kc5TS4eI

rXhqGfdMa9azPuC/D/LKTyIbIwwrFssTNR6jcQzcGzydq6s3xVFBF3DtrhoN9odlSG6dz1XxS1UH

J/hbrjzTEEXwHNwVqrsKlWqblzbr1KUHYZTEj7bibJQRzAxXFr5G+z2zXZ6oTsIzcMh07Rgx8g/F

oZ0Sd71ldjRlVzVK7oPB6N7EwjuZaD6eF3eIRSucZKAr2HAR1AvLwl2S/490qtX1gzRkLmsDzNVW

VBW8pQIHVy0lwCgRVTuSxqI/mYHLPglyaKA1/s/i6M6SbtOKrKNwOHtMVcyn9PxBWsZ0xoEVoeGq

ejimLNwlbd3r600M8W3vtoef6ezWDCyizw61vEYzoZUVzIpXiZFrizH5Zux0IA2dWed8fCs5D7Wj

VItmVEFUMJKCjm4Rc28S2JumPL1HnzYDlxOxlhvnMqywMbP+59KxP6lJpWxE3IBZvUeF2mQAFI9A

GXS8tTuzRoE9zwrA0Y2bXy6HMEH5YLKNe8RHeeZOisBLK7qEKiX8mqAwqbYZU8CJ7Bqf50gHCOXi

2qOJDhMwmvEEc4C/7u4Y6Co+CdbAPmtnJ1h0k7F2QpbYD/duTMex4E5sp1VaF1htvRt5N64/lI/a

W2Ha2QkI51itkU4u3b61kgG8iyI4Jg1j1dvYfSrrEDbth4RRY1gB5cYR5HH4eXT++D9AUPk1hr1G

ce/Rp6Yvq9EHSNLlXw1/i/7KOsRt9JB0YfRE7HxIvLhjQB7j+3+c99+6Lq8VgdqrPbdEi/JwlrTP

abh/lYdLaC61IgeqdWC3O2WU0cqOtsE68aXQ9oP3TqvkglubMJLPUKsgmjUJyGm48R2UD8lp1WQm

b0lcfzqM53P0J6SNNtvLnrejDJnx8t4OuTvw8ey0yMLvNjuj0rZEW9u5d8zEAWnTB393vtdvLHr/

ZAOTse+XHTROKENfeFgPea3nDqC/DJu1vImTvIiJW5fbIQUqD2i8Ci8wOPMRf3fb1wOtE9GZL7zC

WGTmcTWvofSEJGzguJQ/WTGfrGm4QRfAfVI+UQnL0tQdue4EO3yZRCU0jidylbyOmK9y30GFuhEY

sOX17qDq1ykywDXqFC0PV7NOEXNoGpFUWmKSNwM3XOBMnWK9GkXPDqpKjaJk4bJ8Xa19+KWx+0ye

VlSTphSpaTi43VMF77X0dIs0oohJPGkarW7gSStPnqhWPBVczp6Do+P5n8HmLF4QCSe0IVcbyRKc

hht5vVA1yAcW7PKF7wVU8fC4jkk4djzl6Sf4KAuXi6jRDi9vo8okQrtlNqABKRYO1/bi17lJQwV1

jWCbsYGTH5Uc9extT/YyLmx/B2316cD7uP/AQrns7x0VhRXf81ZJrE9rNTEWC06YmelGaT7nFere

qHaiGVFtsEEKA5fX+d+w9c8m/ZDF3bFgcTRcZB/IdcNs//JLG8Ie9aeCQSspQ3yfBVGzrt5JTUGL

RnTXhqGUwu+a0FXLq5IVXkYOuoZpqC0Ld4pnc+TCKZ/ipBXVrzRiq7SlqNsU3FYwqnwPF2OEdu2I

Goc4DNwnwZlKZ1Y5RwGxVpRdJAk8DXe5di6WRgVRYRqSDE5IluTtOPihql+xWhnBHKYqVqIXhpXJ

3xLhdSxnUKkHZ/tJeVMuYGubZvxt4mf7unz2C6awKXa+K6SwOcrz4a7catkvGjQp13AZQZPSHNqo

N8bIQXmam2UsP9bJ/jGSHCCN+Bu8CJnpHjXHOCnunzQ2Z3NN8ywfpsaCVXZac4gPPbF6E2QoHggy

UVGi1Z1WdifmEqsGgly0WLFw30GlSoEg2JOg77ughM+Dyr+5Olu/+nEICZHjJseCv0CxlCOYL+Hf

IX9k4TddLoprdgEn7uBQy9tE/RyBmhXTHuDvc0X0Jmq+hAkrXtMT0IFzcCjl1S/0IprDwF+Uj6Vp

XO5HYIwWtzsM/N0FFmUOTuubTWeX2wqGhcGg2mhM9xEhqlbH4v58WI9qEz9TX4MMOR0u9/FFUH6m

cvHbwTHVKoM7CEye8JEb+NNMkfPiA8t9JB5hRsBagN16ABjjerov9y2eXoYWcngU7l6hJ+Ag8Jb9

SmdjbL9WqVfRoBzpxzghWmoR73BCHsOwBRUdLIJHmBPjhTuMW/x21SYh4iMQho+C0XsQeN0iLYya

au/WX47S6+DwnG10UR03yih8L0T7J9g3ZnZGiuwosfs8981CbXbT5bl4TiF8Y+u47bm6h7nYzJPF

RIG+AFgKGxLYN4j7/rOpm75Iz32PAespCwYUcTBk761+1Oq536sfWmLvVn4r/QDqx2p3a2zatO8Y

Nj+iMfP1XPvZ0/zKgUwKs59qXBLRHCZQ3rBBv6LtLHwx7AOmiaCZ66vO+pSx3HauuAJlMZZ6cFAV

NDePJ/QgcAUTJ6Fh+wiMtRb2DlOtjTbltUKLCvoI+16ypExXQS78iSF0uyvh6ufFMsC18mIZuJEP

I3t0auWIYk60a0ZaGSkiC3f6SWFMebZYz5vasXUGExcYONJ4hrQkclpsP++hUkdqFQN2Imo2Czk3

dxKuqsmJ5lVqt7e1NGho7j3QzTKQMD7oWClaJT6YWLgKXUs8Jky0o4c9uDm0Bg/2iE7wV2KFKGEQ

noXbLkGrkCkLFk8rppgpy6Ix7Z2Lh+rA/G9H2FEX+WlZXDUdFOt0bbsTiw+6kOzSXtImXuX79b91

etHAIeJmuspjLyT6vDm+0/2zhkL78nWAoFfGdvt6P9yr/vhufJfo+S/f8sFZTPptRtmBlDbtrlxM

Mg4NVzRIrCBl4Eb+x6wtF085Tpjh3Irs2uZ1mn4zXSOZM3/7CEXxWJ3B2DIzgAqhbI+psAxcPqOU

cHQ2lGOcD9Xm60AdVq1T24/y89Fbbq3mwzl0P+5d/5oKpgrUsbsZ3ZjN8Gm43AqG6K4+jeeXT2nR

KtI93Yg6Pu7Raw6ueOWZ1h67Hrdjl0jrOniu1w010J9ddXV9IlOmFX8Q5I5d3QpmcCT7pRW7SG0H

GbhldSllZBAsfAXbkB5vycCtw5fGzPrnXdV47A/mq0p2Px300Bd4ys6eLEprvPg/HkVet6G5nXgY

ESUFVmrTmDR8Mk7Clo8Y9AGKCayboaT1ZmPUVQgWKMxfakJWaYPlo1NYfRnvzbjWpApdm8ih24Su

U2Q8TmCdZlfxRt4sTyvRTdQupA3dRL1CJuliSGTvk93Nbp5nrQYFXmKaRZMpQR+zn8ZajurT+zoM

dGhsPbUU3i3e7N5IsMEb0e97N09h9eVz5YtPVPZzN6GnJb41hVW+3UR+ZHMjXkEw1+5I3b+8WG5l

HRd39lJGVxvCgGWmL+HJ9o/9wzvpjNbtOQCGbKvLGXs7xOnbqvhutpqy9hrxSpT4tINVt2G/NZHT

daq5GmVE0f44Zk2ygB25MRy0IAp1CZyyafDp4aDO33tIdXsEmpDE7tb4a/VUqGncWplQU2jjc1f+

OQpYyuVCK5pYv5U4tKzR5eXc6jm/7l+91S+4gvtZqWbz4Cj9aBrtbZ/duqyQ9USJ261IRi8chzbh

CE2V/aCgpnl9N/Ik3f4HKJ5YOAplbmRzdHJlYW0KZW5kb2JqCjUgMCBvYmoKPDwKL1R5cGUgL1Bh

Z2UKL01lZGlhQm94IFswIDAgNTk1LjkyIDg0MS45Ml0KL1Jlc291cmNlcyA8PAovRm9udCA8PAov

RjEgNiAwIFIKL0YyIDkgMCBSCi9GMyAxMiAwIFIKPj4KL0V4dEdTdGF0ZSA8PAovR1M3IDE1IDAg

UgovR1M4IDE2IDAgUgo+PgovUHJvY1NldCBbL1BERiAvVGV4dCAvSW1hZ2VCIC9JbWFnZUMgL0lt

YWdlSV0KPj4KL0NvbnRlbnRzIDE3IDAgUgovR3JvdXAgPDwKL1R5cGUgL0dyb3VwCi9TIC9UcmFu

c3BhcmVuY3kKL0NTIC9EZXZpY2VSR0IKPj4KL1RhYnMgL1MKL1N0cnVjdFBhcmVudHMgMAovUGFy

ZW50IDIgMCBSCj4+CmVuZG9iagoxOCAwIG9iago8PAovUyAvUAovVHlwZSAvU3RydWN0RWxlbQov

SyBbMF0KL1AgMTkgMCBSCi9QZyA1IDAgUgo+PgplbmRvYmoKMjAgMCBvYmoKPDwKL1MgL1AKL1R5

cGUgL1N0cnVjdEVsZW0KL0sgWzFdCi9QIDE5IDAgUgovUGcgNSAwIFIKPj4KZW5kb2JqCjIxIDAg

b2JqCjw8Ci9TIC9QCi9UeXBlIC9TdHJ1Y3RFbGVtCi9LIFsyXQovUCAxOSAwIFIKL1BnIDUgMCBS

Cj4+CmVuZG9iagoyMiAwIG9iago8PAovUyAvUAovVHlwZSAvU3RydWN0RWxlbQovSyBbM10KL1Ag

MTkgMCBSCi9QZyA1IDAgUgo+PgplbmRvYmoKMjMgMCBvYmoKPDwKL1MgL1AKL1R5cGUgL1N0cnVj

dEVsZW0KL0sgWzRdCi9QIDE5IDAgUgovUGcgNSAwIFIKPj4KZW5kb2JqCjI0IDAgb2JqCjw8Ci9T

IC9QCi9UeXBlIC9TdHJ1Y3RFbGVtCi9LIFs1XQovUCAxOSAwIFIKL1BnIDUgMCBSCj4+CmVuZG9i

agoyNSAwIG9iago8PAovUyAvUAovVHlwZSAvU3RydWN0RWxlbQovSyBbNl0KL1AgMTkgMCBSCi9Q

ZyA1IDAgUgo+PgplbmRvYmoKMjYgMCBvYmoKPDwKL1MgL1AKL1R5cGUgL1N0cnVjdEVsZW0KL0sg

WzddCi9QIDE5IDAgUgovUGcgNSAwIFIKPj4KZW5kb2JqCjI3IDAgb2JqCjw8Ci9TIC9QCi9UeXBl

IC9TdHJ1Y3RFbGVtCi9LIFs4XQovUCAxOSAwIFIKL1BnIDUgMCBSCj4+CmVuZG9iagoyOCAwIG9i

ago8PAovUyAvUAovVHlwZSAvU3RydWN0RWxlbQovSyBbOV0KL1AgMTkgMCBSCi9QZyA1IDAgUgo+

PgplbmRvYmoKMjkgMCBvYmoKPDwKL1MgL1AKL1R5cGUgL1N0cnVjdEVsZW0KL0sgWzEwXQovUCAx

OSAwIFIKL1BnIDUgMCBSCj4+CmVuZG9iagozMCAwIG9iago8PAovUyAvUAovVHlwZSAvU3RydWN0

RWxlbQovSyBbMTFdCi9QIDE5IDAgUgovUGcgNSAwIFIKPj4KZW5kb2JqCjMxIDAgb2JqCjw8Ci9T

IC9QCi9UeXBlIC9TdHJ1Y3RFbGVtCi9LIFsxMl0KL1AgMTkgMCBSCi9QZyA1IDAgUgo+PgplbmRv

YmoKMzIgMCBvYmoKPDwKL1MgL1AKL1R5cGUgL1N0cnVjdEVsZW0KL0sgWzEzXQovUCAxOSAwIFIK

L1BnIDUgMCBSCj4+CmVuZG9iagozMyAwIG9iago8PAovUyAvUAovVHlwZSAvU3RydWN0RWxlbQov

SyBbMTRdCi9QIDE5IDAgUgovUGcgNSAwIFIKPj4KZW5kb2JqCjM0IDAgb2JqCjw8Ci9TIC9QCi9U

eXBlIC9TdHJ1Y3RFbGVtCi9LIFsxNV0KL1AgMTkgMCBSCi9QZyA1IDAgUgo+PgplbmRvYmoKMzUg

MCBvYmoKPDwKL1MgL1AKL1R5cGUgL1N0cnVjdEVsZW0KL0sgWzE2XQovUCAxOSAwIFIKL1BnIDUg

MCBSCj4+CmVuZG9iagozNiAwIG9iago8PAovUyAvUAovVHlwZSAvU3RydWN0RWxlbQovSyBbMTdd

Ci9QIDE5IDAgUgovUGcgNSAwIFIKPj4KZW5kb2JqCjE5IDAgb2JqCjw8Ci9TIC9QYXJ0Ci9UeXBl

IC9TdHJ1Y3RFbGVtCi9LIFsxOCAwIFIgMjAgMCBSIDIxIDAgUiAyMiAwIFIgMjMgMCBSIDI0IDAg

UiAyNSAwIFIgMjYgMCBSIDI3IDAgUiAyOCAwIFIgMjkgMCBSIDMwIDAgUiAzMSAwIFIgMzIgMCBS

IDMzIDAgUiAzNCAwIFIgMzUgMCBSIDM2IDAgUl0KL1AgMyAwIFIKPj4KZW5kb2JqCjM3IDAgb2Jq

Cjw8Ci9OdW1zIFswIFsxOCAwIFIgMjAgMCBSIDIxIDAgUiAyMiAwIFIgMjMgMCBSIDI0IDAgUiAy

NSAwIFIgMjYgMCBSIDI3IDAgUiAyOCAwIFIgMjkgMCBSIDMwIDAgUiAzMSAwIFIgMzIgMCBSIDMz

IDAgUiAzNCAwIFIgMzUgMCBSIDM2IDAgUl1dCj4+CmVuZG9iago0IDAgb2JqCjw8Ci9Gb290bm90

ZSAvTm90ZQovRW5kbm90ZSAvTm90ZQovVGV4dGJveCAvU2VjdAovSGVhZGVyIC9TZWN0Ci9Gb290

ZXIgL1NlY3QKL0lubGluZVNoYXBlIC9TZWN0Ci9Bbm5vdGF0aW9uIC9TZWN0Ci9BcnRpZmFjdCAv

U2VjdAovV29ya2Jvb2sgL0RvY3VtZW50Ci9Xb3Jrc2hlZXQgL1BhcnQKL01hY3Jvc2hlZXQgL1Bh

cnQKL0NoYXJ0c2hlZXQgL1BhcnQKL0RpYWxvZ3NoZWV0IC9QYXJ0Ci9TbGlkZSAvUGFydAovQ2hh

cnQgL1NlY3QKL0RpYWdyYW0gL0ZpZ3VyZQo+PgplbmRvYmoKMyAwIG9iago8PAovVHlwZSAvU3Ry

dWN0VHJlZVJvb3QKL1JvbGVNYXAgNCAwIFIKL0sgWzE5IDAgUl0KL1BhcmVudFRyZWUgMzcgMCBS

Ci9QYXJlbnRUcmVlTmV4dEtleSAxCj4+CmVuZG9iagoyIDAgb2JqCjw8Ci9UeXBlIC9QYWdlcwov

S2lkcyBbNSAwIFJdCi9Db3VudCAxCj4+CmVuZG9iagoxIDAgb2JqCjw8Ci9UeXBlIC9DYXRhbG9n

Ci9QYWdlcyAyIDAgUgovTGFuZyAoZW4tVVMpCi9TdHJ1Y3RUcmVlUm9vdCAzIDAgUgovTWFya0lu

Zm8gPDwKL01hcmtlZCB0cnVlCj4+Cj4+CmVuZG9iagozOCAwIG9iago8PAovVGl0bGUgKHJhYmFp

cyBsb3llcikKL0F1dGhvciAoTU9OQSBPVENIT01CRSkKL0NyZWF0b3IgPEZFRkYwMDREMDA2OTAw

NjMwMDcyMDA2RjAwNzMwMDZGMDA2NjAwNzQwMEFFMDAyMDAwNTcwMDZGMDA3MjAwNjQwMDIwMDAz

MjAwMzAwMDMxMDAzNj4KL0NyZWF0aW9uRGF0ZSAoRDoyMDI0MTEyNDIwNDAzMCswMCcwMCcpCi9Q

cm9kdWNlciAod3d3Lmlsb3ZlcGRmLmNvbSkKL01vZERhdGUgKEQ6MjAyNDExMjQyMDQwMzBaKQo+

PgplbmRvYmoKeHJlZgowIDM5CjAwMDAwMDAwMDAgNjU1MzUgZg0KMDAwMDAwODU4MiAwMDAwMCBu

DQowMDAwMDA4NTI1IDAwMDAwIG4NCjAwMDAwMDg0MTUgMDAwMDAgbg0KMDAwMDAwODEzMiAwMDAw

MCBuDQowMDAwMDA2MTM2IDAwMDAwIG4NCjAwMDAwMDA4MjEgMDAwMDAgbg0KMDAwMDAwMDAxNSAw

MDAwMCBuDQowMDAwMDAwMjY2IDAwMDAwIG4NCjAwMDAwMDE0NjggMDAwMDAgbg0KMDAwMDAwMTAw

NSAwMDAwMCBuDQowMDAwMDAxMjU2IDAwMDAwIG4NCjAwMDAwMDIxMzggMDAwMDAgbg0KMDAwMDAw

MTY1MSAwMDAwMCBuDQowMDAwMDAxODk0IDAwMDAwIG4NCjAwMDAwMDIzMTYgMDAwMDAgbg0KMDAw

MDAwMjM3MyAwMDAwMCBuDQowMDAwMDAyNDMwIDAwMDAwIG4NCjAwMDAwMDY0NjEgMDAwMDAgbg0K

MDAwMDAwNzc4MyAwMDAwMCBuDQowMDAwMDA2NTM0IDAwMDAwIG4NCjAwMDAwMDY2MDcgMDAwMDAg

bg0KMDAwMDAwNjY4MCAwMDAwMCBuDQowMDAwMDA2NzUzIDAwMDAwIG4NCjAwMDAwMDY4MjYgMDAw

MDAgbg0KMDAwMDAwNjg5OSAwMDAwMCBuDQowMDAwMDA2OTcyIDAwMDAwIG4NCjAwMDAwMDcwNDUg

MDAwMDAgbg0KMDAwMDAwNzExOCAwMDAwMCBuDQowMDAwMDA3MTkxIDAwMDAwIG4NCjAwMDAwMDcy

NjUgMDAwMDAgbg0KMDAwMDAwNzMzOSAwMDAwMCBuDQowMDAwMDA3NDEzIDAwMDAwIG4NCjAwMDAw

MDc0ODcgMDAwMDAgbg0KMDAwMDAwNzU2MSAwMDAwMCBuDQowMDAwMDA3NjM1IDAwMDAwIG4NCjAw

MDAwMDc3MDkgMDAwMDAgbg0KMDAwMDAwNzk3MiAwMDAwMCBuDQowMDAwMDA4Njk2IDAwMDAwIG4N

CnRyYWlsZXIKPDwKL1NpemUgMzkKL1Jvb3QgMSAwIFIKL0luZm8gMzggMCBSCi9JRCBbPDExNzk4

RTVGN0IyRjM5NjI1RDFDMDcwOTNEN0JBQjFGPiA8MjAxNkI2NDg4NzZCMEExRThDMTUxNzIyQjIw

MkRCNkY+XQo+PgpzdGFydHhyZWYKODk1OAolJUVPRgo=

--000000000000c59bd60627e6643c--