More Paypal phishing from Outllok servers

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 08 Feb 2023 15:41:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pPt6p-0009pp-1P

for dave@doctor.nl2k.ab.ca;

Wed, 08 Feb 2023 15:40:11 -0700

Resent-From: The Doctor

Resent-Date: Wed, 8 Feb 2023 15:40:11 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dbaeur03on2102.outbound.protection.outlook.com ([40.107.104.102]:21536 helo=EUR03-DBA-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pPnpu-000Ghp-2H

for doctor@nl2k.ab.ca;

Wed, 08 Feb 2023 10:02:26 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=GQ46D6alZeuYBFz5bMpTTxyWH+lUu9rtStr+gmmdsd/JYKjo6Jo5/WiHZbLLcLWvrY+QnS9zNuSpTA7cFGCke8hrTgNu+18x/AIEr8BsajZc1n/daeSte9bLClXopHP6UMy0N3riSZSV0DqnUThtoX+F+BD0Ee7fJdZkquMjxiYNH4tjhhM+z+Kz3ODrjwMo851NK5Xu/PY0RisRhds5RsXFSh6wGIW3mq4OqNGnqJUCo9my2Zk8VZPs71yCFxHazWGeQ0uO7ejmqnYqsC2iHoWRKMnywv5WpSSipLP3lZjI0lpNO8a3uFbSMUA8V/FMqEPj5RyQNQHBs3leOQxBxA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=pMs8nfXyn2uwCdAlvazLU9YW9eWjEWklzDBb4AWDLFE=;

b=Hugsxnlf1qDns61R99V7nRJixqhydbueQZnmz9jQPBoaRNvKTi4958GHqI9bEfzjBGmQ6RtwBuWXPDkyeX/D92srDaZbCnfpewwdoYvOTttGu6omz197FcX9sDmfzLkwktvaP2uXAIdqPHZAhZzvenBMqvdX6pYKTLI2M3XRes0ubuBWJJ79a0lYbeblv0jMezYWC3LSxcFKPjq6UrsKRhHguhZz9W6nlkuTdSW0oBqdljHyNYhHKXjJxYNozwWtMnXaahQflTwJo+1ca281OGcIz+8s0VYg1eqqqzAIPmULG10fcom/AUrfYr6f3lO0CTxfpuGWKN6SMI0Cxy2+UQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=alnashaa.sch.ae; dmarc=pass action=none

header.from=alnashaa.sch.ae; dkim=pass header.d=alnashaa.sch.ae; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=NASHAALSALEH.onmicrosoft.com; s=selector1-NASHAALSALEH-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=pMs8nfXyn2uwCdAlvazLU9YW9eWjEWklzDBb4AWDLFE=;

b=VK86/EnjPZiKzz7Br9ycFdm783YgZaJtjSsdlaHMUhlLJMZF4kdEkscXWvF1aVd2+pqeb4cvvoT6xh1MRrqtnpep/toHwszUewzK9c9hcrYlScvwNxLNZO1oruswTvdWKI+SCoaU8BMEAwUU5bDAMDr+GJQe9WD4II/0iX9sfFY=

Received: from PAXPR03MB7936.eurprd03.prod.outlook.com (2603:10a6:102:21b::16)

by AS4PR03MB8555.eurprd03.prod.outlook.com (2603:10a6:20b:582::11) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6064.34; Wed, 8 Feb

2023 17:00:14 +0000

Received: from PAXPR03MB7936.eurprd03.prod.outlook.com

([fe80::58e9:7483:e05b:614e]) by PAXPR03MB7936.eurprd03.prod.outlook.com

([fe80::58e9:7483:e05b:614e%5]) with mapi id 15.20.6086.017; Wed, 8 Feb 2023

17:00:14 +0000

From: Mohammed Adra

Subject: PayPal Billing +1 (808) 229-4114

Thread-Topic: PayPal Billing +1 (808) 229-4114

Thread-Index: AQHZO9nXj5lXcmICCUi0UY9u3NIwLA==

Date: Wed, 8 Feb 2023 17:00:13 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

authentication-results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=alnashaa.sch.ae;

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: PAXPR03MB7936:EE_|AS4PR03MB8555:EE_

x-ms-office365-filtering-correlation-id: e130c737-c759-4c32-429b-08db09f5f225

x-ms-exchange-senderadcheck: 1

x-ms-exchange-antispam-relay: 0

x-microsoft-antispam: BCL:0;

x-microsoft-antispam-message-info:

ywtrka7l+yy0GZQk56ZLy8sOA38Q7OrU90DwPiONbkMt5nBbnslKosM/coQjshrGgJwQoyabSV+iCjm1PmGHjCPA4oB5PXgwAXgJEVK21KidBQCgdPb3rvagY0x4nZTHakNvK7DQ2C7EJTyO9u2vVoRKCz8aHHSU7oh1BmUaxfhvWAwrSfWH3WwsuYjCRN10Z1D+DDeXkyZx/TPfBY0LPV6ZIQgOlHp3oOR3URiM3hyjpLjASJKlswPUg4T6goge0bsnLiCQAT5yb9iOFpYEA8Sd650a91QgBpGyU6cJ4M5xWj4nfwjBEHL088pANOmfGx5naESUaOCGy4BZ/pLGw3r73a68/T2nxVQOtotZ7LMoafZUaJBwbCGanBjV0bSBAMWwDKDMEvTqeFu9CXuaPW5lfrri4VyPuyEgAhcUQRzm8rcyHjDCeG13ttoEawhR4zF+YS/Jlnz3593Bmf0qWzhJRH2pgi5ktLrNVohaZhfQMhxafJW3m56RGCaWxG6cCtvyZTS3LY/Oam1JQj3S1XQ5JINRcNxNOyFd9bJ6vCraWhTP/HfnUBLBnqMtGkb3aukzvVFCbeC1i3mgu09i65Y39Ks1GtNZX8Y+vLdlEDP1yBFdChvyt+PZb4sUIVjIAzTraFXeqgZSFI8eURf7C0c5k8yPf1po85tdbqkLYHsqFr/UELRlzxrtHwGSIfN6PLTyuOx3rSbjokttFgxROw==

x-forefront-antispam-report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PAXPR03MB7936.eurprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230025)(376002)(136003)(39860400002)(346002)(366004)(396003)(47640400002)(451199018)(109986016)(38070700005)(4744005)(86362001)(19627405001)(41320700001)(5660300002)(38100700002)(2906002)(52536014)(8936002)(7406005)(7336002)(7276002)(7366002)(7416002)(122000001)(66446008)(66476007)(41300700001)(66899018)(8676002)(64756008)(76116006)(66556008)(91956017)(66946007)(55016003)(10130500003)(71200400001)(7696005)(316002)(786003)(33656002)(83380400001)(6506007)(40140700001)(4743002)(9686003)(186003)(26005)(89122003)(478600001)(76576003)(88732003)(32160200001);DIR:OUT;SFP:1102;

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?l2RuPY0DWCaOCGdHcXimvL9V27DAiceyPpjNfBv5sFtctqTk/kGrhHXymW?=

=?iso-8859-1?Q?X0DTc7Nm4FCg/G4NtuxzVF5pGv/AOE4LEOw7Vc0vD+BuzTiG4ZxVAbC2kH?=

=?iso-8859-1?Q?TQMMxuK36wFz8Bt50bxHOPjfx+MUTSpE/M+67rSBvs9tRrBDYuCMMo/x6I?=

=?iso-8859-1?Q?K3lp/5o+vtkQ9d2ldLHe8UXceBKckcd4yi92vzze+b2M5wKRf/6ZJMKCNn?=

=?iso-8859-1?Q?FZnVQBFMuc/dAcRQT/k2JVH78EWx1DZRnEuV85/MXQKBo8oQiqa6hHEj9L?=

=?iso-8859-1?Q?BVszMiDGLeqmY2Rjkyip7yT50t5ktvM4M+zGaz7nzUcL1LI6B/4z/fjUzA?=

=?iso-8859-1?Q?27eoZlfm1ybgCOEK2f+jed7XnUrttabh8mhE9MGXT3BXwHqAMfFAiSoc3V?=

=?iso-8859-1?Q?O/q+Px5qJp0wxz+VJjh2yh/DgG7FsB6OpEfZOvHmx/tOe3uIrWuEP1iED3?=

=?iso-8859-1?Q?B/PMtyYq0bAds6yHiuEvINo8xbJgnoLC6lsDQUekyn/JygEv0Hq9YEv2PC?=

=?iso-8859-1?Q?fV9DOoSlxYFSaJ6aiOTirW0dLTxa1zoi+OgRf5sV23mtZIRGPSxPxCIHll?=

=?iso-8859-1?Q?zCffp/zeX7PF9IhW5Dy1oMHWWk96cDrZ8zdI3Sx97GWcA6fF8yYavNPPKX?=

=?iso-8859-1?Q?NKECPzwJdjQHJKuLk5hjh4lk9UWXLDIOmEpKhbeN/4v+7iL+CyF4NmEAjm?=

=?iso-8859-1?Q?mCABvF1y7rzSQhf0ODorrVcI+J2hP5b6+FjPf00O4ov8qXVSzuGf8HH/+H?=

=?iso-8859-1?Q?5xEgroWXasjkOnMiyH5czcHwAEE6fHrFt4h4/137pn0tjET+aoM8AryIxK?=

=?iso-8859-1?Q?gH2az+77GJUbSAFJ9Ek+NQHLRlQh477CTviqVUPeAcC3CWZx0kR8oLivq+?=

=?iso-8859-1?Q?SzAkwB81BGzmWj0SHVsAnMBfk1+XLCQwGda+C22BBmJ7G2sdpZGx643Vxx?=

=?iso-8859-1?Q?G79Xfdwn2bLZvcHdWWF+JTAq+jHrNQrivr5kKhsRe2Pfb+Xg6KnfR1KDUi?=

=?iso-8859-1?Q?zU0Gnhabh2yePvELJlTad+hjvcTX54ufAlXDBPqvK2V2o7WJ3VMZHFxtic?=

=?iso-8859-1?Q?5LClda7cAc0D9EpL5dtCQ/U+aRcND2lTyyYI6IfcYlMriduMl3HnxnxTAR?=

=?iso-8859-1?Q?qtmcjjAgCtEqvwts57z+peyjqx8rggWEz1cYVpe36AIGTKu8xaN1Ahg7rW?=

=?iso-8859-1?Q?0Lh4FpguF/mILG7NnTqvmnXNZ2u2yTsFppd4dHoR8BUWqUOKXxjfPImScy?=

=?iso-8859-1?Q?XARBfbsjiaBol7LynefkKJ0RS7wuop9KoCenFIsapP2pcraZg/pgKdW2+W?=

=?iso-8859-1?Q?nO/WJWij94AjvjALebd/E7cz6RWT6rqvQmPzJSmYVDBt3lfpHmwNG8qK1T?=

=?iso-8859-1?Q?jBYqyBeDT3FarN8DcEckAxC6dy+5Zt1uGY1Jw1xoZmDPEHqMtftzTNe8V3?=

=?iso-8859-1?Q?n64Juw9dLD66DK4fNO2s60y+KNiwWqG5eog7nHdnP/akrTZgFiWeDX4WFR?=

=?iso-8859-1?Q?QY/2X4a6fabZgNuyId6Fl4d4M7pIYLm8P6HjqbHl9dhhl6FR2SmN0c/gXP?=

=?iso-8859-1?Q?//wu4VN9kSA7Cdv5/442O0Dq3nL0pltnIH3IsqBmJfb1URLoVdQh0QfqWW?=

=?iso-8859-1?Q?+jGkFp/zKj7pU=3D?=

Content-Type: multipart/alternative;

boundary="_000_PAXPR03MB7936F333E60333A5A17422EF82D89PAXPR03MB7936eurp_"

MIME-Version: 1.0

X-OriginatorOrg: alnashaa.sch.ae

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: PAXPR03MB7936.eurprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-Network-Message-Id: e130c737-c759-4c32-429b-08db09f5f225

X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Feb 2023 17:00:13.6910

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: ea5ba3f9-b226-45ac-aa3a-ab73ece20119

X-MS-Exchange-CrossTenant-mailboxtype: HOSTED

X-MS-Exchange-CrossTenant-userprincipalname: SAaMhFG1rY95AfqzBJixNwjFn2U739Rdx9mmIUqe4JOJRVE9SDZX7Oxl5t2ZIGcPVl/UcM14kBUq791q3wKnAg==

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS4PR03MB8555



--_000_PAXPR03MB7936F333E60333A5A17422EF82D89PAXPR03MB7936eurp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Billing Support: +1 (808) 229-4114



Date: 02-08-2023



Invoice ID: IB30156899



Dear Customer,



We would like to know you about your recent purchase of $1022.00. This char=

ge will appear on your statement as PayPal Coinbase within 24 hours.



Delivery Information

Online Delivery



Payment Method: Debit Card

Amount: $1022.00



Product Purchased

Acer Nitro ANS 5 Gaming Laptop



Merchant Information

sammehand22@inorbit.com



Not sure why you received this email? Call PayPal support immediately at +1=

(808) 229-4114.





--_000_PAXPR03MB7936F333E60333A5A17422EF82D89PAXPR03MB7936eurp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class=

=3D"elementToProof">


)">
255, 255, 255);display:inline !important">Billing Support:
ntentPasted0" style=3D"margin:0px"> 

asted0" style=3D"background-color:rgb(255, 255, 255)">+1

(808) 229-4114

round-color:rgb(255, 255, 255);display:inline !important">    &nb=

sp;                     &=

nbsp;                    =

     



: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class=

=3D"elementToProof">


">






Date: 02-08-2023


      &nb=

sp;                     &=

nbsp;                    =

                    &nbs=

p;                     &n=

bsp;              


Invoice ID: IB30156899
div>






Dear Customer,







We would like to know yo=

u about your recent purchase of $1022.00. This charge will appear on your s=

tatement as PayPal Coinbase within 24 hours.







Delivery Information
v>

Online Delivery







Payment Method: Debit Ca=

rd


Amount: $1022.00







Product Purchased


Acer Nitro ANS 5 Gaming =

Laptop







Merchant Information
v>

sammehand22@inorbit.com<=

/div>






Not sure why you receive=

d this email? Call PayPal support immediately at
d0" style=3D"margin:0px"> 
+1 (808) =

229-4114
.















--_000_PAXPR03MB7936F333E60333A5A17422EF82D89PAXPR03MB7936eurp_--

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA