Lowe's phish from Microsoft Outlook

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 19 Dec 2023 16:16:01 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97 (FreeBSD))

(envelope-from )

id 1rFj4V-00000000M1m-3LXi

for dave@doctor.nl2k.ab.ca;

Tue, 19 Dec 2023 16:00:19 -0700

Resent-From: The Doctor

Resent-Date: Tue, 19 Dec 2023 16:00:19 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-mw2nam12on2052.outbound.protection.outlook.com ([40.107.244.52]:17600 helo=NAM12-MW2-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97 (FreeBSD))

(envelope-from )

id 1rFcFQ-00000000AYU-20hU

for doctor@doctor.nl2k.ab.ca;

Tue, 19 Dec 2023 08:43:18 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=LoWE4S7q/wckkknDxwUBIhhk3q4YRXTAOFlEPll1ZOpFcDLA5cp5JoPrhsjCU/sd2/P0GnKbIY6Fx0CuPUArLXFl3frrNJExZ/Q6dxXhj3QTGowNny6aRXirVKzSoeG808+hjTAF2CLPgl3QxbRl7ooD7aEPXZviJE62AImOvBMxP9txtbYNOwwl8Qh1P9tVKShru+JkThpgJjr6OTHEWV7/E7ZrMRVumojMtVxsGls6RUSvIcRbOnGX/0FrmvFfEUpTcsNGT5OPLJys465Y4EHzdAHb+0cilGBO2bAxFBGtxKukrl99DAUhDbT5cBhaYtmAJLHXp9UI86AeOFjttw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=tcgc2P+iBn1x/7osGEyFM/+1lsHBtBV8o4J0mYZkUoY=;

b=XfAClcitBFYC5YZuP+SOEaPlEhVFlTQihHyJX0CrZBPcU/IuXXpXEuJu3ifJ4UlZw7Yka8Ht28NDVfo12mMM46l4Ken8A1+fsx9bg45Rk78Cc/f002EsDc0DdDP8T6xlJUw6wqmBV6pFXC9eQAHoTZnU3cMP5Q/vs8dWNaEqPWkdvrxfIToPERRCJfFYi4gMgk+rVvckpUFMgtFDOfcGhnTSMvXVjkoeKzzGLHbbd1Ej8LVu9MmENWjKzYzwSvuBjOtAKV2/lmLUAyjiQoVKsbL7TCh2kHOe2KfetsqA1K9+Ue1izp7eZ1Ur5SgEjB+C10TQ1PLvCd05uo8ghLXD4g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

172.234.25.141) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=xc2h60z.onmicrosoft.com; dmarc=none action=none

header.from=xc2h60z.onmicrosoft.com; dkim=none (message not signed); arc=none

(0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=xc2h60z.onmicrosoft.com; s=selector1-xc2h60z-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=tcgc2P+iBn1x/7osGEyFM/+1lsHBtBV8o4J0mYZkUoY=;

b=cq3REqVoSbuySaU4NVrQgcgVOk/BqGwbF6asMkyf1GuhQ1ssNk6nHVYRGJ4yjx9602T+poRKE1/AvVeA3Hva57HWJyBW4cK0RD1QdBf8/k15rAEBbL6KMldbnuWax+nTtCjRY0KMbozW05uuT2AGAQ2m2/Zx/wkKP+RCU/xGOylrKb04s310S8ju/saIgIR7LkqhNseUiqiUzwwT5+KsfvSVWQoNMlfkNYC2AzLoh5m53zyd8u19rXWNBfidsRooOlDTlt6YqGCtPydymROOcTBcaX7Uy3lhTX288hnaOuYRQtvQf+u8b2IGn8FjBCPWwr0WT/QSk207qIgTqJ7n9w==

Received: from BYAPR03CA0018.namprd03.prod.outlook.com (2603:10b6:a02:a8::31)

by MW4PR10MB6560.namprd10.prod.outlook.com (2603:10b6:303:226::8) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7091.38; Tue, 19 Dec

2023 15:41:01 +0000

Received: from DM6NAM12FT044.eop-nam12.prod.protection.outlook.com

(2603:10b6:a02:a8:cafe::ba) by BYAPR03CA0018.outlook.office365.com

(2603:10b6:a02:a8::31) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7091.38 via Frontend

Transport; Tue, 19 Dec 2023 15:41:00 +0000

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 172.234.25.141)

smtp.mailfrom=xc2h60z.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=xc2h60z.onmicrosoft.com;

Received-SPF: Fail (protection.outlook.com: domain of xc2h60z.onmicrosoft.com

does not designate 172.234.25.141 as permitted sender)

receiver=protection.outlook.com; client-ip=172.234.25.141;

helo=mail.howe.com;

Received: from mail.howe.com (172.234.25.141) by

DM6NAM12FT044.mail.protection.outlook.com (10.13.178.204) with Microsoft SMTP

Server id 15.20.7113.12 via Frontend Transport; Tue, 19 Dec 2023 15:41:00

+0000

Importance: high

MIME-Version: 1.0

From: Lowe'S_Department_!!

Sender: app-java@xc2h60z.onmicrosoft.com

X-TOI-MSGID: <106129944.3F57B3A2402EA.1703000286625@howe.com>

Date: Tue, 19 Dec 2023 16:38:06 +0100

CC: doctor@doctor.nl2k.ab.ca

In-Reply-To:

Subject: Important for doctor, You Are Our December Winner_!!

Content-Type: multipart/alternative; charset="UTF-8";boundary="PART_g6Rc.vdtsdgsa"

To: doctor@doctor.nl2k.ab.ca

Message-ID:

<4f5d550d-9f60-48f3-a30c-025ed9d1dc03@DM6NAM12FT044.eop-nam12.prod.protection.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: DM6NAM12FT044:EE_|MW4PR10MB6560:EE_

X-MS-Office365-Filtering-Correlation-Id: 743bfcbc-4084-4bfd-63d8-08dc00a8e691

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?VWtOTDZMU2Q5N05OOHB4anpDeURqR05EbUFCMjhvbnlGaXdweTk1eW1aSmlm?=

=?utf-8?B?R0ZZM2h3ckR6YWFHdXdCdGxkMWJRNzJ4L09LTWhkZ1lnb0dsNUNRVzVZT01n?=

=?utf-8?B?ZlpqblUwUC9tTjh4WHVnYWt0Q1grNk85RGNUV3BMcEpvRVVhTmJzcWlPd2RU?=

=?utf-8?B?TGwrbHN4QmkwakNDemJKVWxyaWM5R2VZZkYybUVVWndEWFlySTAvRzNZdWZn?=

=?utf-8?B?YXNzVmk0Q0F2M1VIRVh4Z25vNnJGQzA3Z0JFbExxeTJjQ3pTTjNUaFNtSXBw?=

=?utf-8?B?L0g3amgxb01UVUk4dEpmTFhNUFpVV294SHVIR0NSYmtFMGxvZytaandXZ29G?=

=?utf-8?B?L3pzWGZGWmw0bDRiUnpKcTViVS80b0U3aFBmQ2tiTkVqdTB5dEk2Zi9QRTFN?=

=?utf-8?B?UGJnYnpqbm93Y0Z4Q2UycUcvdjhERnNnZzlyeDAwY2ZUWkxvSW43SGhhU1A0?=

=?utf-8?B?ZHJzMlIweDU1RnhYSXRRci9SLzBYRXd3YnNPRndaNHY1Y1hmTlNKK0NmemZZ?=

=?utf-8?B?ajhyMGZkOHZ1ZWMvL3RIUHhwV1lBUGwrTW1MNEt3SENDSGRaU3dkS0k0WWRL?=

=?utf-8?B?NkRRNmFRRzZrZ2ZKR0FNMC9RTzhGZXZqQVhLRzBIRWJFM0xMSnl1SHlWODRw?=

=?utf-8?B?Vy9vcUNHVFJGWEdTNW1YTGZ5TDRXSE9mVFNDT1pZNHc4V2tHeVpObkttRlZs?=

=?utf-8?B?ZVlkT09VUHM4cUE4eXBKSnpHSlNIdnBqMi9jOE1NQ0djb3duTkdwTWFYb0xo?=

=?utf-8?B?ZHVLbmZIUkgyNFpsK0Q1MFhBcmZxMVllR2FheThpQUFsK0twTCtKZHByd3M3?=

=?utf-8?B?NTZXb0RqWnBNWXlnaG1Fc0hNdnlIZ014bUgwOGJ3SFZsRG9rK2pScHYvZ1pU?=

=?utf-8?B?ZXI0TVBVOVFqYmJYRmhUZG1qcFZPejJMdS9uWlo4UDVEaWZLeVpJd2lMSTdW?=

=?utf-8?B?clI2Mmdzd1FxMGFJR1QxRVhXaXQzSWY4NVRKeUhkdXNXckJlNEZHWHB3Myta?=

=?utf-8?B?cEVTNnpWUDAwU2xuMEZOTVhjTkJsNU1hby9zeW5IZEdsNzJuNkVJUHN0VDFK?=

=?utf-8?B?UnlRQm5XZzdZL0dvZ3IzcTJ2QnpneEd1M1M4eExHb3htZmIwOWdjcWhUaXBn?=

=?utf-8?B?Y1o1THZFOXBJQVVQaCtRRXNyR0JPeTRpS2orZGM0MnlBeVM0NjIwR21CTDd3?=

=?utf-8?B?Qm9Cd0pKSDRVQXRpWFBKNXd4eE44UXZiclRzTVgvd0c5UzZvY0Y1bWswYVJz?=

=?utf-8?B?V1Z0WTF1eHNnVXY4Y2JubzkxcEwxRlVyK3h6aDgxcGkvSHpZRE13Z2VCTUMz?=

=?utf-8?B?cWQ3S2ZRUERyVEt5a1NwZkhoNE1qb3dQKys3YmtWWXhrQzd3cFdEZ1hseFdB?=

=?utf-8?B?R2pVSVZvSzFHMnF6NWlaY1ZTbndjNjh1YzhudHIxUk5zRFdaL2s2NGVkQnd5?=

=?utf-8?B?WHI3YnFyV3dmUm54NDNzeE1BakMwQlUvWkpJYUxkTGxNRTM4K3o3ZWpwVjJ5?=

=?utf-8?B?MGFvVWVVdXZ2bnBPaTBnVlJ3OUNKczllRXJPNTlhbWdiTmdVTjh5Ukh3SWdw?=

=?utf-8?B?SzBpelRzR1BpeTJvRGd0RGx2dzQ1czhlZFJUWm1RMmxNMS9QUEI5V1BZK1g4?=

=?utf-8?B?ekhLVzRFU3YzUUhxeFJ2cDJWcFJyRGh3c29jQkFUOUNQZGx0eDFWMnVNSTd1?=

=?utf-8?B?aWNsMHFKelFpN01hL2xIYVZyS3o2M3lZRnAyYkdNVms0YnF6K2oxRDMycWRU?=

=?utf-8?B?cHAzNnAyNXFZQzlCSkdXc2w1OExnZ1pScmFIWGFGd0tvQ3E3aHZacnJ0Wksv?=

=?utf-8?B?RlJIVURPekg0bVFiL1E1UmF3MVhUTkwwUnp6cnVoakdLSVhWbU9lZ3l1dk1n?=

=?utf-8?B?d3d6UyswOVhRb2lRNCtXeGVkMHFyVmtqQ2RyS0M2Vm5BRDNmRHhMc3FZTVFt?=

=?utf-8?B?N3dyL0IxN2dJb2FoVnpXTHVpemEzV2szS0Z3SVpxNFROSWFsOXRZVXcySTFD?=

=?utf-8?B?OE1qRTZwaUpaR1ZXeVR4U1NTSTVHdmRuZFdaeHp1ZDhCOTNtWVZkdlI5cDZz?=

=?utf-8?B?TVhGRmNZSGVqOU84S0dkZVlCZDRmY0tTeEYvOW9YUGpzejRHUEpsOEN4cGRt?=

=?utf-8?B?eGFCWWgrYno2SG9UU0didVQwVFE2MVdIejM1R0FpbEc3VGJ6Q0ZiL1RYVGtv?=

=?utf-8?B?VHc9PQ==?=

X-Forefront-Antispam-Report:

CIP:172.234.25.141;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.howe.com;PTR:172-234-25-141.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(136003)(376002)(39860400002)(346002)(396003)(230922051799003)(64100799003)(82310400011)(7200799017)(1690799017)(186009)(451199024)(61400799012)(46966006)(36840700001)(40470700004)(41320700001)(40460700003)(66899024)(33964004)(6916009)(34020700004)(36860700001)(83380400001)(47076005)(31696002)(81166007)(82740400003)(356005)(118246002)(6486002)(8676002)(166002)(478600001)(41300700001)(8936002)(4326008)(786003)(316002)(70206006)(36736006)(19625305002)(956004)(336012)(9686003)(26005)(2906002)(6506007)(5660300002)(7846003)(70586007)(21615005)(6512007)(564344004)(9316004)(31686004)(8400799017)(40480700001)(1406899027)(43852003)(18023003)(42472002)(38122002);DIR:OUT;SFP:1101;

X-OriginatorOrg: xc2h60z.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Dec 2023 15:41:00.1467

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 743bfcbc-4084-4bfd-63d8-08dc00a8e691

X-MS-Exchange-CrossTenant-Id: 79432332-f417-43e7-84a8-8203b4e26f73

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=79432332-f417-43e7-84a8-8203b4e26f73;Ip=[172.234.25.141];Helo=[mail.howe.com]

X-MS-Exchange-CrossTenant-AuthSource:

DM6NAM12FT044.eop-nam12.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR10MB6560



--PART_g6Rc.vdtsdgsa

Content-Transfer-Encoding: 7bit

Content-Type: text/html; charset="UTF-8"











(3543) Notifications












































































If you no longer wish to receive these emails, you may unsubscribe by

clicking here.





























--PART_g6Rc.vdtsdgsa--

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA