Dewalt Canadian Tire Phish from MIcrosoft Outlook

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 06 Mar 2024 11:39:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rhw9y-00000000F9a-2HCJ

for dave@doctor.nl2k.ab.ca;

Wed, 06 Mar 2024 11:38:34 -0700

Resent-From: The Doctor

Resent-Date: Wed, 6 Mar 2024 11:38:34 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-am7eur03on2109.outbound.protection.outlook.com ([40.107.105.109]:62713 helo=EUR03-AM7-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rhvXB-00000000Alp-07C4

for root@nk.ca;

Wed, 06 Mar 2024 10:58:32 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=Q9r09apZZKFwQ+CR+c5UY7760gO8Y5g6TA3kqsNWGGs+XGkTgKmb3wY2H5Ezn+rTelyUMH70xzWJWx+VhfRtnf+EoeEQcvOzmtVg95tQMXXjfNYa9R5Jla4vBeng1TznswhjhF80lfgBSzJevg9qMZEnjwElnw3cUPJmF6z/4IVNC9demfdm2kJSLrNYpMfhGjXpNMets5Wd49320C2scwzCxkc+0GjCyRUfZuAtH44sKodMRmCF58MidF3j52UnFNwicoRUX9+UQEtYBp6/eX/6lrriCnxDkjUMw/z068z5OGpKsUDwSlgZsDYFf9a6nRN+VWSJJ9AZBWL1BMlteQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=ZOQ/g0BsWB5mOpsDGr/Qyxpll5KYgOZdVglv4qIyVD4=;

b=RhltWhPIEmJwmjd6VwC8chSViY2vkwBxlbSjbYP+EoT7KLlZoH6Yl6ecOVy4p9Y6zNkHfcPcWn6CtssO9lLxfoJlFhWVVskFZ7bjrZE44f8t3Xxw2EwnPX6uqRtd9InZW3ASY3/FxuGmlasGoof/J9AnNFcI1n7xzlVY55ys8EvUqwtQl9dMdGy3n05BoHIwVSzNN5PVjQQc/3HBudaqBg1PdGWIdcRjgp/MfiGyhJxF1LyUFwTn7NRCVM27M1Mxc7/wUTTnqBFiQIPqeNLEk/C6znQQdJOm0ObVm3v39hAam3QmTMZnLKqJfTTYDUMGJ5Iu+RM5n6TicguMND0tmw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

192.46.210.97) smtp.rcpttodomain=nk.ca smtp.mailfrom=xav.onmicrosoft.com;

dmarc=none action=none header.from=xav.onmicrosoft.com; dkim=none (message

not signed); arc=none (0)

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 192.46.210.97)

smtp.mailfrom=xav.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=xav.onmicrosoft.com;

From: Canadian_Tire Department_0460

To: root

Subject: Win a_Dewalt EXTREME_Drill_by Taking Our_Survey_3743

x-priority: 1

Reply-To: Canadian_Tire Department_4407

X-Sender: admin@xav.onmicrosoft.com

Delivered-To: root

Content-Type: multipart/alternative; charset="UTF-8";boundary="5CPH79meH6RXEQhB04G6Sl"

Date: Wed, 06 Mar 2024 17:56:22 +0000

MIME-Version: 1.0

Message-ID:

<4459658d-a7e2-469e-85fc-c93fac475d4a@CW2PEPF000056BB.GBRP265.PROD.OUTLOOK.COM>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: CW2PEPF000056BB:EE_|DU0PR07MB9039:EE_

X-MS-Office365-Filtering-Correlation-Id: 9f120553-a1fc-44c3-8e63-08dc3e06bd29

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

mrZheiorsbcF4GWf23tzNq40Udx3QwY3BbevN7I19IKYk1p/7aUS3d4KJ+flRTZjdacY+ti2Fokz+0r+/hQyzigE1bJqe9cxysJhmHMNN9Y9xI8Zpute951COoiFqjv588qiZOh++L8LzNJoet1r1fwZEZ80SXz1seSSt7YEBlBMEJtcClHptMU1JzOpR1cldeSMjRCQgriCxtxua0P+AJ171ZTzSTdjRFeHFpUHihjONRDDUgd0jd5Q6FLF9uTT5samM88hve9XukNOdG+MPV6KWXK5R6gbDXtHJ+wnYTdqmu5kOvf6WRkqIaG1n7L6E+baVWygzP1EgfOPZGFe43Fz+90WDvB6CsXnLztaTlDeKpWQNhOSg52m6SdSXPUDibz4RGkn+a6zyrKe6TTH2jHxAgTMO5bnwuxmtbj6+Is98HbZuIkpeyThgd8z+Z6Hhx9/nLzJV6udm9RgqB7+Hx8phBEXhJhibsgpmrHDrHSVnk2hOiEWLoM+12JlviFN

X-Forefront-Antispam-Report:

CIP:192.46.210.97;CTRY:IN;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:keebler.com;PTR:192-46-210-97.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(376005)(61400799018)(82310400014)(36860700004)(4123299003)(4523499018);DIR:OUT;SFP:1102;

X-OriginatorOrg: xav.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Mar 2024 17:56:24.0204

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 9f120553-a1fc-44c3-8e63-08dc3e06bd29

X-MS-Exchange-CrossTenant-Id: 7e723233-bf4e-4996-bd1a-cc0868a732ba

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=7e723233-bf4e-4996-bd1a-cc0868a732ba;Ip=[192.46.210.97];Helo=[keebler.com]

X-MS-Exchange-CrossTenant-AuthSource: CW2PEPF000056BB.GBRP265.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR07MB9039

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: NNW620qRFPhi5 NNW620qRFPhi5 NNW620qRFPhi5 NNW620qRFPhi5 NNW620qRFPhi5

NNW620qRFPhi5 NNW620qRFPhi5 NNW620qRFPhi5 eIhwyfx02WJC eIhwyfx02WJC eIhwyfx02WJC

eIhwyfx02WJC yFrwP6Vikw yFrwP6Vikw yFrwP6Vikw yFr [...]



Content analysis details: (9.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.107.105.109 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.105.109 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[botox55.6riimhphtiollbgcmjpbec3mds(at)xav.onmicrosoft.com]

0.1 TW_YF BODY: Odd Letter Triples with YF

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

1.5 URI_IMG_CWINDOWSNET Non-MSFT image hosted by Microsoft Azure infra,

possible phishing

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 TVD_SPACE_RATIO No description available.

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

1.0 XPRIO Has X-Priority header

1.0 HOSTED_IMG_FREEM Image hosted at large ecomm, CDN or hosting site or

redirected, freemail from or reply-to

3.5 HOSTED_IMG_DIRECT_MX Image hosted at large ecomm, CDN or hosting

site, message direct-to-mx

0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX

Subject: {SPAM?} Win a_Dewalt EXTREME_Drill_by Taking Our_Survey_3743



--00jFKDOGy4ucQAbNeywEGBlAiSmlgeF6

Content-Type: multipart/alternative; boundary="5CPH79meH6RXEQhB04G6Sl"



--5CPH79meH6RXEQhB04G6Sl

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



NNW620qRFPhi5 NNW620qRFPhi5 NNW620qRFPhi5 NNW620qRFPhi5

NNW620qRFPhi5 NNW620qRFPhi5 NNW620qRFPhi5 NNW620qRFPhi5

eIhwyfx02WJC eIhwyfx02WJC eIhwyfx02WJC eIhwyfx02WJC

yFrwP6Vikw yFrwP6Vikw yFrwP6Vikw yFrwP6Vikw

NNW620qRFPhi5 NNW620qRFPhi5 NNW620qRFPhi5 NNW620qRFPhi5





eIhwyfx02WJC eIhwyfx02WJC eIhwyfx02WJC eIhwyfx02WJC

yFrwP6Vikw yFrwP6Vikw yFrwP6Vikw yFrwP6Vikw

NNW620qRFPhi5 NNW620qRFPhi5 NNW620qRFPhi5 NNW620qRFPhi5

eIhwyfx02WJC eIhwyfx02WJC eIhwyfx02WJC eIhwyfx02WJC

yFrwP6Vikw yFrwP6Vikw yFrwP6Vikw yFrwP6Vikw





--5CPH79meH6RXEQhB04G6Sl

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">










Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">















--5CPH79meH6RXEQhB04G6Sl--

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA