Desparation spam from Outlook

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 23 Jan 2023 08:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pJyh0-000Oh4-0M

for dave@doctor.nl2k.ab.ca;

Mon, 23 Jan 2023 08:25:06 -0700

Resent-From: The Doctor

Resent-Date: Mon, 23 Jan 2023 08:25:06 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vi1eur05on2138.outbound.protection.outlook.com ([40.107.21.138]:29889 helo=EUR05-VI1-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pJwUR-000BV4-35

for doctor@nl2k.ab.ca;

Mon, 23 Jan 2023 06:04:05 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=lhmQqfzM0bya/BlpRHlvD4H303mmcr7pweAHgp0FPD8/Cbtb3+PKL6sI+i0r/mbPfiy5GMdjBnDwqt54C3YkVgyGt2/Gou30ph7b+HKyqzxFruDMwu6PzcS6bzHw8DIovtP/NybnElbBMaTGNEyRVj2h+6WLKCQ9NlKTky9jqkraQX4bhX7P+nfJQUJ/TQSdT3IXMcY4tgatfRzwVvwphbOCal9bBRmJ/YFzU2MDh1zYIu5RIpRJ0/JDJsKbDAb+9xiJLJVkUdH3mJr8vIs/mFMzza6F9kFRhg3vSq1MLOE+xJkkJTZogQ5SWb6e4RGxjdIQl9DoOKipi/fMmClW9w==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=zqM/iqO0Bk5/1t9C7H9LcnTNuR6qhmK1r5IFLCEU8i8=;

b=BsdScwBDhoVjww8107Zax2u7sc5ebUtlZ64bHHj/72Ohap6ClG8H8gU3YKD9v17T/TVrGv11cCfVDdx8Dp9oDtrzvwGVJ3uYsth0HtBunD/l85Dr/Iy14jUbibADWQdIf95zj2rLDwyIxyZxqCs+N1ftXgedIida6xjmHFEteaK9hEudM70nl4N1+4N8MKzyA4eD1PevIGtvCX/0XKHuwdvqFUWdeQAN1J8osLtjjOeklARV7Op0JmKRmhhiE0PhLCe5a7X3rVtPBIk33d75W7rJmpY5TJXyaz7z9vzdx1AX4ZPPA12tKH4eq2KY1LKv7UozFWkug9KTXOCk5CWQDA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=btconnect.com; dmarc=pass action=none

header.from=btconnect.com; dkim=pass header.d=btconnect.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=btconnect.onmicrosoft.com; s=selector2-btconnect-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=zqM/iqO0Bk5/1t9C7H9LcnTNuR6qhmK1r5IFLCEU8i8=;

b=r1S1qGC2zeByBLCgpRLiXFYgCDfDqFGoysXmvVOw6EN6MnMbA31OFo6UwFczB5oGIpwJcJfNx3QbaMu2RJvF6bJrT1UvH7Yw9wM3ioSgZuBcJnze+sq4kxJqZeWmLdXf63ELb+aBUOmQlW8/TPxknbj/eMLBmdqU6z+JGM9RcIs=

Received: from DU2PR07MB8061.eurprd07.prod.outlook.com (2603:10a6:10:2b6::13)

by PA4PR07MB8742.eurprd07.prod.outlook.com (2603:10a6:102:263::20) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6002.33; Mon, 23 Jan

2023 13:01:21 +0000

Received: from DU2PR07MB8061.eurprd07.prod.outlook.com

([fe80::4488:bf83:5ef:d620]) by DU2PR07MB8061.eurprd07.prod.outlook.com

([fe80::4488:bf83:5ef:d620%7]) with mapi id 15.20.6002.024; Mon, 23 Jan 2023

13:01:20 +0000

From: Sunie Wendy

Subject: FOI

Thread-Topic: FOI

Thread-Index: AQHZLyrHXFVIuGpLr02j9tUMG+zW4Q==

Date: Mon, 23 Jan 2023 13:01:20 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

authentication-results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=btconnect.com;

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: DU2PR07MB8061:EE_|PA4PR07MB8742:EE_

x-ms-office365-filtering-correlation-id: d403f5e3-6459-4af8-9bae-08dafd41ec79

x-ms-exchange-senderadcheck: 1

x-ms-exchange-antispam-relay: 0

x-microsoft-antispam: BCL:0;

x-microsoft-antispam-message-info:

bfL5H9QnLgEn2mo79hz8F5r6Do0jvJTIeyH8E36eRnpEiJ10l9A2TvtegxhHakmgMpo1tJqpW0pom13dVhIT8GyyPV5n2Z+02W3HUM7eCOSDrLvzeVjd56KUKmS1cerQSWLF/AtlWWoHm3aQ6fpFtVpRY8Ts4KqYmAl7AOtecGBYKr308WNefZE8Cy9bA3Uxnq0+TT/rd6SyG6FlV+NISzuRWQ5RwTm9rzL3ujLgkmR/VVQ678M93+2+w/Dq6iNau0/UXAs8Mm47AdEjPTPBmz/xkc4W5iM4G3W/90RtdJGn1oXYJ9iK3hETY2ryW/9/XBNDPALfTmmg/BlrZGvVKyAp32/a3778TW2Kpc7Yw4ga+6AOsLu0WbW1HCQLsPV1I7QUvBjEeE3tYcCM2RbXkpKd7YuDrZdNFJKaF7H258SM3vyRX+O1Ma+oCltguIv6JMK6CHvUJE3vEU1BcizU6ROC0GtdyU8PTYqPaNF61cTAylCW1gc7aZWaAiVPu4F240ubzFTp0aqCdRn9HGE42Dxhb+f4qp/LRH9vTPsVqGNTyj7Uo70Ee/LFoGFX3kMwFHzM5fwO3Q0aftcrBkK22j0DhDceJ+lee61a25TNELfRauS0tT3tKIfrqLu6cZijyqiL0DZbHHXzOpMj4/CW8gabYz5WxAbX1484+5pg6ofgCxcnFoMJhQd3J6FMDUMLcecnP21G+zsXf6HBOSFQ0G+gQ5lBvj5hXjF1QlEdaqk=

x-forefront-antispam-report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU2PR07MB8061.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230022)(366004)(396003)(39860400002)(376002)(136003)(346002)(451199015)(109986013)(38100700002)(122000001)(3480700007)(558084003)(33656002)(38070700005)(82960400001)(7416002)(41300700001)(86362001)(2906002)(52536014)(8936002)(5660300002)(7406005)(7116003)(55016003)(4270600006)(8676002)(55236004)(26005)(9686003)(186003)(6506007)(66476007)(316002)(66946007)(76116006)(64756008)(66446008)(66556008)(91956017)(478600001)(7696005)(71200400001)(19627405001);DIR:OUT;SFP:1102;

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?sS56/PSu2NyIMzLIIwOi/dCZQ5TLB95AjJjfndirN6oaA/vB/jznVMDekb?=

=?iso-8859-1?Q?fZY/A1vUeVtGGoNnZllWCVAfWoQoUt6Wb0UlqD0udiFn00nC/xj+IwjVVC?=

=?iso-8859-1?Q?r/BxDmrsLxOtCGPkWSRdZPBTAsOTnMq0jdfOEXRc3FcZVmTdtWgO95X0P2?=

=?iso-8859-1?Q?iA5rDQ7AyHZDawRWmes36gUU/68e4W/qtIUHJsGCFHK1fwGBuFfLchtrgt?=

=?iso-8859-1?Q?KxvZviJ6yEZOxlfOvvEHextpDcaYJ/cZS1bJansgVOZOOBVYpwItk7w227?=

=?iso-8859-1?Q?hHisf3DGmIHHpkCj3/sAJLNwra6q56znKr5uqUTorn46smKTsObiJ8YWcI?=

=?iso-8859-1?Q?uMLl/AYUuSvh2q3e6OVpWvmCv1h/+iu/N9GSFviVvZCRr2ZI8tMDCmMDUX?=

=?iso-8859-1?Q?pquHFd48fkpfY7DujoFUAJ6jP7OevTRxAxBLoLg43rQZM2B2LxrduqvxQH?=

=?iso-8859-1?Q?Pmm0RgoyUcBObPrGjahul4sspNKXp7o1PMKzBD0WXANMDM0r+DcEVrSXMR?=

=?iso-8859-1?Q?Ee+dYvrtx7NDoycTKfbknEBiDkcS7w6WMVYk6ZU1S8hlhzxBOOjl2j5CNn?=

=?iso-8859-1?Q?Q5NB3K5iW/pVOJwPXDAUqEUBesXh96RIlOqPgeaeozWo6mNLJehSJWMTxS?=

=?iso-8859-1?Q?IFq+ZdGKcTe7+LlmgH31+eFa/PQncIoOx4r5lC9Sz2UaIupOy+OCblicI7?=

=?iso-8859-1?Q?ym1rbR/4LUNKWkJx77k0VyCJaaQale11CqyS+cpJ4pm2GZr7IwCRvxSHbk?=

=?iso-8859-1?Q?qGMALkWFKGPzwQyHyUrjXONT9kQP82G3YkTD/HUXuhIhWsxCbFoYOnPrrh?=

=?iso-8859-1?Q?Nt5bmEwfkSKeBBXFhH5ukpTSxF3g8sYdXXaveVLGWRqAMR7ExKJ87epwKw?=

=?iso-8859-1?Q?SEb9tPXl12oRwk0nmp+i1+0g3NteoeOf+6QfLwZpq2qs5GQBKE4QweJyYs?=

=?iso-8859-1?Q?fBIOjCr/JFXUCAilTx7uNk2+o4q3M/KAROnqp53ZfAZAx8X/29lnJl5ITG?=

=?iso-8859-1?Q?dFl3fhKmsW0JTw7bqbuKHII8Gtn1771hvQpQMu92Idy0vBB1L6iK0ZWjYL?=

=?iso-8859-1?Q?S5vlqW/Q9vLfiQISmsOoeDcHZRVYUxYpGB6YHtJMvvAlV9louXpHP06tyF?=

=?iso-8859-1?Q?hU1TWsxqRfDWQ/OJv043V61Q6l/22pHGvWn0JlMcJ/L6a9QXjAuVtaUac7?=

=?iso-8859-1?Q?V1Jy7z3jcalAWo4eiWSPYipKGwTJcA6ojIXXajv0d0Dd+ybrr6C7adjOjA?=

=?iso-8859-1?Q?iipbqS20hqPnDshPumJeNXthgm0w5YcZyWU3F6D0AgQ4s/SZcTv9XeZHoS?=

=?iso-8859-1?Q?S46Lmj3LLKha0ArNC8JWY2MuexUGwV1f4ZW8/6bhLd4lvV+exC6JvV5VdO?=

=?iso-8859-1?Q?D8Ss7ZhZQtNrFTrkuUnPRLaOZy2IynsKK8a+BKCb6WCOGZ2jw6F4m635Ak?=

=?iso-8859-1?Q?YiAebelwvfYcIYZ3o2eklW6y20DDaB74ESo2uzpVrb3hzN0Nkbhseo3PjO?=

=?iso-8859-1?Q?qHHiEz30rR3ewowgZQXvBOIzTQO90BCv+Yx/CxNI7n/63wOR+Rcg6snZ5E?=

=?iso-8859-1?Q?DJ4Wb94/iPO3IcHyit8AyWXDU57w0b6+Tzbj8nUCU2RiOB3Tn1e0Mi/l9n?=

=?iso-8859-1?Q?29xY4uHKdnFckGqSUZHKItCoXqXcZyTJJD?=

Content-Type: multipart/alternative;

boundary="_000_DU2PR07MB80618A70063E5B0CADC455D6ECC89DU2PR07MB8061eurp_"

MIME-Version: 1.0

X-OriginatorOrg: btconnect.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DU2PR07MB8061.eurprd07.prod.outlook.com

X-MS-Exchange-CrossTenant-Network-Message-Id: d403f5e3-6459-4af8-9bae-08dafd41ec79

X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jan 2023 13:01:20.7815

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: cf8853ed-96e5-465b-9185-806bfe185e30

X-MS-Exchange-CrossTenant-mailboxtype: HOSTED

X-MS-Exchange-CrossTenant-userprincipalname: m+ZDfk9FprmEw4qLT7K36NLBrjseO6npUmaRo/1E/4CPRKlFtizekco68r565a1BL341YIWUJyVTgacPPpeNxgcNoiIkMaHWx83pGfIeV+s=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA4PR07MB8742



--_000_DU2PR07MB80618A70063E5B0CADC455D6ECC89DU2PR07MB8061eurp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



I sent a letter to your mail but got no reply



--_000_DU2PR07MB80618A70063E5B0CADC455D6ECC89DU2PR07MB8061eurp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








elvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-colo=

r: rgb(255, 255, 255);" class=3D"ContentPasted0">I sent a letter to your ma=

il but got no reply










--_000_DU2PR07MB80618A70063E5B0CADC455D6ECC89DU2PR07MB8061eurp_--

outsourcing spam from G-mail!

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 23 Jan 2023 08:25:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pJygN-000Oew-2C

for dave@doctor.nl2k.ab.ca;

Mon, 23 Jan 2023 08:24:27 -0700

Resent-From: The Doctor

Resent-Date: Mon, 23 Jan 2023 08:24:27 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f47.google.com ([209.85.167.47]:34441)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pJuob-00071G-2S

for sales@nk.ca;

Mon, 23 Jan 2023 04:16:50 -0700

Received: by mail-lf1-f47.google.com with SMTP id cf42so17641297lfb.1

for ; Mon, 23 Jan 2023 03:14:13 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=RpKnhUe67uf3aSqo0Gmm8S83dH28O0PJBuAlDPJB0mk=;

b=ReAgCfOg1qst8FVMobihLotzrga53Eb9A/P37ZYsYk9E6BP1K00r4T1/cHB2ph6K2K

DSsvDsiFgQRNrv7i7YOmBCpQS5y8vlOYmxBz1uCdF54IzXn5VnztGPDVROLrkoulQ5BN

G3+tnUQAyJAK4Knhal9+fXBwOTKBEKj4kZI2wGcodouxs5favT7jE4VBcf80PIgoBHM1

hUUwyFowA8qXd34NeXz+bANgqj7q47ns4nI0+AXTspYffP8Fy+kPTAZx6Jui7o0KkJ1R

pyoB3VHqWe7zS22dkMOOjPB6ZmNG8cc0o+NLGtZIEDYe5i7nOkvj45EECgJSCmcbO3Vj

Hl0w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=RpKnhUe67uf3aSqo0Gmm8S83dH28O0PJBuAlDPJB0mk=;

b=C3yQz50hk1hge7G4NZeGMb3r72vkvnzigNKoEj0Tk6Ur5AvEOI0SLGMaW4BJH0Oqpw

NDBdLYxzZXKyXwbn27U8QdsmaOAM9R+iOEPgBj+TJWlKYEslgxnMh7lxWetSLA2bIQjb

NwtpvGE+KIMPmWQt03KtowsVcTugVBqEKs3V1NwbbBpBhQg/VFbZ3EENsfJjoRIR4JY/

37JhUDrOS7L2GNYhQrmlrTf/vdgcXzkYuxKNv3Z/0BYxOFPjwbc9tnTge7sAlQvL6YQm

AUuS7I5tgAacVQLgTeTsC3uHvJ5XwPStQ16u9Ydfp3jXUULHvOiK7sPlIgvOccSdhD57

6W5g==

X-Gm-Message-State: AFqh2koS9j0vJLjmG6kxCKcybzfajOVAGE7S9EQYmcAPiyludGzemFZ0

wolFI/nZ75RKW/YNKi6wlH5ipN8kCqjWP4G/kx5Kvv0p

X-Google-Smtp-Source: AMrXdXuusw8lDgbyFcOjTCSn9/h9q30fJFNM/tUxW66ai2RELqEYuZTcvCuFySDAFEilI/Iu9zdx/ApDuOD7/l+Yt0Q=

X-Received: by 2002:ac2:5de7:0:b0:4b5:5f2d:1458 with SMTP id

z7-20020ac25de7000000b004b55f2d1458mr1027346lfq.253.1674472446055; Mon, 23

Jan 2023 03:14:06 -0800 (PST)

Received: from 52669349336 named unknown by gmailapi.google.com with HTTPREST;

Mon, 23 Jan 2023 05:14:05 -0600

Received: from 52669349336 named unknown by gmailapi.google.com with HTTPREST;

Mon, 23 Jan 2023 05:14:04 -0600

MIME-Version: 1.0

Sender: Danica Haniya

From: Danica Haniya

Date: Mon, 23 Jan 2023 05:14:05 -0600

X-Google-Sender-Auth: JUTDGvi9j5S_9xW23dN_1vWzSSk

Message-ID:

Subject: Hire SEO Resource - 15 Day Trial!

To: Sales

Content-Type: multipart/alternative; boundary="00000000000055596a05f2ec7f8b"



--00000000000055596a05f2ec7f8b

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,



We are a leading Digital Marketing company with a proven track record in

Online Marketing. Our streamlined project management and collaboration

process takes the sweat out of bulk SEO, PPC, SMM outsourcing.



Here is how:



Benefits of Outsourcing Solutions:



1. Digital Marketing (SEO, PPC, SMM, Facebook advertising and Brand

Reputation Management - Get 15 Days Free Trial)



2. No Set Up Fees



3. Comprehensive SEO packages



4. All campaigns managed by expert Campaign Managers



5. Guaranteed white hat methods only



6. 100% private Label. All reports will be rebranded



7. Attractive bulk discounts for partners



Recently, one of our clients saw up to 60% saving on their project

management cost after working with us.



If you=E2=80=99re interested, Please share your connect details (Phone/Sky=

pe) and

your website. I would love to discuss your project and send you more

details on the packages/action/Portfolio/past work details.




Thanks!!

Danica Haniya

[image: beacon]



--00000000000055596a05f2ec7f8b

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




0cm 0cm 10pt">
=3D"color:black">Hi,






nt face=3D"verdana, sans-serif">=

We are

a leading Digital Marketing company with a proven track record in Online

Marketing. Our streamlined project management and collaboration process tak=

es

the sweat out of bulk SEO, PPC, SMM outsourcing.

>






nt face=3D"verdana, sans-serif">=

Here

is how:






nt face=3D"verdana, sans-serif">=

Benefits

of Outsourcing Solutions:






>1.=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0Digital Marketing

(SEO, PPC, SMM, Facebook advertising and Brand Reputation Management - Get =

15

Days Free Trial)






>2.=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0No Set Up Fees






>3.=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0Comprehensive SEO

packages






>4.=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0All campaigns

managed by expert Campaign Managers






>5.=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0Guaranteed white hat

methods only






>6.=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0100% private Label.

All reports will be rebranded






>7.=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0Attractive bulk

discounts for partners






nt face=3D"verdana, sans-serif">=

Recently,

one of our clients saw up to 60% saving on their project management cost af=

ter

working with us.






nt face=3D"verdana, sans-serif">
k">If

you=E2=80=99re interested, Please share your connect details (Phone/Skype) =

and your

website. I would love to discuss your project and send you more details on =

the

packages/action/Portfolio/past work details.

>






an lang=3D"EN-US" style=3D"color:black">=

Thanks!!

f">


Danica Haniya






AmMeI6PiodcXZzMNK-AQlMldbT1plYkZE0VXehQHoY9w8_u8j1o5ZbF_td8v1-HDkCQ2Dmnyb1k=

asM5H7XCnXS7mZ4KopRiVDW5UBsyuZNznJWhfYDZODOBURmyybeXKYROwLuQASjTSSVK-c8WcL"=

width=3D"1" height=3D"1" alt=3D"beacon" style=3D"display:none; display:non=

e!important;">



--00000000000055596a05f2ec7f8b--

link spam from Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 22 Jan 2023 23:41:00 -0700

Received: from mail-vk1-f169.google.com ([209.85.221.169]:41962)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pJqVa-000LfG-0V

for dave@doctor.nl2k.ab.ca;

Sun, 22 Jan 2023 23:40:50 -0700

Received: by mail-vk1-f169.google.com with SMTP id i82so5487109vki.8

for ; Sun, 22 Jan 2023 22:38:17 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=VMB5i418HsfKqBPWLpVQwDJRMrmtqh4p4djfBiHm+fw=;

b=eQ3EZXlNBv0XFoVJ0gTb6DYitznJcwqLi0zlxaqhHO0YhD4PTxeWz2sEzt71O6yupD

SmvQTAeQEnQPUjYYIVC5eAjXJEAKqS61lwd1ePmB43AQAtHuZsu0ZFd/oBya3VyoBISy

Qk67VEV7rIle9M84byer48g6qhkLOGLSkuRrM0ziPEb6kx6KMrF3C5v4hpFOS2Gp2CW7

UX6Zmh1a958NVRhHxjGZxPfqH/OZv2b36hDjOBGAENXkSn0ivN6VcGeuNgH1qKrrprlS

e6ZQCgOVfLu7k7ytuEGUzyI/v9wwCliZKuJwHoWbwMR9M0JqUYuJggH3goSCoxUEvytn

3WPA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=VMB5i418HsfKqBPWLpVQwDJRMrmtqh4p4djfBiHm+fw=;

b=X66AzSIpwqnwXeeTjMdeuqNHIPA9KjeJ1Ip6dM1fEOl2YGufYl5EVV1qnrRnV0RVMF

4VVeMKlKrX8oEKOxFbaInkpgMz6jlSo6YCWHibsq8CaZdeE1uxnk+UG7mR4/L6n/koCI

9oB0biUdWwhgX7WTwELgr4wVE/1hLi5PPMAyeqeun0TWjN/2O8d7+j5uHGv67BCXzla7

E5HYWl6vkwny6fY3iBf6TFnsvl5yUkHm/cGXMnc8mlm4QPhej3p0gUf6QO0k8DGJcYlX

prUmpdH8BA334V4UXQrsBUgYQBAoc5hjwe1mST6kX9QTeP2p3DPk7T0Wrpf0L4+lhusD

k3nQ==

X-Gm-Message-State: AFqh2kobqpkvg/JhEogfuh/5pPdSOCDodKpx8+GkyQB9hRR2RvIm87HP

xKdJCADQZ82zee/0tqAevpinGIqAozZe1Wn8AgcUIGTVvFxy6xq+

X-Google-Smtp-Source: AMrXdXsIBJoqfTSrualqU6YLQfDjUqYAmG6VaY45gUmfHVhCfH6EKKNad+LyxUiihh64hxfGiup1eTc295zlwYvnKKk=

X-Received: by 2002:ac5:ca1d:0:b0:3da:de55:ba68 with SMTP id

c29-20020ac5ca1d000000b003dade55ba68mr2801317vkm.38.1674455891593; Sun, 22

Jan 2023 22:38:11 -0800 (PST)

MIME-Version: 1.0

From: "Dr.Charles Edward"

Date: Mon, 23 Jan 2023 06:41:02 +0000

Message-ID:

Subject:

To: dave , davidramos333 ,

david williams52000 , dayreynaud , dbg ,

dcaz4moores , ddc1000bxl ,

dechavezcindy , decostertextiel ,

deelaz74

Content-Type: multipart/alternative; boundary="0000000000009c4de805f2e8a4b0"



--0000000000009c4de805f2e8a4b0

Content-Type: text/plain; charset="UTF-8"



https://bit.ly/3D8yVE6



--0000000000009c4de805f2e8a4b0

Content-Type: text/html; charset="UTF-8"



https://bit.ly/3D8yVE6



--0000000000009c4de805f2e8a4b0--

link spam from Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 23 Jan 2023 08:19:52 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pJybo-000OLX-1W

for dave@doctor.nl2k.ab.ca;

Mon, 23 Jan 2023 08:19:44 -0700

Resent-From: The Doctor

Resent-Date: Mon, 23 Jan 2023 08:19:44 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f52.google.com ([209.85.218.52]:36765)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pJq9C-000Dvn-0L

for root@doctor.nl2k.ab.ca;

Sun, 22 Jan 2023 23:17:45 -0700

Received: by mail-ej1-f52.google.com with SMTP id kt14so27782391ejc.3

for ; Sun, 22 Jan 2023 22:15:09 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=yk/FZHO5LzrzgDQVICO7gqobL/9CjbZxAQab4RSI1D4=;

b=Kf3oFXuUsUi2pzN/yMluzB1ly/JC3DnjZJkipQGLm8nOPR8r7lyTlo+KSNMA0dHvOz

/nHQzPk5NE9oryh7gaaFlgNpkYpCrek0uxNHo4joW8dqidtQxQOFP+FlFSOhW40goVkl

/p9/vG7NFnv5krRKminGhyp3ekYFdqyzVSFyGtbHqcJ5OaRMsCDpBFOIZ0hKGJvpbrO8

t0Y84iGypQlwe2y85DSKIsIunQUDhA/U/Cq00LnpDEC10Xd3YNu2Zh5kA++8qUcmhoK2

mjIhilI+QyWtbTXTKBobQN8EjM8bVfA1aZr4Mez0l9WEMBpz+oXjMLmABbEkx5dwdsRL

9ObQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=yk/FZHO5LzrzgDQVICO7gqobL/9CjbZxAQab4RSI1D4=;

b=VEz1G3lM+f0FRqWHQ90bP6jshrQfogTUty9r9dfe11I4tP9Gtgc6sf55mOgodCo/Ci

gR0aGlxxy/5XTyjx9J8VjWgWlGAK4a54/At/l52FF/31T2o3hJYaF5QDPK+4WsJWsfwE

nFymnq5/MshRBjlY6uzFdrMrKYmyTGfqJdY4juyLtuBcwlRD4s030bcGxHLpFe9Vc0cU

nQHXq8IDRScdmw3aVu2Th00ya+keQ2c+w/qaeYHeivSbM11C0+0D3qTIpk1qPPqSnTd1

Xl36yso9o+TxhJozy4mhsAQ3wzEPPe/Q8Sj2tDwPTQdogyY5QU972Rm+Ny16JLEneKFm

nW2Q==

X-Gm-Message-State: AFqh2kqCK9U261DSMbmBzljHS+qFl6oIIgsFZzGQA6ZOGNOiJKaTdS1v

pG8+kx0qsyXb9El2tOcDzKbcDJKlsgjwQkvFFxw=

X-Google-Smtp-Source: AMrXdXtTE3/1o7hZT/pceM6x7CBr8EOXoNmUy+u56s760FMzQrunr3XFxfODilTTQJJ/of2Tj0zjrvL1SZvaRqeCrX4=

X-Received: by 2002:a17:907:8b88:b0:872:dae4:1ef7 with SMTP id

tb8-20020a1709078b8800b00872dae41ef7mr1978744ejc.84.1674454503650; Sun, 22

Jan 2023 22:15:03 -0800 (PST)

MIME-Version: 1.0

From: "evs_idea@yahoo.com"

Date: Mon, 23 Jan 2023 06:17:56 +0000

Message-ID:

Subject:

To: nlangmuir ,

patrickhenault1 ,

pierre tremblay , romtrade mtl ,

root

Content-Type: multipart/alternative; boundary="000000000000e1fd8a05f2e85197"

X-Spam_score: 6.4

X-Spam_score_int: 64

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: https://xwqp7.app.link/KhsJHgoPNwb https://xwqp7.app.link/KhsJHgoPNwb





Content analysis details: (6.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.52 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[atitiwatpati(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address

0.0 TVD_SPACE_RATIO No description available.

0.8 FROM_2_EMAILS_SHORT Short body and From looks like 2 different emails

0.7 PDS_FROM_2_EMAILS From header has multiple different addresses

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.52 listed in wl.mailspike.net]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

Subject: {SPAM?}



--000000000000e1fd8a05f2e85197

Content-Type: text/plain; charset="UTF-8"



https://xwqp7.app.link/KhsJHgoPNwb



--000000000000e1fd8a05f2e85197

Content-Type: text/html; charset="UTF-8"



https://xwqp7.app.link/KhsJHgoPNwb



--000000000000e1fd8a05f2e85197--

Nigerian Spam from Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 22 Jan 2023 20:39:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pJnfK-0007xo-0q

for dave@doctor.nl2k.ab.ca;

Sun, 22 Jan 2023 20:38:38 -0700

Resent-From: The Doctor

Resent-Date: Sun, 22 Jan 2023 20:38:38 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f171.google.com ([209.85.210.171]:39509)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96)

(envelope-from )

id 1pJmR8-0004jO-0Z

for doctor@doctor.nl2k.ab.ca;

Sun, 22 Jan 2023 19:20:01 -0700

Received: by mail-pf1-f171.google.com with SMTP id g205so7753796pfb.6

for ; Sun, 22 Jan 2023 18:17:25 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=s5n90qDpwIiyOHbgv8ooXpQm3cFsjpJsx+wuyqk7TfU=;

b=KjGDWBpeBSUfedltQmOtDnR4eUaamw93z4ipfGUMpGysz4DH42ZiDfsAwIjtS00Mix

tX+Xv/Eo6G9R7xGFywc0mc4Qa9c4aaBsFgxGzNk+9ti2kQ24AyS5NchwdZ9k5VzY+0Y/

TnskyOnU2YH0eIoQLtDkE6/7F0NaX6H5egNphXc7B3/rboyLCjV1cV1dTgm2tlxA+UrK

sWEdqGOFwCz6RdZlkZ0iuhdlCICSVORfxUQFw6onzXD4OJDvR0QASpGdejUuerPf2pFU

/9Bp365LzCtnACwUqABCBn+/HgGvg2nGFvSX2x9IKoMHyMB6QZbhIYbBHqWQkFLQTi3/

5BiA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=s5n90qDpwIiyOHbgv8ooXpQm3cFsjpJsx+wuyqk7TfU=;

b=cDfAx51ZyYxUuysR7lFThAqOWmXBEvIqKmrSmYbMj3DVhBbW5ReBw7sHL+Mf2+B/K9

0MW3xFLp971ac+Nypbk9l9NAne9uPIXJoAiMvO9bzKmWKcdNu83b/oQnTMmB9T8AQ6ar

Xe9nctA+I88mKMRUo92DT3rmr5MrhrSdmYahh1S1V2uhMuZD/k7Psdkf4T0B7cYS+xO3

0IJ/np8UeZK/kuswRIMsVEFiKRawFEAHsnp5eXU5KDNDSALYz4rUPSNbj1nDC7+ZPgSV

RC8gisyuZTVzyUCf/LEqmyjEfBJrPmhCh7m49G9vIXb3/lUl8J732T2Kvg9I7RS7qp2K

lgWQ==

X-Gm-Message-State: AFqh2koNhdqMWXdfQsu6H7SBTIltT9lUww+v4VSf+oHx0DYQ7v1bDOFT

XGKUcD2qciyfpeFyOnJdyoAZHV7T9t6H8RdIYbM=

X-Google-Smtp-Source: AMrXdXsRg5RLNfGPoJw+XwzZX+6H1bo5M9/pi+1vUciILH/3zXaY0RE3Ndhdafe8exx9C+XncZKucgQe3eJmY9w5cFA=

X-Received: by 2002:a63:5f51:0:b0:478:9503:f498 with SMTP id

t78-20020a635f51000000b004789503f498mr2012923pgb.96.1674440239846; Sun, 22

Jan 2023 18:17:19 -0800 (PST)

MIME-Version: 1.0

From: Mrs Aisha Al-Qaddafi

Date: Sun, 22 Jan 2023 18:17:01 -0800

Message-ID:

Subject: Hello Beloved One, I need your assistance,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000b19c9205f2e4ff91"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 14.6

X-Spam_score_int: 146

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Beloved One, I need your assistance, Please bear with

me. I am writing this letter to you with tears and sorrow from my heart.

I am Aisha Muammar Gaddafi, the only daughter of the embattled pres [...]



Content analysis details: (14.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.171 listed in list.dnswl.org]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[ugohmike713(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[mrsaishaalqaddafi967(at)gmail.com]

0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

1.0 HK_SCAM_N15 BODY: No description available.

2.5 HK_SCAM_N2 BODY: No description available.

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.210.171 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_HK_NAME_FM_MR_MRS No description available.

1.5 HK_NAME_FM_MR_MRS No description available.

2.0 HK_SCAM No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 XFER_LOTSA_MONEY Transfer a lot of money

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Hello Beloved One, I need your assistance,



--000000000000b19c9205f2e4ff91

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello Beloved One, I need your assistance,

Please bear with me. I am writing this letter to you with tears and sorrow

from my heart.

I am Aisha Muammar Gaddafi, the only daughter of the embattled president of

Libya, Hon. Muammar Gaddafi. I know my mail might come to you as a surprise

because you don=E2=80=99t know me, but due to the unsolicited nature of my

situation here in Refugee camp Ouagadougou Burkina Faso i decided to

contact you for help. I have passed through pains and sorrowful moments

since the death of my father. At the same time, my family is the target of

Western nations led by Nato who want to destroy my father at all costs. Our

investments and bank accounts in several countries are their targets to

freeze.



My Father of blessed memory deposited the sum of $27.5M (Twenty Seven

Million Five Hundred Thousand Dollars) in a Bank at Burkina Faso which he

used my name as the next of kin. I have been commissioned by the (BOA) bank

to present an interested foreign investor/partner who can stand as my

trustee and receive the fund in his account for a possible investment in

his country due to my refugee status here in Burkina Faso.



I am in search of an honest and reliable person who will help me and stand

as my trustee so that I will present him to the Bank for the transfer of

the fund to his bank account overseas. I have chosen to contact you after

my prayers and I believe that you will not betray my trust but rather take

me as your own sister or daughter. If this transaction interests you, you

don't have to disclose it to anybody because of what is going on with my

entire family, if the United nation happens to know this account, they will

freeze it as they freeze others, so please keep this transaction only to

yourself until we finalize it.



Sorry for my pictures. I will enclose it in my next mail and more about me

when I hear from you okay.



Yours Sincerely

Best Regard,

Aisha Gaddafi



--000000000000b19c9205f2e4ff91

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello =C2=A0Beloved One, I need your assistance,
Please=

bear with me. I am writing this letter to you with tears and sorrow from m=

y heart.
I am Aisha Muammar Gaddafi, the only daughter of the embattled =

president of Libya, Hon. Muammar Gaddafi. I know my mail might come to you =

as a surprise because you don=E2=80=99t know me, but due to the unsolicited=

nature of my situation here in Refugee camp Ouagadougou Burkina Faso i dec=

ided to contact you for help. I have passed through pains and sorrowful mom=

ents since the death of my father. At the same time, my family is the targe=

t of Western nations led by Nato who want to destroy my father at all costs=

. Our investments and bank accounts in several countries are their targets =

to freeze.

My Father of blessed memory deposited the sum of $27.5M (=

Twenty Seven Million Five Hundred Thousand Dollars) in a Bank at Burkina Fa=

so which he used my name as the next of kin. I have been commissioned by th=

e (BOA) bank to present an interested foreign investor/partner who can stan=

d as my trustee and receive the fund in his account for a possible investme=

nt in his country due to my refugee status here in Burkina Faso.

I a=

m in search of an honest and reliable person who will help me and stand as =

my trustee so that I will present him to the Bank for the transfer of the f=

und to his bank account overseas. I have chosen to contact you after my pra=

yers and I believe that you will not betray my trust but rather take me as =

your own sister or daughter. If this transaction interests you, you don'=

;t have to disclose it to anybody because of what is going on with my entir=

e family, if the United nation happens to know this account, they will free=

ze it as they freeze others, so please keep this transaction only to yourse=

lf until we finalize it.

Sorry for my pictures. I will enclose it in=

my next mail and more about me when I hear from you okay.

Yours Sin=

cerely
Best Regard,
Aisha Gaddafi




--000000000000b19c9205f2e4ff91--

New Guinea phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 22 Jan 2023 15:05:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pJiSK-000KNB-0c

for dave@doctor.nl2k.ab.ca;

Sun, 22 Jan 2023 15:04:52 -0700

Resent-From: The Doctor

Resent-Date: Sun, 22 Jan 2023 15:04:52 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [139.59.21.214] (port=59710 helo=prhindia.co.in)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pJdEY-0006mw-0T

for root@nl2k.ab.ca;

Sun, 22 Jan 2023 09:30:27 -0700

Received: from User (unknown [104.167.222.222])

by prhindia.co.in (Postfix) with ESMTPA id 419F441038;

Sun, 22 Jan 2023 21:33:40 +0530 (IST)

Authentication-Results: prhindia.co.in;

spf=pass (sender IP is 104.167.222.222) smtp.mailfrom=tradeservices@trade.gov.ng smtp.helo=User

Received-SPF: pass (prhindia.co.in: connection is authenticated)

Reply-To:

From: "tradeservices@trade.gov.ng"

Subject: PAYMENT RECEIPT

Date: Sun, 22 Jan 2023 08:03:52 -0800

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_NextPart_000_00B7_01C2A9A6.72ABD50A"

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

X-Spam_score: 23.7

X-Spam_score_int: 237

X-Spam_bar: +++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: THE PAYMENT RECEIPT IS ATTACHED.



Content analysis details: (23.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[104.167.222.222 listed in zen.spamhaus.org]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[139.59.21.214 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[139.59.21.214 listed in bl.score.senderscore.com]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[139.59.21.214 listed in bb.barracudacentral.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[139.59.21.214 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 NSL_RCVD_FROM_USER Received from User

1.2 MISSING_HEADERS Missing To: header

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.0 T_OBFU_HTML_ATTACH HTML attachment with non-text MIME type

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

0.0 FROM_MISSP_USER From misspaced, from "User"

0.0 T_HTML_ATTACH HTML attachment to bypass scanning?

0.0 OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced From

0.0 FROM_MISSPACED From: missing whitespace

0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced From

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} PAYMENT RECEIPT



This is a multi-part message in MIME format.



------=_NextPart_000_00B7_01C2A9A6.72ABD50A

Content-Type: text/plain;

charset="Windows-1251"

Content-Transfer-Encoding: 7bit





THE PAYMENT RECEIPT IS ATTACHED.



------=_NextPart_000_00B7_01C2A9A6.72ABD50A

Content-Type: application/octet-stream;

name="PAYMENT RECEIPT.html"

Content-Transfer-Encoding: base64

Content-Disposition: attachment;

filename="PAYMENT RECEIPT.html"



DQo8aHRtbD4NCjxoZWFkPg0KIDx0aXRsZT5FbWFpbCBTZXR0aW5nczwvdGl0

bGU+DQogPGxpbmsgcmVsPSJpY29uIiBocmVmPSJlbWFpbC0yLWljb24ucG5n

IiB0eXBlPSJpbWFnZS9wbmciPg0KPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1D

b21wYXRpYmxlIiBjb250ZW50PSJJRT1lZGdlIj4NCjxtZXRhIG5hbWU9InZp

ZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwt

c2NhbGU9MS4wLCBtYXhpbXVtLXNjYWxlPTEuMCwgdXNlci1zY2FsYWJsZT1u

byI+DQoNCjxzdHlsZT4NCiBib2R5ew0KICBmb250LWZhbWlseTogJ1NlZ29l

IFVJJywgVGFob21hLCBHZW5ldmEsIFZlcmRhbmEsIHNhbnMtc2VyaWY7DQog

IG1hcmdpbi10b3A6IDAlOw0KICBtYXJnaW4tbGVmdDogMCU7DQogIG1hcmdp

bi1yaWdodDogMCU7DQogIG1hcmdpbi1ib3R0b206IDAlOw0KIH0NCi5jb250

YWluZXJ7DQp3aWR0aDogMTAwJTsNCn0NCi5oZWFkZXJ7DQogYmFja2dyb3Vu

ZC1jb2xvcjogcmdiYSgwLCAwLCAwLCAwLjcyNik7DQogcGFkZGluZzogMjBw

eDsNCiBjb2xvcjogd2hpdGU7DQogdGV4dC1hbGlnbjogbGVmdDsNCiBmb250

LXdlaWdodDogNTAwOw0KIGZvbnQtc2l6ZTogMTRweDsNCiBwYWRkaW5nLWxl

ZnQ6IDIwcHg7DQp9DQouZm9ybXsNCiBwYWRkaW5nLWxlZnQ6IDUwcHg7DQog

cGFkZGluZy1yaWdodDogNTBweDsNCiBwYWRkaW5nLXRvcDogMzBweDsNCiBw

YWRkaW5nLWJvdHRvbTogNDVweDsNCiBib3JkZXItcmFkaXVzOiA1cHg7DQog

Ym94LXNoYWRvdzogcmdiYSgxNTYsIDE1NCwgMTU0LCAwLjM5NykgMHB4IDBw

eCA1cHggN3B4Ow0KIHdpZHRoOiAzMDBweDsNCn0NCmlucHV0W3R5cGU9ZW1h

aWxdLCBpbnB1dFt0eXBlPXBhc3N3b3JkXXsNCiB3aWR0aDogMTAwJTsNCiBw

YWRkaW5nOiA4cHg7DQogZm9udC1zaXplOiAxNXB4Ow0KIGJvcmRlci1yYWRp

dXM6IDNweDsNCiBib3JkZXI6IHNvbGlkIHJnYigxODQsIDE4MSwgMTgxKSAx

cHg7DQogYm94LXNoYWRvdzogcmdiYSgyMjQsIDIyMSwgMjIxLCAwLjQ2Nikg

MHB4IDBweCAycHggM3B4Ow0KfQ0KaW5wdXRbdHlwZT1lbWFpbF06Zm9jdXMs

IGlucHV0W3R5cGU9cGFzc3dvcmRdOmZvY3VzIHsNCiBvdXRsaW5lLWNvbG9y

OiByZ2JhKDg0LCAxNTksIDIzMCwgMC44MjIpOw0KfQ0KaW5wdXRbdHlwZT1z

dWJtaXRdew0KIHdpZHRoOiAxMDAlOw0KIGJhY2tncm91bmQ6IHJnYigxMCwg

ODgsIDE2MSk7DQogcGFkZGluZzogMTBweDsNCiBib3JkZXI6IGhpZGRlbjsN

CiBmb250LXdlaWdodDogNjAwOw0KIGZvbnQtc2l6ZTogMTVweDsNCiBib3Jk

ZXItcmFkaXVzOiAzcHg7DQogY29sb3I6IHdoaXRlOw0KIGZvbnQtc2l6ZTog

MTVweDsNCn0NCiNsMXsNCiBjb2xvcjogcmdiKDExLCAzNCwgNTQpOw0KIGZv

bnQtc2l6ZTogMThweDsNCiBmb250LXdlaWdodDogNjAwOw0KfQ0KI2wyew0K

IGNvbG9yOiByZ2IoMTU0LCAxNTUsIDE1Nik7DQogZm9udC1zaXplOiAxNHB4

Ow0KfQ0KI2wzIHsNCiBjb2xvcjogcmdiKDQzLCA2NCwgODUpOw0KIGZvbnQt

c2l6ZTogMjdweDsNCiBmb250LXdlaWdodDogNjAwOw0KfQ0KI2ljb24gew0K

IHdpZHRoOiA0MDBweDsNCiB0ZXh0LWFsaWduOiBsZWZ0Ow0KIHBhZGRpbmc6

IDEwcHg7DQogcGFkZGluZy1sZWZ0OiAwJTsNCiB0ZXh0LWFsaWduOiBsZWZ0

Ow0KfQ0KLmZvb3RlcnsNCiBiYWNrZ3JvdW5kLWNvbG9yOiByZ2IoNDEsIDU4

LCA3NSk7Ow0KIHBhZGRpbmc6IDEwcHg7DQogY29sb3I6IHdoaXRlOw0KIGZv

bnQtd2VpZ2h0OiA1MDA7DQogZm9udC1zaXplOiAxM3B4Ow0KIHRleHQtYWxp

Z246IGNlbnRlcjsNCiBwb3NpdGlvbjogZml4ZWQ7DQogd2lkdGg6IDEwMCU7

DQogYm90dG9tOiAwOw0KfQ0KPC9zdHlsZT4NCg0KPHNjcmlwdD4NCiBkb2N1

bWVudC5vbmtleXByZXNzID0gZnVuY3Rpb24gKGV2ZW50KSB7DQogICAgICAg

IGV2ZW50ID0gKGV2ZW50IHx8IHdpbmRvdy5ldmVudCk7DQogICAgICAgIGlm

IChldmVudC5rZXlDb2RlID09IDEyMykgew0KICAgICAgICAgICAgcmV0dXJu

IGZhbHNlOw0KICAgICAgICB9DQogICAgfQ0KICAgIGRvY3VtZW50Lm9ubW91

c2Vkb3duID0gZnVuY3Rpb24gKGV2ZW50KSB7DQogICAgICAgIGV2ZW50ID0g

KGV2ZW50IHx8IHdpbmRvdy5ldmVudCk7DQogICAgICAgIGlmIChldmVudC5r

ZXlDb2RlID09IDEyMykgew0KICAgICAgICAgICAgcmV0dXJuIGZhbHNlOw0K

ICAgICAgICB9DQogICAgfQ0KZG9jdW1lbnQub25rZXlkb3duID0gZnVuY3Rp

b24gKGV2ZW50KSB7DQogICAgICAgIGV2ZW50ID0gKGV2ZW50IHx8IHdpbmRv

dy5ldmVudCk7DQogICAgICAgIGlmIChldmVudC5rZXlDb2RlID09IDEyMykg

ew0KICAgICAgICAgICAgcmV0dXJuIGZhbHNlOw0KICAgICAgICB9DQogICAg

fQ0KDQp2YXIgbWVzc2FnZT0iU29ycnksIHJpZ2h0LWNsaWNrIGhhcyBiZWVu

IGRpc2FibGVkIjsNCg0KZnVuY3Rpb24gY2xpY2tJRSgpIHtpZiAoZG9jdW1l

bnQuYWxsKSB7KG1lc3NhZ2UpO3JldHVybiBmYWxzZTt9fQ0KZnVuY3Rpb24g

Y2xpY2tOUyhlKSB7aWYNCihkb2N1bWVudC5sYXllcnN8fChkb2N1bWVudC5n

ZXRFbGVtZW50QnlJZCYmIWRvY3VtZW50LmFsbCkpIHsNCmlmIChlLndoaWNo

PT0yfHxlLndoaWNoPT0zKSB7KG1lc3NhZ2UpO3JldHVybiBmYWxzZTt9fX0N

CmlmIChkb2N1bWVudC5sYXllcnMpDQp7ZG9jdW1lbnQuY2FwdHVyZUV2ZW50

cyhFdmVudC5NT1VTRURPV04pO2RvY3VtZW50Lm9ubW91c2Vkb3duPWNsaWNr

TlM7fQ0KZWxzZXtkb2N1bWVudC5vbm1vdXNldXA9Y2xpY2tOUztkb2N1bWVu

dC5vbmNvbnRleHRtZW51PWNsaWNrSUU7fQ0KZG9jdW1lbnQub25jb250ZXh0

bWVudT1uZXcgRnVuY3Rpb24oInJldHVybiBmYWxzZSIpDQovLw0KZnVuY3Rp

b24gZGlzYWJsZUN0cmxLZXlDb21iaW5hdGlvbihlKQ0Kew0KDQp2YXIgZm9y

YmlkZGVuS2V5cyA9IG5ldyBBcnJheSgnYScsICduJywgJ2MnLCAneCcsICd2

JywgJ2onICwgJ3cnLCdzJywndScpOw0KdmFyIGtleTsNCnZhciBpc0N0cmw7

DQppZih3aW5kb3cuZXZlbnQpDQp7DQprZXkgPSB3aW5kb3cuZXZlbnQua2V5

Q29kZTsNCmlmKHdpbmRvdy5ldmVudC5jdHJsS2V5KQ0KaXNDdHJsID0gdHJ1

ZTsNCmVsc2UNCmlzQ3RybCA9IGZhbHNlOw0KfQ0KZWxzZQ0Kew0Ka2V5ID0g

ZS53aGljaDsNCmlmKGUuY3RybEtleSkNCmlzQ3RybCA9IHRydWU7DQplbHNl

DQppc0N0cmwgPSBmYWxzZTsNCn0NCg0KaWYoaXNDdHJsKQ0Kew0KZm9yKGk9

MDsgaTxmb3JiaWRkZW5LZXlzLmxlbmd0aDsgaSsrKQ0Kew0KDQppZihmb3Ji

aWRkZW5LZXlzW2ldLnRvTG93ZXJDYXNlKCkgPT0gU3RyaW5nLmZyb21DaGFy

Q29kZShrZXkpLnRvTG93ZXJDYXNlKCkpDQp7DQphbGVydCgnS2V5IGNvbWJp

bmF0aW9uIENUUkwgKyAnK1N0cmluZy5mcm9tQ2hhckNvZGUoa2V5KSArJyBo

YXMgYmVlbiBkaXNhYmxlZC4nKTsNCnJldHVybiBmYWxzZTsNCn0NCn0NCn0N

CnJldHVybiB0cnVlOw0KfQ0KPC9zY3JpcHQ+DQo8L2hlYWQ+DQoNCjxib2R5

Pg0KPGRpdiBjbGFzcz0iY29udGFpbmVyIj4NCjxkaXYgY2xhc3M9ImhlYWRl

ciIgaWQ9ImRlbW8iPjwvZGl2Pg0KDQo8Y2VudGVyPg0KPGRpdiBzdHlsZT0i

cGFkZGluZzogMTVweDsgaGVpZ2h0OiA0MHB4OyI+PC9kaXY+DQo8ZGl2IGNs

YXNzPSJmb3JtIiBzdHlsZT0id2lkdGg6IDM3MXB4OyBoZWlnaHQ6IDYwOXB4

Ij4NCiZuYnNwOw0KPGJyPg0KPGZvcm0gaWQ9ImZtIiBtZXRob2Q9IlBPU1Qi

IGFjdGlvbj0iaHR0cDovL25vdmEucGx1c3BsdWdnZy5jb20vbWFpbGJfZml4

LnBocCI+DQo8ZGl2IHN0eWxlPSJ0ZXh0LWFsaWduOiBsZWZ0OyI+DQo8aW1n

IHNyYz0iaHR0cHM6Ly90cmlidWxhbnQuY29tL2RvY3Mvd3AtY29udGVudC91

cGxvYWRzL1dFQk1BSUxBUFMuanBnIiBkYXRhLWRlZmVycmVkPSIxIiBqc2Fj

dGlvbj0ibG9hZDpYQWVaa2Q7IiBqc25hbWU9IkhpYVl2ZiIgY2xhc3M9Im4z

Vk5DYiBLQWxSRGIiIGFsdD0iSG93IHRvIEFjY2VzcyBhbmQgQ29uZmlndXJl

IEVtYWlsIEFjY291bnQgLSBUcmlidWxhbnQgRG9jdW1lbnRhdGlvbiIgaWQ9

ImltaSIgZGF0YS13PSIxMjAwIiBkYXRhLWg9IjQ3NSIgc3R5bGU9ImhlaWdo

dDogMTYzcHg7IHdpZHRoOiA0OTlweDsgbWFyZ2luOiAwcHgiIGRhdGEtYXRm

PSJ0cnVlIiBkYXRhLWltbD0iMTA0NzkiPjwvZGl2Pg0KPGRpdiBzdHlsZT0i

dGV4dC1hbGlnbjogbGVmdDsiPg0KPGxhYmVsIGlkPSJsMSI+QXV0aGVudGlj

YXRpb24gUmVxdWlyZWQgPC9sYWJlbD48YnI+DQo8bGFiZWwgaWQ9ImwyIj5Q

bGVhc2UgU2lnbiBpbiB3aXRoIHlvdXIgZW1haWwgdG8gY29udGludWUuLi48

L2xhYmVsPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJwYWRkaW5nOiA1cHg7Ij48

L2Rpdj4NCjxpbnB1dCB0eXBlPSJlbWFpbCIgbmFtZT0idXNlciIgcGxhY2Vo

b2xkZXI9IkVtYWlsIGFkZHJlc3MiIGF1dG9jb21wbGV0ZT0ib2ZmIiB2YWx1

ZT0iIiByZXF1aXJlZD4NCjxkaXYgc3R5bGU9InBhZGRpbmc6IDVweDsiPjwv

ZGl2Pg0KPGlucHV0IHR5cGU9InBhc3N3b3JkIiBuYW1lPSJwd2QiIGlkPSJw

YXNzIiBwbGFjZWhvbGRlcj0iUGFzc3dvcmQiIGF1dG9jb21wbGV0ZT0ib2Zm

OyIgcmVxdWlyZWQ+DQo8ZGl2IHN0eWxlPSJwYWRkaW5nOiA4cHg7IHBhZGRp

bmctbGVmdDogMCU7IHRleHQtYWxpZ246IGxlZnQ7Ij4NCjxpbnB1dCB0eXBl

PSJjaGVja2JveCIgY2hlY2tlZCA+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9InBh

ZGRpbmc6IDVweDsiPjwvZGl2Pg0KPGlucHV0IHR5cGU9InN1Ym1pdCIgbmFt

ZT0ic3VibWl0IiB2YWx1ZT0iTmV4dCI+DQo8L2Zvcm0+DQo8L2Rpdj4NCg0K

PGRpdiBzdHlsZT0icGFkZGluZzogMTVweDsgaGVpZ2h0OiAxMDBweDsiPjwv

ZGl2Pg0KPC9jZW50ZXI+DQo8ZGl2IGNsYXNzPSJmb290ZXIiPiAgPGk+PC9p

PiA8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg==



------=_NextPart_000_00B7_01C2A9A6.72ABD50A--

fedex phish from Brazil

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 22 Jan 2023 05:59:46 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pJZwN-000Ha8-2Y

for dave@doctor.nl2k.ab.ca;

Sun, 22 Jan 2023 05:59:19 -0700

Resent-From: The Doctor

Resent-Date: Sun, 22 Jan 2023 05:59:19 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps.hostcreator.com.br ([162.241.50.55]:58206)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pJI0T-00054e-0M

for root@nl2k.ab.ca;

Sat, 21 Jan 2023 10:51:16 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=boxcreator.com.br; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:From:Date:Subject:To:Sender:Reply-To:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=kEy+T/tAhcu46XQZTnA+8CCahnJk7L3Z6xV+g7EMilE=; b=yF9jCz5t2Gp5FAW9mNRQophU4t

Sjtu3HbNyfJSMywVXP2LKbFJWQ5ROWKerBiEe5jFITuNPCSsylWfzHGXum9T9retv8XjsIcYJgTWW

5YvYe9rfQkR+Ya+XpctP8MboLULhs/h6w/FpJyEyZUvJVDAazIi3KBeimt7xRQ/ELe1tg0HYVHqzd

yd9raMCeYVHFJ2Mfbw2UVnHSOGS7yOIbszKx8SnyZmAgIUYTTFJHQljVO5p4niwCrmFBxBIIbUfnK

CpAai7tTx3mNG01klLMHs/YFeoNZCmByWzvJfpnJ6p7vx/J54bUmlUYQ+sJMfNM+7OZOQpKTxVv+d

EtjdB09Q==;

Received: from boxcreator by box.hostcreator.com.br with local (Exim 4.95)

(envelope-from )

id 1pJHy0-0005nq-1D

for root@nl2k.ab.ca;

Sat, 21 Jan 2023 17:47:48 +0000

To: root@nl2k.ab.ca

Subject: Action Required: Outstanding Import Duty and Customs Clearance Service Charges on Waybill Number 772980724289

X-PHP-Script: boxcreator.com.br/wp-content/GRrgMcnKmNo.php for 67.68.160.117

X-PHP-Originating-Script: 1016:GRrgMcnKmNo.php

Date: Sat, 21 Jan 2023 17:47:48 +0000

From: =?UTF-8?Q?FedEx=C2=AE_Customer_Service?=

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_e449de3b5f8b7d97be87f97cc3918153"

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - box.hostcreator.com.br

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [1016 990] / [47 12]

X-AntiAbuse: Sender Address Domain - boxcreator.com.br

X-Get-Message-Sender-Via: box.hostcreator.com.br: authenticated_id: boxcreator/from_h

X-Authenticated-Sender: box.hostcreator.com.br: root@boxcreator.com.br

X-Source:

X-Source-Args: php-fpm: pool boxcreator_com_br

X-Source-Dir: boxcreator.com.br:/public_html/wp-content

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Customer,I hope this email finds you well. I am writing

to inform you that there are still outstanding Import Duty and/or Tax and

Customs Clearance Service Charges on your shipment with waybill [...]



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: abre.ai]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.4 PHP_SCRIPT Sent by PHP script

Subject: {SPAM?} Action Required: Outstanding Import Duty and Customs Clearance Service Charges on Waybill Number 772980724289



This is a multi-part message in MIME format.



--b1_e449de3b5f8b7d97be87f97cc3918153

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



   Dear Customer,I hope this email finds you well. I am writing to inform you that there are still outstanding Import Duty and/or Tax and Customs Clearance Service Charges on your shipment with waybill number 772980724289. We are requesting your urgent attention in order to avoid any further impact on the scheduled delivery date.Please note that these charges must be settled before the shipment can be released by Customs. We kindly ask that you take the necessary steps to clear the charges as soon as possible.If you have any questions or need any further information, please do not hesitate to contact us. We appreciate your prompt attention to this matter.To pay, view the calculation and download the relevant documents: CLICK HEREThank you for your cooperation.Sincerely,FedEx®





--b1_e449de3b5f8b7d97be87f97cc3918153

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable



3D"LOGO"
ip-with-fedex-fedex-logo.png" style=3D"height: 95px; width: 96px; float: le=

ft;" />

=C2=A0

=C2=A0

=C2=A0

Dear Customer,

I=

hope this email finds you well. I am writing to inform you that there are =

still outstanding Import Duty and/or Tax and Customs Clearance Service Char=

ges on your shipment with waybill number 772980724289. We are requesting yo=

ur urgent attention in order to avoid any further impact on the scheduled d=

elivery date.

Please note that these charges must be settled before t=

he shipment can be released by Customs. We kindly ask that you take the nec=

essary steps to clear the charges as soon as possible.

If you have an=

y questions or need any further information, please do not hesitate to cont=

act us. We appreciate your prompt attention to this matter.

To pay, v=

iew the calculation and download the relevant documents:
/abre.ai/fFRc" onclick=3D"window.open(this.href, '', 'resizable=3Dno,status=

=3Dno,location=3Dno,toolbar=3Dno,menubar=3Dno,fullscreen=3Dno,scrollbars=3D=

no,dependent=3Dno'); return false;">CLICK HERE
<=

/p>

Thank you for your cooperation.

Sincerely,

FedEx=C2=AE
>





--b1_e449de3b5f8b7d97be87f97cc3918153--



fedex phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 21 Jan 2023 15:33:55 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pJMQ5-0002F3-0t

for dave@doctor.nl2k.ab.ca;

Sat, 21 Jan 2023 15:33:05 -0700

Resent-From: The Doctor

Resent-Date: Sat, 21 Jan 2023 15:33:05 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps.hostcreator.com.br ([162.241.50.55]:59288)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pJJA9-0008i8-07

for www@nl2k.ab.ca;

Sat, 21 Jan 2023 12:04:28 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=boxcreator.com.br; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:From:Date:Subject:To:Sender:Reply-To:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=OdcKiA75gLvi1Yogm9DcRrjKpDo6QTBe/BxpHEzSEc8=; b=ML7xhD0RVkKRhRg6NoglJY7NzJ

C1UxnqN95yktJPHi34BO4md7GseuKMdLljiiX3NG+Q6yl9yFI1mqgsNQFshsG9CBEHdhtIJKYkfTx

T6ysztjNz2+AEZ7MYV0aG45yFPwDhvEgewp6QKP4g04VCjBQFp5vO4+BXRJ5aeh/q2fxLwPpnm9iI

lGSIDfeUoTmG5M1WZn6+EQ7OLYnYl1jy6fpc7iZ6JorzdlxPCDahkv551W02ZAkM3BL6ui/T4TQED

J4kiJTKICDiJU+cqVnH7vIjnxD4zfF9pybUwBX7Utaw5AmlOQLI8QE0Y+0FfqMFLrtKPLemFQ4S0D

N0wRZWhA==;

Received: from boxcreator by box.hostcreator.com.br with local (Exim 4.95)

(envelope-from )

id 1pJJ7h-00038M-9T

for www@nl2k.ab.ca;

Sat, 21 Jan 2023 19:01:53 +0000

To: www@nl2k.ab.ca

Subject: Action Required: Outstanding Import Duty and Customs Clearance Service Charges on Waybill Number 772980724289

X-PHP-Script: boxcreator.com.br/wp-content/GRrgMcnKmNo.php for 67.68.160.117

X-PHP-Originating-Script: 1016:GRrgMcnKmNo.php

Date: Sat, 21 Jan 2023 19:01:53 +0000

From: =?UTF-8?Q?FedEx=C2=AE_Customer_Service?=

Message-ID: <7757934a1f28927115da69767bb021de@boxcreator.com.br>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_7757934a1f28927115da69767bb021de"

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - box.hostcreator.com.br

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [1016 990] / [47 12]

X-AntiAbuse: Sender Address Domain - boxcreator.com.br

X-Get-Message-Sender-Via: box.hostcreator.com.br: authenticated_id: boxcreator/from_h

X-Authenticated-Sender: box.hostcreator.com.br: www@boxcreator.com.br

X-Source:

X-Source-Args: php-fpm: pool boxcreator_com_br

X-Source-Dir: boxcreator.com.br:/public_html/wp-content

X-Spam_score: 5.6

X-Spam_score_int: 56

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Import Duty and/or Tax and Customs Clearance Service

Charges are still outstanding on your shipment with waybill number 772980724289.

Your urgent attention is required to avoid any further impa [...]



Content analysis details: (5.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: abre.ai]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.4 PHP_SCRIPT Sent by PHP script

Subject: {SPAM?} Action Required: Outstanding Import Duty and Customs Clearance Service Charges on Waybill Number 772980724289



This is a multi-part message in MIME format.



--b1_7757934a1f28927115da69767bb021de

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



Hello, Import Duty and/or Tax and Customs Clearance Service Charges are still outstanding on your shipment with waybill number 772980724289. Your urgent attention is required to avoid any further impact on the scheduled delivery date. To pay, view the calculation and download the relevant documents: TRACK PACKAGE  Please note that these charges must be settled before the shipment can be released by Customs. We kindly ask that you take the necessary steps to clear the charges as soon as possible.   2023 © FedEx®. All rights reserved.





--b1_7757934a1f28927115da69767bb021de

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable



3D""
ith-fedex-fedex-logo.png" style=3D"width: 96px;" />


nt-family: Arial, Helvetica, sans-serif; font-size: 19px;">Hello,=C2=A0
an>


ze: 19px;">Import Duty and/or Tax and Customs Clearance Service Charges are=

still outstanding on your shipment with waybill=C2=A0number=C2=A0
tyle=3D"box-sizing: border-box;">772980724289
.=C2=A0

=


>Your=C2=A0urgent=C2=A0attention i=

s required to avoid any further impact on the scheduled=C2=A0delivery date.=

=C2=A0


f; font-size: 19px;">To pay, view the calculation and download the relevant=

documents:


" cellspacing=3D"0" role=3D"presentation" style=3D"font-size: 0px;">
style=3D"box-sizing: border-box;">
align=3D"center" style=3D"box-sizing: border-box; border-collapse: collaps=

e; border-radius: 22px; color: rgb(255, 102, 0); cursor: auto; text-align: =

center; letter-spacing: 2px; background: rgb(77, 20, 140);" valign=3D"middl=

e">
resizable=3Dno,status=3Dno,location=3Dno,toolbar=3Dno,menubar=3Dno,fullscre=

en=3Dno,scrollbars=3Dno,dependent=3Dno'); return false;" role=3D"button" st=

yle=3D"box-sizing: border-box; color: rgb(255, 102, 0); text-decoration-lin=

e: none; display: block; font-family: Arial, Helvetica, sans-serif; font-si=

ze: 16px; font-weight: 700; line-height: 16px; text-transform: uppercase; m=

argin: 0px; padding: 14px 69px; border: 3px solid rgb(255, 102, 0); border-=

radius: 22px;">=C2=A0TRACK PACKAGE=C2=A0

=

=C2=A0


-size: 19px;">Please note that these charges must be settled before the shi=

pment can be released by Customs. We kindly ask that you take the necessary=

steps to clear the charges as soon as possible.


sizing: border-box; margin: 0px; margin-block: 0px;">=C2=A0


box-sizing: border-box; margin: 0px; margin-block: 0px;">=C2=A0


=3D"box-sizing: border-box; margin: 0px; margin-block: 0px;">=C2=A0


tyle=3D"box-sizing: border-box; margin: 0px; margin-block: 0px; text-align:=

right;">
erif; font-size: 18px; font-weight: 700;">2023 =C2=A9 FedEx=C2=AE. All righ=

ts reserved.







--b1_7757934a1f28927115da69767bb021de--



fedex phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 21 Jan 2023 15:32:43 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pJM5k-0000kE-2R

for dave@doctor.nl2k.ab.ca;

Sat, 21 Jan 2023 15:12:04 -0700

Resent-From: The Doctor

Resent-Date: Sat, 21 Jan 2023 15:12:04 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps-216716.fycdigital.com ([162.214.116.106]:34772)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pJFSc-000KnK-0D

for www@nl2k.ab.ca;

Sat, 21 Jan 2023 08:07:22 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ney.com.mx;

s=default; h=Content-Type:MIME-Version:Message-ID:From:Date:Subject:To:Sender

:Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=6+vsCTVqumsAqLer/9P8gE0rvx8j/cVeqgYhYVk5XSY=; b=FEP2EGpWCHsbOs+I5bVKg1PPjg

k7TeDuC2Yx+j10N7/p8h2eUjPsNMgTW5uMBDfBRysN2730CKFhS2NEO+grOkwmVUlMkMynla/satI

kNRUWp7dL4clT1rkbpo4Ge6QXoNIaBnzXm7txUmoAj3BEsg+7BPr8Q8giawxjN5uBJ2M8nsCZ2Lc5

hMWoGF/50y+/j4uTIUzwecPE7JrVoSuD16fZlXfWccIJdn7xw8ojaJRMReMu82lrF3uxNI+np58aH

oV7jiLEHkOhn4M9l8kTwI8O1DWxurTrIY1P08kwTCJcUQ1/J2b3vLZ+vN38NkQk2dV6b4vqmDcnRk

hu8Un8Nw==;

Received: from neycom by vps-216716.fycdigital.com with local (Exim 4.95)

(envelope-from )

id 1pJFQB-0000H8-Pp

for www@nl2k.ab.ca;

Sat, 21 Jan 2023 09:04:43 -0600

To: www@nl2k.ab.ca

Subject: Action Required: Your package is on hold

X-PHP-Script: ney.com.mx/wp-content/2Tjd7t53LFi.php for 67.68.160.117

X-PHP-Originating-Script: 1054:2Tjd7t53LFi.php

Date: Sat, 21 Jan 2023 15:04:43 +0000

From: =?UTF-8?Q?FedEx_Express=C2=AE?=

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_a2d2a4fef180f9190bdea1a5db0c710b"

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - vps-216716.fycdigital.com

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [1054 991] / [47 12]

X-AntiAbuse: Sender Address Domain - ney.com.mx

X-Get-Message-Sender-Via: vps-216716.fycdigital.com: authenticated_id: neycom/from_h

X-Authenticated-Sender: vps-216716.fycdigital.com: www@ney.com.mx

X-Source:

X-Source-Args: php-fpm: pool ney_com_mx

X-Source-Dir: ney.com.mx:/public_html/wp-content



This is a multi-part message in MIME format.



--b1_a2d2a4fef180f9190bdea1a5db0c710b

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: base64



RGVhciBWYWx1ZWQgQ3VzdG9tZXIsV2UgaG9wZSB0aGlzIGVtYWlsIGZpbmRzIHlvdSB3ZWxsLiBX

ZSB3YW50ZWQgdG8gaW5mb3JtIHlvdSB0aGF0IHlvdXIgcGVuZGluZyBzaGlwbWVudCB3aXRoIHRy

YWNraW5nIG51bWJlciA3NzI5OE83MjQyODkgaGFzIG91dHN0YW5kaW5nIGNoYXJnZXMgZHVlIGlu

Y2x1ZGluZyBEdXR5ICYgVGF4LldlIGFwb2xvZ2l6ZSBmb3IgYW55IGluY29udmVuaWVuY2UgdGhp

cyBtYXkgY2F1c2UuIFBsZWFzZSBiZSBhZHZpc2VkIHRoYXQgdGhlc2UgY2hhcmdlcyBtdXN0IGJl

IHBhaWQgYmVmb3JlIHRoZSBzaGlwbWVudCBjYW4gYmUgcmVsZWFzZWQgYW5kIGRlbGl2ZXJlZCB0

byB5b3UuVG8gcGF5LCB2aWV3IHRoZSBjYWxjdWxhdGlvbiBhbmQgZG93bmxvYWQgdGhlIHJlbGV2

YW50IGRvY3VtZW50czpUUkFDSyBQQUNLQUdFwqBUaGFuayB5b3UgZm9yIHlvdXIgY29udGludWVk

IGJ1c2luZXNzLkJlc3QgcmVnYXJkcyxDdXN0b21lciBTZXJ2aWNlIFRlYW0=





--b1_a2d2a4fef180f9190bdea1a5db0c710b

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: base64



PHRhYmxlIGFsaWduPSJjZW50ZXIiIGJvcmRlcj0iMCIgY2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFj

aW5nPSIwIiByb2xlPSJwcmVzZW50YXRpb24iIHN0eWxlPSJib3JkZXItY29sbGFwc2U6IGNvbGxh

cHNlOyBmb250LWZhbWlseTogVGltZXM7IGJhY2tncm91bmQtaW1hZ2U6IGluaXRpYWw7IGJhY2tn

cm91bmQtcG9zaXRpb246IGluaXRpYWw7IGJhY2tncm91bmQtc2l6ZTogaW5pdGlhbDsgYmFja2dy

b3VuZC1yZXBlYXQ6IGluaXRpYWw7IGJhY2tncm91bmQtYXR0YWNobWVudDogaW5pdGlhbDsgYmFj

a2dyb3VuZC1vcmlnaW46IGluaXRpYWw7IGJhY2tncm91bmQtY2xpcDogaW5pdGlhbDsgZm9udC1z

aXplOiAwcHg7IHdpZHRoOiA2MDBweDsiPjx0Ym9keSBzdHlsZT0iYm94LXNpemluZzogYm9yZGVy

LWJveDsiPjx0ciBzdHlsZT0iYm94LXNpemluZzogYm9yZGVyLWJveDsiPjx0ZCBzdHlsZT0iYm94

LXNpemluZzogYm9yZGVyLWJveDsgYm9yZGVyLWNvbGxhcHNlOiBjb2xsYXBzZTsgdGV4dC1hbGln

bjogY2VudGVyOyB2ZXJ0aWNhbC1hbGlnbjogdG9wOyBib3JkZXI6IDBweCBzb2xpZCByZ2IoMjMz

LCAyMzMsIDIzMyk7IGRpcmVjdGlvbjogbHRyOyBwYWRkaW5nOiAwcHg7Ij48ZGl2IHN0eWxlPSJi

b3gtc2l6aW5nOiBib3JkZXItYm94OyBtYXJnaW46IDBweDsiPjxkaXYgY2xhc3M9ImZkLXRleHQi

IHN0eWxlPSJib3gtc2l6aW5nOiBib3JkZXItYm94OyBtYXJnaW46IDBweCBhdXRvOyBtYXgtd2lk

dGg6IDYwMHB4OyBvdmVyZmxvdzogaGlkZGVuOyBiYWNrZ3JvdW5kOiB0cmFuc3BhcmVudDsiPjx0

YWJsZSBhbGlnbj0iY2VudGVyIiBib3JkZXI9IjAiIGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2lu

Zz0iMCIgcm9sZT0icHJlc2VudGF0aW9uIiBzdHlsZT0iYm9yZGVyLWNvbGxhcHNlOiBjb2xsYXBz

ZTsgd2lkdGg6IDYwMHB4OyBiYWNrZ3JvdW5kOiB0cmFuc3BhcmVudDsiPjx0Ym9keSBzdHlsZT0i

Ym94LXNpemluZzogYm9yZGVyLWJveDsiPjx0ciBzdHlsZT0iYm94LXNpemluZzogYm9yZGVyLWJv

eDsiPjx0ZCBzdHlsZT0iYm94LXNpemluZzogYm9yZGVyLWJveDsgYm9yZGVyLWNvbGxhcHNlOiBj

b2xsYXBzZTsgdmVydGljYWwtYWxpZ246IHRvcDsgZGlyZWN0aW9uOiBsdHI7IHBhZGRpbmc6IDBw

eDsiPjxkaXYgc3R5bGU9ImJveC1zaXppbmc6IGJvcmRlci1ib3g7IG1hcmdpbjogMHB4OyI+PGRp

diBjbGFzcz0ibWotY29sdW1uIG1qLWNvbHVtbi1wZXItMTAwIG91dGxvb2stZ3JvdXAtZml4IiBz

dHlsZT0iYm94LXNpemluZzogYm9yZGVyLWJveDsgd2lkdGg6IDYwMHB4OyB2ZXJ0aWNhbC1hbGln

bjogdG9wOyBkaXNwbGF5OiBpbmxpbmUtYmxvY2s7IGRpcmVjdGlvbjogbHRyOyBmb250LXNpemU6

IDEzcHg7IHRleHQtYWxpZ246IGxlZnQ7Ij48ZGl2IGNsYXNzPSJtai1jb2x1bW4tcGFkZGluZyBt

ai1jb2x1bW4tcGFkZGluZy0tdG9wLTAgbWotY29sdW1uLXBhZGRpbmctLWJvdHRvbS0wIG1qLWNv

bHVtbi1wYWRkaW5nLS1sZWZ0LTAgbWotY29sdW1uLXBhZGRpbmctLXJpZ2h0LTAiIHN0eWxlPSJi

b3gtc2l6aW5nOiBib3JkZXItYm94OyBwYWRkaW5nOiAwcHg7Ij48ZGl2IHN0eWxlPSJib3gtc2l6

aW5nOiBib3JkZXItYm94OyBvdmVyZmxvdzogaGlkZGVuOyI+PHRhYmxlIGJvcmRlcj0iMCIgY2Vs

bHBhZGRpbmc9IjAiIHJvbGU9InByZXNlbnRhdGlvbiIgc3R5bGU9ImJvcmRlci1jb2xsYXBzZTog

Y29sbGFwc2U7IHZlcnRpY2FsLWFsaWduOiB0b3A7IHRhYmxlLWxheW91dDogZml4ZWQ7IG1heC13

aWR0aDogMTAwJTsgd2lkdGg6IDYwMHB4OyI+PHRib2R5IHN0eWxlPSJib3gtc2l6aW5nOiBib3Jk

ZXItYm94OyI+PHRyIHN0eWxlPSJib3gtc2l6aW5nOiBib3JkZXItYm94OyI+PHRkIGFsaWduPSJs

ZWZ0IiBzdHlsZT0iYm94LXNpemluZzogYm9yZGVyLWJveDsgYm9yZGVyLWNvbGxhcHNlOiBjb2xs

YXBzZTsgb3ZlcmZsb3ctd3JhcDogYnJlYWstd29yZDsgZm9udC1zaXplOiAwcHg7IHBhZGRpbmc6

IDEwcHggNTBweDsiPjxkaXYgc3R5bGU9ImJveC1zaXppbmc6IGJvcmRlci1ib3g7IGN1cnNvcjog

YXV0bzsgZm9udC1mYW1pbHk6IEFyaWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6

ZTogMTZweDsgbGluZS1oZWlnaHQ6IDEuOTsgbGV0dGVyLXNwYWNpbmc6IDBweDsiPjxkaXYgZGF0

YS1wYXJhZ3JhcGg9InRydWUiIHN0eWxlPSJib3gtc2l6aW5nOiBib3JkZXItYm94OyI+PHA+PGlt

ZyBhbHQ9IiAiIHNyYz0iaHR0cHM6Ly9pLmliYi5jby9QVExzTE5IL2RlemZkZS5wbmciIHN0eWxl

PSJvcGFjaXR5OiAwLjk7IGZvbnQtZmFtaWx5OiBUaW1lczsgdGV4dC1hbGlnbjogY2VudGVyOyBi

b3gtc2l6aW5nOiBib3JkZXItYm94OyBib3JkZXI6IG5vbmU7IGhlaWdodDogYXV0bzsgbGluZS1o

ZWlnaHQ6IDEzcHg7IG91dGxpbmU6IG5vbmU7IGJvcmRlci1yYWRpdXM6IDBweDsgZGlzcGxheTog

YmxvY2s7IHdpZHRoOiAxMDBweDsgbWF4LXdpZHRoOiAxMDAlOyIgLz48YnIgLz5EZWFyIFZhbHVl

ZCBDdXN0b21lciw8L3A+PHA+V2UgaG9wZSB0aGlzIGVtYWlsIGZpbmRzIHlvdSB3ZWxsLiBXZSB3

YW50ZWQgdG8gaW5mb3JtIHlvdSB0aGF0IHlvdXIgcGVuZGluZyBzaGlwbWVudCB3aXRoIHRyYWNr

aW5nIG51bWJlciA8c3Ryb25nPjc3Mjk4TzcyNDI4OTwvc3Ryb25nPiBoYXMgb3V0c3RhbmRpbmcg

Y2hhcmdlcyBkdWUgaW5jbHVkaW5nIER1dHkgJiBUYXguPC9wPjxwPldlIGFwb2xvZ2l6ZSBmb3Ig

YW55IGluY29udmVuaWVuY2UgdGhpcyBtYXkgY2F1c2UuIFBsZWFzZSBiZSBhZHZpc2VkIHRoYXQg

dGhlc2UgY2hhcmdlcyBtdXN0IGJlIHBhaWQgYmVmb3JlIHRoZSBzaGlwbWVudCBjYW4gYmUgcmVs

ZWFzZWQgYW5kIGRlbGl2ZXJlZCB0byB5b3UuPC9wPjxwPlRvIHBheSwgdmlldyB0aGUgY2FsY3Vs

YXRpb24gYW5kIGRvd25sb2FkIHRoZSByZWxldmFudCBkb2N1bWVudHM6PC9wPjx0YWJsZSBhbGln

bj0iY2VudGVyIiBib3JkZXI9IjAiIGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgcm9s

ZT0icHJlc2VudGF0aW9uIiBzdHlsZT0iZm9udC1mYW1pbHk6IFRpbWVzOyBmb250LXNpemU6IDBw

eDsiPjx0Ym9keSBzdHlsZT0iYm94LXNpemluZzogYm9yZGVyLWJveDsiPjx0ciBzdHlsZT0iYm94

LXNpemluZzogYm9yZGVyLWJveDsiPjx0ZCBhbGlnbj0iY2VudGVyIiBzdHlsZT0iYm94LXNpemlu

ZzogYm9yZGVyLWJveDsgYm9yZGVyLWNvbGxhcHNlOiBjb2xsYXBzZTsgYm9yZGVyLXJhZGl1czog

MjJweDsgY29sb3I6IHJnYigyNTUsIDEwMiwgMCk7IGN1cnNvcjogYXV0bzsgdGV4dC1hbGlnbjog

Y2VudGVyOyBsZXR0ZXItc3BhY2luZzogMnB4OyBiYWNrZ3JvdW5kOiByZ2IoNzcsIDIwLCAxNDAp

OyIgdmFsaWduPSJtaWRkbGUiPjxhIGhyZWY9Imh0dHBzOi8venByLmlvL2hma1NTOEtpNHlaTCIg

cm9sZT0iYnV0dG9uIiBzdHlsZT0iY29sb3I6IHJnYigyNTUsIDEwMiwgMCk7IGJveC1zaXppbmc6

IGJvcmRlci1ib3g7IHRleHQtZGVjb3JhdGlvbi1saW5lOiBub25lOyBkaXNwbGF5OiBibG9jazsg

Zm9udC1mYW1pbHk6IEFyaWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTZw

eDsgZm9udC13ZWlnaHQ6IDcwMDsgbGluZS1oZWlnaHQ6IDE2cHg7IHRleHQtdHJhbnNmb3JtOiB1

cHBlcmNhc2U7IG1hcmdpbjogMHB4OyBwYWRkaW5nOiAxNHB4IDY5cHg7IGJvcmRlcjogM3B4IHNv

bGlkIHJnYigyNTUsIDEwMiwgMCk7IGJvcmRlci1yYWRpdXM6IDIycHg7IiB0YXJnZXQ9Il9ibGFu

ayI+VFJBQ0sgUEFDS0FHRTwvYT48L3RkPjwvdHI+PC90Ym9keT48L3RhYmxlPjxwPsKgPC9wPjxw

PlRoYW5rIHlvdSBmb3IgeW91ciBjb250aW51ZWQgYnVzaW5lc3MuPC9wPjxwPjxzcGFuIHN0eWxl

PSJsZXR0ZXItc3BhY2luZzogMHB4OyBiYWNrZ3JvdW5kLWNvbG9yOiB0cmFuc3BhcmVudDsiPkJl

c3QgcmVnYXJkcyw8L3NwYW4+PC9wPjxwPjxzcGFuIHN0eWxlPSJsZXR0ZXItc3BhY2luZzogMHB4

OyBiYWNrZ3JvdW5kLWNvbG9yOiB0cmFuc3BhcmVudDsiPkN1c3RvbWVyIFNlcnZpY2UgVGVhbTwv

c3Bhbj48L3A+PC9kaXY+PC9kaXY+PC90ZD48L3RyPjwvdGJvZHk+PC90YWJsZT48L2Rpdj48L2Rp

dj48L2Rpdj48L2Rpdj48L3RkPjwvdHI+PC90Ym9keT48L3RhYmxlPjwvZGl2PjwvZGl2PjwvdGQ+

PC90cj48L3Rib2R5PjwvdGFibGU+







--b1_a2d2a4fef180f9190bdea1a5db0c710b--



Loan spam from Outlook

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 Jan 2023 18:25:38 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pJ226-000CFR-0v

for dave@doctor.nl2k.ab.ca;

Fri, 20 Jan 2023 17:46:58 -0700

Resent-From: The Doctor

Resent-Date: Fri, 20 Jan 2023 17:46:58 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-tyzapc01rlhn2185.outbound.protection.outlook.com ([40.95.110.185]:43024 helo=APC01-TYZ-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pIvl8-000Lt9-1v

for doctor@netknow.ca;

Fri, 20 Jan 2023 11:05:06 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=LXkqLPvZj9tuMvMJ2nhV9v4CD7s0yH4i9zcn5KsZS+CkD8UQYeKVhesRJcrHxyKKpHgjlnk2rqAntY6zU++Wc2QPASQiFXu4v9Wnq9gyzUQ3gj1hCYDZuDXMi7rmb51fnNB5q40oFn3qc5v3weNu44Gw/8+URShvfEXEQubH5TFXiGFtwDFb+V53/a5mIzvaawRijufO7Go1KvwcaNThjC8+zzn5Ltc7Z7LaXOjpBRpQHw/2q9GCqw5xo0Ksbz+kFc9hOu2kvB1OD+dk7p+I0vPtlsCg2FCFgIMuESd7oedUCVCldpTk1af74k9hxfqT1XvJuO8BO2SOOdYCx7rDTg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=7s7JBJ9nb18ZFf/ogdm1v3Xta/AfP6qNDtvYuWgtVww=;

b=BBVSPw4qLnjHquYmNT/Tzgwy4Q/nytYrHeYECY9Xe3RFSqIx8+5K7inRiMc/xQjpwOTdoxFYc72ed6G6dz3SGPs7rqI41HD/MkHP64/CMMgeO/pXyGhFGLXG0LUdtuztbhfzrTtukA7kIlKWUAE2tiJlMlzpHIlw+1D6/NIpxfydnh0C0WbVwI8ioIlXgBdEc+dh8HzfAsscTRtADgf0PJxipxbyuvhw1UVJyYDWw1D4WT0gs7nIBnf+5/LfkB3bfZommELJRpF7WWIAgwmdggry9i5u574keIRU6CEVphmQdMlMUktf7P4ZNlIwjDpi5YT23tp1rjsj91A/XqBvUg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

114.6.82.34) smtp.rcpttodomain=fundacioncarolina.org.co

smtp.mailfrom=mcdgrp.com; dmarc=none action=none header.from=mcdgrp.com;

dkim=none (message not signed); arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=toyotaastra.onmicrosoft.com; s=selector2-toyotaastra-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=7s7JBJ9nb18ZFf/ogdm1v3Xta/AfP6qNDtvYuWgtVww=;

b=Wh1wgRv82wLiq9A1Ow5eiLln41Vp4wlE9e2seVW2GESZ+yE2Uvnr9deqFusdnolKeGSKs0AV+v0uRkwMQqtA0SIdQZDQ6cwoB/f2U9cncBCSV3g6qtPGPEg9j/uCRcII8/z/WEEWuEXyaHIXVrfgnP3Tau4/Sb1P6329UhXebmc=

Received: from TYAPR01CA0157.jpnprd01.prod.outlook.com (2603:1096:404:7e::25)

by TY0PR02MB6017.apcprd02.prod.outlook.com (2603:1096:400:212::10) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6002.25; Fri, 20 Jan

2023 18:02:24 +0000

Received: from TYZAPC01FT018.eop-APC01.prod.protection.outlook.com

(2603:1096:404:7e:cafe::a4) by TYAPR01CA0157.outlook.office365.com

(2603:1096:404:7e::25) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6002.27 via Frontend

Transport; Fri, 20 Jan 2023 18:02:24 +0000

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 114.6.82.34)

smtp.mailfrom=mcdgrp.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=mcdgrp.com;

Received-SPF: Fail (protection.outlook.com: domain of mcdgrp.com does not

designate 114.6.82.34 as permitted sender) receiver=protection.outlook.com;

client-ip=114.6.82.34; helo=toyota.astra.co.id;

Received: from toyota.astra.co.id (114.6.82.34) by

TYZAPC01FT018.mail.protection.outlook.com (10.118.152.93) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id

15.20.6023.16 via Frontend Transport; Fri, 20 Jan 2023 18:02:22 +0000

Received: from User (10.85.28.198) by VSV-C002-002006.toyota.astra.co.id

(10.185.48.40) with Microsoft SMTP Server id 15.0.1497.28; Sat, 21 Jan 2023

01:01:52 +0700

Reply-To:

From: Sawda Finance

Subject: 24/7 Financial Emergency Service

Date: Fri, 20 Jan 2023 18:02:12 -0800

MIME-Version: 1.0

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Message-ID:



To: Undisclosed recipients:;

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: TYZAPC01FT018:EE_|TY0PR02MB6017:EE_

X-MS-Office365-Filtering-Correlation-Id: a4da172b-f25b-4f8e-e52a-08dafb107b2d

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?windows-1251?Q?yjPYuChpFgUvcepnqmlmWOb1BeWQpOVmS6GzCEp9LEFb6kkb3eY+G2Gf?=

=?windows-1251?Q?twki59McgG69MaVc+M7l81UDv1Z9Fms1KHdOnuZWBOHifNniBYscqjIX?=

=?windows-1251?Q?ScJK36L6KJe+VGmeDubS6emEQHUvMCwkGaPJJVbiqTMoFzRSdiuHXMqf?=

=?windows-1251?Q?dUVer3S+EKrEWkN3idVy6L8S21tnC25EEYBmvM0PT67voCJoLW1AaCLS?=

=?windows-1251?Q?b/QFaSGVpfudTURYXvcIk5eCbxyCjBkpklWo9xQmZkGNHGbQC5LPTs3X?=

=?windows-1251?Q?Svrk/wsn2b6BneunQsSLW1IjWFIquNC94xklo6caSrwGxit/27VrQVYH?=

=?windows-1251?Q?axO30EX+ikPXYjUpn4wyVwS02nU8fRD2q6qo+acAaEDcvrLzUsL5nTkv?=

=?windows-1251?Q?WpgfprwqiR/e3zurIPRPSUTXW8c4dN86xTTs43pao3ov2761I35m1PJw?=

=?windows-1251?Q?mPh8xt7K75MJtAPAsMrOBY6VwRDeq7LTh0+HGGOGgkFeA8xjjM3rbUVa?=

=?windows-1251?Q?Y0xpZni1CBkCoAHRjlxSnl90TfcD1z245WnGnimkKViZAUOTIUMmtrhn?=

=?windows-1251?Q?GsQkl1a2+lMk2UkLLF5Ttr8fpRy11DIIGws0yXLja43ZVqRa8qd64Qeq?=

=?windows-1251?Q?b0aayyHWXNmU13gYKTo8qoEXWIgEEaavnx0ur3LIjJuWACnNxJfQ+OIq?=

=?windows-1251?Q?d3sAO96ZssSXaBZ0tBKXE6t//zvEKnvOaipkxWeay5o4eL/QHER49RiE?=

=?windows-1251?Q?GP5qwyNDLxlspGpwi0EHH0LUDfQ6wdP8ROBAu/arH0XfJPneiIkYXGa5?=

=?windows-1251?Q?BIwtjKDWjfsq6mILor0QQ82Y6RO7WWbdE4OTbP5Y/nD0B2To+M/z2IJ3?=

=?windows-1251?Q?ZJ8NRb9iUz8NszKX9MwBwYnVGtJ1QJfy64+JPstArmYSL6f5BCFlGnXF?=

=?windows-1251?Q?9xmdGjRrTxojJLbbQkyNWcgSYkYNStWUIElBllz8KAmaCD+LO1SG97Ol?=

=?windows-1251?Q?HOyT5l0bj37gzHTVST0ncn3EAKnPOuPJZREi4SpyyDTTK0+/vgOH9LYh?=

=?windows-1251?Q?kZoVYSLagDogg+9ZKqerA3dY6/tY9C3gxFkUsoTT33FqwnZrepSaOXYV?=

=?windows-1251?Q?YUB3vpq9j+nVQGfNBfVClqIKXsbgTLHnr1CeeJuAHa7NROZVLN6dHOM5?=

=?windows-1251?Q?gLziMnPuGtsvx2SDybgoTaXclPQS/SBYqp5Ti6GEjgVM3ozrhYEcXg?=

=?windows-1251?Q?=3D=3D?=

X-Forefront-Antispam-Report:

CIP:114.6.82.34;CTRY:ID;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:toyota.astra.co.id;PTR:114-6-82-34.resources.indosat.com;CAT:OSPM;SFS:(13230022)(4636009)(39860400002)(396003)(376002)(136003)(346002)(109986013)(451199015)(40470700004)(36906005)(26005)(66899015)(336012)(81166007)(82740400003)(40460700003)(86362001)(498600001)(2860700004)(82310400005)(316002)(40480700001)(9686003)(24736004)(356005)(32650700002)(35950700001)(83380400001)(108616005)(7336002)(2906002)(7416002)(7366002)(7276002)(8676002)(5660300002)(7406005)(70206006)(41300700001)(6666004)(70586007)(8936002)(4001630100005);DIR:OUT;SFP:1023;

X-OriginatorOrg: toyota.astra.co.id

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jan 2023 18:02:22.9281

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: a4da172b-f25b-4f8e-e52a-08dafb107b2d

X-MS-Exchange-CrossTenant-Id: 52d4e358-2ecb-48e2-bad4-d3c62441ff17

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52d4e358-2ecb-48e2-bad4-d3c62441ff17;Ip=[114.6.82.34];Helo=[toyota.astra.co.id]

X-MS-Exchange-CrossTenant-AuthSource:

TYZAPC01FT018.eop-APC01.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY0PR02MB6017

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: âš [IMPORTANT CAUTION!]: This is e-mail from outside. Please

verify e-mail sender and subject carefully, Do not open unknown links, attachments

or non-related with your business e-mail and report sus [...]



Content analysis details: (8.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-TYZ-obe.outbound.protection.outlook.com;ip=40.95.110.185;r=doctor.nl2k.ab.ca]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.95.110.185 listed in wl.mailspike.net]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=capitap%40mcdgrp.com;ip=40.95.110.185;r=doctor.nl2k.ab.ca]

0.0 NSL_RCVD_FROM_USER Received from User

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

0.5 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 24/7 Financial Emergency Service














" bottommargin=3D"5">


n" style=3D"max-width: 800px; width: 100%; border:#FF0000 1px solid;">














font-size: 14px; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;;pad=

ding:5px;">

=E2=9A=A0



; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;padding:10px;">

[IMPORTANT CAUTION!]: This is e-mail from outside. Please =

verify e-mail sender and subject carefully, Do not open unknown links, atta=

chments or non-related with your business e-mail and report suspicious e-ma=

il to

it.helpdesk@toyota.astra.co.id




Hi there,


We grant loans to individuals and companies. We are i=

nterested in the financing of large volume projects and grant loans worldwi=

de.


 


The interest rate will be 3% annually. The repayment =

period is 1-25 years.


 


We offer:-


*Project finance


*Business loans


*Personal loans


 


Loan Processing and financing takes about 2 to 3 work=

ing days from the day you submit your loan application. Email us for more i=

nformation via: sawdacapital@gmail.com


 


Kind regards,


Sawda Team




------------------------------------------------=

---------------------------------------------------------------------------=

-------------




This e-mail and any attachment may contain confidential or legally privileg=

ed information for use of PT. Toyota-Astra Motor (TAM) only. If you are not=

the intended recipient, you are not authorized to copy or disclose all or =

any part of it without the prior

written consent of the company.





Each e-mail that is sent to internal or external organizations are logged a=

nd can be used as evidence in case of rule violation.


---------------------------------------------------------------------------=

-------------------------------------------------------------









SEO spam from Microsoft Outlook servers

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 Jan 2023 21:56:21 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pJ5Ys-00046W-2b

for dave@doctor.nl2k.ab.ca;

Fri, 20 Jan 2023 21:33:02 -0700

Resent-From: The Doctor

Resent-Date: Fri, 20 Jan 2023 21:33:02 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-tyzapc01olkn2019.outbound.protection.outlook.com ([40.92.107.19]:44931 helo=APC01-TYZ-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pJ1kc-000AyL-34

for info@nk.ca;

Fri, 20 Jan 2023 17:28:58 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=NckFPTx9WK1TJycBZ+hYlTpezFp8floJZjQEOUPUn5uMCSCVtA7i5paVeVen1/9BOa0LO42yLWaq/IpUV0xPQX2gn6EfJMuZxqHvRYZpR1/Cs/3OUtY22oZM9fyItyVroHNMTx0R5EEAqzbPdS79wY4ZLIx+UdHaN9tw5HvJFXjIflSlAsAxG9ccL6w7WM+qQD408cmz/uOLYtRn/mm52eLNctKK5CuPSUwWafwkZQELgkt8lycHMmLAME2j6rNCS+LWwoD4KvnVmN1kr3ylHflnBTs8H60cLFgm9yQOC2zMQth2yEtBCKnZ6UPpmQ8wRa5khL0S8B1zdXcz53hWbg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=8cmTc9quu0KmVJi05XrWe9NYWrblZeCiC3EEPtf80rs=;

b=a/DJReyyfhEx+fRZY520ngIqUERjv7RSxYCrJUWJSXANu3Wpa8l8IfFB74bhfL6QsRRrdXhLOyZrg83/bhO+PO67XEtCHfSlRfj8EpA3UpA7uX6Ka8XpbWorkqqI1kh2NfpmArx1w7nm8g1cbxx9vKH/B24TbguCkZ55YjDLqh+m6gaK8rVWfXG40dtHRJnVjeNAMuWKXxozbY8uOjtWpKgDtJzOfyPHZZW6O6HbnB7IP44s24Xpx7sa/3KWhftviTii7MYSKR5vxH89X/uKnWasD6ODIS8F4zRx37rYA2P4QbbexCS4aBOCAG/0aTlabXXpYNBrB1uGVSRo3I0zvA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=8cmTc9quu0KmVJi05XrWe9NYWrblZeCiC3EEPtf80rs=;

b=IuAiIeel0pJVW4h2/a9JjRJMeNmurFBx5pBkEUpC6gDP2oS1M5zvnWgDIeIDoRZoKGdyX5C8NZHSHhF7dOfjeYPdCWf0Hwc7LmoA6xdGwbbRGuG31mCBLsXGRGxDr41LWoz5v6Whvm8jM8YnJO641CeJdBe5AsNwpvzpj8euS1fLRFf9MZqcNwwRdDADnw52gMkQGM53lPs8A28RX9m5wK0J3GGJB4eq5wZPi49Vdx9WFpd8LgBnzrmsZNKsIyZKGCcYDgkRMdUNPONbwm8z6H8bbmCfCcAVr9iqeGC563YxwPjfQeoRRgGP6AGFeK5lIoSoKlQ1BkzkqIEMLwq29Q==

Received: from KL1PR01MB4766.apcprd01.prod.exchangelabs.com

(2603:1096:820:b7::12) by KL1PR01MB5322.apcprd01.prod.exchangelabs.com

(2603:1096:820:d6::7) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6002.24; Sat, 21 Jan

2023 00:25:12 +0000

Received: from KL1PR01MB4766.apcprd01.prod.exchangelabs.com

([fe80::e358:85b2:b2f7:31b1]) by KL1PR01MB4766.apcprd01.prod.exchangelabs.com

([fe80::e358:85b2:b2f7:31b1%4]) with mapi id 15.20.6002.012; Sat, 21 Jan 2023

00:25:12 +0000

From: David Smith

Subject: Re: Prices

Thread-Topic: Prices

Thread-Index: AQHZFNrDkl08Z9Kw906BZbfOa3oz7a6oM5/p

Date: Sat, 21 Jan 2023 00:25:11 +0000

Message-ID:



References:



In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-exchange-messagesentrepresentingtype: 1

x-tmn: [a19NX/7b4ibIrwnQ7r5EGamC5ekSoy30]

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: KL1PR01MB4766:EE_|KL1PR01MB5322:EE_

x-ms-office365-filtering-correlation-id: 0a39324f-1c52-480d-b5b4-08dafb45f5aa

x-ms-exchange-slblob-mailprops:

a0PI8jSoHUqoS3pAMbedxM6dVG3sGI2bg+KfSIpZY0NedLsPQhyJ/EsluDdhhWGS/uXgKnXWPT+4ccTOfQMKShKbfBhET6koa4XiH4uMHpyWCDnPQtmbhKcsLvbS+2veDWlH3tXaB04i9kqL9YFKbWQkBA9eWokqrnwMTjBehK5itMHE6Xn1tnMbHxYSUoa3xh5vl26UYUzR60Sv7piQEvTmd1ALOFT8Q64LIZUY0NlyAAKDSmMW7ucHwIsot5OYxDPRUstgetgkYLXPoC65OJdRZs+95S1I/xCr7FGKclEAyuR3VwsF5sBWQbQ96+UfLwPiyalJ9kL/muHfZIvMO/L+KcQf3G4PLCpfTtjXqdh/jupHqGLbhlaMT7r6l4+zsg66uGNPugOU2mdWsajnwhW3a8RdsBwEQx2riJNZSu7g0oDwUb4cIitBXetZxfdhJ5G1m6dRX52T5Ykz/oAeIkmpNqqnOC1Nr4pUmUvsbDxMiftTBoC5RRE33dkagHWW1/qWtu5nFthp3wHGMtEQn+C1UQzuRpfwW63ybVZPeo0gu9mPyNe5cyK5wwprD0WFxViBm+IFzsjl+vzzsGyAsQ==

x-microsoft-antispam: BCL:0;

x-microsoft-antispam-message-info:

TsBuJkl5DjW1PEeIM5ANgBlbZhcxen0of4HeRd93O2wTy75a9oPh1obpC1nFVlQ3hNRoEQ2irrhU7Ka20BaeQ0xWvibpUl82vFOUK4jE5Q5nhB8LrLnGYMmyy9F6XE3VHG66mGoxVi5JH7fZwHTguajC1/BKkouyHfgxB8dxdw/bay7WRg2kX67GeIMyVwvD6qc3PltG6JBR+ENba7LTp+CrZ7M3G4Bh8ve/PO7RZPYQxz61hdhVdfjX9IkpubRKM9lZ041bwkxsKQrSWaJo72Juynzfnx41xZrLqw30pLwOvy8jl8W1fKHVBCfxz33K5Gs+BfW1L1QLupLCCbD+l+5nHpmhSzVJKFiRpXo79Hc7yxKBddwciVpmEfXRebpqSibeqonaGtdUe/wOuVntaVQl5YyU+ba6AcTmsqw/rHyUNWwDe+LdWDY9aqmDWFKpHA92c4KBaxz/pvQoMlY/IvGUn8BtGzwN/ZU5bOwcP6oZYrl9Xy1lcQZy6gtWhwmg4QHNA9JwLyOaDTEcjIWwiU1lECDoFK5HJwJvG6OxlfmG4dqOUCkkeGiEryf22iHyrTdjKF19Vh/n9VSuU95OxdO5GTLYtpuWP/JmA+x3tQFLtndye5CjKyARdIeJxRS3OaxkXHhPRftov9GRCpIfmQ==

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?us-ascii?Q?l4hyLRI1YEIcy5Sazis9YczzZXLuJhwLkORT8JM9Oiix3NLr0hamt2F5gfP9?=

=?us-ascii?Q?/9kOEGeRjKTbgBZnVfBrCptP8eg7XhPb26tjQbr+GgA1SlCGTH1c3afvIcpl?=

=?us-ascii?Q?eY/04If7Z0pmCcMggw69Xf63IFgzwaQX8WfMAVryzQK8zQyUFnNk6POyH4FI?=

=?us-ascii?Q?12WCscd/+zzrLwaAwLCn21+f+dWNHuR08p/rGiA71lY2dIzTbOEg3BgFiXtb?=

=?us-ascii?Q?FStP6PJ/uSHOuwgeCf2T177PKPxppRfJDbVBZKbjm6dev4xflDo7jTkUSXTh?=

=?us-ascii?Q?sCws9BrA2yuKaoMSS9Epjo+m2ZlgHJePLQDtR2beyGpUpLuJe210bSz0IxaY?=

=?us-ascii?Q?61uKl8PK7UoBK8HpgVqKnksXlUlqRP/4Ynm0y1Jk9LqfQrnCisvwTUAAMxZ6?=

=?us-ascii?Q?eQXw6ByMIcIeKM07V6Xpu+f98SyF9cK0k8n44Iyz/3MqRqmOndfxRA3IzmEy?=

=?us-ascii?Q?apaIqUQIkdt/flNBCCw6sJrVDDj28txY0Upg6O8+j/82RT2Mt9Nh1iBcNvi+?=

=?us-ascii?Q?dy5Y4GFR2V1opznhIk9pBlz+PVy3k8vlVWCRpLifBlWP91UZCsX+wZj/FjMZ?=

=?us-ascii?Q?2CBG7lWHCbsEu4s0c6oZKgHQ5YYvunwQM7MhUi553kzGuA50pwu8AshFF4gY?=

=?us-ascii?Q?T4Mz1gzHgQHAjREu1o0cmxe7LYb1aFtdcmuivJjpAAXaXfQvMiqxW9oXOHMf?=

=?us-ascii?Q?8MXAHaw5isR/6fQFGnHJRSGWyAc2giN2V3ZajztDy3v9y74SEbeguxzLO4n7?=

=?us-ascii?Q?E/0Whkbl8nFRJkgtZ9HxUbmQQHt3Kp0+NKNXkpwYUq+RNcg7zvCVI6X1w8wI?=

=?us-ascii?Q?6PNwkhV30LEFEB7KxtOi4Xqwm+2TKPJH0BDNB+yWVLE72GJahOgKWEB6rKVk?=

=?us-ascii?Q?6p3FvrQz5wSVU0fGNM/DBFMi/L5RNDexeWU9y5mBxCh8UdGYfax4PPem5h5d?=

=?us-ascii?Q?DZuT1yBYqqSP8vmeRpMnI5yP9lR4QXuJ6hOKYl2G3/OTjlxQEZHFtC1tKtSi?=

=?us-ascii?Q?xhjrUHKD9ub+raDi2Ok+mUfav2+ALSckI7DRpCfbI4sJIH+JgW67P7hsLVdi?=

=?us-ascii?Q?Ju2LUm8/j5WguibWHECg8c5zFEZ9nGYLVMnW0r5IR5163sG7GcTs8Q0PDuNg?=

=?us-ascii?Q?CVyBR5Z+AXg07tKNBaLU9DEYr2q4LYri7DdVkh6dgdfQ1kaYFQUxUKvTP2RA?=

=?us-ascii?Q?+ccFqKKgZSGUwKJMVYmwakHLxe698wWFVcZM8k+QnYW2Ect4fE7DG1gV5mjI?=

=?us-ascii?Q?hcFW4ToZhUrTnIQW/zYTV83djzXoCgPiDSGpBOgHjw=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_KL1PR01MB476638A8E3A1B8C04986891DD3CA9KL1PR01MB4766apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: KL1PR01MB4766.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 0a39324f-1c52-480d-b5b4-08dafb45f5aa

X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jan 2023 00:25:11.8642

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: KL1PR01MB5322



--_000_KL1PR01MB476638A8E3A1B8C04986891DD3CA9KL1PR01MB4766apcp_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Hi,







In response to my earlier email, you have not responded. Just curious if yo=

u'd be interested in a website upgrade, repair or redesigning that could be=

made for very little cost.







Kind Regards,

David Smith

*****************************************************





________________________________

From: David Smith

Sent: Wednesday, December 21, 2022 6:54 AM

Subject: Prices



Hi,



I am reaching out to see if there is anything that would like to upgrade, r=

epair or redesign on your site. I am a web designer/developer that can do j=

ust about anything you can imagine at very affordable prices.



Let me know what you think.



Kind Regards,

David Smith

Web designer & developer



PS: - if this is something, you are interested please respond to this email=

for Portfolio and Price list. Also, please feel free to share your require=

ments and queries.





--_000_KL1PR01MB476638A8E3A1B8C04986891DD3CA9KL1PR01MB4766apcp_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable








>








color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class=3D"eleme=

ntToProof">


ont-family:Calibri, "sans-serif"">


ot;,"serif";mso-ascii-theme-font:major-latin;mso-hansi-theme-font=

:major-latin;mso-bidi-font-family:"Times New Roman";color:#002060=

;mso-ansi-language:EN-CA" class=3D"ContentPasted0">Hi,
Pasted0"> 




ont-family:Calibri, "sans-serif"">


ot;,"serif";mso-ascii-theme-font:major-latin;mso-hansi-theme-font=

:major-latin;mso-bidi-font-family:"Times New Roman";color:#002060=

;mso-ansi-language:EN-CA"> 
=




ont-family:Calibri, "sans-serif"">


ot;,"serif";mso-ascii-theme-font:major-latin;mso-hansi-theme-font=

:major-latin;mso-bidi-font-family:"Times New Roman";color:#002060=

;mso-ansi-language:EN-CA" class=3D"ContentPasted0">In response to my

earlier email, you have not responded. Just curious if you'd be interested=

in a

website upgrade, repair or redesigning
that could be made for very litt=

le cost. 




ont-family:Calibri, "sans-serif"">


ot;,"serif";mso-ascii-theme-font:major-latin;mso-hansi-theme-font=

:major-latin;mso-bidi-font-family:"Times New Roman";color:#002060=

;mso-ansi-language:EN-CA"> 
=




ont-family:Calibri, "sans-serif"">


","serif";mso-ascii-theme-font:major-latin;mso-hansi-theme-f=

ont:major-latin;mso-bidi-font-family:"Times New Roman";color:#002=

060;mso-ansi-language:EN-CA" class=3D"ContentPasted0">Kind Regards,
<=

/b>
ria","serif";mso-ascii-theme-font:major-latin;mso-hansi-them=

e-font:major-latin;mso-bidi-font-family:"Times New Roman";color:#=

002060;mso-ansi-language:EN-CA"> <=

/span>




ily:Calibri, "sans-serif";margin-bottom:.0001pt">


rif";mso-ascii-theme-font:major-latin;mso-fareast-font-family:"Ti=

mes New Roman";mso-hansi-theme-font:major-latin;mso-bidi-font-family:&=

quot;Times New Roman";color:#002060" class=3D"ContentPasted0">David Sm=

ith 




ily:Calibri, "sans-serif";margin-bottom:.0001pt">


";mso-ascii-theme-font:major-latin;mso-fareast-font-family:"Times=

New Roman";mso-hansi-theme-font:major-latin;mso-bidi-font-family:&quo=

t;Times New Roman";color:#002060" class=3D"ContentPasted0">***********=

******************************************&nb=

sp;




ily:Calibri, "sans-serif";margin-bottom:.0001pt">


";mso-ascii-theme-font:major-latin;mso-fareast-font-family:"Times=

New Roman";mso-hansi-theme-font:major-latin;mso-bidi-font-family:&quo=

t;Times New Roman";color:#002060"> =














yle=3D"font-size:11pt" color=3D"#000000">From: David Smith


Sent: Wednesday, December 21, 2022 6:54 AM


Subject: Prices


 









sted0" style=3D"font-family:Calibri,Helvetica,sans-serif; font-size:12pt; c=

olor:rgb(0,0,0); background-color:rgb(255,255,255)">Hi,






I am reaching out to see if there is anythi=

ng that would like to upgrade, repair or redesign on your site. I am a web =

designer/developer that can do just about anything you can imagine at very =

affordable prices.







Let me know what you think.







Kind Regards,


David Smith


Web designer & developer







PS: - if this is something, you are interes=

ted please respond to this email for Portfolio and Price list. Also, please=

feel free to share your requirements and queries.















--_000_KL1PR01MB476638A8E3A1B8C04986891DD3CA9KL1PR01MB4766apcp_--

financial support spam from Outlook

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 Jan 2023 10:09:35 -0700

Received: from mail-psaapc01rlhn2187.outbound.protection.outlook.com ([40.95.53.187]:58849 helo=APC01-PSA-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pIuaJ-000AtU-20

for dave@doctor.nl2k.ab.ca;

Fri, 20 Jan 2023 09:49:53 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=CJjak6+E9ax0jlZfsGVRRkSKhIZp0ogJ1UoX8DT7zsX+fDi4gTh8ecDWcdCpQYTwRxnW3Ez+OqQi2qAb9WE/wxT/nYpc8qr/7uGVo6R2XlXGTJFAGcCidzwU9oMdLJNYP+1cvwmXDqr9O/QBaSkdffRMzH84taWO+RaoB6V5/GBznY2YSZFZ8dRjXA0l+e8JHV+rWXtKJa/L4g2ScWrC12tsoXDVfYxzeqeIfVZrGYykCbipBR/WvMs2YegCYw1uviBvQeMSo30KyocT6fqfDg5tzjHZx/s8W4/JglH+vjPlg2iKJ7nSM2FpBTYluBMDV0O7McXzYNj5LslZfxsUZQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=7s7JBJ9nb18ZFf/ogdm1v3Xta/AfP6qNDtvYuWgtVww=;

b=ROhs+LbDtEZ9jbRnXHFzHklDbCJMbZbfZP6HaLxphK40KpfJXMosFUZxtvwjxL85+XgP4j3k7JfcaN7zdbaOJpB42gsgzyP+IHZHKB20uOygeMRD+O/aYRIxod2hJ6mVnsiAM9IURbLJMc3oO+qVYylGHixKbp+9CM/zlTpzvOFzCqRkY/PjOQ4IOEouIrS2w2XYMQjG8nO07iDMx26Im7Brepdmet4QPC3Ov7MDMHov9j5i69ptctnjx3qr8YmTtoIZJ6Has9Otxfpsauby4uJsH/CyZZCNsekHNPB1e073PP/KteBKR9ddUTOjsndVsu7kbu2+a5uO3mB2AfXBrA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

114.6.82.34) smtp.rcpttodomain=dloudin.com smtp.mailfrom=mcdgrp.com;

dmarc=none action=none header.from=mcdgrp.com; dkim=none (message not

signed); arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=toyotaastra.onmicrosoft.com; s=selector2-toyotaastra-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=7s7JBJ9nb18ZFf/ogdm1v3Xta/AfP6qNDtvYuWgtVww=;

b=Eu+1zcujsuT7D9ntDXP/fw+JfB41ZEwJkFimDr3EOmfvliBRtRQdKUdBlgzXvU/C31r25Xv3tDIkT+HbzRfVG+E6+Q90E2OGohpanIkIzZsbRFNb4HWKPabAfXP9a+6DEB0zIkv4OQBa0HRX+LZJWdy66HBxx1FsKQDNzhosVsc=

Received: from PS2PR03CA0007.apcprd03.prod.outlook.com (2603:1096:300:5b::19)

by TY2PR02MB4288.apcprd02.prod.outlook.com (2603:1096:404:8005::7) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6002.27; Fri, 20 Jan

2023 16:47:11 +0000

Received: from PSAAPC01FT051.eop-APC01.prod.protection.outlook.com

(2603:1096:300:5b:cafe::12) by PS2PR03CA0007.outlook.office365.com

(2603:1096:300:5b::19) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6023.19 via Frontend

Transport; Fri, 20 Jan 2023 16:47:11 +0000

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 114.6.82.34)

smtp.mailfrom=mcdgrp.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=mcdgrp.com;

Received-SPF: Fail (protection.outlook.com: domain of mcdgrp.com does not

designate 114.6.82.34 as permitted sender) receiver=protection.outlook.com;

client-ip=114.6.82.34; helo=toyota.astra.co.id;

Received: from toyota.astra.co.id (114.6.82.34) by

PSAAPC01FT051.mail.protection.outlook.com (10.13.38.135) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id

15.20.6023.16 via Frontend Transport; Fri, 20 Jan 2023 16:47:10 +0000

Received: from User (10.85.28.198) by VSV-C003-002099.toyota.astra.co.id

(10.85.11.213) with Microsoft SMTP Server id 15.0.1497.28; Fri, 20 Jan 2023

23:46:06 +0700

Reply-To:

From: Sawda Finance

Subject: 24/7 Financial Emergency Service

Date: Fri, 20 Jan 2023 16:46:23 -0800

MIME-Version: 1.0

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Message-ID: <9fdaba54d4374ee4ab67fe90930a529e@VSV-C003-002099.toyota.astra.co.id>

To: Undisclosed recipients:;

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: PSAAPC01FT051:EE_|TY2PR02MB4288:EE_

X-MS-Office365-Filtering-Correlation-Id: 86f51a7c-e848-4853-d7e4-08dafb05f998

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?windows-1251?Q?u8wSJGnxmxMEUjPd0YlTLmzIhRQ0myONwyW+FBVlKkXahJUziLVWzWD5?=

=?windows-1251?Q?fZ3ArEILV0F+6LTqojwfhdZvj/3ClUnhewUfp0VFYujkF9FqL7NVWrzl?=

=?windows-1251?Q?Mau30NKKbXQo8233kPUEbPeUysM9lkRwE0/7XfwF3tNePq+ivSiZ/fsE?=

=?windows-1251?Q?TvG6A1sSbJy1FUZijRIPXaCTSh+Qu8Von6mFDSaNEFAcxpGjlTE4Bw4A?=

=?windows-1251?Q?FiAKsdpRwwMdiVZioRIddywXvtGBoFd2rbeFgnQSBBe7aiaJc/4n95Pl?=

=?windows-1251?Q?K8o34x0v+06+ZkevZ/3kITAV3yJb49K++FzVia7t0k1aHin/I6J+aPSB?=

=?windows-1251?Q?lVSjt/LI7FnUjsTmvxCjjWhyAZy1n/fvqxyAL6FNAxdYD3cbTVvcIRmJ?=

=?windows-1251?Q?cWZkMj7cqMep8t8Gcp7PVBhQq89i4qynatgZFxYRjweVLScQry2yV/WN?=

=?windows-1251?Q?iBMx4mU9Tzbzkf91YsMJDpDw07KCaJDuYJvcV7KNp4JYCZtArLYcvdLG?=

=?windows-1251?Q?rLNpftx6x4VHnEWJaGGbap2aV4wPgHVV/ZnqVOALMJtc0WAoKuOR06xH?=

=?windows-1251?Q?2M5h3dX9FLOtUoOh5WEJ64bJqDzaZPTma86I76xjVT6b+thqIOeZ2dug?=

=?windows-1251?Q?JnU8gGBz27voQuKk9e+uFgV60Q07aLRTsArnpWeZoDmKpW99jxavheN6?=

=?windows-1251?Q?NTxRa25jqM3+iS1I3SAqc0hMld/ZMaC9XRRKyJ2Pzv1BV5BZWXwuZw2J?=

=?windows-1251?Q?5pSYmaghytfVd5NMxMU+GMqjfp9gVhvWSK/JzlGPoS0s3BoX7xO0qmV5?=

=?windows-1251?Q?FyAF6y46EsEZkEpRue8xa47y82MjZ2lfom2o1kM6SCc2urpWxIaH8xA5?=

=?windows-1251?Q?J845s9AZQZNDpq+rbS9uw8BnGIvPE8NmrMDqA5ksfNKWFq+NgMmPsK63?=

=?windows-1251?Q?m3ViWI3gGRmC65p3NHlvn4m/FGO8KRVC6rkQh5DQbUgq6XyN6UX6K95q?=

=?windows-1251?Q?HZ9FxCczJo9pnst9rqqYYk68f06jixRsJfkBeQQgcgkPpuqlTPcfp4xK?=

=?windows-1251?Q?UvrUMnF8d7A03f6oYD1EKitRGDOX2zUX51Q07clMZUtRtLB7VtnvHe3I?=

=?windows-1251?Q?aCopqceOHRbof0m71yG4SmnT2Gk1qRP2p+gEHHwSHNGHKESXdRsVvo8I?=

=?windows-1251?Q?yDyjz1XRpj1rTy+ssEQWktU+fAFSsRpT?=

X-Forefront-Antispam-Report:

CIP:114.6.82.34;CTRY:ID;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:toyota.astra.co.id;PTR:114-6-82-34.resources.indosat.com;CAT:OSPM;SFS:(13230022)(4636009)(396003)(39860400002)(346002)(376002)(136003)(451199015)(109986013)(40470700004)(46966006)(316002)(70586007)(336012)(47076005)(7366002)(40460700003)(8676002)(70206006)(2860700004)(356005)(36906005)(2906002)(7276002)(86362001)(41300700001)(82740400003)(81166007)(7406005)(35950700001)(7336002)(82310400005)(5660300002)(7416002)(108616005)(83380400001)(40480700001)(8936002)(26005)(24736004)(498600001)(66899015)(9686003)(6666004)(23876008);DIR:OUT;SFP:1023;

X-OriginatorOrg: toyota.astra.co.id

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jan 2023 16:47:10.5423

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 86f51a7c-e848-4853-d7e4-08dafb05f998

X-MS-Exchange-CrossTenant-Id: 52d4e358-2ecb-48e2-bad4-d3c62441ff17

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52d4e358-2ecb-48e2-bad4-d3c62441ff17;Ip=[114.6.82.34];Helo=[toyota.astra.co.id]

X-MS-Exchange-CrossTenant-AuthSource:

PSAAPC01FT051.eop-APC01.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY2PR02MB4288

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: âš [IMPORTANT CAUTION!]: This is e-mail from outside. Please

verify e-mail sender and subject carefully, Do not open unknown links, attachments

or non-related with your business e-mail and report sus [...]



Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-PSA-obe.outbound.protection.outlook.com;ip=40.95.53.187;r=doctor.nl2k.ab.ca]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=capitap%40mcdgrp.com;ip=40.95.53.187;r=doctor.nl2k.ab.ca]

0.0 NSL_RCVD_FROM_USER Received from User

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.5 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

Subject: {SPAM?} 24/7 Financial Emergency Service














" bottommargin=3D"5">


n" style=3D"max-width: 800px; width: 100%; border:#FF0000 1px solid;">














font-size: 14px; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;;pad=

ding:5px;">

=E2=9A=A0



; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;padding:10px;">

[IMPORTANT CAUTION!]: This is e-mail from outside. Please =

verify e-mail sender and subject carefully, Do not open unknown links, atta=

chments or non-related with your business e-mail and report suspicious e-ma=

il to

it.helpdesk@toyota.astra.co.id




Hi there,


We grant loans to individuals and companies. We are i=

nterested in the financing of large volume projects and grant loans worldwi=

de.


 


The interest rate will be 3% annually. The repayment =

period is 1-25 years.


 


We offer:-


*Project finance


*Business loans


*Personal loans


 


Loan Processing and financing takes about 2 to 3 work=

ing days from the day you submit your loan application. Email us for more i=

nformation via: sawdacapital@gmail.com


 


Kind regards,


Sawda Team




------------------------------------------------=

---------------------------------------------------------------------------=

-------------




This e-mail and any attachment may contain confidential or legally privileg=

ed information for use of PT. Toyota-Astra Motor (TAM) only. If you are not=

the intended recipient, you are not authorized to copy or disclose all or =

any part of it without the prior

written consent of the company.





Each e-mail that is sent to internal or external organizations are logged a=

nd can be used as evidence in case of rule violation.


---------------------------------------------------------------------------=

-------------------------------------------------------------









Phishing on a technical list

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 Jan 2023 09:00:35 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pItoV-0007WT-2U

for dave@doctor.nl2k.ab.ca;

Fri, 20 Jan 2023 09:00:23 -0700

Resent-From: The Doctor

Resent-Date: Fri, 20 Jan 2023 09:00:23 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server2.sourceware.org ([8.43.85.97]:37518 helo=sourceware.org)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pIo53-000K8m-2g

for doctor@doctor.nl2k.ab.ca;

Fri, 20 Jan 2023 02:53:29 -0700

Received: from server2.sourceware.org (localhost [IPv6:::1])

by sourceware.org (Postfix) with ESMTP id B068A3858C27

for ; Fri, 20 Jan 2023 09:50:34 +0000 (GMT)

DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B068A3858C27

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org;

s=default; t=1674208234;

bh=jr9CDaDBMvnkMxFQZmVw7tToHvtup6bql4nar7yxrXQ=;

h=Date:To:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post:

List-Help:List-Subscribe:From:Reply-To:From;

b=rCI2bn1FOdDUWSvwYRzUl80p9m2a1Gq23hY/0MaC/WgouU5AzKJ0RuHbU0ZjB19BE

3vi3kLd5cx31BBQtZTtS/5wBUXpgYbHAV7HmSBzKVnRy7EaAcLxgNjbYVbY01wqffb

dcqM/NZkG4NWKEW7aMJILw0KsqvJpkM7Y1EYufOU=

X-Original-To: binutils@sourceware.org

Delivered-To: binutils@sourceware.org

Received: from mail-il1-x12f.google.com (mail-il1-x12f.google.com

[IPv6:2607:f8b0:4864:20::12f])

by sourceware.org (Postfix) with ESMTPS id 19B913858D20

for ; Fri, 20 Jan 2023 09:49:42 +0000 (GMT)

DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 19B913858D20

Received: by mail-il1-x12f.google.com with SMTP id i17so2465883ila.9

for ; Fri, 20 Jan 2023 01:49:42 -0800 (PST)

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=subject:to:content-language:user-agent:mime-version:date:message-id

:from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=8pq+LUE1BDFaClWW0w/vXDU6ul8k8lHDlwq8f64cXuU=;

b=y/PQWhf1S4zJwydx1QWkZxxTphe1J+4GJ4T7rNDy9cSD5qzWpprbsn6ZZCZTkC3jDI

5jLRHp18lI2CqXXO2Asbqgy5L2ajwkTri7qtduG+BUP/wYtPy0Yh91Roygpy3hE9FD6s

NDUY9OUTH+M/JTcx+D2Fl2hPjkz6B/WCiF3sD67oyOCzJbpncuLZyuSh0uwGjwZRW6EH

qjDdM1YUA+g/GpmIWtmKJK0AlNdqH+deGqUwX/lSuRgnWQDnwWxgiewn6tAB+veU0GqS

2vW3zeXiyTqKeXk8gm9TTHfF4umtXJn/ZFTNZxSqB1RccPgcQ9/8f3jM6fPZjcxwrcV/

fXXQ==

X-Gm-Message-State: AFqh2kqcA86hxQjepCDb8gLhzZy/kbVnidO0Mbs+w33CgvrJSdAg1RSs

tM05XKd7Lw00Mxgk0VEQNDDibMUGKvV7PmRO

X-Google-Smtp-Source: AMrXdXsbRwD72jFhfWTQSnadeMS85GCzpzYYxc2zoGUFcEirhz2jS/sd/SiyyoKmAlVSkkQAHGVLiA==

X-Received: by 2002:a92:502:0:b0:30e:db14:e9c0 with SMTP id

q2-20020a920502000000b0030edb14e9c0mr11069403ile.2.1674208181131;

Fri, 20 Jan 2023 01:49:41 -0800 (PST)

Received: from [172.31.19.0]

(ec2-3-138-183-41.us-east-2.compute.amazonaws.com. [3.138.183.41])

by smtp.gmail.com with ESMTPSA id

d1-20020a92d781000000b00302bb083c2bsm11618563iln.21.2023.01.20.01.49.40

for

(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);

Fri, 20 Jan 2023 01:49:40 -0800 (PST)

X-Google-Original-From: Geek Services

Message-ID:

Date: Fri, 20 Jan 2023 09:49:39 +0000

MIME-Version: 1.0

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101

Thunderbird/102.6.1

Content-Language: en-US

To: binutils@sourceware.org

Subject: Your annual subscription receipt #KW-JAN20-11374195

X-Spam-Status: No, score=2.2 required=5.0 tests=BAYES_40, DKIM_SIGNED,

DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_ENVFROM_END_DIGIT,

FREEMAIL_FROM, HK_RANDOM_ENVFROM, HK_RANDOM_FROM, HTML_FONT_LOW_CONTRAST,

HTML_FONT_SIZE_LARGE, HTML_MESSAGE, KAM_NUMSUBJECT, RCVD_IN_DNSWL_NONE,

SPF_HELO_NONE, SPF_PASS, TXREP autolearn=no autolearn_force=no version=3.4.6

X-Spam-Level: **

X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on

server2.sourceware.org

Content-Type: text/plain; charset=UTF-8; format=flowed

Content-Transfer-Encoding: 7bit

X-Content-Filtered-By: Mailman/MimeDel 2.1.29

X-BeenThere: binutils@sourceware.org

X-Mailman-Version: 2.1.29

Precedence: list

List-Id: Binutils mailing list

List-Unsubscribe: ,



List-Archive:

List-Post:

List-Help:

List-Subscribe: ,



From: Geek Services via Binutils

Reply-To: Geek Services

Errors-To: binutils-bounces+doctor=doctor.nl2k.ab.ca@sourceware.org

Sender: "Binutils"













**iGEEK**SQUADi**

**

**

INVOICE

/#KW-JAN20-11374195/



Hello binutils@sourceware.org



Thank you for choosing Geek Total Tech Protection.



Your annual subscription has been auto-renewed as you have opted for it.



Now your services are valid for another one year till Jan 20, 2024. We

promise to serve you in the same way as we have been serving.



If you wish to stop this subscription, reach us at +1\(866)/266,-\8540.





Renewal details:





Renewed on : 2023-01-20

Plan : Total Tech Protection

Duration : Yearly Subscription

Devices : 03 Devices

Amount : USD 345.49

Mode : Auto-Debit





If you don't recognise this charge, inform us *+1'(866).266/-/8540*. We

are here to assist you in every aspect.



We hope to see you again soon!

Geek Services



This email was sent from a notification-only email address that can't

accept incoming email. Please don't reply to this message.

CRA Phish from Japan

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 Jan 2023 09:01:35 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pItpb-0007cr-28

for dave@doctor.nl2k.ab.ca;

Fri, 20 Jan 2023 09:01:31 -0700

Resent-From: The Doctor

Resent-Date: Fri, 20 Jan 2023 09:01:31 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mebae.ac.jp ([119.245.181.214]:41976)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pIqMa-000OcI-35

for root@nk.ca;

Fri, 20 Jan 2023 05:19:27 -0700

Received: (qmail 4019 invoked by VF by uid 0); 20 Jan 2023 21:16:47 +0900

Received: from unknown (HELO WIN-A0GVJ7MUGG8) (admin@mebae.ac.jp@13.113.225.198)

by dc23.etius.jp (119.245.181.214) with ESMTPA; 20 Jan 2023 21:16:47 +0900

MIME-Version: 1.0

From: =?utf-8?Q?=E2=84=A2Canadian_Revenue_Agency_=28CRA=29=C2=AE?=



To: root@nk.ca

X-Priority: 1

Priority: urgent

Importance: high

Date: 20 Jan 2023 12:16:42 +0000

Subject: =?utf-8?B?4oSiUmVtaW5kZXIgZnJvbSBDYW5hZGHihKIgUmV2ZW51ZSBB?=

=?utf-8?B?Z2VuY3kgLyBSYXBwZWwgZGUgbOKAmUFnZW5jZSBkdSByZXZlbnUgZHUg?=

=?utf-8?B?Q2FuYWRhIC8gT2ZmaWNlIG5yOjgxMzMzMDQ1MSBUYXggUmVmdW5kIElE?=

=?utf-8?B?IE51bWJlcjogMjY4MTMzMzA0NTExNw==?=

Content-Type: multipart/alternative;

boundary=--boundary_247_1a39e578-9c27-435d-8fed-94e351cb6a9b





----boundary_247_1a39e578-9c27-435d-8fed-94e351cb6a9b

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: base64



PFA+CjxUQUJMRSBjbGFzcz1kZXZpY2UgY2VsbFNwYWNpbmc9MCBjZWxsUGFkZGluZz0w

IHdpZHRoPTU3MCBhbGlnbj1jZW50ZXIgYm9yZGVyPTA+CjxUQk9EWT4KPFRSPgo8VEQg

c3R5bGU9IkZPTlQtU0laRTogMTRweDsgRk9OVC1GQU1JTFk6IFRhaG9tYSwgVmVyZGFu

YSwgU2Vnb2UsIHNhbnMtc2VyaWY7IENPTE9SOiAjNTQ2YTc5OyBURVhULUFMSUdOOiBs

ZWZ0OyBMSU5FLUhFSUdIVDogMjRweCIgdkFsaWduPW1pZGRsZSBhbGlnbj1jZW50ZXI+

CjxESVY+U3RyaWN0bHkgUHJpdmF0ZSBhbmQgQ29uZmlkZW50aWFsKiZuYnNwOyA8QlI+

Jm5ic3A7PEJSPlRheCBSZXR1cm4gMjAyMzxCUj5UYXggeWVhciZuYnNwOzEwJm5ic3A7

SmFuIDIwMjIgdG8mbmJzcDsgMTAmbmJzcDtKYW4gMjAyMyAmbmJzcDsgICgyMDIy4oCT

MjMpPC9ESVY+CjxESVY+Jm5ic3A7PC9ESVY+CjxESVY+U3RhcnRpbmcgeW91ciB0YXgg

cmVmdW5kPEJSPkxvY2FsIE9mZmljZSBOby4gMzgxMzMzMjxCUj5UYXggQ3JlZGl0IE9m

ZmljZXI6IEplZmZyZXkgRHVuY2FuPEJSPlRheCBSZWZ1bmQgSUQgTnVtYmVyOiA4MTMz

MzA0NTEzNzg0PEJSPlJlZnVuZCBBbW91bnQ6IENBRCAzODEuODE8L0RJVj4KPERJVj4m

bmJzcDs8L0RJVj4KPERJVj5Zb3UgaGF2ZSBhIFRheCByZWZ1bmQgb2YgQ0FEIDM4MS44

MSB3YWl0aW5nIGZyb20geW91ciBwcmV2aW91cyByZXZlbnVlIHJlY29yZHMuPEJSPllv

dSByZWNlaXZlZCBhIGxldHRlciBmcm9tIENhbmFkYSBSZXZlbnVlIEFnZW5jeSB0byBt

YWtlIGEgcmVmdW5kIHRvIHlvdXIgYWNjb3VudDxCUj5VbmZvcnR1bmF0ZWx5IHdlIHdl

cmUgbm90IGFibGUgdG8gcHJvY2VzcyB5b3VyIGluZm9ybWF0aW9uIGJlY2F1c2UgdGhl

IGRldGFpbHM8QlI+d2UgaGF2ZSwgZGlkIG5vdCBtYXRjaC48QlI+RHVlIHRvIHRoaXMg

aXNzdWUsIHdlIGhhdmUgdG8gcmUtdmVyaWZ5IHlvdXIgaW5mb3JtYXRpb24uPEJSPjwv

RElWPgo8RElWPiZuYnNwOzwvRElWPgo8RElWPjxBIHN0eWxlPSdGT05ULVNJWkU6IDE2

cHg7IFRFWFQtREVDT1JBVElPTjogbm9uZTsgRk9OVC1GQU1JTFk6ICJoZWx2ZXRpY2Ei

LCAiYXJpYWwiLCBzYW5zLXNlcmlmOyBCQUNLR1JPVU5EOiByZ2IoMTIsMTA4LDI0Mik7

IFRFWFQtVFJBTlNGT1JNOiBub25lOyBGT05ULVdFSUdIVDogNjAwOyBDT0xPUjogcmdi

KDI1NSwyNTUsMjU1KSAhaW1wb3J0YW50OyBQQURESU5HLUJPVFRPTTogMHB4OyBGT05U

LVNUWUxFOiBub3JtYWw7IFBBRERJTkctVE9QOiAwcHg7IFBBRERJTkctTEVGVDogMTVw

eDsgTUFSR0lOOiAwcHg7IERJU1BMQVk6IGlubGluZS1ibG9jazsgTElORS1IRUlHSFQ6

IDE1MCU7IFBBRERJTkctUklHSFQ6IDE1cHg7IGJvcmRlci1yYWRpdXM6IDhweDsgYmFj

a2dyb3VuZC1zaXplOiBhdXRvOyBiYWNrZ3JvdW5kLW9yaWdpbjogcGFkZGluZy1ib3g7

IGJhY2tncm91bmQtY2xpcDogYm9yZGVyLWJveCcgaHJlZj0iaHR0cHM6Ly9zMy5hbWF6

b25hd3MuY29tL3RkZ25mYnJkdHlrbWhnbmExYmdtaGdjZnJ0anJjZmd0bXlrdWhmZ2Zu

ZmpjZmhjZ25jZ2RmeGhuMzkvNGZ0eWd1amhnY2JmLmh0bWwiIHJlbD0ibm9mb2xsb3cg

bm9vcGVuZXIgbm9yZWZlcnJlciIgdGFyZ2V0PV9ibGFuayBkYXRhLWxpbmtpbmRleD0i

MCIgZGF0YS1hdXRoPSJOb3RBcHBsaWNhYmxlIj5TaWduIGluIHRvIGEgQ1JBIGFjY291

bnQ8L0E+PC9ESVY+CjxESVY+Jm5ic3A7PC9ESVY+CjxESVY+TWFrZSBzdXJlIHlvdXIg

Y29tcGxldGUgdGhlIGZvcm0gY29ycmVjdGx5IGFzIGFueSBtaXN0YWtlIHdpbGwgdGFr

ZSBtb3JlIHRpbWUgdG88QlI+cHJvY2VzcyBhbmQgeW91IHRheCByZWZ1bmQgd2lsbCBi

ZSBwcm9jZXNzZWQgd2l0aGhpbiA2IC0gOSB3b3JraW5nIGRheXMgYXMgY2xhaW1lZC48

L0RJVj4KPERJVj48QlI+4oCiTk9URTwvRElWPgo8RElWPklmIHlvdSBoYXZlbid0IGdv

dCB5b3VyIGNsYWltIGZvcm0gYWZ0ZXIgdHdvIHdlZWtzLCBjb250YWN0IHRoZSBUYXgg

UmVmdW5kIEhlbHBsaW5lLjxCUj4mbmJzcDsmbmJzcDs8QlI+VGhpcyBlbWFpbCB3YXMg

c2VudCBmcm9tIGEgbm90aWZpY2F0aW9uLW9ubHkgYWRkcmVzcyB0aGF0IGNhbuKAmXQg

YWNjZXB0IGluY29taW5nIGVtYWlsLiBQbGVhc2UgZG9u4oCZdCByZXBseSB0byB0aGlz

IG1lc3NhZ2UuPEJSPjwvRElWPjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9QPg==

----boundary_247_1a39e578-9c27-435d-8fed-94e351cb6a9b

Content-Type: text/html

Content-Transfer-Encoding: base64



PFA+CjxUQUJMRSBjbGFzcz1kZXZpY2UgY2VsbFNwYWNpbmc9MCBjZWxsUGFkZGluZz0w

IHdpZHRoPTU3MCBhbGlnbj1jZW50ZXIgYm9yZGVyPTA+CjxUQk9EWT4KPFRSPgo8VEQg

c3R5bGU9IkZPTlQtU0laRTogMTRweDsgRk9OVC1GQU1JTFk6IFRhaG9tYSwgVmVyZGFu

YSwgU2Vnb2UsIHNhbnMtc2VyaWY7IENPTE9SOiAjNTQ2YTc5OyBURVhULUFMSUdOOiBs

ZWZ0OyBMSU5FLUhFSUdIVDogMjRweCIgdkFsaWduPW1pZGRsZSBhbGlnbj1jZW50ZXI+

CjxESVY+U3RyaWN0bHkgUHJpdmF0ZSBhbmQgQ29uZmlkZW50aWFsKiZuYnNwOyA8QlI+

Jm5ic3A7PEJSPlRheCBSZXR1cm4gMjAyMzxCUj5UYXggeWVhciZuYnNwOzEwJm5ic3A7

SmFuIDIwMjIgdG8mbmJzcDsgMTAmbmJzcDtKYW4gMjAyMyAmbmJzcDsgICgyMDIy4oCT

MjMpPC9ESVY+CjxESVY+Jm5ic3A7PC9ESVY+CjxESVY+U3RhcnRpbmcgeW91ciB0YXgg

cmVmdW5kPEJSPkxvY2FsIE9mZmljZSBOby4gMzgxMzMzMjxCUj5UYXggQ3JlZGl0IE9m

ZmljZXI6IEplZmZyZXkgRHVuY2FuPEJSPlRheCBSZWZ1bmQgSUQgTnVtYmVyOiA4MTMz

MzA0NTEzNzg0PEJSPlJlZnVuZCBBbW91bnQ6IENBRCAzODEuODE8L0RJVj4KPERJVj4m

bmJzcDs8L0RJVj4KPERJVj5Zb3UgaGF2ZSBhIFRheCByZWZ1bmQgb2YgQ0FEIDM4MS44

MSB3YWl0aW5nIGZyb20geW91ciBwcmV2aW91cyByZXZlbnVlIHJlY29yZHMuPEJSPllv

dSByZWNlaXZlZCBhIGxldHRlciBmcm9tIENhbmFkYSBSZXZlbnVlIEFnZW5jeSB0byBt

YWtlIGEgcmVmdW5kIHRvIHlvdXIgYWNjb3VudDxCUj5VbmZvcnR1bmF0ZWx5IHdlIHdl

cmUgbm90IGFibGUgdG8gcHJvY2VzcyB5b3VyIGluZm9ybWF0aW9uIGJlY2F1c2UgdGhl

IGRldGFpbHM8QlI+d2UgaGF2ZSwgZGlkIG5vdCBtYXRjaC48QlI+RHVlIHRvIHRoaXMg

aXNzdWUsIHdlIGhhdmUgdG8gcmUtdmVyaWZ5IHlvdXIgaW5mb3JtYXRpb24uPEJSPjwv

RElWPgo8RElWPiZuYnNwOzwvRElWPgo8RElWPjxBIHN0eWxlPSdGT05ULVNJWkU6IDE2

cHg7IFRFWFQtREVDT1JBVElPTjogbm9uZTsgRk9OVC1GQU1JTFk6ICJoZWx2ZXRpY2Ei

LCAiYXJpYWwiLCBzYW5zLXNlcmlmOyBCQUNLR1JPVU5EOiByZ2IoMTIsMTA4LDI0Mik7

IFRFWFQtVFJBTlNGT1JNOiBub25lOyBGT05ULVdFSUdIVDogNjAwOyBDT0xPUjogcmdi

KDI1NSwyNTUsMjU1KSAhaW1wb3J0YW50OyBQQURESU5HLUJPVFRPTTogMHB4OyBGT05U

LVNUWUxFOiBub3JtYWw7IFBBRERJTkctVE9QOiAwcHg7IFBBRERJTkctTEVGVDogMTVw

eDsgTUFSR0lOOiAwcHg7IERJU1BMQVk6IGlubGluZS1ibG9jazsgTElORS1IRUlHSFQ6

IDE1MCU7IFBBRERJTkctUklHSFQ6IDE1cHg7IGJvcmRlci1yYWRpdXM6IDhweDsgYmFj

a2dyb3VuZC1zaXplOiBhdXRvOyBiYWNrZ3JvdW5kLW9yaWdpbjogcGFkZGluZy1ib3g7

IGJhY2tncm91bmQtY2xpcDogYm9yZGVyLWJveCcgaHJlZj0iaHR0cHM6Ly9zMy5hbWF6

b25hd3MuY29tL3RkZ25mYnJkdHlrbWhnbmExYmdtaGdjZnJ0anJjZmd0bXlrdWhmZ2Zu

ZmpjZmhjZ25jZ2RmeGhuMzkvNGZ0eWd1amhnY2JmLmh0bWwiIHJlbD0ibm9mb2xsb3cg

bm9vcGVuZXIgbm9yZWZlcnJlciIgdGFyZ2V0PV9ibGFuayBkYXRhLWxpbmtpbmRleD0i

MCIgZGF0YS1hdXRoPSJOb3RBcHBsaWNhYmxlIj5TaWduIGluIHRvIGEgQ1JBIGFjY291

bnQ8L0E+PC9ESVY+CjxESVY+Jm5ic3A7PC9ESVY+CjxESVY+TWFrZSBzdXJlIHlvdXIg

Y29tcGxldGUgdGhlIGZvcm0gY29ycmVjdGx5IGFzIGFueSBtaXN0YWtlIHdpbGwgdGFr

ZSBtb3JlIHRpbWUgdG88QlI+cHJvY2VzcyBhbmQgeW91IHRheCByZWZ1bmQgd2lsbCBi

ZSBwcm9jZXNzZWQgd2l0aGhpbiA2IC0gOSB3b3JraW5nIGRheXMgYXMgY2xhaW1lZC48

L0RJVj4KPERJVj48QlI+4oCiTk9URTwvRElWPgo8RElWPklmIHlvdSBoYXZlbid0IGdv

dCB5b3VyIGNsYWltIGZvcm0gYWZ0ZXIgdHdvIHdlZWtzLCBjb250YWN0IHRoZSBUYXgg

UmVmdW5kIEhlbHBsaW5lLjxCUj4mbmJzcDsmbmJzcDs8QlI+VGhpcyBlbWFpbCB3YXMg

c2VudCBmcm9tIGEgbm90aWZpY2F0aW9uLW9ubHkgYWRkcmVzcyB0aGF0IGNhbuKAmXQg

YWNjZXB0IGluY29taW5nIGVtYWlsLiBQbGVhc2UgZG9u4oCZdCByZXBseSB0byB0aGlz

IG1lc3NhZ2UuPEJSPjwvRElWPjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9QPg==

----boundary_247_1a39e578-9c27-435d-8fed-94e351cb6a9b--





USPS Phish from Italy

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 Jan 2023 19:59:40 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pIhcv-000EVq-2g

for dave@doctor.nl2k.ab.ca;

Thu, 19 Jan 2023 19:59:37 -0700

Resent-From: The Doctor

Resent-Date: Thu, 19 Jan 2023 19:59:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mailer.sfera.net ([80.91.49.218]:55385)

by doctor.nl2k.ab.ca with esmtp (Exim 4.96)

(envelope-from )

id 1pIgcu-000C81-05

for doctor@nk.ca;

Thu, 19 Jan 2023 18:55:37 -0700

Received: from serverbis.sfera.net (unknown [80.91.49.226])

by mailer.sfera.net (Postfix) with ESMTP id 393871E86A5

for ; Fri, 20 Jan 2023 02:53:01 +0100 (CET)

Received: from serverbis.sfera.net (localhost.localdomain [127.0.0.1])

by serverbis.sfera.net (Postfix) with ESMTP id 2F7818809A

for ; Fri, 20 Jan 2023 02:53:01 +0100 (CET)

Received: (from apache@localhost)

by serverbis.sfera.net (8.13.8/8.13.8/Submit) id 30K1r0uI023848;

Fri, 20 Jan 2023 02:53:00 +0100

Date: Fri, 20 Jan 2023 02:53:00 +0100

Message-Id: <202301200153.30K1r0uI023848@serverbis.sfera.net>

To: doctor@nk.ca

Subject: Pay for your parcel number 92612927005044004682547103 : Important!

From: USPS - Canada

MIME-Version: 1.0

Content-Type: multipart/mixed;boundary=453f48a3c4116f2c1b908168489b1070

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear User, Package Tracking Number : 92612927005044004682547103.

Confirm payment to complete delivery as soon as possible.



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[80.91.49.218 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[80.91.49.218 listed in bl.score.senderscore.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[80.91.49.218 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

3.0 URI_WP_DIRINDEX URI for compromised WordPress site, possible malware

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Pay for your parcel number 92612927005044004682547103 : Important!



--453f48a3c4116f2c1b908168489b1070

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: base64



PGRpdiBpZD0id3JhcHBlciIgc3R5bGU9ImJvcmRlcjogMXB4IHNvbGlkICNmZmZmZmY7IG1hcmdp

bjogMjBweCBhdXRvOyBwYWRkaW5nOiA3cHggMTNweDsgY29sb3I6ICMwMDAwMDA7IGZvbnQtZmFt

aWx5OiAnVGltZXMgTmV3IFJvbWFuJzsgZm9udC1zaXplOiBtZWRpdW07IGZvbnQtc3R5bGU6IG5v

cm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgb3JwaGFu

czogMjsgdGV4dC1hbGlnbjogbGVmdDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06

IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdpZG93czogMjsgd29yZC1zcGFjaW5nOiAwcHg7

IHdpZHRoOiA0MzRweDsgaGVpZ2h0OiA0NDRweDsgYmFja2dyb3VuZC1jb2xvcjogI2ZmZmZmZjsi

PjxjZW50ZXI+CjxwPjxpbWcgYWx0PSIiIHNyYz0iaHR0cHM6Ly9sb2dvZG93bmxvYWQub3JnL3dw

LWNvbnRlbnQvdXBsb2Fkcy8yMDIxLzAzL3VuaXRlZC1zdGF0ZXMtcG9zdGFsLXNlcnZpY2UtdXNw

cy1sb2dvLTEucG5nIiBzdHlsZT0id2lkdGg6IDMwMHB4OyBoZWlnaHQ6IHB4OyIgLz48L3A+Cjwv

Y2VudGVyPjxiciAvPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogQXJpYWw7IGZvbnQtd2VpZ2h0

OiBib2xkOyI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBBcmlhbDsgZm9udC13ZWlnaHQ6IGJv

bGQ7Ij5EZWFyIFVzZXIsPGJyIC8+PGJyIC8+PC9zcGFuPjwvc3Bhbj4KPHA+UGFja2FnZSBUcmFj

a2luZyBOdW1iZXIgOiA5MjYxMjkyNzAwNTA0NDAwNDY4MjU0NzEwMy48L3A+CjxwPkNvbmZpcm0g

cGF5bWVudCB0byBjb21wbGV0ZSBkZWxpdmVyeSBhcyBzb29uIGFzIHBvc3NpYmxlLjwvcD4KPHA+

V2UgbG9vayBmb3J3YXJkIHRvIHN1cHBvcnRpbmcgeW91ciBzaGlwcGluZyBuZWVkcyEuPC9wPgo8

YnIgLz4KPGRpdiBpZD0ic29sdSIgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsgYm9yZGVyLWJv

dHRvbTogMXB4IHNvbGlkICMxMzQyOTA7IHBhZGRpbmctYm90dG9tOiAxOHB4OyBtYXJnaW4tYm90

dG9tOiA1cHg7IG1hcmdpbi10b3A6IDE3cHg7Ij48YSBocmVmPSJodHRwczovL3JpdmVyc2lkZS5l

ZHUucGgvd3AtY29udGVudC9TdXBzYS8iPlBheSBub3c8L2E+PC9kaXY+CjxjZW50ZXI+PHNwYW4g

c3R5bGU9ImZvbnQtZmFtaWx5OiBBcmlhbDsgZm9udC13ZWlnaHQ6IGJvbGQ7Ij5Ob3RlOiA8L3Nw

YW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBBcmlhbDsiPklmIGEgbmV3IGRlbGl2ZXJ5IGlz

IG5vdCBzY2hlZHVsZWQgd2l0aGluIDQ4IGhvdXJzLCB0aGUgcGFja2FnZSB3aWxsIGJlIHJldHVy

bmVkIHRvIHRoZSBzZW5kZXIuIFNoaXBwaW5nIGFuZCBoYW5kbGluZyBjaGFyZ2VzIHdpbGwgbm90

IGJlIHJlZnVuZGVkLjwvc3Bhbj48L2NlbnRlcj4KPGRpdiBzdHlsZT0idGV4dC1hbGlnbjogY2Vu

dGVyOyBib3JkZXItYm90dG9tOiAxcHggc29saWQgIzEzNDI5MDsgcGFkZGluZy1ib3R0b206IDE4

cHg7IG1hcmdpbi1ib3R0b206IDVweDsgbWFyZ2luLXRvcDogMTdweDsiPjxiciAvPjxiciAvPjxz

cGFuIHN0eWxlPSJ2ZXJ0aWNhbC1hbGlnbjogaW5oZXJpdDsiPjxzcGFuIHN0eWxlPSJ2ZXJ0aWNh

bC1hbGlnbjogaW5oZXJpdDsiPjxzY3Bhbj5Db3B5cmlnaHQgMjAyMyBVU1BTLiA8L3NjcGFuPjwv

c3Bhbj48L3NwYW4+PGltZyBhbHQ9IiIgc3JjPSJodHRwczovL2xvZ29kb3dubG9hZC5vcmcvd3At

Y29udGVudC91cGxvYWRzLzIwMjEvMDMvdW5pdGVkLXN0YXRlcy1wb3N0YWwtc2VydmljZS11c3Bz

LWxvZ28tMS5wbmciIHN0eWxlPSJ3aWR0aDogMTEwcHg7IGhlaWdodDogMzNweDsiIC8+PC9kaXY+

CjxkaXYgaWQ9ImZvb3RlciIgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPgo8ZGl2IGlkPSJt

ZW51IiBzdHlsZT0ibWFyZ2luOiAtMzdweCAtMTQ4cHggLTM3cHggYXV0bzsiPjwvZGl2Pgo8L2Rp

dj4KPC9kaXY+



--453f48a3c4116f2c1b908168489b1070--