Lowe's phish from Microsoft Outlook
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 22 Mar 2024 09:35:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rnguH-00000000EDl-3Tb0
for dave@doctor.nl2k.ab.ca;
Fri, 22 Mar 2024 09:34:09 -0600
Resent-From: The Doctor
Resent-Date: Fri, 22 Mar 2024 09:34:09 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-bn7nam10on2091.outbound.protection.outlook.com ([40.107.92.91]:3584 helo=NAM10-BN7-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from <2h2d7ysfcabv@bbcgfdhvbnghfa20.onmicrosoft.com>)
id 1rnfCH-00000000OIE-3ryE
for sales@nk.ca;
Fri, 22 Mar 2024 07:44:42 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=mkrBkFUwGUtSiL9RuC8VK8hWjuoM8u1z78q230lhH9KpPS7Cs6p4h4U763RNUiuJg0cbhHWdOFCFbAd9+T9OHtTDtD+a3aqpqc6GXFtPcDgsVHZafNJT/XmRXG3BglfnDP08CuOxc+wG+WlRHrwj13d6pWYgbi2eCeNTjSrDCIYTqpinUmya0JW5SZso2/4Mn7Sv+/mXXFcYwg1bdLEcYBNtVqwN1v6OPecr5IPsddDX2ms/ZkOU5cK6sxvyP5tzU2ux9Gxy4XjNGYouKEP4O/O2txS8AvDlNHRz1B18K8naSoiEhgDq6FPX15A6GqnxZlq0oc0l8xEt7Dc6PCmNBw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=5xlULT5oNl5JBZT3ERt18ZWItbfmpMz1Fi2rKSV0jvE=;
b=nB2A2CWec6QZM9h0oaiNCeGqEykDrZwodHRYjANc6Q0wH7wDxpG4qTjH99V6d6vegFT7fTFURcLkG5udn7z8gVFK9jmYF9q/HAMdcD7rZo9AhH97QGq83mow2fwbTuU3Qj+bhAxhu2fv2DyVkTznZjGxRclU/wWdJQiGBgfyajG6SEqyYU3OyWGhpu5IL7XGK4H4dOdcq1wxlPD6ZY5BmRiT1dtI+TcgFFxn1xBy5dcTpvz4RuELia+lrPULFbRjWLR9WDVMGE8W5ibHKrDObBAY7m1nhydPHtxOHUyS0m44obaY04tSsdu50ugfFtQqZ1+3YyEIEEuS/kmkHZeiYA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
178.79.141.237) smtp.rcpttodomain=nk.ca
smtp.mailfrom=bbcgfdhvbnghfa20.onmicrosoft.com; dmarc=none action=none
header.from=bbcgfdhvbnghfa20.onmicrosoft.com; dkim=none (message not signed);
arc=none (0)
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 178.79.141.237)
smtp.mailfrom=bbcgfdhvbnghfa20.onmicrosoft.com; dkim=none (message not
signed) header.d=none;dmarc=none action=none
header.from=bbcgfdhvbnghfa20.onmicrosoft.com;
Subject: Thank you
Date: Fri, 22 Mar 2024 13:42:32 +0000
X-TOI-MSGID: <101741277697062.AC354F821938C.1705442930402@bbcgfdhvbnghfa20.onmicrosoft.com>
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0In-Reply-To:
To: sales@nk.ca
Content-Type: text/html; charset="UTF-8"
CC: sales@nk.ca
From: "Lowes"
Message-ID:
<9d3d93c1-7051-41df-8841-9f232000ef29@BN2PEPF000044A8.namprd04.prod.outlook.com>
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: BN2PEPF000044A8:EE_|BL3PR19MB6491:EE_
X-MS-Office365-Filtering-Correlation-Id: 013672e3-8f47-42bd-7673-08dc4a75ed33
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
2HPiNiH1At0oep77IAjxtnhUcTyzlXBqEoOvvqwogFKcYFJmqqIEY8EF/LRrfuYD1sitOYvXIHe5wPfeoVJNHnfTWDbXxz9qlFuUpo6o7zLCU9YbGB1S4PTK3P8LCC09LpoR0jzYDi6UI1Hcc6Ln7jF9Pp1p8ka+zkKMHdpf5CAWjphX1kywa71kLnarBx7BJDFDY4GkDDKC80xZZdLqsAnPpFgjCAgHO5zoLDk/5FvMaOt0q4H0Fst0yA26dK1YJhB4xGTw6ew4zsohe/LeIrNHiwf/RlvtCXD4nTNSCI9bEfw/39XLD/xw59zGpsCQwv7fz9XwpJICCsJHZAg0/x97Yzs1PwZTNG2TepiIusDT24bQruVW2N0O1eAGz22RSUv7FvLF2duXaLWVvKmhP7uFcCJXRlmb1tMOspVmIyROgIbdlJwdN+pRFzNbVBiejY50tofGcv3L57/B6cYsaUHHj/MLSU3XRbufe8PWt9px6jhI4QleI9/JSFdIukw5FsjATUWIQyEh5ep5KbvWROn83gzqm1MJIpYLSc8VtVYvlLikLl5LVjYWx7WNtHwq6NIQyEYI9BdpqIj4OMVKl7G+1za5kk3H6vsAxJiI3GVsYsOvVvJi7i6kqjWQtHPEr0Cktgnjtot6RpCQMwVwbQ/BzhjM1q069JAAP943aUknZQhvqyAN2Mv+tYsHcmF4ryc886wHMIAgUYdHsrUkMg==
X-Forefront-Antispam-Report:
CIP:178.79.141.237;CTRY:GB;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:bbcgfdhvbnghfa20.onmicrosoft.com;PTR:178-79-141-237.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(82310400014)(376005)(36860700004)(34070700005)(41320700004)(61400799018);DIR:OUT;SFP:1102;
X-OriginatorOrg: bbcgfdhvbnghfa20.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Mar 2024 13:42:32.8938
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 013672e3-8f47-42bd-7673-08dc4a75ed33
X-MS-Exchange-CrossTenant-Id: 4101a2b9-b79d-41dd-8e33-4851f7c67926
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4101a2b9-b79d-41dd-8e33-4851f7c67926;Ip=[178.79.141.237];Helo=[bbcgfdhvbnghfa20.onmicrosoft.com]
X-MS-Exchange-CrossTenant-AuthSource:
BN2PEPF000044A8.namprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL3PR19MB6491
X-Spam_score: 7.7
X-Spam_score_int: 77
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: (1) Notifications ミ★ Ninja Woodfire Grill ★彡 ꧁ Order
confirmation #103800 ꧂
Content analysis details: (7.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.107.92.91 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.0 ARC_VALID Message has a valid ARC signature
0.0 ARC_SIGNED Message has a ARC signature
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ninja-za5oy0o(at)bbcgfdhvbnghfa20.onmicrosoft.com]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted
Colors in HTML
1.0 BOGUS_MIME_VERSION Mime version header is bogus
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.0 T_FROM_MISSP_DKIM From misspaced, DKIM dependable
0.0 T_REMOTE_IMAGE Message contains an external image
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
Subject: {SPAM?} Thank you
(1) Notifications
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 22 Mar 2024 09:35:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rnguH-00000000EDl-3Tb0
for dave@doctor.nl2k.ab.ca;
Fri, 22 Mar 2024 09:34:09 -0600
Resent-From: The Doctor
Resent-Date: Fri, 22 Mar 2024 09:34:09 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-bn7nam10on2091.outbound.protection.outlook.com ([40.107.92.91]:3584 helo=NAM10-BN7-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from <2h2d7ysfcabv@bbcgfdhvbnghfa20.onmicrosoft.com>)
id 1rnfCH-00000000OIE-3ryE
for sales@nk.ca;
Fri, 22 Mar 2024 07:44:42 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=mkrBkFUwGUtSiL9RuC8VK8hWjuoM8u1z78q230lhH9KpPS7Cs6p4h4U763RNUiuJg0cbhHWdOFCFbAd9+T9OHtTDtD+a3aqpqc6GXFtPcDgsVHZafNJT/XmRXG3BglfnDP08CuOxc+wG+WlRHrwj13d6pWYgbi2eCeNTjSrDCIYTqpinUmya0JW5SZso2/4Mn7Sv+/mXXFcYwg1bdLEcYBNtVqwN1v6OPecr5IPsddDX2ms/ZkOU5cK6sxvyP5tzU2ux9Gxy4XjNGYouKEP4O/O2txS8AvDlNHRz1B18K8naSoiEhgDq6FPX15A6GqnxZlq0oc0l8xEt7Dc6PCmNBw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=5xlULT5oNl5JBZT3ERt18ZWItbfmpMz1Fi2rKSV0jvE=;
b=nB2A2CWec6QZM9h0oaiNCeGqEykDrZwodHRYjANc6Q0wH7wDxpG4qTjH99V6d6vegFT7fTFURcLkG5udn7z8gVFK9jmYF9q/HAMdcD7rZo9AhH97QGq83mow2fwbTuU3Qj+bhAxhu2fv2DyVkTznZjGxRclU/wWdJQiGBgfyajG6SEqyYU3OyWGhpu5IL7XGK4H4dOdcq1wxlPD6ZY5BmRiT1dtI+TcgFFxn1xBy5dcTpvz4RuELia+lrPULFbRjWLR9WDVMGE8W5ibHKrDObBAY7m1nhydPHtxOHUyS0m44obaY04tSsdu50ugfFtQqZ1+3YyEIEEuS/kmkHZeiYA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
178.79.141.237) smtp.rcpttodomain=nk.ca
smtp.mailfrom=bbcgfdhvbnghfa20.onmicrosoft.com; dmarc=none action=none
header.from=bbcgfdhvbnghfa20.onmicrosoft.com; dkim=none (message not signed);
arc=none (0)
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 178.79.141.237)
smtp.mailfrom=bbcgfdhvbnghfa20.onmicrosoft.com; dkim=none (message not
signed) header.d=none;dmarc=none action=none
header.from=bbcgfdhvbnghfa20.onmicrosoft.com;
Subject: Thank you
Date: Fri, 22 Mar 2024 13:42:32 +0000
X-TOI-MSGID: <101741277697062.AC354F821938C.1705442930402@bbcgfdhvbnghfa20.onmicrosoft.com>
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0In-Reply-To:
To: sales@nk.ca
Content-Type: text/html; charset="UTF-8"
CC: sales@nk.ca
From: "Lowes"
Message-ID:
<9d3d93c1-7051-41df-8841-9f232000ef29@BN2PEPF000044A8.namprd04.prod.outlook.com>
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: BN2PEPF000044A8:EE_|BL3PR19MB6491:EE_
X-MS-Office365-Filtering-Correlation-Id: 013672e3-8f47-42bd-7673-08dc4a75ed33
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
2HPiNiH1At0oep77IAjxtnhUcTyzlXBqEoOvvqwogFKcYFJmqqIEY8EF/LRrfuYD1sitOYvXIHe5wPfeoVJNHnfTWDbXxz9qlFuUpo6o7zLCU9YbGB1S4PTK3P8LCC09LpoR0jzYDi6UI1Hcc6Ln7jF9Pp1p8ka+zkKMHdpf5CAWjphX1kywa71kLnarBx7BJDFDY4GkDDKC80xZZdLqsAnPpFgjCAgHO5zoLDk/5FvMaOt0q4H0Fst0yA26dK1YJhB4xGTw6ew4zsohe/LeIrNHiwf/RlvtCXD4nTNSCI9bEfw/39XLD/xw59zGpsCQwv7fz9XwpJICCsJHZAg0/x97Yzs1PwZTNG2TepiIusDT24bQruVW2N0O1eAGz22RSUv7FvLF2duXaLWVvKmhP7uFcCJXRlmb1tMOspVmIyROgIbdlJwdN+pRFzNbVBiejY50tofGcv3L57/B6cYsaUHHj/MLSU3XRbufe8PWt9px6jhI4QleI9/JSFdIukw5FsjATUWIQyEh5ep5KbvWROn83gzqm1MJIpYLSc8VtVYvlLikLl5LVjYWx7WNtHwq6NIQyEYI9BdpqIj4OMVKl7G+1za5kk3H6vsAxJiI3GVsYsOvVvJi7i6kqjWQtHPEr0Cktgnjtot6RpCQMwVwbQ/BzhjM1q069JAAP943aUknZQhvqyAN2Mv+tYsHcmF4ryc886wHMIAgUYdHsrUkMg==
X-Forefront-Antispam-Report:
CIP:178.79.141.237;CTRY:GB;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:bbcgfdhvbnghfa20.onmicrosoft.com;PTR:178-79-141-237.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(82310400014)(376005)(36860700004)(34070700005)(41320700004)(61400799018);DIR:OUT;SFP:1102;
X-OriginatorOrg: bbcgfdhvbnghfa20.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Mar 2024 13:42:32.8938
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 013672e3-8f47-42bd-7673-08dc4a75ed33
X-MS-Exchange-CrossTenant-Id: 4101a2b9-b79d-41dd-8e33-4851f7c67926
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=4101a2b9-b79d-41dd-8e33-4851f7c67926;Ip=[178.79.141.237];Helo=[bbcgfdhvbnghfa20.onmicrosoft.com]
X-MS-Exchange-CrossTenant-AuthSource:
BN2PEPF000044A8.namprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL3PR19MB6491
X-Spam_score: 7.7
X-Spam_score_int: 77
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: (1) Notifications ミ★ Ninja Woodfire Grill ★彡 ꧁ Order
confirmation #103800 ꧂
Content analysis details: (7.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.107.92.91 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.0 ARC_VALID Message has a valid ARC signature
0.0 ARC_SIGNED Message has a ARC signature
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ninja-za5oy0o(at)bbcgfdhvbnghfa20.onmicrosoft.com]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted
Colors in HTML
1.0 BOGUS_MIME_VERSION Mime version header is bogus
-0.0 T_SCC_BODY_TEXT_LINE No description available.
0.0 FROM_MISSPACED From: missing whitespace
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
0.0 T_FROM_MISSP_DKIM From misspaced, DKIM dependable
0.0 T_REMOTE_IMAGE Message contains an external image
1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
Subject: {SPAM?} Thank you
|
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments