Product Phishing from Microsoft Outlook
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 25 Mar 2024 23:48:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rozeU-000000007kB-2iRG
for dave@doctor.nl2k.ab.ca;
Mon, 25 Mar 2024 23:47:14 -0600
Resent-From: The Doctor
Resent-Date: Mon, 25 Mar 2024 23:47:14 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lo4gbr01on2136.outbound.protection.outlook.com ([40.107.122.136]:43246 helo=GBR01-LO4-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1routC-00000000LCw-38J5
for root@nk.ca;
Mon, 25 Mar 2024 18:42:11 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=XsHgfhPEkCzRREOknGHB9ZDd+oUUOaicyqKkVOCHF53YMsRBDP+GMce2lv2O2PYYHZJoNcCIrTls0lGukc9ZLS3AFmrGd5ax/Pele8ZOFgtzA6td1agmGgXYoe1t9mSnEPV/VCkFQgUJ9MSj+4U2F8Oezv1n1z1GIy9hszRJu49dlF2J2Rvql82bMYhcaAvXk9XWAGALf0Gvo2RuRT5mksP83va9Qp/CIl8c0encnXYJ8TqE9zq1Ky+6Y6W5Ai1ZZzZ3BOz37tq9a8DZrBnx0XGr3Mx/3e1D1rrHIK4gmTi9LFRSieWO062mPhbLywF24rVnoh7EQkwkpDEiLPHkBQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=VwUlNQRWtM6yJRasGzAv7TSWHWe3IHRo4KEYsozOQS0=;
b=afeDcQ1XOmYWntyDHdJ+dswZQzVTk+UC2zqPoGdNUvtglMVbAK9rN5sr/zJxiyaJjf7F9DKyPd2gped582b/fRt8I3OiBHFvWgk5z7QdzsHlmJ8TqwqA7eLH7asmU6Whw9M/vix8rReuKT5MIpq8YahdMUMNIk5J+/nKISewLM3pG/8TY2WdBUku3ZKi+OhvFsSMkvAZknohwvnkxF3wbWyw6D0YXfEuQuRHnhzUIjzHR3Q2u5sZ8qG8hApXqXyIuc3FxrLBfcipF8yigjWBt8cjh23ZjUOdhm9px7aBj/hWgPW/sz3aycZuNkj8x1ojbs2m7Xv2muEAWjeGhr62/g==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
45.11.93.53) smtp.rcpttodomain=nk.ca smtp.mailfrom=zmbhksu.onmicrosoft.com;
dmarc=none action=none header.from=zmbhksu.onmicrosoft.com; dkim=none
(message not signed); arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=wetherbyprepstudentscouk.onmicrosoft.com;
s=selector1-wetherbyprepstudentscouk-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=VwUlNQRWtM6yJRasGzAv7TSWHWe3IHRo4KEYsozOQS0=;
b=S7r2GH67jx+4lF4/TzUVLWSCudjqKN3+94ODdl2G9FfPSS5qF9aGUbDi1Nnkv6HoiUJecGl9b1PHkl/R0shagQQUoe/6Q1cKQfm7Ent1xp3hCeVFwU7BobqJP/ny/T6+dktv4XecKdIT1Rkymih2LiKy1jASSJNMTQqRLbV6+zk=
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 45.11.93.53)
smtp.mailfrom=zmbhksu.onmicrosoft.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=zmbhksu.onmicrosoft.com;
Content-Type: multipart/related; boundary="HSi5hIr4q2T505jKShZwx71qP5EEUH2zOOlzXcxQaT"; type="multipart/alternative"
Content-Language: fr-FR
Subject: Get Ahead with Elon Musk's Seal of Approval!
msip_labels:
X-MS-TNEF-Correlator:
Message-ID:
Thread-Index: 6Q3TGNyab3PMBZqOD+hG0DprtWzWV0LuSf==
Date: Tue, 26 Mar 2024 00:40:00 +0000
From: Elon Power Bank
To: "root@gmail.com"
Accept-Language: fr-FR, en-US
X-MS-Has-Attach: yes
MIME-Version: 1.0
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: LO1PEPF000028CC:EE_|LO2P123MB6245:EE_
X-MS-Office365-Filtering-Correlation-Id: 25601516-b06a-46e1-0aa9-08dc4d2d4677
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
P1B0Z4nWzvC/ExGRBHbNPJ08U+Gy/FrZBH5jmdyPTqUNycaHvHLEzlYgdAfTriE0BNK9UUIl+PnsoroLKXfFCMhErv6BCfj8wSNTSJBt+h7JaVKqWXhJb0PWNPzrItegFbBu9SLQg8ZwbvKmaHClGIfjkNP3b8d2ZYykRbqtIOjnvlTTbNqmiLDXJa5TSRzPUeNQ2NXBnzKBIbDeSqqWz/fIzGzXsrCyM4BZkNKLa+ZmJGH5CHg/87ngvtxE+E+erGaBSu7fyS/TJayaI/eqQSty2FNqj93h1I1ZFAiXfsVf9IOTkzUQpU6t4GVq2ARZFIWC7azEv3HSYgzWyBIorIwvlB/QLQ7QKSO6jAu4eK8Y3seDl2GuTMu22f3Vn7+EyHKXuUztC1VkTeJBgz4w5vxWehlM5idf67u6GAULEZZat9tV0zwix5836g3qFgB021n2xHM5KyFT5TMnqsvohxsJevtNDsK2P/2kPjdNSJBF9KTo5g0QOOGJu5JuN4S8ErFSnXm2O/WYLwDUSv3DEtNDd2gtZyIWwqReAevePc51skyswtqPNc9jksww4RtQnmZk2vCHsXemXbmSkgflzJz9wQd366OWDdvnhKWacPoCjBasdfYNjkRPzTyn8t8mw8G/ZJxomhSfoGHvorQXuz/pT/3B4N1PPCcTI+Zagvzhmbj/AITPxRkAho2XwShz9mYAVLyZMzfCilnb/YlQKA==
X-Forefront-Antispam-Report:
CIP:45.11.93.53;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:zmbhksu.onmicrosoft.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230031)(34020700007)(36860700004)(41320700004)(82310400014)(61400799018)(376005);DIR:OUT;SFP:1102;
X-OriginatorOrg: zmbhksu.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Mar 2024 00:40:01.1622
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 25601516-b06a-46e1-0aa9-08dc4d2d4677
X-MS-Exchange-CrossTenant-Id: 758d6117-8a63-4a5d-8dd9-7339a955921a
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=758d6117-8a63-4a5d-8dd9-7339a955921a;Ip=[45.11.93.53];Helo=[zmbhksu.onmicrosoft.com]
X-MS-Exchange-CrossTenant-AuthSource: LO1PEPF000028CC.GBRP265.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB6245
--HSi5hIr4q2T505jKShZwx71qP5EEUH2zOOlzXcxQaT
Content-Type: multipart/alternative; boundary="cbLhGKHsKats7HgeD9xN48MZSboHkzRDeGFXVek3EQgIhdG826RA"
--cbLhGKHsKats7HgeD9xN48MZSboHkzRDeGFXVek3EQgIhdG826RA
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: hexa
1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa
1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa
EvBKlgLxKN28 EvBKlgLxKN28 EvBKlgLxKN28 EvBKlgLxKN28
ArpaBra1YF ArpaBra1YF ArpaBra1YF ArpaBra1YF
1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa
EvBKlgLxKN28 EvBKlgLxKN28 EvBKlgLxKN28 EvBKlgLxKN28
ArpaBra1YF ArpaBra1YF ArpaBra1YF ArpaBra1YF
1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa
EvBKlgLxKN28 EvBKlgLxKN28 EvBKlgLxKN28 EvBKlgLxKN28
ArpaBra1YF ArpaBra1YF ArpaBra1YF ArpaBra1YF
--cbLhGKHsKats7HgeD9xN48MZSboHkzRDeGFXVek3EQgIhdG826RA
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
--cbLhGKHsKats7HgeD9xN48MZSboHkzRDeGFXVek3EQgIhdG826RA--
--HSi5hIr4q2T505jKShZwx71qP5EEUH2zOOlzXcxQaT--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 25 Mar 2024 23:48:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rozeU-000000007kB-2iRG
for dave@doctor.nl2k.ab.ca;
Mon, 25 Mar 2024 23:47:14 -0600
Resent-From: The Doctor
Resent-Date: Mon, 25 Mar 2024 23:47:14 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-lo4gbr01on2136.outbound.protection.outlook.com ([40.107.122.136]:43246 helo=GBR01-LO4-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1routC-00000000LCw-38J5
for root@nk.ca;
Mon, 25 Mar 2024 18:42:11 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=XsHgfhPEkCzRREOknGHB9ZDd+oUUOaicyqKkVOCHF53YMsRBDP+GMce2lv2O2PYYHZJoNcCIrTls0lGukc9ZLS3AFmrGd5ax/Pele8ZOFgtzA6td1agmGgXYoe1t9mSnEPV/VCkFQgUJ9MSj+4U2F8Oezv1n1z1GIy9hszRJu49dlF2J2Rvql82bMYhcaAvXk9XWAGALf0Gvo2RuRT5mksP83va9Qp/CIl8c0encnXYJ8TqE9zq1Ky+6Y6W5Ai1ZZzZ3BOz37tq9a8DZrBnx0XGr3Mx/3e1D1rrHIK4gmTi9LFRSieWO062mPhbLywF24rVnoh7EQkwkpDEiLPHkBQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=VwUlNQRWtM6yJRasGzAv7TSWHWe3IHRo4KEYsozOQS0=;
b=afeDcQ1XOmYWntyDHdJ+dswZQzVTk+UC2zqPoGdNUvtglMVbAK9rN5sr/zJxiyaJjf7F9DKyPd2gped582b/fRt8I3OiBHFvWgk5z7QdzsHlmJ8TqwqA7eLH7asmU6Whw9M/vix8rReuKT5MIpq8YahdMUMNIk5J+/nKISewLM3pG/8TY2WdBUku3ZKi+OhvFsSMkvAZknohwvnkxF3wbWyw6D0YXfEuQuRHnhzUIjzHR3Q2u5sZ8qG8hApXqXyIuc3FxrLBfcipF8yigjWBt8cjh23ZjUOdhm9px7aBj/hWgPW/sz3aycZuNkj8x1ojbs2m7Xv2muEAWjeGhr62/g==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
45.11.93.53) smtp.rcpttodomain=nk.ca smtp.mailfrom=zmbhksu.onmicrosoft.com;
dmarc=none action=none header.from=zmbhksu.onmicrosoft.com; dkim=none
(message not signed); arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=wetherbyprepstudentscouk.onmicrosoft.com;
s=selector1-wetherbyprepstudentscouk-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=VwUlNQRWtM6yJRasGzAv7TSWHWe3IHRo4KEYsozOQS0=;
b=S7r2GH67jx+4lF4/TzUVLWSCudjqKN3+94ODdl2G9FfPSS5qF9aGUbDi1Nnkv6HoiUJecGl9b1PHkl/R0shagQQUoe/6Q1cKQfm7Ent1xp3hCeVFwU7BobqJP/ny/T6+dktv4XecKdIT1Rkymih2LiKy1jASSJNMTQqRLbV6+zk=
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 45.11.93.53)
smtp.mailfrom=zmbhksu.onmicrosoft.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=zmbhksu.onmicrosoft.com;
Content-Type: multipart/related; boundary="HSi5hIr4q2T505jKShZwx71qP5EEUH2zOOlzXcxQaT"; type="multipart/alternative"
Content-Language: fr-FR
Subject: Get Ahead with Elon Musk's Seal of Approval!
msip_labels:
X-MS-TNEF-Correlator:
Message-ID:
Thread-Index: 6Q3TGNyab3PMBZqOD+hG0DprtWzWV0LuSf==
Date: Tue, 26 Mar 2024 00:40:00 +0000
From: Elon Power Bank
To: "root@gmail.com"
Accept-Language: fr-FR, en-US
X-MS-Has-Attach: yes
MIME-Version: 1.0
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: LO1PEPF000028CC:EE_|LO2P123MB6245:EE_
X-MS-Office365-Filtering-Correlation-Id: 25601516-b06a-46e1-0aa9-08dc4d2d4677
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
P1B0Z4nWzvC/ExGRBHbNPJ08U+Gy/FrZBH5jmdyPTqUNycaHvHLEzlYgdAfTriE0BNK9UUIl+PnsoroLKXfFCMhErv6BCfj8wSNTSJBt+h7JaVKqWXhJb0PWNPzrItegFbBu9SLQg8ZwbvKmaHClGIfjkNP3b8d2ZYykRbqtIOjnvlTTbNqmiLDXJa5TSRzPUeNQ2NXBnzKBIbDeSqqWz/fIzGzXsrCyM4BZkNKLa+ZmJGH5CHg/87ngvtxE+E+erGaBSu7fyS/TJayaI/eqQSty2FNqj93h1I1ZFAiXfsVf9IOTkzUQpU6t4GVq2ARZFIWC7azEv3HSYgzWyBIorIwvlB/QLQ7QKSO6jAu4eK8Y3seDl2GuTMu22f3Vn7+EyHKXuUztC1VkTeJBgz4w5vxWehlM5idf67u6GAULEZZat9tV0zwix5836g3qFgB021n2xHM5KyFT5TMnqsvohxsJevtNDsK2P/2kPjdNSJBF9KTo5g0QOOGJu5JuN4S8ErFSnXm2O/WYLwDUSv3DEtNDd2gtZyIWwqReAevePc51skyswtqPNc9jksww4RtQnmZk2vCHsXemXbmSkgflzJz9wQd366OWDdvnhKWacPoCjBasdfYNjkRPzTyn8t8mw8G/ZJxomhSfoGHvorQXuz/pT/3B4N1PPCcTI+Zagvzhmbj/AITPxRkAho2XwShz9mYAVLyZMzfCilnb/YlQKA==
X-Forefront-Antispam-Report:
CIP:45.11.93.53;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:zmbhksu.onmicrosoft.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230031)(34020700007)(36860700004)(41320700004)(82310400014)(61400799018)(376005);DIR:OUT;SFP:1102;
X-OriginatorOrg: zmbhksu.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Mar 2024 00:40:01.1622
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 25601516-b06a-46e1-0aa9-08dc4d2d4677
X-MS-Exchange-CrossTenant-Id: 758d6117-8a63-4a5d-8dd9-7339a955921a
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=758d6117-8a63-4a5d-8dd9-7339a955921a;Ip=[45.11.93.53];Helo=[zmbhksu.onmicrosoft.com]
X-MS-Exchange-CrossTenant-AuthSource: LO1PEPF000028CC.GBRP265.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB6245
--HSi5hIr4q2T505jKShZwx71qP5EEUH2zOOlzXcxQaT
Content-Type: multipart/alternative; boundary="cbLhGKHsKats7HgeD9xN48MZSboHkzRDeGFXVek3EQgIhdG826RA"
--cbLhGKHsKats7HgeD9xN48MZSboHkzRDeGFXVek3EQgIhdG826RA
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: hexa
1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa
1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa
EvBKlgLxKN28 EvBKlgLxKN28 EvBKlgLxKN28 EvBKlgLxKN28
ArpaBra1YF ArpaBra1YF ArpaBra1YF ArpaBra1YF
1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa
EvBKlgLxKN28 EvBKlgLxKN28 EvBKlgLxKN28 EvBKlgLxKN28
ArpaBra1YF ArpaBra1YF ArpaBra1YF ArpaBra1YF
1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa 1foKVhPm4dnIa
EvBKlgLxKN28 EvBKlgLxKN28 EvBKlgLxKN28 EvBKlgLxKN28
ArpaBra1YF ArpaBra1YF ArpaBra1YF ArpaBra1YF
--cbLhGKHsKats7HgeD9xN48MZSboHkzRDeGFXVek3EQgIhdG826RA
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
--cbLhGKHsKats7HgeD9xN48MZSboHkzRDeGFXVek3EQgIhdG826RA--
--HSi5hIr4q2T505jKShZwx71qP5EEUH2zOOlzXcxQaT--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments