Canadian Tire Phish from MIcrosoft Outlook
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 22 Mar 2024 19:53:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rnqYh-000000003Dy-10jG
for dave@doctor.nl2k.ab.ca;
Fri, 22 Mar 2024 19:52:31 -0600
Resent-From: The Doctor
Resent-Date: Fri, 22 Mar 2024 19:52:31 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-psaapc01on2097.outbound.protection.outlook.com ([40.107.255.97]:39009 helo=APC01-PSA-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from)
id 1rnqJF-00000000Jur-3c7t
for doctor@doctor.nl2k.ab.ca;
Fri, 22 Mar 2024 19:36:38 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=LZ4J/YwnzSWk6sVOzEB/yGU81mAUOOWIjV1n+Ls7v1zH/KDHz3dF3AuCnEtn1o2s8c33pH0N4dgsoOBJuVkIg6DicW3avhZ9NLw8aU8VaPmQDEOY5v+jCQz2noOzBpTq2xMa9OqHFd281Fi3OKXUhIHuMKwXIRc0WmQDSL6e8n/naMZjQin9kX9ciiSLPlPjqY+fn6rdoMF/bLPYDJb5JSRLAbfw3pidyzrm7QGVtxDX+1PJN0JcT0GtGfQwUcpFMNzOjwxfHP3c4e2r0mw/UvL5OkICJ5ncgjfwUWrSVQq/jcAVB9qXC0twSXeVXXTYCQef2IrgPqncaaRHp2XQAA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=z5XccaY2L/Y0wMwfufBBRdn+FfAQKn13ver0hQ0lvJE=;
b=dPfTZ18xD6bX+ww4cNd3ZWwVKAjrESgsPGirS2mtM/meYPM6Jr29u1rWOxtOZJHMHcPrQf6bZJgMZtikJqwcO4i2tJnxWoEI2HThw+/ApUtuhFS+UxrZHhasudI4sgVYrZGRmGNXYr5KzXJKgkTlb95F9KWFpTUOCa6OTwW38JzQfB6VOFKFVQKZWEXnwJ7ptfv3rd4IOHKLt//XYBciGTqODPao0isKfABHQ7ecrx3kw9AiGUQp2t9a0HdAxpBc9uZUJOczAFciSHnklQYmrm1TS86hA6DhlrFB8knCdV2Fyfi+abb2Ecu9x4/UTDUEcZF5byf5y558MR+cbha2Fw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
172.233.40.156) smtp.rcpttodomain=doctor.nl2k.ab.ca
smtp.mailfrom=vehz.onmicrosoft.com; dmarc=none action=none
header.from=vehz.onmicrosoft.com; dkim=none (message not signed); arc=none
(0)
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 172.233.40.156)
smtp.mailfrom=vehz.onmicrosoft.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=vehz.onmicrosoft.com;
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Date: Sat, 23 Mar 2024 01:34:21 +0000
Subject: Y0U'VE -RECEIVED- A -REWARDS
From: Canadian Tire Rewards
Thread-Index: 9vmSzcZ36N6DYklr9+h3UAUbxWkoPI6Qfo==
msip_labels:
Content-Type: multipart/related; boundary="NmZ6p35d6mbkveVqypMWNMSIvLrfXzK55QcgDSP4Sm"; type="multipart/alternative"
Content-Language: fr-FR
Message-ID:
To: "doctor@gmail.com"
Accept-Language: fr-FR, en-US
MIME-Version: 1.0
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: HK2PEPF00006FB5:EE_|SEYPR01MB5661:EE_
X-MS-Office365-Filtering-Correlation-Id: 8d692d29-57ab-4bc2-77dc-08dc4ad95e04
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
I3qekstu/fGtpqRr9Tp3ttwn0SyjuY+0/kdg9dk6q6GmuncbFreLTGLHubwc5uf+QlyXrnXNRUeADgaEW4ypiVOzp8lzPwe2/Iuymt2aCBrdDIk9MacnnJYCWstQsNZrKkwEfvJlXFEJPLwnMKyxql5NMwfnpiAwfPla9XXYrNSA9m1IyOMgE+a3f1jEHiiFTwVy6l6WsYl5gxi5KDCgHTEsMoaXAmtvRN5nh/oGn1OrJIniU+a/Fv9gh6JMTgCpe9sA2YQ6uWfZS0Gi6oVk3u0ifOp0x6OdaDM4HKiNsHHKBXIkqHJ6vfsumOXF/peHFD5VL38t62nlbrNxr6yrCfWeL+G1IjXEID8U/mwDzdzHYvSkHxIBd9xnfV+Hc0m52ca37PfO9lJhTZQUvz76rJnwscyXlxM6EL/Ov3LwvhWY8HCn2kz00uuk+atBES3W/diS+hj9Olh7TYYNYgYmsC6mYEvMLS/M7h6BE8W9lcQoXxr0oJqFzuGZLvbrV8AqexY7vvy0fuzIIW+j2sBLC1IutV6CHNWw/3uxpcH8XQ9E1kFQbLxouAUPEVosAgno2jgt1chHJQ+o2Fs+pdxSVPSlSm1JMDlpDj6XErONu4v8huZ4ns/Tgb9YmoapNgrvW+7l2Z3LfQ8kG4rby3SjjfwjV3fEkk8OaeczLN98DciVf7YJdPsLSy0JPGq2wZSdFSwTLlP2cOwPHWDOIcp6hw==
X-Forefront-Antispam-Report:
CIP:172.233.40.156;CTRY:NL;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:vehz.onmicrosoft.com;PTR:172-233-40-156.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(82310400014)(376005)(41320700004)(34020700007)(36860700004)(61400799018);DIR:OUT;SFP:1102;
X-OriginatorOrg: vehz.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Mar 2024 01:34:22.1415
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 8d692d29-57ab-4bc2-77dc-08dc4ad95e04
X-MS-Exchange-CrossTenant-Id: a54a1645-38a1-4581-86b4-4f9afe14d61a
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=a54a1645-38a1-4581-86b4-4f9afe14d61a;Ip=[172.233.40.156];Helo=[vehz.onmicrosoft.com]
X-MS-Exchange-CrossTenant-AuthSource:
HK2PEPF00006FB5.apcprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEYPR01MB5661
--NmZ6p35d6mbkveVqypMWNMSIvLrfXzK55QcgDSP4Sm
Content-Type: multipart/alternative; boundary="xDCXsoVtHNmhwjjNqd1V6rWZslQNtsYeQALr4QgDnqQsxNNB7d9y"
--xDCXsoVtHNmhwjjNqd1V6rWZslQNtsYeQALr4QgDnqQsxNNB7d9y
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: hexa
3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd
3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd
M63ZG4uErucr M63ZG4uErucr M63ZG4uErucr M63ZG4uErucr
u2LOVchXWE u2LOVchXWE u2LOVchXWE u2LOVchXWE
3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd
M63ZG4uErucr M63ZG4uErucr M63ZG4uErucr M63ZG4uErucr
u2LOVchXWE u2LOVchXWE u2LOVchXWE u2LOVchXWE
3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd
M63ZG4uErucr M63ZG4uErucr M63ZG4uErucr M63ZG4uErucr
u2LOVchXWE u2LOVchXWE u2LOVchXWE u2LOVchXWE
--xDCXsoVtHNmhwjjNqd1V6rWZslQNtsYeQALr4QgDnqQsxNNB7d9y
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
--xDCXsoVtHNmhwjjNqd1V6rWZslQNtsYeQALr4QgDnqQsxNNB7d9y--
--NmZ6p35d6mbkveVqypMWNMSIvLrfXzK55QcgDSP4Sm--
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 22 Mar 2024 19:53:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rnqYh-000000003Dy-10jG
for dave@doctor.nl2k.ab.ca;
Fri, 22 Mar 2024 19:52:31 -0600
Resent-From: The Doctor
Resent-Date: Fri, 22 Mar 2024 19:52:31 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-psaapc01on2097.outbound.protection.outlook.com ([40.107.255.97]:39009 helo=APC01-PSA-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.97.1 (FreeBSD))
(envelope-from
id 1rnqJF-00000000Jur-3c7t
for doctor@doctor.nl2k.ab.ca;
Fri, 22 Mar 2024 19:36:38 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=LZ4J/YwnzSWk6sVOzEB/yGU81mAUOOWIjV1n+Ls7v1zH/KDHz3dF3AuCnEtn1o2s8c33pH0N4dgsoOBJuVkIg6DicW3avhZ9NLw8aU8VaPmQDEOY5v+jCQz2noOzBpTq2xMa9OqHFd281Fi3OKXUhIHuMKwXIRc0WmQDSL6e8n/naMZjQin9kX9ciiSLPlPjqY+fn6rdoMF/bLPYDJb5JSRLAbfw3pidyzrm7QGVtxDX+1PJN0JcT0GtGfQwUcpFMNzOjwxfHP3c4e2r0mw/UvL5OkICJ5ncgjfwUWrSVQq/jcAVB9qXC0twSXeVXXTYCQef2IrgPqncaaRHp2XQAA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=z5XccaY2L/Y0wMwfufBBRdn+FfAQKn13ver0hQ0lvJE=;
b=dPfTZ18xD6bX+ww4cNd3ZWwVKAjrESgsPGirS2mtM/meYPM6Jr29u1rWOxtOZJHMHcPrQf6bZJgMZtikJqwcO4i2tJnxWoEI2HThw+/ApUtuhFS+UxrZHhasudI4sgVYrZGRmGNXYr5KzXJKgkTlb95F9KWFpTUOCa6OTwW38JzQfB6VOFKFVQKZWEXnwJ7ptfv3rd4IOHKLt//XYBciGTqODPao0isKfABHQ7ecrx3kw9AiGUQp2t9a0HdAxpBc9uZUJOczAFciSHnklQYmrm1TS86hA6DhlrFB8knCdV2Fyfi+abb2Ecu9x4/UTDUEcZF5byf5y558MR+cbha2Fw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
172.233.40.156) smtp.rcpttodomain=doctor.nl2k.ab.ca
smtp.mailfrom=vehz.onmicrosoft.com; dmarc=none action=none
header.from=vehz.onmicrosoft.com; dkim=none (message not signed); arc=none
(0)
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 172.233.40.156)
smtp.mailfrom=vehz.onmicrosoft.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=vehz.onmicrosoft.com;
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Date: Sat, 23 Mar 2024 01:34:21 +0000
Subject: Y0U'VE -RECEIVED- A -REWARDS
From: Canadian Tire Rewards
Thread-Index: 9vmSzcZ36N6DYklr9+h3UAUbxWkoPI6Qfo==
msip_labels:
Content-Type: multipart/related; boundary="NmZ6p35d6mbkveVqypMWNMSIvLrfXzK55QcgDSP4Sm"; type="multipart/alternative"
Content-Language: fr-FR
Message-ID:
To: "doctor@gmail.com"
Accept-Language: fr-FR, en-US
MIME-Version: 1.0
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: HK2PEPF00006FB5:EE_|SEYPR01MB5661:EE_
X-MS-Office365-Filtering-Correlation-Id: 8d692d29-57ab-4bc2-77dc-08dc4ad95e04
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
I3qekstu/fGtpqRr9Tp3ttwn0SyjuY+0/kdg9dk6q6GmuncbFreLTGLHubwc5uf+QlyXrnXNRUeADgaEW4ypiVOzp8lzPwe2/Iuymt2aCBrdDIk9MacnnJYCWstQsNZrKkwEfvJlXFEJPLwnMKyxql5NMwfnpiAwfPla9XXYrNSA9m1IyOMgE+a3f1jEHiiFTwVy6l6WsYl5gxi5KDCgHTEsMoaXAmtvRN5nh/oGn1OrJIniU+a/Fv9gh6JMTgCpe9sA2YQ6uWfZS0Gi6oVk3u0ifOp0x6OdaDM4HKiNsHHKBXIkqHJ6vfsumOXF/peHFD5VL38t62nlbrNxr6yrCfWeL+G1IjXEID8U/mwDzdzHYvSkHxIBd9xnfV+Hc0m52ca37PfO9lJhTZQUvz76rJnwscyXlxM6EL/Ov3LwvhWY8HCn2kz00uuk+atBES3W/diS+hj9Olh7TYYNYgYmsC6mYEvMLS/M7h6BE8W9lcQoXxr0oJqFzuGZLvbrV8AqexY7vvy0fuzIIW+j2sBLC1IutV6CHNWw/3uxpcH8XQ9E1kFQbLxouAUPEVosAgno2jgt1chHJQ+o2Fs+pdxSVPSlSm1JMDlpDj6XErONu4v8huZ4ns/Tgb9YmoapNgrvW+7l2Z3LfQ8kG4rby3SjjfwjV3fEkk8OaeczLN98DciVf7YJdPsLSy0JPGq2wZSdFSwTLlP2cOwPHWDOIcp6hw==
X-Forefront-Antispam-Report:
CIP:172.233.40.156;CTRY:NL;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:vehz.onmicrosoft.com;PTR:172-233-40-156.ip.linodeusercontent.com;CAT:NONE;SFS:(13230031)(82310400014)(376005)(41320700004)(34020700007)(36860700004)(61400799018);DIR:OUT;SFP:1102;
X-OriginatorOrg: vehz.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Mar 2024 01:34:22.1415
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 8d692d29-57ab-4bc2-77dc-08dc4ad95e04
X-MS-Exchange-CrossTenant-Id: a54a1645-38a1-4581-86b4-4f9afe14d61a
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=a54a1645-38a1-4581-86b4-4f9afe14d61a;Ip=[172.233.40.156];Helo=[vehz.onmicrosoft.com]
X-MS-Exchange-CrossTenant-AuthSource:
HK2PEPF00006FB5.apcprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEYPR01MB5661
--NmZ6p35d6mbkveVqypMWNMSIvLrfXzK55QcgDSP4Sm
Content-Type: multipart/alternative; boundary="xDCXsoVtHNmhwjjNqd1V6rWZslQNtsYeQALr4QgDnqQsxNNB7d9y"
--xDCXsoVtHNmhwjjNqd1V6rWZslQNtsYeQALr4QgDnqQsxNNB7d9y
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: hexa
3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd
3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd
M63ZG4uErucr M63ZG4uErucr M63ZG4uErucr M63ZG4uErucr
u2LOVchXWE u2LOVchXWE u2LOVchXWE u2LOVchXWE
3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd
M63ZG4uErucr M63ZG4uErucr M63ZG4uErucr M63ZG4uErucr
u2LOVchXWE u2LOVchXWE u2LOVchXWE u2LOVchXWE
3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd 3W9MmuSoNh9Bd
M63ZG4uErucr M63ZG4uErucr M63ZG4uErucr M63ZG4uErucr
u2LOVchXWE u2LOVchXWE u2LOVchXWE u2LOVchXWE
--xDCXsoVtHNmhwjjNqd1V6rWZslQNtsYeQALr4QgDnqQsxNNB7d9y
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
--xDCXsoVtHNmhwjjNqd1V6rWZslQNtsYeQALr4QgDnqQsxNNB7d9y--
--NmZ6p35d6mbkveVqypMWNMSIvLrfXzK55QcgDSP4Sm--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments