OwlCyberSecurity - MANAGER

Edit File: 1702285331.M318702P2333489.server237.web-hosting.com,S=14335,W=14601

Envelope-to: dev@ebaarchitects.org
Delivery-date: Mon, 11 Dec 2023 04:02:11 -0500
From: Support Team <info@mandatorytraining.co.uk>
To: "dev@ebaarchitects.org" <dev@ebaarchitects.org>
Subject: Re: Possible suspicious charge on my bank account - urgent attention
 required
Thread-Topic: Possible suspicious charge on my bank account - urgent attention
 required
Thread-Index: AQHaK9p+h1MavhB8M0uQXEm3OAJw2bCjyYTJ
Date: Mon, 11 Dec 2023 09:01:22 +0000
Message-ID:
 <CWLP123MB6034D6927D7EDF347FCD2E8E918FA@CWLP123MB6034.GBRP123.PROD.OUTLOOK.COM>
References: <0a531ab15b705a55862c65ce284c6666eeb5ca@ebaarchitects.org>
In-Reply-To: <0a531ab15b705a55862c65ce284c6666eeb5ca@ebaarchitects.org>
Accept-Language: en-GB, en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
 =?us-ascii?Q?oxFsqs6JB/mzC0CaKqMn/Furcjn1J+nAkElpc0pMmBgjmRvDfenY/sPPd4nJ?=
 =?us-ascii?Q?toumRctYXdhaxMrrnG1OATklOVMkZzM8RUq/kJVSC7bmMnIIuEy7e9x4H1hC?=
 =?us-ascii?Q?P/H+bK7eyTJu0mNuV2WtMHWbXrkkSqlEDYb9Yjg+nIsVoCFlfU+QxHwHXRpZ?=
 =?us-ascii?Q?xeqv3ciNYm/+JG9vzpbtwNuJzWIBjbYATBcTgg9r/T1ApSg6D+9zSVSBFdmf?=
 =?us-ascii?Q?+4erxKht1ZM90f42CvQI5Xh5Bp5VNA2egRyX9W0PG9udtQq36KQE/b7RsU6w?=
 =?us-ascii?Q?SwZzuk1gsY0wIQMpifBUkADQ9Dpw/hbOqPjog5v7voBF+KaGAJ+8U0mlrTqZ?=
 =?us-ascii?Q?R6IAcC2Xuj7SGC2J3COVHrAqgDm2G2G+mdzd/hYurQeJyK2OL+Mar62+2IHN?=
 =?us-ascii?Q?7fLhp63dBrnn2oQljARU+4NYUyFu8dZbNcD8qaZtZFGL8GSJRCupe2Ejt+V+?=
 =?us-ascii?Q?dEvLDyb6GF4rgz5Iitic4wkL/Nrz1P9GHw/3/FDUyBvuBQeEpMgBpFSJ0NCF?=
 =?us-ascii?Q?CKvLPXGe9eabmBMMlxC+uauJ1pISjhc5G02bokvk/BMXfMPH1boM+I45XKYR?=
 =?us-ascii?Q?OX+VGlKQ75n340sXZahVIaZCj5WSrlsWGBVcRGJ9pZe6Ls+egZkaKa9dGY1l?=
 =?us-ascii?Q?sWSPVDFiX63Q0ko1R60qk/JYPo2QLJ6GketWhVJ8b/sxx+mEwrDGKUhnrJHY?=
 =?us-ascii?Q?amW0t4Ik6iWDi93ny6JvDYmcGNadHs1FxV1SsNnoYgmwFFexe0ILmPpt3FwM?=
 =?us-ascii?Q?iKCc1HYh+ifgJpwj13GAtghUx9ZJFwdiH2alMVpwxsUOXk5g0DaGfK8dN/Yg?=
 =?us-ascii?Q?EzuehI815QXo0iDfYwXgROYY1NxePjFVV5YDKgAxpnSoYDw7MS/j5OuE33Px?=
 =?us-ascii?Q?zB8fxRH1vjBBHFr6STVNr4gCV+EoWZLrdvaVu6enautAKLIIpKyofAeauPF/?=
 =?us-ascii?Q?qVxcjXoNJasIQWFL7fLGExhOAGSJe7+lZhdyzZnRalHFFXDWfBZJYTJzyjuf?=
 =?us-ascii?Q?8MzOQvcBLnZOQvlw2sQvTlnfW196+hUHchBfVTFEKsL76SKL9NfF62Dr+CzQ?=
 =?us-ascii?Q?+cdkIJR1dtj+2k7I1LQyZAGr4bxQWedP8aWNsxYMboAnM3LRk36EmWwKzOwK?=
 =?us-ascii?Q?q7uaaPzhPmmoVZ8vJdtX7A+sejPRGMYUEE4akfZLMiS3IqJlTcHUjA5oneLv?=
 =?us-ascii?Q?/9Og6eZWzXBBvK2+3/RugqMfVLfB4qwkRi8POd+JWHH7T7NU4PCAmHZk+q0r?=
 =?us-ascii?Q?sIR4HYNsGnaTaAhV9/2DCb6gJzbLPbkmpHKIzHuxtChT3kQ6fdLI0/i6MK0f?=
 =?us-ascii?Q?bdMBucukT1ItFiFYy8fkTLF/v125i5itUWtLOIaxk2OXdZyBb1VfUk48C/+b?=
 =?us-ascii?Q?EajQV1Fq0Igi7VSZkpNYyXvZ5wZaS4MrbyEe2Y+re0RY6qVBvZOoCTtQD9Ff?=
 =?us-ascii?Q?XCIp7XkGDaacGiwr0Y64S/CYyqOKN8+lvgFt2TjfLekQjh8UvUcI5EOp0Nh6?=
 =?us-ascii?Q?QbGoatvFMoMIXlGQyyRnQrEniLUABV0VrljPTzWiGeIZootk9zkNzBtjYp2u?=
 =?us-ascii?Q?mzs3siDbJ+uoMIHxDEbzHNawbshoVmDEvCuu38X0BWXXlxuJSIeWs4eysbf/?=
 =?us-ascii?Q?qw=3D=3D?=
Content-Type: multipart/alternative;
	boundary="_000_CWLP123MB6034D6927D7EDF347FCD2E8E918FACWLP123MB6034GBRP_"
MIME-Version: 1.0
X-OriginatorOrg: mandatorytraining.co.uk
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6034.GBRP123.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 940bdf92-36d4-4950-68ca-08dbfa27bf99
X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Dec 2023 09:01:22.7906
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: fed28fed-0aaa-491b-a7d0-9b492075eb4c
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: KGZpWV5NaLaIJy9aSLCdtoxLePls3TMMfcG1+4/FPzaGQNYlboj5VJR4MQafTIkdDrRfKjcQxSBoLjvaJk14ltsXwCX6S2kqg4h4ugiPB2M=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO3P123MB3338
X-Spam-Status: No, score=2.1
X-Spam-Score: 21
X-Spam-Bar: ++
X-Ham-Report: Spam detection software, running on the system "server237.web-hosting.com",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content preview:  Good day, Bern I hope you are well. Please provide us with
    the order number or order transaction so we can investigate this on our end.
    
 Content analysis details:   (2.1 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: hs-service-engage.com]
  0.8 KAM_COUK               Scoring .co.uk emails higher due to poor registry
                             security.
 -0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
 -0.0 SPF_PASS               SPF: sender matches SPF record
  0.0 HTML_MESSAGE           BODY: HTML included in message
  1.3 HTML_IMAGE_ONLY_24     BODY: HTML: images with 2000-2400 bytes of
                             words
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -0.0 T_SCC_BODY_TEXT_LINE   No description available.
  0.0 T_REMOTE_IMAGE         Message contains an external image
X-Spam-Flag: NO

--_000_CWLP123MB6034D6927D7EDF347FCD2E8E918FACWLP123MB6034GBRP_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Good day, Bern

I hope you are well.

Please provide us with the order number or order transaction so we can inve=
stigate this on our end.

Looking forward to hearing from you at your earliest.

Many thanks,

Jesh

On Monday, 11 December 2023, 02:33:59 GMT, Bern S <dev@ebaarchitects.org<ma=
ilto:dev@ebaarchitects.org>> wrote:
Hello Customer Support Team,

I am extremely disappointed to have discovered an unauthorized payment made=
 on my credit card for a purchase made on your website. I have never made a=
ny purchase on your site before, and I am deeply concerned about how my per=
sonal information may have been compromised.

I have already reported this matter to my bank and have provided them with =
all the necessary documentation to prove that I did not make this payment.

Please assist me in this matter by providing me with any relevant informati=
on, such as the transaction ID, that could help me identify the source of t=
his issue.

Your prompt action on this matter would be greatly appreciated.

Sincerely,

--_000_CWLP123MB6034D6927D7EDF347FCD2E8E918FACWLP123MB6034GBRP_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!doctype html>
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
</head>
<body>
<div class=3D"hs_reply_wrap">
<div style=3D"font-family: sans-serif;" dir=3D"auto" data-top-level=3D"true=
">
<p style=3D"margin:0;">Good day, Bern</p>
<br>
<p style=3D"margin:0;">I hope you are well.</p>
<br>
<p style=3D"margin:0;">Please provide us with the order number or order tra=
nsaction so we can investigate this on our end.</p>
<br>
<p style=3D"margin:0;">Looking forward to hearing from you at your earliest=
.</p>
<br>
<p style=3D"margin:0;">Many thanks,</p>
<br>
<p style=3D"margin:0;">Jesh</p>
</div>
<div class=3D"hs_reply"><br>
<div>On Monday, 11 December 2023, 02:33:59 GMT, Bern S <span dir=3D"ltr">&l=
t;<a href=3D"mailto:dev@ebaarchitects.org" target=3D"_blank">dev@ebaarchite=
cts.org</a>&gt;</span> wrote:
<br>
<blockquote class=3D"hs_reply_quote" style=3D"margin:0 0 0 .8ex;border-left=
:1px #ccc solid;padding-left:1ex">
<div align=3D"left"><font size=3D"2" face=3D"Arial">Hello Customer Support =
Team,</font>
</div>
<div>&nbsp; </div>
<div align=3D"left"><font size=3D"2" face=3D"Arial">I am extremely disappoi=
nted to have discovered an unauthorized payment made on my credit card for =
a purchase made on your website. I have never made any purchase on your sit=
e before, and I am deeply concerned about
 how my personal information may have been compromised.</font> </div>
<div>&nbsp; </div>
<div align=3D"left"><font size=3D"2" face=3D"Arial">I have already reported=
 this matter to my bank and have provided them with all the necessary docum=
entation to prove that I did not make this payment.</font>
</div>
<div>&nbsp; </div>
<div align=3D"left"><font size=3D"2" face=3D"Arial">Please assist me in thi=
s matter by providing me with any relevant information, such as the transac=
tion ID, that could help me identify the source of this issue.</font>
</div>
<div>&nbsp; </div>
<div align=3D"left"><font size=3D"2" face=3D"Arial">Your prompt action on t=
his matter would be greatly appreciated.</font>
</div>
<div>&nbsp; </div>
<div align=3D"left"><font size=3D"2" face=3D"Arial">Sincerely,</font> </div=
>
</blockquote>
</div>
</div>
</div>
<img width=3D"1" height=3D"1" style=3D"display:none" alt=3D"" src=3D"https:=
//cpHfy04.na1.hs-service-engage.com/Cto/ON+23284/cpHfy04/R5R8b48XSN7CqsHf2f=
J7zW1Q3fqG25cBJTW3DLtY51X1nJfW1Gytc31YXNgHW23gPY421gBKGW3GJsPS1Q5kxHn1-_jsv=
4W1">
</body>
</html>

--_000_CWLP123MB6034D6927D7EDF347FCD2E8E918FACWLP123MB6034GBRP_--