Fwd: Fraud emails impersonating National Lottery Fwd: Lotto

---------- Forwarded message ----------
From: Andrey Kopelev <ansvet_99@yahoo.com>
Date: Friday, December 10, 2021
Subject: Fraud emails impersonating National Lottery Fwd: Lotto
To: spam@fightspam.gc.ca, reportphishing@antiphishing.org, reportphishing@apwg.org, phishing-report@us-cert.gov, fraudreporting@unaids.org, contact@cyber.gc.ca, abuse@contactprivacy.com, emailscamalerts@gmail.com, phish@office365.microsoft.com, junk@office365.microsoft.com, abusecomplaints@markmonitor.com, ccops@markmonitor.com, domains@microsoft.com, abuse@microsoft.com, secure@microsoft.com, msndcc@microsoft.com, msnhst@microsoft.com, IOC@microsoft.com, dabedard@microsoft.com, v-raghuy@microsoft.com, customerservice@calottery.com, dns-admin@mailbox.co.za, abuse@online.net, noc+ripe@as12876.net, ripe@online.net, abuse@bookmyname.com, abuse_2021+online.net_216.119.122.229@bookmyname.com, a17762ffa3f9efcf.1093358@spamfree.bookmyname.com, mmarchand+ripe@online.net, support@mailbox.co.za, bushelerfoec@outlook.com

This person bombard me with fraud/scam emails asking for personal information impersonating lottery.  I have reported this domain already several times - it is still active and the offender still sends those emails. I don't participate in lotteries. My emails address is not officially listed anywhere. The only way this person could get it is from the spam list.  Please block his accounts.  Below is the full header and more info on domain mailbox.co.za 

Emails provided: maryhanks1080@outlook.com   maryhanks1024@mailbox.co.za Hosting Provider: ONLINE S.A.S IP Address: 195.154.207.108

Domain Name: mailbox.co.za  Registry Domain ID: DOM_20H44-CO.ZA  Registrar WHOIS Server:  Registrar URL: http://eoe.work/  Updated Date: 2021-11-04T22:00:06Z  Creation Date: 1996-11-04T22:00:00Z  Registry Expiry Date: 2022-11-04T22:00:00Z  Registrar Registration Expiration Date: 2022-11-04T22:00:00Z  Registrar: East of Eden  Registrar Abuse Contact Email: dns-admin@mailbox.co.za  Registrar Abuse Contact Phone: +27.116289700

Responsible organisation: ONLINE SAS

Abuse contact info: abuse@online.net

rganisation:   ORG-ONLI1-RIPE  mnt-ref:        MNT-TISCALIFR-B2B  org-name:       ONLINE SAS  org-type:       OTHER  address:        8 rue de la ville l'eveque 75008 PARIS  e-mail:         noc+ripe@as12876.net  abuse-c:        AR32851-RIPE  mnt-ref:        ONLINESAS-MNT  mnt-by:         ONLINESAS-MNT  created:        2015-07-10T15:20:41Z  last-modified:  2017-10-30T14:40:53Z  source:         RIPE

Euro-Million Lottery <bushelerfoec@outlook.com> 

Lotto

Suggested_Attachment_Session_Id: 4b355748-ad94-55d2-89b2-dde49dcce730

X-Ms-Exchange-Crosstenant-Originalarrivaltime: 09 Dec 2021 16:40:26.4689 (UTC)

X-Originatororg: outlook.com

X-Ms-Exchange-Transport-Crosstenantheadersstamped: BYAPR17MB2214

X-Ms-Exchange-Slblob-Mailprops: jU7fZ3FgphXrGnd4iOLaeYyW06wFQFULKfGXTga2UgdVqOhExP3cDechdHW1Z2MIrJTAMKlPQJDMHyk0zoe6igO1mdeRcxPXFmXZjsNZwVE2UpGy4oPw5V+AKnQGyTnD/pBPn0aNDopgjPu/Z9GpYYYfUhWQH43ITfoldM5gJDwxZtV+//VDqrVWA/a1e23MUMgAuGnsAlDhrlPC6G1ElJdpEfPflks5aRtkMahvyUFtEHlgreyDlVAjcgNlKmcw9Y/lj6hH3q/tISzF0D6OvTV74BxdRTQ8auxk3UwTI+eZdqryibgmeFBcPFD3YXBz/sOgLIRVjRz37ocnJyAaeEO3OaUxPL7bjm+fzsRVsultlwMXJggPSthAcF4nzwqemVRI4+1wI4zgDdovSva2NhAClR254zE8WfNfEi94L0KGQaEUBr8cKbDtuWRcUEosAMSwTCnsLK3INe3Vm98pU4YPIM/kTsE6IyXesISboVxwtZL+BcqeXYX/b1Fda8j8jlGdH7JS8rySOGITt3UKwG+hmiqkNq+RIm43XB+95/jeI5//sLov253J6BH4Qe/BDq4540INnYb3JVPFM3ePGcpitCPeY+EltX4Nk1VxZmI/A9W1QbZp9A==

Authentication-Results: atlas123.free.mail.bf1.yahoo.com; dkim=pass header.i=@outlook.com header.s=selector1; spf=pass smtp.mailfrom=outlook.com; dmarc=pass(p=NONE,sp=QUARANTINE) header.from=outlook.com;

X-Originating-Ip: [40.92.40.95]

X-Ms-Exchange-Crosstenant-Authsource: BY5PR17MB3428.namprd17.prod.outlook.com

X-Ms-Exchange-Crosstenant-Rms-Persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-Ms-Exchange-Crosstenant-Rms-Persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-Ymailisg: joxOGmYWLDuUz4zms_RzsOxrshP6QoydJB5_nW0ydp8Qh1hj K8x1bxmRBD1CmuLuDWqPDA3dDbRTvKfsvg_AkWvKmnKchHhfDfPl.2AGw3tY VL5aSp7UjQj90DW0OGMnuXTGOqk7F6y0JZf3NVWK6g.ioCC3WVkHixjpljgO pa2YDCnJZdHmwv1.VHd1YX3MZV5AEuhiKvSlPvnLAzOKqa5W605legvGpGnO r7A4NpdugK3H03HQmvJPMxWuarZMztmsyKGZHC5paz9yXJQpIKPnxUo8hj8q DOu3SQPIVU.H_2dz9byjRnqd4Nxyh_eBU4TURbWG1ShrOWT5kYFrorpCvxt1 fyv6gOT7vUkok2U2COQM8YkmpYK4v8T6tlnC4RegJkEmGu2SdzQFXhyi1dGq TW8OsQ8zLvVTAdvtX1zToEdsEvZZ8CZSrnvaNIOxRywIkD9Rg7j_kU24MlNB V0UBk3WzXDRdKEeFTfu1NII06Phm2AQ9l6EbHR58YRTPbJ.33wgkmSHEen9y wme9tykdbTbH_eJMQ9pEEsKKMzqU36nZBgxQyuaiel0meD9zR95KI12UR.CK qrFXX38PaeuKOQqh4kW_FN9M8Kp_NJnfwkjKY.8B22Q_ple3m_4PFWPZHrlf fQpmhEYNrADUteJK_8Yt.xEmgpaJWsc7VpfX06OWZSP7GIiqrIzXA7wQlUyU w2jjQfDozwKV_JDK5M1mZE5PaXcMMRCXT36vOSrEAvkybokmXpfBfAb7DQOC 1V6OdSZCkpz1RFO6MQn02fUVNDJIM1W0EQJjjUD7mpldgfAADaaAG5MGmR5_ F2X6Qc5Qo_hqc7U1iN0PZmBbMJsOzj3PxSL.xCLY9e2YMN7ZG_ury5DWDg8V kG.dw5KdtUPOK_d.Iwkr8KsbelBmPskU319iK.nXjhVStAl7gEPstsH5fXU9 2QowibMeMnz6iSKxEaiDoihz4VI6e06pN94ylW43j3CxR_O4W7WNJmtejheE GdttxOWvSDl8cAmG5dZOlEdxwNEIwBt7Q9snwCsch.XYog4609SaJVDUrGtm PGKReE8xLzzC1Hq2fNyYfHr0s.QDPTMuUQqs.EaTZ.epiPilFU7Hrs0Ysv8E XsMY3_x4pBPhCEE0cnuOHLoK0tQA._YPgGADNZ4Zm500cossdGL3c3qixkLb 2yt.qaeSGRZGY5mFq3Ezd9rjfQ0UbRXpk4FohOdI5xM5mHAsUup.KjW3Cavj yk4CCoA952AspvgVKNoOA6KhhFNuGWsmD6Cry5od1rF4Nne6L_qNmsqo4nt6

Return-Path: <bushelerfoec@outlook.com>

Content-Length: 345463

X-Ms-Exchange-Crosstenant-Fromentityheader: Hosted

X-Ms-Tnef-Correlator: 

X-Ms-Exchange-Crosstenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-Ms-Exchange-Antispam-Messagedata-Chunkcount: 1

X-Ms-Publictraffictype: Email

X-Ms-Exchange-Crosstenant-Authas: Internal

Arc-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Oi2Stpq1LDDY1DVzi9JGNGdmvtj8a4kjs9VEBWX0HfV4dD4rnFl52bMyhM0iAwX9cO4mwa5/usnFBZPxwrceh4vA23c2VFJKFWhpymtUc5FIYR6Dh0dWsTXjwAne3dxylAGX/Q9cYNYTl+4xvrN2cUA46/oslNi/EFRov9obZrGA/n+zsZMwh9s7O9stDgHxcbNt41UZaibThwAKFHOE7Q98rznGTvabA1DoACeMAbGL80ldD1R9yeA4Wh+G5ZappjuqbFEe54+1B9PFBb6eof+j6PMRIYQfhrKzNG2OI4Y9c+oo7ljXksw4FFkyLtdDn0nqr+3s6BbPBpNG4t3Fxw==

X-Microsoft-Antispam: BCL:0;

Thread-Index: AQHX7RtqcQQZgVbhnUK0/Z1V+rXT8w==

Accept-Language: en-US

X-Ms-Exchange-Antispam-Messagedata-0: 39Qj8GWdkFpotC+NSw6F+vJEl+2wPdnQkjqVmx3ipWMPW80slsw6ob9uEmUXhJzNiCHIN6mID3GVIPxKzrlLvvRgl0algK9rGkJ+438wNYlmniy1HAQErMIKzPTKL3kfWCRajsoEIuR7D+V+P8ohrotWzNH/bYUAcvP2hczp94dafrzA88+ywthUk8Ij10Cbs0dM/Y4aF8znsWQGecNIf4wOkSZIjDRbJQJld+YkOjm6Az9eRVJml/8q2d0g79SWJWjJ6ydtt/ImGiR6lNCHeoyJWYEWDCXkWeqSI9ed3sAGpqUGEjPOW7wTE5aYtiZkGaL/lTXsmy0tQ/8bBCnvpU9k5mmswFNmyrx3wsLtCcDyr9tdpPFBgn0hocl2VKci2Nus9mWvpr4WmZ/PqIFx4rTFMiN6i7DD8PbUrCBKRr3zVNzfDTriAcUJiasywCJSJT9cGYvfe7uZT0GQX6jnJEoEXdX02tGavK9jW96x2NXlJ2VW7BMGuo0SEpJcxiwG5DPdck+7+CLn3EPQmyU1La5bOHvavvgbgOycNKh8NfQAfxUeXHwTth3jsXSEXzc3ehultle93LW/fLHJENjFI0pPyeCJwXnalI4TZXzp5LxB0u23SY3SSBx92XVdTqtVcEBoLmnqM4WJLwO5m5HOpsRPM076l46/4fRPblr8Nr4mz0046xdTAj1HdRq+9EWTKUQP7o03pLeg60ZFQiYRa335yHfyR9I+V1PcmaOFG1G7n459w7sBoPfcRnigjNdo83FCamlAQfQf0c6BPYC8z/CGLIciFdYRpbOBbolsUli1JfJcJf/HnndeL6KVSFxGXyZoj1PG7/11B+TGay2Ang/+XcmKNDbXldOSUwVtiiR2B/Zq95SRIBcV7/T+1oGTJf584OhR/VwIZGJNph02JNJaMJdf0OZXddzdQHz/ZIfBG8Vaw2AlAjYIT7jPx35+

<BY5PR17MB34288C647CEA143145498042C1709@BY5PR17MB3428.namprd17.prod.outlook.com>

X-Microsoft-Antispam-Message-Info: bnKDjmuORNgZd4w66HlgfWDanhBN+lk220SVB7DfEDNXwnlBlt9/xT/G7MoW5LGdHR7j0virE2sjud8U+VMY/rgTcGxOcu56FXx5Qzwgv8MgWg/TNPMgHuP55ztl8LpBt5Jnl3QBe4Cbr4ayt2/tiUCJkwqqIFelUz8EmHySqigDRJDUFtpY5GysNgXz6NbyxQp4MKA50AoMoFkb3W9piWq4UeOE/xhUfPEdSPMKOjVu10GQ8NNIPNilE2ZrB9cjs2E8Pm9Uc9kJFQYcM5tpK06YARtHLqBomt8NgCB8b5YnAqGLq3Y+aZkkOqmAno+sAc8YvVjjoUg78ccwNS2soQRoUBdeQ/HfaC9JZLyAowpqxWxawz8V71a2gl3Ld+EbhavBOPQJbvD9Q0adVN5HPGLSp4L7l2X35VVNZaTK9fzu20Fas6K8SaGXvsc4eE9lkiWKQu1JLyIG+tRlF39lJm1fN2QpYkAtLEGP6iLPzPkaPX4574+OMsr54iOIqKi/CqoCdFs4rB5c1f4hhPmT5g==

Content-Language: en-US

Arc-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none

Mime-Version: 1.0

X-Ms-Office365-Filtering-Correlation-Id: a0fa6c3a-3169-45a0-51f3-08d9bb329a98

Received: from 10.197.33.137 by atlas123.free.mail.bf1.yahoo.com with HTTPS; Thu, 9 Dec 2021 16:40:40 +0000

Received: from 40.92.40.95 (EHLO NAM10-BN7-obe.outbound.protection.outlook.com) by 10.197.33.137 with SMTPs (version=TLS1_2 cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256); Thu, 09 Dec 2021 16:40:40 +0000

Received: from BY5PR17MB3428.namprd17.prod.outlook.com (2603:10b6:a03:1b9::10) by BYAPR17MB2214.namprd17.prod.outlook.com (2603:10b6:a02:b9::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4755.21; Thu, 9 Dec 2021 16:40:26 +0000

Received: from BY5PR17MB3428.namprd17.prod.outlook.com ([fe80::6804:54ba:78a6:f7e1]) by BY5PR17MB3428.namprd17.prod.outlook.com ([fe80::6804:54ba:78a6:f7e1%2]) with mapi id 15.20.4778.013; Thu, 9 Dec 2021 16:40:26 +0000

Thread-Topic: Lotto

X-Ms-Has-Attach: yes

Content-Type: multipart/mixed; boundary="_004_BY5PR17MB34288C647CEA143145498042C1709BY5PR17MB3428namp_"

X-Ms-Traffictypediagnostic: BYAPR17MB2214:EE_

Received-Spf: pass (domain of outlook.com designates 40.92.40.95 as permitted sender)

X-Apparently-To: ansvet_99@yahoo.com; Thu, 9 Dec 2021 16:40:41 +0000

X-Tmn: [ex0Omd3YJ7eSEK7/pUMV0a9qMYoH8/Qh]

X-Ms-Exchange-Crosstenant-Network-Message-Id: a0fa6c3a-3169-45a0-51f3-08d9bb329a98

Arc-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=UeKkH/UMzc25kLrB12PGzRTtC5PfwN35U6EpdZJOCt0=; b=TwUsUUhbyPSDaslSs6CIZzH5WtcXBm3c12EoMXgTbhb2cvOSMJV3idiPGKFsdH70q5oSykQFKGfEi2hDWo2ZQh371eyVRXDPb3fuW9DoUlKS8i6aYvRJx+t7XAWbKtYIar/xBtL6WysOvC/5fVX5z/nWmBLQQ32JGVeTywxcjkgJRBc2uKlo0QpUzEt3cPOGKumbuP60y7uUqDv/tbCwAjSbaPpRq/9yiUoEKn2nCvaB8Va61Fo7pX/4m/Czwi8iVUR1IroRO2U+Sozslw7ZMnkrzRRf45hVkSn4mePdTb7ndPo+sI4pV0/P+vTiNIemGj5++QDcWdzypx+1owH43w==

Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UeKkH/UMzc25kLrB12PGzRTtC5PfwN35U6EpdZJOCt0=; b=ufKbDxvkQIv1IaoR3cv0rONzDQhUitF0UidahE8bt7Hihxn5AIDLGHz0WYwyv1wwg1IOA8pB/Te2ftYplTnxvnWqZPzH55HwhQgP6Sp5lcJ54824ksLmoUx7+j1KRd03/pxwUCOzaOTlgYMxkpL67O5v5P/48AAfny2EQ9wKYThNolh9RJLtsxxHMlS36h0JPpAewjlm1kjW3R9HoqeorLBXUSZvJmVDDLaJlg4FL3EIl6kssingtRx80xzaB6Wkf9BSqWO1c6FugXACF44Y8zYS8j/8eY80nTHL7iyIi15ihWj7dK9oA4J1q1tdDcTf4L2lvYaHcOTB10EpENJOEA==

Begin forwarded message:

From: Euro-Million Lottery <bushelerfoec@outlook.com>

Subject: Lotto

Date: December 9, 2021 at 11:40:26 AM EST

Open the attachment: