So, a few days ago I got one of the most sophisticated phising scam messages I’ve ever received. Message:
Bluehost.com
2:46 PM (5 hours ago)
to me
Hello, LAWRENCE PERSON
We are contacting you today because we have disabled your outbound email services temporarily. The reason for this is because you've got a forum that spammers were subscribing to to get messages sent out. They used a spam trap email address that actually resulted in our mail server getting blacklisted.
We need you to add protection to it so it isn't being exploited in the future. You will need to contact us and let us know this has been resolved for us to restore your email services.
For protection, we ask that you require an account to subscribe to topic notifications if you haven't already. We also ask that you add protection to your sign-up page so that spammers cannot automate it. You can do this by using a captcha or something similar to that.
To activate your account, please visit our BlueHost account reactivation center. Use the link below:
http://my.bluehost.com.313e7d092611f0c58251064957ca6b4c.
cajunhomeservices.com/account/58961/reactivation.html
Thank you,
BlueHost.com Terms of Service Compliance
http://www.bluehost.com
For support go to http://helpdesk.bluehost.com/
Toll-Free: (888) 401-4678
Note the relatively good English and the fairly sophisticated “You have a technical spam problem” hook. The all caps name and the fact I don’t have any “forums” is the only giveaway, besides an examination of the actual link provided, that it’s not kosher.
Note that the link actually points to “cajunhomeservices.com”.
Raw source:
Delivered-To: l********@gmail.com
Received: by 2002:ac2:518f:0:0:0:0:0 with SMTP id u15csp11449403lfi;
Thu, 14 Nov 2019 12:46:12 -0800 (PST)
X-Google-Smtp-Source: APXvYqzeSBr4ElY5I4kaRQJbufydJ32F7GyXgzop2lpZkta8d7s7
RkuuytltMNPtM4up1GCCTCwr
X-Received: by 2002:aca:52c2:: with SMTP id g185mr5152898oib.45.1573764372228;
Thu, 14 Nov 2019 12:46:12 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1573764372; cv=none;
d=google.com; s=arc-20160816;
b=sPXkzlz9bAXMXM5E2CaRKG6d6ybRdOxTCNcjZNm5e5kMRkr4KWL
2xq4PjgaGnn3KIYbVmgahiHv7Trl3QgGFzbryJNeeX5VNhxK/
cSIumeiQnlB3aNUV/0qfNY1Cu6szqcMn890SG6r/
7Nvq3XWQ0kGiPBdTAELDw8QS8bpgIPrSHeKPJ669ifn50yKL7KybJ
PnrlQrJe8rWDPDAag1kkJpPhEWIzhWzETQpMW65pUVsuO4SoleoVo
MRHR4WWZ3x4UgY+I7+s58RjcHDx+uSS5UYboFJd6n+ksMZQUNI9rq
MmUYIdq3GLvXAekXAbIXyzUYo+24K2Z0iusbAJo
CQGA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=content-transfer-encoding:mime-version:from:to:subject:message-id
:date;
bh=sZf91ll1kaMuGiSLWB5C0DKuw/3r72M1cUA1iJqiuLw=;
b=b5CGhK96w1NqMgkAhr04RJAsjO9YKteraSIV/tvZoFeuEGUhGlHF
nxu8r3KLVTb5fNbAJXyxbLxSy+vxpXeZXhMLcS+OApLDERBmuJ9Pm
VH9TTxayaPbpqTHvyKgCGRr6JG4aM12/7CdqWxy3aH5hRvKwYg8Y35
xZZ0jQgnngrEXsx9glAX3S78XsCGS27BCKzoB/qA7c4245rT7rEXf3
y6uRyZSe6Kc9FaYotV7j5VpjhVr0c+qcf7iJUFtdjLSkYW/BlY2baA
jGq3WixP5g3y9fYZ8X636dLLFcu7PKpKsb324VRcRgKJONc356J7x0
K4I+pEk3oLxlMa8T3
/RLw==
ARC-Authentication-Results: i=1; mx.google.com;
spf=fail (google.com: domain of support@bluehost.com does not designate 192.185.143.39 as permitted sender) smtp.mailfrom=support@bluehost.com;
dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=bluehost.com
Return-Path:
Received: from gateway31.websitewelcome.com (gateway31.websitewelcome.com. [192.185.143.39])
by mx.google.com with ESMTPS id f84si4367574oig.42.2019.11.14.12.46.11
for
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Thu, 14 Nov 2019 12:46:12 -0800 (PST)
Received-SPF: fail (google.com: domain of support@bluehost.com does not designate 192.185.143.39 as permitted sender) client-ip=192.185.143.39;
Authentication-Results: mx.google.com;
spf=fail (google.com: domain of support@bluehost.com does not designate 192.185.143.39 as permitted sender) smtp.mailfrom=support@bluehost.com;
dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=bluehost.com
Received: from cm13.websitewelcome.com (cm13.websitewelcome.com [100.42.49.6]) by gateway31.websitewelcome.com (Postfix) with ESMTP id BD99FD53F0 for
Received: from box2082.bluehost.com ([50.87.249.228]) by cmsmtp with SMTP id VM0Ji8N6s3Qi0VM0JiRiqR; Thu, 14 Nov 2019 14:46:11 -0600
X-Authority-Reason: ss=1
Received: from [162.248.225.8] (port=55837 helo=support) by box2082.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92) (envelope-from
Date: Thu, 14 Nov 2019 15:48:38 -0500
Message-ID: <1332064982.webi20191114154838@bluehost.com>
Subject: Disabled your outbound email services temporarily
To: l********@gmail.com
From: "Bluehost.com"
X-Priority: 4 (Low)
Mime-Version: 1.0
X-Mailer: Php_libMail_v_2.11(webi.ru)
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: base64
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - box2082.bluehost.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - bluehost.com
X-BWhitelist: no
X-Source-IP: 162.248.225.8
X-Source-L: No
X-Exim-ID: 1iVM0J-003aX1-95
X-Source:
X-Source-Args:
X-Source-Dir:
X-Source-Sender: (support) [162.248.225.8]:55837
X-Source-Auth: bh_1572749987@sandiegoslushkin.com
X-Email-Count: 9
X-Source-Cap: c2FuZGlmbjk7c2FuZGlmbjk7Ym94MjA4Mi5ibHVlaG9zdC5jb20=
X-Local-Domain: no
SGVsbG8sIExBV1JFTkNFIFBFUlNPTg0KIA0KV2UgYXJlIGNvbnRhY3RpbmcgeW91IHRvZGF5IGJl
Y2F1c2Ugd2UgaGF2ZSBkaXNhYmxlZCB5b3VyIG91dGJvdW5kIGVtYWlsIHNlcnZpY2VzIHRlbXBv
cmFyaWx5LiBUaGUgcmVhc29uIGZvciB0aGlzIGlzIGJlY2F1c2UgeW91J3ZlIGdvdCBhIGZvcnVt
IHRoYXQgc3BhbW1lcnMgd2VyZSBzdWJzY3JpYmluZyB0byB0byBnZXQgbWVzc2FnZXMgc2VudCBv
dXQuIFRoZXkgdXNlZCBhIHNwYW0gdHJhcCBlbWFpbCBhZGRyZXNzIHRoYXQgYWN0dWFsbHkgcmVz
dWx0ZWQgaW4gb3VyIG1haWwgc2VydmVyIGdldHRpbmcgYmxhY2tsaXN0ZWQuDQoNCldlIG5lZWQg
eW91IHRvIGFkZCBwcm90ZWN0aW9uIHRvIGl0IHNvIGl0IGlzbid0IGJlaW5nIGV4cGxvaXRlZCBp
biB0aGUgZnV0dXJlLiBZb3Ugd2lsbCBuZWVkIHRvIGNvbnRhY3QgdXMgYW5kIGxldCB1cyBrbm93
IHRoaXMgaGFzIGJlZW4gcmVzb2x2ZWQgZm9yIHVzIHRvIHJlc3RvcmUgeW91ciBlbWFpbCBzZXJ2
aWNlcy4NCg0KRm9yIHByb3RlY3Rpb24sIHdlIGFzayB0aGF0IHlvdSByZXF1aXJlIGFuIGFjY291
bnQgdG8gc3Vic2NyaWJlIHRvIHRvcGljIG5vdGlmaWNhdGlvbnMgaWYgeW91IGhhdmVuJ3QgYWxy
ZWFkeS4gV2UgYWxzbyBhc2sgdGhhdCB5b3UgYWRkIHByb3RlY3Rpb24gdG8geW91ciBzaWduLXVw
IHBhZ2Ugc28gdGhhdCBzcGFtbWVycyBjYW5ub3QgYXV0b21hdGUgaXQuIFlvdSBjYW4gZG8gdGhp
cyBieSB1c2luZyBhIGNhcHRjaGEgb3Igc29tZXRoaW5nIHNpbWlsYXIgdG8gdGhhdC4NCg0KVG8g
YWN0aXZhdGUgeW91ciBhY2NvdW50LCBwbGVhc2UgdmlzaXQgb3VyIEJsdWVIb3N0IGFjY291bnQg
cmVhY3RpdmF0aW9uIGNlbnRlci4gVXNlIHRoZSBsaW5rIGJlbG93Og0KaHR0cDovL215LmJsdWVo
b3N0LmNvbS4zMTNlN2QwOTI2MTFmMGM1ODI1MTA2NDk1N2NhNmI0Yy5jYWp1bmhvbWVzZXJ2aWNl
cy5jb20vYWNjb3VudC81ODk2MS9yZWFjdGl2YXRpb24uaHRtbA0KDQogDQpUaGFuayB5b3UsIA0K
Qmx1ZUhvc3QuY29tIFRlcm1zIG9mIFNlcnZpY2UgQ29tcGxpYW5jZQ0KaHR0cDovL3d3dy5ibHVl
aG9zdC5jb20NCkZvciBzdXBwb3J0IGdvIHRvIGh0dHA6Ly9oZWxwZGVzay5ibHVlaG9zdC5jb20v
DQpUb2xsLUZyZWU6ICg4ODgpIDQwMS00Njc4
(Note: Line breaks added on ARC lines.)
Note the authentication fails in the raw source of the message.
Let’s do a whois for cajunhomeservices.com:
Domain Name: CAJUNHOMESERVICES.COM
Registry Domain ID: 1987624026_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.fastdomain.com
Registrar URL: http://www.fastdomain.com
Updated Date: 2018-12-16T00:21:49Z
Creation Date: 2015-12-16T00:22:33Z
Registry Expiry Date: 2019-12-16T00:22:33Z
Registrar: FastDomain Inc.
Registrar IANA ID: 1154
Registrar Abuse Contact Email:
Registrar Abuse Contact Phone:
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Name Server: NS1.BLUEHOST.COM
Name Server: NS2.BLUEHOST.COM
DNSSEC: unsigned
URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2019-11-15T02:46:01Z <<<
The interesting thing here is that cajunhomeservices.com is actually registered to bluehost.com. I launched a chat window with technical support (offshore, it seemed like), and they promised to alert the proper security staff.
Lesson: If you receive a message alerting you to some sort of online fraud, never click any link in the message. If it's a domain or service you use, go there by your saved bookmark or by typing the domain URL directly into your browser.
Eternal vigilance is the price of IT security...
Tags: BlueHost, Crime, data security, phishing, Site Administration, technology
Yup, they’re counting on recipients of this scam _not_ carefully checking the headers as you have.
BTW, I notice you obfuscated your …._at_gmail_dot_com address in one place in the header output, but down a bit, your plain text email is _exposed_.
Not sure you meant to do that?
[Good point. Fixed. – LP.]
.
It was the DNS-IP 162.248.225.8 that led me here and yes, a version of the scam manifest’s still (fraudulently posing as Hostmonster.com).
Hostmonster was notified.
One way they harvest victim contact info apparently is by breaking WHOIS website data usage regulations, such as support contacts.
They also repeatedly pass the same mail server at, bluehost.com (74.220.210.60). They should be ‘Blacklisted’ and reported to the WHOIS abuse console.
Cheers
Below is Message Header:
————————————–
Received: from HK2APC01HT126.eop-APC01.prod.protection.outlook.com
(2603:10b6:3:d4::33) by DM6PR02MB5131.namprd02.prod.outlook.com with HTTPS
via DM5PR05CA0023.NAMPRD05.PROD.OUTLOOK.COM; Sun, 29 Nov 2020 19:49:57 +0000
Received: from HK2APC01FT051.eop-APC01.prod.protection.outlook.com
(2a01:111:e400:7ebc::50) by
HK2APC01HT126.eop-APC01.prod.protection.outlook.com (2a01:111:e400:7ebc::377)
with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3611.23; Sun, 29 Nov
2020 19:49:56 +0000
Authentication-Results: spf=pass (sender IP is 74.220.210.60)
smtp.mailfrom=hostmonster.com; dkim=none (message not signed)
header.d=none;email.com; dmarc=pass action=none
header.from=hostmonster.com;compauth=pass reason=100
Received-SPF: Pass (protection.outlook.com: domain of hostmonster.com
designates 74.220.210.60 as permitted sender)
receiver=protection.outlook.com; client-ip=74.220.210.60;
helo=outbound-ss-690.bluehost.com;
Received: from outbound-ss-690.bluehost.com (74.220.210.60) by
HK2APC01FT051.mail.protection.outlook.com (10.152.248.224) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.3611.23 via Frontend Transport; Sun, 29 Nov 2020 19:49:55 +0000
X-IncomingTopHeaderMarker:
OriginalChecksum:853EF0858F43EBB8020A34E674A6AADA5F55180A18062A78D19A3FCDDE7B3C33;UpperCasedChecksum:5D73B6E182C117294E3CE1ECCB659B7A71B1EC6B56455ED021714752D9389B0A;SizeAsReceived:2163;Count:33
Received: from CMGW (unknown [66.147.244.16])
by soproxy1.mail.unifiedlayer.com (Postfix) with ESMTP id 60C76175A5A
for ; Sun, 29 Nov 2020 12:49:54 -0700 (MST)
Received: from host298.hostmonster.com ([66.147.240.98])
by cmsmtp with ESMTP
id jShmk9HFIi1lMjShmk7d5S; Sun, 29 Nov 2020 12:49:54 -0700
X-Authority-Reason: ss=1
X-Authority-Reason: s=1
X-Authority-Analysis: v=2.2 cv=dd3w5Tfe c=1 sm=1 tr=0
a=/jv/ILQsNPe17bXuGqlA/g==:117 a=/jv/ILQsNPe17bXuGqlA/g==:17
a=IkcTkHD0fZMA:10 a=nNwsprhYR40A:10 a=kJO52Q_YrzQA:10 a=GRVx_9asRRsA:10
a=CqXnNkoYAAAA:8 a=akUy9YiQAAAA:8 a=DsvgjBjRAAAA:8 a=v39xLPd8NIIzixw6Ry4A:9
a=QEXdDO2ut3YA:10 a=wib1u2kniKIA:10 a=FU1fj6hume4A:10
a=vX2Ciu08lBWh_3ZkFoZp:22 a=KxBoU5p6ZFG-c4HVJWhV:22 a=c2isB2HDzJ1BPU03kZvS:22
Received: from [162.248.225.8] (port=51190 helo=alert)
by host298.hostmonster.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.93)
(envelope-from )
id 1kjShm-001e6I-6t
for mail@mail.com; Sun, 29 Nov 2020 12:49:54 -0700
Date: Sun, 29 Nov 2020 14:41:55 -0500
Message-ID:
Subject: =?UTF-8?B?WW91IGhhdmUgMSBpbXBvcnRhbnQgbWVzc2FnZSBhbGVydC4=?=
To: mail@mail.com
From: =?UTF-8?B?SG9zdG1vbnN0ZXIuY29t?=
X-Mailer: Php_libMail_v_2.11(webi.ru)
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: base64
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname – host298.hostmonster.com
X-AntiAbuse: Original Domain – mail.com
X-AntiAbuse: Originator/Caller UID/GID – [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain – hostmonster.com
X-BWhitelist: no
X-Source-IP: 162.248.225.8
X-Source-L: No
X-Exim-ID: 1kjShm-001e6I-6t
X-Source:
X-Source-Args:
X-Source-Dir:
X-Source-Sender: (alert) [162.248.225.8]:51190
X-Source-Auth: supports@shs1985.com
X-Email-Count: 10
X-Source-Cap: b21zZWxtaXI7b21zZWxtaXI7aG9zdDI5OC5ob3N0bW9uc3Rlci5jb20=
X-Local-Domain: no
X-IncomingHeaderCount: 33
Return-Path: alert@hostmonster.com
X-MS-Exchange-Organization-ExpirationStartTime: 29 Nov 2020 19:49:56.2309
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
9b077d13-f0bc-47cb-0597-08d8949ff283
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-PublicTrafficType: Email
X-MS-Exchange-Organization-AuthSource:
HK2APC01FT051.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-UserLastLogonTime: 11/29/2020 2:29:33 AM
X-MS-Office365-Filtering-Correlation-Id: 9b077d13-f0bc-47cb-0597-08d8949ff283
X-MS-TrafficTypeDiagnostic: HK2APC01HT126:
X-MS-Exchange-MinimumUrlDomainAge: hostmonster.com#7838
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 74.220.210.60
X-SID-PRA: ALERT@HOSTMONSTER.COM
X-SID-Result: PASS
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-SCL: 0
X-Microsoft-Antispam: BCL:0;
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Nov 2020 19:49:55.8580
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 9b077d13-f0bc-47cb-0597-08d8949ff283
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-AuthSource:
HK2APC01FT051.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HK2APC01HT126
X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.6000385
X-MS-Exchange-Processed-By-BccFoldering: 15.20.3611.031
X-Message-Flag: Flag for follow up
Importance: low
X-Priority: 5
X-Microsoft-Antispam-Mailbox-Delivery:
abwl:0;wl:0;pcwl:0;iwl:0;dwl:1;rwl:0;ucf:0;jmr:0;ex:0;auth:1;dest:I;OFR:TrustedDomainList;ENG:(5062000282)(90000117)(90005022)(91005020)(91035115)(9000001)(9010001)(9030002)(9050020)(9100272)(5061607266)(5061608174)(4900115)(2008001094)(2008000189)(2008019284)(2008120284)(8390226)(8377080)(98390106)(58390106)(8391040)(4920090)(6350099)(4950131)(580107);
X-Message-Info:
5vMbyqxGkdeZc53eCtvw11eS5MQHGYXhk/My37Ga0AgS06AC6+grcPw17tfGq/yNqh7wqj/GOwYsy9VvO6M+T6HwZdHACF4IG1q0iCzGiMqMTYCfFE/IGDHXeQ3Au6d5A8E8HEMYfUThzx/XxDIFyK45Wv4VESCGQ215CA95j3+SojIRE8awJJyjXE3ykxJchWI2VCd1T2Q22YxBsmBwRQ==
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MTtHRD0yO1NDTD0tMQ==
X-Microsoft-Antispam-Message-Info:
=?utf-8?B?YXd6RG5KSGhHVElrWDVwdzRGMFh2SXVtZ2ZISDgrdmptR0ZxVXBuTUovVVhl?=
=?utf-8?B?Ym1FMm10WHpObmRTOEV4U2ZROWdXOWdFNXFlaktZTFlqaE8yaU5JUUwzNjE5?=
=?utf-8?B?MFZzTG54ZHNJVzAyTG9ScnhUaG9SMkFPTGtvK0pCTG5kcnk3cXNPU0E5dng2?=
=?utf-8?B?ci9tb2Jwa2YwVzAvdmkyaEh4TzBCblkvb3AvOGthOUphTHpKMzVOOU16WjVD?=
=?utf-8?B?V0t1SVhGZmsxRWE4VGwvYTF3bW5HbkFrL1VIQTVKSzBEQW1uR1drTStYYUQ2?=
=?utf-8?B?djNYVG5OcnAwOFJJeHdBd3hZR1BTeUh3NzF3T2trRC9KQUNSL3c5WlJXc0Qx?=
=?utf-8?B?TDFIRVpSZlAzTWtJUFNuQ2FFTGxaQ2twVkY1WkJpVHI0WkhjNnpsajlybTJG?=
=?utf-8?B?dDFKZjBSUTNBbklDSnc3bGdOYkhDNXdGMHlYRCs2RDJRRHZyOFB2SWY1MjJo?=
=?utf-8?B?dVhhZy9TNkpwc3YwWm04ZkdxSXVhQXZlOC9SbVROeTFhZVlydFNZVUhEWVhq?=
=?utf-8?B?U200NmpleWZtOVdPMC9NbWJFUlZPTzdoWEVqQ2ZVYWJibUg0d2luNzY0Nlhx?=
=?utf-8?B?KzkvNDRkYzFzeE85Ryt1N0dmd2ZsOXJoa0VtUVRYUndhYjZ5M3N0b2ZtNVRD?=
=?utf-8?B?YnRSeDVwcEk5Q0tUVzhGcmx3RlJ4ZUlpME9FcTRNaWxpQkNWKzcvblVPaDJZ?=
=?utf-8?B?cUZxcVlIakpldnNpekdObTlYUXIrLzZ6d3VXY0Y5blkzMnliOWpMZHlmbCtM?=
=?utf-8?B?VlNHK2NHdElmMnIyS0tsRGpZSk1vQVNkZFdGL0tvQmpaS1JpTFBHV09sN2hE?=
=?utf-8?B?OTE2bVFNMnM3YTFsdVRBVGFiZTJYYVRZTTNWK0ZtbUQ5NGVGUFF0N3hzSCtI?=
=?utf-8?B?WmY4bGxoNHRZc3pnZlhwTkt3OExmK3huWTl0M1VvY3UvYVNvRDVaNWt0S3Jj?=
=?utf-8?B?WSs4VWZrTkRDaWFwcUwxRDk5UXlrMllPdndMVmtDMHFBNzdkd1hSYjV1ei9v?=
=?utf-8?B?V3JTOVNpMFRHWVdrNVR2eDRLWU5PM0VkUUJxRmhNS081enJoUytGajhmUVZL?=
=?utf-8?B?Q0tEaXJyZDY0MlFXbWtYcWUrRzJlYXJESElPRXR2TlFFQkgyV3ZCYnRNVmNF?=
=?utf-8?B?NkJ3dHVFKzNyQVVpZzAyaVRXRFJqK0tnbmZLbjU4aHJWRnpGY2phTEpTNWIv?=
=?utf-8?B?UTRwV2dLK2xhdzRHQzZER2E0V1VjTUNIK2x5bkozN2tlN2VpRXdveWVuODdE?=
=?utf-8?B?byswMTczQ3RDMkVNbGs5empUM1lybnNGekx0bjdSTzlPZk1waU8xRHR1TkM4?=
=?utf-8?B?cXZvM3NtOGI4NlkvU1g5bnpIZUx4OXBmSEFvUyt4bnIrdkRIM1BYVWlmSDJR?=
=?utf-8?B?dER2OWlZVnhodlpGZTE1clZoSE1CRkFtbHpnRGVSWUVISGdJRE1xTFJqREh1?=
=?utf-8?B?TUdUY1FwVXVvTUoxUStoeDdoY2cxRDhMV2h6U1NjWmpTZ1REcXVGY0xjUlFk?=
=?utf-8?B?NExaOXJ3ZUltSFk2NFpkNmt4NE1sZFgyajB0eVRoZWVoM2xqSkFkNHR4SXg5?=
=?utf-8?B?eS9mT0FYV1pOK2dFM055dTQwajJpUTBWMmhvUU5pTEtNalBqeVlnSWZBeWIv?=
=?utf-8?B?Y3RtUkdsSXdOaHJRWDlHNUVYOGVkRTl6ZU92YTNnNit5ak9lWUxGTE1oOGlL?=
=?utf-8?B?MmJLUjVjM3hIMG5rWmxPWmlESTJZN2dNZk1TR1REYVZWSDA4TUdmSXV6ZlZO?=
=?utf-8?Q?6DO7TabpK21Pfwln6ewNgNb0+Eg6YJ/RYaaVtJE?=
MIME-Version: 1.0
WW91IGhhdmUgMSBpbXBvcnRhbnQgbWVzc2FnZSBhbGVydC4NCg0KV2Ugc3Ryb25nbHkgYWR2aXNl
IHlvdSBzaG91bGQgdXBkYXRlIHlvdXIgYWNjb3VudCBhbmQgcmVzb2x2ZSB0aGUgcHJvYmxlbS4N
Cg0KRG9tYWluIG5hbWU6IG15c3RvbGVuaWQuY29tDQoNCkZvbGxvdyB0aGUgcmVmZXJlbmNlIGJl
bG93IHRvIGNvbnRpbnVlOiANCmh0dHA6Ly9teS5ob3N0bW9uc3Rlci5jb20uNjA3ZjA5ODNlYjgw
ZWM2ZjFhNTcyN2MyZTU5YzQ5MTMuaGFuZHNmcmVlbmV0d29ya3MuY29tL2FjY291bnQvNTU2Njkv
dXBkYXRlcy5odG1sDQoNCkZhaWx1cmUgdG8gZG8gdGhpcyB3aWxsIGxlYWQgdG8geW91ciBhY2Nv
dW50IGJlZW4gc3VzcGVuZGVkIG9yIGRlLWFjdGl2YXRlZC4NCg0KVGhhbmtzIGZvciB5b3VyIGNv
LW9wZXJhdGlvbi4NCg0KSG9zdG1vbnN0ZXIuY29tIFN1cHBvcnQNCmh0dHBzOi8vd3d3Lmhvc3Rt
b25zdGVyLmNvbSANCkZvciBzdXBwb3J0IGdvIHRvIGh0dHBzOi8vaGVscGRlc2suaG9zdG1vbnN0
ZXIuY29tLyANClRvbGwtRnJlZTogKDgwOSkgNDMzLTU5MDE=