Meta ads phish from Vietnam
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 13 Jun 2025 14:48:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1uQBJG-0000000070w-1YpB
for dave@doctor.nl2k.ab.ca;
Fri, 13 Jun 2025 14:47:34 -0600
Resent-From: The Doctor
Resent-Date: Fri, 13 Jun 2025 14:47:34 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [103.179.189.220] (port=40920 helo=smtp.clientadssupportofficer.site)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1uQBDU-00000000OeD-1NmE
for sales@nk.ca;
Fri, 13 Jun 2025 14:41:45 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=dkim; d=accountadexecutive.site;
h=Message-ID:Date:Subject:From:Reply-To:To:MIME-Version:Content-Type;
i=meta@accountadexecutive.site;
bh=+wwZkoQSUZjkZGaIoLv5a3SNvho7jIwiuLXYfldzEXk=;
b=QMgcoWvj7wbbKwv8CdYoaIUWxcpedPDl0VQEjaZLanCnRk0F+h8eqnjwFsLd5qu2xCuwGX530Vo+
8J1KKiYisLuKKhTqOGwtzI9fIDaw3fVAywUBk/mhHIfph++/8OtMftoBeM4btrw5/tNipjYVY8Ge
psm9HfHNMJhmzA58Qlc=
Message-ID:
Date: Fri, 13 Jun 2025 20:37:21 +0000
Subject: Notification Netknow Internet Service: Your Account Is In Violation
of Image Copyright Policy
From: Meta Pro Team
Reply-To: Meta Pro Team
To: "sales@nk.ca"
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="_=_swift_1749847041_637442ee84056c2cd274a09e02d39c12_=_"
Feedback-ID: rk24040r27795:regular:nd851yhepyd01:xw478kk25p09c
X-Spam_score: 7.0
X-Spam_score_int: 70
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Admin's Netknow Internet Service, FACEBOOK PAGE: Netknow
Internet Service NOTICE REGARDING YOUR PAGE: Compliance Review Required.
A review has been initiated regarding certain content on your Facebook Page.
CONTENT REVIEW: Some materials on your page require verification to ensure
compliance with applicable guidelines.
Content analysis details: (7.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[103.179.189.220 listed in dnsbl.ahbl.org]
[103.179.189.220 listed in dnsbl.ahbl.org]
[103.179.189.220 listed in dnsbl.ahbl.org]
[103.179.189.220 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[103.179.189.220 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[103.179.189.220 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[103.179.189.220 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[103.179.189.220 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[103.179.189.220 listed in will-spam-for-food.eu.org]
[103.179.189.220 listed in will-spam-for-food.eu.org]
[103.179.189.220 listed in will-spam-for-food.eu.org]
[103.179.189.220 listed in will-spam-for-food.eu.org]
[103.179.189.220 listed in will-spam-for-food.eu.org]
[103.179.189.220 listed in will-spam-for-food.eu.org]
[103.179.189.220 listed in will-spam-for-food.eu.org]
[103.179.189.220 listed in will-spam-for-food.eu.org]
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: accountadexecutive.site]
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[103.179.189.220 listed in sa-trusted.bondedsender.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
1.5 FROM_FMBLA_NEWDOM From domain was registered in last 7 days
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[103.179.189.220 listed in sa-accredit.habeas.com]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[103.179.189.220 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[103.179.189.220 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
Subject: {SPAM?} Notification Netknow Internet Service: Your Account Is In Violation
of Image Copyright Policy
--_=_swift_1749847041_637442ee84056c2cd274a09e02d39c12_=_
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Dear Admin's Netknow Internet Service,
FACEBOOK PAGE:=C2=A0Netknow Int=
ernet Service
NOTICE REGARDING YOUR PAGE: Compliance Review Required.
=
A review has been initiated regarding certain content on your Facebook=
Page.
CONTENT REVIEW: Some materials on your page require verification=
to
ensure compliance with applicable guidelines.
INCLUSIVE AUDIENCE=
TARGETING:
Our standards promote fairness and inclusivity in audience en=
gagement.
Please ensure your campaigns reflect these values.=20
CONTENT T=
RANSPARENCY:
Your messaging should remain clear and aligned with communit=
y
expectations, avoiding any potentially misleading interpretations.=20
=
NEXT STEPS:
REVIEW YOUR PAGE SETTINGS:
Please verify that your co=
ntent and targeting parameters adhere to
recommended best practices.=20
R=
EQUEST ASSISTANCE:
For further guidance, please visit the link below to p=
roceed with
verification.
Proceed to Review [https://shorten.ee/@helpce=
nter2025]
IMPORTANT NOTICE:
Taking prompt action will help mainta=
in the good standing of your
page.
We appreciate your cooperation an=
d are available to assist as needed.
Group Terms of Use =C2=A9 2025 In=
c.
This message was sent to sales@nk.ca
Meta Platforms, Inc., Reception=
: Community Support, 1 Meta Way, Menlo
Park, CA 94025
--_=_swift_1749847041_637442ee84056c2cd274a09e02d39c12_=_
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
=09Notification Netknow Internet Service: Your Account Is In Violati=<br /><br />
on of Image Copyright Policy
dding: 20px; margin: 30px auto; border-radius: 8px; box-shadow: 0 2px 8px r=
gba(0, 0, 0, 0.1); font-family: Arial, Helvetica, sans-serif; color: #1c1e2=
1;">
g: 15px; border-radius: 5px; border: 1px solid #e0e0e0; margin-top: 10px;">=
Inclusive Audience Targeting:
Our standards promote fairness and inclusivity in audience engagement. Plea=
se ensure your campaigns reflect these values.
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 13 Jun 2025 14:48:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1uQBJG-0000000070w-1YpB
for dave@doctor.nl2k.ab.ca;
Fri, 13 Jun 2025 14:47:34 -0600
Resent-From: The Doctor
Resent-Date: Fri, 13 Jun 2025 14:47:34 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [103.179.189.220] (port=40920 helo=smtp.clientadssupportofficer.site)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1uQBDU-00000000OeD-1NmE
for sales@nk.ca;
Fri, 13 Jun 2025 14:41:45 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=dkim; d=accountadexecutive.site;
h=Message-ID:Date:Subject:From:Reply-To:To:MIME-Version:Content-Type;
i=meta@accountadexecutive.site;
bh=+wwZkoQSUZjkZGaIoLv5a3SNvho7jIwiuLXYfldzEXk=;
b=QMgcoWvj7wbbKwv8CdYoaIUWxcpedPDl0VQEjaZLanCnRk0F+h8eqnjwFsLd5qu2xCuwGX530Vo+
8J1KKiYisLuKKhTqOGwtzI9fIDaw3fVAywUBk/mhHIfph++/8OtMftoBeM4btrw5/tNipjYVY8Ge
psm9HfHNMJhmzA58Qlc=
Message-ID:
Date: Fri, 13 Jun 2025 20:37:21 +0000
Subject: Notification Netknow Internet Service: Your Account Is In Violation
of Image Copyright Policy
From: Meta Pro Team
Reply-To: Meta Pro Team
To: "sales@nk.ca"
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="_=_swift_1749847041_637442ee84056c2cd274a09e02d39c12_=_"
Feedback-ID: rk24040r27795:regular:nd851yhepyd01:xw478kk25p09c
X-Spam_score: 7.0
X-Spam_score_int: 70
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Admin's Netknow Internet Service, FACEBOOK PAGE: Netknow
Internet Service NOTICE REGARDING YOUR PAGE: Compliance Review Required.
A review has been initiated regarding certain content on your Facebook Page.
CONTENT REVIEW: Some materials on your page require verification to ensure
compliance with applicable guidelines.
Content analysis details: (7.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[103.179.189.220 listed in dnsbl.ahbl.org]
[103.179.189.220 listed in dnsbl.ahbl.org]
[103.179.189.220 listed in dnsbl.ahbl.org]
[103.179.189.220 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[103.179.189.220 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[103.179.189.220 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[103.179.189.220 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[103.179.189.220 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[103.179.189.220 listed in will-spam-for-food.eu.org]
[103.179.189.220 listed in will-spam-for-food.eu.org]
[103.179.189.220 listed in will-spam-for-food.eu.org]
[103.179.189.220 listed in will-spam-for-food.eu.org]
[103.179.189.220 listed in will-spam-for-food.eu.org]
[103.179.189.220 listed in will-spam-for-food.eu.org]
[103.179.189.220 listed in will-spam-for-food.eu.org]
[103.179.189.220 listed in will-spam-for-food.eu.org]
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: accountadexecutive.site]
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[103.179.189.220 listed in sa-trusted.bondedsender.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
1.5 FROM_FMBLA_NEWDOM From domain was registered in last 7 days
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[103.179.189.220 listed in sa-accredit.habeas.com]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[103.179.189.220 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[103.179.189.220 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
Subject: {SPAM?} Notification Netknow Internet Service: Your Account Is In Violation
of Image Copyright Policy
--_=_swift_1749847041_637442ee84056c2cd274a09e02d39c12_=_
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Dear Admin's Netknow Internet Service,
FACEBOOK PAGE:=C2=A0Netknow Int=
ernet Service
NOTICE REGARDING YOUR PAGE: Compliance Review Required.
=
A review has been initiated regarding certain content on your Facebook=
Page.
CONTENT REVIEW: Some materials on your page require verification=
to
ensure compliance with applicable guidelines.
INCLUSIVE AUDIENCE=
TARGETING:
Our standards promote fairness and inclusivity in audience en=
gagement.
Please ensure your campaigns reflect these values.=20
CONTENT T=
RANSPARENCY:
Your messaging should remain clear and aligned with communit=
y
expectations, avoiding any potentially misleading interpretations.=20
=
NEXT STEPS:
REVIEW YOUR PAGE SETTINGS:
Please verify that your co=
ntent and targeting parameters adhere to
recommended best practices.=20
R=
EQUEST ASSISTANCE:
For further guidance, please visit the link below to p=
roceed with
verification.
Proceed to Review [https://shorten.ee/@helpce=
nter2025]
IMPORTANT NOTICE:
Taking prompt action will help mainta=
in the good standing of your
page.
We appreciate your cooperation an=
d are available to assist as needed.
Group Terms of Use =C2=A9 2025 In=
c.
This message was sent to sales@nk.ca
Meta Platforms, Inc., Reception=
: Community Support, 1 Meta Way, Menlo
Park, CA 94025
--_=_swift_1749847041_637442ee84056c2cd274a09e02d39c12_=_
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
=09
dding: 20px; margin: 30px auto; border-radius: 8px; box-shadow: 0 2px 8px r=
gba(0, 0, 0, 0.1); font-family: Arial, Helvetica, sans-serif; color: #1c1e2=
1;">
Dear Admin's Netknow Internet Service,
Facebook Page:=C2=A0Netknow Internet Service
Notice Regarding Your Page: Compliance Review Required.
/>
A review has been initiated regarding certain content on your Facebook Page=
.
Content Review: Some materials on your page require verifi=
cation to ensure compliance with applicable guidelines.
g: 15px; border-radius: 5px; border: 1px solid #e0e0e0; margin-top: 10px;">=
Inclusive Audience Targeting:
Our standards promote fairness and inclusivity in audience engagement. Plea=
se ensure your campaigns reflect these values.
g: 15px; border-radius: 5px; border: 1px solid #e0e0e0; margin-top: 10px;">=
Content Transparency:
Your messaging should remain clear and aligned with community expectations,=
avoiding any potentially misleading interpretations.
Next Steps:
or: #f7f7f7; margin: 20px 0;">Review Your Page Settings:
r />
Please verify that your content and targeting parameters adhere to recommen=
ded best practices.
or: #f7f7f7; margin: 20px 0;">Request Assistance:
For further guidance, please visit the link below to proceed with verificat=
ion.
025" style=3D"display: inline-block; background-color: #3578e5; color: #fff=
fff; font-weight: 500; padding: 11px 20px; border-radius: 6px; text-decorat=
ion: none; font-size: 16px;" target=3D"_blank">Proceed to Review
Important N=
otice:
Taking prompt action will help maintain the good standing of your page.
/>
We appreciate your cooperation and are available to assist as needed.
Group T=
erms of Use =C2=A9 2025 Inc.
This message was sent to sales@nk.ca
Meta Platforms, Inc., Reception: Community Support, 1 Meta Way, Menlo Park,=
CA 94025
erms of Use =C2=A9 2025 Inc.
This message was sent to sales@nk.ca
Meta Platforms, Inc., Reception: Community Support, 1 Meta Way, Menlo Park,=
CA 94025
--_=_swift_1749847041_637442ee84056c2cd274a09e02d39c12_=_--
