Cryptocurrency phish from microsoft outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 09 Oct 2024 09:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1syZ3g-00000000FZh-45nG

for dave@doctor.nl2k.ab.ca;

Wed, 09 Oct 2024 09:57:04 -0600

Resent-From: The Doctor

Resent-Date: Wed, 9 Oct 2024 09:57:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.ramly.com.my ([219.93.101.253]:52878 helo=zimbra.ramly.com.my)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1syYe3-00000000Bj8-12lL

for doctor@nl2k.ab.ca;

Wed, 09 Oct 2024 09:30:43 -0600

Received: from localhost (localhost [127.0.0.1])

by zimbra.ramly.com.my (Postfix) with ESMTP id B31D3FFDD7B3

for ; Wed, 9 Oct 2024 23:14:24 +0800 (+08)

Received: from zimbra.ramly.com.my ([127.0.0.1])

by localhost (zimbra.ramly.com.my [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id fNN4Tx1DA97S for ;

Wed, 9 Oct 2024 23:14:24 +0800 (+08)

Received: from localhost (localhost [127.0.0.1])

by zimbra.ramly.com.my (Postfix) with ESMTP id 6BEF7FFDD7A3

for ; Wed, 9 Oct 2024 23:14:23 +0800 (+08)

X-Virus-Scanned: amavisd-new at ramly.com.my

Received: from zimbra.ramly.com.my ([127.0.0.1])

by localhost (zimbra.ramly.com.my [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id TefWzGvnbMU5 for ;

Wed, 9 Oct 2024 23:14:23 +0800 (+08)

Received: from YankyHQ (unknown [20.55.110.231])

by zimbra.ramly.com.my (Postfix) with ESMTPSA id 9C0FBFFCF01D

for ; Wed, 9 Oct 2024 23:14:21 +0800 (+08)

From: "Kathryn Dalli"

Subject: Secure: Your Ethereum DeFi Login Details

To:

Content-Type: multipart/alternative; boundary="3LmG3GUepHLOQtLYsAnizbwf=_bZsdzeoL"

MIME-Version: 1.0

Date: Wed, 9 Oct 2024 15:14:20 +0000

Message-Id: <09192024101415B28B84C6BA$084D6DBF61@ramly.com.my>

X-Spam_score: 13.6

X-Spam_score_int: 136

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Mike Morlock, As per your request, $300,000 has been successfully

invested into a DeFi Layer project through Ethereum (ETH). Below are the

details you’ll need to access your account: Username: mmorlock Password:

Password1 (Change it) Website URL: www.defixlayer.com



Content analysis details: (13.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[20.55.110.231 listed in will-spam-for-food.eu.org]

[20.55.110.231 listed in will-spam-for-food.eu.org]

[20.55.110.231 listed in will-spam-for-food.eu.org]

[20.55.110.231 listed in will-spam-for-food.eu.org]

[20.55.110.231 listed in will-spam-for-food.eu.org]

[20.55.110.231 listed in will-spam-for-food.eu.org]

[20.55.110.231 listed in will-spam-for-food.eu.org]

[20.55.110.231 listed in will-spam-for-food.eu.org]

[219.93.101.253 listed in will-spam-for-food.eu.org]

[219.93.101.253 listed in will-spam-for-food.eu.org]

[219.93.101.253 listed in will-spam-for-food.eu.org]

[219.93.101.253 listed in will-spam-for-food.eu.org]

[219.93.101.253 listed in will-spam-for-food.eu.org]

[219.93.101.253 listed in will-spam-for-food.eu.org]

[219.93.101.253 listed in will-spam-for-food.eu.org]

[219.93.101.253 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[219.93.101.253 listed in dnsbl.ahbl.org]

[219.93.101.253 listed in dnsbl.ahbl.org]

[219.93.101.253 listed in dnsbl.ahbl.org]

[219.93.101.253 listed in dnsbl.ahbl.org]

[20.55.110.231 listed in dnsbl.ahbl.org]

[20.55.110.231 listed in dnsbl.ahbl.org]

[20.55.110.231 listed in dnsbl.ahbl.org]

[20.55.110.231 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[219.93.101.253 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[219.93.101.253 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[219.93.101.253 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[219.93.101.253 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: defixlayer.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: defixlayer.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: www.defixlayer.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: defixlayer.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Secure: Your Ethereum DeFi Login Details



This is a multi-part message in MIME format



--3LmG3GUepHLOQtLYsAnizbwf=_bZsdzeoL

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable





Hi Mike Morlock,



As per your request, $300,000 has been successfully invested into a De=

Fi Layer project through Ethereum (ETH). Below are the details you=E2=80=

=99ll need to access your account:



Username: mmorlock

Password: Password1 (Change it)

Website URL: www.defixlayer.com



Please visit the provided website and connect your wallet to begin tra=

cking or withdrawing your funds as they grow in the DeFi project.



For security, delete this email after saving your login details



Best regards,

Kathryn Dalli, Esq.

Portfolio Manager

Twomey, Latham, Shea, Kelley, Dubin & Quartararo LLP

33 West Second Street, P.O. Box 9398, Riverhead, NY 11901

O: (631) 727-2108 Ext. 228



--3LmG3GUepHLOQtLYsAnizbwf=_bZsdzeoL

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable








8">


le=3D1"> <=

title>Secure: Your Ethereum DeFi Login Details



Hi Mi=

ke Morlock,

As per your request, $300,000 has been successfully =

invested into a DeFi Layer project through Ethereum (ETH). Below are t=

he details you=E2=80=99ll need to access your account:

Username:=

  mmorlock
Password:  Password1<=

/STRONG> (Change it)
Website URL:  www.defixlayer=

=2Ecom


Please visit the provided website and connec=

t your wallet to begin tracking or withdrawing your funds as they grow=

in the DeFi project.


#ff0000>For security, delete this email after saving your login detail=

s

Best regards,
Kathryn Dalli, Esq.
>Portfolio Manager
Twomey, Latham, Shea, Kelley, Dubin & Quarta=

raro LLP
33 West Second Street, P.O. Box 9398, Riverhead, NY 11901<=

BR>O: (631) 727-2108 Ext. 228







--3LmG3GUepHLOQtLYsAnizbwf=_bZsdzeoL--

Web / SEO/ App spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 09 Oct 2024 09:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1syZ3q-00000000Fa2-16p7

for dave@doctor.nl2k.ab.ca;

Wed, 09 Oct 2024 09:57:14 -0600

Resent-From: The Doctor

Resent-Date: Wed, 9 Oct 2024 09:57:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-psaapc01olkn2050.outbound.protection.outlook.com ([40.92.52.50]:4832 helo=APC01-PSA-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1syYUv-0000000092B-3ynV

for sales@nk.ca;

Wed, 09 Oct 2024 09:21:17 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=cclU7iOYr/SSj53XNXSvly4yF4ihfkqYLfQsPspLO1xTocfTi4Pt5aE2pV3j8sBIu9HYohBnLYe7dsANXDsl6++miso3U8CEfuaQn39jt9yyYZwp+AjDqNY2ILV2WYNV5K+BZ8G8d9960MDEfuvG4uzZh+h7R6W3gw4rPRauVWAzNcLjpd+7qKFBKiuvUN+renTdtiom9j6zLx9O8EJ2Pm5DkndcFtzyIxkUd7z3F73zMi3S54cvlgeYtk7+TJe6M1DkXQz8yqoYyCW/C2Wch4RMBSOhmrS6/MxC8sqjwfZUqEplJWv6btxFwPoGWHo+781AWpnNKHfZw28ozUN5xw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=x5bRbolyBdidAI537Ti77of1pJqh5WUFsKkhIlLbAHM=;

b=cLyCMzIdbgQpAOwo81Xl8YzykcMkWP9zGp+BjPITMqaYs0rvjqIWd6XA8GMfT9hF42tGXJn2/hxQ/7RHShEzIJLPkZ4kij4vWMlcfx5ZmmvN9uSAiS0DeTIEKvjOoeqAU/QpV5hCLT+b9xm9h92jVi6zoEyKOgsaGQyOYa/tnU5o/cJtTfsLev4yYTTpUgy/RP+rk5Vx6nt4xEB4vAjH8JaoBWI7e36wViLj880xbsvLIGsg6iaizUCKyIoxQP6EqlhdGVH/21ZpEBth707koglpvKTeAO2JENPr40sj/1SUmii0fMgyd7neObmdrxy7GQ4NWZAk7+wQhrN38C7vpg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=x5bRbolyBdidAI537Ti77of1pJqh5WUFsKkhIlLbAHM=;

b=O5C9WPSN3q3HA7GJ4/olQhC4AwEtSWAlYfb8X5mhbKtz4Kkf8AU241aTjyVSWe+HB2QZzCw9aMAeBiS86hoy2iUWIc+RoOMnsmO6jlc6NWZ3XXJhHPZa7EJAq34LnLVRgFGEeU6oMURexfgJyHQWzT9yK2CIR+r4cUJaKkhmhiN6bX6wC8InT2m8/v1rvr2MDv6tqcamOwPwJvVF3EOxNxNqNFuhmAXYgpl6GGGiuYlBfcnmNBhKWlmmwUYlKDUNAlvxSo/1paiZcW6uIlQabpdKICvLIWalj68IekGHKnY6kzWJiuo7HI200jmVFcjBZOSWOL9L0x9/TlvDIovh6Q==

Received: from SI2PR04MB5942.apcprd04.prod.outlook.com (2603:1096:4:1ed::5) by

TY0PR04MB5886.apcprd04.prod.outlook.com (2603:1096:400:213::6) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.8048.16; Wed, 9 Oct 2024 15:18:37 +0000

Received: from SI2PR04MB5942.apcprd04.prod.outlook.com

([fe80::b974:8fb1:2f7a:7081]) by SI2PR04MB5942.apcprd04.prod.outlook.com

([fe80::b974:8fb1:2f7a:7081%4]) with mapi id 15.20.8048.013; Wed, 9 Oct 2024

15:18:37 +0000

From: chaos curran

To: chaos curran

Subject: Re: yes / sure..

Thread-Topic: yes / sure..

Thread-Index: AQHbGl3TQFAh8OvfU0GcVGlPe2aPiw==

Date: Wed, 9 Oct 2024 15:18:37 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SI2PR04MB5942:EE_|TY0PR04MB5886:EE_

x-ms-office365-filtering-correlation-id: f4b2dda5-8f1f-4ef7-7138-08dce875a5db

x-microsoft-antispam:

BCL:0;ARA:14566002|8060799006|15080799006|15030799003|19110799003|461199028|8062599003|56899033|102099032|3412199025|440099028|1710799026;

x-microsoft-antispam-message-info:

MI25Ves+LEfN77FJ6oKmwmCPOHlo620ybhnZ/zrbQEC8G1ZvdxE9p+7Z67uhmVsCc4tPC9rqZcmQPlmX4+Dd/iOe8/Qh8r6dq4s7nBqFzv+FW9zbHc6Cw9snQaLQIiHQzLZthiKMQ6BllUS+0v4bMl941jYedB8cVM7xGJwsNjXpo7pqIuY+zqrtBWrdjpXpXIXFcHrAJojEGzUdupPY3p2otqrYcJos/d978eVRpvx9fNtD2LsKtDNU/r5YiuxRV2WWIn3KbGQTeSplf26qnR4whYmiemVOwBvzTlGY8vzL4Tou+VQ2NE7nee8WVgE2f8S13IHPTGbphupEGRBQgJBQwXG7QkG7/pFakwZiuseYUf6yEgRIcGrbmj0mzjhrBYMesnAMS2e0mXutUUvsRRsWX5xGBG5naxlaOAloXz1CpAjFxk/9gG5U0/qM8r2Gia/o4wx3rbq002YzC+ND5Ul4KPWJ7TEPbxMgz475O8eUzJJXCmWCfdcdViqJ1zb7t8bH8BDk2AyJ57sZSTW2bWiOH/ljVpxqYLGjIzN5wgawpvVrkwQsfgh1pG9D2G/Qa4o+UEpck8Usgw4fWktMisoVIjKVaqnRNi8zamyZhTkHxtujXmvnlOjsglgLw0puqxSfht2QAhfP7txirrtvd7FvHiyCSGPsbOaDkgsn4uZ8ngrJ2Zig03OQ/yb2q6Ow6MbZRJCbJ1TPwd55oomyZe9RL+Cj3PAD8DJNw9kM698O11G2lwHgVkvDXR7maejYxHlchE0XG8p3frDsNQiAIA==

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?M9nSxsFxtMoXUbyrSDf+WLI5/xu7UpcJeRu8cifAEfHGP4P77PAL+xWVAU?=

=?iso-8859-1?Q?auDO62/E1Hzy28Vr5p0WCgzxyFlW+Yf3l42Df9OvfKRukESgvYimFMm8lL?=

=?iso-8859-1?Q?o84LAGUyoqrF8u/HqOXhJ2uh3wVIYfaAdCeU6pPCzSWLvIUqog/1qAvvtX?=

=?iso-8859-1?Q?B3kqkld7ohmvYnIS2OKPBYQUb1VUxyWIrUW57269UbA3SI+ENdA/sQlFy3?=

=?iso-8859-1?Q?mi6Z3bxgSZEcwQdIbCZk7dS44eIhdVVtN2/CUlIaHIuWUmJU3+abYKGPxb?=

=?iso-8859-1?Q?eVNRo8pVbs1f4ifeANcDoOlhWshZ2dLhX9Tb2ygchSD3MWVzJNghhdVvL6?=

=?iso-8859-1?Q?/DwX045OJCbs6d5DC60L9wgcEqcoBZdCX70GJMdVUgPe7Npz3pzQcMN828?=

=?iso-8859-1?Q?UcynSluWEerjs/pb18LJXlgEtQCQldhNm6ZVXKowMpwW73DzBKBBrjn6oR?=

=?iso-8859-1?Q?yaFYt2qSGtYo4qRmCu3NE6E23RmzIMvOIo3CJ9a1S+zkSDC3c4gjJk0/Qd?=

=?iso-8859-1?Q?dEGk5niWT469TSB/GL0rYkjycOjVWpDw/cVounUemDBaFkq+Zt0yzvQq7T?=

=?iso-8859-1?Q?sf1OokN1OeP5SKoiX2DV2tlNq2d59U3tE39niznBYGwf5gyD1zVY11CnXp?=

=?iso-8859-1?Q?M1T4xA8RVueMixLNZ/DoHqzbGpb3nGi6mJDTJQ9ECH2T8euLdJPxDNHvL6?=

=?iso-8859-1?Q?AcRWIqoSm2wakn3TvXtpgZL5MijWuS0FcR9rsqlIpQ1cKLv1Sv4dx1gUFz?=

=?iso-8859-1?Q?+MCV9C/v/c+4UAtvIngbMkG74V9lWB+wO7DlZaD08I2fFbwDAx/Moc/Nv1?=

=?iso-8859-1?Q?mCH7BIM0O4e8mlg/hcndGfujqnjg71Vet+o1LTL5707rs/q19nEIScDpca?=

=?iso-8859-1?Q?nfFBWct28fpuAFYca4RbYbR5zqOjgxQ36opRVxk5lc22doFhihFgqTfds1?=

=?iso-8859-1?Q?Pr9UwsDBgkrnOXthhuCwu/yOHm+NtAULL7AcrSKvZ9vmHpRK/bMX13UTwH?=

=?iso-8859-1?Q?KuS63S8T+rPdDKnQrCvoPJiYQyrODe7yjtqMrgSpDqu964k2jPxgXalVn9?=

=?iso-8859-1?Q?fxc4UEwGe0MVyyWtIqqhVNjIESDdE+IhQ4t6Cta2JgC+gtgUn44t+1M8X9?=

=?iso-8859-1?Q?pNaPCkB7tQTWs0fWyiBNty1nHO2YrrzkFKIK0elxtm9ziG30d/Vx1ICoAD?=

=?iso-8859-1?Q?NrOiIBNXbDilZMpckcsONUtwl847nSawbh/J1fsCh0qUmxYFpUswlJ7EqO?=

=?iso-8859-1?Q?SfGnbOvcf7Uaa2HSTTWtkV1kQ5Rr3tChSmO0lJ9ig=3D?=

Content-Type: multipart/alternative;

boundary="_000_SI2PR04MB59429CA479B165CC72C4BD63B37F2SI2PR04MB5942apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SI2PR04MB5942.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: f4b2dda5-8f1f-4ef7-7138-08dce875a5db

X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Oct 2024 15:18:37.1077

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY0PR04MB5886



--_000_SI2PR04MB59429CA479B165CC72C4BD63B37F2SI2PR04MB5942apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hey there!



I am still waiting for your reply



May I send you report of those Errors?



You're welcome!



From: chaos curran



Sent: August 8, 2024 5:51 PM

Subject: Re: price & screenshot..$@



Hey,



I was browsing through your website and noticed a few errors along the way.



Just wanted to check if you're aware of them and if you'd like me to send o=

ver some screenshots for reference it might help you fix the issues quicker=

.



I would like to send you a audit report showing you 3 or 4 things that can =

help you improve your Google rankings dramatically.



Looking forward to hearing from you.



Best Regards,







--_000_SI2PR04MB59429CA479B165CC72C4BD63B37F2SI2PR04MB5942apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=

alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hey there!



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

I am still waiting for your reply



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=

alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

May I send you report of those Errors?



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=

alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

You're welcome!



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

From: chaos curran



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Sent: August 8, 2024 5:51 PM



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Subject: Re: price & screenshot..$@



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Hey,



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

I was browsing through your website and noticed a few errors along the way.=




Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

 



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Just wanted to check if you're aware of them and if you'd like me to sen=

d over some screenshots for reference it might help you fix the is=

sues quicker.



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

 



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

I would like to send you a audit report showing you 3 or 4 things that can =

help you improve your Google rankings dramatically.



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Looking forward to hearing from you.



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Best Regards,



FontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0,=

0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">












--_000_SI2PR04MB59429CA479B165CC72C4BD63B37F2SI2PR04MB5942apcp_--

docusign phish from cogentco/mundo-r

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 09 Oct 2024 09:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1syZ3M-00000000FYR-16Hp

for dave@doctor.nl2k.ab.ca;

Wed, 09 Oct 2024 09:56:44 -0600

Resent-From: The Doctor

Resent-Date: Wed, 9 Oct 2024 09:56:44 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [77.26.7.22] (port=61390 helo=22.7.26.77.dynamic.reverse-mundo-r.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

(envelope-from )

id 1syYBe-0000000088x-2Dy4

for sales@nk.ca;

Wed, 09 Oct 2024 09:01:20 -0600

From: "Docusign Via Docusign"

To: sales@nk.ca

Subject: Review Document : Kindly Sign : filename PaymentInstruction-EFT - 9/10/2024 17:03:01 Contact - sales@nk.ca

Date: 9 Oct 2024 17:03:01 +0200

Message-ID: <20241009170301.61E6584EEA538867@notification.intuit.com>

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0012_625EEA0D.F6B1417F"

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your document has been completed. VIEW COMPLETED DOCUMENTS

sales@nk.ca All parties have completed documents on ( 9/10/2024 17:03:01

) that requires your signature.



Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[77.26.7.22 listed in will-spam-for-food.eu.org]

[77.26.7.22 listed in will-spam-for-food.eu.org]

[77.26.7.22 listed in will-spam-for-food.eu.org]

[77.26.7.22 listed in will-spam-for-food.eu.org]

[77.26.7.22 listed in will-spam-for-food.eu.org]

[77.26.7.22 listed in will-spam-for-food.eu.org]

[77.26.7.22 listed in will-spam-for-food.eu.org]

[77.26.7.22 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[77.26.7.22 listed in dnsbl.ahbl.org]

[77.26.7.22 listed in dnsbl.ahbl.org]

[77.26.7.22 listed in dnsbl.ahbl.org]

[77.26.7.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[77.26.7.22 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[77.26.7.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[77.26.7.22 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[77.26.7.22 listed in dnsbl.ahbl.org]

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=quickbooks%40notification.intuit.com;ip=77.26.7.22;r=doctor.nl2k.ab.ca]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or

Generic rPTR

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

3.9 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr

2)

1.0 FROM_MISSP_SPF_FAIL No description available.

Subject: {SPAM?} Review Document : Kindly Sign : filename PaymentInstruction-EFT - 9/10/2024 17:03:01 Contact - sales@nk.ca





------=_NextPart_000_0012_625EEA0D.F6B1417F

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable












form-origin: left top; color: rgb(36, 36, 36); text-transform: none; letter=

-spacing: normal; font-family: Helvetica, Arial, "Sans Serif", serif, Emoji=

Font; font-size: 15px; font-style: normal; font-weight: 400; word-spacing: =

0px; white-space: normal; orphans: 2; widows: 2; font-stretch: inherit; tra=

nsform: scale(0.884259); font-feature-settings: inherit; background-color: =

rgb(234, 234, 234); font-variant-ligatures: normal;=20

font-variant-caps: normal; font-variant-numeric: inherit; font-variant-east=

-asian: inherit; font-variant-alternates: inherit; font-variant-position: i=

nherit; font-optical-sizing: inherit; font-kerning: inherit; font-variation=

-settings: inherit; -webkit-text-stroke-width: 0px; text-decoration-thickne=

ss: initial; text-decoration-style: initial; text-decoration-color: initial=

;' border=3D"0" cellspacing=3D"0" cellpadding=3D"0" min-scale=3D"0.88425925=

92592593">










or: rgb(255, 255, 255);">






>






: rgb(255, 255, 255); background-color: rgb(13, 66, 108);" border=3D"0" cel=

lspacing=3D"0" cellpadding=3D"0">













=






width: 580px; text-align: center; color: rgb(255, 255, 255); font-family: H=

elvetica, Arial, "Sans Serif"; font-size: 16px; white-space: normal !import=

ant; background-color: rgb(13, 66, 108);'>


0px currentColor; border-image: none; width: 75px; height: 75px; vertical-=

align: baseline;" alt=3D"" src=3D"cid:docComplete-white.png" data-imagetype=

=3D"External">


cellpadding=3D"0">






t-align: center; color: rgb(255, 255, 255); padding-top: 24px; font-family:=

Helvetica, Arial, "Sans Serif"; font-size: 16px; white-space: normal !impo=

rtant;'>Your document has been completed.



cellpadding=3D"0">






able>

tant;">


mage: none; vertical-align: baseline;">








solid rgb(255, 255, 255); border-image: none; height: 44px; text-align: ce=

nter; color: rgb(255, 255, 255); font-family: Helvetica, Arial, "Sans Serif=

"; font-size: 14px; font-weight: bold; text-decoration: none; display: bloc=

k; white-space: normal !important; background-color: rgb(13, 66, 108);'>


r-image: none; text-align: center; color: rgb(255, 255, 255); font-family: =

Helvetica, Arial, "Sans Serif"; font-size: 14px; font-weight: bold; text-de=

coration: none; vertical-align: baseline; display: inline-block; cursor: po=

inter; font-stretch: inherit; font-feature-settings: inherit; background-co=

lor: rgb(13, 66, 108); font-optical-sizing: inherit; font-kerning: inherit;=

font-variation-settings: inherit;'=20

href=3D"https://www.bing.com/ck/a?!&&p=3D4ed30224ac809bc0JmltdHM9MTcyMzQyMD=

gwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0M=

Q&ptn=3D3&ver=3D2&hsh=3D3&fclid=3D364f65e8-e56c-619d-1257-713ee42a6012&u=3D=

a1aHR0cDovL3d3dy40NDQzMTcuY29tLw#aHR0cHM6Ly9HTi5yZXNjaW5kcS5jb20vd3F0eVpBRl=

p6RjNoWGdzb2dib0tnLw=3D=3D" target=3D"_blank" rel=3D"noopener noreferrer" d=

ata-linkindex=3D"0" data-auth=3D"NotApplicable">


image: none; line-height: 44px; font-family: inherit; vertical-align: basel=

ine; font-stretch: inherit; font-feature-settings: inherit; font-optical-si=

zing: inherit; font-kerning: inherit; font-variation-settings: inherit;">


MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5=

zaWQ9NTE0MQ&ptn=3D3&ver=3D2&hsh=3D3&fclid=3D364f65e8-e56c-619d-1257-713ee42=

a6012&u=3Da1aHR0cDovL3d3dy40NDQzMTcuY29tLw#aHR0cHM6Ly9HTi5yZXNjaW5kcS5jb20v=

d3F0eVpBRlp6RjNoWGdzb2dib0tnLw=3D=3D">
!&&p=3D4ed30224ac809bc0JmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYx=

OWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MQ&ptn=3D3&ver=3D2&hsh=3D3&fclid=3D=

364f65e8-e56c-619d-1257-713ee42a6012&u=3Da1aHR0cDovL3d3dy40NDQzMTcuY29tLw#a=

HR0cHM6Ly9HTi5yZXNjaW5kcS5jb20vd3F0eVpBRlp6RjNoWGdzb2dib0tnLw=3D=3D">VIEW C=

OMPLETED DOCUMENTS

etica, Arial, "Sans Serif"; font-size: 16px; white-space: normal !important=

; background-color: white;'>


0">








mage: none; color: rgb(51, 51, 51); line-height: 18px; font-family: Helveti=

ca, Arial, "Sans Serif", serif, EmojiFont; font-size: 15px; font-weight: bo=

ld; vertical-align: baseline; font-stretch: inherit; font-feature-settings:=

inherit; font-optical-sizing: inherit; font-kerning: inherit; font-variati=

on-settings: inherit;'>sales@nk.ca



ca, Arial, "Sans Serif"; font-size: 15px;'>All parties have completed docum=

ents on (  9/10/2024 17:03:01  ) that requires your signatur=

e.


: Helvetica, Arial, "Sans Serif"; font-size: 11px; white-space: normal !imp=

ortant; background-color: rgb(255, 255, 255);'>










ca, Arial, "Sans Serif"; font-size: 11px; vertical-align: top; white-space:=

normal !important;'>


or; border-image: none; color: rgb(102, 102, 102); font-family: Helvetica, =

Arial, "Sans Serif", serif, EmojiFont; font-size: 11px; vertical-align: bas=

eline; font-stretch: inherit; font-feature-settings: inherit; font-optical-=

sizing: inherit; font-kerning: inherit; font-variation-settings: inherit;'>=

Powered by 
argin: 0px; padding: 0px; border: currentColor; border-image: none; vertica=

l-align: baseline;" alt=3D"DocuSign" src=3D"cid:c3e45dffbc8719ee4c718c1d606=

d2948.png" data-imagetype=3D"External">

round-color: rgb(234, 234, 234);">


etica, Arial, "Sans Serif"; font-size: 13px; margin-bottom: 1em;'>
=3D"heading" aria-level=3D"3">Do Not Share This Email

"true">This email contains a secure link to 
=3D"marko31iqkukx" style=3D"margin: 0px; padding: 0px; border: 0px currentC=

olor; border-image: none; vertical-align: baseline;" data-ogsb=3D"" data-og=

sc=3D"" data-ogab=3D"" data-ogac=3D"" data-markjs=3D"true">DocuSign

=2E Please do not share this email, link, or access code with others.


td>


------=_NextPart_000_0012_625EEA0D.F6B1417F

Content-Type: image/png; name="docComplete-white.png"

Content-Transfer-Encoding: base64

Content-ID:

Content-Disposition: inline; filename="docComplete-white.png"



iVBORw0KGgoAAAANSUhEUgAAAJYAAACWCAYAAAA8AXHiAAAAGXRFWHRTb2Z0d2FyZQBBZG9i

ZSBJbWFnZVJlYWR5ccllPAAACQRJREFUeNrsnY+RmzoQxs3NFUAHoQPTwfEqCCU4HVCCO6AE

0oGTCnypwL4K7KsAd+AHeSKj6AkQIMSu9O2Mhhuf/0irH98uQkjRLlB7Pp9Jc2hL2pS4KXtx

jMVrU+zalIcoH+LYvnaPougeon+jgCBqYXkTxw4mF9ZB9kscryHAFnkKUgtN1pSv4pgQq2IL

1ntTfrbHBrQHwKINUy5gymcoStvZn+K194k/n4njFyW8mtoPAdkPXyCLPADqMAGmqygfUlh6

rAh6F3b30t9GkDX1+r6Duc+ZmlI2pX4O2028LxcdvbmqirqUom5DVov3Jejx9Tsma8p5pEMu

TSk4dIg4QQpR5yFr25yBAPdA3bjAZADZDYBtD1Tlo6NFuysAZt+x6QBQbe5xpJAzOcrJjgO5

ZOujFMSYObIMHagZgJUh+sXUeXmP44IFaiJg7Ws5SPrbWSecidaU/RS8zwZUCrnDslw0TPUa

OONahxRAZrI/i54TNBzFF+M1F0i4s5Ti4v3ovRifqaFSztWr9nbcq71Z3HM2IZdaJ/fSRYWD

bw2tekbNEfrWDY1av/sMFUKf29DoD1zijLngMphEX+iGdS7sIsYAVMints27+MIFqADXWpW/

sJdc/5P6//URt0QdUPGBq+ICVQ2oyMNVk4ZLM/iJnIpvznWgUrkMUHkHV751pRJylYLN6cdc

Iw4JpQSwYObQ6snDalHXZEVfFCQuvDTzqSpA5QSw1KFPyq2lk9WwAlOoVg9TPVEod9Up6mUq

q2S9B6qYcH0zzQS+asXfSzX9G7to6IlrXtWnVEzqLvu9Xvm31Hzr5DoEnrhDxQiszGWdNQKS

r/VD8SYS6SCnYtKG2DFYbvpbcxVY+AAVF7BEW5zWWRMSS9s/kKrP/fl09QewBn9TfW4x5fHl

BIYUANYGoqK5F1j6BBXAmpUGZbbVinzCPmfwE2BNTuTPttXq6BtUAMv4t4/WVIuTWi25TTOn

Y20YM7DsqBYntVp67w9gOVQtLmpl44YyQqEj1RIT+Mirla1ZCgBrkWolSy4vY1+hAlizVGve

8JMid5XPUAGsxf6vTT90sD4YRhgqgGXlwu5g8iF5usTNd6jWntvkI1iiLjfj6VOa+Fl4DhWr

ufrEwCqM83BNGEw8h6p+MlqfkxhYiXE4VMLgJQCo0rkdG+IAqaY+l9FwSDUMUnpGD2DNCIea

+ewJQbCCXmSEIFjJ6Lx4JeTc4EyANePqsBp7QwlnAizDOpW9gmQkaXAmfKGvU38KpflnDGcC

LMM6xTpRehH/ly+7r1EUPXYwmIEJVq7SS6kM1psMFtwFm2gyM299ivUBP8Em2oeqWK8i2Yp9

VCzqeVkTRiIPFavNuZJITIs5U22sDMfUuvkG1hJfOD6J/3lVwqBXSbtHisDBHlLkS198DYOw

bcNhC9ZeeuEO/8BmmszOXlWsT/gHNtM+VcXCtiQw2xbvKD840V1t4JYOfV+oD1i84OSCrWEA

C7aKvfoeOijXz+dxNigWDIoFReCrWJiHBVsFLIxpwZBjwQAWDGDBYAALtvvv8T2KYMnzaDJ0

EzuoDs3hZrT42boms3Ntx7EeHjvd65F3AVP3WHu7REL7nd8JNO3xooD1BRrASqnUtRKqDZVL

ZuehLq98JuhATJvR+GLEDhvUTd4X4KgqVgot8MKqDZbATFXFyohPIINiTVcsp+uratZvyHQr

zWQAi2ZORXXxXs3y3En3j5rqXs8AS9txU61cuX6Furx5N0Aqj2XtkaKQgqrNXU4Lv2bt9Thk

Zq5y5Y/UVkuGYv3Zj7leqFYHB/W8aDf0wsJrgMpi4p7L//RyqcgnceMOVY8oJX9yrCiK7ru/

H5F+Q3azaU7VDlQviRrfHN7akVm5C5b+ahCW40b4m1Pn0eW4yW8gAKjIQWW0gQD5LU82rEMM

qEbHr/ov+ohu0rT1BtuVuJyOAdXgMMNp6I3ktpXbEiwl77QOF3OoJm0rRy4cbgVWz3Z21uDi

DNWkMNgTDm8hgjWyR+JiuLhDpbkaPJl8gNRm467BMtx4czZcnkCVzaqP0vAqFLAm7uY6GS4f

oNL4qZ7ywZLKvUNXYM3cItgYLo+gimdPydFk/EefwVq47/QoXL5AJdpyXDRyoEyOr7dSLUdg

XRZ2ei9cnkEVK205z/mSjIJqOQIrXgMun6DqUats7hdtrloOcyyrcHkI1XK1oqRajq8KbcGV

+QSVVbWiolpKY1ImcD09g8qeWg2oVum4UfWkEV7+cJGCqmf4KbP1xWfXyjEwFHBycTdgI7go

QpUqdTzz+HKzMbX66b+Rg8qJqGjksHB81tSAyjlUxeppkCaBc5rIC+WqPASMKlTu+lszL/60

C8RWyrmOhNt7cvpIoOYHC8BFc7EOiyHw5Mq5qkSmgMsbqNLNUh5NSLw8CT2WTxyuilm7cteV

KLk4jBBcFfE2VVsOhg85tgBcbKEqyEShnsHLHHCxg0pNberNH/3rqVQKuNhApRt8zqhU7gC4

tHBxhOpAPfGrQ7pS1MBVMahrzeJE0MB1CRSugtEJwOOqXlPh4OAi3j+Jro+45hrB5VyMcio+

Jz7gAlRbwJWjm533Re4FVCMJfXAj9Bv7v+A2trYUrgpJ/eoRo/IWKqmhh55n8JB3rZNPXbjM

VrXRYN2DnDVCo/XQp/NxFuI4SvdYF0LjstB36okKSUhOKDVOgHrZU6mn8HEcokPyHoeckXsZ

51LnnhM0D905fRIe7hk3X/GRUkxQr1qsdBLDR7+BOg74CYPPM87EYAEbAQrKbiF3CAowA6CQ

i850bDYAWDd6n3na7qEFd8/ej0sRAewmLrkTxm1MRBtuAIoeYN2AIAvIJJjGnvIBUA47pDRY

eeYm3pdTyMlEzpSLOt1G6l6L97FU4cgDyA7N4WtTTC61r6J8dH9HUfRYC6LmkIqyl/4esx9N

+elwT2eAZdCR+QTIOnsIyO5N+RSvvQ+8V6d8XZj60pREADRFIX/D1B7XAh1g2YMsE5BlorMp

2V3A28L07gtM3oOly8mkUPQ2Q1GWWKeIv6Twe/fd50GANQCbHLb24hgb5kJq7vYQ5UMOryFA

pLN/BRgANtnnxKyU/cUAAAAASUVORK5CYII=



------=_NextPart_000_0012_625EEA0D.F6B1417F

Content-Type: image/png; name="c3e45dffbc8719ee4c718c1d606d2948.png"

Content-Transfer-Encoding: base64

Content-ID:

Content-Disposition: inline; filename="c3e45dffbc8719ee4c718c1d606d2948.png"



iVBORw0KGgoAAAANSUhEUgAAAKwAAAAyCAYAAADBXTDrAAAACXBIWXMAAAsTAAALEwEAmpwY

AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAcuSURBVHgB7ZyBOS07EIBz3/cKuB3Q

ASpABagAFaACVIAKUAEqoANUgApQwb79937jy4uZJBucPXs3//flefdsNieZzE4mM9nzq2lx

lcpI+MdVKiOiKmxlVFSFrYyKqrCVUVEVtjIqqsJWRkVV2MqoqApbGRX/ugKOj4971f/9+7db

Wlpya2trrqJzd3fnbm5u3MPDg3t+fu6KsLy87BYXF93m5qbb2Njo5Gm14d8H3GPVHyVNAdxW

UlqhN0dHR83T01NT+cPt7W3TPsi9ZHh6eqq2tbOz86k+7f9NzFRhfaFfXV01U4eHt1SGKGfI

FBR2EB+WZWtra8udnZ25qXJxceFahXWlcP/BwYGbGoNuuvb39zu/a4pY+wB8zvPzc9e6Te7+

/t61FtK1llP1Q1vXYHryawpwyhJlLT2vr69NOwGdG+AM94A6UwJZ9ZEh4PdrMvRdA+RIPb/8

bbL9cYX12d7eVu/Fl5sSmu/aWtbkfZqit5a3mRJFYa1S8LteXl4+LWMsbXt7e2b45e3trQv3

EPbB/+Xf1CXUs7q62i2jfeD+6+tr9/j4+Kk9wkZW+E1bfq260mcf2qeEoSfICT3xXdr3Sf/D

cBgQEtPa5p7Ly8uPMJrU9ccfjpd2qKONTa7Jff5c8TmlNVj/uwd94D5KdsizKcAVWliwlkMr

akAIByviElGHdvBZ35/bntYfrZ4FbpAzVpLWd1ct5VeX79woAf2IyYB26Ev4OeE30OZQ7mGl

iMlVQpqtwWhaH73rC+3x/znMfNNlWQmeSB+ezPX19W5jxv/H4ElmY7KysmLW7dseUYy+CZJc

sLJa/+g/Vu8n2d3d7aITMRlg+Rh/X7iHlcsCuTIH/G11r7OsWGP+stpl0RTgvmBhQbMwobVq

l5CoFbQK92mWKvbkx4o/rlSffWIWVrNeLrC29JfVoI9cUxb2K3Ffl7CwqVXLL4wNGTC+VmF7

JZMGUVhtMv3Ng7VkHh4efigjA6QdTVDcn/o+mQCWfvrOX20X7ivldymsNcaUsjDBsYmNKSz3

ae0yhpOTk64ehTYs5YsprD9PtMFYY0ZC5hFXoI8rNIjCWgOWsIx2zfJx+FwTsD+xmiKi/Bpa

mlTG9p0Km/L3UsqrySOmsNaqpikLstNkmlJY30f150erm7vnCBkkcaD5cIBfpWW/8E9lBxrC

5/ilIeILym41/H4ry9QqstnWd4Lf1lp111o3Ux4W+H34u318bC3CQVJCiyDQH02mKWgvHIs1

P1qkJIfBUrMa4oSHEPKKEYZLgI0DaO1pSimwIWz+rDwfhczTT8FkktXiO/qerOKhy1XaMAwl

J8AsUjIPibXHSb3vYq7OwzJZsfieBYIKJ1oeirA9qT9vsIpgcdslurNUWN4cBUZpU9ZKu56S

gcSlc5nVEcZBFFYLYaCUpQF1q54WSId5VFgfrDyW11dgFNqixGUZ6xnZQRRWW6bnXYmGBAWW

AzGaommrSIocHzIVrx6CmSssgtKCy9ZJ+lyhafU0V6FPmz8BykXw3C8E83NgPJqlTY1HkwP9

iN2Xuj4UM1dYa5OAFdH8JoSW46OFwhW/V/N/U1kVJotVwC99eX9/N6+FbbNBzFWO0pUoPG9h

RWSEeT2rPDOFRUAcOJbduw9WQyZCO8iS8tG066KoHI4J0frgE1pA6yHTHhTBSlFaVj9XQbTl

P7UpBS2SokUZYvM0FzQFOCUQLGnEsJBBImhtZU/CYLOV9rMyPFaQW+oTGNeuW4FrLX0pmTMt

AaG9X8Vn2lglcWC9w5UKplupVTmok0rNWt+LfLhGWjuWYo0lDuSaRiqJ0odB3unShO1jZWX8

CY0dDA/fdyL1qH039cjEoNxMgpUuFeXXFELaoS+U2AuFMkmx1CZKQz+kPQr/jh2AF1IKax0C

zy2TV1gGooEyxgSbuqZZ4z5vpvqlDaB/tBFTtJziTxKp4a+0JcVP0eYcL0Q2OQeLtP7Ng8IO

EtbC5+J9JSu2iI+npfkEaxNGfes+Ypo5vp4Pfh+HywXraKRGqh7+YyzjlkJSu33HhGyQPWEy

rY98FpubwWkKcAWWQPykPodksLQ5lig8yRWDeqllUdqz+mS5BlLk9JPLsCpYvFR7TrFm2ipS

8pq3/x6YLz/tENI8WNhf/Mf1pG+YR14NKQWLKq9dSJhLUrbkqa23Sn+yPf+XWkBCcuTg+Rt7

RSbWJ0JuEgOVCERu37TYqbwi0zfjR1+IkPiQfSNlnHpFRhubdgCpSCeayiTQrK/1CzKg+bnW

nmOWFFnYyvjQLCZgsfHVxdphOYkJh6uo+L5Dn0GoCjshUNjSH97AFSg5I/vd1J/bnBAlUQUg

mjEPygpVYScEy7mEtHI2PIS4CBN+5TfAvpvqEkwY3AN8Vn7cRKILKPLCwkKnrPN45LMqbGVU

VJegMiqqwlZGRVXYyqioClsZFVVhK6OiKmxlVFSFrYyK/wBRt4SRI+1o2gAAAABJRU5ErkJg

gg==



------=_NextPart_000_0012_625EEA0D.F6B1417F--

docusign phish from cogentco

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 09 Oct 2024 09:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1syZ37-00000000FXy-2MUV

for dave@doctor.nl2k.ab.ca;

Wed, 09 Oct 2024 09:56:29 -0600

Resent-From: The Doctor

Resent-Date: Wed, 9 Oct 2024 09:56:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [77.26.7.22] (port=49469 helo=22.7.26.77.dynamic.reverse-mundo-r.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

(envelope-from )

id 1syY7e-000000007t0-2eps

for root@nk.ca;

Wed, 09 Oct 2024 08:57:14 -0600

From: "Docusign Via Docusign"

To: root@nk.ca

Subject: Review Document : Kindly sign : fllename Paymentinstruction-EFT - 9/10/2024 16:58:52 Contact - root@nk.ca

Date: 9 Oct 2024 16:58:53 +0200

Message-ID: <20241009165852.AED79DD72DDFC09A@notification.intuit.com>

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0012_0C733B8B.6088641E"

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your document has been completed. VIEW COMPLETED DOCUMENTS

root@nk.ca All parties have completed documents on ( 9/10/2024 16:58:52 )

that requires your signature.



Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[77.26.7.22 listed in will-spam-for-food.eu.org]

[77.26.7.22 listed in will-spam-for-food.eu.org]

[77.26.7.22 listed in will-spam-for-food.eu.org]

[77.26.7.22 listed in will-spam-for-food.eu.org]

[77.26.7.22 listed in will-spam-for-food.eu.org]

[77.26.7.22 listed in will-spam-for-food.eu.org]

[77.26.7.22 listed in will-spam-for-food.eu.org]

[77.26.7.22 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[77.26.7.22 listed in dnsbl.ahbl.org]

[77.26.7.22 listed in dnsbl.ahbl.org]

[77.26.7.22 listed in dnsbl.ahbl.org]

[77.26.7.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[77.26.7.22 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[77.26.7.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[77.26.7.22 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[77.26.7.22 listed in dnsbl.ahbl.org]

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=quickbooks%40notification.intuit.com;ip=77.26.7.22;r=doctor.nl2k.ab.ca]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or

Generic rPTR

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 FROM_MISSP_SPF_FAIL No description available.

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

3.9 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr

2)

Subject: {SPAM?} Review Document : Kindly sign : fllename Paymentinstruction-EFT - 9/10/2024 16:58:52 Contact - root@nk.ca





------=_NextPart_000_0012_0C733B8B.6088641E

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable












form-origin: left top; color: rgb(36, 36, 36); text-transform: none; letter=

-spacing: normal; font-family: Helvetica, Arial, "Sans Serif", serif, Emoji=

Font; font-size: 15px; font-style: normal; font-weight: 400; word-spacing: =

0px; white-space: normal; orphans: 2; widows: 2; font-stretch: inherit; tra=

nsform: scale(0.884259); font-feature-settings: inherit; background-color: =

rgb(234, 234, 234); font-variant-ligatures: normal;=20

font-variant-caps: normal; font-variant-numeric: inherit; font-variant-east=

-asian: inherit; font-variant-alternates: inherit; font-variant-position: i=

nherit; font-optical-sizing: inherit; font-kerning: inherit; font-variation=

-settings: inherit; -webkit-text-stroke-width: 0px; text-decoration-thickne=

ss: initial; text-decoration-style: initial; text-decoration-color: initial=

;' border=3D"0" cellspacing=3D"0" cellpadding=3D"0" min-scale=3D"0.88425925=

92592593">










or: rgb(255, 255, 255);">






>






: rgb(255, 255, 255); background-color: rgb(13, 66, 108);" border=3D"0" cel=

lspacing=3D"0" cellpadding=3D"0">













=






width: 580px; text-align: center; color: rgb(255, 255, 255); font-family: H=

elvetica, Arial, "Sans Serif"; font-size: 16px; white-space: normal !import=

ant; background-color: rgb(13, 66, 108);'>


0px currentColor; border-image: none; width: 75px; height: 75px; vertical-=

align: baseline;" alt=3D"" src=3D"cid:docComplete-white.png" data-imagetype=

=3D"External">


cellpadding=3D"0">






t-align: center; color: rgb(255, 255, 255); padding-top: 24px; font-family:=

Helvetica, Arial, "Sans Serif"; font-size: 16px; white-space: normal !impo=

rtant;'>Your document has been completed.



cellpadding=3D"0">






able>

tant;">


mage: none; vertical-align: baseline;">








solid rgb(255, 255, 255); border-image: none; height: 44px; text-align: ce=

nter; color: rgb(255, 255, 255); font-family: Helvetica, Arial, "Sans Serif=

"; font-size: 14px; font-weight: bold; text-decoration: none; display: bloc=

k; white-space: normal !important; background-color: rgb(13, 66, 108);'>


r-image: none; text-align: center; color: rgb(255, 255, 255); font-family: =

Helvetica, Arial, "Sans Serif"; font-size: 14px; font-weight: bold; text-de=

coration: none; vertical-align: baseline; display: inline-block; cursor: po=

inter; font-stretch: inherit; font-feature-settings: inherit; background-co=

lor: rgb(13, 66, 108); font-optical-sizing: inherit; font-kerning: inherit;=

font-variation-settings: inherit;'=20

href=3D"https://www.bing.com/ck/a?!&&p=3D4ed30224ac809bc0JmltdHM9MTcyMzQyMD=

gwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0M=

Q&ptn=3D3&ver=3D2&hsh=3D3&fclid=3D364f65e8-e56c-619d-1257-713ee42a6012&u=3D=

a1aHR0cDovL3d3dy40NDQzMTcuY29tLw#aHR0cHM6Ly9HTi5yZXNjaW5kcS5jb20vd3F0eVpBRl=

p6RjNoWGdzb2dib0tnLw=3D=3D" target=3D"_blank" rel=3D"noopener noreferrer" d=

ata-linkindex=3D"0" data-auth=3D"NotApplicable">


image: none; line-height: 44px; font-family: inherit; vertical-align: basel=

ine; font-stretch: inherit; font-feature-settings: inherit; font-optical-si=

zing: inherit; font-kerning: inherit; font-variation-settings: inherit;">


MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5=

zaWQ9NTE0MQ&ptn=3D3&ver=3D2&hsh=3D3&fclid=3D364f65e8-e56c-619d-1257-713ee42=

a6012&u=3Da1aHR0cDovL3d3dy40NDQzMTcuY29tLw#aHR0cHM6Ly9HTi5yZXNjaW5kcS5jb20v=

d3F0eVpBRlp6RjNoWGdzb2dib0tnLw=3D=3D">
!&&p=3D4ed30224ac809bc0JmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYx=

OWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MQ&ptn=3D3&ver=3D2&hsh=3D3&fclid=3D=

364f65e8-e56c-619d-1257-713ee42a6012&u=3Da1aHR0cDovL3d3dy40NDQzMTcuY29tLw#a=

HR0cHM6Ly9HTi5yZXNjaW5kcS5jb20vd3F0eVpBRlp6RjNoWGdzb2dib0tnLw=3D=3D">VIEW C=

OMPLETED DOCUMENTS

etica, Arial, "Sans Serif"; font-size: 16px; white-space: normal !important=

; background-color: white;'>


0">








mage: none; color: rgb(51, 51, 51); line-height: 18px; font-family: Helveti=

ca, Arial, "Sans Serif", serif, EmojiFont; font-size: 15px; font-weight: bo=

ld; vertical-align: baseline; font-stretch: inherit; font-feature-settings:=

inherit; font-optical-sizing: inherit; font-kerning: inherit; font-variati=

on-settings: inherit;'>root@nk.ca



ca, Arial, "Sans Serif"; font-size: 15px;'>All parties have completed docum=

ents on (  9/10/2024 16:58:52  ) that requires your signatur=

e.


: Helvetica, Arial, "Sans Serif"; font-size: 11px; white-space: normal !imp=

ortant; background-color: rgb(255, 255, 255);'>










ca, Arial, "Sans Serif"; font-size: 11px; vertical-align: top; white-space:=

normal !important;'>


or; border-image: none; color: rgb(102, 102, 102); font-family: Helvetica, =

Arial, "Sans Serif", serif, EmojiFont; font-size: 11px; vertical-align: bas=

eline; font-stretch: inherit; font-feature-settings: inherit; font-optical-=

sizing: inherit; font-kerning: inherit; font-variation-settings: inherit;'>=

Powered by 
argin: 0px; padding: 0px; border: currentColor; border-image: none; vertica=

l-align: baseline;" alt=3D"DocuSign" src=3D"cid:c3e45dffbc8719ee4c718c1d606=

d2948.png" data-imagetype=3D"External">

round-color: rgb(234, 234, 234);">


etica, Arial, "Sans Serif"; font-size: 13px; margin-bottom: 1em;'>
=3D"heading" aria-level=3D"3">Do Not Share This Email

"true">This email contains a secure link to 
=3D"marko31iqkukx" style=3D"margin: 0px; padding: 0px; border: 0px currentC=

olor; border-image: none; vertical-align: baseline;" data-ogsb=3D"" data-og=

sc=3D"" data-ogab=3D"" data-ogac=3D"" data-markjs=3D"true">DocuSign

=2E Please do not share this email, link, or access code with others.


td>


------=_NextPart_000_0012_0C733B8B.6088641E

Content-Type: image/png; name="docComplete-white.png"

Content-Transfer-Encoding: base64

Content-ID:

Content-Disposition: inline; filename="docComplete-white.png"



iVBORw0KGgoAAAANSUhEUgAAAJYAAACWCAYAAAA8AXHiAAAAGXRFWHRTb2Z0d2FyZQBBZG9i

ZSBJbWFnZVJlYWR5ccllPAAACQRJREFUeNrsnY+RmzoQxs3NFUAHoQPTwfEqCCU4HVCCO6AE

0oGTCnypwL4K7KsAd+AHeSKj6AkQIMSu9O2Mhhuf/0irH98uQkjRLlB7Pp9Jc2hL2pS4KXtx

jMVrU+zalIcoH+LYvnaPougeon+jgCBqYXkTxw4mF9ZB9kscryHAFnkKUgtN1pSv4pgQq2IL

1ntTfrbHBrQHwKINUy5gymcoStvZn+K194k/n4njFyW8mtoPAdkPXyCLPADqMAGmqygfUlh6

rAh6F3b30t9GkDX1+r6Duc+ZmlI2pX4O2028LxcdvbmqirqUom5DVov3Jejx9Tsma8p5pEMu

TSk4dIg4QQpR5yFr25yBAPdA3bjAZADZDYBtD1Tlo6NFuysAZt+x6QBQbe5xpJAzOcrJjgO5

ZOujFMSYObIMHagZgJUh+sXUeXmP44IFaiJg7Ws5SPrbWSecidaU/RS8zwZUCrnDslw0TPUa

OONahxRAZrI/i54TNBzFF+M1F0i4s5Ti4v3ovRifqaFSztWr9nbcq71Z3HM2IZdaJ/fSRYWD

bw2tekbNEfrWDY1av/sMFUKf29DoD1zijLngMphEX+iGdS7sIsYAVMints27+MIFqADXWpW/

sJdc/5P6//URt0QdUPGBq+ICVQ2oyMNVk4ZLM/iJnIpvznWgUrkMUHkHV751pRJylYLN6cdc

Iw4JpQSwYObQ6snDalHXZEVfFCQuvDTzqSpA5QSw1KFPyq2lk9WwAlOoVg9TPVEod9Up6mUq

q2S9B6qYcH0zzQS+asXfSzX9G7to6IlrXtWnVEzqLvu9Xvm31Hzr5DoEnrhDxQiszGWdNQKS

r/VD8SYS6SCnYtKG2DFYbvpbcxVY+AAVF7BEW5zWWRMSS9s/kKrP/fl09QewBn9TfW4x5fHl

BIYUANYGoqK5F1j6BBXAmpUGZbbVinzCPmfwE2BNTuTPttXq6BtUAMv4t4/WVIuTWi25TTOn

Y20YM7DsqBYntVp67w9gOVQtLmpl44YyQqEj1RIT+Mirla1ZCgBrkWolSy4vY1+hAlizVGve

8JMid5XPUAGsxf6vTT90sD4YRhgqgGXlwu5g8iF5usTNd6jWntvkI1iiLjfj6VOa+Fl4DhWr

ufrEwCqM83BNGEw8h6p+MlqfkxhYiXE4VMLgJQCo0rkdG+IAqaY+l9FwSDUMUnpGD2DNCIea

+ewJQbCCXmSEIFjJ6Lx4JeTc4EyANePqsBp7QwlnAizDOpW9gmQkaXAmfKGvU38KpflnDGcC

LMM6xTpRehH/ly+7r1EUPXYwmIEJVq7SS6kM1psMFtwFm2gyM299ivUBP8Em2oeqWK8i2Yp9

VCzqeVkTRiIPFavNuZJITIs5U22sDMfUuvkG1hJfOD6J/3lVwqBXSbtHisDBHlLkS198DYOw

bcNhC9ZeeuEO/8BmmszOXlWsT/gHNtM+VcXCtiQw2xbvKD840V1t4JYOfV+oD1i84OSCrWEA

C7aKvfoeOijXz+dxNigWDIoFReCrWJiHBVsFLIxpwZBjwQAWDGDBYAALtvvv8T2KYMnzaDJ0

EzuoDs3hZrT42boms3Ntx7EeHjvd65F3AVP3WHu7REL7nd8JNO3xooD1BRrASqnUtRKqDZVL

ZuehLq98JuhATJvR+GLEDhvUTd4X4KgqVgot8MKqDZbATFXFyohPIINiTVcsp+uratZvyHQr

zWQAi2ZORXXxXs3y3En3j5rqXs8AS9txU61cuX6Furx5N0Aqj2XtkaKQgqrNXU4Lv2bt9Thk

Zq5y5Y/UVkuGYv3Zj7leqFYHB/W8aDf0wsJrgMpi4p7L//RyqcgnceMOVY8oJX9yrCiK7ru/

H5F+Q3azaU7VDlQviRrfHN7akVm5C5b+ahCW40b4m1Pn0eW4yW8gAKjIQWW0gQD5LU82rEMM

qEbHr/ov+ohu0rT1BtuVuJyOAdXgMMNp6I3ktpXbEiwl77QOF3OoJm0rRy4cbgVWz3Z21uDi

DNWkMNgTDm8hgjWyR+JiuLhDpbkaPJl8gNRm467BMtx4czZcnkCVzaqP0vAqFLAm7uY6GS4f

oNL4qZ7ywZLKvUNXYM3cItgYLo+gimdPydFk/EefwVq47/QoXL5AJdpyXDRyoEyOr7dSLUdg

XRZ2ei9cnkEVK205z/mSjIJqOQIrXgMun6DqUats7hdtrloOcyyrcHkI1XK1oqRajq8KbcGV

+QSVVbWiolpKY1ImcD09g8qeWg2oVum4UfWkEV7+cJGCqmf4KbP1xWfXyjEwFHBycTdgI7go

QpUqdTzz+HKzMbX66b+Rg8qJqGjksHB81tSAyjlUxeppkCaBc5rIC+WqPASMKlTu+lszL/60

C8RWyrmOhNt7cvpIoOYHC8BFc7EOiyHw5Mq5qkSmgMsbqNLNUh5NSLw8CT2WTxyuilm7cteV

KLk4jBBcFfE2VVsOhg85tgBcbKEqyEShnsHLHHCxg0pNberNH/3rqVQKuNhApRt8zqhU7gC4

tHBxhOpAPfGrQ7pS1MBVMahrzeJE0MB1CRSugtEJwOOqXlPh4OAi3j+Jro+45hrB5VyMcio+

Jz7gAlRbwJWjm533Re4FVCMJfXAj9Bv7v+A2trYUrgpJ/eoRo/IWKqmhh55n8JB3rZNPXbjM

VrXRYN2DnDVCo/XQp/NxFuI4SvdYF0LjstB36okKSUhOKDVOgHrZU6mn8HEcokPyHoeckXsZ

51LnnhM0D905fRIe7hk3X/GRUkxQr1qsdBLDR7+BOg74CYPPM87EYAEbAQrKbiF3CAowA6CQ

i850bDYAWDd6n3na7qEFd8/ej0sRAewmLrkTxm1MRBtuAIoeYN2AIAvIJJjGnvIBUA47pDRY

eeYm3pdTyMlEzpSLOt1G6l6L97FU4cgDyA7N4WtTTC61r6J8dH9HUfRYC6LmkIqyl/4esx9N

+elwT2eAZdCR+QTIOnsIyO5N+RSvvQ+8V6d8XZj60pREADRFIX/D1B7XAh1g2YMsE5BlorMp

2V3A28L07gtM3oOly8mkUPQ2Q1GWWKeIv6Twe/fd50GANQCbHLb24hgb5kJq7vYQ5UMOryFA

pLN/BRgANtnnxKyU/cUAAAAASUVORK5CYII=



------=_NextPart_000_0012_0C733B8B.6088641E

Content-Type: image/png; name="c3e45dffbc8719ee4c718c1d606d2948.png"

Content-Transfer-Encoding: base64

Content-ID:

Content-Disposition: inline; filename="c3e45dffbc8719ee4c718c1d606d2948.png"



iVBORw0KGgoAAAANSUhEUgAAAKwAAAAyCAYAAADBXTDrAAAACXBIWXMAAAsTAAALEwEAmpwY

AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAcuSURBVHgB7ZyBOS07EIBz3/cKuB3Q

ASpABagAFaACVIAKUAEqoANUgApQwb79937jy4uZJBucPXs3//flefdsNieZzE4mM9nzq2lx

lcpI+MdVKiOiKmxlVFSFrYyKqrCVUVEVtjIqqsJWRkVV2MqoqApbGRX/ugKOj4971f/9+7db

Wlpya2trrqJzd3fnbm5u3MPDg3t+fu6KsLy87BYXF93m5qbb2Njo5Gm14d8H3GPVHyVNAdxW

UlqhN0dHR83T01NT+cPt7W3TPsi9ZHh6eqq2tbOz86k+7f9NzFRhfaFfXV01U4eHt1SGKGfI

FBR2EB+WZWtra8udnZ25qXJxceFahXWlcP/BwYGbGoNuuvb39zu/a4pY+wB8zvPzc9e6Te7+

/t61FtK1llP1Q1vXYHryawpwyhJlLT2vr69NOwGdG+AM94A6UwJZ9ZEh4PdrMvRdA+RIPb/8

bbL9cYX12d7eVu/Fl5sSmu/aWtbkfZqit5a3mRJFYa1S8LteXl4+LWMsbXt7e2b45e3trQv3

EPbB/+Xf1CXUs7q62i2jfeD+6+tr9/j4+Kk9wkZW+E1bfq260mcf2qeEoSfICT3xXdr3Sf/D

cBgQEtPa5p7Ly8uPMJrU9ccfjpd2qKONTa7Jff5c8TmlNVj/uwd94D5KdsizKcAVWliwlkMr

akAIByviElGHdvBZ35/bntYfrZ4FbpAzVpLWd1ct5VeX79woAf2IyYB26Ev4OeE30OZQ7mGl

iMlVQpqtwWhaH73rC+3x/znMfNNlWQmeSB+ezPX19W5jxv/H4ElmY7KysmLW7dseUYy+CZJc

sLJa/+g/Vu8n2d3d7aITMRlg+Rh/X7iHlcsCuTIH/G11r7OsWGP+stpl0RTgvmBhQbMwobVq

l5CoFbQK92mWKvbkx4o/rlSffWIWVrNeLrC29JfVoI9cUxb2K3Ffl7CwqVXLL4wNGTC+VmF7

JZMGUVhtMv3Ng7VkHh4efigjA6QdTVDcn/o+mQCWfvrOX20X7ivldymsNcaUsjDBsYmNKSz3

ae0yhpOTk64ehTYs5YsprD9PtMFYY0ZC5hFXoI8rNIjCWgOWsIx2zfJx+FwTsD+xmiKi/Bpa

mlTG9p0Km/L3UsqrySOmsNaqpikLstNkmlJY30f150erm7vnCBkkcaD5cIBfpWW/8E9lBxrC

5/ilIeILym41/H4ry9QqstnWd4Lf1lp111o3Ux4W+H34u318bC3CQVJCiyDQH02mKWgvHIs1

P1qkJIfBUrMa4oSHEPKKEYZLgI0DaO1pSimwIWz+rDwfhczTT8FkktXiO/qerOKhy1XaMAwl

J8AsUjIPibXHSb3vYq7OwzJZsfieBYIKJ1oeirA9qT9vsIpgcdslurNUWN4cBUZpU9ZKu56S

gcSlc5nVEcZBFFYLYaCUpQF1q54WSId5VFgfrDyW11dgFNqixGUZ6xnZQRRWW6bnXYmGBAWW

AzGaommrSIocHzIVrx6CmSssgtKCy9ZJ+lyhafU0V6FPmz8BykXw3C8E83NgPJqlTY1HkwP9

iN2Xuj4UM1dYa5OAFdH8JoSW46OFwhW/V/N/U1kVJotVwC99eX9/N6+FbbNBzFWO0pUoPG9h

RWSEeT2rPDOFRUAcOJbduw9WQyZCO8iS8tG066KoHI4J0frgE1pA6yHTHhTBSlFaVj9XQbTl

P7UpBS2SokUZYvM0FzQFOCUQLGnEsJBBImhtZU/CYLOV9rMyPFaQW+oTGNeuW4FrLX0pmTMt

AaG9X8Vn2lglcWC9w5UKplupVTmok0rNWt+LfLhGWjuWYo0lDuSaRiqJ0odB3unShO1jZWX8

CY0dDA/fdyL1qH039cjEoNxMgpUuFeXXFELaoS+U2AuFMkmx1CZKQz+kPQr/jh2AF1IKax0C

zy2TV1gGooEyxgSbuqZZ4z5vpvqlDaB/tBFTtJziTxKp4a+0JcVP0eYcL0Q2OQeLtP7Ng8IO

EtbC5+J9JSu2iI+npfkEaxNGfes+Ypo5vp4Pfh+HywXraKRGqh7+YyzjlkJSu33HhGyQPWEy

rY98FpubwWkKcAWWQPykPodksLQ5lig8yRWDeqllUdqz+mS5BlLk9JPLsCpYvFR7TrFm2ipS

8pq3/x6YLz/tENI8WNhf/Mf1pG+YR14NKQWLKq9dSJhLUrbkqa23Sn+yPf+XWkBCcuTg+Rt7

RSbWJ0JuEgOVCERu37TYqbwi0zfjR1+IkPiQfSNlnHpFRhubdgCpSCeayiTQrK/1CzKg+bnW

nmOWFFnYyvjQLCZgsfHVxdphOYkJh6uo+L5Dn0GoCjshUNjSH97AFSg5I/vd1J/bnBAlUQUg

mjEPygpVYScEy7mEtHI2PIS4CBN+5TfAvpvqEkwY3AN8Vn7cRKILKPLCwkKnrPN45LMqbGVU

VJegMiqqwlZGRVXYyqioClsZFVVhK6OiKmxlVFSFrYyK/wBRt4SRI+1o2gAAAABJRU5ErkJg

gg==



------=_NextPart_000_0012_0C733B8B.6088641E--

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 08 Oct 2024 12:27:01 -0600

Received: from mail-ej1-f68.google.com ([209.85.218.68]:59898)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1syEtO-00000000H1F-1FCM

for dave@doctor.nl2k.ab.ca;

Tue, 08 Oct 2024 12:26:22 -0600

Received: by mail-ej1-f68.google.com with SMTP id a640c23a62f3a-a9960371b62so225232566b.3

for ; Tue, 08 Oct 2024 11:23:11 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1728411785; x=1729016585; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=x9RElXgXFP3Y5kjIgR6CqP8wrj3FOFk8cQWJbpcziy0=;

b=PmxWtHWUl1IJ1bfjUYZ0iiyyZM10kNYf8pIBY6CJKceWFtaUBsB12In3/f4B8BDfMs

QOCkWcvWoMkG3e5q3aqIPvEPoTaew3HmAuQzSFOUbRfDnIFyvyAkM6S5v/0W/GkbGNpA

mnkyYu03o2A7kHUgAA/biexzKkcdGRw7AfS4SY/bzzw29vEhdhEDbJP0cttyl/2kjAHb

+xTBv+8E8ldWRbD+ehGrJd1dDibuQLQg77Fujqmd+lUSrwEjzf/s8wAftY5zSRu5pB1l

HNI9Vx2kch+cwk2U6Guge/V7KjHhQKEzFpBRv8LJSmwZFaKqRBi7r8wRSnWulyYAHUdi

E1qg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1728411785; x=1729016585;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=x9RElXgXFP3Y5kjIgR6CqP8wrj3FOFk8cQWJbpcziy0=;

b=FNQwD+LGL2xMf2TUHShWpoLoX3jjk8W6+sG9T4KwhLqTsDcv1e7kuKjHzWyzPyNpMF

RD3BNLDrtzCRA7heHAKSSkwZ0uXjOQHS1w5Y+IMpoPvY3uj1zyA3YqEZ/qSyCSZZRjtu

JSA6lw52i5EN3FGfV+IWu17UjISC4r4+CNp919yoTHqHA8EIWrLwjv7p4QWk2A8Cxz9O

thuPPyU/xhyMH+OUngAIdBCEi0TfDCKo9HEC5rRxXLE1w5S3BUBFt5jfS3wnsxIOUXg+

17/XqsaK3McfBIEI0B9KWG4uePIjR+O8WZXf9TxuyX68k+bjP5vxsTIxmdCuEmmOFEta

8suA==

X-Forwarded-Encrypted: i=1; AJvYcCUsFYmC1W0FdRg45MyVUDWi3ZSNqeKMExqn3qz1DQLaMgbzR1w3XUfoIb3tjeUyEF4iutkd@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YzO9maZegdeGgdMxe6Ea0loY6ONkjkXVgehYYPGsB1gXDv3I0eG

K5sD5/okzk3OXax4WHg0bqqnViBNt8HpMSAltVVSaohN1FpMmrdAfECjoEpimNDj8w/mjKf51+S

I5iD798pBlujJOEu/YR3eMOS9pQ==

X-Google-Smtp-Source: AGHT+IE18mQ97p7O8G6xptuNKe47m3dge0V5KyQsj9Ybptj69Dqu0CemIrfC3t5SIu5NIkSmHVBZcoh9V+aJ8tdl8D0=

X-Received: by 2002:a05:600c:1daa:b0:42f:8515:e482 with SMTP id

5b1f17b1804b1-42f85ab59b8mr131229635e9.9.1728411129644; Tue, 08 Oct 2024

11:12:09 -0700 (PDT)

MIME-Version: 1.0

From: Aisha Gaddafi

Date: Tue, 8 Oct 2024 11:11:56 -0700

Message-ID:

Subject: dearest beloved friend,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000688f7f0623fb1383"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 19.6

X-Spam_score_int: 196

X-Spam_bar: +++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: dearest beloved friend, Please forgive me for stressing you

with my predicaments and I am sorry to approach you through this media. It

is because it serves as the fastest means of communication. I came across

your email from my personal search and I decided to contact you. Mrs. Aisha

Al-Gaddafi is my name, the only biological daughter of the Former late Libyan

president, Col. Muammar Gaddafi. [...]



Content analysis details: (19.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.68 listed in wl.mailspike.net]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.218.68 listed in will-spam-for-food.eu.org]

[209.85.218.68 listed in will-spam-for-food.eu.org]

[209.85.218.68 listed in will-spam-for-food.eu.org]

[209.85.218.68 listed in will-spam-for-food.eu.org]

[209.85.218.68 listed in will-spam-for-food.eu.org]

[209.85.218.68 listed in will-spam-for-food.eu.org]

[209.85.218.68 listed in will-spam-for-food.eu.org]

[209.85.218.68 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.218.68 listed in dnsbl.ahbl.org]

[209.85.218.68 listed in dnsbl.ahbl.org]

[209.85.218.68 listed in dnsbl.ahbl.org]

[209.85.218.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.218.68 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.218.68 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.218.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.218.68 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.68 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[nancylee7153(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[nancylee7153(at)gmail.com]

0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

2.5 MILLION_USD BODY: Talks about millions of dollars

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLY From and body contain different freemails

0.0 T_MONEY_PERCENT X% of a lot of money for you

2.5 BODY_EMAIL_419_FRAUD_GM Email address in body is likely advance fee

fraud collector mailbox

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

1.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

Subject: {SPAM?} dearest beloved friend,



--000000000000688f7f0623fb1383

Content-Type: text/plain; charset="UTF-8"



dearest beloved friend,



Please forgive me for stressing you with my predicaments and I am sorry to

approach you through this media. It is because it serves as the fastest

means of communication.



I came across your email from my personal search and I decided to contact

you. Mrs. Aisha Al-Gaddafi is my name, the only biological daughter of the

Former late Libyan president, Col. Muammar Gaddafi. I am a single mother

and a widow. I have investment funds worth the sum of Twenty-seven million

Two hundred thousand United States Dollars ($27,200,000.00 million USD) for

investment. I am interested in you for investment project assistance in

your country because of my current refugee status here in Oman. I shall

compensate you with 30% of the total sum after the funds have been

successfully transferred into your account. I am also willing to negotiate

an investment/business profit sharing ratio with you based on the future

investment earning profits.



If you are interested, reply to me urgently for more details on my private

email address below (aishagaddafilibya5@gmail.com).



Best Regards,

Yours Truly,

Aisha Gaddafi.



--000000000000688f7f0623fb1383

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



dearest beloved friend,

Please forgive me for stres=

sing you with my predicaments and I am sorry to approach you through this m=

edia. It is because it serves as the fastest means of communication.

>I came across your email from my personal search and I decided to contact =

you. Mrs. Aisha Al-Gaddafi is my name, the only biological daughter of the =

Former late Libyan president, Col. Muammar Gaddafi. I am a single mother an=

d a widow. I have investment funds worth the sum of Twenty-seven million Tw=

o hundred thousand United States Dollars ($27,200,000.00 million USD) for i=

nvestment. I am interested in you for investment project assistance in your=

country because of my current refugee status here in Oman. I shall compens=

ate you with 30% of the total sum after the funds have been successfully tr=

ansferred into your account. I am also willing to negotiate an investment/b=

usiness profit sharing ratio with you based on the future investment earnin=

g profits.

If you are interested, reply to me urgently for more deta=

ils on my private email address below (
@gmail.com">aishagaddafilibya5@gmail.com).

Best Regards,
Your=

s Truly,
Aisha Gaddafi.




--000000000000688f7f0623fb1383--

Compensation spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 08 Oct 2024 12:10:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1syEdq-00000000GbT-2jFy

for dave@doctor.nl2k.ab.ca;

Tue, 08 Oct 2024 12:09:02 -0600

Resent-From: The Doctor

Resent-Date: Tue, 8 Oct 2024 12:09:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oi1-f176.google.com ([209.85.167.176]:60772)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1syC1a-00000000Aej-1Si0

for root@doctor.nl2k.ab.ca;

Tue, 08 Oct 2024 09:21:26 -0600

Received: by mail-oi1-f176.google.com with SMTP id 5614622812f47-3e3a47ae905so3175555b6e.1

for ; Tue, 08 Oct 2024 08:19:29 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=unpad-ac-id.20230601.gappssmtp.com; s=20230601; t=1728400763; x=1729005563; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=d3/Vi59kbcqHAgRN8ADKChDk/457D0kHOHd6Xv3C38k=;

b=RmL+k/eiJcmofZukgujL+Ju9wbg3sXG5tjrfAa2tj0LiuO4rVb2GjZddbUHPtrIPL4

xwAXVwkX4cTEcux/LsD/V26vNtwanYK4d306uGThtVWUdMSW0xcWlYESpNHAZuroAs3Q

XHrOirDbyzI26OkFbf43RRfMt14sVDho3pXia8CgtHgNfwOddcHgy1qzTG3DG2A5qhBB

HF4gWrUtJpRnpVNxSsKhE0N0m2a/lmkJKu2+lIKvRsOtnPok/Xww171NLkrVDW7mVWEj

saIk5ZSeqS1DBpTf89Co2mbplca1SypxbuuJvEnXw9RArLr5qQ2f0+nfFRtwONThvnVH

+EmA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1728400763; x=1729005563;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=d3/Vi59kbcqHAgRN8ADKChDk/457D0kHOHd6Xv3C38k=;

b=klh2Oe+GPjNgVHj1SaHQUsMaaWdVWYQOJXq55EKgoHEznvQzJGgetl7YuaD+pnGE6X

5A9wKPItrDfAYff6ct78ZxGAi4d3B0lIpsxk1xbruyxDqfhFnr5wcG8klpHeuDOFaDFD

uvhoRMXEei0TCgOikTqN7MOQHo5OXSEoOgR2WjJ6jYQViI8PsbN230/FTVHz38dKx6QM

riqCqNFtBCcZV4YPDU3BSu37uSLI8ojkh00LpvKiwqK2gaK4I4FLeiAbmV94DUNS0Ro0

Xpw4zcCX7lqPjc0uqT0VZOHpnbk5fIyfA7nhk5jAGmdoiPKlJPumqiqJT/bJHZ40/yEz

LG2w==

X-Forwarded-Encrypted: i=1; AJvYcCU6MeZDWzC/AQmh8EJYvG6OH3cBcoXnoa711rqMC0Jz8fFpXbD3Kr1t9pxezl5m0wyvk/qs@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Yy5PSWba67hmLpiadWG0qc4Wsy7mKm67HLV7GLZqxtQvM+qHgMx

1QUPNo+oEzlaIS5lMDTxvdr1yfvUTDNR3p8JanFCRL1eBiPmEjq7DzVcG236bYRNRcg/PfEOrQU

G6oWzi4O9z0qi6or3ALMixCA2QWQGBbqidb+sEIyzNWbEclRrdqA3pOZxnP+qzQ==

X-Google-Smtp-Source: AGHT+IHTT8ufoNV82y5Bd7nVnYqFCY32pJ/O3npRRtcpyIFfYbDTBtmJQf7vwp68zFitGCkC6usVHcn73/1Q2tpIOrs=

X-Received: by 2002:a05:6808:2002:b0:3da:ab89:a805 with SMTP id

5614622812f47-3e3c1326afamr10607534b6e.16.1728396297180; Tue, 08 Oct 2024

07:04:57 -0700 (PDT)

MIME-Version: 1.0

Reply-To: donaldfrank133@gmail.com

From: "mr. david edeard"

Date: Tue, 8 Oct 2024 14:04:45 +0000

Message-ID:

Subject:

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000532fa10623f79fb8"

Bcc: root@doctor.nl2k.ab.ca

X-Spam_score: 9.1

X-Spam_score_int: 91

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Good morning, have you received the compensation money I sent

to you through my Secretary Good morning, have you received the compensation

money I sent to you through my Secretary



Content analysis details: (9.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.176 listed in will-spam-for-food.eu.org]

[209.85.167.176 listed in will-spam-for-food.eu.org]

[209.85.167.176 listed in will-spam-for-food.eu.org]

[209.85.167.176 listed in will-spam-for-food.eu.org]

[209.85.167.176 listed in will-spam-for-food.eu.org]

[209.85.167.176 listed in will-spam-for-food.eu.org]

[209.85.167.176 listed in will-spam-for-food.eu.org]

[209.85.167.176 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.176 listed in dnsbl.ahbl.org]

[209.85.167.176 listed in dnsbl.ahbl.org]

[209.85.167.176 listed in dnsbl.ahbl.org]

[209.85.167.176 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.176 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.176 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.176 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.176 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.176 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.176 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[donaldfrank133(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HK_NAME_MR_MRS No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?}



--000000000000532fa10623f79fb8

Content-Type: text/plain; charset="UTF-8"



Good morning, have you received the compensation money I sent to you

through my Secretary



--000000000000532fa10623f79fb8

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Good morning, have you received the compensation money I s=

ent to you through my Secretary=C2=A0




--000000000000532fa10623f79fb8--

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 08 Oct 2024 12:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1syEe2-00000000Gbh-11RS

for dave@doctor.nl2k.ab.ca;

Tue, 08 Oct 2024 12:09:14 -0600

Resent-From: The Doctor

Resent-Date: Tue, 8 Oct 2024 12:09:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-io1-f43.google.com ([209.85.166.43]:48172)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1syCIi-00000000BNh-0Kjg

for root@nl2k.ab.ca;

Tue, 08 Oct 2024 09:39:09 -0600

Received: by mail-io1-f43.google.com with SMTP id ca18e2360f4ac-82ce603d8daso212994939f.0

for ; Tue, 08 Oct 2024 08:37:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1728401823; x=1729006623; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=04Mk9QZq7WK9CpwwgUOptYa6v9VVQnk+nOVMrKQfyD8=;

b=iGi9FPEA9mP2kOfZuESMxtGj+PZv+P4oi7LXvIG512jEHyggj6O/3bXqv154/XAf12

DRdsWqdBYhmyHbdVBjWKQOtWdQdGfZHFEdagoQWQKYJc0Mgi22L0GLO3CZgWRqqCpuBV

m3VKUAlQMnkQRj9khAVr2iDct1YBEsQGheivJ2U5qi2xH1u+c3neMr77q2FdvmD7ovzt

qiN01jSydTGJ0W4ZiXAtVCAOPc+FrJIPLFj0DQr2ZxFVSQ2WUc94fBNwuCR0SjHH7q0X

OXrp3vBTy3GkBiNR0s+z/74VYd2Y1df7A1QxjXQYhUzngV4mM1uu1Sy7ZfF8OcHO/qe2

xjtw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1728401823; x=1729006623;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=04Mk9QZq7WK9CpwwgUOptYa6v9VVQnk+nOVMrKQfyD8=;

b=C14aAQuO1JfBlsINvDr+51onYLp64qAoJveyzZGZvCD199r2X4Gf/p6Dp/Nd95g8eh

3X4Ky/xuwchXKkudGxy9PW8iD9hal1KTbitIGxTE1anf7ejZGv92+vIpCoVa75jmYR2g

ORtp/K1NZTIrNU3y2q0eS+b20j2eUsVWyrVbA41CjXBA92YvxAlbyekToqIp2jND4/It

CZgCtVkxkZTZ/GycH7gvxioMzhiU8Q69bNP/iLsyhEp4CPT6R7Z+0UNuac+yJMMm63F8

GynAo22M/lFqVYVHQURXw3R7oqNpFujZcn8LidzjW9aU3o4S55zZx5OagYedwzfJcTj9

1c3Q==

X-Forwarded-Encrypted: i=1; AJvYcCV0sIE9EWV/CM77c80WkUatPIEvrLc9poJ+fzlINsXbwTExiysXi2VMURLSA5Z0JxoP8Pn4@nl2k.ab.ca

X-Gm-Message-State: AOJu0Yw3VttyQBRvhNEC+f831tL5LWzdohNBs0yJvw0P+QfXzn6YsCa9

KKtYenff+wWKmwYTavU5R19F83R/O19/cYnqdKzOYi7tBKvYpE4Ewp5lYvidSwEHW7ACKVW81r6

nY9brGNjAvyiC/G5I5wq3/VN7iXk=

X-Google-Smtp-Source: AGHT+IF1o7rJ6pmpCOd54+Y4zxzdEmH3iN6Gl+iqF7MLJUsWTKR85ZJ7VCY+4mrWIj3pM7o01OKecU/tgmaLL2yd6CE=

X-Received: by 2002:a05:6e02:1fc8:b0:3a0:aa15:3497 with SMTP id

e9e14a558f8ab-3a375976e55mr150239215ab.1.1728401822251; Tue, 08 Oct 2024

08:37:02 -0700 (PDT)

MIME-Version: 1.0

Reply-To: mariarodrigues33yt@gmail.com

From: "Mrs.Maria Rodrigues"

Date: Tue, 8 Oct 2024 15:36:49 +0000

Message-ID:

Subject:

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000a50af30623f8e866"

Bcc: root@nl2k.ab.ca

X-Spam_score: 20.2

X-Spam_score_int: 202

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings beloved, I know this message might meet you in utmost

surprise. However, it's just my urgent need for a foreign partner. I would

like to know if this proposal will be worthwhile for your acceptance. I need

you [...]



Content analysis details: (20.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.166.43 listed in will-spam-for-food.eu.org]

[209.85.166.43 listed in will-spam-for-food.eu.org]

[209.85.166.43 listed in will-spam-for-food.eu.org]

[209.85.166.43 listed in will-spam-for-food.eu.org]

[209.85.166.43 listed in will-spam-for-food.eu.org]

[209.85.166.43 listed in will-spam-for-food.eu.org]

[209.85.166.43 listed in will-spam-for-food.eu.org]

[209.85.166.43 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.166.43 listed in dnsbl.ahbl.org]

[209.85.166.43 listed in dnsbl.ahbl.org]

[209.85.166.43 listed in dnsbl.ahbl.org]

[209.85.166.43 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.166.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.166.43 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.166.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.166.43 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.166.43 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.166.43 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[loglokokou(at)gmail.com]

0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

2.5 MILLION_USD BODY: Talks about millions of dollars

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 LOTS_OF_MONEY Huge... sums of money

1.5 HK_NAME_FM_MR_MRS No description available.

0.6 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.5 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

1.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 XFER_LOTSA_MONEY Transfer a lot of money

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?}



--000000000000a50af30623f8e866

Content-Type: text/plain; charset="UTF-8"



Greetings beloved,



I know this message might meet you in utmost surprise. However, it's just

my urgent need for a foreign partner. I would like to know if this proposal

will be worthwhile for your acceptance. I need your honest assistance to

actualize my humanitarian project. Sadly, I am critically down with

terminal sickness and on the verge of death. I want you to utilize my

inheritance funds, Three million one hundred and Fifty thousand united

states dollars ($3,150,000.00) for a charity purpose in your country as

soon as you receive these funds. It will be my greatest joy to conclude

this project with you before I die. Further details shall be provided to

you upon your response to my proposal.



Your positive response shall be appreciated. Contact my private email

address below for more details on (mariarodrigues33yt@gmail.com).



Your sister,



Mrs. Maria Rodrigues



--000000000000a50af30623f8e866

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings beloved,

I know this message might meet y=

ou in utmost surprise. However, it's just my urgent need for a foreign =

partner. I would like to know if this proposal will be worthwhile for your =

acceptance. I need your honest assistance to actualize my humanitarian proj=

ect. Sadly, I am critically down with terminal sickness and on the verge of=

death. I want you to utilize my inheritance funds, Three million one hundr=

ed and Fifty thousand united states dollars ($3,150,000.00) for a charity p=

urpose in your country as soon as you receive these funds. It will be my gr=

eatest joy to conclude this project with you before I die. Further details =

shall be provided to you upon your response to my proposal.

Your pos=

itive response shall be appreciated. Contact my private email address below=

for more details on (maria=

rodrigues33yt@gmail.com).

=C2=A0Your sister,

Mrs. Maria R=

odrigues




--000000000000a50af30623f8e866--

Business proposition spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 08 Oct 2024 09:22:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1syC1G-00000000AiP-0EEv

for dave@doctor.nl2k.ab.ca;

Tue, 08 Oct 2024 09:21:02 -0600

Resent-From: The Doctor

Resent-Date: Tue, 8 Oct 2024 09:21:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f50.google.com ([209.85.219.50]:58582)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1syBkk-00000000A4c-1gc4

for root@nk.ca;

Tue, 08 Oct 2024 09:04:02 -0600

Received: by mail-qv1-f50.google.com with SMTP id 6a1803df08f44-6c5acb785f2so32295486d6.0

for ; Tue, 08 Oct 2024 08:02:03 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1728399717; x=1729004517; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=9mtj9rGPZc8LARMxXSi3MRMqrIT/idqgLsg5S96qfYU=;

b=AswltL9z0dkPZnVRcsRO21oQU0coKFtYGsDj8GD3Se2XEJIxJjUjBsZQqDdaSj8mtE

AjbagLEbPxMM6LJEXDx1bxSPcW021vMa0JpCxi9X1RoI1BGOhZBYjNrE9WQ+tu7Yg9lX

Ix980ykZhDMssqI3K1GaP9+43u+rfDVD6ZMjXMbrlSbs/b5qE6SYOi1IEZq7bLykdiyA

9yz4pfw7SwdOZwVrp7uEnuiBzqacP1vUpRFvNGZh3YWUyD7bh+Kyhh/rMl6N406jgtWX

u+tn6Pw2n6NCQefN/0uYGd1vURMFE9+AU7h+iQrmi577USgXPezX+GkNkWgf3NpqgEcM

kAwg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1728399717; x=1729004517;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=9mtj9rGPZc8LARMxXSi3MRMqrIT/idqgLsg5S96qfYU=;

b=jmVMaKHj35eNVLlkGNzxNo74wjaSQH1l05w1lfGkA5EN08uVwyEG1vHPDP3Geyp0ZH

5DZY2Bm+mJyDtQ4bR7DKT4b02/6eywmPSJSfAWtRf3TAnSFLG9XHuNFMRVIVbx93xg8S

GbH229Wcowh2eMkzJ9zdM2CZT4XQEMLNQRNJXpMRHUfhjS6hygMltniCxru183AOgS+c

K9+x4H5MooRyznA23+Ji5Va5MDaL5gQt+eKeJBdpCR8hHNpr6Ujij57USMTBCbGHyUS6

vkERa7Tth8peswubfYYbnOn0udWmubRleMenEYs9zNseQ+L2P0acMdfpGN9KBDQPloMR

lLqQ==

X-Gm-Message-State: AOJu0YzkPjhNm6EDbQ639md0ARKB3uC2+Ha8nl30lEnwdy/NMhpiQKzz

5h1jEpOwZ8SWZn0UPgx3O/8KsTBfib4WInVIjMQ/+GTiikWUVfaHzXFCwqJTH/AM9DtqOmWTlgv

JpGHYaPkIKkNl94nLEE+zrX9nl54k2Z8x

X-Google-Smtp-Source: AGHT+IFFgrm8fezAs/6NArVYnq0BxlhF++0/whvWrE6gwaE7OrJEF7MqhFYBuVQ04PvBsdEmoGnDWPXfw8L3oEJ2gk8=

X-Received: by 2002:a05:6870:eca8:b0:288:29ae:c981 with SMTP id

586e51a60fabf-28829af2476mr590550fac.43.1728395700858; Tue, 08 Oct 2024

06:55:00 -0700 (PDT)

MIME-Version: 1.0

From: Charlotte Dennery

Date: Tue, 8 Oct 2024 13:54:48 +0000

Message-ID:

Subject: RE: FEEDBACK

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000c7f5360623f77b62"



--000000000000c7f5360623f77b62

Content-Type: text/plain; charset="UTF-8"



--



Good day,







I hope this message finds you well, Would you be open to discussing a

potential business proposal with me? I wanted to confirm if this email

address is appropriate to get in touch with you. I appreciate your timely

response











Warm regards,

Charlotte Dennery



--000000000000c7f5360623f77b62

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable






ature_prefix">--

-smartmail=3D"gmail_signature">

34,34)">


nt-family:"Courier New"">Good day,
>


nt color=3D"#666666">=C2=A0


oNormal">
=3D"#666666">I hope this message finds you well,=C2=A0Would you be open to =

discussing a potential business proposal with me?=C2=A0I wanted to confirm =

if this email address is appropriate to get in touch with you. I appreciate=

your timely response


le=3D"font-family:"Courier New"">
<=

/font>


t;Courier New"">

<=

p class=3D"MsoNormal"><=

b>

=


66">

Warm regards,

ng=3D"0" cellspacing=3D"0" style=3D"color:rgb(0,0,0);font-family:Arial;font=

-size:16px;border-collapse:collapse">

2;padding:0.01px">
lor:rgb(69,102,142);letter-spacing:0px;line-height:1.2">
ical-align:inherit">
ertical-align:inherit">
=3D"vertical-align:inherit">
yle=3D"vertical-align:inherit">
style=3D"color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-s=

ize:small;font-weight:400">Charlotte Dennery
ont>

v>




--000000000000c7f5360623f77b62--

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 08 Oct 2024 09:40:00 -0600

Received: from mail-il1-f173.google.com ([209.85.166.173]:49268)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1syCIh-00000000BNg-0XYd

for dave@doctor.nl2k.ab.ca;

Tue, 08 Oct 2024 09:39:08 -0600

Received: by mail-il1-f173.google.com with SMTP id e9e14a558f8ab-3a3636ddad6so20483315ab.2

for ; Tue, 08 Oct 2024 08:37:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1728401823; x=1729006623; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=04Mk9QZq7WK9CpwwgUOptYa6v9VVQnk+nOVMrKQfyD8=;

b=F9CArlX+/gaZEnmAR1dlNLhqmKWKYJVxz4xNlSlwq7T5VG9eFK1INVBs4UUUwfCUjg

f/fgtIK3d7bQevlrBM2Qf6cd1AAMth8waM/H9AuWqucZPvXYfxwYvbWryzgpEr7c0sGk

tvgtoZU88Yj5glFhpvwgPZ0aJRrU7QDR5Z0FnNT2Y3XalcKoa6QcuFM0sHH7XdbOtfVR

adSFPDxcDoIMoleh8vuTsk0fVWTbXM4A4JLqRPMMD4G/QydJ9ckNNCUXllh9sdgz39Qn

7Mt82K/pjEg2vqRwtzMQIL8Q0zquu9MKB9qXBQUSP2CmMp4o8TW3+4jKtnKI52ICec2n

QgpQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1728401823; x=1729006623;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=04Mk9QZq7WK9CpwwgUOptYa6v9VVQnk+nOVMrKQfyD8=;

b=B7K5ZTdRei1TbpG9H3ROQl6U7JnbYb41mvYuu9MJR5qN2v2WZyMwY/1b4vo/oHwliB

tayK7sKJNtsLJ8UXCS+vRrFmddmsv1B48ULl2MKKmYCM8+EEbPbSqxAlH11+WqcKVJjK

mC3R1/S3lNXZWaVhnk1f/EXZy1Xf6G7LX+M8HoOHkWzNbvIllAmOWJIcHjAcSa16oFnO

qs8qUMouqrkJMHExuE5BAEjQ/cqfwY7Eq1wDyvXDlilhD38NAolU4mpUoaK+WNE3Cp+p

FDdmjngBbdoUwUnXBTOdryyJrNFpox++ztaTNTrPEz1dV9lsWNEbgIEMtGd29Ouuf+rn

uTgg==

X-Forwarded-Encrypted: i=1; AJvYcCUjMy64mynLMPwjhfFf4NMBti4+eO7Uz/p+6vhiEDk8AG2EPp4mRRvt0pZ0Sg24HyxsG9OT@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YyKsFiu9npo2OEtPvWf2EFpfzhzk0mo/ZnlpfyRApN5asFZJcrP

pPuyN7WiTLSDFALm+4d0uzzs8GqJ3Qw82hdl7zMxO/Lff+P0nBsQCjdvZ1Y5ZMJnV2PgAaYnpCq

Zl0eY+tIJGHcbpWvDiz4WX6w6HPI=

X-Google-Smtp-Source: AGHT+IF1o7rJ6pmpCOd54+Y4zxzdEmH3iN6Gl+iqF7MLJUsWTKR85ZJ7VCY+4mrWIj3pM7o01OKecU/tgmaLL2yd6CE=

X-Received: by 2002:a05:6e02:1fc8:b0:3a0:aa15:3497 with SMTP id

e9e14a558f8ab-3a375976e55mr150239215ab.1.1728401822251; Tue, 08 Oct 2024

08:37:02 -0700 (PDT)

MIME-Version: 1.0

Reply-To: mariarodrigues33yt@gmail.com

From: "Mrs.Maria Rodrigues"

Date: Tue, 8 Oct 2024 15:36:49 +0000

Message-ID:

Subject:

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000a50af30623f8e866"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 20.2

X-Spam_score_int: 202

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings beloved, I know this message might meet you in utmost

surprise. However, it's just my urgent need for a foreign partner. I would

like to know if this proposal will be worthwhile for your acceptance. I need

you [...]



Content analysis details: (20.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.166.173 listed in will-spam-for-food.eu.org]

[209.85.166.173 listed in will-spam-for-food.eu.org]

[209.85.166.173 listed in will-spam-for-food.eu.org]

[209.85.166.173 listed in will-spam-for-food.eu.org]

[209.85.166.173 listed in will-spam-for-food.eu.org]

[209.85.166.173 listed in will-spam-for-food.eu.org]

[209.85.166.173 listed in will-spam-for-food.eu.org]

[209.85.166.173 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.166.173 listed in dnsbl.ahbl.org]

[209.85.166.173 listed in dnsbl.ahbl.org]

[209.85.166.173 listed in dnsbl.ahbl.org]

[209.85.166.173 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.166.173 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.166.173 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.166.173 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.166.173 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.166.173 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.166.173 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[loglokokou(at)gmail.com]

0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

2.5 MILLION_USD BODY: Talks about millions of dollars

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

1.5 HK_NAME_FM_MR_MRS No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

1.5 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 XFER_LOTSA_MONEY Transfer a lot of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.6 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

Subject: {SPAM?}



--000000000000a50af30623f8e866

Content-Type: text/plain; charset="UTF-8"



Greetings beloved,



I know this message might meet you in utmost surprise. However, it's just

my urgent need for a foreign partner. I would like to know if this proposal

will be worthwhile for your acceptance. I need your honest assistance to

actualize my humanitarian project. Sadly, I am critically down with

terminal sickness and on the verge of death. I want you to utilize my

inheritance funds, Three million one hundred and Fifty thousand united

states dollars ($3,150,000.00) for a charity purpose in your country as

soon as you receive these funds. It will be my greatest joy to conclude

this project with you before I die. Further details shall be provided to

you upon your response to my proposal.



Your positive response shall be appreciated. Contact my private email

address below for more details on (mariarodrigues33yt@gmail.com).



Your sister,



Mrs. Maria Rodrigues



--000000000000a50af30623f8e866

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings beloved,

I know this message might meet y=

ou in utmost surprise. However, it's just my urgent need for a foreign =

partner. I would like to know if this proposal will be worthwhile for your =

acceptance. I need your honest assistance to actualize my humanitarian proj=

ect. Sadly, I am critically down with terminal sickness and on the verge of=

death. I want you to utilize my inheritance funds, Three million one hundr=

ed and Fifty thousand united states dollars ($3,150,000.00) for a charity p=

urpose in your country as soon as you receive these funds. It will be my gr=

eatest joy to conclude this project with you before I die. Further details =

shall be provided to you upon your response to my proposal.

Your pos=

itive response shall be appreciated. Contact my private email address below=

for more details on (maria=

rodrigues33yt@gmail.com).

=C2=A0Your sister,

Mrs. Maria R=

odrigues




--000000000000a50af30623f8e866--

Web / SEO/ App spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 08 Oct 2024 07:50:01 -0600

Received: from mail-psaapc01olkn2052.outbound.protection.outlook.com ([40.92.52.52]:14816 helo=APC01-PSA-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1syAaE-000000007Vc-1EJF

for dave@doctor.nl2k.ab.ca;

Tue, 08 Oct 2024 07:49:11 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=nbOltgBavoP5OtaqwzPzJys+NbvNv2LpEx/wsXMutoUrkNGeL0lVmoID/07lefl9vrhvPwOAA4Pd8l8rnyfVmjF3GEoswN9EqhkRxAXsEGmIZILXYdg3YWaXyeoIG2wTWZXTMTmY++QE5fE5yTpD5CMVcAktisw/DeFJGbMATyvAlST80ZGwghbrYa0vI0/zaBVKALMfo7OP8BBjf0HE5PcXQ5cbMY5eJ8X1TfArlaSQzxs/n0wRzIt9GT/f1b0oUt0sy7ckDMHfy5RGP6lZDBOd/q1+RkJy9KOb9eorIF2ejAot+ZV8k1NGp6Mdp8yJ17hdOcA39Dd0LlLY49u5Uw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=Ax1mHQSQF22xOusBsbXrTweMj4xzVxUm8AHL9P8NQ10=;

b=lNjfc6LT1HA8JpZNu+r8b+vz//Z03b31FDjIjtDE7e5yYRWC1LoIgK2kO0k6Ibjr5VKa3ObYGQNgL/N9BbVQhWMm0YjwDkVMIblffzJdufAZith5lvgL4QYXPst5dk3OechSS1086lNlZAqUzAGCxdqnxkG0j28mxQcVAI0i0DqH1f4Cjhmql0YRozOSldCTlrO6NHWzS3hJxop7xlPzabHgEUT0FQC+ZafDv2DDD5AYgCJxNIF60vLujQf2GY14vPRliWfcBNRNULERCccI4jZ9eip0ZHG2WnoL5WDAZd7EfkdQL46S5g1uKnta2J9En4U7Vm7xYyfRMhNGV5HygA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=Ax1mHQSQF22xOusBsbXrTweMj4xzVxUm8AHL9P8NQ10=;

b=bSkVjgHFzOP5dvrd1zjJy7+h6r//adjjXKt+ITZgWHpsKWklEmByiKOvS+5bnXcDMf5SFarHmHvg/LGhHdnVLOjOola542XtuTKn7ZafrPSPiwYzVECbAAGuCD+hiBiiqdlxPoOKgEI04vn9H2vaPE0d+YsNwfdi82mkDjZ2mH+UC9kUn0XW+KJg+DjanF2HNNarn3XhkYaCc5ffHYAqz+tdGpUdqBf8GTdvbpHmthyankBIpicWpyA/UKxM91k+XUgH5rdlkJD1mwbIuIpp9xJEwdNjyTggJuLob+bK6maRP3yCXpNUHzg7/saPqOqNFBA5YzY7p4PqBPEHFM80aw==

Received: from SEYPR06MB6482.apcprd06.prod.outlook.com (2603:1096:101:178::11)

by JH0PR06MB6703.apcprd06.prod.outlook.com (2603:1096:990:36::10) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7982.27; Tue, 8 Oct

2024 12:00:00 +0000

Received: from SEYPR06MB6482.apcprd06.prod.outlook.com

([fe80::224c:2941:e9e8:3950]) by SEYPR06MB6482.apcprd06.prod.outlook.com

([fe80::224c:2941:e9e8:3950%4]) with mapi id 15.20.8005.020; Tue, 8 Oct 2024

12:00:00 +0000

From: Willyim Hofffa

Subject: CREATIVE WEBSITE DESIGNS.!

Thread-Topic: CREATIVE WEBSITE DESIGNS.!

Thread-Index: AQHbGXmTReeJYruFXEC1EpCA6YuOZg==

Date: Tue, 8 Oct 2024 12:00:00 +0000

Message-ID:



Accept-Language: en-IN, en-US

Content-Language: en-IN

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SEYPR06MB6482:EE_|JH0PR06MB6703:EE_

x-ms-office365-filtering-correlation-id: ba3b4fc2-f907-47a2-3ffa-08dce790bcbb

x-microsoft-antispam:

BCL:0;ARA:14566002|19110799003|15030799003|36102599003|8062599003|15080799006|461199028|8060799006|3412199025|440099028|56899033|102099032;

x-microsoft-antispam-message-info:

DsCM3mKybGTIefU7T0ooLZWY+lb4w6bjv7Q6FS8xNOPcO9sE9RizmiNrl/AQw/+XmQsQmmcECbCkhYcNbv0qdSa+NjFz+dkrh+rbzXXjCBQoCY7/ogmIj9M/kOHb7qvsQ7Qatblgg+c86r8j8qoHsFX+qUWlp1WydxO+R0GZXv0Ko7bEZbh1eu4CArdfuNQgeWYOOC56Y16qsULSYsVaPjAlGTZINKPLGRSDjftJRLBWounMfwY0flqu4vQCq5qCyCcQgEkACIuZqO3+DxWvrZT6er3QwZimhyKqkpBpMzfvVMLmNrnF0L+7glZv6Jsxy5hfv2kDtP+hUPJk68bIHVRSHMAM5LQ2QKxhoCdJ4IdZ/TLq/MSmKNaekKMlDg+0q79DUbvGQXB5bmNT8qS4gtuJ1O5RR6jjD/hlF3kQkScBG94nfQSQrSpb6PxcUR4uYaRZvYV3Y5Y0vt1rjtI4HNnID7dcnQAcPerF9A+gT/toiN6QJ5EKimJV2aiohJjJjZL3ACdWLKpvICG4Jjtz2JD0EnR0DhJiFAiLBNl5ddbGJ0kXZdTULUxiKNadG+I6rx4xz2GOz5Y2x2OHVPB4cnat0XHdmje1Dd0s0KYrfq3gE/PsgHnfoNV9CCTTSQqphk6zicVtp2ZuxhmpPz5BmcbLPUxPMvQEJARm2w7wUA9zaecNP+z5abBm6egFYpRbOzraeS4Uvwh58057Oso+kYzlzY31AdXnIFaHMeeqbpDuNVpHJ5YF5rtuG00u/Leu6djGalPPhh7NRm5WjO4+Bw==

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?fgNTr7In84yDpKBb6ZRGZ1n6FNEE738keu0s3Ft+GSm1MIGXh3UJvR0y?=

=?Windows-1252?Q?MsmPimz/wsfI1eCQqVF46ZNRgwNWvYjmiQpb17hIbzlQJRyQmzpZ9uj9?=

=?Windows-1252?Q?Dkp3po7omuwGTivPqcEaL0jffZx5dvRSvzRhd8XawcGMr53v4HtTjJFl?=

=?Windows-1252?Q?+j5rGbfZM6V7aK6AttWJQegjDAFLe51Scz/J8sgBFwPr4b923mvtkcC4?=

=?Windows-1252?Q?qpnJa0ys1TafV0npU1PHanqhrItZCI7j+v18KRpUY7UiF+LFy1QLIcIG?=

=?Windows-1252?Q?Vai2Be6CcLVuOd1BoV9uV4M17gNv3VCnG1CY3Afh3Dk0Ts40bp0yGyJc?=

=?Windows-1252?Q?fjxCW0MFkk3qgqiDJKkabOPZPjxygvMVFS2LM1AnAMR4uPd2DW2XuWiO?=

=?Windows-1252?Q?OKNLgEdVn79l7LKAxJbCzD0nW7zQhWFhJ9QNgNhHnzVVBdbVIly8GqpB?=

=?Windows-1252?Q?wIJpfVEw2ef+wq2CjX9bZ8Irlyx4ZLe6/gI+eU70CjSalnyW4Lutmxy+?=

=?Windows-1252?Q?F7726T/N4+tKZNubVfFe6pMFJYjvwQmHWIThGUfQdIjwnfLJFM1opL4U?=

=?Windows-1252?Q?H8gonaYbb96lWY9RecxQiqCusTfBMxdH9d2u1M4qjtXRbbJEWP+MmRN3?=

=?Windows-1252?Q?5mthezkJ/hGW581b5A0G4Bxx3HcX3YxBN7rYPL9THbsjshhEZXVA+Yv3?=

=?Windows-1252?Q?UhufiVRMEXkE+bhwPs+j5RSVwO5YENhpRUHWmkqWnMJ86tEGHTepufAH?=

=?Windows-1252?Q?/t8OAci+6gjaZSUxM4M7C+WByOwhHixbZGBPPjJ2QmY/DKkW0FFzCE/h?=

=?Windows-1252?Q?3vlC3XQh4zyo9j93U0p5yyAJUa5X508sOSIS2BDg4TMkoFt83gDk+SpF?=

=?Windows-1252?Q?WvNsc0sRUPwi8W3+X+Q0bH69uV/VWyi3NIvoQ3aFuJ6uCEYHdMF6kZBL?=

=?Windows-1252?Q?eGdbn7EnstXHJg4L+jhI0e1ixgv8LisvArF7mYFqVCiI5HIp6NNjAGGu?=

=?Windows-1252?Q?Aa4JBn01M+aHiaUw1lYQOdfsDnZIYAig7fPgtTWQhY7cZhRT5kgUhUk2?=

=?Windows-1252?Q?L+M6p7vSxCcDu5zltvtTMLdDKJed1Kmf3dkkOWMw8KmWZpuBtSNWiMWS?=

=?Windows-1252?Q?mMce+EbtFtUk0yJDxpqlncy0GhWeWchV/6/dIa7dGv2eowFMQuwX1O20?=

=?Windows-1252?Q?ozC++ieSqymfDiB+VnQLW2ekLIGOX0dTntwh2y5/nS3VHWjF5kaNa3Q/?=

=?Windows-1252?Q?JNx4uCIxdaRKN5u3z4zO+aKcClIOfUe3eTcF0icT1Z5pN3dvd3Gxr9VY?=

=?Windows-1252?Q?r2QY/EQSgDPVNdNKrN8dxMZ1b7ybvG2uhxalIIVC2IICTkptAuqlHBb+?=

=?Windows-1252?Q?5mqS78XIKTFbD9oRXIxll1Wtse1AekH5h4O/YbLRusi7bxIn+SsIMDta?=

Content-Type: multipart/alternative;

boundary="_000_SEYPR06MB64829744AC82223C9291A65B847E2SEYPR06MB6482apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SEYPR06MB6482.apcprd06.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: ba3b4fc2-f907-47a2-3ffa-08dce790bcbb

X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Oct 2024 12:00:00.6906

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: JH0PR06MB6703

X-Spam_score: 9.0

X-Spam_score_int: 90

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I hope my mail finds you in the- best of your health,

We are a Web Design & Development firm, with over 12+ years of experience

in the field of Website Designing & Development.



Content analysis details: (9.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:101:178:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:178:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:178:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:178:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:178:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:178:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:178:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:178:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[40.92.52.52 listed in will-spam-for-food.eu.org]

[40.92.52.52 listed in will-spam-for-food.eu.org]

[40.92.52.52 listed in will-spam-for-food.eu.org]

[40.92.52.52 listed in will-spam-for-food.eu.org]

[40.92.52.52 listed in will-spam-for-food.eu.org]

[40.92.52.52 listed in will-spam-for-food.eu.org]

[40.92.52.52 listed in will-spam-for-food.eu.org]

[40.92.52.52 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.92.52.52 listed in dnsbl.ahbl.org]

[40.92.52.52 listed in dnsbl.ahbl.org]

[40.92.52.52 listed in dnsbl.ahbl.org]

[40.92.52.52 listed in dnsbl.ahbl.org]

[2603:1096:101:178:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:1096:101:178:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:1096:101:178:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:1096:101:178:0:0:0:11 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.92.52.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.92.52.52 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.92.52.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.92.52.52 listed in dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.52.52 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 ARC_VALID Message has a valid ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[willyimhofffa658(at)outlook.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[willyimhofffa658(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

Subject: {SPAM?} CREATIVE WEBSITE DESIGNS.!



--_000_SEYPR06MB64829744AC82223C9291A65B847E2SEYPR06MB6482apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,



I hope my mail finds you in the- best of your health,



We are a Web Design & Development firm, with over 12+ years of experience i=

n the field of Website Designing & Development.



We proffer following services at competitive charges:





Website Designing =96 Responsive

 Website Re-Designing

* Word press Websites







Kindly revert back if you are interested.



Awaiting your response and looking forward to a long term association with =

you!



Many thanks,



Willyim







--_000_SEYPR06MB64829744AC82223C9291A65B847E2SEYPR06MB6482apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








y: Cambria, Georgia, serif; font-size: 11pt; color: rgb(0, 36, 81);">

Hi,



f; font-size: 11pt; color: rgb(0, 36, 81);">

 



f; font-size: 11pt; color: rgb(0, 36, 81);">

I hope my mail finds you in the- best of your health,



f; font-size: 11pt; color: rgb(0, 36, 81);">

 



f; font-size: 11pt; color: rgb(0, 36, 81);">

We are a Web Design & Development firm, with over 12+ years of experien=

ce in the field of Website Designing & Development.



f; font-size: 11pt; color: rgb(0, 36, 81);">

 



f; font-size: 11pt; color: rgb(0, 36, 81);">

We proffer following services at competitive charges:



f; font-size: 11pt; color: rgb(0, 36, 81);">

 





  • rgb(0, 36, 81); margin: 0in 0in 0.0001pt 0.5in;">

    Website Designing =96 Responsive

  • ia, Georgia, serif; font-size: 11pt; color: rgb(0, 36, 81); margin: 0in 0in=

    0.0001pt 0.5in;">

    Website Re-Designing

  • serif; font-size: 11pt; color: rgb(0, 36, 81); margin: 0in 0in 0.0001pt 0.=

    5in;">

    Word press Websites



f; font-size: 11pt; color: rgb(0, 36, 81);">

 



f; font-size: 11pt; color: rgb(0, 36, 81);">

 



f; font-size: 11pt; color: rgb(0, 36, 81);">

Kindly revert back if you are interested.



f; font-size: 11pt; color: rgb(0, 36, 81);">

 



f; font-size: 11pt; color: rgb(0, 36, 81);">

Awaiting your response and looking forward to a long term association with =

you!



f; font-size: 11pt; color: rgb(0, 36, 81);">

 



f; font-size: 11pt; color: rgb(0, 36, 81);">

Many thanks,



f; font-size: 11pt; color: rgb(0, 36, 81);">

 



f; font-size: 11pt; color: rgb(0, 36, 81);">

Willyim



, Georgia, serif; font-size: 11pt; color: rgb(0, 36, 81);">

 



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">












--_000_SEYPR06MB64829744AC82223C9291A65B847E2SEYPR06MB6482apcp_--

IDShield / LegalShield Phish from Microsoft

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 07 Oct 2024 14:06:04 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sxtzU-000000006af-0hrC

for dave@doctor.nl2k.ab.ca;

Mon, 07 Oct 2024 14:06:00 -0600

Resent-From: The Doctor

Resent-Date: Mon, 7 Oct 2024 14:05:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm6nam12hn2228.outbound.protection.outlook.com ([52.100.166.228]:57184 helo=NAM12-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

id 1sxrfI-00000000LRa-2gHx

for Mailer-Daemon@doctor.nl2k.ab.ca;

Mon, 07 Oct 2024 11:37:07 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=o0b3Yjdw7VBNexjoUQg/m0/kRvsjgg5HC7ujX1LR6opq0wjsrxamkJpDxG1vEPUwVks8l8XPwb+I2WuW0pZzBTo3hySZeYQvcUUhbuDW4r5hGUQ5koVp7ODSP8uDDNLefyTrycdyh1LFPscAv9ailfbvxC/nNm5p+zeD31w+KxxB80VeQK7Yd96dz2hn143gPkSBwGW/CFV2hWVNsACqQZCYbj3kfSIruW03mkQfu1m6tQX89Kt8ggv/xRHml0q3cA8sCc2hTnX4XpYSiDr7x6CYaSg8V3KOvj9d+9ykHLMZmBTjsIRLB/Xop4PN+N8zDs6ZXBVt1zrn7Al7NILpaQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=25WIiKV8mwGQc9WM+a4oa3YNie8BgPQ7sYRusC3aS50=;

b=cLAmwpGCZ5p3r3FN0EP5y+IK9w9iSMsyl3i695UM6tmyeTLdt0VHtDvnLv0xbDfdVJXesyJ6eRso/8qLH96DW/B4jk0BKzAVuX9eRpSXNG8++T9oB/L0mcqm0gDvjWtic+CCgkUHZctSAHCNCKkxbTVJWA2Bgk2VUrkNcIKO4KQzucAMD62pJYTiyxovf7vEYqN39ve4pl45Z9uPHgQ9IRwKIwDoerS0vSnvGVMa/fPwOSUvXKXqxCgPwfjAC0sjd9iZo3JynQwxHadr3UsL/1zF+sYY36mig6rFktpWg66Mh1w7jnQXg9wZDSxLrBTiecN4f5N1v+cMw7CTp4dz2Q==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=pass

action=none header.from=legalshield.com; dkim=pass header.d=legalshield.com;

arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=legalshieldcorp.onmicrosoft.com;

s=selector2-legalshieldcorp-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=25WIiKV8mwGQc9WM+a4oa3YNie8BgPQ7sYRusC3aS50=;

b=l7aOTFmBxjY3H6M3CBqoMum3gCyBEG7lg2WW4TIwPzKulZsMPX1k1ftyoC7HdaRcE0mYQ61eWDsKWyJVklhnOwX/Az6f8P3vN0y76QGZyeNIMQKVKT1swhD5txBaqjWl+cA9ImjHDHzIhB3pRlIGmYGQcsGGb/0iImD9naa0s2U=

Received: from SA1PR16MB6436.namprd16.prod.outlook.com (2603:10b6:806:3e7::5)

by IA3PR16MB6773.namprd16.prod.outlook.com (2603:10b6:208:528::12) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8005.30; Mon, 7 Oct

2024 17:35:00 +0000

Received: from SA1PR16MB6436.namprd16.prod.outlook.com ([::1]) by

SA1PR16MB6436.namprd16.prod.outlook.com ([fe80::a390:e990:7202:9095%4]) with

Microsoft SMTP Server id 15.20.8005.029; Mon, 7 Oct 2024 17:35:00 +0000

From: noreply

To: Mail Delivery System

Subject: Automatic reply: Mail delivery failed: returning message to sender

Thread-Topic: Mail delivery failed: returning message to sender

Thread-Index: AQHbGN87cncjt47ZjECHQ+Fkb2T2vLJ7jLlo

Date: Mon, 7 Oct 2024 17:35:00 +0000

Message-ID:



References:

In-Reply-To:

X-MS-Has-Attach:

X-Auto-Response-Suppress: All

X-MS-Exchange-Inbox-Rules-Loop: noreply@legalshield.com

X-MS-TNEF-Correlator:

authentication-results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=legalshield.com;

x-ms-exchange-parent-message-id:

auto-submitted: auto-generated

x-ms-exchange-generated-message-source: Mailbox Rules Agent

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SA1PR16MB6436:EE_|IA3PR16MB6773:EE_

x-ms-office365-filtering-correlation-id: 0160692e-c777-492a-9476-08dce6f65e7f

x-ms-exchange-senderadcheck: 1

x-ms-exchange-antispam-relay: 0

x-microsoft-antispam:

BCL:0;ARA:13230040|50650200027|376014|1800799024|366016|1930700014|10070799003|80100003;

x-microsoft-antispam-message-info:

=?us-ascii?Q?yDEHEOlM5wm5piWmD6FpHKoRf/0zwSmvFEiyNANDb/DGe0I+NdQw4VJA8+Bl?=

=?us-ascii?Q?5n1pqos+ygW3NlAjQaVl6AnRibPwhYJjwfMM5wbasK7lrbQ87jHSFmGNrtGh?=

=?us-ascii?Q?8tMXNFtqD2PfD1LPpGuzJRun+800RYH3lkXfWTCD9p2OpnPnQUdJMf+Uujds?=

=?us-ascii?Q?gXkey8TNvgPn5wIEhYWVW9fAQperQX3bP5AZhH7lw2hJS2uuaZKSjvBEp2vv?=

=?us-ascii?Q?HGl25/3jl17tPPzwMT7rXAAgU2AJC8I2mbrayEOoyL31nydqi+Z1fGRykFFi?=

=?us-ascii?Q?Liw51YoQHuBnqLQyXzx5Ws8T3scjREqpp2H9oFraZniT/yHG0oOLFE2BbwF5?=

=?us-ascii?Q?/573sTxWhKxmwTSgRfgj96h1l9RdYB+BPJOg18slXRfDIhEZaVmroeL2x/nG?=

=?us-ascii?Q?RymKsMw/MliE+mkUcLRRRyX3h4kBu8Ldmsim6biEg2yxtXK4oaqkee2XKCI8?=

=?us-ascii?Q?UBZ54bBJCiuCvhjxW1QJUT5AlK9h+vVNZ5PZR7l2kEbLZWML3St9t1BQ7aBU?=

=?us-ascii?Q?CMjOxsWj91vqdBvI7e0jn1gfEw02nBe8i2tYK5bTdDamoxusvZnvqdHsabsJ?=

=?us-ascii?Q?Mx+o5G/Xqthe3ELtT4CoKp/A1b/HHt5/lCnWUbsT0SV3F+vtFXLHXBCBoqB6?=

=?us-ascii?Q?ciAFM4YsDsfVmprAp/PvHndtyMtByWDWQVecNwuxqXlsgpByxpB5A4ICIQix?=

=?us-ascii?Q?KCyoKdeemRkDE0SwuOgMYZU33bjyTSY6JVqtg1cQn0Wpbi0rMfDInqYFukAA?=

=?us-ascii?Q?99pDofJgugE3ixrWalhApv/C4lKho8P/d4tUrp3+bLnOKmyP0C98EB/L4xzV?=

=?us-ascii?Q?Ph536t/0oX2HkNg55VLAT9/PnwI2SSSZ5JC1ItHIxIj9p5s8CQhSqp4NJRR4?=

=?us-ascii?Q?CCz3cB8FgWhwXj9woMgYpRc+MkHzv13CTOWj8UVbq5peLtR5Yd3sTX/X/mUj?=

=?us-ascii?Q?pJO7HhqNbCR5qHrsrYmm3n9Ryu+1K5wBDkHcoLnFA2P6T2Gfiofm0ibGZQab?=

=?us-ascii?Q?C8hYNU/ObFkVX5+FRx1as5CGo0DCnMMbg62jHBYXjTgfYkvP1DtXioDXycup?=

=?us-ascii?Q?0UZF9LsaZpKgtnIVMiGXu2iSVbztZVeoPcMvwepsJgWHvIclC16uKMPB2HEn?=

=?us-ascii?Q?1l/ln4cXD8UY20TKWkIKqQqDxH+nu6YRGC84MyZ2lxa3BoQYyr0n3GUP6gcl?=

=?us-ascii?Q?3ulU33SAakcVSp9ye0cNwIzdupiRkPCSE1SN8C+I7bUUnJue145MRSeFYfB0?=

=?us-ascii?Q?Pk1VTcY3lT/nnkUkALITqe7vqDYGCw8JmNNcP9I6pA=3D=3D?=

x-forefront-antispam-report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA1PR16MB6436.namprd16.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(50650200027)(376014)(1800799024)(366016)(1930700014)(10070799003)(80100003);DIR:OUT;SFP:1501;

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

krxgMW8SjeZo8/tDweJlMxO8uqKdGaAZEXmCUvTU92wkF3rCgC07dIkXQ6wEddHvuNG11dnlvypLQs5xmGbmhnupOwYtn8AuahY/Q+DRk6+IoFM5jIDibCL8YaWj6NXhqCv3n071mez5PJR3NijWDVXvNwat7cpSR6u4mkjj1VTTBpTnShQg6+FSjYqdT1RHrCXEvxDf9P7lNOP5pcys6yAeVcV/8edHt/uCI3L5iWohNgCzsRrsUm/NLIbIkzUswYVWRGcpU9o3fW0GDzBGrVboIFYfiKh6LH1MQr01AH7GKvM149cB5X0DxANN8dAK

Content-Type: multipart/alternative;

boundary="_000_ae9ec463d9034232893c981602fddaecSA1PR16MB6436namprd16pr_"

MIME-Version: 1.0

X-OriginatorOrg: LegalShield.Com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SA1PR16MB6436.namprd16.prod.outlook.com

X-MS-Exchange-CrossTenant-Network-Message-Id: 0160692e-c777-492a-9476-08dce6f65e7f

X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Oct 2024 17:35:00.1357

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: b4edc9f8-801a-47b2-841c-0e14544448fa

X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA3PR16MB6773

X-Spam_score: 5.6

X-Spam_score_int: 56

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Thank you for contacting LegalShield. This email inbox is

not monitored. To contact us please visit https://www.legalshield.com/contact.

Thank you for contacting LegalShield. This email inbox is not monitored.

To contact us please visit https://www.legalshield.com/contact.



Content analysis details: (5.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10b6:806:3e7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:3e7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:3e7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:3e7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:3e7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:3e7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:3e7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:3e7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[52.100.166.228 listed in will-spam-for-food.eu.org]

[52.100.166.228 listed in will-spam-for-food.eu.org]

[52.100.166.228 listed in will-spam-for-food.eu.org]

[52.100.166.228 listed in will-spam-for-food.eu.org]

[52.100.166.228 listed in will-spam-for-food.eu.org]

[52.100.166.228 listed in will-spam-for-food.eu.org]

[52.100.166.228 listed in will-spam-for-food.eu.org]

[52.100.166.228 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.100.166.228 listed in dnsbl.ahbl.org]

[52.100.166.228 listed in dnsbl.ahbl.org]

[52.100.166.228 listed in dnsbl.ahbl.org]

[52.100.166.228 listed in dnsbl.ahbl.org]

[2603:10b6:806:3e7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:3e7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:3e7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:3e7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.100.166.228 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.100.166.228 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.100.166.228 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.100.166.228 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.100.166.228 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.166.228 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 ARC_VALID Message has a valid ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_SIGNED Message has a ARC signature

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.7 FORGED_SPF_HELO No description available.

Subject: {SPAM?} Automatic reply: Mail delivery failed: returning message to sender



--_000_ae9ec463d9034232893c981602fddaecSA1PR16MB6436namprd16pr_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Thank you for contacting LegalShield. This email inbox is not monitored. To=

contact us please visit https://www.legalshield.com/contact.



--_000_ae9ec463d9034232893c981602fddaecSA1PR16MB6436namprd16pr_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable








>










:#000000; font-family:Calibri,Helvetica,sans-serif">


rt">Thank you for contacting LegalShield. This email inbox is =

not monitored. To contact us please visit https://www.legalshield.com/conta=

ct.












--_000_ae9ec463d9034232893c981602fddaecSA1PR16MB6436namprd16pr_--

CAA Phish from Ukraine

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 07 Oct 2024 09:39:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sxpoZ-000000008eo-3OqI

for dave@doctor.nl2k.ab.ca;

Mon, 07 Oct 2024 09:38:27 -0600

Resent-From: The Doctor

Resent-Date: Mon, 7 Oct 2024 09:38:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [46.175.149.14] (port=50027 helo=i15er1s6sa51as5e.it)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sxoa0-00000000CsT-29Zo

for doctor@netknow.ca;

Mon, 07 Oct 2024 08:20:14 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1728310241;

s=s1; d=tutamail.com;

h=From:From:To:To:Subject:Subject:Content-Description:Content-ID:Content-Type:Content-Type:Content-Transfer-Encoding:Cc:Date:Date:In-Reply-To:MIME-Version:MIME-Version:Message-ID:Message-ID:Reply-To:References:Sender;

bh=nwQgL+cF0mG4OcMQtYnzt/gaMX7YUiPH2Kc2Uhpc0Pk=;

b=UGtEf5/eb2QSzXumGxpDX6msc+kLVN/eJVBKtKsZZEQ15eTxLqALOSK5NKL6yKxV

C4eD6C2b+w7HFZ5PF4hrK3v18HMSy0i84gALKHhraz9KhiVhymtt8Ua/Dnp9QZyzaRk

xQHRgO5JLf0Hc22SlQVdchNlEzLSIHhc+EUm7Scz3bJh5/1OIVwca54OirmQ5BsBUJ1

HUFYVMKWm0Vw4Udd01dS7Z/oFSElQd/hpexnRpsYjc4M6rd4mo7AMp2+HB/UxHhWXkv

p30aU5ainzzvv3V7ZyHP8OO3eMG8m3LX+ejTj/ZE4LWz8aNtXjDU6ZEJv0nGSAeMz8q

ZF6xJgUJlA==

Date: Mon, 7 Oct 2024 16:10:41 +0200 (CEST)

From: CAA Customer Care

To: Utgolovep

Message-ID:

Subject: Stay Safe with This Kit

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_Part_18536_1776140653.1728310241634"

X-Spam_score: 10.2

X-Spam_score_int: 102

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Be Road-Ready: The Kit You Need for Emergencies
[...]



Content analysis details: (10.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[46.175.149.14 listed in will-spam-for-food.eu.org]

[46.175.149.14 listed in will-spam-for-food.eu.org]

[46.175.149.14 listed in will-spam-for-food.eu.org]

[46.175.149.14 listed in will-spam-for-food.eu.org]

[46.175.149.14 listed in will-spam-for-food.eu.org]

[46.175.149.14 listed in will-spam-for-food.eu.org]

[46.175.149.14 listed in will-spam-for-food.eu.org]

[46.175.149.14 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[46.175.149.14 listed in dnsbl.ahbl.org]

[46.175.149.14 listed in dnsbl.ahbl.org]

[46.175.149.14 listed in dnsbl.ahbl.org]

[46.175.149.14 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[46.175.149.14 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[46.175.149.14 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[46.175.149.14 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[46.175.149.14 listed in dnsbl.ahbl.org]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Stay Safe with This Kit



------=_Part_18536_1776140653.1728310241634

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: quoted-printable



Be Road-Ready: The Kit You Need for Emergencies <=

https://firebasestorage.googleapis.com/v0/b/project-30-z8l210.appspot.com/o=

/10_07_24%2FCAA%20Emergency%20Kit.html?alt=3Dmedia&token=3Df2005754-22ce-47=

0c-b300-1b1ba6b130b3>
googleapis.com/v0/b/project-30-z8l210.appspot.com/o/10_07_24%2FCAA%20Emerge=

ncy%20Kit.html?alt=3Dmedia&token=3Df2005754-22ce-470c-b300-1b1ba6b130b3> =

Discover More About Your Car Kit Offer
rebasestorage.googleapis.com/v0/b/project-30-z8l210.appspot.com/o/10_07_24%=

2FCAA%20Emergency%20Kit.html?alt=3Dmedia&token=3Df2005754-22ce-470c-b300-1b=

1ba6b130b3> =C2=A0 =20

------=_Part_18536_1776140653.1728310241634

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 7bit





























------=_Part_18536_1776140653.1728310241634--

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 07 Oct 2024 08:12:04 -0600

Received: from mail-lj1-f180.google.com ([209.85.208.180]:49400)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sxoSa-000000009hK-0kDk

for dave@doctor.nl2k.ab.ca;

Mon, 07 Oct 2024 08:11:57 -0600

Received: by mail-lj1-f180.google.com with SMTP id 38308e7fff4ca-2fabe5c8c26so39909301fa.2

for ; Mon, 07 Oct 2024 07:09:49 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1728310182; x=1728914982; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=cnMvs9V3kl/eny3RyPgSGJ9sKgHXs5vAyHbakMrL72c=;

b=VvEUX1Lu/USBDjalHwU9uIX36P6ynfGi1kk1cY0A1VfZx9RuIAUJQ/k0X9JXUfTX59

67uj9mAarU6lYBPgWTbqUh6DFW2DH7k4h1xAgBoM7n1EJxSfbS6XbV+oe9S0Jyj1vO9c

LWDncRD9eps+0UXZl19EOagl68cBeQ6Dr6y89aaNAg2fBBaICZQgwZRjYUQPq7nNbQn7

fyVi7L815pL5oribbkjUpKo31OiNTC3t+osPb3PWGu9x2SjRrR3wsZodToL3dwVszvFQ

5753UpZAB2hYac7EAjDbUhQkiQCz8+FPaHeG5K9BQ+2SJMp8bheAwpjoyWSJyAdVfs9M

D0Rw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1728310182; x=1728914982;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=cnMvs9V3kl/eny3RyPgSGJ9sKgHXs5vAyHbakMrL72c=;

b=sKFgjDgl3Qw2eVVmOMUVis5sCf7iVPESiDIZ4XcmA464wDOgw0JGyC65tp/iHZbaDb

HZWT/UUqX2OyjLvtLs7V/UYm7/xfS50bUAZScrxs/9SEb+ZHCmLZvbZwV2ajpY3rmZcl

2vrpUuLBmQpQbzAMEgUQaI8QnRtwD8qwi2zgP8M6RVRw1xi85jq/letSNZ763NxBTFzc

6x2YrPet3MW/GUS7FGuAm0D3SthsQg9mCBeUnctxqd2LbEYqDBH1kvzyLHmlDRsyWT5/

E3Ct/K+aMFa98MbttjvwKTEsIoiMM+c1dcq1PHNsBGObNoPNSEp0T+XQ2lPQ6o7YBHZo

VK1Q==

X-Forwarded-Encrypted: i=1; AJvYcCXafddz4qaOZNYNGgiT36JsGZAatUTw+iZclY+GaQD9136IKagJeEY/Dkk8sMVemIXdMVXn@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YwdcQjOJ5ToDN9c6GzImibsmPoMrvff7Ja75uimlq2XmmXQFUFt

XqE4kaiHS82aJ1eCg9/rMJmuHTcQU6szHyV2UyJeDgX/ma4uFY7faDHuMhXsUURaBzcl+M0274g

TnI51MN/eP1qzgMcmlsyFEoVV94Q=

X-Google-Smtp-Source: AGHT+IHGOeWURrmJas0GVJYuOVVto2KQayrUgSVTr+WDfaIoDzOOPPNYcpcKN+ej/ELh4tOS0snnNsMmgy9vjUbS+2w=

X-Received: by 2002:a2e:a7ca:0:b0:2fb:b59:816a with SMTP id

38308e7fff4ca-2fb0b598349mr8378641fa.45.1728310181707; Mon, 07 Oct 2024

07:09:41 -0700 (PDT)

MIME-Version: 1.0

From: Mrs Aisha Al-Gaddafi

Date: Mon, 7 Oct 2024 08:09:22 -0600

Message-ID:

Subject: I need your assistance

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000007146c80623e392fd"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 22.9

X-Spam_score_int: 229

X-Spam_bar: ++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings Dear Partner, I came across your e-mail contact

prior to a private search while in need of your assistance. My name is Aisha

Al-Gaddafi, a single Mother and a Widow with four Children. I am the only

biological Daughter of late Libyan President (Late Colonel Muammar Gaddafi).I

have investment funds worth Twenty Seven Million Five Hundred Thousand United

State Dollar ($27.500.000.00 ) [...]



Content analysis details: (22.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.208.180 listed in will-spam-for-food.eu.org]

[209.85.208.180 listed in will-spam-for-food.eu.org]

[209.85.208.180 listed in will-spam-for-food.eu.org]

[209.85.208.180 listed in will-spam-for-food.eu.org]

[209.85.208.180 listed in will-spam-for-food.eu.org]

[209.85.208.180 listed in will-spam-for-food.eu.org]

[209.85.208.180 listed in will-spam-for-food.eu.org]

[209.85.208.180 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.180 listed in dnsbl.ahbl.org]

[209.85.208.180 listed in dnsbl.ahbl.org]

[209.85.208.180 listed in dnsbl.ahbl.org]

[209.85.208.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.180 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.180 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.180 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.180 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.180 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[fffc4242(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[mrsaishaalgaddafi5(at)gmail.com]

0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

0.9 URG_BIZ BODY: Contains urgent matter

2.5 MILLION_USD BODY: Talks about millions of dollars

2.7 HK_SCAM_N1 BODY: No description available.

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

1.5 HK_NAME_FM_MR_MRS No description available.

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

1.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

Subject: {SPAM?} I need your assistance



--0000000000007146c80623e392fd

Content-Type: text/plain; charset="UTF-8"



Greetings Dear Partner,







I came across your e-mail contact prior to a private search while in need

of your assistance. My name is Aisha Al-Gaddafi, a single Mother and a

Widow with four Children.







I am the only biological Daughter of late Libyan President (Late

Colonel Muammar Gaddafi).I have investment funds worth Twenty Seven Million

Five Hundred Thousand United State Dollar ($27.500.000.00 ) and i need a

trusted investment Manager/Partner because of my current refugee status,

however,







I am interested in you for investment project assistance in your country,

may be from there, we can build business relationship in the nearest future.







Your Urgent Reply Will Be Appreciated if really this transaction interests

you. Contact me at this my private email address







Best Regards



Mrs Aisha Al-Gaddafi



--0000000000007146c80623e392fd

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




al;background-position:initial;background-size:initial;background-repeat:in=

itial;background-origin:initial;background-clip:initial;font-size:12pt;font=

-family:"Times New Roman","serif"">
:rgb(38,40,42)">Greetings Dear Partner,






ition:initial;background-size:initial;background-repeat:initial;background-=

origin:initial;background-clip:initial;font-size:12pt;font-family:"Tim=

es New Roman","serif"">=

=C2=A0






ition:initial;background-size:initial;background-repeat:initial;background-=

origin:initial;background-clip:initial;font-size:12pt;font-family:"Tim=

es New Roman","serif"">I=

came across your e-mail contact

prior to a private search while in=C2=A0need of your assistance. My name is=

Aisha

Al-Gaddafi, a single Mother and a Widow with four Children.






ition:initial;background-size:initial;background-repeat:initial;background-=

origin:initial;background-clip:initial;font-size:12pt;font-family:"Tim=

es New Roman","serif"">=

=C2=A0






ition:initial;background-size:initial;background-repeat:initial;background-=

origin:initial;background-clip:initial;font-size:12pt;font-family:"Tim=

es New Roman","serif"">I=

am the only biological Daughter

of late Libyan President (Late Colonel=C2=A0Muammar Gaddafi).I have investm=

ent

funds worth Twenty Seven=C2=A0Million Five Hundred Thousand United State Do=

llar

($27.500.000.00 )=C2=A0and i need a trusted investment Manager/Partner beca=

use

of my current=C2=A0refugee status, however,






ition:initial;background-size:initial;background-repeat:initial;background-=

origin:initial;background-clip:initial;font-size:12pt;font-family:"Tim=

es New Roman","serif"">=

=C2=A0






ition:initial;background-size:initial;background-repeat:initial;background-=

origin:initial;background-clip:initial;font-size:12pt;font-family:"Tim=

es New Roman","serif"">I=

am interested in you for

investment project assistance in your=C2=A0country, may be from there, we c=

an

build business relationship in the nearest future.






ition:initial;background-size:initial;background-repeat:initial;background-=

origin:initial;background-clip:initial;font-size:12pt;font-family:"Tim=

es New Roman","serif"">=

=C2=A0






ition:initial;background-size:initial;background-repeat:initial;background-=

origin:initial;background-clip:initial;font-size:12pt;font-family:"Tim=

es New Roman","serif"">Y=

our Urgent Reply Will Be

Appreciated if really this transaction interests you.=C2=A0Contact me at th=

is

my private email address=C2=A0






ition:initial;background-size:initial;background-repeat:initial;background-=

origin:initial;background-clip:initial;font-size:12pt;font-family:"Tim=

es New Roman","serif"">=

=C2=A0






ition:initial;background-size:initial;background-repeat:initial;background-=

origin:initial;background-clip:initial;font-size:12pt;font-family:"Tim=

es New Roman","serif"">B=

est Regards






tial;background-size:initial;background-repeat:initial;background-origin:in=

itial;background-clip:initial;margin-right:0in;margin-left:0in;font-size:12=

pt;font-family:"Times New Roman","serif"">
=3D"color:rgb(38,40,42)">Mrs Aisha Al-Gaddafi






ize:11pt;font-family:Calibri,"sans-serif"">=C2=A0






ize:11pt;font-family:Calibri,"sans-serif"">=C2=A0





--0000000000007146c80623e392fd--

French language Paypal Phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 07 Oct 2024 07:34:06 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sxnrZ-00000000NgU-3zhI

for dave@doctor.nl2k.ab.ca;

Mon, 07 Oct 2024 07:33:25 -0600

Resent-From: The Doctor

Resent-Date: Mon, 7 Oct 2024 07:33:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [45.80.215.157] (port=53866 helo=managergram.com.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sxkIZ-00000000HPO-2OO4

for doctor@nl2k.ab.ca;

Mon, 07 Oct 2024 03:45:18 -0600

Received: by managergram.com.com (Postfix, from userid 33)

id 234C85B0EE; Mon, 7 Oct 2024 07:33:14 +0000 (UTC)

To: doctor@nl2k.ab.ca

Subject: =?UTF-8?B?TUVUVEVaIMOAIEpPVVJTIFZPUyBJTkZPUk1BVElPTlM=?=

Date: Mon, 7 Oct 2024 07:32:37 +0000

From: =?UTF-8?B?UGF5UGFs?=

Message-ID: <7bab4f775e95229f21250d944f6e406d@compte.fr>

List-Unsubscribe: mailto:bounce395-lYl8gSaS9CCHRx9@compte.fr?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1a79db978737e0ef7ffe78ae99130ab2a"

X-Spam_score: 8.9

X-Spam_score_int: 89

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:   Bonjour,Une mise à jour de notre serveur a

été effectuée afin de vous garantir un meilleur service

et une meilleur sécurité.Pour terminer le processus de cell

[...]



Content analysis details: (8.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[45.80.215.157 listed in will-spam-for-food.eu.org]

[45.80.215.157 listed in will-spam-for-food.eu.org]

[45.80.215.157 listed in will-spam-for-food.eu.org]

[45.80.215.157 listed in will-spam-for-food.eu.org]

[45.80.215.157 listed in will-spam-for-food.eu.org]

[45.80.215.157 listed in will-spam-for-food.eu.org]

[45.80.215.157 listed in will-spam-for-food.eu.org]

[45.80.215.157 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[45.80.215.157 listed in dnsbl.ahbl.org]

[45.80.215.157 listed in dnsbl.ahbl.org]

[45.80.215.157 listed in dnsbl.ahbl.org]

[45.80.215.157 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[45.80.215.157 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[45.80.215.157 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[45.80.215.157 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[45.80.215.157 listed in dnsbl.ahbl.org]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=www-data%40managergram.com.com;ip=45.80.215.157;r=doctor.nl2k.ab.ca]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=managergram.com.com;ip=45.80.215.157;r=doctor.nl2k.ab.ca]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

Subject: {SPAM?} =?UTF-8?B?TUVUVEVaIMOAIEpPVVJTIFZPUyBJTkZPUk1BVElPTlM=?=



This is a multi-part message in MIME format.



--1a79db978737e0ef7ffe78ae99130ab2a

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: base64



DQoNCg0KDQoNCg0KDQoNCg0KDQoNCiZuYnNwOw0KDQoNCg0KQm9uam91cixVbmUgbWlzZSAmYWdy

YXZlOyBqb3VyIGRlIG5vdHJlIHNlcnZldXIgYSAmZWFjdXRlO3QmZWFjdXRlOyBlZmZlY3R1JmVh

Y3V0ZTtlIGFmaW4gZGUgdm91cyBnYXJhbnRpciB1biBtZWlsbGV1ciBzZXJ2aWNlIGV0IHVuZSBt

ZWlsbGV1ciBzJmVhY3V0ZTtjdXJpdCZlYWN1dGU7LlBvdXIgdGVybWluZXIgbGUgcHJvY2Vzc3Vz

IGRlIGNlbGxlLWNpLHZvdXMgZGV2ZXogaW1wJmVhY3V0ZTtyYXRpdmVtZW50IG1ldHRyZSAmYWdy

YXZlOyBqb3VyIHZvcyBpbmZvcm1hdGlvbnMgc3VyIHZvdHJlIGNvbXB0ZSBwb3VyIHYmZWFjdXRl

O3JpZmllciBxdSdpbCBzJ2FnaXQgYmllbiBkZSB2b3VzIHNpbm9uIGlsIHNlcmEgYXVzc2l0Jm9j

aXJjO3QgYmxvcXUmZWFjdXRlOyBkYW5zIGxlcyAyNGggcXVpIHN1aXZlbnQuDQoNCg0KDQptZXR0

cmUgJmFncmF2ZTsgam91ciBtZXMgaW5mb21hcnRpb25zDQoNCg0KDQombmJzcDsNCg0KDQoNCiZj

b3B5O1BheXBhbCAyMDI0TWVyY2kgZGUgbmUgcGFzIHImZWFjdXRlO3BvbmRyZSAmYWdyYXZlOyBj

ZXQgZW1haWwuIE5vdXMgbmUgc29tbWVzIHBhcyBlbiBtZXN1cmUgZGUgciZlYWN1dGU7cG9uZHJl

IGF1eCBkZW1hbmRlcyBlbnZveSZlYWN1dGU7ZXMgJmFncmF2ZTsgY2V0dGUgYWRyZXNzZS4gUG91

ciBvYnRlbmlyIGRlcyByJmVhY3V0ZTtwb25zZXMgaW1tJmVhY3V0ZTtkaWF0ZXMgJmFncmF2ZTsg

dm9zIHF1ZXN0aW9ucywgdmlzaXRleiBub3RyZSBjZW50cmUgZCdhaWRlIGVuIGNsaXF1YW50IHN1

ciAiQWlkZSIgc2l0dSZlYWN1dGU7IHN1ciBuJ2ltcG9ydGUgcXVlbGxlIHBhZ2UgUGEgeVBhbCBv

dSBwYXIgZS1tYWlsLg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCiZuYnNwOw==





--1a79db978737e0ef7ffe78ae99130ab2a

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: base64



PHRhYmxlIGJvcmRlcj0iMCIgd2lkdGg9IjEwMCUiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGlu

Zz0iMCI+DQo8dGJvZHk+DQo8dHI+DQo8dGQgc3R5bGU9InZlcnRpY2FsLWFsaWduOiB0b3A7IGJh

Y2tncm91bmQtY29sb3I6ICNmZmZmZmY7IHBhZGRpbmc6IDBweDsiIGFsaWduPSJjZW50ZXIiPg0K

PHRhYmxlIHN0eWxlPSJtaW4td2lkdGg6IDQ4MHB4OyIgYm9yZGVyPSIwIiB3aWR0aD0iNDgwIiBj

ZWxsc3BhY2luZz0iMCIgY2VsbHBhZGRpbmc9IjAiPg0KPHRib2R5Pg0KPHRyPg0KPHRkIHN0eWxl

PSJ2ZXJ0aWNhbC1hbGlnbjogdG9wOyBtaW4td2lkdGg6IDQ4MHB4OyBwYWRkaW5nOiAwcHg7IiBh

bGlnbj0ibGVmdCI+PGltZyBzcmM9Imh0dHBzOi8vaGVpbmJhdmViLWY4Y2RjZi5pbmdyZXNzLWJh

cm9ubi5ld3AubGl2ZS93cC1jb250ZW50L3BsdWdpbnMvcHAxNDQucG5nIiBhbHQ9IiIgd2lkdGg9

IjE1MCIgaGVpZ2h0PSI5NCIgLz48YnIgLz4NCjx0YWJsZSBzdHlsZT0iaGVpZ2h0OiAyNTRweDsg

YmFja2dyb3VuZC1jb2xvcjogI2ZmZmZmZjsiIGJvcmRlcj0iMCIgd2lkdGg9IjQ4MCIgY2VsbHNw

YWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIiBhbGlnbj0iY2VudGVyIj4NCjx0Ym9keT4NCjx0ciBz

dHlsZT0iaGVpZ2h0OiA1cHg7Ij4NCjx0ZCBzdHlsZT0iaGVpZ2h0OiA1cHg7IHdpZHRoOiA0Nzcu

MzMzcHg7IHZlcnRpY2FsLWFsaWduOiB0b3A7IiBhbGlnbj0ibGVmdCI+Jm5ic3A7PC90ZD4NCjwv

dHI+DQo8dHIgc3R5bGU9ImhlaWdodDogMjA2cHg7Ij4NCjx0ZCBzdHlsZT0iZm9udC1zaXplOiAx

M3B4OyBib3JkZXItdG9wOiAxcHggc29saWQgI2U2ZTZlNjsgaGVpZ2h0OiAyMDZweDsgZm9udC1m

YW1pbHk6IEFyaWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IHdpZHRoOiA0MzcuMzMzcHg7IHZl

cnRpY2FsLWFsaWduOiB0b3A7IGNvbG9yOiAjMDAwMDAwOyBwYWRkaW5nLXRvcDogMjBweDsgcGFk

ZGluZy1sZWZ0OiAyMHB4OyBwYWRkaW5nLXJpZ2h0OiAyMHB4OyIgYWxpZ249ImxlZnQiPg0KPHA+

Qm9uam91ciw8YnIgLz48YnIgLz5VbmUgbWlzZSAmYWdyYXZlOyBqb3VyIGRlIG5vdHJlIHNlcnZl

dXIgYSAmZWFjdXRlO3QmZWFjdXRlOyBlZmZlY3R1JmVhY3V0ZTtlIGFmaW4gZGUgdm91cyBnYXJh

bnRpciB1biBtZWlsbGV1ciBzZXJ2aWNlIGV0IHVuZSBtZWlsbGV1ciBzJmVhY3V0ZTtjdXJpdCZl

YWN1dGU7LjxiciAvPlBvdXIgdGVybWluZXIgbGUgcHJvY2Vzc3VzIGRlIGNlbGxlLWNpLHZvdXMg

ZGV2ZXogaW1wJmVhY3V0ZTtyYXRpdmVtZW50IG1ldHRyZSAmYWdyYXZlOyBqb3VyIHZvcyBpbmZv

cm1hdGlvbnMgc3VyIHZvdHJlIGNvbXB0ZSBwb3VyIHYmZWFjdXRlO3JpZmllciBxdSdpbCBzJ2Fn

aXQgYmllbiBkZSB2b3VzIHNpbm9uIGlsIHNlcmEgYXVzc2l0Jm9jaXJjO3QgYmxvcXUmZWFjdXRl

OyBkYW5zIGxlcyAyNGggcXVpIHN1aXZlbnQuPGJyIC8+PGJyIC8+PC9wPg0KPHRhYmxlIGNsYXNz

PSJtXzMwMTg0MDgwMjM2MTU5Nzk3NDJzbS13LWZ1bGwiIHN0eWxlPSJ3aWR0aDogMjMycHg7IGZv

bnQtZmFtaWx5OiAnT3BlbiBTYW5zJywgUm9ib3RvLCB1aS1zYW5zLXNlcmlmLCAnU2Vnb2UgVUkn

LCBBcmlhbCwgLWFwcGxlLXN5c3RlbSwgc2Fucy1zZXJpZjsgaGVpZ2h0OiAzNXB4OyBtYXJnaW4t

bGVmdDogMTAwcHg7IiByb2xlPSJwcmVzZW50YXRpb24iIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFk

ZGluZz0iMCI+DQo8dGJvZHkgc3R5bGU9ImZvbnQtZmFtaWx5OiAnT3BlbiBTYW5zJyxSb2JvdG8s

dWktc2Fucy1zZXJpZiwnU2Vnb2UgVUknLEFyaWFsLC1hcHBsZS1zeXN0ZW0sc2Fucy1zZXJpZjsi

Pg0KPHRyIHN0eWxlPSJmb250LWZhbWlseTogJ09wZW4gU2FucycsUm9ib3RvLHVpLXNhbnMtc2Vy

aWYsJ1NlZ29lIFVJJyxBcmlhbCwtYXBwbGUtc3lzdGVtLHNhbnMtc2VyaWY7Ij4NCjx0aCBzdHls

ZT0iYm9yZGVyLXJhZGl1czogOTk5OXB4OyBmb250LWZhbWlseTogJ09wZW4gU2FucycsIFJvYm90

bywgdWktc2Fucy1zZXJpZiwgJ1NlZ29lIFVJJywgQXJpYWwsIC1hcHBsZS1zeXN0ZW0sIHNhbnMt

c2VyaWY7IGJhY2tncm91bmQtY29sb3I6IGJsdWU7IGJvcmRlcjogMXB4IHNvbGlkICMwMDc0NjE7

IHdpZHRoOiAyMjkuMzMzcHg7Ij48YSBzdHlsZT0idGV4dC1kZWNvcmF0aW9uOiBub25lOyBkaXNw

bGF5OiBibG9jazsgcGFkZGluZy10b3A6IDE4cHg7IHBhZGRpbmctYm90dG9tOiAxOHB4OyBmb250

LXNpemU6IDE0cHg7IGxpbmUtaGVpZ2h0OiAxMDAlOyBmb250LWZhbWlseTogJ09wZW4gU2Fucycs

Um9ib3RvLHVpLXNhbnMtc2VyaWYsJ1NlZ29lIFVJJyxBcmlhbCwtYXBwbGUtc3lzdGVtLHNhbnMt

c2VyaWY7IGNvbG9yOiAjZmZmZmZmOyIgaHJlZj0iaHR0cHM6Ly9zaXRlcy5nb29nbGUuY29tL3Zp

ZXcvenJldGVyL2hvbWUiIHRhcmdldD0iX2JsYW5rIiByZWw9Im5vb3BlbmVyIj5tZXR0cmUgJmFn

cmF2ZTsgam91ciBtZXMgaW5mb21hcnRpb25zPC9hPjwvdGg+DQo8L3RyPg0KPC90Ym9keT4NCjwv

dGFibGU+DQo8cCBzdHlsZT0idGV4dC1hbGlnbjogbGVmdDsiPiZuYnNwOzwvcD4NCjwvdGQ+DQo8

L3RyPg0KPHRyIHN0eWxlPSJoZWlnaHQ6IDQ4cHg7Ij4NCjx0ZCBzdHlsZT0iZm9udC1zaXplOiAx

MnB4OyBoZWlnaHQ6IDQzcHg7IGZvbnQtZmFtaWx5OiBBcmlhbCwgSGVsdmV0aWNhLCBzYW5zLXNl

cmlmOyB3aWR0aDogNDE3LjMzM3B4OyB2ZXJ0aWNhbC1hbGlnbjogdG9wOyBjb2xvcjogIzAwMDAw

MDsgYmFja2dyb3VuZC1jb2xvcjogI2VkZWRlZDsgcGFkZGluZzogMjBweCAzMHB4IDIzcHg7IiBh

bGlnbj0ibGVmdCI+PHNwYW4gaWQ9InAyOCI+PHNwYW4gaWQ9IjMxIj4mY29weTtQYXlwYWw8L3Nw

YW4+IDIwMjQ8L3NwYW4+PGJyIC8+TWVyY2kgZGUgbmUgcGFzIHImZWFjdXRlO3BvbmRyZSAmYWdy

YXZlOyBjZXQgZW1haWwuIE5vdXMgbmUgc29tbWVzIHBhcyBlbiBtZXN1cmUgZGUgciZlYWN1dGU7

cG9uZHJlIGF1eCBkZW1hbmRlcyBlbnZveSZlYWN1dGU7ZXMgJmFncmF2ZTsgY2V0dGUgYWRyZXNz

ZS4gUG91ciBvYnRlbmlyIGRlcyByJmVhY3V0ZTtwb25zZXMgaW1tJmVhY3V0ZTtkaWF0ZXMgJmFn

cmF2ZTsgdm9zIHF1ZXN0aW9ucywgdmlzaXRleiBub3RyZSBjZW50cmUgZCdhaWRlIGVuIGNsaXF1

YW50IHN1ciAiQWlkZSIgc2l0dSZlYWN1dGU7IHN1ciBuJ2ltcG9ydGUgcXVlbGxlIHBhZ2UgUGEg

eVBhbCBvdSBwYXIgZS1tYWlsLjwvdGQ+DQo8L3RyPg0KPC90Ym9keT4NCjwvdGFibGU+DQo8L3Rk

Pg0KPC90cj4NCjwvdGJvZHk+DQo8L3RhYmxlPg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90

YWJsZT4NCjxwPiZuYnNwOzwvcD4=







--1a79db978737e0ef7ffe78ae99130ab2a--

French language Paypal Phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 07 Oct 2024 07:34:06 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sxnrn-00000000Nh6-3h9K

for dave@doctor.nl2k.ab.ca;

Mon, 07 Oct 2024 07:33:39 -0600

Resent-From: The Doctor

Resent-Date: Mon, 7 Oct 2024 07:33:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [45.80.215.157] (port=37358 helo=managergram.com.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sxlpn-00000000K31-3v0z

for games@nl2k.ab.ca;

Mon, 07 Oct 2024 05:24:04 -0600

Received: by managergram.com.com (Postfix, from userid 33)

id 1CCEF46258; Mon, 7 Oct 2024 07:33:14 +0000 (UTC)

To: games@nl2k.ab.ca

Subject: =?UTF-8?B?TUVUVEVaIMOAIEpPVVJTIFZPUyBJTkZPUk1BVElPTlM=?=

Date: Mon, 7 Oct 2024 07:32:37 +0000

From: =?UTF-8?B?UGF5UGFs?=

Message-ID: <7c71a4e803ee170ef36ebf5cc0cb145a@compte.fr>

List-Unsubscribe: mailto:bounce395-lYl8gSaS9CCHRx9@compte.fr?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1099daa186988336b909c4951856f5eef"

X-Spam_score: 8.0

X-Spam_score_int: 80

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:   Bonjour,Une mise à jour de notre serveur a

été effectuée afin de vous garantir un meilleur service

et une meilleur sécurité.Pour terminer le processus de cell

[...]



Content analysis details: (8.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[45.80.215.157 listed in dnsbl.ahbl.org]

[45.80.215.157 listed in dnsbl.ahbl.org]

[45.80.215.157 listed in dnsbl.ahbl.org]

[45.80.215.157 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[45.80.215.157 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[45.80.215.157 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[45.80.215.157 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[45.80.215.157 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[45.80.215.157 listed in will-spam-for-food.eu.org]

[45.80.215.157 listed in will-spam-for-food.eu.org]

[45.80.215.157 listed in will-spam-for-food.eu.org]

[45.80.215.157 listed in will-spam-for-food.eu.org]

[45.80.215.157 listed in will-spam-for-food.eu.org]

[45.80.215.157 listed in will-spam-for-food.eu.org]

[45.80.215.157 listed in will-spam-for-food.eu.org]

[45.80.215.157 listed in will-spam-for-food.eu.org]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=managergram.com.com;ip=45.80.215.157;r=doctor.nl2k.ab.ca]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} =?UTF-8?B?TUVUVEVaIMOAIEpPVVJTIFZPUyBJTkZPUk1BVElPTlM=?=



This is a multi-part message in MIME format.



--1099daa186988336b909c4951856f5eef

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: base64



DQoNCg0KDQoNCg0KDQoNCg0KDQoNCiZuYnNwOw0KDQoNCg0KQm9uam91cixVbmUgbWlzZSAmYWdy

YXZlOyBqb3VyIGRlIG5vdHJlIHNlcnZldXIgYSAmZWFjdXRlO3QmZWFjdXRlOyBlZmZlY3R1JmVh

Y3V0ZTtlIGFmaW4gZGUgdm91cyBnYXJhbnRpciB1biBtZWlsbGV1ciBzZXJ2aWNlIGV0IHVuZSBt

ZWlsbGV1ciBzJmVhY3V0ZTtjdXJpdCZlYWN1dGU7LlBvdXIgdGVybWluZXIgbGUgcHJvY2Vzc3Vz

IGRlIGNlbGxlLWNpLHZvdXMgZGV2ZXogaW1wJmVhY3V0ZTtyYXRpdmVtZW50IG1ldHRyZSAmYWdy

YXZlOyBqb3VyIHZvcyBpbmZvcm1hdGlvbnMgc3VyIHZvdHJlIGNvbXB0ZSBwb3VyIHYmZWFjdXRl

O3JpZmllciBxdSdpbCBzJ2FnaXQgYmllbiBkZSB2b3VzIHNpbm9uIGlsIHNlcmEgYXVzc2l0Jm9j

aXJjO3QgYmxvcXUmZWFjdXRlOyBkYW5zIGxlcyAyNGggcXVpIHN1aXZlbnQuDQoNCg0KDQptZXR0

cmUgJmFncmF2ZTsgam91ciBtZXMgaW5mb21hcnRpb25zDQoNCg0KDQombmJzcDsNCg0KDQoNCiZj

b3B5O1BheXBhbCAyMDI0TWVyY2kgZGUgbmUgcGFzIHImZWFjdXRlO3BvbmRyZSAmYWdyYXZlOyBj

ZXQgZW1haWwuIE5vdXMgbmUgc29tbWVzIHBhcyBlbiBtZXN1cmUgZGUgciZlYWN1dGU7cG9uZHJl

IGF1eCBkZW1hbmRlcyBlbnZveSZlYWN1dGU7ZXMgJmFncmF2ZTsgY2V0dGUgYWRyZXNzZS4gUG91

ciBvYnRlbmlyIGRlcyByJmVhY3V0ZTtwb25zZXMgaW1tJmVhY3V0ZTtkaWF0ZXMgJmFncmF2ZTsg

dm9zIHF1ZXN0aW9ucywgdmlzaXRleiBub3RyZSBjZW50cmUgZCdhaWRlIGVuIGNsaXF1YW50IHN1

ciAiQWlkZSIgc2l0dSZlYWN1dGU7IHN1ciBuJ2ltcG9ydGUgcXVlbGxlIHBhZ2UgUGEgeVBhbCBv

dSBwYXIgZS1tYWlsLg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCiZuYnNwOw==





--1099daa186988336b909c4951856f5eef

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: base64



PHRhYmxlIGJvcmRlcj0iMCIgd2lkdGg9IjEwMCUiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGlu

Zz0iMCI+DQo8dGJvZHk+DQo8dHI+DQo8dGQgc3R5bGU9InZlcnRpY2FsLWFsaWduOiB0b3A7IGJh

Y2tncm91bmQtY29sb3I6ICNmZmZmZmY7IHBhZGRpbmc6IDBweDsiIGFsaWduPSJjZW50ZXIiPg0K

PHRhYmxlIHN0eWxlPSJtaW4td2lkdGg6IDQ4MHB4OyIgYm9yZGVyPSIwIiB3aWR0aD0iNDgwIiBj

ZWxsc3BhY2luZz0iMCIgY2VsbHBhZGRpbmc9IjAiPg0KPHRib2R5Pg0KPHRyPg0KPHRkIHN0eWxl

PSJ2ZXJ0aWNhbC1hbGlnbjogdG9wOyBtaW4td2lkdGg6IDQ4MHB4OyBwYWRkaW5nOiAwcHg7IiBh

bGlnbj0ibGVmdCI+PGltZyBzcmM9Imh0dHBzOi8vaGVpbmJhdmViLWY4Y2RjZi5pbmdyZXNzLWJh

cm9ubi5ld3AubGl2ZS93cC1jb250ZW50L3BsdWdpbnMvcHAxNDQucG5nIiBhbHQ9IiIgd2lkdGg9

IjE1MCIgaGVpZ2h0PSI5NCIgLz48YnIgLz4NCjx0YWJsZSBzdHlsZT0iaGVpZ2h0OiAyNTRweDsg

YmFja2dyb3VuZC1jb2xvcjogI2ZmZmZmZjsiIGJvcmRlcj0iMCIgd2lkdGg9IjQ4MCIgY2VsbHNw

YWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIiBhbGlnbj0iY2VudGVyIj4NCjx0Ym9keT4NCjx0ciBz

dHlsZT0iaGVpZ2h0OiA1cHg7Ij4NCjx0ZCBzdHlsZT0iaGVpZ2h0OiA1cHg7IHdpZHRoOiA0Nzcu

MzMzcHg7IHZlcnRpY2FsLWFsaWduOiB0b3A7IiBhbGlnbj0ibGVmdCI+Jm5ic3A7PC90ZD4NCjwv

dHI+DQo8dHIgc3R5bGU9ImhlaWdodDogMjA2cHg7Ij4NCjx0ZCBzdHlsZT0iZm9udC1zaXplOiAx

M3B4OyBib3JkZXItdG9wOiAxcHggc29saWQgI2U2ZTZlNjsgaGVpZ2h0OiAyMDZweDsgZm9udC1m

YW1pbHk6IEFyaWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IHdpZHRoOiA0MzcuMzMzcHg7IHZl

cnRpY2FsLWFsaWduOiB0b3A7IGNvbG9yOiAjMDAwMDAwOyBwYWRkaW5nLXRvcDogMjBweDsgcGFk

ZGluZy1sZWZ0OiAyMHB4OyBwYWRkaW5nLXJpZ2h0OiAyMHB4OyIgYWxpZ249ImxlZnQiPg0KPHA+

Qm9uam91ciw8YnIgLz48YnIgLz5VbmUgbWlzZSAmYWdyYXZlOyBqb3VyIGRlIG5vdHJlIHNlcnZl

dXIgYSAmZWFjdXRlO3QmZWFjdXRlOyBlZmZlY3R1JmVhY3V0ZTtlIGFmaW4gZGUgdm91cyBnYXJh

bnRpciB1biBtZWlsbGV1ciBzZXJ2aWNlIGV0IHVuZSBtZWlsbGV1ciBzJmVhY3V0ZTtjdXJpdCZl

YWN1dGU7LjxiciAvPlBvdXIgdGVybWluZXIgbGUgcHJvY2Vzc3VzIGRlIGNlbGxlLWNpLHZvdXMg

ZGV2ZXogaW1wJmVhY3V0ZTtyYXRpdmVtZW50IG1ldHRyZSAmYWdyYXZlOyBqb3VyIHZvcyBpbmZv

cm1hdGlvbnMgc3VyIHZvdHJlIGNvbXB0ZSBwb3VyIHYmZWFjdXRlO3JpZmllciBxdSdpbCBzJ2Fn

aXQgYmllbiBkZSB2b3VzIHNpbm9uIGlsIHNlcmEgYXVzc2l0Jm9jaXJjO3QgYmxvcXUmZWFjdXRl

OyBkYW5zIGxlcyAyNGggcXVpIHN1aXZlbnQuPGJyIC8+PGJyIC8+PC9wPg0KPHRhYmxlIGNsYXNz

PSJtXzMwMTg0MDgwMjM2MTU5Nzk3NDJzbS13LWZ1bGwiIHN0eWxlPSJ3aWR0aDogMjMycHg7IGZv

bnQtZmFtaWx5OiAnT3BlbiBTYW5zJywgUm9ib3RvLCB1aS1zYW5zLXNlcmlmLCAnU2Vnb2UgVUkn

LCBBcmlhbCwgLWFwcGxlLXN5c3RlbSwgc2Fucy1zZXJpZjsgaGVpZ2h0OiAzNXB4OyBtYXJnaW4t

bGVmdDogMTAwcHg7IiByb2xlPSJwcmVzZW50YXRpb24iIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFk

ZGluZz0iMCI+DQo8dGJvZHkgc3R5bGU9ImZvbnQtZmFtaWx5OiAnT3BlbiBTYW5zJyxSb2JvdG8s

dWktc2Fucy1zZXJpZiwnU2Vnb2UgVUknLEFyaWFsLC1hcHBsZS1zeXN0ZW0sc2Fucy1zZXJpZjsi

Pg0KPHRyIHN0eWxlPSJmb250LWZhbWlseTogJ09wZW4gU2FucycsUm9ib3RvLHVpLXNhbnMtc2Vy

aWYsJ1NlZ29lIFVJJyxBcmlhbCwtYXBwbGUtc3lzdGVtLHNhbnMtc2VyaWY7Ij4NCjx0aCBzdHls

ZT0iYm9yZGVyLXJhZGl1czogOTk5OXB4OyBmb250LWZhbWlseTogJ09wZW4gU2FucycsIFJvYm90

bywgdWktc2Fucy1zZXJpZiwgJ1NlZ29lIFVJJywgQXJpYWwsIC1hcHBsZS1zeXN0ZW0sIHNhbnMt

c2VyaWY7IGJhY2tncm91bmQtY29sb3I6IGJsdWU7IGJvcmRlcjogMXB4IHNvbGlkICMwMDc0NjE7

IHdpZHRoOiAyMjkuMzMzcHg7Ij48YSBzdHlsZT0idGV4dC1kZWNvcmF0aW9uOiBub25lOyBkaXNw

bGF5OiBibG9jazsgcGFkZGluZy10b3A6IDE4cHg7IHBhZGRpbmctYm90dG9tOiAxOHB4OyBmb250

LXNpemU6IDE0cHg7IGxpbmUtaGVpZ2h0OiAxMDAlOyBmb250LWZhbWlseTogJ09wZW4gU2Fucycs

Um9ib3RvLHVpLXNhbnMtc2VyaWYsJ1NlZ29lIFVJJyxBcmlhbCwtYXBwbGUtc3lzdGVtLHNhbnMt

c2VyaWY7IGNvbG9yOiAjZmZmZmZmOyIgaHJlZj0iaHR0cHM6Ly9zaXRlcy5nb29nbGUuY29tL3Zp

ZXcvenJldGVyL2hvbWUiIHRhcmdldD0iX2JsYW5rIiByZWw9Im5vb3BlbmVyIj5tZXR0cmUgJmFn

cmF2ZTsgam91ciBtZXMgaW5mb21hcnRpb25zPC9hPjwvdGg+DQo8L3RyPg0KPC90Ym9keT4NCjwv

dGFibGU+DQo8cCBzdHlsZT0idGV4dC1hbGlnbjogbGVmdDsiPiZuYnNwOzwvcD4NCjwvdGQ+DQo8

L3RyPg0KPHRyIHN0eWxlPSJoZWlnaHQ6IDQ4cHg7Ij4NCjx0ZCBzdHlsZT0iZm9udC1zaXplOiAx

MnB4OyBoZWlnaHQ6IDQzcHg7IGZvbnQtZmFtaWx5OiBBcmlhbCwgSGVsdmV0aWNhLCBzYW5zLXNl

cmlmOyB3aWR0aDogNDE3LjMzM3B4OyB2ZXJ0aWNhbC1hbGlnbjogdG9wOyBjb2xvcjogIzAwMDAw

MDsgYmFja2dyb3VuZC1jb2xvcjogI2VkZWRlZDsgcGFkZGluZzogMjBweCAzMHB4IDIzcHg7IiBh

bGlnbj0ibGVmdCI+PHNwYW4gaWQ9InAyOCI+PHNwYW4gaWQ9IjMxIj4mY29weTtQYXlwYWw8L3Nw

YW4+IDIwMjQ8L3NwYW4+PGJyIC8+TWVyY2kgZGUgbmUgcGFzIHImZWFjdXRlO3BvbmRyZSAmYWdy

YXZlOyBjZXQgZW1haWwuIE5vdXMgbmUgc29tbWVzIHBhcyBlbiBtZXN1cmUgZGUgciZlYWN1dGU7

cG9uZHJlIGF1eCBkZW1hbmRlcyBlbnZveSZlYWN1dGU7ZXMgJmFncmF2ZTsgY2V0dGUgYWRyZXNz

ZS4gUG91ciBvYnRlbmlyIGRlcyByJmVhY3V0ZTtwb25zZXMgaW1tJmVhY3V0ZTtkaWF0ZXMgJmFn

cmF2ZTsgdm9zIHF1ZXN0aW9ucywgdmlzaXRleiBub3RyZSBjZW50cmUgZCdhaWRlIGVuIGNsaXF1

YW50IHN1ciAiQWlkZSIgc2l0dSZlYWN1dGU7IHN1ciBuJ2ltcG9ydGUgcXVlbGxlIHBhZ2UgUGEg

eVBhbCBvdSBwYXIgZS1tYWlsLjwvdGQ+DQo8L3RyPg0KPC90Ym9keT4NCjwvdGFibGU+DQo8L3Rk

Pg0KPC90cj4NCjwvdGJvZHk+DQo8L3RhYmxlPg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90

YWJsZT4NCjxwPiZuYnNwOzwvcD4=







--1099daa186988336b909c4951856f5eef--