Shipping agent spam from Sophos

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 14 May 2022 15:22:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1npzCB-000OBS-H2

for dave@doctor.nl2k.ab.ca;

Sat, 14 May 2022 15:21:03 -0600

Resent-From: The Doctor

Resent-Date: Sat, 14 May 2022 15:21:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [36.36.13.2] (port=29361 helo=mx-02-eu-central-1.prod.hydra.sophos.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nput5-000Pnh-A9

for root@nk.ca;

Sat, 14 May 2022 10:45:09 -0600

Date: Sun, 15 May 2022 00:44:39 +0800 (CST)

From: globallogistics128

Sender: shuieuoyyz

To: root

Message-ID: <1971813472.2068591.1652546679286@mx-02-eu-central-1.prod.hydra.sophos.com>

Subject: Re: shipping agent sea freight 20GP/40HQ whole container to Usa

Europe

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear friendroot Have a nice day! Keyword : shipping service;

Air freight and sea freight;



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=shuieuoyyz%40rocast.ro;ip=36.36.13.2;r=doctor.nl2k.ab.ca]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[globallogistics128[at]yeah.net]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or

identical to background

0.0 HTML_OBFUSCATE_05_10 BODY: Message is 5% to 10% HTML obfuscation

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and

EnvelopeFrom freemail headers are

different

2.3 LONGLN_LOW_CONTRAST Excessively long line + hidden text

0.0 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS

0.7 NORDNS_LOW_CONTRAST No rDNS + hidden text

Subject: {SPAM?} Re: shipping agent sea freight 20GP/40HQ whole container to Usa

Europe




rgb(255, 255, 255)">
ont-size: 16px;">Dear friendroot


rgin-top:2px;line-height: 150%;background: rgb(255, 255, 255)">
=3D"font-family: Arial; line-height: 150%; font-size: 16px;">Have a nice da=

y!


%;background: rgb(255, 255, 255)">


rgin-top:2px;line-height: 150%;background: rgb(255, 255, 255)">
=3D"font-size: 16px;">
t: 150%; font-size: 14px;">Keyword : shipping service; Air freight and sea =

freight;


:2px;line-height: 150%;background: rgb(255, 255, 255)">
family: Arial; line-height: 150%; font-size: 16px;">Do you need shipping se=

rvice recently?


-height: 150%;background: rgb(255, 255, 255)">
rial; line-height: 150%; font-size: 16px;">I=E2=80=99m Ada ,shipping agent =

from china to worldwide.We offer the best Air freight / Sea freight(FCL&=

;LCL) / DDU&DDP / Express.


in-top:2px;line-height: 150%;background: rgb(255, 255, 255)">


yle=3D"margin-bottom:2px;margin-top:2px;line-height: 150%;background: rgb(2=

55, 255, 255)">
-family: Arial; line-height: 150%; font-size: 14px;"> Advantages:
trong>


150%;background: rgb(255, 255, 255)">
e-height: 150%; font-size: 16px;">1. cheapest prices with best service.(our=

company has founded over 10years.)


;margin-top:2px;line-height: 150%;background: rgb(255, 255, 255)">
le=3D"font-family: Arial; line-height: 150%; font-size: 16px;">2. Fast time=

of shipment


ight: 150%;background: rgb(255, 255, 255)">
l; line-height: 150%; font-size: 16px;">3. To door service


le=3D"margin-bottom:2px;margin-top:2px;line-height: 150%;background: rgb(25=

5, 255, 255)">
ze: 16px;">4. Multi - supplier goods shipping service


=3D"margin-bottom:2px;margin-top:2px;line-height: 150%;background: rgb(255,=

255, 255)">
: 16px;">
ext-align: justify;white-space: normal;background-color: rgb(255, 255, 255)=

">Location:Hongkong;Shenzhen=

;Guangzhou;Shanghai;Qingdao;Ningbo
ily: =E5=AE=8B=E4=BD=93;font-size: 12px;text-align: justify;white-space: no=

rmal;background-color: rgb(255, 255, 255)">=EF=BC=9B
=3D"font-family: =E5=AE=8B=E4=BD=93;font-size: 12px;text-align: justify;whi=

te-space: normal;background-color: rgb(255, 255, 255)">
family: Arial, sans-serif">Wuhan
y: =E5=AE=8B=E4=BD=93;font-size: 12px;text-align: justify;white-space: norm=

al;background-color: rgb(255, 255, 255)">=EF=BC=9B
"font-family: =E5=AE=8B=E4=BD=93;font-size: 12px;text-align: justify;white-=

space: normal;background-color: rgb(255, 255, 255)">
ily: Arial, sans-serif">Tianjin
: =E5=AE=8B=E4=BD=93;font-size: 12px;text-align: justify;white-space: norma=

l;background-color: rgb(255, 255, 255)">=EF=BC=9B
font-family: =E5=AE=8B=E4=BD=93;font-size: 12px;text-align: justify;white-s=

pace: normal;background-color: rgb(255, 255, 255)">
ly: Arial, sans-serif">Xiaman


bottom:2px;margin-top:2px;line-height: 150%;background: rgb(255, 255, 255)"=

>
trong style=3D"font-family: =E5=AE=8B=E4=BD=93;font-size: 12px;text-align: =

justify;white-space: normal;background-color: rgb(255, 255, 255)">
le=3D"font-family: Arial, sans-serif">


=3D"margin-bottom:2px;margin-top:2px;;font-family: 'Microsoft YaHei UI&=

#39;;white-space: normal;background-color: rgb(255, 255, 255);text-align: j=

ustify">
size: 12px;line-height: normal">Our agents are located in major cities in E=

urope and the United States.


;margin-top:2px;;font-family: 'Microsoft YaHei UI';white-space: nor=

mal;background-color: rgb(255, 255, 255);text-align: justify">
=3D"font-family:=E5=AE=8B=E4=BD=93">
ght: normal">In London, Paris, Hamburg, Frankfurt, Amsterdam, Madrid, Lisbo=

n, Antwerp, Poland, Los Angeles, San Francisco, Seattle, Chicago, Houston, =

New York and other relationships are more than 10 years.

<=

p style=3D"margin-bottom:2px;margin-top:2px;;font-family: 'Microsoft Ya=

Hei UI';white-space: normal;background-color: rgb(255, 255, 255);text-a=

lign: justify">


style=3D"margin-bottom:2px;margin-top:2px;;font-family: 'Microsoft YaH=

ei UI';white-space: normal;background-color: rgb(255, 255, 255);text-al=

ign: justify">
"font-size: 12px;line-height: normal">Can provide one-stop service. Door to=

door. US warehousing, customs clearance, truck delivery.

=


rgb(255, 255, 255)">
ont-size: 16px;">
: 12px;text-align: justify;white-space: normal;background-color: rgb(255, 2=

55, 255)">

ng>


: 150%;background: rgb(255, 255, 255)">


px;margin-top:2px;line-height: 150%;background: rgb(255, 255, 255)">
tyle=3D"font-size: 16px;">
; font-family: Arial;">If you need shipping service and have interested in =

that,pl
ze: 14px;">s
ght: 150%; font-size: 14px;">
Arial;">don
0%; font-size: 14px;">=E2=80=99
t-size: 16px; font-family: Arial;">t hesitate to contact with me.
pan>


ground: rgb(255, 255, 255)">
"font-family: Arial; line-height: 150%; font-size: 12px;">A
le=3D"line-height: 150%; font-size: 16px; font-family: Arial;">d
n style=3D"font-family: Arial; line-height: 150%; font-size: 12px;">a
>


background: rgb(255, 255, 255)">
ght: 150%; font-size: 16px;">Mobile/wechat/whatsapp:008613076952536
yle=3D"font-style:italic;color:#FFF;">sox7
italic;color:#FFF;">sox7


in-bottom: 2px;">



Chinese products spam from Barracuda

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 14 May 2022 15:19:07 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1npz9X-000Nx1-AY

for dave@doctor.nl2k.ab.ca;

Sat, 14 May 2022 15:18:19 -0600

Resent-From: The Doctor

Resent-Date: Sat, 14 May 2022 15:18:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [111.75.101.38] (port=16764 helo=d302253.a.ess.de.barracudanetworks.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1npsnZ-000BhI-7Y

for root@nk.ca;

Sat, 14 May 2022 08:31:17 -0600

Date: Sat, 14 May 2022 22:30:36 +0800 (CST)

From: huixricky5

Sender: spuieussqy

To: root

Message-ID: <467731822.864401.1652538636093@d302253.a.ess.de.barracudanetworks.com>

Subject: Re: Paper cups supplier to support you

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 6.7

X-Spam_score_int: 67

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear manager. we Are a export company in China . Do below

service : 1. all Kind of Plastic Straws . and wrapped in Paper or Cello. Also

Art straws.



Content analysis details: (6.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[111.75.101.38 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=spuieussqy%40ksn.com;ip=111.75.101.38;r=doctor.nl2k.ab.ca]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[huixricky5[at]yeah.net]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and

EnvelopeFrom freemail headers are

different

0.0 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS

Subject: {SPAM?} Re: Paper cups supplier to support you



Dear manager.


"margin-top:2px;margin-bottom:2px;">


gin-bottom:2px;">we Are a export company in China . Do below service :

<=

p style=3D"margin-top:2px;margin-bottom:2px;">1. all Kind of Plastic Straws=

. and wrapped in Paper or Cello. Also Art straws.


p:2px;margin-bottom:2px;">2. Paper cups ,Double Wall .Ripple wall cups and =

ice Cream cups .Soup Cups ,Vending cups


n-bottom:2px;">3. We have good Price on PS LIDS. PP Coffee Lids .


le=3D"margin-top:2px;margin-bottom:2px;">4. Small OEM Logo Spoon. Fruit For=

k.

5. PET Plastic Cups fr=

om all size

6.We can pay =

the Mold cost if you have new item and can not find good factory for you.
p>



n-top:2px;margin-bottom:2px;">Any requirements . Please feel free to contac=

t me . and we can send you catalog.


ttom:2px;">

Best Reg=

ards

Contact : Jeff Chu,<=

/p>

Mobile No.: +86 155793668=

0

Company: Shangrao Ecopa=

k Co.,Ltd.

It is not we w=

ant to earn your money, just need your money to move your things more fast.=




Nigerian spam from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 14 May 2022 06:42:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1npr5H-0001DM-2b

for dave@doctor.nl2k.ab.ca;

Sat, 14 May 2022 06:41:23 -0600

Resent-From: The Doctor

Resent-Date: Sat, 14 May 2022 06:41:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f68.google.com ([209.85.128.68]:51761)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1npoKj-0005bk-VJ

for root@doctor.nl2k.ab.ca;

Sat, 14 May 2022 03:45:40 -0600

Received: by mail-wm1-f68.google.com with SMTP id q20so5987168wmq.1

for ; Sat, 14 May 2022 02:44:52 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=message-id:mime-version:subject:to:from:date:reply-to;

bh=scQcx9Pdew1o5z+V4BlbcSvURScZBPjfkTQ7fppZgws=;

b=FJJP9jrSptyGgpYE98YF/gOzcd7vp13tvdMLXXXKp2khbGSXKzy49XuqfAENP2QHWq

I0vx0n7wrLwwsTkvJseRRI2eiYV86k90Stn9wSd9s6D47P48eU3uJS8hBpUZ/0fHzNR0

cRt/JveohgHNy5/zCFfDyIz3MfzodHVw3QvCvv8DDXPp7MyghkzdI+YJobXzfjdna9kx

vd4xmIoKnWz+eUdmnXOUrA7U+1IkVHTgTo4u80dotICJbgXtzl2kJf1FbBUk/2FehVAC

Slz5haPtzJzwdGU1rt4TZztk4se/8ct0E5bwbC4YhKGYwgJe0YHQ5v0lhHN1TLRpkNiY

1EyA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:message-id:mime-version:subject:to:from:date

:reply-to;

bh=scQcx9Pdew1o5z+V4BlbcSvURScZBPjfkTQ7fppZgws=;

b=in3Px+PoBXtfSZ8W/8aYrJ36fQiGEgYPqE3rA8Zt/GHFuaS9r9KF6zsCqC2/RKGMyr

uFsGhXAjwq2yAk792iZ1R+FbTXFhfJseg2AH02m0T12otLhb8mG4nhn7t+2tac+HVIBV

sOI1SDN5TOxPmXCDXVfb0hIYF0XdvdR0XjddImluY1dIcBTaS+/U4fJC4PBU4wKX8ffg

REliI4zd7K72Wqzx5b98aPhOO+XwlUV747NLaBOhqWV5cV0BbmjzM9wtZQPhEIgnEjCK

ue89KZu4T5GvjjLc2wYJImZrNo4/OF9MdLwrL+eNrIrRw8VU7jml/9tdRpCSvT91OPfk

NvTA==

X-Gm-Message-State: AOAM532Hisk5ryyyON33X/HCTt8efIKNB/1TGKdNVRHFVhG+E0PMgfIN

8uIqh9PK4UD+nwqBfhjOVH8=

X-Google-Smtp-Source: ABdhPJzNV1x1IPhfTD+FsKHWJF+g/HKYgz7bBpqNzgaFd1uB0Z4KWWiSvg10glCZTXCj6dHoXjeqNA==

X-Received: by 2002:a1c:acc4:0:b0:392:9dd4:fbcc with SMTP id v187-20020a1cacc4000000b003929dd4fbccmr8043636wme.78.1652521485832;

Sat, 14 May 2022 02:44:45 -0700 (PDT)

Received: from [192.168.8.155] ([41.58.245.34])

by smtp.gmail.com with ESMTPSA id p10-20020a1c544a000000b003942a244ecasm4663702wmi.15.2022.05.14.02.44.37

(version=TLS1 cipher=AES128-SHA bits=128/128);

Sat, 14 May 2022 02:44:45 -0700 (PDT)

Message-ID: <627f7a0d.1c69fb81.e0c5d.5ca7@mx.google.com>

Content-Type: multipart/alternative; boundary="===============0747385880=="

MIME-Version: 1.0

Subject: FUNDS TRANSFER

To: Recipients

From: "FUNDS TRANSFER"

Date: Sat, 14 May 2022 17:44:28 +0800

Reply-To: williamhrogersjr@outlook.com

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Head of International Operations, Sun Trust Bank - USA Address:

N Street NE Washington, DC 20002 USA. Dear Beneficiary With all due respect,

This particular letter is strictly confidential and only fo [...]



Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.68 listed in wl.mailspike.net]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[mrdavidmorris707[at]gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[mrdavidmorris707[at]gmail.com]

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

0.7 MONEY_FROM_41 Lots of money from Africa

0.3 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 XFER_LOTSA_MONEY Transfer a lot of money

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} FUNDS TRANSFER



You will not see this in a MIME-aware mail reader.

--===============0747385880==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body



Head of International Operations, Sun Trust Bank - USA Address: N Street NE=

Washington, DC 20002 USA. Dear Beneficiary With all due respect, This part=

icular letter is strictly confidential and only for your perusal. Based on =

your inability to complete your claim from your previous transactions, we h=

ave been officially appointed by World Bank - Switzerland to release the al=

ready ear-marked (assigned) sum of (US$10,500,000.00) to you as a form of s=

ettlement of debt. Officially, you are the true beneficiary to the stated s=

um. The US Treasury Department and the Securities/Exchange Commission are c=

ollectively ready to APPROVE and ORDER for the immediate swift wire transfe=

r of your due funds via Telegraphic Transfer/Telex Transfer (Swift). As a m=

atter of fact, we are ready to affect the onward remittance of your due fun=

d but your partner/representative (Mr. Donald Parker) from Georgia has advi=

sed us to transfer your fund into his own personal account. The mentioned p=

erson (Mr. Donald Parker) said that you authorized him to help you collect =

your due fund from this bank. And he is ready to pay a transfer fee of $750=

to get this done. And we receive an alert that a fake scammer has extorted=

some money from you already, please we advise you to stop any further comm=

unication with them. Please confirm to us if we should release your due fun=

d to your partner/representative (Mr. Donald Parker). We hereby anticipate =

your swift response because this is urgent. Sealed, Mr. William H. Rogers, =

Jr. Chairman and Chief Executive Officer. Sun Trust Bank - USA (Privacy Pol=

icy, Terms, Satisfaction and Banking Accuracy)

--===============0747385880==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body




=3Diso-8859-1"/>Head of International Operations,

Sun Trust Bank - USA

Address: N Street NE Washington,

DC 20002 USA.







Dear Beneficiary

With all due respect,



This particular letter is strictly confidential and only for your perusal.



Based on your inability to complete your claim from your previous transacti=

ons, we have been officially appointed by World Bank - Switzerland to relea=

se the already ear-marked (assigned) sum of (US$10,500,000.00) to you as a =

form of settlement of debt. Officially, you are the true beneficiary to the=

stated sum. The US Treasury Department and the Securities/Exchange Commiss=

ion are collectively ready to APPROVE and ORDER for the immediate swift wir=

e transfer of your due funds via Telegraphic Transfer/Telex Transfer (Swift=

).



As a matter of fact, we are ready to affect the onward remittance of your d=

ue fund but your partner/representative (Mr. Donald Parker) from Georgia ha=

s advised us to transfer your fund into his own personal account. The menti=

oned person (Mr. Donald Parker) said that you authorized him to help you co=

llect your due fund from this bank. And he is ready to pay a transfer fee o=

f $750 to get this done. And we receive an alert that a fake scammer has ex=

torted some money from you already, please we advise you to stop any furthe=

r communication with them.



Please confirm to us if we should release your due fund to your partner/rep=

resentative (Mr. Donald Parker). We hereby anticipate your swift response b=

ecause this is urgent.



Sealed,

Mr. William H. Rogers, Jr.

Chairman and Chief Executive Officer.

Sun Trust Bank - USA

(Privacy Policy, Terms, Satisfaction and Banking Accuracy)

--===============0747385880==--

Urgency spam from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 14 May 2022 06:40:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1npr3P-0000y2-8S

for dave@doctor.nl2k.ab.ca;

Sat, 14 May 2022 06:39:27 -0600

Resent-From: The Doctor

Resent-Date: Sat, 14 May 2022 06:39:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 22.146.185.35.bc.googleusercontent.com ([35.185.146.22]:41212 helo=mail.etech2u.net)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nppLl-000AU8-0z

for root@nk.ca;

Sat, 14 May 2022 04:50:27 -0600

Received: from [185.239.242.61] (unknown [185.239.242.61])

by mail.etech2u.net (Postfix) with ESMTP id B7A28356F091;

Sat, 14 May 2022 06:32:23 +0800 (CST)

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: KINDLY REPLY ASAP.

To: Recipients

From: "Alfred Robert"

Date: Fri, 13 May 2022 23:32:16 -0700

Reply-To: desires@currently.com

X-Spam_score: 18.5

X-Spam_score_int: 185

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Dear, I am sorry to encroach into your privacy in this

manner, I found you listed in the Trade Center Chambers of Commerce directory

here and I find it pleasurable to offer you my partnership in business. I

[...]



Content analysis details: (18.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[35.185.146.22 listed in psbl.surriel.com]

0.0 TVD_RCVD_IP Message was received from an IP address

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.185.146.22 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[35.185.146.22 listed in wl.mailspike.net]

1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)

[35.185.146.22 listed in ix.dnsbl.manitu.net]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is

CUSTOM_MED

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[ardocumtn[at]gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received'

headers

1.1 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.1 MISSING_MID Missing Message-Id: header

3.2 FOUND_YOU I found you...

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing

list

0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

1.9 SPOOFED_FREEMAIL No description available.

0.4 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...

Subject: {SPAM?} KINDLY REPLY ASAP.



Hello Dear,



I am sorry to encroach into your privacy in this manner, I found you listed=

in the Trade Center Chambers of Commerce directory here and I find it plea=

surable to offer you my partnership in business. I only pray at this time t=

hat your address is still valid. I want to solicit your attention to receiv=

e money on my behalf. I am Capt. Alfred Robert, an officer in the USA Army =

and also a West Point Graduate presently serving in the Military with the 8=

2nd Air Borne Division Peace keeping force.



I really need your help in assisting me with the safe keeping of Two Milita=

ry Trunk Boxes. I hope you can be trusted? If you can be trusted, I will e=

xplain further when i get a response from you for further clarification.



Thanks for your cooperation, God bless you and America !!



Best Regards

Capt. Alfred Robert

US ARMY

Chinese products spam from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 14 May 2022 06:40:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1npr33-0000vB-At

for dave@doctor.nl2k.ab.ca;

Sat, 14 May 2022 06:39:05 -0600

Resent-From: The Doctor

Resent-Date: Sat, 14 May 2022 06:39:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [183.240.8.52] (port=21411 helo=alt1.aspmx.l.google.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1npksT-000Edg-Et

for sales@nk.ca;

Sat, 14 May 2022 00:03:58 -0600

Date: Sat, 14 May 2022 14:12:33 +0800 (CST)

From: kenshippingagent

Sender: aakiup

To: sales

Message-ID: <2067162103.2474685.1652508753584@alt1.aspmx.l.google.com>

Subject: RE: air freight and sea freight from China to your country with

cheap rates

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 12.3

X-Spam_score_int: 123

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear sales Our shipping services can reduce your 1/5 purchase

cost exactly under the same quality conditions. If you have big order,we

just promise shipping cost is better for your current supplier.



Content analysis details: (12.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[183.240.8.52 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[kenshippingagent[at]163.com]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or

identical to background

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and

EnvelopeFrom freemail headers are

different

0.6 PDS_HP_HELO_NORDNS High profile HELO with no sender rDNS

2.3 LONGLN_LOW_CONTRAST Excessively long line + hidden text

0.0 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS

0.7 NORDNS_LOW_CONTRAST No rDNS + hidden text

1.9 SPOOFED_FREEMAIL No description available.

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: 6.best]

Subject: {SPAM?} RE: air freight and sea freight from China to your country with

cheap rates





top:2px;margin-bottom:2px;">
Arial',sans-serif">Dear sales


;margin-bottom:2px;">


">Our=

shipping services  can reduce your 1/5 purchase cost exactly under th=

e same quality conditions.


om:2px;">


e=3D"font-size:16px;font-family:'Arial',sans-serif">If you have big=

order,we just promise shipping cost is better for your current supplier.
span>


-size:16px;font-family:'Arial',sans-serif">If you have not big orde=

r, I sure you will get a reliable agent with no need to pay much effort.
pan>


size:16px;font-family:'Arial',sans-serif">l am ken, l am China ship=

ping agent, we are provide shipping services from China to your country wit=

h best rates.



>



rgin-top:2px;margin-bottom:2px;">
'Arial',sans-serif">Why work with us ?


-top:2px;margin-bottom:2px;">


tom:2px;">
rif">1, TOP5 International Forwarding Company=

from China to Worldwide;


n-bottom:2px;">
ns-serif">2, Ability to handle cargo from any city in china & consolida=

tion service


style=3D"font-size:16px;font-family:'Arial',sans-serif">3, Profess=

ional team guarantee to our customers good services .


=3D"margin-top:2px;margin-bottom:2px;">
amily:'Arial',sans-serif">4, Provide the cost effective and time ef=

fective shipping solution, and the competitive rates .


=3D"margin-top:2px;margin-bottom:2px;">
amily:'Arial',sans-serif">5.We have twenty years experience of Amaz=

on FBA  Door to Door DeliveryService with high reputation among the in=

dustry.


e=3D"font-size:16px;font-family:'Arial',sans-serif">6.Best service =

at the most reasonable price is always our company benefit. We believe long=

term business relationship is built on each transaction's satisfaction=

.



e=3D"margin-top:2px;margin-bottom:2px;">


;margin-bottom:2px;">
39;,sans-serif">Our main Services as below:


p:2px;margin-bottom:2px;">
ial',sans-serif">FBA amazon Shipping service


in-top:2px;margin-bottom:2px;">
39;Arial',sans-serif">Sea freight,


;margin-bottom:2px;">
39;,sans-serif">Air freight ,


ottom:2px;">
serif">Customs brokerage,


m:2px;">
f">Door to door delivery,


m:2px;">
f">Warehousing,


pan style=3D"font-size:16px;font-family:'Arial',sans-serif">Commodi=

ty inspection,


an style=3D"font-size:16px;font-family:'Arial',sans-serif">Export l=

icence,


e=3D"font-size:16px;font-family:'Arial',sans-serif">Inland transpor=

tation


=3D"font-size:16px;font-family:'Arial',sans-serif">Shipping insuran=

ce.


"font-size:16px;font-family:'Arial',sans-serif"> If you want more d=

etails,you can add my contact:


bottom:2px;">
-serif;color:#70AD47">Mobile (WhatsApp/Wechat):  0086 15801639260
n>


-style:italic;color:#FFF;">1tu0
r:#FFF;">1tu0But they=

did not show it and they spoke politely about t



Chinese Spam from Barracuda

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 14 May 2022 06:38:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1npr1e-0000Y4-Af

for dave@doctor.nl2k.ab.ca;

Sat, 14 May 2022 06:37:38 -0600

Resent-From: The Doctor

Resent-Date: Sat, 14 May 2022 06:37:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [125.115.106.209] (port=3075 helo=d264714b.ess.barracudanetworks.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1npiSM-0002RE-GF

for sales@nk.ca;

Fri, 13 May 2022 21:28:52 -0600

Date: Sat, 14 May 2022 11:28:17 +0800 (CST)

From: aplifts

Sender: uqbpkl

To: sales

Message-ID: <1299432679.424133.1652498897936@d264714b.ess.barracudanetworks.com>

Subject: =?UTF-8?Q?Re:_Pallet=C2=A0Truck,_Stacker,?=

=?UTF-8?Q?_Lift=C2=A0Table_=C2=A0and=C2=A0_Forklift?=

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 9.1

X-Spam_score_int: 91

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Sir, Hope you’re doing well! Aplifts factory was founded

in August 1993, it’s a professional and reliable Material Handling Equipment

company...



Content analysis details: (9.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

DNSWL was blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[125.115.106.209 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[125.115.106.209 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=uqbpkl%40krishibank.org.bd;ip=125.115.106.209;r=doctor.nl2k.ab.ca]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[aplifts[at]163.com]

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and

EnvelopeFrom freemail headers are

different

0.0 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS

Subject: {SPAM?} =?UTF-8?Q?Re:_Pallet=C2=A0Truck,_Stacker,?=

=?UTF-8?Q?_Lift=C2=A0Table_=C2=A0and=C2=A0_Forklift?=



Dear Sir,


gin-top:2px;margin-bottom:2px;">


bottom:2px;">Hope you=E2=80=99re doing well!


margin-bottom:2px;">


>Aplifts factory was founded in August 1993, it=E2=80=99s a professional an=

d reliable Material Handling Equipment company...


:2px;margin-bottom:2px;">


2px;">Below is some of our best seller products for your reference.


tyle=3D"margin-top:2px;margin-bottom:2px;">


2px;margin-bottom:2px;">

=

Hand Pallet Truck=09    &n=

bsp;                     =

USD115.00/PC FOB NINGBO=09  
>

Manual Stacker 1.0T, 1.6M
pan style=3D"white-space:pre">=09         U=

SD410.00/PC FOB NINGBO =09  
>

Semi-electric Stacker 1.0T,=

1.6M=09 USD1100.00/PC FOB NING=

BO=09  


op:2px;margin-bottom:2px;">Full Electric Stacker 1.0T, 1.6M
hite-space:pre">=09 USD1910.00/PC FOB NINGBO
e-space:pre">=09  


2px;">Full Electric Pallet Truck=09&=

nbsp;                USD800.00/PC F=

OB NINGBO=09


top:2px;margin-bottom:2px;">


om:2px;">So if you are interested in our products, please feel free to cont=

act us, thanks!


=

Best regards!


"margin-top:2px;margin-bottom:2px;">Jay Hope


margin-bottom:2px;">Sales Director


tom:2px;">Zhejiang Aplifts Machinery Co., Ltd


;margin-bottom:2px;">Jiangshan Town, Yinzhou District, Ningbo, Zhejiang Pro=

vince 315000, China

Tel: =

+86-574-2558 2099

=3D=3D=

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D

If you li=

ke to removed from our mailing list,


ottom:2px;">Please reply with subject "REMOVE"


gin-top:2px;margin-bottom:2px;">We are sorry for the inconvenience


r/>



Chinese products spam from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 13 May 2022 20:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nphi6-000Nlq-W5

for dave@doctor.nl2k.ab.ca;

Fri, 13 May 2022 20:40:50 -0600

Resent-From: The Doctor

Resent-Date: Fri, 13 May 2022 20:40:50 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [39.83.79.172] (port=34309 helo=aspmx4.googlemail.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1npgua-000Jcz-Qh

for sales@nk.ca;

Fri, 13 May 2022 19:49:45 -0600

Date: Sat, 14 May 2022 09:50:18 +0800 (CST)

From: rdjdpart

Sender: hvvadi

To: sales

Message-ID: <1251860123.215019.1652493018161@aspmx4.googlemail.com>

Subject: Re:OEM metal parts for your products

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 11.3

X-Spam_score_int: 113

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, We are a professional manufacturer for hardware parts.

We have focused on the production of various metal parts, with casting and

machining for 16 years;



Content analysis details: (11.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 HK_RANDOM_FROM From username looks random

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[39.83.79.172 listed in bb.barracudacentral.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[39.83.79.172 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=hvvadi%40aiu.edu;ip=39.83.79.172;r=doctor.nl2k.ab.ca]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[rdjdpart[at]163.com]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and

EnvelopeFrom freemail headers are

different

0.0 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS

1.9 SPOOFED_FREEMAIL No description available.

Subject: {SPAM?} Re:OEM metal parts for your products



Hi,


p:2px;margin-bottom:2px;">


:2px;">      We are a professional manufacturer for hardware=

parts.



=3D"margin-top:2px;margin-bottom:2px;">       We have f=

ocused on the production of various metal parts, with casting and  mac=

hining for 16 years;



>

      &n=

bsp;If you are intereted in this , please feel free to send us the drawing =

for quoting.



style=3D"margin-top:2px;margin-bottom:2px;">


:2px;margin-bottom:2px;">


2px;">Best regards


<=

/p>

John




Chinese products spam possibly coming from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Fri, 13 May 2022 18:29:00 -0600

Received: from [139.205.200.221] (port=21376 helo=aspmx3.googlemail.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1npfeA-000Csd-7Q

for dave@nk.ca;

Fri, 13 May 2022 18:28:51 -0600

Date: Sat, 14 May 2022 08:28:14 +0800 (CST)

From: cdjfystainless

Sender: drcqceo

To: dave

Message-ID: <1641701513.1461609.1652488094829@aspmx3.googlemail.com>

Subject: RE: tube/bar/wire rope/sheet

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 14.6

X-Spam_score_int: 146

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear friend, We take this profound pleasure to introduce ourselves

with our superior quality stainless steel products. We take high quality

products, good faith and considerate service as our faith. F [...]



Content analysis details: (14.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[139.205.200.221 listed in psbl.surriel.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[139.205.200.221 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=drcqceo%40mipt.ru;ip=139.205.200.221;r=doctor.nl2k.ab.ca]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[cdjfystainless[at]163.com]

2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_OBFUSCATE_05_10 BODY: Message is 5% to 10% HTML obfuscation

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and

EnvelopeFrom freemail headers are

different

0.0 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS

1.9 SPOOFED_FREEMAIL No description available.

Subject: {SPAM?} RE: tube/bar/wire rope/sheet



Dear friend,
We take th=

is profound pleasure to introduce ourselves with our superior quality stain=

less steel products. We take high quality products, good faith and consider=

ate service as our faith. FREE SAMPLE is a=

vailable.


text-decoration:underline;">
llow">PIPES, TUBES:


om:2px;">
nd:lightgrey;background: lightgrey">Stainless steel seamless tube/pipe:
an>>Grades: 201B/H, 301, 302, 304/L, 310S, 316/L/H, 316Ti, 317/L,=

321/H, 2205, S31200, S31260, S31500, S31803, S32101, S32506, S32750, S3276=

0, S32906, TP309, 410/S, 430, 439, 446, 44660, 400, 600, 625, 800/H, 825, C=

276

>Standards: GB, AS=

TM, ASME, EN, DIN, JIS, GOST


x;">>Size: =CF=86=

: 0.32-610mm thickness: 0.08-35mm
serif; background-color: rgb(249, 250, 250);">>Surface condition: Bright=

Annedled, Mechanically Polished, Annealed And Pickled, Electro Polished
pan>


decoration:underline;">
tgrey">Stainless steel welded tube/pipe:


n-top:2px;margin-bottom:2px;">>Grades: 304/L/H/LN, 316/L/H/LN/Ti, 321/H,=

317/L/LN, 347/H, 310S/H, N08904(904L), S31803,S32205, S32750, S32760, N022=

00, N02201, N04400, N06600, N06690, N06625, N06985(G3), N08028, N08800, N08=

810, N08811, N08825

>S=

tandards: GB, ASTM, ASME, EN, DIN, JIS, GOST


margin-bottom:2px;">>Size:
=93">=CF=86: 12-3000mm thickness: 0.4-100mm


p:2px;margin-bottom:2px;">
style=3D"background:lightgrey;background: lightgrey">Stainless steel rectan=

gular / square tube/pipe:>Grades: 304/L/H, 316/L/H/Ti, 321=

/H

>Standards: GB, AST=

M, ASME, EN, DIN, JIS, GOST


;">>Size: 10*10-400*400mm x 0.5-30mm


n-bottom:2px;">20*30-50*100mm x 0.8-3.0mm


gin-bottom:2px;">
background:yellow;background: yellow">BARS:


rgin-top:2px;margin-bottom:2px;">>Grades: 304/L, 316/L, S30815, 410, 420=

, 4130, 4140, 4145H, T5BA, P20, etc.


ottom:2px;">>Material: stainless steel, structural alloy steel, tool&=

; die steel, nickel alloy, copper alloy


n-bottom:2px;">>Standards: GB, ASTM, ASME, EN, DIN, JIS, GOST


e=3D"margin-top:2px;margin-bottom:2px;">>Size:
y: =E5=AE=8B=E4=BD=93">=CF=86: 5.5-1000mm


2px;margin-bottom:2px;">>Surface condition: Black surface, bright surfac=

e


oration:underline;">ST=

AINLESS STEEL WIRE/ ROPE:


n-bottom:2px;">>Grades: 300 series, 400 series


:2px;margin-bottom:2px;">>Structure:1*3,3*7,7*7,1*19,1*7,6*7-wsc,6*19-WS=

C,6*19S-IWRC,6*19W-IWRC,6*25FI-WRC,6*26WS-IWRC,6*31WS-IWRC,8*19S-IWRC,8*19W=

-IWRC,8*25FI-IWRC,8*26WS-IWRC,8*31WS-IWRC,8*19W-IWRC,8*25FI-IWRC, 8*26WS-IW=

RC, 8*31WS-IWRC

>Size:=

=CF=86: 0.18-60mm<=

/p>

>Application: control,=

aeronautical, aviation, textile, machinery, automobile, hardware, medical,=

decoration, leisure and other military, industrial and civil fields


style=3D"margin-top:2px;margin-bottom:2px;">
underline;">SHEET/PLAT=

E:

> Gra=

des: 300 series, 400 series


;">>Size: Hot rolled plate: 3.0~200.0x
=8B=E4=BD=93">=E2=89=A42500x
=BD=93">=E2=89=A4L=EF=

=BC=88mm=EF=BC=89
an>

Cold =

rolled sheet: 0.8~4.5x600~1050x
=93">=E2=89=A42400=EF=

=BC=88mm=EF=BC=89
an>

>Standards: GB, AS=

TM, ASME, EN, DIN, JIS, GOST


x;">

It would be our=

pleasure to begin a business relationship with you and supply your stores =

with our quality products.


">

Best Wishes


style=3D"margin-top:2px;margin-bottom:2px;">
.3333px; background-color: transparent;">Sales Department


yle=3D"margin-top: 2px; margin-bottom: 2px;">Sunny