Restaurant listing spam from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 May 2022 13:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ns8kd-0002ft-L2

for dave@doctor.nl2k.ab.ca;

Fri, 20 May 2022 13:57:31 -0600

Resent-From: The Doctor

Resent-Date: Fri, 20 May 2022 13:57:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-io1-f66.google.com ([209.85.166.66]:35608)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ns6MR-0007X4-6D

for sales@nk.ca;

Fri, 20 May 2022 11:24:27 -0600

Received: by mail-io1-f66.google.com with SMTP id f4so9426138iov.2

for ; Fri, 20 May 2022 10:24:02 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=techuserspro-com.20210112.gappssmtp.com; s=20210112;

h=from:to:references:in-reply-to:subject:date:message-id:mime-version

:thread-index:content-language;

bh=3+qjq0QG7Zphn4V3VIEQBCvFTwsBfkYhbdr45CWfARU=;

b=KX3hUoua0OfIxf9tYpilDHxOiO/C265ioCrfdPdgJTRPFVCUDPZVEDVU5H5h1H4kct

2CILfBJ+wj+BOYQ5UEozMXRuLqKbJ+y6GICH9Ql8HLAKfh0UtnbtC1VBoYlVJw/WkS4F

vM42b0/zk+WLBddQ9zxZbGCMDDb8wIq2OkExkSQZrrr2OFMwdaPnouxit6TtchUQ3v1i

nzz+N2TxvBIfH5cu9g6zfMLr2xiNIYz45ge1W6+Rc5E6HpDOVP3AQ6E1qve3UIYMput+

gphw1LBmpjI9dsi+UJY3fZ3ghzGNp606Dt3HtJ1+QYMSSHztJgO7dll88pM1Ejd0fpjJ

fNEw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:from:to:references:in-reply-to:subject:date

:message-id:mime-version:thread-index:content-language;

bh=3+qjq0QG7Zphn4V3VIEQBCvFTwsBfkYhbdr45CWfARU=;

b=QhdCAZfLCW7BqjYjUqB0ES+I8BQM3WvzFwan22C5bOvriUGED7FVH3BARqpEeOT+xE

L+xtinyqY1/S7IG46glY/k4sOYHzb7TlXLYzVml0LxgXfC/qJ2/kc45JUDsdXdPNlBmB

mb9amvOIOvbB2zb/o5TQs3cHYdp0pP6PJbc4lobeu2gmYGSloS8iXOcgllGHjQXz3tBR

0w3U+Hx+Mk4an0Ay0u8OpCkb84HrwvJzkraQazhh5H0S63EUpq0i5EvGozuDkviSl4ls

Ljs6LwTbrhH22gj73jAfwJqWPQ0M19ySDsedLAsMhnZ3Pyy7PhQhkOCwhHJjyOeConcX

Runw==

X-Gm-Message-State: AOAM533fe9yScDZ5xbm/OX7i7DIZHQ4qD+f4TXPg7sImxWcutUGDzp6+

xs5n2dwmfvRBfXW5rPe7ompWSFdZV7Wrbf3CKeo=

X-Google-Smtp-Source: ABdhPJxJ6oCDxRTd7W95qbFUZK/GBn0gK+sp3q48JGoDbuviXeu5ARn7GzVgaMGTdAaSxXWBFZW6aQ==

X-Received: by 2002:a05:6602:13c2:b0:65d:bc5a:ae30 with SMTP id o2-20020a05660213c200b0065dbc5aae30mr5415814iov.1.1653067436082;

Fri, 20 May 2022 10:23:56 -0700 (PDT)

Received: from userPC ([154.6.20.218])

by smtp.gmail.com with ESMTPSA id p13-20020a6b8d0d000000b0065e4641e78asm1312700iod.31.2022.05.20.10.23.51

for

(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);

Fri, 20 May 2022 10:23:55 -0700 (PDT)

From: "Amanda Medel"

To:

References:

In-Reply-To:

Subject: TRA Marketplace Attendees Contact Database

Date: Fri, 20 May 2022 12:23:17 -0500

Message-ID: <2f0701d86c6e$62535360$26f9fa20$@techuserspro.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_2F08_01D86C44.797E0EB0"

X-Mailer: Microsoft Outlook 15.0

Thread-Index: AdhsSxc23qC1KmJMQlO+VsETPfeL5AAIxDBgAAAAE7AAAAAMEAAAAAzQAAAADAAAAAAMMAAAAAwAAAAADPAAAAAL8AAAAAzwAAAADeAAAAAMQAAAAAsQAAAADBAAAAANAAAAAAwwAAAADjAAAAAOYAAAAAyAAAAADlAAAAAPEAAAAA8QAAAADgAAAAAQ0AAAABeQAAAAE8AAAAATIAAAABPgAAAAE9AAAAAToAAAABCQAAAAE1AAAAANsAAAAA4gAAAAD+AAAAAO4AAAAA1wAAAADtAAAAANYAAAAA/wAAAADvAAAAANsAAAAA7gAAAADrAAAAAOQAAAABPQAAAAEmAAAAAP8AAAABAgAAAAEFAAAAASsA==

Content-Language: en-us



This is a multipart message in MIME format.



------=_NextPart_000_2F08_01D86C44.797E0EB0

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,







I think you might be interested in acquiring the attendees contact database

of Texas Restaurant Association Marketplace 2022? And there will be a cost

associated with the database.







Attendees: Independent operators, Franchisees, Franchisors, Corporate

executives, Chefs, Unit managers, Restaurateurs, Institutional food service

providers, Hotels, Caterers and more...







Please let me know if you are interested and I will get back to you with

count and pricing information.







I look forward to hearing from you.







Thanks & Regards,



Amanda Medel | Marketing Executive.







To remove, kindly respond with "Exit".













------=_NextPart_000_2F08_01D86C44.797E0EB0

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
http-equiv=3DContent-Type content=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">
link=3D"#0563C1" vlink=3D"#954F72">


class=3DMsoNormal>
style=3D'color:black'>Hi,


class=3DMsoNormal>
style=3D'color:black'> 


class=3DMsoNormal>I think you might be =

interested in acquiring the attendees contact database of Texas =

Restaurant Association Marketplace 2022? And there will be a cost =

associated with the database.


class=3DMsoNormal>
style=3D'color:black'> 


class=3DMsoNormal>Attendees: =

Independent operators, Franchisees, Franchisors, Corporate executives, =

Chefs, Unit managers, Restaurateurs, Institutional food service =

providers, Hotels, Caterers and more...


class=3DMsoNormal>
style=3D'color:black'> 


class=3DMsoNormal>Please let me know if you =

are interested and I will get back to you with count and pricing =

information.


style=3D'color:black'> 


class=3DMsoNormal>I look forward to hearing =

from you.


style=3D'color:black'> 


class=3DMsoNormal>Thanks & =

Regards,


style=3D'color:black'>Amanda Medel | Marketing =

Executive.


style=3D'color:#1F4E79;mso-style-textfill-fill-color:#1F4E79;mso-style-te=

xtfill-fill-alpha:100.0%'> 


class=3DMsoNormal>
style=3D'font-size:10.0pt;color:#7F7F7F;mso-style-textfill-fill-color:#7F=

7F7F;mso-style-textfill-fill-alpha:100.0%'>To remove, kindly respond =

with "Exit".


class=3DMsoNormal> 


class=3DMsoNormal> 



------=_NextPart_000_2F08_01D86C44.797E0EB0--



Phish attempt from Germany

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 May 2022 13:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ns8iK-0002Zy-Ry

for dave@doctor.nl2k.ab.ca;

Fri, 20 May 2022 13:55:08 -0600

Resent-From: The Doctor

Resent-Date: Fri, 20 May 2022 13:55:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from srv.legenditds.com ([5.9.106.86]:58084)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ns4wK-0002eT-D5

for sales@nk.ca;

Fri, 20 May 2022 09:53:27 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=surabhitek.com; s=default; h=Content-Type:MIME-Version:Message-ID:Date:

Subject:To:From:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=Odl8dMB8Gm5v/VW3VjErsEuwYERERMXOSXeFgOeJcWA=; b=VvqNQIwJDlc7dPWR7Lt8B2M+SV

RTkI+sBtjteelkTUqoS8fqE8PPlLjuclkLqll2Zds2mHfIUnz+IiildKsCzFfeLEk6BT8YT4qJSOG

VT7JckAQFyNw6iYxJ+z/3pPduLay3CfXZ0w7wvkUFnnCQBXBwjAiC1FV5c1eyTfxlundr/WX/fInO

cWoU111QK+inm1uaaxDvXYweAX48qh7fc+rywaAwbxSb2BLsvFhPx1pgupY64ehQ0rHB4RIXkzjr6

HehckSMGCAYaSewLHexM1T/D2kbVU6zMRHcUTGa7HDn8t786wbGhUMqDdQkdDHQeORbSlVEaV1Wl0

3ezEbOwQ==;

Received: from [107.172.59.37] (port=63063 helo=njrich.com)

by srv.legenditds.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95)

(envelope-from )

id 1ns4vw-000115-6O

for sales@nk.ca;

Fri, 20 May 2022 21:22:56 +0530

From: "@nk.ca"

To: sales@nk.ca

Subject: Dangerous virus attachment found

Date: 20 May 2022 08:52:59 -0700

Message-ID: <20220520085258.0B60E223CEE571F9@nk.ca>

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0012_B6A1EB3B.8DEA482C"

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - srv.legenditds.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - nk.ca

X-Get-Message-Sender-Via: srv.legenditds.com: authenticated_id: ashok@surabhitek.com

X-Authenticated-Sender: srv.legenditds.com: ashok@surabhitek.com

X-Source:

X-Source-Args:

X-Source-Dir:





------=_NextPart_000_0012_B6A1EB3B.8DEA482C

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable












GIN: 0px; PADDING-RIGHT: 0px" bgcolor=3D"#FFFFFF">


=3D"0" cellpadding=3D"0" width=3D"100%" border=3D"0">

















ellspacing=3D"0" cellpadding=3D"0" border=3D"0">








R>


8,220,224) thin solid; BORDER-RIGHT: rgb(218,220,224) thin solid; BORDER-BO=

TTOM: rgb(218,220,224) thin solid; PADDING-BOTTOM: 40px; PADDING-TOP: 40px;=

PADDING-LEFT: 20px; BORDER-LEFT: rgb(218,220,224) thin solid; PADDING-RIGH=

T: 20px; border-radius: 8px" align=3Dcenter>


rial, sans-serif; BORDER-BOTTOM: rgb(218,220,224) thin solid; PADDING-BOTTO=

M: 24px; TEXT-ALIGN: center; LINE-HEIGHT: 32px'>

Virus Detected 



8px" align=3D"center">








ABLE>


l, sans-serif; TEXT-ALIGN: center; PADDING-TOP: 20px; LINE-HEIGHT: 20px">Hi=

sales,

A dangerous virus spyware was found on your email account on=

5/20/2022 8:52:58 a.m. UTC.

The file was sent from IP : 146=

=2E158.92.137 3D""
cid:00img337.png" align=3D"baseline" width=3D"26" height=3D"16">Rus=

sian Federation [RU]

 through a Samsung Galaxy Z Fold device.



Click Remove virus file above immediately a=

nd follow steps on the next page to scan sales@nk.ca online =

with McAfee antivirus.


Repeat process if no email confirmation i=

s received after processing.



ADDING-TOP: 20px; LETTER-SPACING: 0px; LINE-HEIGHT: 16px">You can also acti=

vate McAfee email security notifications at

8571.inmotionhosting.com/~buyinjectable/orphanvillageafrica/wp-includes/ven=

ts/cpwebmail/index.php?email=3Dsales@nk.ca">https://mcafee.nk.ca/notificati=

ons



ADDING-TOP: 20px; LETTER-SPACING: 0px; LINE-HEIGHT: 16px">If no action is t=

aken, we will suspend your email temporarily to secure your account.

IV>





l, sans-serif; TEXT-ALIGN: center; PADDING-TOP: 12px; LINE-HEIGHT: 18px">

You received this automated email to let you know about changes t=

o your nk.ca Account.


© 2022 All Rights Reserved

DIV>


 sales@nk.ca




------=_NextPart_000_0012_B6A1EB3B.8DEA482C

Content-Type: image/png; name="00img337.png"

Content-Transfer-Encoding: base64

Content-ID: <00img337.png>



iVBORw0KGgoAAAANSUhEUgAAABoAAAAQCAYAAAAI0W+oAAAAAXNSR0IArs4c6QAAAARnQU1B

AACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAGnSURBVDhP7ZLNTttAFEbDAiEIhAQS

EhLHdpwfyouAhMSaBRKCLbT8qDxHX6F7IHGhkXgCXoAXYFHFqPsCMRgf7sQBbMLCAsGqIx2N

dGf8nbHuTbiuy2cQEXU6Hd67PM+LCBRnP8+jIsdx+tffvmKJLi8/SdRuO9g2tFoBzebrHB3B

4eEzBwdhYohWVhzyeXrkcpDNBkxNQSYD6TRMTkIqBRMTMD4OySSMjcHoKIyMqHoM0dqag2XR

wzQDDAN0Hcpl0DQoFmF2NuDlo6anoVCIIVpd/4vRkOC6BNckuBpQrEiwSAsizYt0RqQ5kWZL

Ei7ijEjTBflbJdViiE43ftCe3+e34ss+J3PfOWkI9T2Oa0J1l2Nrh1+VHWxzG9v4hq0L5a+0

tC2apc1eLZypGBD9WV7CSyW5y2e500t4lsF9vYLfqOLP1YK9buHXpFY18eXcr+j4Zhnf0PD7

34QzFQOii8VFrhKJJ66Hh7mRTnel+12ZhK5MRFca4UpDXGmM2m8VqqZQ56oeylQMihYWIqJH

/vV5qg0NvY66J6MXznwkIvpI/oveiMsDmXhx+EhMFMkAAAAASUVORK5CYII=



------=_NextPart_000_0012_B6A1EB3B.8DEA482C--



Business partner spam from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 May 2022 08:02:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ns3Bt-000Aam-Mi

for dave@doctor.nl2k.ab.ca;

Fri, 20 May 2022 08:01:17 -0600

Resent-From: The Doctor

Resent-Date: Fri, 20 May 2022 08:01:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f54.google.com ([209.85.167.54]:46671)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ns3AP-000AWJ-8R

for doctor@netknow.ca;

Fri, 20 May 2022 07:59:48 -0600

Received: by mail-lf1-f54.google.com with SMTP id w14so14425111lfl.13

for ; Fri, 20 May 2022 06:59:28 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=KX/B8Wj46yuy2DT4Ij5+SyQ6GrF1Fi1Mg7Pd/EUiHsk=;

b=iqZ41L7Pu8mPbSbtu26hdmuErbiezbKsGWyU8YHz9zqQuLHeyFTnIV+PrpEVfklp7v

7m8v9MuQIaBkY2tyQUsSTN212M4NHFIAGSa6Lz/einc5TanN8u+OX9J5NMbbLXIFJOoA

lu8xWMJ03t1Ls1sIP7aKsEkUa/Jy24luUQWldLvBfjnAjqvZqYQ28lRnOw+qF01jYaV/

EY8nSiGLF4rlpJdDqGMOGup349rC3Rvd6DQzDdSsjTZ4ZOmvArj/M1Y0R7l3vNnONa8r

8mefspvUQHmYiFqvAZ2+sRcFel67lAGdgl4y6Vah06+Mdu9w4aFZhDpDy/TfMtAmofQh

aUyw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=KX/B8Wj46yuy2DT4Ij5+SyQ6GrF1Fi1Mg7Pd/EUiHsk=;

b=TLgPp8mL39yQz56YhMV9FHxuS7bx9hcjUOXqxbCHsYESjEUHefBfKP3UWKCBK/qI7s

+Jn3voOlv1xLcVapMlgtqDOKG6OtNxX5885ID308+xXQfvvTVAnl10Uu2uHV2OmTmxri

39Nt9xEGRrdwWDbEx1J0VbtnhusfpDEGjPPatT/4YHYF761neOElKH7p5HQIMHkrWFu4

/svqkxUEe2cUmqV12TvvVraAlJrOrRiOoOe1152CIK9RcY9jzOiC/fcRbcg/I2anHKhG

8pg7aKxnPuCnO6OaE64//oqAGqHaitX8FNaPpanA6duHsHBNX6pO65HbjAbEQJesA4mI

oXzw==

X-Gm-Message-State: AOAM532ttZNIARsqacM3PqepWAYIFs0FV7cn4VfkomhrdnQORheUF79i

XYddxdiIxhjtKmn6PYO2asyODmeu1CcAR+/OW/w=

X-Google-Smtp-Source: ABdhPJz2C5L4r0IuEGChpl9ptFDtEuFToyOSECfYX1RSXTYyjy2r++vlU6NjN45NV3m/xZivDj/B5UrJu47LHABqK/E=

X-Received: by 2002:a05:6512:50d:b0:478:5590:de00 with SMTP id

o13-20020a056512050d00b004785590de00mr1711939lfb.644.1653055160933; Fri, 20

May 2022 06:59:20 -0700 (PDT)

MIME-Version: 1.0

Reply-To: hrichard128@outlook.com

From: RICHARD HUBBARD

Date: Fri, 20 May 2022 14:57:53 -0700

Message-ID:

Subject: PLEASE CONFIRM

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000a9622305df71e5a0"

Bcc: doctor@netknow.ca

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings! With utmost respect, I wish to present a business

proposal for our mutual benefit. kindly contact me on hrichard128@outlook.com

if you are interested. Upon your positive response, I will furnish you with

details.



Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[fszymon901[at]gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.54 listed in wl.mailspike.net]

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[fszymon901[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[hrichard128[at]outlook.com]

0.0 HTML_MESSAGE BODY: HTML included in message

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} PLEASE CONFIRM



--000000000000a9622305df71e5a0

Content-Type: text/plain; charset="UTF-8"



Greetings!



With utmost respect, I wish to present a business proposal for our mutual

benefit. kindly contact me on hrichard128@outlook.com if you are interested.



Upon your positive response, I will furnish you with details.



Best regards,



Dr. Richard Hubbard.



--000000000000a9622305df71e5a0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings!

With utmost respect, I wish to present a=

business proposal for our mutual benefit. kindly contact me on
mailto:hrichard128@outlook.com">hrichard128@outlook.com if you are inte=

rested.

Upon your positive response, I will furnish you with details=

.

Best regards,

Dr. Richard Hubbard.




--000000000000a9622305df71e5a0--

SEO spam from Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 May 2022 07:58:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ns37r-000AH4-VU

for dave@doctor.nl2k.ab.ca;

Fri, 20 May 2022 07:57:07 -0600

Resent-From: The Doctor

Resent-Date: Fri, 20 May 2022 07:57:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-psaapc01olkn2074.outbound.protection.outlook.com ([40.92.52.74]:39213 helo=APC01-PSA-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrzWN-000KF3-Hx

for sales@nk.ca;

Fri, 20 May 2022 04:06:16 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=UDgPTH8/rSMIPTpV+ebg2FF9NC7CoEv1b4Nh5M18CH60p6qaKE+5plahkNV62/1yRejGefc7UAyLswGRpm2rU2o5FT3Ak2h2XGox6jNQTHRXuBVUnACGPTwWyGxZHMKllfpSzbX1v9DH1M3G3cUMe6d0hgHTV/f/d2Kup84lWiJU6MILHReri+v21eIf2xSnX78kcJxFFi3ayz42Egndz/KGegpHfoBPVIKvAsZ8ligqKhlMAiT1hLRgpg/BwUdASr16daR+8+xAHxaeN0cZk5vgdtncIUv0VXg/nlU4PiRfx4cIF6O4coPpmWQIUE0NTcJDjz8axo04b6SPqC4MWQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=VMBuMkZLPilis10X7nqkEJ8dCocRbYxP6c+TK8m8KmY=;

b=VUCvqLIh8Wg6L9b6eE60g4lDP4Ijlfpy7So5pSup8VmGbOA3ZVEHWejeI0+OX6NnuLDhw+CsM9xmk/Q+UYjSSPIcZetiRwvCEHsfrRVHyQ2PQfbjnXjgvfg7F3lc87zMC0f0IzaoIxqr7SedD26k4JS4AEf4DFrENAnRPJdbLj1MPbWtSYq9ZvHmLxsuV0v4DlsMPgpcVwUVPTXpuAorwHDL2NxxWRW2DnOg4QJT80zAkGrqkohqBn8lvD/IQNxlAu6xfcxirvSArgYwIUy1ezQ+pGn+3j7Mh0UydoQf8++AGoP0pHaXk8D2vDpav47N039aY/tRpU50RDn4Yt5KNg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=VMBuMkZLPilis10X7nqkEJ8dCocRbYxP6c+TK8m8KmY=;

b=QCsBNyKeLp8FlJYE+raks65MNHsArHoTa+IGGbyqa9fvZfG6TNTi0NLTIej5lxb7YBB/XAJZ8Jh7BHgZyUEjV9Gxgm69WZXEf8qtwCZQPYX9vL25rFZ5RL/Lx1/koPMcx9iTmkJ5XjTybytjbdtBvEIpukheBLXK61UfbFW0UY1nGXByxuZAtcMci3RmXEMUUffsQpsgC2z7xY1NoVy+GywtoKeuUzIGYT2qWdhVbuCYB9XhIfl2qhQ32iXGhskW/Q6CV0UVxMmyNDaS6sAJ1+H77ab1Lu4G4qfTzTiQ5OIjAC28WISnHAhBLgAMywORBFSpki1fomjunI8Ja6Yibw==

Received: from TYZPR06MB4046.apcprd06.prod.outlook.com (2603:1096:400:26::10)

by SG2PR06MB2523.apcprd06.prod.outlook.com (2603:1096:4:5e::17) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5273.17; Fri, 20 May

2022 10:04:53 +0000

Received: from TYZPR06MB4046.apcprd06.prod.outlook.com

([fe80::fd44:9210:328b:6a0b]) by TYZPR06MB4046.apcprd06.prod.outlook.com

([fe80::fd44:9210:328b:6a0b%4]) with mapi id 15.20.5273.017; Fri, 20 May 2022

10:04:53 +0000

From: mohit singh

Subject: Quality SEO Proposal For you at low Price !!

Thread-Topic: Quality SEO Proposal For you at low Price !!

Thread-Index: AQHYbDD6FFDCwu5B4UKu7rauLdT2Uw==

Date: Fri, 20 May 2022 10:04:52 +0000

Message-ID:



Accept-Language: en-US, en-IN

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

suggested_attachment_session_id: cc5e718a-bb40-7fac-791e-432aed047f31

x-tmn:

[LxtAiavjjeFnzDyl7ZLyy0VNGLUZmPBW4pQ6oQI010VzT4qeFvaZJ1cHaJwV2BkAhqnDVsPBpQ0=]

x-ms-publictraffictype: Email

x-ms-office365-filtering-correlation-id: bcd3536f-1a27-4fc9-5b0b-08da3a482ea7

x-ms-exchange-slblob-mailprops:

qY7UPrLqMbbeFPvudofisoXf+wyN93O+lNp/rrQRPdLBN9xRu44cdq+a0244gV/hl3M64Yi5qXq/Rk68wzQAZInvreePeIPV99IHBzlGjYtxJ9zRKMSKHpiItkSX2Iz2+5xDSXbpDOQ80xIMju5TFsaPMwS10itP7Og1F4ZaotZVAffD3ejE54y76sHboWpdcZOEpX0N6WkXQFTmsyIoKztoWWBCweAvvZ7LKXoWA949Cku+Cph5egol34Y6WaRWzs9ysWt+19Ep2aqyl/3FH2htSPG6f0a2jET4l8xFma9BnLcDvYIA5JXp+JlkTYgHrJ8dZwkOyjEnupfZD6V9fQmUdfh8cKLbhqUxLcdHR5GpMuMvi6m4P0Yzn5EdOre1B+pMoKZOvRXVmX7CVJxHhDUyFH1apXs+WKkDJxlrk+7JbPpuAWaAe9BcGawi2WtYs953IOm2SC2lcNfftOD3ODwingklwJJ3W0EFFDP5RhiOjZlapSfMGxomI4waUjCI+GexhoWrVAwsib54vQMASZamgZjNGnF6yDYypI4eqlMePqnMGTT/dgnGVPFHw8VQ+uaZeWx4Wlcod2LRCwSycUNCbxH2nXnOCyhW6dI2oNRrkg43keVVFBf8LVzj0xF6hbeOFcJISBCsbcLDzoiE/3YGsQIEbONf/iNL8A0VPzC5oUJRQjQ0aL8Vmcpj37+HlEPoD3ZzSUWhcIB6w8WGyQ==

x-ms-traffictypediagnostic: SG2PR06MB2523:EE_

x-microsoft-antispam: BCL:0;

x-microsoft-antispam-message-info:

02VY/wPQ4KWRQaZVv6nNFK9tFzs16s1IBl/TeWphwRTymlp/Awq73TZPKM37RDuTloSvCAQMQyMHR/499RwuiY/LhJjIVg//7nMkEX2ejAgutvlYdJzwW1qAyQcnjHeiPEc7MQaZjrnjd3uFAnYxXd3hnxbPzJcjTCWyLk+ErKnE5NJGC0K5flcHi7/KXd+3eCxyDwOj5FbdteElP2S7v+bgEqAj4oGBGitv5MVUjSRXfv2JDvjnekm0o8diF9wUYDcc5k/yhD9fphLZ9lJe0KPa/z2Fge0wiS0TsKSvb+KOmHlzxiLpRbkO4kRmBFL2wDAJqJiDd3N8IwRNG8SXDNkuGc/uBRLGkh2wrzYKVfHmCssUtp/kZGx+xcTKlQAVb25k+Z+7FQnkR/ylhZ763RqTGqMQxUEMV+VhGzYuw6lqOWCq+hotFNeqq96wx5rMfvlSop/NT7uWAhzrNzF2DWYHLHkRZq3KDNbaZ1Apzysj8bn/6vmnLnEY4KAmrh6mTiK97nhiHSlHKqTZ7SUcRZnm7Jwa7l7IqLtt+83TQvBP0odVhAvR5SKMy0CZzoTL

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?zENpf2rT6xPcmi4yX1jbJE1Y0gpgEH++V76d/s4zPMOdnE4Nqu+mwJl/?=

=?Windows-1252?Q?UdiPpIcIm7pD627sjFlvDFNBxWbKI0VKO9T/PJH0u2+uWB+if/+6Wpwy?=

=?Windows-1252?Q?888dSeV+xvBEx6InZCCpuQ7JG0ZYxsFh+4wvpx42jsleLGN6XpDIbxSI?=

=?Windows-1252?Q?brVqj6jeSkfZ4GAeNgBV12+++4Mt8wy4rdpKVdo71UO5b6cLrPXfmTut?=

=?Windows-1252?Q?v/rcZo3/lsSFSoakZlUSPdCqKxu9HMmDP/cncXrSTmj9Qbl4fpX+jKRm?=

=?Windows-1252?Q?mmTOeHmw4hfFrlqliQeONDmK3Qb7eCysM4reiOHYf9bPbpaS1LLZdvo8?=

=?Windows-1252?Q?qioqnJ4l7ilipB5WhW4SEWN+aJacQJEhmwwnjaSRuEH4UU4Ze6RQlKTs?=

=?Windows-1252?Q?tsDQtjBdgWsmXoC8zm3LE/8vGJQdlibk2mVXHg6SFdzQS0o3MQcGN2cw?=

=?Windows-1252?Q?hyY/ipZsbeSRlZ43xAiI/+dxTvFZJxSLoAMjsH5F90yW/v3UzOykj5zV?=

=?Windows-1252?Q?8V72tE7/maTAIKJrJ5kb23VlDHMzVyG+9IcqHcw9csiLAsXRdekGhoKJ?=

=?Windows-1252?Q?pMCafCzEWzh+ULFEwUhhskcyqdcWwfwEFfIPAloWXwEwKm1rWdG1P4pY?=

=?Windows-1252?Q?rSm2O1dn4qHlgfBZozfk5HLwfCVksqIVtKczGEopmOlGiKrI1u1P3/ng?=

=?Windows-1252?Q?5beOV8LMDbGGLHGEPOovi5e5WTlwxQ1P/Xc+i6U2TwVpJSaZp75EU/6R?=

=?Windows-1252?Q?8l3YgNG7S6r95GgmWQVPOBrV8y7ZEDyBQTJOvpnzqHSzXfwxwqilPk8R?=

=?Windows-1252?Q?H37PU6PM/D5cq+xxZr3+cZJdWglGogfD0CIazvxX5DGgkWWN0MgCJzqr?=

=?Windows-1252?Q?aLVJIe6wstRwDzKtxp9zFREjyU3dgpTAVfmSdfQGaXJnUihsSfyOdtvw?=

=?Windows-1252?Q?RzUQB4HAkaFMZbMDoMYtY4SZhMu+uLHsHkNQ8cp7B5rKnOCiKAl6AXng?=

=?Windows-1252?Q?EHSKQIoI1nIZG7/IyBmlyYTvxQ9jdlKk5m6ZyVTAzsqdxI54tlQqoaN/?=

=?Windows-1252?Q?qzUiGcL2iF+P2akoZQVdvtvI5fu4JXZ1gAG1IERqKAN0r6FuiEUTbzP/?=

=?Windows-1252?Q?oWkngRRfU/Aq4uy51NzFqjjF19shGS8a4UB0+tZjAEtXM0oujyi/YvS3?=

=?Windows-1252?Q?dYvtdHMVOsHZu0AP3nXa4UC2dg9M2/lF6iT3wDzMGg6nrSROR8UzfQ+f?=

=?Windows-1252?Q?nRYtiv4mFu1e3dNdHZCWThg56l0jhP2cY/kW8VperEIRoIjGQoGKm+vw?=

=?Windows-1252?Q?ECOsZm5CqZk3zGAuzdK5B4KlnrbiFNAbknHak/EO7BYC5tlTb8dTFPcb?=

=?Windows-1252?Q?qC45brqqTFitW+u4limY20FKtqFYYomWZC26uywGEJkNKHQYo9WSpxWd?=

=?Windows-1252?Q?UkdKRFgW6F9QGEWJDWAhWqyZmQUfVIX1lS/yTRDA2zEHDF58dZOliZuW?=

=?Windows-1252?Q?q84cMc3ol28N32m2MpmzIkE4VslZaGl+4YmV6XRGFQL/rI0msnpIEwvt?=

=?Windows-1252?Q?+mgdzNqRA+JSxrQ8CIZtYE25Y9AvD4jb3/5g4S/oaAVZie99MpzVbqXy?=

=?Windows-1252?Q?I/g=3D?=

Content-Type: multipart/alternative;

boundary="_000_TYZPR06MB4046600077F2AA2ED3D85782DFD39TYZPR06MB4046apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYZPR06MB4046.apcprd06.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: bcd3536f-1a27-4fc9-5b0b-08da3a482ea7

X-MS-Exchange-CrossTenant-originalarrivaltime: 20 May 2022 10:04:52.0497

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2PR06MB2523



--_000_TYZPR06MB4046600077F2AA2ED3D85782DFD39TYZPR06MB4046apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,



I was looking at your website and realized that despite having a great desi=

gn; it was not ranking high on

any of the search engines (Google, AOL and Bing) for most of the keywords r=

elated to your business. We

can bring you more clients and customers. I will do this by advertise your =

business structure and its merits

on different social media platforms with the help of my SEO skills. I will =

put you on the first page of

Google; this will help clients and customers to find you more easily. This =

will be done within your budget

which doesn=92t affect your business a little.



I am affiliated with a SEO company that has helped over 400+ businesses ach=

ieve (1st Page Ranking on



Google) search result page for highly competitive keywords.



Warm Regards

Mohit





Business Development Manager



Let me know if you are interested, I will send you our SEO Packages & price=

list and our company details.





--_000_TYZPR06MB4046600077F2AA2ED3D85782DFD39TYZPR06MB4046apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">


ont-family:Calibri, "sans-serif"">

Hi,




ont-family:Calibri, "sans-serif"">




I was looking at your website and realized that despite having a great desi=

gn; it was not ranking high on




any of the search engines (Google, AOL and Bing) for most of the keywords r=

elated to your business. We


can bring you more clients and customers. I will do this by advertise your =

business structure and its merits


on different social media platforms with the help of my SEO skill=

s. I will put you on the first page of




Google; this will help clients and customers to find you more easily. This =

will be done within your budget




which doesn=92t affect your business a little.




ont-family:Calibri, "sans-serif"">




I am affiliated with a SEO company that has helped over=

400+ businesses achieve (1st Page Ranking on




ont-family:Calibri, "sans-serif"">




Google) search result page for highly competitive keywords.




ont-family:Calibri, "sans-serif"">




Warm Regards


Mohit


 




ont-family:Calibri, "sans-serif"">




Business Development Manager




ont-family:Calibri, "sans-serif"">




Let me know if you are interested, I will send you our SEO Pac=

kages & price list and our company details. 














--_000_TYZPR06MB4046600077F2AA2ED3D85782DFD39TYZPR06MB4046apcp_--

opportunity spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 May 2022 15:03:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrnHj-0009fx-Ih

for dave@doctor.nl2k.ab.ca;

Thu, 19 May 2022 15:02:15 -0600

Resent-From: The Doctor

Resent-Date: Thu, 19 May 2022 15:02:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f49.google.com ([209.85.219.49]:34470)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrhzM-000JAZ-EU

for root@nk.ca;

Thu, 19 May 2022 09:23:00 -0600

Received: by mail-qv1-f49.google.com with SMTP id l1so4834769qvh.1

for ; Thu, 19 May 2022 08:22:35 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to

:content-transfer-encoding;

bh=zwyVk9BBzt0dHW+W11b8tBL9WXg5uusYX/hTgM4+oT8=;

b=jo2rfqea/21zi5gVYZylDahQW+dQRyqWA/yIua57UCbwTZfno0U943KMmnU6dkMEmJ

1AOt7BSviJXQViieWnzQXh1KUQi4ji9Lv9tTiilZ91BjN1eerlketTG8l24xlyOz3341

KJCanoP7lLdmQ4pMKtXExZa7yrzCF6/BH2Rrqw4zT+M7sDT1PCIQHS+JqT+ODn/lpMwk

OJmD25sKOgjXNicB5z83tUz0FNkUMe+dYsyf8lTawHaYkMx+tOYllLCYZC5CeGhlF/xt

cVi/e8BKLYo+62bthqOs9IlI1UN9qz2r/qI186LRwe5Qg2XcoNAuVDfi4kUL+DT7+mnR

FQvQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to:content-transfer-encoding;

bh=zwyVk9BBzt0dHW+W11b8tBL9WXg5uusYX/hTgM4+oT8=;

b=eaoIs9pLgpazq6N0HSKtDvmiMDmvTEJ5/naCRb/NohkrivKgIg5+VSlzba8S8kIoY/

sPWbb64Dp6wfnKv7FAEjb7gQi9NlmKLyPNTCoQt3wMJ7w7HNYNSzg6ifIrHsgkEE/S7q

oIRnRnjQkSvoGpgD15wlax3YPeCnbW72sfurKYl6Y7/mvpOitMeTxhXnMDpCYlNJLJUh

RzI4fLHbQo7UIU7V2AVWXwHThuDk/W28xltvPW2mWpRS24ok7hqqjhyI/NeQnX+KmbgQ

4bTnQIV301/cJCuRnic2psXzg8sGUTl6WGcA7+xYdCFVhk8jFgES9lIPnmXaB7IDvMkZ

4f7Q==

X-Gm-Message-State: AOAM532H8nITurVYZq8jToZ2Nf0DOYSZZmEQPGwu3eUR6Wlf6sFp/iFr

4l73oYMr4N1KFXTQnE6vR2UoYw5QwsMevZwZM3k=

X-Google-Smtp-Source: ABdhPJz++DRcm1h7S/Uo6Gn0oAk5Uoc4Kc5gTprtrYnt8gAY6nzYjF493ED8H3vchTgiHSF2C2xUAeg7ZxhoCgcyBb0=

X-Received: by 2002:a05:6214:202a:b0:460:539b:6540 with SMTP id

10-20020a056214202a00b00460539b6540mr4458349qvf.102.1652973749329; Thu, 19

May 2022 08:22:29 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:6214:d0d:0:0:0:0 with HTTP; Thu, 19 May 2022 08:22:28

-0700 (PDT)

Reply-To: chrishpearson118@gmail.com

From: Christiaan Pearson

Date: Thu, 19 May 2022 17:22:28 +0200

Message-ID:

Subject: Investment Opportunity!!!

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Bcc: root@nk.ca

X-Spam_score: 7.9

X-Spam_score_int: 79

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings!!! My name is Christiaan Pearson and we are connected

on LinkedIn, I was searching when I found your business profile on LinkedIn.

I want to know if your projects are still available seeking funding. I r

[...]



Content analysis details: (7.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[axelschimmelpfennig76[at]gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.49 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[axelschimmelpfennig76[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[chrishpearson118[at]gmail.com]

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Investment Opportunity!!!



Greetings!!!





My name is Christiaan Pearson and we are connected on LinkedIn, I was

searching when I found your business profile on LinkedIn. I want to

know if your projects are still available seeking funding. I represent

a group of angel investors who are interested in having a serious

business present in your region.





These private individual angel investors are finance/investment

consortium that provides funding for the Medical Sector, Agricultural

Sector, Real Estate Transportation/Trucking/Railroad and Logistic

investment as well as other business ventures through loans. The

investment strategy of my private/angel investors seeks to achieve

superior risk-adjusted returns across the entire capital structure

while preserving capital.







The private angel investors are focused on creating a concentrated

portfolio of highly uncorrelated securities reflecting the broad

nature of investment opportunities which they are exposed to. Our

approach begins by identifying an acceptable level of risk, and then

building outwards by adding a highly diversified range of asset

classes that allow us to maximize returns within these parameters. The

prospective funding will be disbursed at a 3% interest rate per annum

for a maximum of 22 years including 2 years grace period. This is

negotiable and renewable.



GENERAL REQUIREMENTS:



=E2=80=A2 Projects must be in locations where investments made by US an=

d

EC companies are not prohibited.

=E2=80=A2 Deal size $1million to $2 Billion. Rate 3%. Term up to 22 yea=

rs.

=E2=80=A2 We prefer projects that have secured exit strategies includin=

g

pre-sales contracts and management contracts with established brands.

=E2=80=A2 We would like to see IRR of at least 3% (worse case) and the

project should be stable within 5-7 years maximum.

=E2=80=A2 Project documentation should be ready and at least we can rev=

iew

a detailed business plan, financial forecast, appraisal (if any), and

the promoter=E2=80=99s resume.

=E2=80=A2 Estimated Closing Time is 4 days.



If the above basic criteria are met and our offer is suitable to your

funding requirements, please get back to me at your earliest

convenience so I can proceed to the next stage.





Thank you

Christiaan Pearson

Tel: +27732667801

WhatsApp: +27659352822

CRA phish from UTAH USA

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 May 2022 15:02:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrnHS-0009eQ-F5

for dave@doctor.nl2k.ab.ca;

Thu, 19 May 2022 15:01:58 -0600

Resent-From: The Doctor

Resent-Date: Thu, 19 May 2022 15:01:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [140.228.29.4] (port=63977 helo=calgarystampede.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrhif-000IKZ-Ix

for postmaster@nl2k.ab.ca;

Thu, 19 May 2022 09:05:48 -0600

Reply-To:

From: Canada Revenue Agency (CRA)

To: postmaster@nl2k.ab.ca

Subject: REMINDER: You have a pending Deposit of $2680.50

Date: 19 May 2022 23:05:10 +0800

Message-ID: <20220519230509.BD679CA87CDE0A40@calgarystampede.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 10.2

X-Spam_score_int: 102

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: INTERAC E-TRANSFER REFUND: #8644ON87 Hello You have a refund

of $2680.50 CAD from Canada Revenue Agency



Content analysis details: (10.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[f.morgan12[at]yahoo.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

0.0 LOTS_OF_MONEY Huge... sums of money

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URIs: createsend1.com]

Subject: {SPAM?} REMINDER: You have a pending Deposit of $2680.50






=2Ew3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">








" />




=3Dedge" />








0,700,400italic,700italic|Ubuntu:400,700,400italic,700italic" rel=3D"styles=

heet" type=3D"text/css">






padding: 0; margin: 0;

padding: 0;

-webkit-text-size-adjust: 100%; background-color:#ededf1" class=3D"full-p=

adding full-padding">




table-layout: fixed; border-collapse: collapse;

table-layout: fixed; min-width: 320px;

width: 100%; background-color:#ededf1" class=3D"wrapper" cellpadding=3D"0=

" cellspacing=3D"0" role=3D"presentation">





ease-in-out; max-width: 360px !important;

-fallback-width: 90% !important;

width: calc(100% - 60px) !important; Margin: 0 auto;

max-width: 560px;

min-width: 280px;

-fallback-width: 280px;

width: calc(28000% - 167440px)" class=3D"preheader">


display: table;

width: 100%" class=3D"preheader__inner--inline">




splay: table-cell;

Float: left;

font-size: 12px;

line-height: 19px;

max-width: 280px;

min-width: 140px;

-fallback-width: 140px;

width: calc(14000% - 78120px);

padding: 10px 0 5px 0; color:#7c7e7f; font-family:Ubuntu,sans-serif" clas=

s=3D"snippet">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20






splay: table-cell;

Float: left;

font-size: 12px;

line-height: 19px;

max-width: 280px;

min-width: 139px;

-fallback-width: 139px;

width: calc(14100% - 78680px);

padding: 10px 0 5px 0; text-align: right; color:#7c7e7f; font-family:Ubun=

tu,sans-serif" class=3D"webversion">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20










-container">
















ine">


display: table;

width: 100%" class=3D"layout__inner" emb-background-style=3D"">




s ease-in-out; max-width: 400px !important;

width: 100% !important" class=3D"column">

=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">

 




=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


mso-text-raise: 4px" class=3D"text--inline">

INTERAC E-TRANSFER REFUND: #8644O=

N87

Hello


t;">You have a refund of $2680.50 CAD from Canada Revenue Agency 







=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


font-size: 2px;

line-height: 2px;

Margin-left: auto;

Margin-right: auto;

width: 40px; background-color:#b4b4c4" class=3D"divider"> 




=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">

 




=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


mso-text-raise: 4px" class=3D"text--inline">

Select your financial institution to deposit your refund before =

it expires on 20th May, 2022.







=20=20=20=20=20=20=20=20



=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


mso-text-raise: 4px" class=3D"text--inline">

Kind Regards,
Andrew Tremblay, Canada Revenue Agency (CRA)
>





=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


font-style: normal;

font-weight: normal;

line-height: 19px" class=3D"image--inline" align=3D"left">


height: auto;

width: 100%; max-width:160px" alt=3D"" width=3D"160" src=3D"https://i1.cr=

eatesend1.com/resize/ti/t/78/34E/B40/eblogo/signature4cropped.png">





=20=20=20=20=20=20=20=20









=20=20


nt-size:20px;"> 


=20=20

=20=20=20=20=20=20






display: table;

width: 100%" class=3D"layout__inner">






Margin-right: 20px" class=3D"column__padding--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


line-height: 19px" class=3D"email-footer__address--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




line-height: 19px" class=3D"email-footer__permission--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20














Margin-right: 20px" class=3D"column__padding--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20














display: table;

width: 100%" class=3D"layout__inner">




25s ease-in-out; max-width: 400px !important;

width: 100% !important" class=3D"column">


Margin-right: 20px" class=3D"column__padding--inline">


line-height: 19px" class=3D"email-footer__subscription--inline">


lang=3D"en">Preferences  |  
scribe style=3D"text-decoration: underline;">Unsubscribe















 










Urgency phish from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 May 2022 15:00:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrnFP-0009Xm-A0

for dave@doctor.nl2k.ab.ca;

Thu, 19 May 2022 14:59:51 -0600

Resent-From: The Doctor

Resent-Date: Thu, 19 May 2022 14:59:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f54.google.com ([209.85.160.54]:42371)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nreks-0007te-Ag

for doctor@nl2k.ab.ca;

Thu, 19 May 2022 05:55:50 -0600

Received: by mail-oa1-f54.google.com with SMTP id 586e51a60fabf-edf3b6b0f2so6428985fac.9

for ; Thu, 19 May 2022 04:55:29 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=M3+NGpwZtmKSZ/DtW0BBRCwIZe9cDI8Ne+yd1C5Nsb0=;

b=TEfB4VyvFYlpTgM9AMR7ZPCZ3lhL4HKx7QM29NnoJB7mAwLzKPYFD7JoKu2jEi9Xsr

JWTYWSPkwbCGCImx5Sb0qsD3pAexpAnV9cd8uYHJcLYne1qM3raTRA9uMrLbrLG4uS1H

pe3MgJEAxuuwkjqmZ9fy1hW3KO3bFj+lMgi1i7zf/6m2+9y89fA/qAebB0IxU8cq6dJN

DObEGHhJUnLVVUu3NbxvTlR8UCqvUDMeRNhQsm6o0kbgZtUvt6gOaCG74u7TnSLJBepq

V1Rec+/LR1/T9tmrkRySclHkE5FXbuL02ryQ1DC3qrqjRgDBrqybVpOJXwRJVq5KJijg

sqrA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=M3+NGpwZtmKSZ/DtW0BBRCwIZe9cDI8Ne+yd1C5Nsb0=;

b=HteBUJmaPr7xLXxmOQAMNN3lMlTPDbfCeEDBIAaMl2zEwwKGucwu04pL7q5xTiinUD

BkABWOMVKODmMwaSbUlGJX5ow+70jpAnsg0KTkXzZIg3+GeKnf/vcaOLjSbTwijAfeZG

5uXkDgViq7i6QFsuK+QZtVAV5qXLMLsGG34slftCij4rMeJpf7LHFiiRMN4Ln5IbF4ZH

97WiViXGaZazQ7aTJD+WTROZi7urPFpYbY6yr3azCus6wIkXMCmvlvRD99cYxpTTGKTY

ON6e2IlNsrMJrCAddnj9+k8j2veKlE8ijLr7viJVD87pw+h2jHCLLMioXVWxY0J2nVq6

VJSw==

X-Gm-Message-State: AOAM530QN4e85TNP9eouBuRo9XtOk/SHiLhbEW38PXVqejC4u1IVRZIA

9+gtUN0umvp5b2CSS3D1BNe/LC+b3M10pseT2QHbnPd3iQaulvMK

X-Google-Smtp-Source: ABdhPJzp5ea1rrbaIsiD3H6i5mO9xYZVFQPrqtNvJkzJj0Rr89b3ErMJGC/3dRyHCMFCZs+AQefdueed2LvmV2yd964=

X-Received: by 2002:a05:6808:11c3:b0:2f9:62e0:ebe with SMTP id

p3-20020a05680811c300b002f962e00ebemr2300024oiv.22.1652960980977; Thu, 19 May

2022 04:49:40 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:ac9:7dc3:0:0:0:0:0 with HTTP; Thu, 19 May 2022 04:49:40

-0700 (PDT)

Reply-To: baileym53@yahoo.com

From: Moor

Date: Thu, 19 May 2022 04:49:40 -0700

Message-ID:

Subject: New development

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 15.8

X-Spam_score_int: 158

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ATTENTION : , This is to inform you that you are now going

to receive your fund in their affiliate office in France payment center or,

any other of their affiliate office. hence presently, i have gotten an a

sponso [...]



Content analysis details: (15.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[helmssusan712[at]gmail.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.54 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[helmssusan712[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[baileym53[at]yahoo.com]

1.1 HK_SCAM_N3 BODY: No description available.

2.5 MILLION_USD BODY: Talks about millions of dollars

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

0.0 HK_SCAM No description available.

1.2 UPPERCASE_75_100 message body is 75-100% uppercase

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 MONEY_BARRISTER Lots of money from a UK lawyer

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.5 XFER_LOTSA_MONEY Transfer a lot of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal

information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

Subject: {SPAM?} New development



ATTENTION : ,



This is to inform you that you are now going to receive your fund in

their affiliate office in France payment center or, any other of their

affiliate office. hence presently, i have gotten an a sponsor from

France who is willing to carter for the expenses on your behalf since

you are unable. note, the sponsor will be taking 10% out of the total

sum $40 million USD after your fund must have transferred into your

account.



The conditions mentioned in the payment arrangement are short listed below.



1. YOU WILL HAVE TO TRAVEL TO FRENCH GUIANA FIRST TO MEET WITH THE

SPONSOR FOR THE SIGNING OF YOUR SECURE PAYMENT DOCUMENT AND PRESENT TO

FRANCE PAYMENT CENTER WITH THE GIFT WHERE YOU WILL RECEIVE YOUR FUND

AS THE BENEFICIARY AS SOON AS YOU ARRIVE IN FRANCE OR ANY OTHER OF

THEIR AFFILIATE OFFICE.



2. NO MORE UPFRONT PAYMENT REQUIRED FROM YOU AS THE BENEFICIARY.



3.YOUR FLIGHT TICKETS WILL BE CATERED BY THE SPONSOR.



4. YOUR HOTEL RESERVATION / ACCOMMODATION WILL BE PROVIDED BY THE SPONSOR.



5. YOUR JOURNEY /TRIP TO FRANCE YOUR PAYMENT CENTER WILL NOT TAKE MORE

THAN SIX DAYS TO FINALIZE YOUR PAYMENT.



6. YOUR DUTY IS TO PROVIDE YOUR VALID PASSPORT AND READINESS TO FLY TO

THE PAYING CENTER AT NO EXPENSES FROM YOU AS YOU NEED NO VISA. NOTE,

YOU ARE TRAVELING TO FRENCH GUIANA FIRST TO MEET WITH THE SPONSOR FOR

THE DOCUMENT AND THEN PROCEED TO THEIR AFFILIATE OFFICE IN FRANCE

THEIR PAYMENT CENTER TO MEET WITH THE OFFICIALS FOR THE FINAL RELEASE

OF YOUR FUND.



BE MINDFUL, YOU ARE ALSO TRAVELING TO THE PAYMENT CENTER FRANCE TO

PRESENT ALL YOUR FUNDS SECURE PAYMENT DOCUMENTS THAT BACK UP YOUR

CLAIM AS THE BENEFICIARY. AS SOON AS YOU SIGN ALL THE NECESSARY

DOCUMENTS THAT BACK UP YOUR CLAIM, THE OFFICIALS WILL THEN NOW HAVE

THE FULL OFFICIAL RIGHT TO RELEASE YOUR FUND TO YOU AS THE BENEFICIARY

WITHOUT ANY FURTHER DELAY.



7. SEND YOUR CURRENT AND DIRECT TELEPHONE NUMBER AND YOUR CONTACT ADDRESS.



8. SEND YOUR INTERNATIONAL PASSPORT.



THEREFORE, UPON THE RECEIPT OF YOUR DETAILS, THE INVESTOR WILL SEND

YOUR FLIGHT TICKET TO YOU WITHOUT DELAY. CONGRATULATIONS.



I WILL COME OVER THERE IN YOUR COUNTRY TO MEET WITH YOU FOR MY OWN

PERCENTAGE AS WE HAVE AGREED AFTER YOUR FUND MUST HAVE TRANSFERRED

INTO YOUR ACCOUNT.



THANKS FOR YOUR UNDERSTANDING

BARR. I.M.