NetKnow Corporate Blog | Entries from Monday, May 23. 2022

Urgency spam from Google

Posted by Dave Yadallee on Monday, May 23. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 23 May 2022 17:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ntHGO-000Fit-Ur

for dave@doctor.nl2k.ab.ca;

Mon, 23 May 2022 17:15:00 -0600

Resent-From: The Doctor

Resent-Date: Mon, 23 May 2022 17:15:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f50.google.com ([209.85.217.50]:34347)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ntGlN-000Dz4-Oy

for doctor@doctor.nl2k.ab.ca;

Mon, 23 May 2022 16:43:01 -0600

Received: by mail-vs1-f50.google.com with SMTP id b7so16549929vsq.1

for ; Mon, 23 May 2022 15:42:40 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:sender:from:date:message-id:subject:to;

bh=uETXtarVwZqoq55uxf85U5YgwPdkdqdQ5+5+F1r3C0I=;

b=RvHckCG1eoH1Wn0LcvlVGl0aRZmTkkzD9vCo9Preb5OH6xas9y1OL2uB/1AXk85CMr

Em9313VvMs7cRyckN8i5kq8tWPopAaz/RwIKAsFp2BjJWQtjC9cWp9Iro9X4Hp8mpAoD

3yw8GPnJKeJvQPOpQV9YkQkofAJ0e9I77ZfAb44iYh42kfYwD2gVftuyGhBV5PmV+Skj

Y7da/e3NtSPRP1ZxRTkQeWqHN2UjF76k1Rlv7le/wpPZUBABWSzZ8uDKAWoAL04nFtP/

+SWm4QslfXzPss3pkilGCSdvVmdHKKz5GqqJfYoWOTF7EclIxk7ZWnX54wMXhGOj73r9

6OlA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:sender:from:date

:message-id:subject:to;

bh=uETXtarVwZqoq55uxf85U5YgwPdkdqdQ5+5+F1r3C0I=;

b=Lt7NwXeaJkTlGokhkZKWUA11RIE0MwkWS0F0Hvsu9kFMTxMEIj+LW+Z9vyuvZFWtWf

YxXbwbjFTz7TGMCmMl91Z65iEyJZOLPfITgi+6pBO7y1dfNic+K1tXC1nkP/p+OIGEoB

1xE1pqqMJeYvaUQie2mOjZA9erSDapoRmHdgfPEpQLRie4nh2MHOdsOzSAwmMvgVUvKv

6yH88qVzclayFfjO+3f6jKEaBjbHYTRcIkV0tR0DnIAW+uX51sKbK4CiwvySdD6cZa9C

HzDWDrShrx+NI9OD9XWN+nZHdK1V1wUGzGAKvTugz6Ua7jNNVP1LtUJpJVnEJXmYrYUV

4vKg==

X-Gm-Message-State: AOAM533IvV21/pKWx5c0o1AQvUMptLQU73YXAzmJCo9Zi3TRZ7R8yYkp

YU0xqaO6ddCfLjkJsCQfVShPHkJsOtHqISS4qjo=

X-Google-Smtp-Source: ABdhPJx9gXo6Xogw2ENloN1XgIbts04FiISBMx1i62M163rQ06lUHQnlJWGnF0LhrMnj9EmIkllHmaJm61wti95P9k0=

X-Received: by 2002:a67:dc82:0:b0:325:58cc:51c7 with SMTP id

g2-20020a67dc82000000b0032558cc51c7mr10234065vsk.63.1653345754756; Mon, 23

May 2022 15:42:34 -0700 (PDT)

MIME-Version: 1.0

Reply-To: mihirpat55@gmail.com

Sender: mrrobertdadams780@gmail.com

Received: by 2002:a05:612c:70b:b0:2ba:1307:6c0a with HTTP; Mon, 23 May 2022

15:42:33 -0700 (PDT)

From: "Mr. Mihir Patel"

Date: Mon, 23 May 2022 15:42:33 -0700

X-Google-Sender-Auth: lNWdzOySJv9ehlWbcvHK2EyqRNw

Message-ID:

Subject: Your Response Is Needed

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 12.8

X-Spam_score_int: 128

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Greetings, I am contacting you for us to work together on

a profitable business because you bear the same last name with a late client

of our bank. I want to present you as his true next of kin to inherit his

fu [...]

Content analysis details: (12.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[mrrobertdadams780[at]gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.50 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[mrrobertdadams780[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[mihirpat55[at]gmail.com]

2.5 HK_SCAM_N2 BODY: No description available.

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

0.0 HK_SCAM No description available.

1.5 HK_NAME_FM_MR_MRS No description available.

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.0 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Your Response Is Needed

Greetings,

I am contacting you for us to work together on a profitable business

because you bear the same last name with a late client of our bank. I

want to present you as his true next of kin to inherit his fund in our

bank. As his account officer I have some necessary documents in my

disposal to achieve this.

I therefore reckoned that you could receive this fund as you are

qualified by your last name. All the legal papers will be processed in

your name as the deceased's true next of kin.

Please revert back to me for further details if you can handle this with me.

Mr. Mihir Patel

Customer relation officer

CRA phish from UTAH USA (Rockion LLC)

Posted by Dave Yadallee on Monday, May 23. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 23 May 2022 14:26:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ntEcB-000H9o-2m

for dave@doctor.nl2k.ab.ca;

Mon, 23 May 2022 14:25:19 -0600

Resent-From: The Doctor

Resent-Date: Mon, 23 May 2022 14:25:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from gallifrey.nk.ca ([204.209.81.3]:26858)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ntCwv-000Bkd-C8

for doctor@nk.ca;

Mon, 23 May 2022 12:38:39 -0600

Received: from [140.228.29.21] (port=53509 helo=cra-arc.gc.ca)

by gallifrey.nk.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ntCwa-000GgS-Ml

for root@gallifrey.nk.ca;

Mon, 23 May 2022 12:38:19 -0600

Reply-To:

From: Canada Revenue Agency (CRA)

To: root@gallifrey.nk.ca

Subject: ATTENTION: Please Deposit Your Refund of $2680.50 before it Expires

Date: 24 May 2022 02:38:10 +0800

Message-ID: <20220524023810.6C7799B3ED18E859@cra-arc.gc.ca>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 9.7

X-Spam_score_int: 97

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: INTERAC E-TRANSFER REFUND: #8644ON87 Hello You have a refund

of $2680.50 CAD from Canada Revenue Agency

Content analysis details: (9.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=cra-arc.gc.ca;ip=140.228.29.21;r=doctor.nl2k.ab.ca]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[f.morgan12[at]yahoo.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=ne_pas_repondre-do_not_reply%40cra-arc.gc.ca;ip=140.228.29.21;r=doctor.nl2k.ab.ca]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

0.5 SUBJ_ATTENTION ATTENTION in Subject

0.0 LOTS_OF_MONEY Huge... sums of money

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URIs: createsend1.com]

X-Spam_score: 9.7

X-Spam_score_int: 97

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: INTERAC E-TRANSFER REFUND: #8644ON87 Hello You have a refund

of $2680.50 CAD from Canada Revenue Agency

Content analysis details: (9.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=cra-arc.gc.ca;ip=140.228.29.21;r=doctor.nl2k.ab.ca]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[f.morgan12[at]yahoo.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=ne_pas_repondre-do_not_reply%40cra-arc.gc.ca;ip=140.228.29.21;r=doctor.nl2k.ab.ca]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

0.5 SUBJ_ATTENTION ATTENTION in Subject

0.0 LOTS_OF_MONEY Huge... sums of money

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URIs: createsend1.com]

Subject: {SPAM?} ATTENTION: Please Deposit Your Refund of $2680.50 before it Expires

=2Ew3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

" />

=3Dedge" />

0,700,400italic,700italic|Ubuntu:400,700,400italic,700italic" rel=3D"styles=

heet" type=3D"text/css">

padding: 0; margin: 0;

padding: 0;

-webkit-text-size-adjust: 100%; background-color:#ededf1" class=3D"full-p=

adding full-padding">

table-layout: fixed; border-collapse: collapse;

table-layout: fixed; min-width: 320px;

width: 100%; background-color:#ededf1" class=3D"wrapper" cellpadding=3D"0=

" cellspacing=3D"0" role=3D"presentation">

ease-in-out; max-width: 360px !important;

-fallback-width: 90% !important;

width: calc(100% - 60px) !important; Margin: 0 auto;

max-width: 560px;

min-width: 280px;

-fallback-width: 280px;

width: calc(28000% - 167440px)" class=3D"preheader">

display: table;

width: 100%" class=3D"preheader__inner--inline">

splay: table-cell;

Float: left;

font-size: 12px;

line-height: 19px;

max-width: 280px;

min-width: 140px;

-fallback-width: 140px;

width: calc(14000% - 78120px);

padding: 10px 0 5px 0; color:#7c7e7f; font-family:Ubuntu,sans-serif" clas=

s=3D"snippet">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20

splay: table-cell;

Float: left;

font-size: 12px;

line-height: 19px;

max-width: 280px;

min-width: 139px;

-fallback-width: 139px;

width: calc(14100% - 78680px);

padding: 10px 0 5px 0; text-align: right; color:#7c7e7f; font-family:Ubun=

tu,sans-serif" class=3D"webversion">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20

ine">

display: table;

width: 100%" class=3D"layout__inner" emb-background-style=3D"">

s ease-in-out; max-width: 400px !important;

width: 100% !important" class=3D"column">

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

mso-text-raise: 4px" class=3D"text--inline">

INTERAC E-TRANSFER REFUND: #8644O=

N87

Hello

t;">You have a refund of $2680.50 CAD from Canada Revenue Agency

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

font-size: 2px;

line-height: 2px;

Margin-left: auto;

Margin-right: auto;

width: 40px; background-color:#b4b4c4" class=3D"divider">

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

mso-text-raise: 4px" class=3D"text--inline">

Select your financial institution to deposit your refund before =

it expires on 24th May, 2022.

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

=

l-width=3D"182" height=3D"48" style=3D"background-color: #1c1601; color: #f=

fffff !important; font-family: PT Serif, Georgia, serif; border-radius: 4px=

;">Deposit Your Refund

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

mso-text-raise: 4px" class=3D"text--inline">

Kind Regards,
Andrew Tremblay, Canada Revenue Agency (CRA)
>

=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

font-style: normal;

font-weight: normal;

line-height: 19px" class=3D"image--inline" align=3D"left">

height: auto;

width: 100%; max-width:160px" alt=3D"" width=3D"160" src=3D"https://i1.cr=

eatesend1.com/resize/ti/t/78/34E/B40/eblogo/signature4cropped.png">

=20=20=20=20=20=20=20=20

=20=20

nt-size:20px;">

=20=20

=20=20=20=20=20=20

display: table;

width: 100%" class=3D"layout__inner">

Margin-right: 20px" class=3D"column__padding--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

line-height: 19px" class=3D"email-footer__address--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

line-height: 19px" class=3D"email-footer__permission--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

Margin-right: 20px" class=3D"column__padding--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

display: table;

width: 100%" class=3D"layout__inner">

25s ease-in-out; max-width: 400px !important;

width: 100% !important" class=3D"column">

Margin-right: 20px" class=3D"column__padding--inline">

line-height: 19px" class=3D"email-footer__subscription--inline">

lang=3D"en">Preferences |
scribe style=3D"text-decoration: underline;">Unsubscribe

Gmail phish

Posted by Dave Yadallee on Monday, May 23. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 23 May 2022 14:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ntERr-00090c-AY

for dave@doctor.nl2k.ab.ca;

Mon, 23 May 2022 14:14:39 -0600

Resent-From: The Doctor

Resent-Date: Mon, 23 May 2022 14:14:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f41.google.com ([209.85.167.41]:39641)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nt9Sl-00056J-Vi

for doctor@doctor.nl2k.ab.ca;

Mon, 23 May 2022 08:55:19 -0600

Received: by mail-lf1-f41.google.com with SMTP id y32so26020091lfa.6

for ; Mon, 23 May 2022 07:54:58 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to

:content-transfer-encoding;

bh=3IP3LapS+WwVNdfsJ7LqEhQLP1EPVrR8kCDbPE6zy9Q=;

b=aUWYha+vSZwnWREnhyabjvAPViyTbcuxcLgfeWKt+NdH14je4XwyakDo6r/JzIYtXU

xB/jqkxwngtkEv3WR47sQ26rMP0pFvGb0pruo7m0t4gc5sjL9xvtuuQOVUzJtGMmyfzd

1eRRaKyJmHqQuzrAMfcoFh0K9OmsgMKSj3Sp2iX2nfg6mRYqcp5ENL1itRPPT/9r+Wm6

pdWaKTj5UYqfCCBiXZ1YxGWwCqt7gV2Cuv5U37ObQejvSYhjjaOJlWUUFHac92wYdikg

4vdT3ozH+qIYmsu1TtQ6YcnVINjyVVovLSTi5fqujAIoYwtKq8qrcxQWHpd9WERbtM+D

jb1Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to:content-transfer-encoding;

bh=3IP3LapS+WwVNdfsJ7LqEhQLP1EPVrR8kCDbPE6zy9Q=;

b=BYkZ+F3OOYgydymsUujw4V+4uHPHxcc/DJ9bk6sAC93mcyShmy2FqkMWVEgS5E6yg7

/ZyFFrzqJHx+vN4oExQYJ0pRP2HhVuy6wIIAKuAMcLt7SsnKN88ZcJgsp/D8LIDeEdx5

/ByxYVF8cV9L/u0QKOdUbvb4Sr1m37eWhtlTcXMYjU+evtWI7vB/c0EfzTSfbJ2tZnIA

8ARTan1yNxFCcyYNoRCPVpGhEHj8LrJGk/8+RvUGlrcsCyg2vw0lAKwtxaiZYU+0QUuz

kmfki1pF2P9C6WxRl/YFNb6yMArj4AxP0vjbSs0HTeXt1V2pwLfjRAY0t60lxYG5Q9nr

lmuA==

X-Gm-Message-State: AOAM530R5cQXQR5qsW/ZxUODcp5mzSmR1u6skailpuKMI99WBVwmuYQ7

KAgHxHov4iuMJOAiS+OxO3b5FOTeEu8kXzHArag=

X-Google-Smtp-Source: ABdhPJyj48LmTPbryylDIA+/bYYXklZnvNevN31ipCckrarBO6xyTsmRMiwhf+ZktuytGaUmzgvJOhAmsztG8JxYPp8=

X-Received: by 2002:a05:6512:3183:b0:473:dffc:18ac with SMTP id

i3-20020a056512318300b00473dffc18acmr16039603lfe.217.1653317691838; Mon, 23

May 2022 07:54:51 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:6512:3a95:0:0:0:0 with HTTP; Mon, 23 May 2022 07:54:49

-0700 (PDT)

Reply-To: judgemartinsesq@aol.com

From: office

Date: Mon, 23 May 2022 07:54:49 -0700

Message-ID:

Subject: TO YOUR ATTENTION!

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 10.0

X-Spam_score_int: 100

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Department of the Treasury. Attention! I am Ms. Janet Yellen

secretary to the U.S Department of the Treasury. We just got confirmation

from the Financial Crimes Enforcement Network Finecn Authorities concerned

that your funds' inheritance [...]

Content analysis details: (10.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[unitedbankforafrica214[at]gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.41 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[unitedbankforafrica214[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

0.5 SUBJ_ATTENTION ATTENTION in Subject

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 MONEY_BARRISTER Lots of money from a UK lawyer

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal

information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} TO YOUR ATTENTION!

Department of the Treasury.

Attention!

I am Ms. Janet Yellen secretary to the U.S Department of the Treasury.

We just got confirmation from the Financial Crimes Enforcement Network

Finecn Authorities concerned that your funds' inheritance has been

re-approved for a transfer value amount of USD$5.5Million Dollars by

the new government.

I have solicited proper security and guarantee of these approved

funds, discrepancy and or risk on delivery. Your safety and security

is assured. Therefore, you are advised to contact Barrister Judge

Martins, being the Attorney in charge.

Note, and be advised that your funds have been coded for security

reasons. So contact the Barrister Judge for more information on how to

obtain your remaining proper document and the cost obligations

clearance for hitch-free delivery to you.

Contact him thus:

Attn. Judge Martins,

Director Foreign Operations Department.

Address: 28 Liberty St, New York,

NY 10005, United States.

Email: judgemartinsesq@aol.com

Make sure you resend to him all vital information needed for clearance

via: Your full Name, Address, Drivers License or valid Id, Company=E2=80=99=

s

name and address, telephone etc.

Ask him other things he may require to complete clearance within 72

hours to deliver your funds finally to you.

Ms. Janet Yellen

Treasury Secretary.

NetKnow still in the Netcraft's Top 800

Posted by Dave Yadallee on Monday, May 23. 2022

All data is from Netcraft Toolbar . Looks as if there are major changes to the Netcraft algorithm!

NetKnow

Netknow now 754 from ranks 774 at Netcraft .

We are now redirecting all traffic to Secured general server which now 754 from ranks 774 and pfs compliant .

A slight increase! We must do

security audits regularly
check on illegitimate traffic hitting the web server
keep design current!

Some of our others domains and services ranks as follows:

NetKnow Secure Server

ranks >2000000 from >2000000 Netcraft and pfs compliant .

NetKnow's secondary server

ranks at >2000000 from >2000000 last week on Netcraft and Secured secondary server using the wildcard certificate is at 391 from 406 .

NetKnow's Anonynous FTP server

and non-anonymous must be set to client ports higher than 42000.

www.nl2k.ab.ca

ranks >2000000 from >2000000 on Netcraft.

internetedmonton.ca

ranks at >2000000 from >2000000.

edmontoninternetserviceprovider.ca

is at >2000000 from >2000000 .

edmontonab.ca

ranks > 2000000 from >2000000

How do we compare with other providers in

Edmonton, Alberta, Canada?

Netknow again

We at Netknow are 754 from 774 since the middle of May 2022.

Rogers

Rogers Business Solutions

which rank 8316 from 8523and are hosted in Europe.

Telus and reviews

Next we have Telus.com

ranked by Netcraft at 9768 from 9580 .

Sometimes their Web Hosting is done by
title="Internet Names for Business">Internet Names for Business

is ranked by Netcraft at >2000000 from >2000000 .

Is Telus's ADSL network susceptible to Code Red Attacks and Attackers?

Reviews of Telus are available :

NCIX FORUMS

DSL Reports

Government of Alberta

The Government of Alberta Website

ranks 11711 from 11556 by Netcraft and seems to hosted on Cloudfare.

University of Alberta

The University of Alberta ranks 34961 from 35629 hosted by Amazon Techonologies.

Shaw Cable

Next,

members.shaw.ca

ranks 679190 from 679788 and retired and

Shaw Cable

is next at Netcraft rank 42794 from 41865 . Hosted now by Akamei .

Their Network Hosting Arm,

Big Pipe is at

Netcraft rank 262729 from 268380 and hosted by Akamai in Europe .

Reviews of Shaw are available :

Rate It All

Review Stream

Review Stream Number 2

DSL reports

Juno and NetZero

We have Juno Internet ranked on top

at https://www.juno.com/ 39401 from 40118 who are the owners of

US Based Netzero at Netcraft Rank 52322 from 50707 .

City of Edmonton

The City of Edmonton ranks 99103 from 101963 by Netcraft and hosted by Google.

NAIT / Northern Alberta Institute of Technology

NAIT ranks 108585 from 108746 hosted by Microsoft .

TekSavvy

TekSavvy ranks 128978 from 127097 and are hosted by Microsoft

Xplornet

xplornet

ranks 130069 from 140164 and are listed with

Stentor and are joining up with Shaw.

According to an article in the Sherwood Park Independent, they are also getting an Alberta Government subsidy.

Primus

Primus

ranks 239799 from 253567 and now points to BLACKIRON_DataCentres ranked >2000000 from >2000000.

Internet Centre / CCINet

Internet Centre

rank 273328 from 273467 . Their partner Rack Nine ranks > 2000000.

Grant MacEwen University

MacEwan

ranks 311485 from 337304 .

Distributel / 3Web / CIA

Cybersurf

is ranked 458134 from 458325 and seems to be hosted in USA by Microsoft.

Nucleus Internet Services

After that we have

Nucleus Information Services which can be found at Netcraft Rank 1055841 from 1056635 .

Radiant Communications / goco.ca

Radiant Communications

are ranked by Netcraft 1486016 from 1228410 and part of goco.ca

which ranks 1243610 from 1071838 .

MCSnet

MCSNET ranks 1323583 from 1314182 and are hosted by Microsoft .

Tera Byte Edmonton and reviews

Next is Tera-Byte

at Netcraft Rank 1465137 from 1465039 with

Tera-Byte.ca

ranking >2000000 from >2000000 and their wireless arm Tera-Byte Wireless

sold to Xplornet.

One of Tera-Byte's acquisitions

Edmonton Community Networks

ranks at >2000000 from >2000000 and

Go Edmonton ranks >2000000 from >2000000.

Alberta political blogger Daveberta ranks >2000000 from >2000000; interesting!!!

Reviews of Tera-byte is available at

here

and another here

and check Google for more reviews; just search tera byte.

4Web

4web ranks >2000000 from >2000000 .

Alentus / Wolfpaw

Alentus

rank by Netcraft >2000000 from >2000000 and I note they are hosted in the USA .

wolfpaw.net

which ranks at >2000000 from >2000000

Wiband Wireless

Wiband Wireless

is dead

Yellowpencil

Yellowpencil Ranks >2000000 from >2000000

WSI Corporation

Next is WSI - We Simply The Internet of Toronto

at Netcraft Position >2000000 from >2000000 and are being hosted on Amazon.

Uniserve / Interbaun

Next, Uniserve

ranks on Netcraft >2000000 from >2000000

One of their acquisitions

interbaun

ranks with Netcraft ?????? from ?????? due to merging of sites.

One customer just came over from this organization in Nov 2006.

Clearwave Broadband

Clearwave Broadband ranks

at >2000000 from >2000000

Emergence by Design

Emergence by Design

now ranks >2000000 from >2000000.

Platinum Communications

Platinum Communications Corp.

bought out by Xplornet .

Wild Rose Internet

Wild Rose Internet

ranks >2000000 from >2000000 and I wonder if this is another wireless branch of Tera-Byte and bought out by Xplornet

TIC Internet

TIC Internet

ranks >2000000 from >2000000 ( I do remember you).

Nisa Custom Internet Solutions

Nisa Custom Internet Solutions

ranks >2000000 from >2000000 by Netcraft

MediaShaker

Media Shakers of Edmonton

ranks >2000000 from >2000000

Koi Media

Koi Media

rank >2000000 from >2000000

WebFire

Webfire.ca

ranks >2000000 from >2000000 and seems to be connected with Shaw.

Core Network Solutions Inc.

Core Network Solutions Inc.

ranks at >2000000 from >2000000 .

The Network Centre

The Network Centre

ranks >2000000 from >2000000 and are linked with Telus high Speed.

Open Concept Internet, Inc.

Open Concept Internet, Inc.

rank > 2000000 from > 2000000

InterSpots

Interspots of Edmonton

rank > 2000000 from > 2000000 hosted by Stentor and acquired by Techalta ;

Yegtel

Yegtel rank > 2000000 .

Internet Crossroads

Internet Crossroads Ltd of North Edmonton

rank nothing from nothing by Netcraft and seems to merged with Tera-Byte/ecn.ab.ca .

If I remember anymore, I will add to this entry, before Netcraft changes our ranking. Please watch this space and please feel free to peruse

our services.

urgency donation spam from Google

Posted by Dave Yadallee on Monday, May 23. 2022

Return-path:

Envelope-to: dave@nl2k.ab.ca

Delivery-date: Mon, 23 May 2022 05:55:00 -0600

Received: from mail-ej1-f47.google.com ([209.85.218.47]:38833)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nt6dD-000NaH-IX

for dave@nl2k.ab.ca;

Mon, 23 May 2022 05:53:54 -0600

Received: by mail-ej1-f47.google.com with SMTP id n10so28257013ejk.5

for ; Mon, 23 May 2022 04:53:34 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=oCB860jPEgxMXHpbgmQrpvvyqwVZYyQqKFFcRaUfAUc=;

b=ULSAwIL8lWB4+JctAnFboaC6xVFnj00vnV/jkkLJATM/byRW+MfY4ZLFDZoVDwGmax

kJ3bGgoKjh2mZizerB2Sz0Nbb77wneQEwsA3QkrMU9cF4TQjP6NlpHGgdEuNO2mWk/PH

CUTno/cybyBFE3+xJ2fqEtE1idtCcdzFolyspl3wf6wJALxis3KtbJI+06lgRg+8RtZj

lfxNqaCf7CIXRvoAImR1Lx2Nn857/zyVk/evmqyA9jvAze3HueOZK4xgdS3r/pcHkvY/

+jZlFcJXdcmGaKbSs6W5T9FeFpr1Rd5I8MNtATcxYKtwKFa25zIBxe6OVPlNXv+VqvMW

EhUg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=oCB860jPEgxMXHpbgmQrpvvyqwVZYyQqKFFcRaUfAUc=;

b=RxMSntUH09LKMJ/YXdC8NjeKQAeDJsxC0xL+QhvLDyT4fBwM1Faicaec0Ve5L8nDcJ

8fAPtifsJBRO8dKytc/a6aFPhS3PATW8h6C1UGyGzBIkGqOw+iM6zMjWch/+mm46+gm8

RvVa9J9BM8BPR98JEyL1i/LhsJETS4dWJz/0u69D8LdMXajYzPkFMLLbB9DyL7zKr8KT

FY91rSY6VEov6rDsx2kLMX/HzQflC1qX036WirKmGyyXZk94F2A+fGTPzkktckqiZsbt

uE8HknjL/pTsnmcKzhdbhw44gI1KI0C566YpqsABKGzrOzSSqjEj00c5yxIur1enXtdQ

yEzg==

X-Gm-Message-State: AOAM533QBigcQeyO5d6YYFXRw3TCX9tBboUb1ssmwSXNlVLnplffi/gJ

Stt77CU/E75yi3xj4QCrodR8JjZTNZLYayz7YPU=

X-Google-Smtp-Source: ABdhPJxsyi1KzSMZUGqJLb2N5ZxQdmyF1kcvYZRah5drjPdFcUdpQ8YPxVtRK8RpO04puDqk1nyzunYrSKVNVxSPV2A=

X-Received: by 2002:a17:906:90c9:b0:6fe:9e40:5cc with SMTP id

v9-20020a17090690c900b006fe9e4005ccmr16570779ejw.367.1653306807761; Mon, 23

May 2022 04:53:27 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:6f02:a062:b0:1c:8253:8578 with HTTP; Mon, 23 May 2022

04:53:27 -0700 (PDT)

Reply-To: stefanopessina466@yahoo.com

From: Stefano Pessina

Date: Mon, 23 May 2022 04:53:27 -0700

Message-ID:

Subject: Re

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: dave@nl2k.ab.ca

--

I'm Stefano Pessina, I have a donation for you, Email for more info!

Bank of America phish coming from Google

Posted by Dave Yadallee on Monday, May 23. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 23 May 2022 07:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nt8Lw-000DrX-9X

for dave@doctor.nl2k.ab.ca;

Mon, 23 May 2022 07:44:08 -0600

Resent-From: The Doctor

Resent-Date: Mon, 23 May 2022 07:44:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ed1-f66.google.com ([209.85.208.66]:41764)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nt1Px-0009p7-Kw

for www@doctor.nl2k.ab.ca;

Mon, 23 May 2022 00:19:53 -0600

Received: by mail-ed1-f66.google.com with SMTP id h11so16591209eda.8

for ; Sun, 22 May 2022 23:19:25 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=/A0/2NKH39RyuD99h6jlyjDKzhVMMewFMksYcA40mfY=;

b=pxIeRxBHo5vb2IobcAPezGjoSx9fEd3fHcDufI2wNQhig8LmV40q8MsXnjkGFcMuot

DOf3JvQiiMWvIZrV+bcs+MQLQ/bkdBs55ucBJ2qP/g66i4pR7W4thLt0+9QQXlH8dLbI

HWYB5eI5fjFPwpws9AaAhcfQ33l7quUghcbKz1FNqKbs2anNurBDNf4f8QEaMpH2/2el

p9YzidZpp3QtsB2DswWqzN3mvlManEwignCUWKtQzoSRagoahyUo0rNLh8Gjb4kqnNeN

g8nMOfYRhT8hmXyJW+mrgD7za/G861+Ex1Tiyrt/9TgsACwZchkrj3s/K81vY8Fxn5gA

+hWA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=/A0/2NKH39RyuD99h6jlyjDKzhVMMewFMksYcA40mfY=;

b=qcHB1/O8TMqcWQiyMPM+xOMI3HTl4xwqd9yWYiuOMLBzUJIHcT6hdeeyH/bq1F0gKg

/EP6AoR/b4bHPeA03c1Pfz3PpPNMA+R/Je8KJ6x09xviPGTxl/GR8N4FM7A2zbpy93h5

gCiS02bweHElIscIqi6THLfcOLPrE5TwBunqyfFQcjq+OENqZUvvgVcn113+Wbg9FlZI

3gRrZhtIKuFtT5N5rf6+e6t07tdcgM4DkH6vDOm04Os73wtYnyxpKHhpOrMIoZ5LctNm

2BaFwSUfmZ3/002ioQ1BoC2wYZfzSxjyWBAJ0UEXZjLw7v1bm42Em4z/6oHIFWDp2dsg

IJCg==

X-Gm-Message-State: AOAM533XL3x5MZuqLBScAx8RzNlcJ0bIWC6lObhAZ6MDDHWSXgtSqsid

x6L16c6J0tiGWDgYrwqLN1pOh7i43nVPLOWdZ4M=

X-Google-Smtp-Source: ABdhPJwMLDyOSStWNO90NPtO/ifzF47W1fRLmyOq0Gsaqj4i2rAaqbUG/68cdhTipONqnsJesaj8lMy/692oTp7VAL8=

X-Received: by 2002:a05:6402:845:b0:42b:303f:1ef8 with SMTP id

b5-20020a056402084500b0042b303f1ef8mr14023888edz.49.1653286758682; Sun, 22

May 2022 23:19:18 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a17:906:774c:0:0:0:0 with HTTP; Sun, 22 May 2022 23:19:18

-0700 (PDT)

Reply-To: ba4391285@gmail.com

From: Bank Of America

Date: Mon, 23 May 2022 07:19:18 +0100

Message-ID:

Subject: From Bank of America E-mail us now.

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: www@doctor.nl2k.ab.ca

X-Spam_score: 18.6

X-Spam_score_int: 186

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: From Bank of America Address: 301 S College St, Charlotte,

NC 28202, USA RE/NO: 002-BOA/0047/2022 Founded: 1928 Attn: Account Holder

: This is to notify you that a new development has been made today from the

world bank in which the Bank of America has been authorized to release your

INHERITANCE funds, Now the Bank has been ordered t [...]

Content analysis details: (18.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[frankcollins085[at]gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.66 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[frankcollins085[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[ba4391285[at]gmail.com]

2.5 MILLION_USD BODY: Talks about millions of dollars

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

2.9 YOU_INHERIT Discussing your inheritance

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 FILL_THIS_FORM Fill in a form with personal information

2.0 FILL_THIS_FORM_LONG Fill in a form with personal information

0.0 MONEY_FORM Lots of money if you fill out a form

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.8 ADVANCE_FEE_4_NEW_FRM_MNY Advance Fee fraud form and lots of

money

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases

Subject: {SPAM?} From Bank of America E-mail us now.

>From Bank of America

Address: 301 S College St, Charlotte,

NC 28202, USA

RE/NO: 002-BOA/0047/2022

Founded: 1928

Attn: Account Holder :

This is to notify you that a new development has been made today from

the world bank in which the Bank of America has been authorized to

release your INHERITANCE funds, Now the Bank has been ordered to

release your overdue FUND to you.

We have made several contacts to reach you to claim your outstanding

payment, but we did not hear from you till now, so I wish you will

respond and contact us for this notice to claim your fund. We the

Bankers has created an online Bank account on your behalf and the

online Bank account has been funded with the total sum of $4.5 Million

USD in which you would be able to withdraw any amount of money daily

from the online account, Please what Ever you want to Ask make sure

that You Copy this Email and send an email to me (ba4391285@gmail.com)

Below are the online bank account details

Created Opened Account Amount// $4.5 Million USD

Balance $4.5 Million USD

CHECKING ACCOUNT:

Name: Bank Of America

Account No: 7943730460

Routing No: 121042882 (for international transfer)

Routing No: 121000248 (Domestic)

The bank has also stated that you could be able to start accessing the

online bank account once the transfer code has been issued to you. So

send the following details to me as soon as you get this mail.

Your full name:

home or office address:

phone number:

your Country:

Copy of your ID Card:

Your Age:

Marital Status:

Treat as urgent as I will be waiting for the details.

THANKS FOR YOUR COOPERATION.

Respectively Yours

Mr. Brian Moynihan

DIRECTOR BANK OF AMERICA.

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	May '22					Forward →
						1
2	3	4	5	6	7	8
9	10	11	12	13	14	15
16	17	18	19	20	21	22
23	24	25	26	27	28	29
30	31

INTERAC E-TRANSFER REFUND: #8644O= N87

NetKnow

Netknow again

Rogers

Telus and reviews

Government of Alberta

University of Alberta

Shaw Cable

Juno and NetZero

City of Edmonton

NAIT / Northern Alberta Institute of Technology

TekSavvy

Xplornet

Primus

Internet Centre / CCINet

Grant MacEwen University

Distributel / 3Web / CIA

Nucleus Internet Services

Radiant Communications / goco.ca

MCSnet

Tera Byte Edmonton and reviews

4Web

Alentus / Wolfpaw

Wiband Wireless

Yellowpencil

WSI Corporation

Uniserve / Interbaun

Clearwave Broadband

Emergence by Design

Platinum Communications

Wild Rose Internet

TIC Internet

Nisa Custom Internet Solutions

MediaShaker

Koi Media

WebFire

Core Network Solutions Inc.

The Network Centre

Open Concept Internet, Inc.

InterSpots

Yegtel

Internet Crossroads

INTERAC E-TRANSFER REFUND: #8644O=

N87