Commerical Database spam

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 May 2022 07:03:00 -0600

Received: from root by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nuD8Y-000Ew0-Is

for dave@doctor.nl2k.ab.ca;

Thu, 26 May 2022 07:02:46 -0600

Resent-From: "Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem"

Resent-Date: Thu, 26 May 2022 07:02:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f193.google.com ([209.85.222.193]:42954)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nuCl0-000DQ3-4k

for sales@nk.ca;

Thu, 26 May 2022 06:38:31 -0600

Received: by mail-qk1-f193.google.com with SMTP id j6so1301053qkp.9

for ; Thu, 26 May 2022 05:38:08 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=techuserspro-com.20210112.gappssmtp.com; s=20210112;

h=from:to:references:in-reply-to:subject:date:message-id:mime-version

:thread-index:content-language;

bh=vSDNxT5JiJt6fxniFzwEsok5BrnP46PymuTqs41ptR0=;

b=kg4A0IHStJOWSRM2BWaDjEs/ZaBtRuQrLDDC1yg9xOQcO3M4s6B5vUypF4UmgKilzW

UufrQEMlj8VZlZeyfHkt4SCoY9z+1mkbTET956dDGy6xFt9xE//SoTuSOq/nIY0rJCFv

ioQf4nP41EgMn7tBTF5bkMkttvkfEERscrqKW6oOxGpm7dtFxLQhFrV+AXPhKGSZGZUM

aHrAR7gIkjV+weE+aajDU2/+AgWvBMuIz8qYItH1bDFetLrdqcHaFFlTS6X7pGCaZQxF

jVkdjEF+FAhjLvHRcqHg6DWB0VYNL9XEfKZn1UQ/wmv1RCgImwOfYPvxKhmt2zIQiB8m

Iiiw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:from:to:references:in-reply-to:subject:date

:message-id:mime-version:thread-index:content-language;

bh=vSDNxT5JiJt6fxniFzwEsok5BrnP46PymuTqs41ptR0=;

b=EDp9IsiFOp2CVRmkLIaykPh4SgsOtLVwh50XHAVDYRGsj8f938zcRgMKgMYwtLC/hL

4mmdbReuP5J+ju4ln8/lfg7RRiPo3TpH8zS+TNBqLf2fPlWiIwEKvCCDn9Qb6aAAFyFs

pXvEKejSbK5ksTYlu5VP31/P5C0ITeof9xv55qSK3mWC3rTJz+a0rd2mG1KsAtKkkXD+

YJGgS+BJREqgUrYAwP5Hb5WC3yZtjTwreo3RrIw7w2CEkt541hcaZFlKlU47ZqgEzppE

Huw03R7NqVVLrRWq6Rw7/Q5ytMkQg1U7CwPuZw7rntQ+g0TteEy5rvSPx16THMaUNyW3

bnyw==

X-Gm-Message-State: AOAM530Y0CDWZpBK1AjGZWmTbDew3Hmoa7Q3w1j0JQTVv2e9Ch1GlMmh

eMSfOYdIseoadjTFlJAfFJtipZHtpVDs4DPt

X-Google-Smtp-Source: ABdhPJzTrPV7qMwxAZofLzcuOn2jf5KOPKrwQLWgGs3uAT+7K2vif8r7PrmzbnOL9dCn+fwwN3gPLg==

X-Received: by 2002:a05:620a:1902:b0:5f1:8f5d:b0f2 with SMTP id bj2-20020a05620a190200b005f18f5db0f2mr24601981qkb.60.1653568682725;

Thu, 26 May 2022 05:38:02 -0700 (PDT)

Received: from userPC ([154.6.24.142])

by smtp.gmail.com with ESMTPSA id o7-20020a37a507000000b0069fc13ce225sm1137573qke.86.2022.05.26.05.38.01

for

(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);

Thu, 26 May 2022 05:38:02 -0700 (PDT)

From: "Amanda Medel"

To:

References:

In-Reply-To:

Subject: RE: TRA Marketplace Attendees Contact Database

Date: Thu, 26 May 2022 07:36:49 -0500

Message-ID: <02be01d870fd$70bfe290$523fa7b0$@techuserspro.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_02BF_01D870D3.87EA76D0"

X-Mailer: Microsoft Outlook 15.0

Thread-Index: AdhsSxc23qC1KmJMQlO+VsETPfeL5AAIxDBgAAAAE7AAAAAMEAAAAAzQAAAADAAAAAAMMAAAAAwAAAAADPAAAAAL8AAAAAzwAAAADeAAAAAMQAAAAAsQAAAADBAAAAANAAAAAAwwAAAADjAAAAAOYAAAAAyAAAAADlAAAAAPEAAAAA8QAAAADgAAAAAQ0AAAABeQAAAAE8AAAAATIAAAABPgAAAAE9AAAAAToAAAABCQAAAAE1AAAAANsAAAAA4gAAAAD+AAAAAO4AAAAA1wAAAADtAAAAANYAAAAA/wAAAADvAAAAANsAAAAA7gAAAADrAAAAAOQAAAABPQAAAAEmAAAAAP8AAAABAgAAAAEFAAAAASsAEjwFiA

Content-Language: en-us



This is a multipart message in MIME format.



------=_NextPart_000_02BF_01D870D3.87EA76D0

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit











Hi,



Do you have any update on the data list acquiring?



If this is of your interest I would be very happy to share the counts and

pricing details.







Thanks,



Amanda







From: Amanda Medel [mailto:amanda.medel@techuserspro.com]

Sent: Friday, May 20, 2022 12:23 PM

To: 'sales@nk.ca'

Subject: TRA Marketplace Attendees Contact Database







Hi,







I think you might be interested in acquiring the attendees contact database

of Texas Restaurant Association Marketplace 2022? And there will be a cost

associated with the database.







Attendees: Independent operators, Franchisees, Franchisors, Corporate

executives, Chefs, Unit managers, Restaurateurs, Institutional food service

providers, Hotels, Caterers and more...







Please let me know if you are interested and I will get back to you with

count and pricing information.







I look forward to hearing from you.







Thanks & Regards,



Amanda Medel | Marketing Executive.







To remove, kindly respond with "Exit".













------=_NextPart_000_02BF_01D870D3.87EA76D0

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">
link=3D"#0563C1" vlink=3D"#954F72">


class=3DMsoNormal>
style=3D'color:#1F497D'> 


class=3DMsoNormal>
style=3D'color:#1F497D'> 


class=3DMsoNormal>
style=3D'color:#1F3864'>Hi,


class=3DMsoNormal> =


style=3D'color:#1F3864'>Do you have any update on the data list =

acquiring?


style=3D'color:#1F3864'>


class=3DMsoNormal>If this is of your =

interest I would be very happy to share the counts and pricing =

details.


style=3D'color:#1F3864'> 


class=3DMsoNormal>
style=3D'color:#1F3864'>Thanks,


class=3DMsoNormal>
style=3D'color:#1F3864'>Amanda


class=3DMsoNormal>
style=3D'color:#1F497D'> 


style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in =

0in 0in'>

From: Amanda Medel =

[mailto:amanda.medel@techuserspro.com]
Sent: Friday, May 20, =

2022 12:23 PM
To: 'sales@nk.ca'
Subject: TRA =

Marketplace Attendees Contact Database


class=3DMsoNormal> 


style=3D'color:black'>Hi,


class=3DMsoNormal>
style=3D'color:black'> 


class=3DMsoNormal>I think you might be =

interested in acquiring the attendees contact database of Texas =

Restaurant Association Marketplace 2022? And there will be a cost =

associated with the database.


class=3DMsoNormal>
style=3D'color:black'> 


class=3DMsoNormal>Attendees: =

Independent operators, Franchisees, Franchisors, Corporate executives, =

Chefs, Unit managers, Restaurateurs, Institutional food service =

providers, Hotels, Caterers and more...


class=3DMsoNormal>
style=3D'color:black'> 


class=3DMsoNormal>Please let me know if you =

are interested and I will get back to you with count and pricing =

information.


style=3D'color:black'> 


class=3DMsoNormal>I look forward to hearing =

from you.


style=3D'color:black'> 


class=3DMsoNormal>Thanks & =

Regards,


style=3D'color:black'>Amanda Medel | Marketing =

Executive.


style=3D'color:#1F4E79'> 


class=3DMsoNormal>To =

remove, kindly respond with =

"Exit".


class=3DMsoNormal> 


class=3DMsoNormal> 



------=_NextPart_000_02BF_01D870D3.87EA76D0--



Phishing attempt on a service not used

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 May 2022 21:14:00 -0600

Received: from mail.mppolice.gov.in ([210.212.145.115]:64850)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nu3u2-0000wk-EZ

for dave@doctor.nl2k.ab.ca;

Wed, 25 May 2022 21:11:18 -0600

Received: from localhost (localhost [127.0.0.1])

by mail.mppolice.gov.in (Postfix) with ESMTP id 70CF013E47A6

for ; Thu, 26 May 2022 01:00:08 +0530 (IST)

Received: from mail.mppolice.gov.in ([127.0.0.1])

by localhost (mail.mppolice.gov.in [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id vDPkfoUefrbn for ;

Thu, 26 May 2022 01:00:08 +0530 (IST)

Received: from mail.mppolice.gov.in (localhost [127.0.0.1])

by mail.mppolice.gov.in (Postfix) with ESMTP id 19171EDD92F

for ; Wed, 25 May 2022 23:53:08 +0530 (IST)

Received: from [103.1.179.201] (unknown [103.1.179.201])

by mail.mppolice.gov.in (Postfix) with ESMTPSA id 4ADCA1267DD5

for ; Wed, 25 May 2022 23:49:43 +0530 (IST)

Content-Type: multipart/alternative; boundary="===============1697550096=="

MIME-Version: 1.0

Subject: Your account has Exceededit Quota

To: dave@doctor.nl2k.ab.ca

From: "Administrator"

Date: Wed, 25 May 2022 23:48:52 +0530

Message-Id: <20220525181944.4ADCA1267DD5@mail.mppolice.gov.in>

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your Zimbra Mailbox Has Exceeded It Quota/Limit As Set By

Zimbra Team, And You May Not Be Able To Send Or Receive New Mails Until You

Re-Validate Your Zimbra Mailbox.To Re-Validate dave@doctor.nl2k.ab [...]



Content analysis details: (10.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

3.0 URI_FIREBASEAPP Link to hosted firebase web application,

possible phishing

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.0 AC_FROM_MANY_DOTS Multiple periods in From user name

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: mailbox.to]

Subject: {SPAM?} Your account has Exceededit Quota



You will not see this in a MIME-aware mail reader.

--===============1697550096==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body



Your Zimbra Mailbox Has Exceeded It Quota/Limit As Set By Zimbra Team, And =

You May Not Be Able To Send Or Receive New Mails Until You Re-Validate Your=

Zimbra Mailbox.To Re-Validate dave@doctor.nl2k.ab.ca account, Please CLICK=

: Re- Validate dave@doctor.nl2k.ab.ca Account



--===============1697550096==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body




=3Diso-8859-1"/>

Your Zimbra Mailbox Has Exceeded It Quota/L=

imit As Set By Zimbra Team, And You May Not Be Able To Send Or Receive New =

Mails Until You Re-Validate Your Zimbra Mailbox.To Re-Validate dave@doctor.=

nl2k.ab.ca account, Please CLICK:
=3D%2013InboxLightaspxn.1774256418&%20fid.4.1252899642&fid=3D1&=

fav.1&%20rand.13InboxLight.aspxn.%201774256418&fid.1252899642&f=

id.%201&fav.1&login=3D25&loginID=3D$%20loginID&.rand=3D13In=

boxLight.%20aspx?n=3D1774256418&fid=3D420%5Cl22n=3D%201252899642&fi=

d=3D1&fav=3D1">
000ff face=3DArialMT>Re- Validate dave@doctor.nl2k.ab.ca Account=



--===============1697550096==--