NetKnow Corporate Blog | Entries from Saturday, May 28. 2022

uNITED nATIONS COMPENSATION SPAM FROM gMAIL

Posted by Dave Yadallee on Saturday, May 28. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 28 May 2022 15:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nv3YA-000IGM-NS

for dave@doctor.nl2k.ab.ca;

Sat, 28 May 2022 15:00:42 -0600

Resent-From: The Doctor

Resent-Date: Sat, 28 May 2022 15:00:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f173.google.com ([209.85.208.173]:44812)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nv0SL-000CmM-F9

for root@nk.ca;

Sat, 28 May 2022 11:42:35 -0600

Received: by mail-lj1-f173.google.com with SMTP id 24so488385ljw.11

for ; Sat, 28 May 2022 10:42:08 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=dNDedvOUnNbtvrgdW9ENeJtU/xusBykep35/sdOpj6o=;

b=V5HKQYrs6LFfY1O5BJtLbfmDl3vY4lWUAmZ+qmWf8vDCuYNZPl+DNOGPfkfAAbEsy4

ZdEuJr8Y0ikFmEtXoSC7mfboURnqcgFo8+cKkQCQx+N3mDp9NrvfESoSwbPD60UuT/9h

RWebjIM5k9bPVYMDoh5Lv9cJMHv4vTsbBdJK2T4eXk0t/9MopgyhLpKVobBtTxjduP+I

USh3WFS4DznenS7DwfT1mIerttv6K75Pw0yjSROB8Zz7W1XsMSjeBdvrRAvxCVb97zEY

/No9mJVZqFfZxxbq5qyVP4/dE9IwComMt5o8rycRvJKLckJ+Od3v43Gjsg3waqyCncBk

UJwg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=dNDedvOUnNbtvrgdW9ENeJtU/xusBykep35/sdOpj6o=;

b=yLQtKth+LDRtFeErxSCALqOLh7dSftCIeRTuZz6rN1MH52+EY7N/1TC6UKITFRSt7N

xiQw5exF9wdD72WJCquTWubChXWFUcr01S7StFvk4o4ilgRTVhEVmVNSXeFKet5YiBcz

1SJgldadrdEdNYXd7X0l2crckO928facDvJH0R115oM3OoYo4eYK3Z3m9Pkwdjd08cnq

XvT8Hu9SL7bAKK8kHWeO+obzuT2H15DJRD8fo35eRaJv1JYYEXS/3yPNcXgGb4OvtiJw

SqqpiPbr85/fw18TodkphXshQMsfdkz18sESm3/qBiPQfW3C6cf3DcS9G8bto9nICrF4

fnjg==

X-Gm-Message-State: AOAM533MU7c83UxUzW3sBLoXoaDiCX4vVOogKarGpTDURehFxQsif2Dn

BgSF6NjnXiw98xn6yAW1KCZH9F+YOq3l3ndR1Og=

X-Google-Smtp-Source: ABdhPJw4PowPUlG+3V8BdBS3lZPAWTrFBVLkQgRvp8sY+dtu9tr3zmTHunBxl02xBL7jvUzmY+sL/0aznwla6ri9FRI=

X-Received: by 2002:a2e:bf03:0:b0:254:224a:372 with SMTP id

c3-20020a2ebf03000000b00254224a0372mr7701495ljr.509.1653759721040; Sat, 28

May 2022 10:42:01 -0700 (PDT)

MIME-Version: 1.0

Reply-To: antonioguterre4@gmail.com

From: =?UTF-8?Q?Ant=C3=B3nio_Guterres?=

Date: Sat, 28 May 2022 10:41:48 -0700

Message-ID:

Subject: RE: UNITED NATIONS ORGANIZATION FUND APPROVED VIA ATM MASTER CARD

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000b770a705e015f0f9"

Bcc: root@nk.ca

X-Spam_score: 24.8

X-Spam_score_int: 248

X-Spam_bar: ++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: UNITED NATIONS ASSISTED PROGRAMMED DIRECTORATE OF INTERNATIONAL

PAYMENT AND TRANSFERS. UNITED NATIONS LIAISON OFFICE LONDON UNITED KINGDOM

WIRE TRANSFER/AUDIT UNIT Our Ref: UN/CPO/WB/845/2022 ATTENTION:BENEFICIARY:

Content analysis details: (24.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[bankofnigcentral8[at]gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.173 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[bankofnigcentral8[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[antonioguterre4[at]gmail.com]

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

2.5 MILLION_USD BODY: Talks about millions of dollars

1.3 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

0.0 HTML_MESSAGE BODY: HTML included in message

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

1.5 MONEY_ATM_CARD Lots of money on an ATM card

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.5 XFER_LOTSA_MONEY Transfer a lot of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal

information

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: card.to, un.org]

Subject: {SPAM?} RE: UNITED NATIONS ORGANIZATION FUND APPROVED VIA ATM MASTER CARD

--000000000000b770a705e015f0f9

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

UNITED NATIONS ASSISTED PROGRAMMED

DIRECTORATE OF INTERNATIONAL PAYMENT AND

TRANSFERS. UNITED NATIONS LIAISON OFFICE

LONDON UNITED KINGDOM

WIRE TRANSFER/AUDIT UNIT

Our Ref: UN/CPO/WB/845/2022

ATTENTION:BENEFICIARY:

Reply To: antonioguterre4@gmail.com

How are you today? Hope all is well with you and family?You may not

understand why this mail came to you. We have been having a meeting for the

passed three months which ended two days ago with the UNITED NATIONS BOARD

AND AND WORLD BANK ORGANIZATION AUDITORS, with New secretary to the United

Nations. Mr.Ant=C3=B3nio Guterres. This email is to all the people that hav=

e

been scammed in any part of the world,

the UNITED NATIONS have agreed to compensate them with the sum of

$2,500,000 USD (Two Million Five Hundred Thousand United States Dollars}

each. This includes every foreign contractors that may have not received

their contract sum, and people that have had an

unfinished transaction or international businesses that failed due to

Government problems etc.We found your name in our list and that is why we

are contacting you, this have been agreed upon and have been signed.

You are advised to contact Mr. Peter Olisemedua Amangbo, of ZENITH BANK

NIGERIA PLC, as he is our representative, contact him immediately for your

(ATM Card) of US$2,500,000 USD (Two Million Five Hundred Thousand United

States Dollars} each.This funds are in a ATM MASTER CARD.for security

purpose ok? so he will send it to you through Courier Services and you can

use it in any ATM master card in any part of the country,

Therefore, you should send him your full Name and telephone number/your

correct mailing address where you want him to send the ATM MASTER CARD.to

you.

Contact Mr. Olisemedua Amangbo, immediately for your ATM MASTER CARD.Person

to Contact Olisemedua Amangbo, Bank Name Zenith Bank Nigeria Plc Contact

him now on his direct Email: infozenithbankorg1@gmail.com

Once Again When Contacting Him Send To Him your Your Full Name, Residential

Address, Private Phone Number.

Thanks and God bless you and your family. Hoping to hear from you as soon

as you receive your ATM MASTER CARD.

Mr.Ant=C3=B3nio Guterres

United Nations Secretary General.

Web:http://www.un.org/sg/

--000000000000b770a705e015f0f9

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

UNITED NATIONS ASSISTED PROGRAMMED
DIR=

ECTORATE OF INTERNATIONAL PAYMENT AND
TRANSFERS. UNITED NATIONS LIAISON =

OFFICE
LONDON UNITED KINGDOM
WIRE TRANSFER/AUDIT UNIT
Our Ref: UN/=

CPO/WB/845/2022

ATTENTION:BENEFICIARY:

Reply To:
ailto:antonioguterre4@gmail.com">antonioguterre4@gmail.com

How a=

re you today? Hope all is well with you and family?You may not understand w=

hy this mail came to you. We have been having a meeting for the passed thre=

e months which ended two days ago with the UNITED NATIONS BOARD=C2=A0 AND A=

ND WORLD BANK ORGANIZATION=C2=A0 AUDITORS, with New secretary to the United=

Nations. Mr.Ant=C3=B3nio Guterres. This email is to all the people that ha=

ve been scammed in any part of the world,

=C2=A0the UNITED NATIONS h=

ave agreed to compensate them with the sum of $2,500,000 USD (Two Million F=

ive Hundred Thousand United States Dollars} each. This includes every forei=

gn contractors that may have not received their contract sum, and people th=

at have had an
unfinished transaction or international businesses that f=

ailed due to Government problems etc.We found your name in our list and tha=

t is why we are contacting you, this have been agreed upon and have been si=

gned.

You are advised to contact Mr. Peter Olisemedua Amangbo, of ZE=

NITH BANK NIGERIA PLC, as he is our representative, contact him immediately=

for your (ATM Card) of US$2,500,000 USD (Two Million Five Hundred Thousand=

United States Dollars} each.This funds are in a ATM MASTER CARD.for securi=

ty purpose ok? so he will send it to you through Courier Services and you c=

an use it in any ATM master card in any part of the country,

Therefo=

re, you should send him your full Name and telephone number/your correct ma=

iling address where you want him to send the ATM MASTER CARD.to you.

>Contact Mr. Olisemedua Amangbo, immediately for your ATM MASTER CARD.Perso=

n to Contact Olisemedua Amangbo, Bank Name Zenith Bank Nigeria Plc Contact =

him now on his direct Email:
">infozenithbankorg1@gmail.com

Once Again When Contacting Him Se=

nd To Him your Your Full Name, Residential Address, Private Phone Number.
r>Thanks and God bless you and your family. Hoping to hear from you as soon=

as you receive your ATM MASTER CARD.

Mr.Ant=C3=B3nio Guterres
Un=

ited Nations Secretary General.
Web:ht=

tp://www.un.org/sg/

--000000000000b770a705e015f0f9--

MOre gullibe money spam from GMail

Posted by Dave Yadallee on Saturday, May 28. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 28 May 2022 15:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nv3Xf-000HIi-VA

for dave@doctor.nl2k.ab.ca;

Sat, 28 May 2022 15:00:11 -0600

Resent-From: The Doctor

Resent-Date: Sat, 28 May 2022 15:00:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wr1-f67.google.com ([209.85.221.67]:46820)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nuzYd-0000tQ-1n

for sales@nk.ca;

Sat, 28 May 2022 10:44:58 -0600

Received: by mail-wr1-f67.google.com with SMTP id d26so3865301wrb.13

for ; Sat, 28 May 2022 09:44:37 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=q0NOor8eIg/ea3rdbLnGhkBMqP4RNhpkxe1nfNB8SwY=;

b=e4/EGaMsSygaUfR52F8K1M/sX/tkaOcpgN7I2TNq9FQSeccYix8heiktbPUfFEsGHh

0I7lZTvpbO00hJ7Wp49kv6XuAjRr++xw2asGqhw8SjQuPunzEvi/ndBf/7pfREjyCDzo

jpKmN5HJ/aA5yftkKoJS0Ft6f5WiXZC8nWmCiybjoeApxIVjKoKkt9TujdIl6Xe8uEdl

SR5qiRu/9OFgKALU4T+q2zLCfKDADXSbUYG6Y8b1nSWrop4l6PogLaNn/cz5wvZkv10C

jAX+stdn7uLUX6Ksp3W/Ue/f/+c5xwVrNlWUEYWqkx3ZP8/Yc3rPagQ9dPk0SC9p25dE

yUSQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=q0NOor8eIg/ea3rdbLnGhkBMqP4RNhpkxe1nfNB8SwY=;

b=OdUpcbw49udXnw0Y/ZvyogmD6fe/OMlv8pxvEFut/AslOg2KYl0YTOZStEYH/LzdCW

DXexymC64fn4NJcevixkDbi9pjMB1wP94kX+gUJ8fp6GyeMgTf9pcFmmdKit9Sm1OWFu

L5Sfm1NO5h3WmL/X01kel7YAGaYJrUkrgPFNstZAa0BBjqROj7Zj07tbw2zV/+67MdHn

Gn3N5qAQl6ywxCJoAfcj3f7V29hPUu71GHvsjpm5uUFoAh6Z+PjwvnQCmRfGCmFRnVzR

TWtzMad9xBoekS+w1TRc9gLSfxJZTY1pCbw/HPp8/mKKxj7BZPpnnLWidEtggZvZ2FzR

tCfg==

X-Gm-Message-State: AOAM533DMhiE1+dVvvDLre3g+4VIn/45MwfEOO+NaVXP1svan0/FAFYV

18+xdX/AajW4sh6EccD/okYzBMLRyFcVHe1MgVU=

X-Google-Smtp-Source: ABdhPJw2Hwv+7TQMsFApNTRWvf9y0SCWeC+YVFA8muPz6GCbYdjIRc3vZURdxNVJJ4hFDugv0WTIcbksbLlqL0jw0ik=

X-Received: by 2002:a5d:610f:0:b0:210:e8b:7890 with SMTP id

v15-20020a5d610f000000b002100e8b7890mr9893058wrt.411.1653756271413; Sat, 28

May 2022 09:44:31 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:6000:1082:0:0:0:0 with HTTP; Sat, 28 May 2022 09:44:30

-0700 (PDT)

Reply-To: wallace.robert46@yahoo.com

From: "Robert Wallace."

Date: Sat, 28 May 2022 18:44:30 +0200

Message-ID:

Subject: Re: Re: Urgent Respond Needed.

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: sales@nk.ca

X-Spam_score: 7.6

X-Spam_score_int: 76

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: -- Hello. This is a personal email directed to you for your

consideration alone. I request that it remain and be treated as such only.

Content analysis details: (7.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.67 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[bryonhher[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[wallace.robert46[at]yahoo.com]

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Re: Re: Urgent Respond Needed.

--

Hello.

This is a personal email directed to you for your consideration alone.

I request that it remain and be treated as such only.

My name is Robert Wallace. I'm a Belgian/British Citizen an Attorney. I

have an interesting business proposal for you that will be of immense

benefit to both of us, although this may be hard for you to believe, we

stand to gain 9.7 Million Dollars between us in a matter of weeks. This is

fully legal and 100% genuine. I need you to signify your interest by

replying to my email. Most importantly, I need you to keep whatever

information between us confidential even if you decide not to go along with

me. I will make more details available to you on receipt of your positive

response.

Regards,

Robert Wallace.

More gullible money spam from GMail

Posted by Dave Yadallee on Saturday, May 28. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 28 May 2022 15:00:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nv3XC-000HAj-1P

for dave@doctor.nl2k.ab.ca;

Sat, 28 May 2022 14:59:42 -0600

Resent-From: The Doctor

Resent-Date: Sat, 28 May 2022 14:59:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f67.google.com ([209.85.218.67]:36554)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nuzQU-0000GL-AH

for root@nk.ca;

Sat, 28 May 2022 10:36:33 -0600

Received: by mail-ej1-f67.google.com with SMTP id gi33so13863809ejc.3

for ; Sat, 28 May 2022 09:36:13 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=q0NOor8eIg/ea3rdbLnGhkBMqP4RNhpkxe1nfNB8SwY=;

b=ehGpa87Qqf9sBsup/6WMUDz+KBnBhfgRNTEJOyH31bIkGH2Rjny5he/8W+0ju2z05e

tEiq9uWOuM9n6eC+Kl8EofeaSKs5GI24ntHUbIHPlp8Wg4lU7t4e4lKSnXKuJLpl0Jev

blelXm+Cy+gb4JuLH9qo0atsorIoqvf/SW4WGB2sHxu1poHjaGYxiChuVS3JXU/wxYmr

FllNbWGLo8S+ITK2LzfuRKBZsuSo4MKCy3ZeqX93CPawVJjrydwGwz7PYvS23RhDEA7z

it6gp85YCzKwZ8BpzDb6zKOBWfMiWTBQSH14oKgJgi+uxmnnJBWzsZpKWAD6rd3Qdxav

0uFQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=q0NOor8eIg/ea3rdbLnGhkBMqP4RNhpkxe1nfNB8SwY=;

b=MdvabbQxx6Na19u0GRXTMZTcT50RTiDdV2454FrrdRaJ916Q/6Q0c0he/TdmGMvF2Q

hismcDLkiY2cGlSFRqI2un+uTTTCqm7GjY5764VrCcfXqNBWpz9MmuopRtUUYF8oZsuc

4mDFO2Tc/JNYqakgMY87CDPInu9ioONbYBrn0yOYO+dG2YPnmJejf375frqyryiYdoIg

ahAJMJIh3TIOJYCWwDasaU4xQmyIo/6G0CrZP+tp2DO7GO3WgK5hjaKMAicSYle/Rzxy

7BUqrBPmSski3RT+kJP80srq0rJb4oCHh8/B0FiKTa8EliFHAZZpYG7Z2bX9JsI8tGuO

Xatg==

X-Gm-Message-State: AOAM533Z7mFdWzX8+QOgKM7wBzUSd+KKK9Yimdh8bjrpGQ6Od0O1DdTj

jlHf7oqu7HszxphN0m1thCecdMiWIQmqzM7mW6s=

X-Google-Smtp-Source: ABdhPJyB/7Whi58H2Y618vVKt1sllNhZnORNd+VYQi1fMliCM+ti8B/ayxQrz1x8l3tisg1IVYbqLxAUmArsC/B82n8=

X-Received: by 2002:a17:906:58cb:b0:6ff:5282:dd83 with SMTP id

e11-20020a17090658cb00b006ff5282dd83mr1946652ejs.510.1653755766537; Sat, 28

May 2022 09:36:06 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:640c:e46:b0:153:17e3:9d0c with HTTP; Sat, 28 May 2022

09:36:05 -0700 (PDT)

Reply-To: robert_wallace12@yahoo.com

From: "Robert Wallace."

Date: Sat, 28 May 2022 18:36:05 +0200

Message-ID:

Subject: Re: Re: Urgent Respond Needed.

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: root@nk.ca

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: -- Hello. This is a personal email directed to you for your

consideration alone. I request that it remain and be treated as such only.

Content analysis details: (7.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.67 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[dwaynjson[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[robert_wallace12[at]yahoo.com]

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Re: Re: Urgent Respond Needed.

--

Hello.

This is a personal email directed to you for your consideration alone.

I request that it remain and be treated as such only.

My name is Robert Wallace. I'm a Belgian/British Citizen an Attorney. I

have an interesting business proposal for you that will be of immense

benefit to both of us, although this may be hard for you to believe, we

stand to gain 9.7 Million Dollars between us in a matter of weeks. This is

fully legal and 100% genuine. I need you to signify your interest by

replying to my email. Most importantly, I need you to keep whatever

information between us confidential even if you decide not to go along with

me. I will make more details available to you on receipt of your positive

response.

Regards,

Robert Wallace.

scammers scam phish from Gmail

Posted by Dave Yadallee on Saturday, May 28. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 28 May 2022 06:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nuvqn-000NER-95

for dave@doctor.nl2k.ab.ca;

Sat, 28 May 2022 06:47:25 -0600

Resent-From: The Doctor

Resent-Date: Sat, 28 May 2022 06:47:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f196.google.com ([209.85.128.196]:34658)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nuv2y-000EBJ-Nf

for doctor@nl2k.ab.ca;

Sat, 28 May 2022 05:56:00 -0600

Received: by mail-yw1-f196.google.com with SMTP id 00721157ae682-306b5b452b1so38008097b3.1

for ; Sat, 28 May 2022 04:55:35 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=euDEn8VxJxDFN1y5CiFgNQOF6xkbEIbBzV3SSGBP0Bc=;

b=IWDt/6XFZGIOs3kEnt3G0mm6bqRK0Ynu/fPX89PK4RHwijil0oR4oGWtiAcjw5PPfM

Z7qnNWVDyxFiOFqLtXfRqovhjpmJM3Ua9CLcXPqjifFUddWZdEJJ/8lbE0ETHKW2e3Ix

F2ySxzsoQy0Z1Jb3IGlRW5jhYz09+kSARFq8e13ya2iFZiig5roSx+NP4d3Kj9/sb7+M

AibRk7YfFfiwn2CNwVoccLucwVTc1m4MzD30mcB1FiUXc4lnipwlFAPqeXIOxEqtPG9/

n8ompezzfs0wpfnKPGQivQFtGiHIA30jNSdNR+DUCqxhG5R6c0in3HVcE2oULuODgtqZ

FWnQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=euDEn8VxJxDFN1y5CiFgNQOF6xkbEIbBzV3SSGBP0Bc=;

b=69nnHO1okxRAWn2+vDQr+3RQu+JeoOQ1xVQHqBMa2pfz2TrF8/mSqlof0NYj9gX4d+

x6LF/cZpVMZblSlZU59K/dBtCBolFIxKU8ETp5JDqaTzntpWRJxBkYyYEdLAEmAainyE

0WisJCCpK/ZjPUOgKRBgZqB8T4Z+/sIVVJa77hcYVnboUIJMLCjd3hlHDLZNm8Nz7f2H

LvM3N6I42XWF/X9BROeu9znRXto6CphDCkMrYngv3JPPujSjCzf+/GgnpnVfgf2zIuzA

AuainXPTOZDyWhNnXd0231zn6s3xAdlii2KDMwQ5bxlgJyVwIJXQlzurNJvDZN/ENMRF

1RIg==

X-Gm-Message-State: AOAM533KetDKegzoL+92CznqcPtRxTt22eddVkyUaCmlS3p3+rv2wyoE

xtiIcSqolTxFl1tEoNGJhEpyQRhH4095AOnK5sg=

X-Google-Smtp-Source: ABdhPJxeKq/FNr+eeP3hMMN/bflgK6wRYMaKSAihkfK8HbDzOSA/eA7ktOcaM1bvlz7hqKYk8AQlJ4SSlao2Wr3BVbI=

X-Received: by 2002:a0d:ffc3:0:b0:2eb:2327:3361 with SMTP id

p186-20020a0dffc3000000b002eb23273361mr47953940ywf.36.1653738929322; Sat, 28

May 2022 04:55:29 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:7000:6e8a:0:0:0:0 with HTTP; Sat, 28 May 2022 04:55:28

-0700 (PDT)

Reply-To: insp.maxwell101@outlook.com

From: "INSP. MAXWELL"

Date: Sat, 28 May 2022 12:55:28 +0100

Message-ID:

Subject: You are a Scam Victim, Stop Sending Money to Scammers

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 9.9

X-Spam_score_int: 99

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: -- Good Day Dear Scam Victim, Urgent Reply Needed ! Hope you

get this mail in good health and sound mind.The Economic and Financial Crimes

Commission EFCC with the assistance of the FBI has detected from our database

that you have been sending money to [...]

Content analysis details: (9.9 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[orjifrank54[at]gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.196 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[orjifrank54[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[insp.maxwell101[at]outlook.com]

0.9 URG_BIZ BODY: Contains urgent matter

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal

information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

Subject: {SPAM?} You are a Scam Victim, Stop Sending Money to Scammers

--

Good Day Dear Scam Victim, Urgent Reply Needed !

Hope you get this mail in good health and sound mind.The Economic and

Financial Crimes Commission EFCC with the assistance of the FBI has

detected from our database that you have been sending money to some

SCAMMERS for one documentation to another, Transfer charges of funds

etc and yet you are not getting any funds (ATM Card).

We are giving you the full ODER to STOP sending Money or ITunes cards

to them for you will not get anything positive from those thieves that

have been robbing you for quite a long time now.

These fraudulent people are here in Nigeria, UK and USA.

Also a report has reached us that you have sent so much money to this

scam artist. Please STOP!!! contacting these people we advise you to

STOP and use your hard earned money for something good.

However, the President of Nigeria, Muhammed Buhari and the United

Nation and IMF are giving you a compensation check of $850,000USD so

that you can start life again and be a happy and better person.

Dear Scam victims, You are strongly advised to provide us with the

below information.

Name in full:

Home address:

Marital Status:

Also a phone number to contact you with is needed.

send the above information to our email Address stated below.

Inspector Maxwell Okeke

Email: insp.maxwell101@outlook.com

Thanks

Economic and Financial Crimes Commission EFCC

Netflix suspension spam from Microsoft Outlook server

Posted by Dave Yadallee on Saturday, May 28. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 28 May 2022 06:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nuvqa-000NE5-O5

for dave@doctor.nl2k.ab.ca;

Sat, 28 May 2022 06:47:12 -0600

Resent-From: The Doctor

Resent-Date: Sat, 28 May 2022 06:47:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-tyzapc01on2058.outbound.protection.outlook.com ([40.107.117.58]:49348 helo=APC01-TYZ-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nuv3c-000ED4-I1

for doctor@doctor.nl2k.ab.ca;

Sat, 28 May 2022 05:56:42 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=BEI/V+fFNmUvNLKJyzYtkZ0zZTWSqhz49gLFIhH6WOgH9CZoyPZiQ4TQHbdZw5Musuv95wBzju0JtcrPj38tSbQq60Zi6aWTgaKYStp5/8ohH1CJ1NgznWgckcRtPnw4hQ7ffdiUkbg+L6CnlCl+nXNFMKtFbE0GlkbkXr1aTTAR49MhpyR1BqJTLDoj+Ir4KVXrK6RXGhlJ1Wz8n8WWZUgDCWTj5YcPa4cX5fYkv949itK989SY6AMxZhyLL6rfaCPDEVjGWCcjYAcOVNrt4scP/nXV1eOXK8iOHR3OQWXgIMlimGbtE6gaVP7IcpTS5HPkZ0C3h+GKVvZVjGStfg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=AIa1bprkIdci3PqF88Fo5zRTuJ9OkH1oThrb9gShGu0=;

b=OcUOVYECg1iMr9iL9nRY4Yid6LtSU2r5vSlTrzRnLXUro3vYJqmUkBL1vg8EcF3F67/jfCp/zDDMvO8e8WVfnZdrk4phoiKLJdQDzPnYTMHikv+qccYb4RMU9bWkWNRcWDucbKKazf/r2vHYgWU+Rym0YqxNX5oRtFMgw3CmW92wm2EXPeufQxPgUCmkN9G2nwJPJNXTabyOJAa5wacysiYdY59QVL0F8iGsQwNDe/EYpbGGQgiKPoeBIrrkyNGT4i75tF4e18mVTzmLfneXfMh0mzPeZvqdb5BWwnMsz64aeZgT83t9bntcuYPma1Rcb0Wzvs5xk/rCDI/pNnoB4w==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=hazeemsoft.com; dmarc=pass action=none

header.from=hazeemsoft.com; dkim=pass header.d=hazeemsoft.com; arc=none

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=hazeemsoft.com;

Received: from HK0PR02MB2865.apcprd02.prod.outlook.com (2603:1096:203:37::22)

by PSAPR02MB5015.apcprd02.prod.outlook.com (2603:1096:301:8f::8) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5293.17; Sat, 28 May

2022 11:56:11 +0000

Received: from HK0PR02MB2865.apcprd02.prod.outlook.com

([fe80::f5b2:feac:2792:1789]) by HK0PR02MB2865.apcprd02.prod.outlook.com

([fe80::f5b2:feac:2792:1789%5]) with mapi id 15.20.5293.017; Sat, 28 May 2022

11:56:10 +0000

Content-Type: multipart/alternative;

boundary="--_NmP-549ae5435061411d-Part_1"

From: "=?UTF-8?B?TmV0ZmxpeA==?="

To: doctor@doctor.nl2k.ab.ca

Reply-To: bnQqTMWvveNfNj-kcyhp-sjeMNfGnmelPAam@hazeemsoft.com

Subject: Alert : Your Account is on Hold

Message-ID: <891d1632-d0fa-e68f-e909-9f0714add098@hazeemsoft.com>

Date: Sat, 28 May 2022 11:55:23 +0000

X-ClientProxiedBy: DM6PR07CA0078.namprd07.prod.outlook.com

(2603:10b6:5:337::11) To HK0PR02MB2865.apcprd02.prod.outlook.com

(2603:1096:203:37::22)

Importance: high

X-Priority: 1

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-Office365-Filtering-Correlation-Id: 5bd65589-2619-4906-f628-08da40a0f524

X-MS-TrafficTypeDiagnostic: PSAPR02MB5015:EE_

X-Microsoft-Antispam-PRVS:

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

oYD+OOjQDjlTdNRK374E8iKr+bjKS7vmvSeA7h9YN09eM1NdB/3DjMbndAkSI5dHcWXE8GN82lqjS+MpWj/TcFxwXO0265ERH1w+OCgxL+iSJAU6sIViYedTmsB2kEBrS96DgG5mTmgCsu4feFTJEq8QSqYEq41DUVR4QUNh6RQCD61ePCSs1kMXO9A++WFp7kh5acL7ie3fK05ZGecAcqrTiVELhiI1XHEiFaekih0N2AOFEEUmG5ItK7HQsQcmTCnxvkcLfrWnCnHRW0OOoKeEa/GpeTG3GWPIio0+qF3W3F7XN3PNrSvNSZp4kEe4/UOFRLa7KQ8NxZNc9nRiC7SS4G9CAhsVoZwzLa56VT84KWt2DYR485xRhmXCmj/hqyyS90mD/FzP3XlA/mUzPDGMqp74ypqKG+x9iN7B/SoozQITUAVnsVsBW+uawfKeHn6SHMOMB1K9/HlGcT9/9bmpm9R6JubF2bXIYzNa2LVJ/u43c4Hg1mOy/o0+hGGa3JQOeRsI6jmJy5SjIWKFMdcLyOmCobrgfA5itUMK72TFaDxaYnRrn9FYP22jDDAG+MFZbOWS5m3C+5p0YAzdQgC+mzy833KKr9cgM6wu0OIQmkArcxDZ1E+WlNI0euAM2Mv1tzem0RRt0t6n2vwT2VJnEr22Cj4sTsIGAhYj4lb/1wmBMmH1I2xs4A/NiPIOQZbcKJ4Ff8oEwe77vcA5gVgzaxrut/AFmI/mdci6GEUzS/H8wo4DnqtDBbFoPqUI5LJsNUYjhhqs4ymS3Cm/Bswx5NrK7+x9daF82t/+69Db1qb+X8Fd0pe7HlAx7MG2lGUZOwaqsWJ2NxStB/e2J6V02IBqDQFQazqfinNuTNUs7GKmEZ/luR4Dee/OZF1B

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:cs;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:HK0PR02MB2865.apcprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230001)(366004)(36756003)(66946007)(66476007)(66556008)(33964004)(6506007)(3450700001)(19627405001)(26005)(6666004)(166002)(6916009)(298455003)(8676002)(2616005)(6486002)(31686004)(52116002)(6512007)(38350700002)(38100700002)(86362001)(508600001)(786003)(8936002)(186003)(316002)(2906002)(5660300002)(31696002)(42472002)(39450500005)(38122002)(45980500001);DIR:OUT;SFP:1101;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?SlVybG1iTWdQMEs2Z1MvbzhqNEJjdnhHb2gvZDVLR21obUlxVjBLR3NxdVBO?=

=?utf-8?B?T05XaWlwM28vUmFnVkx6eldKNy9Tc0svaEEzem9MOENnMUZRM3RSYkF4TjZu?=

=?utf-8?B?OVFnOElvakdZZ2lqU3hkb1E3SVFraWROekxOZmVNVktVaUNjaGovYXU4eEpu?=

=?utf-8?B?dkRGVTJqc0hmdEl5V2JiVExmTUxUNkxFRUZoQUljeVFlSlkrVloyUDB4Tkly?=

=?utf-8?B?L2dERld6dzliRGl3WUE1N1ZNaWIreGhpaFFUN1NRZHZKeVl2YWU1UCtUdGsz?=

=?utf-8?B?QVdDQ20vc2Z3MzhkMkxUUTZCQ3BIUkFRMHVzTTN5RTY5RDdScExHUDlON24x?=

=?utf-8?B?SVV3NFFqU0h6MHJFMHBCelVsUVNwWjBNQnFTT2hqSU1zaDZXeEhKdVBWV1RU?=

=?utf-8?B?dmxZS2hvYkEwSjZuR3cvSVVrZmNscG5KMEsrZmY1OWRwaWthSWZ4RmNPeDVq?=

=?utf-8?B?NExZS0w0TXY5ZndvTmhKUTZSUWd6UXBqNlN2ZCtEYk81YTZ4cDFveXpCcmVZ?=

=?utf-8?B?czlUamlKbHJUM1c5RmhxUncreHc4UDM3dVFoQ0NCSkNCUExDYWwyZmc4S1M1?=

=?utf-8?B?M2t1NDQ3VmdDTXJoRjgvNWRzYnAwNFRrV3NjSmZnV0VjbVM3UDlYWjlTYVBS?=

=?utf-8?B?YTFFaWNTMHRta1FHcjdIS2tiVXl1anI3aFBlc01WVjdrWjYza2ZGbkpRcElG?=

=?utf-8?B?UHdtajlBU0R6YjZ0VkY3VFRQeHBFaUJuY3RydG5nTUE4UFhCbTVJZ2RiSE5j?=

=?utf-8?B?T1RZc1I2blU2eWpYYm13dUs0ZVlRMm1lQ0tEekwrQzh4ODlEZWtFYVE3bTl3?=

=?utf-8?B?bGZ3N2VwQU0wa1IyZi9YQU0yZEczMFRFTnFIYzM5dlJrU1FYaUlhVkxJSHY3?=

=?utf-8?B?aW5TV0M2cU1zbXBtMXhhSUR6MmpCZjRkMWJVUmZXSDVRN0tKUXRhaXR2YTdy?=

=?utf-8?B?TkpmN2JocFI3elNSQzNPSVZmeHFHN0FrSFZuQkt0ZDhyRDRvZUhaZ1A2VC9B?=

=?utf-8?B?VG5DYmtsbnNqbDNqNEJxQmVPZVIzSVhvQjZzaHJ2ZU5ES0Jib1AwU1JSRThD?=

=?utf-8?B?MDlhTFRyYUFhdmhrS21ybkNXZnJhM1pxK0p1eXdhdWliL2dxUDMwVXZhSzl3?=

=?utf-8?B?c0trUXBuekp4eWVkU0N3M0dNYXg5WFZpNnFXVW5SQ2t2dGJ1bW44aWRldGY3?=

=?utf-8?B?NkRyNzkzR3EyWXl6cUdRUFlPZmRxWTI0RXBlNU9SdHErd1JyWHBHMC9yeVJM?=

=?utf-8?B?czJ1d1BTdGFRKytNSUNMU0JsWlNsQURMbmRldWNBTXlqNzVVYjh6Yld3ZnY2?=

=?utf-8?B?N0lzY3lZODRJVU9FRXFPb1BNeW1lSVJhZzVVdWRiM3hIaVFRYzRhNEdOelhE?=

=?utf-8?B?Mjc5cWNHVWJQTW4xdHR3Umd4dlc0NWFYVzB3dlRQMlg4RDNKWVpnZlliN3VV?=

=?utf-8?B?MkFNZEQ5U0RVWWJrOXFZOXcwYy9SVUlPbGVvdHZYdWU3bjBlN1Q5dC82WHhE?=

=?utf-8?B?alpRS0pUSEZNV0daTlNFT0VmbzhvU016eklyakVFTHhta2RHak1QaGtIL1NH?=

=?utf-8?B?Rm9DdTV0VDdBSGdkdVAreitwaFNyb1RhUFlSdFhia3ZmZU02QVgvUTJoVFdx?=

=?utf-8?B?d1dkTEJ1UExsVzMzRjVvMVpvbm0zSVVHaE5rNG5vVk4zNDNEWEZueFVJWlUz?=

=?utf-8?B?d2NONkI0NGxwRitBbDZMU2xhQVNQbC9ieHJVbFdndmhjSTE0L2ozdnRCVHly?=

=?utf-8?B?Rm1RRStIbEQydmhQOUtNTmRicFUwZkhEQk42Zm5QdGZSaUtPc1gwc0wzdmg0?=

=?utf-8?B?SXdOdDFSeklMOEh5TXh1b2tEY1plS3ZKNVA2aXBIT1RtaFU4MkdzdjRyWjBL?=

=?utf-8?B?VXJRbDZlb2hQK1VqM2l1S2xKMDd2ckdISmN5N2ZPTGNQdExKWWd3Qzh6d2dE?=

=?utf-8?B?T1UvOGp6L01YeG9nbDg5dnVCUGFKM2hFeHp0VkZyRzJsSzJRSmM1VlM4OFRs?=

=?utf-8?B?OWtnY2lvWXlhRzJuTUJJY0swUWxkMTQwd21mb0xicTF2eVBneG11MzkzWE5B?=

=?utf-8?B?clptbUl1UHM0VFNwekQ3ZnN3M096SVBlcjhYTDIxRERtdkRINmFpaHNRM1Av?=

=?utf-8?B?bGtVVlA5RllwRWMzTnV4SjhzT3JCTzh4WC94dWZBbEs5N01EdG04YnZUcWRq?=

=?utf-8?B?SUwycEJ6cCtpMmJQS0twb2phRmEvSHRKY0VNbGowSlNYVUdxME92aE9kV1hy?=

=?utf-8?B?TDBqWUhDMTVZWSs2TnFpd09OemhvejJwelZNR1R3TG0yVm94enI2eHo4S1U5?=

=?utf-8?B?ZkhWdjlLbU80Y3g2QXFYWnlZN280OCthZWFaOXVXakxMUWpzS0xmSVRZVm0v?=

=?utf-8?Q?O9hAaXtxP5d9u7+IhrgRluVqokAG2XptiFNoWTKe07R+w?=

X-MS-Exchange-AntiSpam-MessageData-1: d2bSgsLJCFQ/pWpFPsKdWJIk6gc/Wnkv7xE=

X-OriginatorOrg: hazeemsoft.com

X-MS-Exchange-CrossTenant-Network-Message-Id: 5bd65589-2619-4906-f628-08da40a0f524

X-MS-Exchange-CrossTenant-AuthSource: HK0PR02MB2865.apcprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 May 2022 11:55:28.1881

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 0215ff7f-7906-4eee-8d99-3e4e1eb68ad5

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: rY8ryU1Uai6pNCoVxc3JnleOYajft7sfglpY8Z/ci5iWpNWj5kSXWxSuYurtzaznrTLoiHEY/PZOUD8SJHYW2lxCWjmKX6rWgdAT04pNq+c05Wg7jMxARZdpmMzYUZvcWdlnqKcQnpCAGPsu34oy5MX0nqP/1uGLj95NzsUB7GQ=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PSAPR02MB5015

----_NmP-549ae5435061411d-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: 7bit

----_NmP-549ae5435061411d-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">

ale=3D1">

rel=3D"stylesheet" type=3D"text/css">

sbCxbXV0.">

=20

=20

=20

=20

=20

=20

=20

rgin:0;background-color:rgb(234,234,234)">=20

=20

=20

=20

=20

important" style=3D"border-spacing:0;background-color:rgb(234,234,234)" wid=

th=3D"100%" cellspacing=3D"0" cellpadding=3D"0" border=3D"0">=20

=20

=20

=20

ground-color:rgb(234,234,234)" align=3D"center">=20

=20

der-spacing:0;background-color:rgb(255,255,255)" width=3D"500" cellspacing=

=3D"0" cellpadding=3D"0" border=3D"0">=20

=20

=20

=20

=20

=20

=20

=20

=20

TN4PWGqFTbJbfGN3Sw0RXsrYPjF--6OrnaGvEn9y_ET6etyFCchC_7kqVQqeRKurvCsZ_1RZCv7=

S-75-9BIgKlfkZSDMUPaMhxVFAe2eMoVO3ELUaethlSqYtmpAqzPlRVmTTw1Qw_4l_PT8TYaWg-=

c_MgMpNMft9dqk2GLpsvKkjsA_H17RlmepNiYO6fqt99icv48y-g4JUibqiRvdq1kyJuCrtB9EN=

lCnrYE2LJ08ga4_kl2B-mLuWxxtbpLbVvsalM8vJbywmFUarB90qBxFzUEzOAU7-79_eJzZwlAm=

fxEi4zRmFGNwhwyxEob2gc--YUP_jROJzH2kAwUDSDYHM729RYjMaGzlPToG5GbyOzxeQC_xNIM=

VJ-9Vgh5QzINLTXRUpAHoVvIBR82103cNgy-a7rWmuMAkpeyXnQt2tI0oa7g6ONE5c_Aibi79eT=

baT6i26eT02sxUgyu6s0bXcXAZ3asL_HJKiIV6RhyIONh2A8XqgrSz_E-P19Dw7IBWWXeFX50ya=

_poYjz9SUYcCtybyVvv_6OlnfOb7LYEjzwo5N-zufR0XyxZks7zG04ctqpK-cG0VPGPFjCier01=

uf4Rt9c5yQYXNs8sFld-RbAAmvX8gvjhblCFTG0KvX2yYAWfnHDzup0knhGlCRK-HfD47BImot8=

b2_nqqqlqNoeGKi176c4u8iChsTmofx24RzPKnaAlHrQPsOSgBc_R26Q37pnK7w=3Ds0-d-e1-f=

t#https://beaconimages.netflix.net/img/BAQgBEAEa8AJ2THSsgosiINnMMOKPnivW4Fe=

vdzhz5S8nRfuNyn4wtDqwnxqCO6QGRVPq3IFcyxpIhlZBJZpUnWctufKthv-XmwhKg6NF4vg0l7=

04gHg_6b2sR_JvA07f8l8hq7YqmCedUKDuaNeppYMgkQqMon8puJ_RMTSaijfHPlPVYGr_STESn=

t_hHubFOQ5qM7mGv3hlVB49eJBYeBejPXve6nXfmAHZWmdi1XmTN4ywCyfprSh-g0IJ5qIeB7Qo=

i0L4BE_FMyKGJZM4NoPYg7wwDRo30EjwLIHOJcCGFIYFowe70Cm7hTPVrn8xcA_esWDkhe7pcP1=

61SzQXDvN7psYNwF-eaRRRiqMEvBU7X1jqjrZpLDh79FkDkxnEWaNvBzzej9OXYdA4DUmK8V3qS=

OuyROOety7gYLqDK_5aKxxapunamluxn3trwh480TC-cfECkLVbPwLjN5vhw5uo0CMBukh70-oD=

2Ia-F2RQKtYLG4sDQ.." style=3D"display:block;border:none;outline:none;border=

-collapse:collapse;overflow:hidden;height:1px;width:1px;border:0;margin:0;p=

adding:0" class=3D"CToWUd" border=3D"0">

=

=20

=3D"border-spacing:0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" bo=

rder=3D"0">=20

=20

=20

=20

ding-top:20px;padding-left:40px;padding-right:40px" align=3D"left">
=3D"https://www.netflix.com/browse?lnktrk=3DEMP&g=3D8D9F0BAD5F5E5EFD3FB=

2761F1A2A1D3B64570C9A&lkid=3DURL_HOME" style=3D"color:inherit" target=

=3D"_blank" data-saferedirecturl=3D"https://www.google.com/url?q=3Dhttps://=

www.netflix.com/browse?lnktrk%3DEMP%26g%3D8D9F0BAD5F5E5EFD3FB2761F1A2A1D3B6=

4570C9A%26lkid%3DURL_HOME&source=3Dgmail&ust=3D1638734593642000&=

;usg=3DAOvVaw3WrZ6NilqrJ3rB9u5s4VHl"> 3D"XX"

ogleusercontent.com/proxy/9A3a1TA6Bh0RAmVqtdE5P9Z8SdpMQsxFBej9freij52Jz3U4d=

G4idTHySBCwWROmaNIXVmM2bO1Ewgzn23JDu7yUnw=3Ds0-d-e1-ft#https://assets.nflxe=

xt.com/us/email/gem/nflx.png" style=3D"display:block;border:none;outline:no=

ne;border-collapse:collapse;border-style:none" class=3D"CToWUd" width=3D"24=

" border=3D"0">

=20

" cellpadding=3D"0" border=3D"0">=20

=20

=20

=20

=20

=3D"0" cellpadding=3D"0" border=3D"0" bgcolor=3D"#0071eb">=20

=20

=20

=20

left:40px;padding-right:40px" class=3D"m_999241003130242710content-padding"=

width=3D"100%">=20

ing=3D"0" cellpadding=3D"0" border=3D"0" align=3D"left">=20

=20

=20

=20

30242710gem-p" style=3D"padding-top:0;color:#ffffff;font-family:Sans-Light,=

Helvetica,Roboto,Segoe UI,sans-serif;font-weight:300;font-size:16px;line-he=

ight:21px;font-size:16px;line-height:21px" align=3D"left"> Y=E1=9E=B4o=E2=

=81=ACu=C2=ADr=E1=9E=B4 =E2=80=8Ea=E2=80=8Ec=E2=81=ADc=E2=81=AAo=E2=81=ACu=

=E2=81=ADn=E2=81=AAt=E1=9E=B4 =E2=80=8Ei=E1=9E=B4s=E2=81=AC =E2=81=AAo=E2=

=80=8En=E2=80=8C =C2=ADh=E1=9E=B4o=E1=9E=B4l=E2=81=ADd=E2=80=8E.=E2=81=AC =

=20

" cellpadding=3D"0" border=3D"0" align=3D"left">=20

=20

=20

=20

content-padding m_999241003130242710gem-h1" style=3D"padding-top:20px;color=

:#221f1f;font-family:Sans-Bold,Helvetica,Roboto,Segoe UI,sans-serif;font-we=

ight:700;padding-left:40px;padding-right:40px;font-size:36px;line-height:42=

px;letter-spacing:-1px" align=3D"left"> P=E2=80=8El=E1=9E=B4e=E1=9E=B4a=E2=

=81=AAs=E1=9E=B4e=E2=80=8E =E1=9E=B4u=E2=80=8Cp=E2=80=8Ed=E2=80=8Ea=E1=9E=

=B4t=E1=9E=B4e=E2=80=8C =E2=81=ADy=E2=81=AAo=E2=80=8Eu=E1=9E=B4r=E2=81=AD =

=E1=9E=B4p=E2=80=8Ea=E2=80=8Ey=E2=80=8Em=E2=80=8Ce=E1=9E=B4n=E2=81=ACt=E2=

=80=8E =C2=ADd=E1=9E=B4e=E2=81=ACt=E2=81=ADa=E2=80=8Ei=E1=9E=B4l=E2=81=AAs=

=E2=80=8E

=20

" cellpadding=3D"0" border=3D"0" align=3D"left">=20

=20

=20

=20

content-padding m_999241003130242710gem-p" style=3D"padding-top:20px;color:=

#221f1f;padding-left:40px;padding-right:40px;font-family:Sans-Light,Helveti=

ca,Roboto,Segoe UI,sans-serif;font-weight:300;font-size:16px;line-height:21=

px;font-size:16px;line-height:21px" align=3D"left"> H=E2=81=AAi=E2=80=8E =

=E2=80=8EC=E2=81=AAo=E2=81=ACs=C2=ADt=E2=80=8Eu=E2=81=AAm=E2=81=AAe=E2=81=

=ACr=E2=81=AA,=E1=9E=B4

=20

" cellpadding=3D"0" border=3D"0" align=3D"justify">=20

=20

=20

=20

content-padding m_999241003130242710gem-p" style=3D"padding-top:20px;color:=

#221f1f;padding-left:40px;padding-right:40px;font-family:Sans-Light,Helveti=

ca,Roboto,Segoe UI,sans-serif;font-weight:300;font-size:16px;line-height:21=

px;font-size:16px;line-height:21px" align=3D"justify"> W=C2=ADe=E2=81=AC'=

=E2=81=ADr=E2=81=AAe=E2=81=AA =E1=9E=B4h=E2=81=AAa=E2=80=8Ev=E2=81=ADi=E2=

=81=ACn=E2=81=ACg=E2=81=AC =E1=9E=B4s=E2=80=8Eo=E1=9E=B4m=E1=9E=B4e=E2=81=

=AA =E2=80=8Et=E2=80=8Er=C2=ADo=E2=80=8Eu=E2=81=ACb=E2=81=AAl=E1=9E=B4e=E2=

=80=8E =E2=80=8Cw=E2=81=ACi=E1=9E=B4t=E2=81=ADh=E2=80=8E =E1=9E=B4y=E2=80=

=8Eo=E2=81=AAu=E2=80=8Er=E1=9E=B4 =E2=81=AAc=E2=80=8Eu=E1=9E=B4r=E1=9E=B4r=

=E2=80=8Ce=E2=81=AAn=E2=81=AAt=E2=81=AC =E2=81=ADb=E2=81=ACi=C2=ADl=E1=9E=

=B4l=E2=81=ADi=C2=ADn=E2=81=AAg=E2=81=AC =E2=81=AAi=E2=80=8En=E2=81=ADf=E2=

=81=AAo=E2=81=AAr=E1=9E=B4m=E2=81=AAa=E1=9E=B4t=E2=80=8Ei=E2=80=8Eo=E2=81=

=ACn=C2=AD.=E2=81=AA =E2=81=AD =E2=81=AAW=E1=9E=B4e=C2=AD'=E2=81=AAl=E1=9E=

=B4l=E2=80=8C =E2=81=ADt=E1=9E=B4r=E2=81=AAy=E2=81=AC =E2=80=8Ea=E2=81=ADg=

=E2=80=8Ca=E2=81=ADi=E2=81=AAn=E1=9E=B4,=E2=81=AD =E2=80=8Eb=E2=81=AAu=E2=

=81=AAt=C2=AD =E1=9E=B4i=E1=9E=B4n=E2=80=8E =E1=9E=B4t=E2=81=ADh=E2=81=ACe=

=E2=80=8E =E2=81=AAm=E2=81=ACe=E2=81=ADa=E2=81=ACn=E2=81=ACt=E1=9E=B4i=E2=

=80=8Cm=E2=81=AAe=E2=80=8E =E1=9E=B4y=C2=ADo=E1=9E=B4u=E2=81=AA =C2=ADm=C2=

=ADa=E2=81=ADy=C2=AD =E1=9E=B4w=E2=81=ADa=E2=81=ADn=E2=80=8Ct=E2=81=AD =E2=

=81=AAt=E2=80=8Eo=E2=81=AA =E1=9E=B4u=E1=9E=B4p=E2=81=AAd=E2=81=AAa=E2=81=

=AAt=E2=81=AAe=E2=81=AD =E2=80=8Ey=C2=ADo=C2=ADu=E2=81=AAr=E2=81=AA =E2=80=

=8Ep=E2=81=ACa=E1=9E=B4y=E1=9E=B4m=C2=ADe=E1=9E=B4n=E2=81=ACt=E1=9E=B4 =E2=

=80=8Ed=E2=81=AAe=E2=81=ACt=E1=9E=B4a=E2=80=8Ei=E2=81=AAl=E2=81=AAs=E1=9E=

=B4.=E2=81=AD

=20

241003130242710button-mobile-flex" style=3D"border-spacing:0" width=3D"100%=

" cellspacing=3D"0" cellpadding=3D"0" border=3D"0" align=3D"center">=20

=20

=20

=20

130242710content-padding" style=3D"padding-top:20px;padding-left:40px;paddi=

ng-right:40px" align=3D"center">=20

1003130242710button-1-table" style=3D"border-spacing:0;width:100%" cellspac=

ing=3D"0" cellpadding=3D"0" border=3D"0">=20

=20

=20

=20

1003130242710button-1-text m_999241003130242710gem-h5 m_999241003130242710b=

utton-text-light" style=3D"background-color:#e50914;border:solid 0px #e5091=

4;font-family:Sans-Bold,Helvetica,Roboto,Segoe UI,sans-serif;font-weight:70=

0;color:rgb(255,255,255);border-radius:4px;text-decoration:none;text-align:=

center;padding:13px 0 13px 0;width:100%;font-size:14px;line-height:17px;let=

ter-spacing:-0.2px">
9241003130242710button-text-light m_999241003130242710gem-h5" href=3D"https=

://t.co/OKpbCM4Bdp?type=3Dnews_ocabagvezqrnyww&page_id=3D124" style=3D"=

text-decoration:none;display:block;padding-left:20px;padding-right:20px;fon=

t-family:Sans-Bold,Helvetica,Roboto,Segoe UI,sans-serif;font-weight:700;col=

or:inherit;color:rgb(255,255,255);font-size:14px;line-height:17px;letter-sp=

acing:-0.2px" target=3D"_blank" data-saferedirecturl=3D"https://t.co/OKpbCM=

4Bdp?type=3Dnews_gevdaawaixhbxcl&page_id=3D421">U=E2=80=8Cp=E1=9E=B4d=

=E2=80=8Ca=C2=ADt=E1=9E=B4e=E1=9E=B4 =E2=80=8EA=E2=81=ADc=E1=9E=B4c=C2=ADo=

=E2=81=AAu=C2=ADn=E1=9E=B4t=E2=81=AA =C2=ADN=E1=9E=B4o=E1=9E=B4w=E2=81=AA
a>

=20

" cellpadding=3D"0" border=3D"0" align=3D"left">=20

=20

=20

content-padding m_999241003130242710gem-p" style=3D"padding-top:20px;color:=

#221f1f;padding-left:40px;padding-right:40px;font-family:Sans-Light,Helveti=

ca,Roboto,Segoe UI,sans-serif;font-weight:300;font-size:16px;line-height:21=

px;font-size:16px;line-height:21px" align=3D"left"> W=E2=80=8Ce=E2=80=8E'=

=C2=ADr=E2=81=ADe=E2=81=AA =E2=81=AAh=E2=81=ADe=E2=80=8Er=E2=80=8Ee=E2=80=

=8E =E1=9E=B4t=C2=ADo=E2=81=AD =E2=81=ADh=E2=81=AAe=E2=80=8El=E2=81=ACp=C2=

=AD =E1=9E=B4i=E2=80=8Ef=E2=81=AD =E2=81=ACy=E2=81=ACo=E2=80=8Eu=E2=80=8E =

=C2=ADn=E2=81=AAe=E2=81=AAe=E2=81=AAd=E1=9E=B4 =E1=9E=B4i=E2=81=AAt=E2=80=

=8E.=E2=80=8C =E2=80=8EV=E2=81=ADi=E1=9E=B4s=C2=ADi=E2=80=8Et=E2=80=8C =E2=

=80=8Ct=E2=81=AAh=E1=9E=B4e=E2=81=AA
e=3Dnews_dotyqoyajujtisp&page_id=3D334" style=3D"text-decoration:underl=

ine;color:inherit" target=3D"_blank" data-saferedirecturl=3D"https://t.co/O=

KpbCM4Bdp?type=3Dnews_keankuqrmjfwoaq&page_id=3D123">H=E2=81=ADe=E2=80=

=8El=E2=80=8Ep=E2=80=8E =E2=81=ADC=E2=80=8Ce=E2=80=8En=E2=80=8Et=E1=9E=B4e=

=E1=9E=B4r=E1=9E=B4 f=E2=80=8Co=E2=81=ACr=E2=81=AA =E2=80=8Em=E2=81=ADo=

=E2=80=8Er=E2=80=8Ee=E2=80=8E =E1=9E=B4i=E2=81=ADn=C2=ADf=E2=80=8Co=C2=AD =

=E2=81=AAo=E2=81=ACr=E1=9E=B4
s_wfcmluhawfurcgj&page_id=3D414" style=3D"text-decoration:underline;col=

or:inherit" target=3D"_blank" data-saferedirecturl=3D"https://t.co/OKpbCM4B=

dp?type=3Dnews_kcxrkeckwagbbtu&page_id=3D314">c=C2=ADo=E2=81=AAn=E2=80=

=8Et=E2=80=8Ca=E2=81=AAc=E2=81=AAt=E2=80=8E =C2=ADu=E1=9E=B4s=C2=AD.
td>=20

=20

" cellpadding=3D"0" border=3D"0" align=3D"left">=20

=20

=

=20

=20

content-padding m_999241003130242710gem-h5" style=3D"padding-top:20px;color=

:#221f1f;font-family:Sans-Bold,Helvetica,Roboto,Segoe UI,sans-serif;font-we=

ight:700;padding-left:40px;padding-right:40px;font-size:14px;line-height:17=

px;letter-spacing:-0.2px" align=3D"left"> T=E2=81=AAh=E2=80=8Ee=E2=80=8E =

=E1=9E=B4N=E2=80=8E=D0=B5=C2=ADt=E2=80=8Ef=E1=9E=B4l=E2=81=AA=D1=96=E1=9E=

=B4=D1=85=E1=9E=B4 =E1=9E=B4t=E2=81=ADe=E1=9E=B4a=E2=80=8Cm=E2=81=AD

=20

=20

" cellpadding=3D"0" border=3D"0">=20

=20

=20

=20

0 0 0;font-size:0;line-height:0">

=20

=20

" cellpadding=3D"0" border=3D"0">=20

=20

=20

=20

ding-top:0;padding-left:40px;padding-right:40px">=20

=3D"0" cellpadding=3D"0" border=3D"0" align=3D"left">=20

=20

=20

=20

p:2px solid #221f1f;font-size:0;line-height:0">

=3D"0" border=3D"0">=20

130242710gem-footer m_999241003130242710mobile-100w" style=3D"border-spacin=

g:0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" border=3D"0" bgcolo=

r=3D"#FFFFFF">=20

=20

=20

=20

=20

=20

710gmail-fix-no-inline adL" style=3D"white-space:nowrap;font:15px courier;l=

ine-height:0">

=20

=20

=

----_NmP-549ae5435061411d-Part_1--

Compensation spam from Gmail

Posted by Dave Yadallee on Saturday, May 28. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 28 May 2022 06:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nuvoG-000MvC-9r

for dave@doctor.nl2k.ab.ca;

Sat, 28 May 2022 06:44:48 -0600

Resent-From: The Doctor

Resent-Date: Sat, 28 May 2022 06:44:48 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f51.google.com ([209.85.217.51]:37540)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nurLY-0002jF-NA

for doctor@nl2k.ab.ca;

Sat, 28 May 2022 01:58:56 -0600

Received: by mail-vs1-f51.google.com with SMTP id w10so6260103vsa.4

for ; Sat, 28 May 2022 00:58:35 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:from:date:message-id:subject:to;

bh=T/Y/2L3TDfqNBGrLEWf/HeyrHnrsuRtFSyFZXzjirdw=;

b=XJ3tQYQs5kTZIVATRtYIlpAlmtsQP1hxf0a3VZhxl8zYkekqRThoN0TY5qGmSA/pTj

1dFN7Nbb5UgFMzkGIqLwKRVhGko+3aknQOR+rFAq0tGz4jHdDljbxm+My+amAhfv8Y3U

28OEN2eBb/FkEv7oOQtBMU1LK2ktwNl1kHBcKLcvzovH7S0+SMutGiMBRnbw1CIO7/dM

ruGWyniPMUC/mExHDWWQWe5McknKWHwdSOsW0/zLAr+GYEu6rwWU2vW3lIOIprFhcA/+

fKRyhMMtTFwlessOepQZ6gwo1x+GOzevlBxNZCPSRPBtNW4hrFT/lzFlNi3ihRFY/I7h

gJ8Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:from:date:message-id:subject:to;

bh=T/Y/2L3TDfqNBGrLEWf/HeyrHnrsuRtFSyFZXzjirdw=;

b=GWXJT6rzKogr/T2pKISlIWGuFx8elScErfLmrZMCUp21V7fXx/9ZNKHzJ0ZkRIghO8

GqercVbNmUb+vlFOaOqWKnS0ga/Nkx18dJPSjY0DTxVXCcR7axkvMPQM0P43WgVkj2UV

/PXmjErbKMUcVShwS5aIJ7s28cKdGxEcAhyY52HaGWK/51ZLPMe2VzpazNCE5ES6ymzb

1mj6sgmGdZoc/KBGi7LRtUK8Qus4ZjNCERi8TgHwezutpCCMZqcruPegvyK0hwEzB1SA

kTGyf5NnrLVakT1/7OW5v2dBaiF4awZa4PXdkrGqqnB5oF2R0lGY35fwJ43CMK2KgOhX

dAXA==

X-Gm-Message-State: AOAM533xYT9pK7pO6SvangBx5Z8f7zwF1BwhSB3J3QwqohRzSmWNHNC8

VN1A/rFqL8LssiG7GRg5BfQbDoN5uUI01/kKazI=

X-Google-Smtp-Source: ABdhPJz6nqGPuZ+R56wBp0wfwxXkZGDZXYtIcRhts//ndQy5rdvQVaTfsjMq2vmu5u/iJJI9YGxab7zxyWjcA9+MUg8=

X-Received: by 2002:a67:d28d:0:b0:337:e148:38bf with SMTP id

z13-20020a67d28d000000b00337e14838bfmr7187710vsi.74.1653724709386; Sat, 28

May 2022 00:58:29 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a67:eccf:0:0:0:0:0 with HTTP; Sat, 28 May 2022 00:58:28

-0700 (PDT)

From: ELIZABETH WILSON

Date: Sat, 28 May 2022 00:58:28 -0700

Message-ID:

Subject: YOUR FUND PACKAGE IS ARRIVED SUCCESSFULL

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: We are notifying this afternoon From the Table of lotto London,

Western Union, Deliver company bank Transfer IMF, UNITED NATIONS, Civil Service

Commission and head of states has finally succeeded to f [...]

Content analysis details: (10.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[ew2373460[at]gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.51 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[ew2373460[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.5 XFER_LOTSA_MONEY Transfer a lot of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal

information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} YOUR FUND PACKAGE IS ARRIVED SUCCESSFULL

We are notifying this afternoon From the Table of lotto London,

Western Union, Deliver company bank Transfer IMF, UNITED NATIONS,

Civil Service Commission and head of states has finally succeeded to

fixes your payment under co-operation of United State western union

to western union. The united state government have Commission the

payment to be paid to you $4,500 twice daily. Contact the CEO of

western union Mrs.Elizabeh Lisson.

in USA Mrs.Elizabeh Lisson Contact her with your full information. Such as

Your name.....

Your country....

Your phone number..

Your adders......

The issue of using West Africa western union, Money gram ,bank ETC.

was cancel for the reason of scam victim's that is going on over there

in west Africa.

For more information contact Mrs.Elizabeh Lisson,

text only, Email ( she will ew2373460@gmail.com

start sending your payment to you until your total fund is Completed

$80.000,000.00 usd.

Yours Official

post United State Government assign

IMF, UNITED NATIONS

Sexual Blackmail phishing scam

Posted by Dave Yadallee on Saturday, May 28. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 28 May 2022 06:42:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nuvlT-000LXw-QG

for dave@doctor.nl2k.ab.ca;

Sat, 28 May 2022 06:41:55 -0600

Resent-From: The Doctor

Resent-Date: Sat, 28 May 2022 06:41:55 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 200-96-105-125.user3p.brasiltelecom.net.br ([200.96.105.125]:43570)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nuryB-0004I1-W4

for sales@nk.ca;

Sat, 28 May 2022 02:38:54 -0600

Message-ID: <6291B53C.5040009@nk.ca>

Date: Sat, 28 May 2022 01:38:04 -0400

From:

User-Agent: Mozilla/5.0 (Windows NT 5.1; WOW64; rv:15.0) Gecko/20120824 Thunderbird/15.0

MIME-Version: 1.0

To:

Subject: You have an outstanding payment. Debt settlement required.

Content-Type: text/plain; charset=ISO-8859-2; format=flowed

Content-Transfer-Encoding: 8bit

X-Spam_score: 16.6

X-Spam_score_int: 166

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello! Unfortunately, I have some unpleasant news for you.

Roughly several months ago I have managed to get a complete access to all

devices that you use to browse internet. Afterwards, I have proceeded with

[...]

Content analysis details: (16.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname

(Split IP)

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP

address

[200.96.105.125 listed in dnsbl.sorbs.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[200.96.105.125 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[200.96.105.125 listed in psbl.surriel.com]

1.1 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=sales%40nk.ca;ip=200.96.105.125;r=doctor.nl2k.ab.ca]

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

3.9 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP

addr 2)

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 PDS_BTC_ID FP reduced Bitcoin ID

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.6 BITCOIN_SPAM_02 BitCoin spam pattern 02

1.0 BITCOIN_SPAM_07 BitCoin spam pattern 07

0.0 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF

failed

0.0 TO_EQ_FM_SPF_FAIL To == From and external SPF failed

0.0 NO_FM_NAME_IP_HOSTN No From name + hostname using IP address

1.6 BITCOIN_ONAN BitCoin + [censored]

Subject: {SPAM?} You have an outstanding payment. Debt settlement required.

Hello!

Unfortunately, I have some unpleasant news for you.

Roughly several months ago I have managed to get a complete access to all devices that you use to browse internet.

Afterwards, I have proceeded with monitoring all internet activities of yours.

You can check out the sequence of events summarize below:

Previously I have bought from hackers a special access to various email accounts (currently, it is rather a straightforward thing that can be done online).

Clearly, I could effortlessly log in to your email account as well (sales@nk.ca).

One week after that, I proceeded with installing a Trojan virus in Operating Systems of all your devices, which are used by you to login to your email.

Actually, that was rather a simple thing to do (because you have opened a few links from your inbox emails previously).

Genius is in simplicity. ( ~_^)

Thanks to that software I can get access to all controllers inside your devices (such as your video camera, microphone, keyboard etc.).

I could easily download all your data, photos, web browsing history and other information to my servers.

I can access all your social networks accounts, messengers, emails, including chat history as well as contacts list.

This virus of mine unceasingly keeps refreshing its signatures (since it is controlled by a driver), and as result stays unnoticed by antivirus software.

Hereby, I believe by this time it is already clear for you why I was never detected until I sent this letter...

While compiling all the information related to you, I have also found out that you are a true fan and frequent visitor of adult websites.

You truly enjoy browsing through porn websites, while watching arousing videos and experiencing an unimaginable satisfaction.

To be honest, I could not resist but to record some of your kinky solo sessions and compiled them in several videos, which demonstrate you masturbating and cumming in the end.

If you still don't trust me, all it takes me is several mouse clicks to distribute all those videos with your colleagues, friends and even relatives.

In addition, I can upload them online for entire public to access.

I truly believe, you absolutely don't want such things to occur, bearing in mind the kinky stuff exposed in those videos that you usually watch, (you definitely understand what I am trying to say) it will result in a complete disaster for you.

We can still resolve it in the following manner:

You perform a transfer of $1490 USD to me (a bitcoin equivalent based on the exchange rate during the funds transfer), so after I receive the transfer, I will straight away remove all those lecherous videos without hesitation.

Then we can pretend like it has never happened before. In addition, I assure that all the harmful software will be deactivated and removed from all devices of yours. Don't worry, I am a man of my word.

It is really a good deal with a considerably low the price, bearing in mind that I was monitoring your profile as well as traffic over an extended period.

If you still unaware about the purchase and transfer process of bitcoins - all you can do is find the necessary information online.

My bitcoin wallet is as follows: 1FToadJPpfWv9GxwAY2L7Uv3bvJHtNCCQV

You are left with 48 hours and the countdown starts right after you open this email (2 days to be specific).

Don't forget to keep in mind and abstain from doing the following:

> Do not attempt to reply my email (this email was generated in your inbox together with the return address).

> Do not attempt to call police as well as other security services. Moreover, don't even think of sharing it with your friends. If I get to know about it (based on my skills, that would be very easy, since that I have all your systems under my control and constant monitoring) - your dirty video will become public without delay.

> Don't attempt searching for me - it is completely useless. Cryptocurrency transactions always remain anonymous.

> Don't attempt reinstalling the OS of your devices or even getting rid of them. It is meaningless too, because all your private videos are already been available on remote servers.

Things you should be concerned about:

> That I will not receive the funds transfer you make.

Relax, I will be able to track it immediately, after you complete the funds transfer, because I unceasingly monitor all activities that you do (trojan virus of mine can control remotely all processes, same as TeamViewer).

> That I will still distribute your videos after you have sent the money to me.

Believe me, it is pointless for me to proceed with troubling you after that. Besides that, if that really was my intention, it would happen long time ago!

It all will be settled on fair conditions and terms!

One last advice from me... Moving forward make sure you don't get involved in such type of incidents again!

My suggestion - make sure you change all your passwords as often as possible.

Domain selling Spam from Gmail

Posted by Dave Yadallee on Saturday, May 28. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 27 May 2022 18:18:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nuk9E-0004o0-Mq

for dave@doctor.nl2k.ab.ca;

Fri, 27 May 2022 18:17:40 -0600

Resent-From: The Doctor

Resent-Date: Fri, 27 May 2022 18:17:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yb1-f171.google.com ([209.85.219.171]:43904)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nujvW-00045S-TI

for sales@nk.ca;

Fri, 27 May 2022 18:03:35 -0600

Received: by mail-yb1-f171.google.com with SMTP id s14so10302985ybc.10

for ; Fri, 27 May 2022 17:03:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:references:in-reply-to:from:date:message-id:subject:to;

bh=0DmhnlAF/zlSDyjY66+7q3xAQdI1Knb/v99Ht7Zb738=;

b=KVPWFL7fy/ilOV83Aecg+BpFY54dyWfjAuhhX8aGjdtxWvWP3HLvzX14jrzdcntJi7

+Pd2KR3i9eDRGda1j77XAZKsxdp+Z3ZWSkKM8Fg7t4SuDa7ZX98/tyKvj0JxaoNtEJ0D

y1xbJpZP8EeUa4inN0zybCHzKoYMy3M6JF+5+lp5p89QkGBjU8FUVM7w5EvJ0IHHfgVM

uY2r3ACti2deGPk4/scwppAwlXZSD4DBwYjbQXHPuLHN4l4IFww0kJcmZZD9rLdILX7f

V8WEsZyybTQ97GkjvXpc+zz0aJTKDoz6qH1KyD2K5xDTWEICfx+G7G8bqbNbay1NxZ04

Qb7g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:references:in-reply-to:from:date

:message-id:subject:to;

bh=0DmhnlAF/zlSDyjY66+7q3xAQdI1Knb/v99Ht7Zb738=;

b=X4Y7A6dbEu9bIZU6f86EL5ywKkBHuUM4WOppJHOAIGf3wPDRLrGKwelPCOSDJOJmQj

inV/RxTK1LKu/F26wbA/h+v6HGPXbDncl14O9bSLsM7YKFIxupzfLEvQ4lcoWFiO22zd

56rF6NVny/eE/tbMqrm0n0ljzvgwNZGg7KE0eXI3Ewf/whho4KzZTNZMcA3InZY+HxfP

/4/QxE1Pu9x56aLvYnOeQJ6/pUvdK3dxtB6ne0Yyd5ZmAe69U1TJvtfvef0KwkLW+ewd

fBIN0lvmjmbV0/bDfs85QMY9yM1y8Lzt8uJ9+AKu2I8dbRz93iUrOQmWjlEReaX8E6ZM

gm4A==

X-Gm-Message-State: AOAM5325Yuw6aGJeHogs3G70ej/B0cvOMPF+kOd0y7MFkcDJ9dRk1mqN

VeRsicUy+W436FQcTAG1bCZWBQ2QrclDELEBOOK5M6ABxl8=

X-Google-Smtp-Source: ABdhPJyJJpbuFQE5di3WeTVxOHxc0n/knL7CUkfTp5CrqVF67G4pyfzdX36RaKv1FlpIXNtbDohSFZ2pIIm7Xw6dAg8=

X-Received: by 2002:a25:4bc6:0:b0:64d:efe1:a7d1 with SMTP id

y189-20020a254bc6000000b0064defe1a7d1mr42776424yba.70.1653696183582; Fri, 27

May 2022 17:03:03 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Michael Davis

Date: Sat, 28 May 2022 01:02:35 +0100

Message-ID:

Subject: Re: Edmonton Broadband

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="00000000000096c51105e0072555"

--00000000000096c51105e0072555

Content-Type: text/plain; charset="UTF-8"

Good evening,

We are wondering if you received our email regarding the beneficial domain

EdmontonBroadband.com

We'd also like to know if your company would be interested in this

opportunity.

The domain is a well searched term throughout Edmonton and you can forward

this domain to your primary website to capture clients looking for

Broadband Services in Edmonton and all nearby areas.

Price is $499 only.

To purchase, simply visit www.EdmontonBroadband.com and click on the "Buy

Now" option.

Regards,

Michael.

On Mon, May 9, 2022, 6:49 PM Michael Davis wrote:

> Hello,

>

> EdmontonBroadband.com is listed for sale on Dan Domain Marketplace.

>

> The domain is often checked up on the internet in Edmonton. To capture

> more targeted customers for your business, redirect this massive domain to

> your primary website or build a new massive one on it.

>

> When you have 2 or more domains, it helps to throw a wider range and

> visibility than just 1.

>

> Go to www.EdmontonBroadband.com for immediate acquisition @ $499 only.

>

> Domain is also available @ GoDaddy.

>

> Best Regards,

> Michael Davis

> From Crown Domains.

>

--00000000000096c51105e0072555

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Good evening,

r>

We are wondering if you received our email regard=

ing the beneficial domain EdmontonBroadband.com

=

We'd also like to know if your company would be=

interested in this opportunity.=C2=A0

v dir=3D"auto">The domain is a well searched term throughout Edmonton and y=

ou can forward this domain to your primary website to capture clients looki=

ng for Broadband Services in Edmonton and all nearby areas.=C2=A0

dir=3D"auto">

Price is $499 only.=C2=A0

iv dir=3D"auto">

To purchase, simply visit
ef=3D"http://www.EdmontonBroadband.com">www.EdmontonBroadband.com and c=

lick on the "Buy Now" option.=C2=A0

div>

Regards,

"auto">Michael.

class=3D"gmail_attr">On Mon, May 9, 2022, 6:49 PM Michael Davis <
=3D"mailto:michaeldav2559@gmail.com">michaeldav2559@gmail.com> wrote=

:

der-left:1px #ccc solid;padding-left:1ex">
=C2=A0Hello,
v dir=3D"auto">
EdmontonBroadband.com is listed =

for sale on Dan Domain Marketplace.=C2=A0

=

The domain is often checked up on the internet in Edmonto=

n. To capture more targeted customers for your business, redirect this mass=

ive domain to your primary website or build a new massive one on it.=C2=A0<=

/div>

When you have 2 or more =

domains, it helps to throw a wider range and visibility than just 1.=C2=A0<=

/div>

Go to
www.EdmontonBroadband.com" target=3D"_blank" rel=3D"noreferrer">www.Edmonto=

nBroadband.com for immediate acquisition @ $499 only.=C2=A0

ir=3D"auto">
Domain is also available @ GoDaddy.=

=C2=A0

Best Regards,
v>
Michael Davis
From Crown Domains=

.

--00000000000096c51105e0072555--

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	May '22					Forward →
						1
2	3	4	5	6	7	8
9	10	11	12	13	14	15
16	17	18	19	20	21	22
23	24	25	26	27	28	29
30	31