Phish directed at nk.ca users

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 May 2022 17:30:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nsC3X-000JRd-38

for dave@doctor.nl2k.ab.ca;

Fri, 20 May 2022 17:29:15 -0600

Resent-From: The Doctor

Resent-Date: Fri, 20 May 2022 17:29:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [144.168.46.18] (port=38284 helo=144-168-46-19.static.hvvc.us)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nsBdV-000HeV-Dv

for doctor@doctor.nl2k.ab.ca;

Fri, 20 May 2022 17:02:29 -0600

Received: from [67.207.163.210] (port=56420 helo=67.207.163.210.rdns.ColocationAmerica.com)

by beeblebrox.awsdns-23.co.uk with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95)

(envelope-from )

id 1nsBdC-00010C-4c

for doctor@doctor.nl2k.ab.ca;

Fri, 20 May 2022 19:02:02 -0400

Reply-To: microsoft@mail.com

From: doctor.nl2k.ab.ca

To: doctor@doctor.nl2k.ab.ca

Subject: ACTION REQUIRED

Date: 20 May 2022 16:02:01 -0700

Message-ID: <20220520160201.0FA3459B049F2255@doctor.nl2k.ab.ca>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - beeblebrox.awsdns-23.co.uk

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - doctor.nl2k.ab.ca

X-Get-Message-Sender-Via: beeblebrox.awsdns-23.co.uk: authenticated_id: smtp41@aws.amazon.com

X-Authenticated-Sender: beeblebrox.awsdns-23.co.uk: smtp41@aws.amazon.com

X-Spam_score: 13.1

X-Spam_score_int: 131

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: doctor, your mailbox is almost full. 4.86 GB 4.18 GB You might

experience delays or can no longer send and receive messages.



Content analysis details: (13.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname

(Split IP)

0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or

Generic rPTR

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=doctor%40doctor.nl2k.ab.ca;ip=144.168.46.18;r=doctor.nl2k.ab.ca]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

3.9 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP

addr 2)

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML

only

0.0 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF

failed

0.0 TO_EQ_FM_SPF_FAIL To == From and external SPF failed

Subject: {SPAM?} ACTION REQUIRED
















; text-indent: 0px; letter-spacing: normal; font-family: "Lucida Grande", V=

erdana, Arial, Helvetica, sans-serif; font-size: 1.2em; font-style: normal;=

font-weight: 600; margin-top: 0px; margin-bottom: 1.5em; word-spacing: 0px=

; white-space: normal; orphans: 2; widows: 2; background-color: rgb(255, 25=

5, 255); font-variant-ligatures: normal; font-variant-caps: normal; -webkit=

-text-stroke-width: 0px; text-decoration-thickness:=20

initial; text-decoration-style: initial; text-decoration-color: initial;'>d=

octor, your mailbox is almost full.




(51, 51, 51); text-transform: none; text-indent: 0px; letter-spacing: norma=

l; font-family: "Lucida Grande", Verdana, Arial, Helvetica, sans-serif; fon=

t-size: 11px; font-style: normal; font-weight: 400; word-spacing: 0px; whit=

e-space: normal; border-collapse: collapse; orphans: 2; widows: 2; backgrou=

nd-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-=

caps: normal; -webkit-text-stroke-width: 0px;=20

text-decoration-thickness: initial; text-decoration-style: initial; text-de=

coration-color: initial;' border=3D"0" cellspacing=3D"0" cellpadding=3D"0">=


, 60, 47); margin: 0px; width: 321px; font-family: Roboto, RobotoDraft, Hel=

vetica, Arial, sans-serif;"> 

224, 224, 224); margin: 0px; font-family: Roboto, RobotoDraft, Helvetica, A=

rial, sans-serif;"> 



(51, 51, 51); text-transform: none; text-indent: 0px; letter-spacing: norma=

l; font-family: "Lucida Grande", Verdana, Arial, Helvetica, sans-serif; fon=

t-size: 11px; font-style: normal; font-weight: 400; word-spacing: 0px; whit=

e-space: normal; border-collapse: collapse; orphans: 2; widows: 2; backgrou=

nd-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-=

caps: normal; -webkit-text-stroke-width: 0px;=20

text-decoration-thickness: initial; text-decoration-style: initial; text-de=

coration-color: initial;' border=3D"0" cellspacing=3D"0" cellpadding=3D"0">=




botoDraft, Helvetica, Arial, sans-serif;">
, 47); font-weight: bold;">4.86 GB

margin: 0px; font-family: Roboto, RobotoDraft, Helvetica, Arial, sans-serif=

;">4.18 GB



ext-transform: none; text-indent: 0px; letter-spacing: normal; font-family:=

"Lucida Grande", Verdana, Arial, Helvetica, sans-serif; font-size: 11px; f=

ont-style: normal; font-weight: 400; word-spacing: 0px; white-space: normal=

; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant=

-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0=

px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;'>You m=

ight experience delays or can no longer send and receive messages.
=



ud/ipfs/QmRQ7J8sWPC8TVsEk2JoSBuhWTx9krt8x2WZbEsoJ7AxSu#doctor@doctor.nl2k.a=

b.ca">


148, 148) 100%); padding: 5px 10px; border-radius: 8px; border: 1px solid r=

gb(8, 44, 64); border-image: none; text-align: center; color: rgb(231, 24, =

76); letter-spacing: 2px; font-size: 24px; font-variant: small-caps; font-w=

eight: bold; position: relative; cursor: pointer; box-shadow: 1px 3px 5px 2=

px #c0c0c0; text-shadow: 1px 1px 1px rgba(5,29,41,1); -ms-user-select: none=

; -webkit-box-shadow: 1px 3px 5px 2px #c0c0c0;=20

-moz-box-shadow: 1px 3px 5px 2px #c0c0c0; -webkit-touch-callout: none; -web=

kit-user-select: none; -khtml-user-select: none; -moz-user-select: none; us=

er-select: none;">CLEAR STORAGE




ext-transform: none; text-indent: 0px; letter-spacing: normal; font-family:=

"Lucida Grande", Verdana, Arial, Helvetica, sans-serif; font-size: 11px; f=

ont-style: normal; font-weight: 400; word-spacing: 0px; white-space: normal=

; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant=

-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0=

px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;'>
=3D"font-weight: bolder;">Mailbox address:

134, 186); text-decoration: none; background-color: transparent;" target=

=3D"_blank" rel=3D"noreferrer">doctor@doctor.nl2k.ab.ca











Phish on nk.ca users

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 May 2022 17:30:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nsC3c-000JS5-5a

for dave@doctor.nl2k.ab.ca;

Fri, 20 May 2022 17:29:20 -0600

Resent-From: The Doctor

Resent-Date: Fri, 20 May 2022 17:29:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [144.168.46.18] (port=38388 helo=144-168-46-19.static.hvvc.us)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nsBdP-000HeW-Re

for doctor@nl2k.ab.ca;

Fri, 20 May 2022 17:02:23 -0600

Received: from [67.207.163.210] (port=56413 helo=67.207.163.210.rdns.ColocationAmerica.com)

by beeblebrox.awsdns-23.co.uk with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95)

(envelope-from )

id 1nsBdD-0000fr-6h

for doctor@nl2k.ab.ca;

Fri, 20 May 2022 19:02:03 -0400

Reply-To: microsoft@mail.com

From: nl2k.ab.ca

To: doctor@nl2k.ab.ca

Subject: ACTION REQUIRED

Date: 20 May 2022 16:02:01 -0700

Message-ID: <20220520160201.9C4C2241E1C029A9@nl2k.ab.ca>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - beeblebrox.awsdns-23.co.uk

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - nl2k.ab.ca

X-Get-Message-Sender-Via: beeblebrox.awsdns-23.co.uk: authenticated_id: smtp41@aws.amazon.com

X-Authenticated-Sender: beeblebrox.awsdns-23.co.uk: smtp41@aws.amazon.com

X-Spam_score: 13.1

X-Spam_score_int: 131

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: doctor, your mailbox is almost full. 4.86 GB 4.18 GB You might

experience delays or can no longer send and receive messages.



Content analysis details: (13.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname

(Split IP)

0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or

Generic rPTR

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=doctor%40nl2k.ab.ca;ip=144.168.46.18;r=doctor.nl2k.ab.ca]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

3.9 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP

addr 2)

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML

only

0.0 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF

failed

0.0 TO_EQ_FM_SPF_FAIL To == From and external SPF failed

Subject: {SPAM?} ACTION REQUIRED
















; text-indent: 0px; letter-spacing: normal; font-family: "Lucida Grande", V=

erdana, Arial, Helvetica, sans-serif; font-size: 1.2em; font-style: normal;=

font-weight: 600; margin-top: 0px; margin-bottom: 1.5em; word-spacing: 0px=

; white-space: normal; orphans: 2; widows: 2; background-color: rgb(255, 25=

5, 255); font-variant-ligatures: normal; font-variant-caps: normal; -webkit=

-text-stroke-width: 0px; text-decoration-thickness:=20

initial; text-decoration-style: initial; text-decoration-color: initial;'>d=

octor, your mailbox is almost full.




(51, 51, 51); text-transform: none; text-indent: 0px; letter-spacing: norma=

l; font-family: "Lucida Grande", Verdana, Arial, Helvetica, sans-serif; fon=

t-size: 11px; font-style: normal; font-weight: 400; word-spacing: 0px; whit=

e-space: normal; border-collapse: collapse; orphans: 2; widows: 2; backgrou=

nd-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-=

caps: normal; -webkit-text-stroke-width: 0px;=20

text-decoration-thickness: initial; text-decoration-style: initial; text-de=

coration-color: initial;' border=3D"0" cellspacing=3D"0" cellpadding=3D"0">=


, 60, 47); margin: 0px; width: 321px; font-family: Roboto, RobotoDraft, Hel=

vetica, Arial, sans-serif;"> 

224, 224, 224); margin: 0px; font-family: Roboto, RobotoDraft, Helvetica, A=

rial, sans-serif;"> 



(51, 51, 51); text-transform: none; text-indent: 0px; letter-spacing: norma=

l; font-family: "Lucida Grande", Verdana, Arial, Helvetica, sans-serif; fon=

t-size: 11px; font-style: normal; font-weight: 400; word-spacing: 0px; whit=

e-space: normal; border-collapse: collapse; orphans: 2; widows: 2; backgrou=

nd-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-=

caps: normal; -webkit-text-stroke-width: 0px;=20

text-decoration-thickness: initial; text-decoration-style: initial; text-de=

coration-color: initial;' border=3D"0" cellspacing=3D"0" cellpadding=3D"0">=




botoDraft, Helvetica, Arial, sans-serif;">
, 47); font-weight: bold;">4.86 GB

margin: 0px; font-family: Roboto, RobotoDraft, Helvetica, Arial, sans-serif=

;">4.18 GB



ext-transform: none; text-indent: 0px; letter-spacing: normal; font-family:=

"Lucida Grande", Verdana, Arial, Helvetica, sans-serif; font-size: 11px; f=

ont-style: normal; font-weight: 400; word-spacing: 0px; white-space: normal=

; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant=

-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0=

px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;'>You m=

ight experience delays or can no longer send and receive messages.
=



ud/ipfs/QmRQ7J8sWPC8TVsEk2JoSBuhWTx9krt8x2WZbEsoJ7AxSu#doctor@nl2k.ab.ca">


148, 148) 100%); padding: 5px 10px; border-radius: 8px; border: 1px solid r=

gb(8, 44, 64); border-image: none; text-align: center; color: rgb(231, 24, =

76); letter-spacing: 2px; font-size: 24px; font-variant: small-caps; font-w=

eight: bold; position: relative; cursor: pointer; box-shadow: 1px 3px 5px 2=

px #c0c0c0; text-shadow: 1px 1px 1px rgba(5,29,41,1); -ms-user-select: none=

; -webkit-box-shadow: 1px 3px 5px 2px #c0c0c0;=20

-moz-box-shadow: 1px 3px 5px 2px #c0c0c0; -webkit-touch-callout: none; -web=

kit-user-select: none; -khtml-user-select: none; -moz-user-select: none; us=

er-select: none;">CLEAR STORAGE




ext-transform: none; text-indent: 0px; letter-spacing: normal; font-family:=

"Lucida Grande", Verdana, Arial, Helvetica, sans-serif; font-size: 11px; f=

ont-style: normal; font-weight: 400; word-spacing: 0px; white-space: normal=

; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant=

-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0=

px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;'>
=3D"font-weight: bolder;">Mailbox address:

134, 186); text-decoration: none; background-color: transparent;" target=

=3D"_blank" rel=3D"noreferrer">doctor@nl2k.ab.ca











Chinese products spam from Outlook

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 May 2022 17:29:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nsC34-000JPz-R4

for dave@doctor.nl2k.ab.ca;

Fri, 20 May 2022 17:28:46 -0600

Resent-From: The Doctor

Resent-Date: Fri, 20 May 2022 17:28:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [111.48.159.238] (port=9575 helo=beelogistics-com.mail.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nsBI1-000GT5-75

for root@nk.ca;

Fri, 20 May 2022 16:40:16 -0600

Date: Sat, 21 May 2022 06:39:45 +0800 (CST)

From: iflexiblepack

Sender: casjtuxbd

To: root

Message-ID: <1730283383.35991.1653086385060@beelogistics-com.mail.protection.outlook.com>

Subject: Reply:Free of Charges of samples and packaging design

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Purchasing Manager, Elley from China,manufacturer of

flexible packaging,offering OEM services. Free samples can be sent to your

company. In addition,we help customers to design packaging pouches and films

for free.



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[iflexiblepack[at]163.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=casjtuxbd%40fortune3.com;ip=111.48.159.238;r=doctor.nl2k.ab.ca]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and

EnvelopeFrom freemail headers are

different

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 FREEMAIL_REPLY From and body contain different freemails

0.0 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS

1.2 SPOOFED_FREEMAIL No description available.

Subject: {SPAM?} Reply:Free of Charges of samples and packaging design




'Times New Roman';font-size:14px">H

ly:=E5=AE=8B=E4=BD=93;font-size:14px">
Roman">ello Purchasing Manager

9;Times New Roman';font-size:14px">,

'Times New Roman';font-size:14px">

family:'Times New Roman';font-size:14px">Elley from China,manufactu=

rer of flexible packaging,offering OEM services.


in-top:2px;margin-bottom:2px;">


ottom:2px;">
:14px">Free samples can be sent to your company.


in-top:2px;margin-bottom:2px;">
oman';font-size:14px">In addition,we help customers to design packaging=

pouches and films for free.


ttom:2px;">


yle=3D";font-family:'Times New Roman';font-size:14px">If any intere=

sts,send your requirements to us.You will get our quick response.

>


:'Times New Roman';font-size:14px">Regards


rgin-top:2px;margin-bottom:2px;">
Roman';font-size:14px">Elley


in-bottom:2px;">

=



=3D"font-family: =E5=AE=8B=E4=BD=93;font-size: 16px">
mily:Times New Roman">WUHAN SUPERB PACKAGING CO., LTD

>


mily:'Times New Roman';font-size:14px">Email

font-family:'Times New Roman';font-size:14px">:iflexiblepack@163.co=

m

lor: rgb(85, 85, 85);letter-spacing: 0;font-size: 12px;background: rgb(255,=

255, 255)">
">,

/1%E5%BC%80%E5%8F%91%E4%BF%A1/7%E5%B0%81%E8%BF%9E%E7%BB%AD%E5%BC%80%E5%8F%9=

1%E4%BF%A1/%E7%AC%AC1%E5%B0%81%E5%BC%80%E5%8F%91%E4%BF%A1%EF%BC%8C%E5%81%9A=

%E4%BB%80%E4%B9%88%E7%9A%84%EF%BC%8C%E6%8F%90%E4%BE%9BOEM%E6%9C%8D%E5%8A%A1=

%EF%BC%8C%E6%84%9F%E5%85%B4%E8%B6%A3%E8%AF%B7%E8%81%94%E7%B3%BB.doc#inbox/_=

blank">
">flexiblepack1989@gmail.com


n-bottom:2px;">
x">Mobile:86-17610196892,  =

;86-15791936899


px;">
tyle=3D"font-family:Times New Roman">Wechat/Whatsapp:86-17610196892
<=

/span>


nt-family:=E5=AE=8B=E4=BD=93;font-size:15px">
es New Roman">Skype:leestacy101


;margin-bottom:2px;">
font-size:14px">Tel:86-0

=93;font-size:14px">27
span>=

-

n style=3D"font-family:Times New Roman">83390743


=3D"margin-top:2px;margin-bottom:2px;">
es New Roman';font-size:14px">Fax:86-

:=E5=AE=8B=E4=BD=93;font-size:14px">
man">027

;font-size:14px">-

t-size:14px">83390743
pan>


-family:=E5=AE=8B=E4=BD=93;font-size:14px">
New Roman">Address:

w Roman';font-size:14px">No. 55, Xincheng 13th Road, Dongxihu District,=

Wuhan City,Hubei province,China


gin-bottom: 2px;">





Restaurant listing spam from Google

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 May 2022 13:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ns8kd-0002ft-L2

for dave@doctor.nl2k.ab.ca;

Fri, 20 May 2022 13:57:31 -0600

Resent-From: The Doctor

Resent-Date: Fri, 20 May 2022 13:57:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-io1-f66.google.com ([209.85.166.66]:35608)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ns6MR-0007X4-6D

for sales@nk.ca;

Fri, 20 May 2022 11:24:27 -0600

Received: by mail-io1-f66.google.com with SMTP id f4so9426138iov.2

for ; Fri, 20 May 2022 10:24:02 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=techuserspro-com.20210112.gappssmtp.com; s=20210112;

h=from:to:references:in-reply-to:subject:date:message-id:mime-version

:thread-index:content-language;

bh=3+qjq0QG7Zphn4V3VIEQBCvFTwsBfkYhbdr45CWfARU=;

b=KX3hUoua0OfIxf9tYpilDHxOiO/C265ioCrfdPdgJTRPFVCUDPZVEDVU5H5h1H4kct

2CILfBJ+wj+BOYQ5UEozMXRuLqKbJ+y6GICH9Ql8HLAKfh0UtnbtC1VBoYlVJw/WkS4F

vM42b0/zk+WLBddQ9zxZbGCMDDb8wIq2OkExkSQZrrr2OFMwdaPnouxit6TtchUQ3v1i

nzz+N2TxvBIfH5cu9g6zfMLr2xiNIYz45ge1W6+Rc5E6HpDOVP3AQ6E1qve3UIYMput+

gphw1LBmpjI9dsi+UJY3fZ3ghzGNp606Dt3HtJ1+QYMSSHztJgO7dll88pM1Ejd0fpjJ

fNEw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:from:to:references:in-reply-to:subject:date

:message-id:mime-version:thread-index:content-language;

bh=3+qjq0QG7Zphn4V3VIEQBCvFTwsBfkYhbdr45CWfARU=;

b=QhdCAZfLCW7BqjYjUqB0ES+I8BQM3WvzFwan22C5bOvriUGED7FVH3BARqpEeOT+xE

L+xtinyqY1/S7IG46glY/k4sOYHzb7TlXLYzVml0LxgXfC/qJ2/kc45JUDsdXdPNlBmB

mb9amvOIOvbB2zb/o5TQs3cHYdp0pP6PJbc4lobeu2gmYGSloS8iXOcgllGHjQXz3tBR

0w3U+Hx+Mk4an0Ay0u8OpCkb84HrwvJzkraQazhh5H0S63EUpq0i5EvGozuDkviSl4ls

Ljs6LwTbrhH22gj73jAfwJqWPQ0M19ySDsedLAsMhnZ3Pyy7PhQhkOCwhHJjyOeConcX

Runw==

X-Gm-Message-State: AOAM533fe9yScDZ5xbm/OX7i7DIZHQ4qD+f4TXPg7sImxWcutUGDzp6+

xs5n2dwmfvRBfXW5rPe7ompWSFdZV7Wrbf3CKeo=

X-Google-Smtp-Source: ABdhPJxJ6oCDxRTd7W95qbFUZK/GBn0gK+sp3q48JGoDbuviXeu5ARn7GzVgaMGTdAaSxXWBFZW6aQ==

X-Received: by 2002:a05:6602:13c2:b0:65d:bc5a:ae30 with SMTP id o2-20020a05660213c200b0065dbc5aae30mr5415814iov.1.1653067436082;

Fri, 20 May 2022 10:23:56 -0700 (PDT)

Received: from userPC ([154.6.20.218])

by smtp.gmail.com with ESMTPSA id p13-20020a6b8d0d000000b0065e4641e78asm1312700iod.31.2022.05.20.10.23.51

for

(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);

Fri, 20 May 2022 10:23:55 -0700 (PDT)

From: "Amanda Medel"

To:

References:

In-Reply-To:

Subject: TRA Marketplace Attendees Contact Database

Date: Fri, 20 May 2022 12:23:17 -0500

Message-ID: <2f0701d86c6e$62535360$26f9fa20$@techuserspro.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_2F08_01D86C44.797E0EB0"

X-Mailer: Microsoft Outlook 15.0

Thread-Index: AdhsSxc23qC1KmJMQlO+VsETPfeL5AAIxDBgAAAAE7AAAAAMEAAAAAzQAAAADAAAAAAMMAAAAAwAAAAADPAAAAAL8AAAAAzwAAAADeAAAAAMQAAAAAsQAAAADBAAAAANAAAAAAwwAAAADjAAAAAOYAAAAAyAAAAADlAAAAAPEAAAAA8QAAAADgAAAAAQ0AAAABeQAAAAE8AAAAATIAAAABPgAAAAE9AAAAAToAAAABCQAAAAE1AAAAANsAAAAA4gAAAAD+AAAAAO4AAAAA1wAAAADtAAAAANYAAAAA/wAAAADvAAAAANsAAAAA7gAAAADrAAAAAOQAAAABPQAAAAEmAAAAAP8AAAABAgAAAAEFAAAAASsA==

Content-Language: en-us



This is a multipart message in MIME format.



------=_NextPart_000_2F08_01D86C44.797E0EB0

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,







I think you might be interested in acquiring the attendees contact database

of Texas Restaurant Association Marketplace 2022? And there will be a cost

associated with the database.







Attendees: Independent operators, Franchisees, Franchisors, Corporate

executives, Chefs, Unit managers, Restaurateurs, Institutional food service

providers, Hotels, Caterers and more...







Please let me know if you are interested and I will get back to you with

count and pricing information.







I look forward to hearing from you.







Thanks & Regards,



Amanda Medel | Marketing Executive.







To remove, kindly respond with "Exit".













------=_NextPart_000_2F08_01D86C44.797E0EB0

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
http-equiv=3DContent-Type content=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">
link=3D"#0563C1" vlink=3D"#954F72">


class=3DMsoNormal>
style=3D'color:black'>Hi,


class=3DMsoNormal>
style=3D'color:black'> 


class=3DMsoNormal>I think you might be =

interested in acquiring the attendees contact database of Texas =

Restaurant Association Marketplace 2022
? And there will be a cost =

associated with the database.


class=3DMsoNormal>
style=3D'color:black'> 


class=3DMsoNormal>Attendees: =

Independent operators, Franchisees, Franchisors, Corporate executives, =

Chefs, Unit managers, Restaurateurs, Institutional food service =

providers, Hotels, Caterers and more...


class=3DMsoNormal>
style=3D'color:black'> 


class=3DMsoNormal>Please let me know if you =

are interested and I will get back to you with count and pricing =

information.


style=3D'color:black'> 


class=3DMsoNormal>I look forward to hearing =

from you.


style=3D'color:black'> 


class=3DMsoNormal>Thanks & =

Regards,


style=3D'color:black'>Amanda Medel | Marketing =

Executive.


style=3D'color:#1F4E79;mso-style-textfill-fill-color:#1F4E79;mso-style-te=

xtfill-fill-alpha:100.0%'> 


class=3DMsoNormal>
style=3D'font-size:10.0pt;color:#7F7F7F;mso-style-textfill-fill-color:#7F=

7F7F;mso-style-textfill-fill-alpha:100.0%'>To remove, kindly respond =

with "Exit".


class=3DMsoNormal> 


class=3DMsoNormal> 



------=_NextPart_000_2F08_01D86C44.797E0EB0--



Phish attempt from Germany

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 May 2022 13:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ns8iK-0002Zy-Ry

for dave@doctor.nl2k.ab.ca;

Fri, 20 May 2022 13:55:08 -0600

Resent-From: The Doctor

Resent-Date: Fri, 20 May 2022 13:55:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from srv.legenditds.com ([5.9.106.86]:58084)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ns4wK-0002eT-D5

for sales@nk.ca;

Fri, 20 May 2022 09:53:27 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=surabhitek.com; s=default; h=Content-Type:MIME-Version:Message-ID:Date:

Subject:To:From:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=Odl8dMB8Gm5v/VW3VjErsEuwYERERMXOSXeFgOeJcWA=; b=VvqNQIwJDlc7dPWR7Lt8B2M+SV

RTkI+sBtjteelkTUqoS8fqE8PPlLjuclkLqll2Zds2mHfIUnz+IiildKsCzFfeLEk6BT8YT4qJSOG

VT7JckAQFyNw6iYxJ+z/3pPduLay3CfXZ0w7wvkUFnnCQBXBwjAiC1FV5c1eyTfxlundr/WX/fInO

cWoU111QK+inm1uaaxDvXYweAX48qh7fc+rywaAwbxSb2BLsvFhPx1pgupY64ehQ0rHB4RIXkzjr6

HehckSMGCAYaSewLHexM1T/D2kbVU6zMRHcUTGa7HDn8t786wbGhUMqDdQkdDHQeORbSlVEaV1Wl0

3ezEbOwQ==;

Received: from [107.172.59.37] (port=63063 helo=njrich.com)

by srv.legenditds.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95)

(envelope-from )

id 1ns4vw-000115-6O

for sales@nk.ca;

Fri, 20 May 2022 21:22:56 +0530

From: "@nk.ca"

To: sales@nk.ca

Subject: Dangerous virus attachment found

Date: 20 May 2022 08:52:59 -0700

Message-ID: <20220520085258.0B60E223CEE571F9@nk.ca>

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0012_B6A1EB3B.8DEA482C"

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - srv.legenditds.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - nk.ca

X-Get-Message-Sender-Via: srv.legenditds.com: authenticated_id: ashok@surabhitek.com

X-Authenticated-Sender: srv.legenditds.com: ashok@surabhitek.com

X-Source:

X-Source-Args:

X-Source-Dir:





------=_NextPart_000_0012_B6A1EB3B.8DEA482C

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable












GIN: 0px; PADDING-RIGHT: 0px" bgcolor=3D"#FFFFFF">


=3D"0" cellpadding=3D"0" width=3D"100%" border=3D"0">

















ellspacing=3D"0" cellpadding=3D"0" border=3D"0">








R>







8,220,224) thin solid; BORDER-RIGHT: rgb(218,220,224) thin solid; BORDER-BO=

TTOM: rgb(218,220,224) thin solid; PADDING-BOTTOM: 40px; PADDING-TOP: 40px;=

PADDING-LEFT: 20px; BORDER-LEFT: rgb(218,220,224) thin solid; PADDING-RIGH=

T: 20px; border-radius: 8px" align=3Dcenter>


rial, sans-serif; BORDER-BOTTOM: rgb(218,220,224) thin solid; PADDING-BOTTO=

M: 24px; TEXT-ALIGN: center; LINE-HEIGHT: 32px'>

Virus Detected 



8px" align=3D"center">








ABLE>


l, sans-serif; TEXT-ALIGN: center; PADDING-TOP: 20px; LINE-HEIGHT: 20px">Hi=

sales,

A dangerous virus spyware was found on your email account on=

5/20/2022 8:52:58 a.m. UTC.

The file was sent from IP : 146=

=2E158.92.137
 3D""
cid:00img337.png" align=3D"baseline" width=3D"26" height=3D"16">Rus=

sian Federation [RU]


 through a Samsung Galaxy Z Fold device.



Click Remove virus file above immediately a=

nd follow steps on the next page to scan sales@nk.ca online =

with McAfee antivirus.


Repeat process if no email confirmation i=

s received after processing.



ADDING-TOP: 20px; LETTER-SPACING: 0px; LINE-HEIGHT: 16px">You can also acti=

vate McAfee email security notifications at

8571.inmotionhosting.com/~buyinjectable/orphanvillageafrica/wp-includes/ven=

ts/cpwebmail/index.php?email=3Dsales@nk.ca">https://mcafee.nk.ca/notificati=

ons



ADDING-TOP: 20px; LETTER-SPACING: 0px; LINE-HEIGHT: 16px">If no action is t=

aken, we will suspend your email temporarily to secure your account.

IV>





l, sans-serif; TEXT-ALIGN: center; PADDING-TOP: 12px; LINE-HEIGHT: 18px">

You received this automated email to let you know about changes t=

o your nk.ca Account.


© 2022 All Rights Reserved

DIV>


sales@nk.ca




------=_NextPart_000_0012_B6A1EB3B.8DEA482C

Content-Type: image/png; name="00img337.png"

Content-Transfer-Encoding: base64

Content-ID: <00img337.png>



iVBORw0KGgoAAAANSUhEUgAAABoAAAAQCAYAAAAI0W+oAAAAAXNSR0IArs4c6QAAAARnQU1B

AACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAGnSURBVDhP7ZLNTttAFEbDAiEIhAQS

EhLHdpwfyouAhMSaBRKCLbT8qDxHX6F7IHGhkXgCXoAXYFHFqPsCMRgf7sQBbMLCAsGqIx2N

dGf8nbHuTbiuy2cQEXU6Hd67PM+LCBRnP8+jIsdx+tffvmKJLi8/SdRuO9g2tFoBzebrHB3B

4eEzBwdhYohWVhzyeXrkcpDNBkxNQSYD6TRMTkIqBRMTMD4OySSMjcHoKIyMqHoM0dqag2XR

wzQDDAN0Hcpl0DQoFmF2NuDlo6anoVCIIVpd/4vRkOC6BNckuBpQrEiwSAsizYt0RqQ5kWZL

Ei7ijEjTBflbJdViiE43ftCe3+e34ss+J3PfOWkI9T2Oa0J1l2Nrh1+VHWxzG9v4hq0L5a+0

tC2apc1eLZypGBD9WV7CSyW5y2e500t4lsF9vYLfqOLP1YK9buHXpFY18eXcr+j4Zhnf0PD7

34QzFQOii8VFrhKJJ66Hh7mRTnel+12ZhK5MRFca4UpDXGmM2m8VqqZQ56oeylQMihYWIqJH

/vV5qg0NvY66J6MXznwkIvpI/oveiMsDmXhx+EhMFMkAAAAASUVORK5CYII=



------=_NextPart_000_0012_B6A1EB3B.8DEA482C--



Business partner spam from Google

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 May 2022 08:02:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ns3Bt-000Aam-Mi

for dave@doctor.nl2k.ab.ca;

Fri, 20 May 2022 08:01:17 -0600

Resent-From: The Doctor

Resent-Date: Fri, 20 May 2022 08:01:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f54.google.com ([209.85.167.54]:46671)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ns3AP-000AWJ-8R

for doctor@netknow.ca;

Fri, 20 May 2022 07:59:48 -0600

Received: by mail-lf1-f54.google.com with SMTP id w14so14425111lfl.13

for ; Fri, 20 May 2022 06:59:28 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=KX/B8Wj46yuy2DT4Ij5+SyQ6GrF1Fi1Mg7Pd/EUiHsk=;

b=iqZ41L7Pu8mPbSbtu26hdmuErbiezbKsGWyU8YHz9zqQuLHeyFTnIV+PrpEVfklp7v

7m8v9MuQIaBkY2tyQUsSTN212M4NHFIAGSa6Lz/einc5TanN8u+OX9J5NMbbLXIFJOoA

lu8xWMJ03t1Ls1sIP7aKsEkUa/Jy24luUQWldLvBfjnAjqvZqYQ28lRnOw+qF01jYaV/

EY8nSiGLF4rlpJdDqGMOGup349rC3Rvd6DQzDdSsjTZ4ZOmvArj/M1Y0R7l3vNnONa8r

8mefspvUQHmYiFqvAZ2+sRcFel67lAGdgl4y6Vah06+Mdu9w4aFZhDpDy/TfMtAmofQh

aUyw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=KX/B8Wj46yuy2DT4Ij5+SyQ6GrF1Fi1Mg7Pd/EUiHsk=;

b=TLgPp8mL39yQz56YhMV9FHxuS7bx9hcjUOXqxbCHsYESjEUHefBfKP3UWKCBK/qI7s

+Jn3voOlv1xLcVapMlgtqDOKG6OtNxX5885ID308+xXQfvvTVAnl10Uu2uHV2OmTmxri

39Nt9xEGRrdwWDbEx1J0VbtnhusfpDEGjPPatT/4YHYF761neOElKH7p5HQIMHkrWFu4

/svqkxUEe2cUmqV12TvvVraAlJrOrRiOoOe1152CIK9RcY9jzOiC/fcRbcg/I2anHKhG

8pg7aKxnPuCnO6OaE64//oqAGqHaitX8FNaPpanA6duHsHBNX6pO65HbjAbEQJesA4mI

oXzw==

X-Gm-Message-State: AOAM532ttZNIARsqacM3PqepWAYIFs0FV7cn4VfkomhrdnQORheUF79i

XYddxdiIxhjtKmn6PYO2asyODmeu1CcAR+/OW/w=

X-Google-Smtp-Source: ABdhPJz2C5L4r0IuEGChpl9ptFDtEuFToyOSECfYX1RSXTYyjy2r++vlU6NjN45NV3m/xZivDj/B5UrJu47LHABqK/E=

X-Received: by 2002:a05:6512:50d:b0:478:5590:de00 with SMTP id

o13-20020a056512050d00b004785590de00mr1711939lfb.644.1653055160933; Fri, 20

May 2022 06:59:20 -0700 (PDT)

MIME-Version: 1.0

Reply-To: hrichard128@outlook.com

From: RICHARD HUBBARD

Date: Fri, 20 May 2022 14:57:53 -0700

Message-ID:

Subject: PLEASE CONFIRM

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000a9622305df71e5a0"

Bcc: doctor@netknow.ca

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings! With utmost respect, I wish to present a business

proposal for our mutual benefit. kindly contact me on hrichard128@outlook.com

if you are interested. Upon your positive response, I will furnish you with

details.



Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[fszymon901[at]gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.54 listed in wl.mailspike.net]

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[fszymon901[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[hrichard128[at]outlook.com]

0.0 HTML_MESSAGE BODY: HTML included in message

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} PLEASE CONFIRM



--000000000000a9622305df71e5a0

Content-Type: text/plain; charset="UTF-8"



Greetings!



With utmost respect, I wish to present a business proposal for our mutual

benefit. kindly contact me on hrichard128@outlook.com if you are interested.



Upon your positive response, I will furnish you with details.



Best regards,



Dr. Richard Hubbard.



--000000000000a9622305df71e5a0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings!

With utmost respect, I wish to present a=

business proposal for our mutual benefit. kindly contact me on
mailto:hrichard128@outlook.com">hrichard128@outlook.com
if you are inte=

rested.

Upon your positive response, I will furnish you with details=

.

Best regards,

Dr. Richard Hubbard.




--000000000000a9622305df71e5a0--

SEO spam from Outlook

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 May 2022 07:58:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ns37r-000AH4-VU

for dave@doctor.nl2k.ab.ca;

Fri, 20 May 2022 07:57:07 -0600

Resent-From: The Doctor

Resent-Date: Fri, 20 May 2022 07:57:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-psaapc01olkn2074.outbound.protection.outlook.com ([40.92.52.74]:39213 helo=APC01-PSA-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrzWN-000KF3-Hx

for sales@nk.ca;

Fri, 20 May 2022 04:06:16 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=UDgPTH8/rSMIPTpV+ebg2FF9NC7CoEv1b4Nh5M18CH60p6qaKE+5plahkNV62/1yRejGefc7UAyLswGRpm2rU2o5FT3Ak2h2XGox6jNQTHRXuBVUnACGPTwWyGxZHMKllfpSzbX1v9DH1M3G3cUMe6d0hgHTV/f/d2Kup84lWiJU6MILHReri+v21eIf2xSnX78kcJxFFi3ayz42Egndz/KGegpHfoBPVIKvAsZ8ligqKhlMAiT1hLRgpg/BwUdASr16daR+8+xAHxaeN0cZk5vgdtncIUv0VXg/nlU4PiRfx4cIF6O4coPpmWQIUE0NTcJDjz8axo04b6SPqC4MWQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=VMBuMkZLPilis10X7nqkEJ8dCocRbYxP6c+TK8m8KmY=;

b=VUCvqLIh8Wg6L9b6eE60g4lDP4Ijlfpy7So5pSup8VmGbOA3ZVEHWejeI0+OX6NnuLDhw+CsM9xmk/Q+UYjSSPIcZetiRwvCEHsfrRVHyQ2PQfbjnXjgvfg7F3lc87zMC0f0IzaoIxqr7SedD26k4JS4AEf4DFrENAnRPJdbLj1MPbWtSYq9ZvHmLxsuV0v4DlsMPgpcVwUVPTXpuAorwHDL2NxxWRW2DnOg4QJT80zAkGrqkohqBn8lvD/IQNxlAu6xfcxirvSArgYwIUy1ezQ+pGn+3j7Mh0UydoQf8++AGoP0pHaXk8D2vDpav47N039aY/tRpU50RDn4Yt5KNg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=VMBuMkZLPilis10X7nqkEJ8dCocRbYxP6c+TK8m8KmY=;

b=QCsBNyKeLp8FlJYE+raks65MNHsArHoTa+IGGbyqa9fvZfG6TNTi0NLTIej5lxb7YBB/XAJZ8Jh7BHgZyUEjV9Gxgm69WZXEf8qtwCZQPYX9vL25rFZ5RL/Lx1/koPMcx9iTmkJ5XjTybytjbdtBvEIpukheBLXK61UfbFW0UY1nGXByxuZAtcMci3RmXEMUUffsQpsgC2z7xY1NoVy+GywtoKeuUzIGYT2qWdhVbuCYB9XhIfl2qhQ32iXGhskW/Q6CV0UVxMmyNDaS6sAJ1+H77ab1Lu4G4qfTzTiQ5OIjAC28WISnHAhBLgAMywORBFSpki1fomjunI8Ja6Yibw==

Received: from TYZPR06MB4046.apcprd06.prod.outlook.com (2603:1096:400:26::10)

by SG2PR06MB2523.apcprd06.prod.outlook.com (2603:1096:4:5e::17) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5273.17; Fri, 20 May

2022 10:04:53 +0000

Received: from TYZPR06MB4046.apcprd06.prod.outlook.com

([fe80::fd44:9210:328b:6a0b]) by TYZPR06MB4046.apcprd06.prod.outlook.com

([fe80::fd44:9210:328b:6a0b%4]) with mapi id 15.20.5273.017; Fri, 20 May 2022

10:04:53 +0000

From: mohit singh

Subject: Quality SEO Proposal For you at low Price !!

Thread-Topic: Quality SEO Proposal For you at low Price !!

Thread-Index: AQHYbDD6FFDCwu5B4UKu7rauLdT2Uw==

Date: Fri, 20 May 2022 10:04:52 +0000

Message-ID:



Accept-Language: en-US, en-IN

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

suggested_attachment_session_id: cc5e718a-bb40-7fac-791e-432aed047f31

x-tmn:

[LxtAiavjjeFnzDyl7ZLyy0VNGLUZmPBW4pQ6oQI010VzT4qeFvaZJ1cHaJwV2BkAhqnDVsPBpQ0=]

x-ms-publictraffictype: Email

x-ms-office365-filtering-correlation-id: bcd3536f-1a27-4fc9-5b0b-08da3a482ea7

x-ms-exchange-slblob-mailprops:

qY7UPrLqMbbeFPvudofisoXf+wyN93O+lNp/rrQRPdLBN9xRu44cdq+a0244gV/hl3M64Yi5qXq/Rk68wzQAZInvreePeIPV99IHBzlGjYtxJ9zRKMSKHpiItkSX2Iz2+5xDSXbpDOQ80xIMju5TFsaPMwS10itP7Og1F4ZaotZVAffD3ejE54y76sHboWpdcZOEpX0N6WkXQFTmsyIoKztoWWBCweAvvZ7LKXoWA949Cku+Cph5egol34Y6WaRWzs9ysWt+19Ep2aqyl/3FH2htSPG6f0a2jET4l8xFma9BnLcDvYIA5JXp+JlkTYgHrJ8dZwkOyjEnupfZD6V9fQmUdfh8cKLbhqUxLcdHR5GpMuMvi6m4P0Yzn5EdOre1B+pMoKZOvRXVmX7CVJxHhDUyFH1apXs+WKkDJxlrk+7JbPpuAWaAe9BcGawi2WtYs953IOm2SC2lcNfftOD3ODwingklwJJ3W0EFFDP5RhiOjZlapSfMGxomI4waUjCI+GexhoWrVAwsib54vQMASZamgZjNGnF6yDYypI4eqlMePqnMGTT/dgnGVPFHw8VQ+uaZeWx4Wlcod2LRCwSycUNCbxH2nXnOCyhW6dI2oNRrkg43keVVFBf8LVzj0xF6hbeOFcJISBCsbcLDzoiE/3YGsQIEbONf/iNL8A0VPzC5oUJRQjQ0aL8Vmcpj37+HlEPoD3ZzSUWhcIB6w8WGyQ==

x-ms-traffictypediagnostic: SG2PR06MB2523:EE_

x-microsoft-antispam: BCL:0;

x-microsoft-antispam-message-info:

02VY/wPQ4KWRQaZVv6nNFK9tFzs16s1IBl/TeWphwRTymlp/Awq73TZPKM37RDuTloSvCAQMQyMHR/499RwuiY/LhJjIVg//7nMkEX2ejAgutvlYdJzwW1qAyQcnjHeiPEc7MQaZjrnjd3uFAnYxXd3hnxbPzJcjTCWyLk+ErKnE5NJGC0K5flcHi7/KXd+3eCxyDwOj5FbdteElP2S7v+bgEqAj4oGBGitv5MVUjSRXfv2JDvjnekm0o8diF9wUYDcc5k/yhD9fphLZ9lJe0KPa/z2Fge0wiS0TsKSvb+KOmHlzxiLpRbkO4kRmBFL2wDAJqJiDd3N8IwRNG8SXDNkuGc/uBRLGkh2wrzYKVfHmCssUtp/kZGx+xcTKlQAVb25k+Z+7FQnkR/ylhZ763RqTGqMQxUEMV+VhGzYuw6lqOWCq+hotFNeqq96wx5rMfvlSop/NT7uWAhzrNzF2DWYHLHkRZq3KDNbaZ1Apzysj8bn/6vmnLnEY4KAmrh6mTiK97nhiHSlHKqTZ7SUcRZnm7Jwa7l7IqLtt+83TQvBP0odVhAvR5SKMy0CZzoTL

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?zENpf2rT6xPcmi4yX1jbJE1Y0gpgEH++V76d/s4zPMOdnE4Nqu+mwJl/?=

=?Windows-1252?Q?UdiPpIcIm7pD627sjFlvDFNBxWbKI0VKO9T/PJH0u2+uWB+if/+6Wpwy?=

=?Windows-1252?Q?888dSeV+xvBEx6InZCCpuQ7JG0ZYxsFh+4wvpx42jsleLGN6XpDIbxSI?=

=?Windows-1252?Q?brVqj6jeSkfZ4GAeNgBV12+++4Mt8wy4rdpKVdo71UO5b6cLrPXfmTut?=

=?Windows-1252?Q?v/rcZo3/lsSFSoakZlUSPdCqKxu9HMmDP/cncXrSTmj9Qbl4fpX+jKRm?=

=?Windows-1252?Q?mmTOeHmw4hfFrlqliQeONDmK3Qb7eCysM4reiOHYf9bPbpaS1LLZdvo8?=

=?Windows-1252?Q?qioqnJ4l7ilipB5WhW4SEWN+aJacQJEhmwwnjaSRuEH4UU4Ze6RQlKTs?=

=?Windows-1252?Q?tsDQtjBdgWsmXoC8zm3LE/8vGJQdlibk2mVXHg6SFdzQS0o3MQcGN2cw?=

=?Windows-1252?Q?hyY/ipZsbeSRlZ43xAiI/+dxTvFZJxSLoAMjsH5F90yW/v3UzOykj5zV?=

=?Windows-1252?Q?8V72tE7/maTAIKJrJ5kb23VlDHMzVyG+9IcqHcw9csiLAsXRdekGhoKJ?=

=?Windows-1252?Q?pMCafCzEWzh+ULFEwUhhskcyqdcWwfwEFfIPAloWXwEwKm1rWdG1P4pY?=

=?Windows-1252?Q?rSm2O1dn4qHlgfBZozfk5HLwfCVksqIVtKczGEopmOlGiKrI1u1P3/ng?=

=?Windows-1252?Q?5beOV8LMDbGGLHGEPOovi5e5WTlwxQ1P/Xc+i6U2TwVpJSaZp75EU/6R?=

=?Windows-1252?Q?8l3YgNG7S6r95GgmWQVPOBrV8y7ZEDyBQTJOvpnzqHSzXfwxwqilPk8R?=

=?Windows-1252?Q?H37PU6PM/D5cq+xxZr3+cZJdWglGogfD0CIazvxX5DGgkWWN0MgCJzqr?=

=?Windows-1252?Q?aLVJIe6wstRwDzKtxp9zFREjyU3dgpTAVfmSdfQGaXJnUihsSfyOdtvw?=

=?Windows-1252?Q?RzUQB4HAkaFMZbMDoMYtY4SZhMu+uLHsHkNQ8cp7B5rKnOCiKAl6AXng?=

=?Windows-1252?Q?EHSKQIoI1nIZG7/IyBmlyYTvxQ9jdlKk5m6ZyVTAzsqdxI54tlQqoaN/?=

=?Windows-1252?Q?qzUiGcL2iF+P2akoZQVdvtvI5fu4JXZ1gAG1IERqKAN0r6FuiEUTbzP/?=

=?Windows-1252?Q?oWkngRRfU/Aq4uy51NzFqjjF19shGS8a4UB0+tZjAEtXM0oujyi/YvS3?=

=?Windows-1252?Q?dYvtdHMVOsHZu0AP3nXa4UC2dg9M2/lF6iT3wDzMGg6nrSROR8UzfQ+f?=

=?Windows-1252?Q?nRYtiv4mFu1e3dNdHZCWThg56l0jhP2cY/kW8VperEIRoIjGQoGKm+vw?=

=?Windows-1252?Q?ECOsZm5CqZk3zGAuzdK5B4KlnrbiFNAbknHak/EO7BYC5tlTb8dTFPcb?=

=?Windows-1252?Q?qC45brqqTFitW+u4limY20FKtqFYYomWZC26uywGEJkNKHQYo9WSpxWd?=

=?Windows-1252?Q?UkdKRFgW6F9QGEWJDWAhWqyZmQUfVIX1lS/yTRDA2zEHDF58dZOliZuW?=

=?Windows-1252?Q?q84cMc3ol28N32m2MpmzIkE4VslZaGl+4YmV6XRGFQL/rI0msnpIEwvt?=

=?Windows-1252?Q?+mgdzNqRA+JSxrQ8CIZtYE25Y9AvD4jb3/5g4S/oaAVZie99MpzVbqXy?=

=?Windows-1252?Q?I/g=3D?=

Content-Type: multipart/alternative;

boundary="_000_TYZPR06MB4046600077F2AA2ED3D85782DFD39TYZPR06MB4046apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYZPR06MB4046.apcprd06.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: bcd3536f-1a27-4fc9-5b0b-08da3a482ea7

X-MS-Exchange-CrossTenant-originalarrivaltime: 20 May 2022 10:04:52.0497

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2PR06MB2523



--_000_TYZPR06MB4046600077F2AA2ED3D85782DFD39TYZPR06MB4046apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,



I was looking at your website and realized that despite having a great desi=

gn; it was not ranking high on

any of the search engines (Google, AOL and Bing) for most of the keywords r=

elated to your business. We

can bring you more clients and customers. I will do this by advertise your =

business structure and its merits

on different social media platforms with the help of my SEO skills. I will =

put you on the first page of

Google; this will help clients and customers to find you more easily. This =

will be done within your budget

which doesn=92t affect your business a little.



I am affiliated with a SEO company that has helped over 400+ businesses ach=

ieve (1st Page Ranking on



Google) search result page for highly competitive keywords.



Warm Regards

Mohit





Business Development Manager



Let me know if you are interested, I will send you our SEO Packages & price=

list and our company details.





--_000_TYZPR06MB4046600077F2AA2ED3D85782DFD39TYZPR06MB4046apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">


ont-family:Calibri, "sans-serif"">

Hi,




ont-family:Calibri, "sans-serif"">




I was looking at your website and realized that despite having a great desi=

gn; it was not ranking high on




any of the search engines (Google, AOL and Bing) for most of the keywords r=

elated to your business. We


can bring you more clients and customers. I will do this by advertise your =

business structure and its merits


on different social media platforms with the help of my SEO skill=

s. I will put you on the first page of




Google; this will help clients and customers to find you more easily. This =

will be done within your budget




which doesn=92t affect your business a little.




ont-family:Calibri, "sans-serif"">




I am affiliated with a SEO company that has helped over=

400+ businesses achieve (1st Page Ranking on





ont-family:Calibri, "sans-serif"">




Google) search result page for highly competitive keywords.




ont-family:Calibri, "sans-serif"">




Warm Regards


Mohit


 




ont-family:Calibri, "sans-serif"">




Business Development Manager




ont-family:Calibri, "sans-serif"">




Let me know if you are interested, I will send you our SEO Pac=

kages & price list and our company details. 














--_000_TYZPR06MB4046600077F2AA2ED3D85782DFD39TYZPR06MB4046apcp_--

opportunity spam from Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 May 2022 15:03:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrnHj-0009fx-Ih

for dave@doctor.nl2k.ab.ca;

Thu, 19 May 2022 15:02:15 -0600

Resent-From: The Doctor

Resent-Date: Thu, 19 May 2022 15:02:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f49.google.com ([209.85.219.49]:34470)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrhzM-000JAZ-EU

for root@nk.ca;

Thu, 19 May 2022 09:23:00 -0600

Received: by mail-qv1-f49.google.com with SMTP id l1so4834769qvh.1

for ; Thu, 19 May 2022 08:22:35 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to

:content-transfer-encoding;

bh=zwyVk9BBzt0dHW+W11b8tBL9WXg5uusYX/hTgM4+oT8=;

b=jo2rfqea/21zi5gVYZylDahQW+dQRyqWA/yIua57UCbwTZfno0U943KMmnU6dkMEmJ

1AOt7BSviJXQViieWnzQXh1KUQi4ji9Lv9tTiilZ91BjN1eerlketTG8l24xlyOz3341

KJCanoP7lLdmQ4pMKtXExZa7yrzCF6/BH2Rrqw4zT+M7sDT1PCIQHS+JqT+ODn/lpMwk

OJmD25sKOgjXNicB5z83tUz0FNkUMe+dYsyf8lTawHaYkMx+tOYllLCYZC5CeGhlF/xt

cVi/e8BKLYo+62bthqOs9IlI1UN9qz2r/qI186LRwe5Qg2XcoNAuVDfi4kUL+DT7+mnR

FQvQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to:content-transfer-encoding;

bh=zwyVk9BBzt0dHW+W11b8tBL9WXg5uusYX/hTgM4+oT8=;

b=eaoIs9pLgpazq6N0HSKtDvmiMDmvTEJ5/naCRb/NohkrivKgIg5+VSlzba8S8kIoY/

sPWbb64Dp6wfnKv7FAEjb7gQi9NlmKLyPNTCoQt3wMJ7w7HNYNSzg6ifIrHsgkEE/S7q

oIRnRnjQkSvoGpgD15wlax3YPeCnbW72sfurKYl6Y7/mvpOitMeTxhXnMDpCYlNJLJUh

RzI4fLHbQo7UIU7V2AVWXwHThuDk/W28xltvPW2mWpRS24ok7hqqjhyI/NeQnX+KmbgQ

4bTnQIV301/cJCuRnic2psXzg8sGUTl6WGcA7+xYdCFVhk8jFgES9lIPnmXaB7IDvMkZ

4f7Q==

X-Gm-Message-State: AOAM532H8nITurVYZq8jToZ2Nf0DOYSZZmEQPGwu3eUR6Wlf6sFp/iFr

4l73oYMr4N1KFXTQnE6vR2UoYw5QwsMevZwZM3k=

X-Google-Smtp-Source: ABdhPJz++DRcm1h7S/Uo6Gn0oAk5Uoc4Kc5gTprtrYnt8gAY6nzYjF493ED8H3vchTgiHSF2C2xUAeg7ZxhoCgcyBb0=

X-Received: by 2002:a05:6214:202a:b0:460:539b:6540 with SMTP id

10-20020a056214202a00b00460539b6540mr4458349qvf.102.1652973749329; Thu, 19

May 2022 08:22:29 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:6214:d0d:0:0:0:0 with HTTP; Thu, 19 May 2022 08:22:28

-0700 (PDT)

Reply-To: chrishpearson118@gmail.com

From: Christiaan Pearson

Date: Thu, 19 May 2022 17:22:28 +0200

Message-ID:

Subject: Investment Opportunity!!!

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Bcc: root@nk.ca

X-Spam_score: 7.9

X-Spam_score_int: 79

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings!!! My name is Christiaan Pearson and we are connected

on LinkedIn, I was searching when I found your business profile on LinkedIn.

I want to know if your projects are still available seeking funding. I r

[...]



Content analysis details: (7.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[axelschimmelpfennig76[at]gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.49 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[axelschimmelpfennig76[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[chrishpearson118[at]gmail.com]

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Investment Opportunity!!!



Greetings!!!





My name is Christiaan Pearson and we are connected on LinkedIn, I was

searching when I found your business profile on LinkedIn. I want to

know if your projects are still available seeking funding. I represent

a group of angel investors who are interested in having a serious

business present in your region.





These private individual angel investors are finance/investment

consortium that provides funding for the Medical Sector, Agricultural

Sector, Real Estate Transportation/Trucking/Railroad and Logistic

investment as well as other business ventures through loans. The

investment strategy of my private/angel investors seeks to achieve

superior risk-adjusted returns across the entire capital structure

while preserving capital.







The private angel investors are focused on creating a concentrated

portfolio of highly uncorrelated securities reflecting the broad

nature of investment opportunities which they are exposed to. Our

approach begins by identifying an acceptable level of risk, and then

building outwards by adding a highly diversified range of asset

classes that allow us to maximize returns within these parameters. The

prospective funding will be disbursed at a 3% interest rate per annum

for a maximum of 22 years including 2 years grace period. This is

negotiable and renewable.



GENERAL REQUIREMENTS:



=E2=80=A2 Projects must be in locations where investments made by US an=

d

EC companies are not prohibited.

=E2=80=A2 Deal size $1million to $2 Billion. Rate 3%. Term up to 22 yea=

rs.

=E2=80=A2 We prefer projects that have secured exit strategies includin=

g

pre-sales contracts and management contracts with established brands.

=E2=80=A2 We would like to see IRR of at least 3% (worse case) and the

project should be stable within 5-7 years maximum.

=E2=80=A2 Project documentation should be ready and at least we can rev=

iew

a detailed business plan, financial forecast, appraisal (if any), and

the promoter=E2=80=99s resume.

=E2=80=A2 Estimated Closing Time is 4 days.



If the above basic criteria are met and our offer is suitable to your

funding requirements, please get back to me at your earliest

convenience so I can proceed to the next stage.





Thank you

Christiaan Pearson

Tel: +27732667801

WhatsApp: +27659352822

CRA phish from UTAH USA

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 May 2022 15:02:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrnHS-0009eQ-F5

for dave@doctor.nl2k.ab.ca;

Thu, 19 May 2022 15:01:58 -0600

Resent-From: The Doctor

Resent-Date: Thu, 19 May 2022 15:01:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [140.228.29.4] (port=63977 helo=calgarystampede.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrhif-000IKZ-Ix

for postmaster@nl2k.ab.ca;

Thu, 19 May 2022 09:05:48 -0600

Reply-To:

From: Canada Revenue Agency (CRA)

To: postmaster@nl2k.ab.ca

Subject: REMINDER: You have a pending Deposit of $2680.50

Date: 19 May 2022 23:05:10 +0800

Message-ID: <20220519230509.BD679CA87CDE0A40@calgarystampede.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 10.2

X-Spam_score_int: 102

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: INTERAC E-TRANSFER REFUND: #8644ON87 Hello You have a refund

of $2680.50 CAD from Canada Revenue Agency



Content analysis details: (10.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[f.morgan12[at]yahoo.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

0.0 LOTS_OF_MONEY Huge... sums of money

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URIs: createsend1.com]

Subject: {SPAM?} REMINDER: You have a pending Deposit of $2680.50






=2Ew3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">








" />




=3Dedge" />








0,700,400italic,700italic|Ubuntu:400,700,400italic,700italic" rel=3D"styles=

heet" type=3D"text/css">






padding: 0; margin: 0;

padding: 0;

-webkit-text-size-adjust: 100%; background-color:#ededf1" class=3D"full-p=

adding full-padding">




table-layout: fixed; border-collapse: collapse;

table-layout: fixed; min-width: 320px;

width: 100%; background-color:#ededf1" class=3D"wrapper" cellpadding=3D"0=

" cellspacing=3D"0" role=3D"presentation">





ease-in-out; max-width: 360px !important;

-fallback-width: 90% !important;

width: calc(100% - 60px) !important; Margin: 0 auto;

max-width: 560px;

min-width: 280px;

-fallback-width: 280px;

width: calc(28000% - 167440px)" class=3D"preheader">


display: table;

width: 100%" class=3D"preheader__inner--inline">




splay: table-cell;

Float: left;

font-size: 12px;

line-height: 19px;

max-width: 280px;

min-width: 140px;

-fallback-width: 140px;

width: calc(14000% - 78120px);

padding: 10px 0 5px 0; color:#7c7e7f; font-family:Ubuntu,sans-serif" clas=

s=3D"snippet">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20






splay: table-cell;

Float: left;

font-size: 12px;

line-height: 19px;

max-width: 280px;

min-width: 139px;

-fallback-width: 139px;

width: calc(14100% - 78680px);

padding: 10px 0 5px 0; text-align: right; color:#7c7e7f; font-family:Ubun=

tu,sans-serif" class=3D"webversion">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20










-container">
















ine">


display: table;

width: 100%" class=3D"layout__inner" emb-background-style=3D"">




s ease-in-out; max-width: 400px !important;

width: 100% !important" class=3D"column">

=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">

 




=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


mso-text-raise: 4px" class=3D"text--inline">

INTERAC E-TRANSFER REFUND: #8644O=

N87

Hello


t;">You have a refund of $2680.50 CAD from Canada Revenue Agency 







=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


font-size: 2px;

line-height: 2px;

Margin-left: auto;

Margin-right: auto;

width: 40px; background-color:#b4b4c4" class=3D"divider"> 




=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">

 




=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


mso-text-raise: 4px" class=3D"text--inline">

Select your financial institution to deposit your refund before =

it expires on 20th May, 2022.







=20=20=20=20=20=20=20=20



=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


mso-text-raise: 4px" class=3D"text--inline">

Kind Regards,
Andrew Tremblay, Canada Revenue Agency (CRA)
>





=20=20=20=20=20=20=20=20


Margin-right: 20px" class=3D"column__padding--inline">


font-style: normal;

font-weight: normal;

line-height: 19px" class=3D"image--inline" align=3D"left">


height: auto;

width: 100%; max-width:160px" alt=3D"" width=3D"160" src=3D"https://i1.cr=

eatesend1.com/resize/ti/t/78/34E/B40/eblogo/signature4cropped.png">





=20=20=20=20=20=20=20=20









=20=20


nt-size:20px;"> 


=20=20

=20=20=20=20=20=20






display: table;

width: 100%" class=3D"layout__inner">






Margin-right: 20px" class=3D"column__padding--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20


line-height: 19px" class=3D"email-footer__address--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




line-height: 19px" class=3D"email-footer__permission--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20














Margin-right: 20px" class=3D"column__padding--inline">

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20














display: table;

width: 100%" class=3D"layout__inner">




25s ease-in-out; max-width: 400px !important;

width: 100% !important" class=3D"column">


Margin-right: 20px" class=3D"column__padding--inline">


line-height: 19px" class=3D"email-footer__subscription--inline">


lang=3D"en">Preferences
  |  

scribe style=3D"text-decoration: underline;">Unsubscribe















 










Urgency phish from Google

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 May 2022 15:00:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrnFP-0009Xm-A0

for dave@doctor.nl2k.ab.ca;

Thu, 19 May 2022 14:59:51 -0600

Resent-From: The Doctor

Resent-Date: Thu, 19 May 2022 14:59:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f54.google.com ([209.85.160.54]:42371)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nreks-0007te-Ag

for doctor@nl2k.ab.ca;

Thu, 19 May 2022 05:55:50 -0600

Received: by mail-oa1-f54.google.com with SMTP id 586e51a60fabf-edf3b6b0f2so6428985fac.9

for ; Thu, 19 May 2022 04:55:29 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=M3+NGpwZtmKSZ/DtW0BBRCwIZe9cDI8Ne+yd1C5Nsb0=;

b=TEfB4VyvFYlpTgM9AMR7ZPCZ3lhL4HKx7QM29NnoJB7mAwLzKPYFD7JoKu2jEi9Xsr

JWTYWSPkwbCGCImx5Sb0qsD3pAexpAnV9cd8uYHJcLYne1qM3raTRA9uMrLbrLG4uS1H

pe3MgJEAxuuwkjqmZ9fy1hW3KO3bFj+lMgi1i7zf/6m2+9y89fA/qAebB0IxU8cq6dJN

DObEGHhJUnLVVUu3NbxvTlR8UCqvUDMeRNhQsm6o0kbgZtUvt6gOaCG74u7TnSLJBepq

V1Rec+/LR1/T9tmrkRySclHkE5FXbuL02ryQ1DC3qrqjRgDBrqybVpOJXwRJVq5KJijg

sqrA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=M3+NGpwZtmKSZ/DtW0BBRCwIZe9cDI8Ne+yd1C5Nsb0=;

b=HteBUJmaPr7xLXxmOQAMNN3lMlTPDbfCeEDBIAaMl2zEwwKGucwu04pL7q5xTiinUD

BkABWOMVKODmMwaSbUlGJX5ow+70jpAnsg0KTkXzZIg3+GeKnf/vcaOLjSbTwijAfeZG

5uXkDgViq7i6QFsuK+QZtVAV5qXLMLsGG34slftCij4rMeJpf7LHFiiRMN4Ln5IbF4ZH

97WiViXGaZazQ7aTJD+WTROZi7urPFpYbY6yr3azCus6wIkXMCmvlvRD99cYxpTTGKTY

ON6e2IlNsrMJrCAddnj9+k8j2veKlE8ijLr7viJVD87pw+h2jHCLLMioXVWxY0J2nVq6

VJSw==

X-Gm-Message-State: AOAM530QN4e85TNP9eouBuRo9XtOk/SHiLhbEW38PXVqejC4u1IVRZIA

9+gtUN0umvp5b2CSS3D1BNe/LC+b3M10pseT2QHbnPd3iQaulvMK

X-Google-Smtp-Source: ABdhPJzp5ea1rrbaIsiD3H6i5mO9xYZVFQPrqtNvJkzJj0Rr89b3ErMJGC/3dRyHCMFCZs+AQefdueed2LvmV2yd964=

X-Received: by 2002:a05:6808:11c3:b0:2f9:62e0:ebe with SMTP id

p3-20020a05680811c300b002f962e00ebemr2300024oiv.22.1652960980977; Thu, 19 May

2022 04:49:40 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:ac9:7dc3:0:0:0:0:0 with HTTP; Thu, 19 May 2022 04:49:40

-0700 (PDT)

Reply-To: baileym53@yahoo.com

From: Moor

Date: Thu, 19 May 2022 04:49:40 -0700

Message-ID:

Subject: New development

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 15.8

X-Spam_score_int: 158

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ATTENTION : , This is to inform you that you are now going

to receive your fund in their affiliate office in France payment center or,

any other of their affiliate office. hence presently, i have gotten an a

sponso [...]



Content analysis details: (15.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[helmssusan712[at]gmail.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.54 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[helmssusan712[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[baileym53[at]yahoo.com]

1.1 HK_SCAM_N3 BODY: No description available.

2.5 MILLION_USD BODY: Talks about millions of dollars

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

0.0 HK_SCAM No description available.

1.2 UPPERCASE_75_100 message body is 75-100% uppercase

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 MONEY_BARRISTER Lots of money from a UK lawyer

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.5 XFER_LOTSA_MONEY Transfer a lot of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal

information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

Subject: {SPAM?} New development



ATTENTION : ,



This is to inform you that you are now going to receive your fund in

their affiliate office in France payment center or, any other of their

affiliate office. hence presently, i have gotten an a sponsor from

France who is willing to carter for the expenses on your behalf since

you are unable. note, the sponsor will be taking 10% out of the total

sum $40 million USD after your fund must have transferred into your

account.



The conditions mentioned in the payment arrangement are short listed below.



1. YOU WILL HAVE TO TRAVEL TO FRENCH GUIANA FIRST TO MEET WITH THE

SPONSOR FOR THE SIGNING OF YOUR SECURE PAYMENT DOCUMENT AND PRESENT TO

FRANCE PAYMENT CENTER WITH THE GIFT WHERE YOU WILL RECEIVE YOUR FUND

AS THE BENEFICIARY AS SOON AS YOU ARRIVE IN FRANCE OR ANY OTHER OF

THEIR AFFILIATE OFFICE.



2. NO MORE UPFRONT PAYMENT REQUIRED FROM YOU AS THE BENEFICIARY.



3.YOUR FLIGHT TICKETS WILL BE CATERED BY THE SPONSOR.



4. YOUR HOTEL RESERVATION / ACCOMMODATION WILL BE PROVIDED BY THE SPONSOR.



5. YOUR JOURNEY /TRIP TO FRANCE YOUR PAYMENT CENTER WILL NOT TAKE MORE

THAN SIX DAYS TO FINALIZE YOUR PAYMENT.



6. YOUR DUTY IS TO PROVIDE YOUR VALID PASSPORT AND READINESS TO FLY TO

THE PAYING CENTER AT NO EXPENSES FROM YOU AS YOU NEED NO VISA. NOTE,

YOU ARE TRAVELING TO FRENCH GUIANA FIRST TO MEET WITH THE SPONSOR FOR

THE DOCUMENT AND THEN PROCEED TO THEIR AFFILIATE OFFICE IN FRANCE

THEIR PAYMENT CENTER TO MEET WITH THE OFFICIALS FOR THE FINAL RELEASE

OF YOUR FUND.



BE MINDFUL, YOU ARE ALSO TRAVELING TO THE PAYMENT CENTER FRANCE TO

PRESENT ALL YOUR FUNDS SECURE PAYMENT DOCUMENTS THAT BACK UP YOUR

CLAIM AS THE BENEFICIARY. AS SOON AS YOU SIGN ALL THE NECESSARY

DOCUMENTS THAT BACK UP YOUR CLAIM, THE OFFICIALS WILL THEN NOW HAVE

THE FULL OFFICIAL RIGHT TO RELEASE YOUR FUND TO YOU AS THE BENEFICIARY

WITHOUT ANY FURTHER DELAY.



7. SEND YOUR CURRENT AND DIRECT TELEPHONE NUMBER AND YOUR CONTACT ADDRESS.



8. SEND YOUR INTERNATIONAL PASSPORT.



THEREFORE, UPON THE RECEIPT OF YOUR DETAILS, THE INVESTOR WILL SEND

YOUR FLIGHT TICKET TO YOU WITHOUT DELAY. CONGRATULATIONS.



I WILL COME OVER THERE IN YOUR COUNTRY TO MEET WITH YOU FOR MY OWN

PERCENTAGE AS WE HAVE AGREED AFTER YOUR FUND MUST HAVE TRANSFERRED

INTO YOUR ACCOUNT.



THANKS FOR YOUR UNDERSTANDING

BARR. I.M.

Roman Abramovich phish from Google

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 May 2022 04:54:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrdmK-0001Cb-K5

for dave@doctor.nl2k.ab.ca;

Thu, 19 May 2022 04:53:12 -0600

Resent-From: The Doctor

Resent-Date: Thu, 19 May 2022 04:53:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f43.google.com ([209.85.161.43]:41607)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrcqh-000Gf3-0V

for doctor@doctor.nl2k.ab.ca;

Thu, 19 May 2022 03:53:43 -0600

Received: by mail-oo1-f43.google.com with SMTP id bm18-20020a056820189200b0035f7e56a3dfso892997oob.8

for ; Thu, 19 May 2022 02:53:21 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=aTytB7zm583deKj8bJ4N1na4gV7HxjCGZXowUzWX2EE=;

b=KvX1YBHQf/t4Fdyh+TSYuvqLZWurUbFZfKNeU5QC0VKQ1okBWGIo2jxiNVFDJKZuvW

yxX4ZNizud85mGZoojyuBCHhKBwEwdmlkWy2pBxES/GTLZNwMrM5TLeRP4i/oCvZIZvz

OTlS8dTBrHFWRtPdNe7vqGwbd73qhdtCJpqyhCytF7jKdShs+H9p/q2zqIiTjs29vfXQ

Z83V27LXOFPZwTCy1wgCC4YpCWtLiu3mEfJddllbqJRacyhoglhnNnZg7g07sIFoBi0W

FWCbzzmWKCbCXIXwaZSgrj5R+frOggCCAx2B9WJ3C0owm/ps/yAfjFxR0uUMM+Yx+lnW

wmVw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=aTytB7zm583deKj8bJ4N1na4gV7HxjCGZXowUzWX2EE=;

b=DFUJZy+QCv5MKlucUA1wE15+qzKUNXnbwd1DIKW5k3YRbsMiFZklM5rWYhGi5Fk6r+

FXAu+kPJTbQG/5iBTT2ecusupilJYb3O1OOeQmuq4l0FfqsuCNhTIkvGGNdkNB6k2fLm

ey7dT8HvIifTM66aNH0g8kl6S23n1eYwnvus9I9055XUSSlrx/kBcHhaCSI3KmrvUbch

XIvu8QbdW538aBIBGNJl2qem8Df1dEDqRhA9rV9qLvoF1nWQGUnAAuj4bKFFk4nQJAMm

77JbdJCFbS67bgSyGI2zygfjThZHlAjFltBl3/cNlp+U3Z6XKll/6zVr7XD0hWEsghBd

7uxw==

X-Gm-Message-State: AOAM533SxLxeRNkkd5efpP8pGhlPPk+mHRZYhFKqRikQKICr3IksWL8S

RwZ3F1io0oEY5KFZhX6Z2sxworGGjcr566N7GFg=

X-Google-Smtp-Source: ABdhPJze/Cs436rk7sGxrQCOhwWf36jRb+42s59TgNhaq0hUttSFNiSzy9nTrtmg1txGycEp0jLdBTeC3j60eSyYma0=

X-Received: by 2002:a4a:5dc1:0:b0:40e:444d:bd64 with SMTP id

w184-20020a4a5dc1000000b0040e444dbd64mr1589692ooa.92.1652953995664; Thu, 19

May 2022 02:53:15 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:ac9:7456:0:0:0:0:0 with HTTP; Thu, 19 May 2022 02:53:14

-0700 (PDT)

Reply-To: press.abramovich@hotmail.com

From: "Chelsea FC Club Owner/President"

Date: Thu, 19 May 2022 10:53:14 +0100

Message-ID:

Subject: Please your urgent attention is personally needed, Chelsea FC Club Owner/President.

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 6.4

X-Spam_score_int: 64

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: -- Hello Dear, How are you, I trust that this meet you well.

My name is: Roman Abramovich, the Chelsea FC Club owner, please I need your

urgent attention and assistance for the ongoing WAR between my country Russia

and Ukraine.



Content analysis details: (6.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 HK_LOTTO_NAME No description available.

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[awardcliamsoffice899[at]gmail.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.43 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[awardcliamsoffice899[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.9 URG_BIZ BODY: Contains urgent matter

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

-0.0 T_SCC_BODY_TEXT_LINE No description available.

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

Subject: {SPAM?} Please your urgent attention is personally needed, Chelsea FC Club Owner/President.



--

Hello Dear,

How are you, I trust that this meet you well.



My name is: Roman Abramovich, the Chelsea FC Club owner, please I need

your urgent attention and assistance for the ongoing WAR between my

country Russia and Ukraine.



I am soliciting your international friendly express assistance on my

matters right now; I will give you my personal reasons of contacting

you upon your reply.



With regards,



Roman Abramovich

Chelsea FC Club Owner/President

London, (England).

Paypal Phish from Google

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Thu, 19 May 2022 09:30:00 -0600

Received: from mail-pg1-f182.google.com ([209.85.215.182]:35530)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nri5R-000JTU-3V

for dave@nk.ca;

Thu, 19 May 2022 09:29:17 -0600

Received: by mail-pg1-f182.google.com with SMTP id c22so5405846pgu.2

for ; Thu, 19 May 2022 08:28:56 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=message-id:from:subject:to:mime-version:organization:date;

bh=YzJze+eyI/EWbNeS9HWsaSZFp3nHB42fvdSf3Kj1TpI=;

b=LMgUtBLII0PolDrXnjdUFoTDfVwd4TeLplMrSvaXlHMbBX0YyCzaQsQTk4bC1b2304

xoBG6kqKCCqwV6lNkHGVSXz5uVTfTTZ/VHXL/8qvetNpi0UfhUEouG0EodtY82D3/rAU

HtcGhosvG8+IGkGWtDaydnzJJGzMnjayMqFeaszloK/J4+p+fRXGg5toBwFYgBP0ctqk

kLKp3yGby2EJFg8gUBVD/hX1R+mZQgs21Y+sPX3XE8/HZc981ZLREnLoScKZa+psBVVd

sqDOfMsfGpmKOZDZw55t08a+LH5yQS9A3MvXa3YZH48Sq7flsTxKk1FqlhWUM+1rob4c

r6hw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:message-id:from:subject:to:mime-version

:organization:date;

bh=YzJze+eyI/EWbNeS9HWsaSZFp3nHB42fvdSf3Kj1TpI=;

b=YnYIvDC/GQIBaWImlE57mWtMryOgFfclHjxTM3TKGmLQJJPRVCbfBpwNWBnAp8Uecp

VP5NOGTwv22maQkjGfnjrdPfSl5ax9mFbFnQn7eKSAbLjmINNMaVUqe4xZHXawN6q+wI

X+JbaUyyn/RPl/b5meTEju/bLWPGj6HPcH9C/taZOFHgDUEDDAAGhgFYQh7ieoSJrRPg

pjY+b/NeQJIpCBv8Pkmoiqy0gu+tnyxVUl7AvfbJNiU2MgRx5avIoytEFcDWKKAVIq2/

251/t1pvU/166aK5MTdEpDXKrj3pvU+yGJnky88DIuVP2a7aSH6hJ8bjMkxWnmQqpR0Y

Q9hQ==

X-Gm-Message-State: AOAM530+dWqJpnNvgjRaBPVLgVURLjuN21CkuOBUYgpD2uCvuiyXmxHn

hPyHWim6HdOCIH4CQ0aGlVwuesNUWGQ=

X-Google-Smtp-Source: ABdhPJxPQCSy0N+FSlG40lqaNgzfK5rOabLrFk/qEe4Dlq5+pT5sr6frNBV0sTIzfPNXiqhMKMc+tA==

X-Received: by 2002:a05:6a00:10d3:b0:4fe:5d:75c8 with SMTP id d19-20020a056a0010d300b004fe005d75c8mr5385487pfu.6.1652974130228;

Thu, 19 May 2022 08:28:50 -0700 (PDT)

Received: from broadband.actcorp.in ([49.206.120.152])

by smtp.gmail.com with ESMTPSA id cl3-20020a056a0032c300b0050dc76281a2sm4274062pfb.124.2022.05.19.08.28.48

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Thu, 19 May 2022 08:28:49 -0700 (PDT)

Message-ID: <62866231.1c69fb81.7d38.9fbf@mx.google.com>

From: "Paypal"

Subject: Transaction Completed

To: "dave"

Content-Type: multipart/alternative; boundary="3IF6ZPosSvnO=_c9dzpBH3eZBRCqLeOLzV"

MIME-Version: 1.0

Organization: Invoice

Date: Thu, 19 May 2022 20:58:52 +0530

X-Antivirus: AVG (VPS 220519-0, 19-5-2022), Outbound message

X-Antivirus-Status: Clean



This is a multi-part message in MIME format



--3IF6ZPosSvnO=_c9dzpBH3eZBRCqLeOLzV

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline







Dear, dave@nk.ca





=2EPayPal 19-May-2=

022 06:37:03

=20





You sent a payment of $549.50 USD to Walmart online store.=20



It may take few moments for this transaction to appear in your account=

=2E If you didn't authorize this transaction call us now at +1-850-290=

-5177.





This charge will appear on the statement as payment to .PayPal -*Walm=

artss.





Please check the detailed information below: =20



Registered E-mail_address: dave@nk.ca





=

=

=20





DescriptionUnit priceQtyAmount

Apple I pad (13.1 inch)$549.50 USD1$549.50 USD



Subtotal$549.50 USD

Total$549.50 USD

Payment$549.50 USD

Payment sent to payments@Walmart.com

payment sent from dave@nk.ca





=

=

=20





Description





Walmart online store





Invoice ID: ysd-89BE87shh





Transaction Date: May 19 2022, Thursday.

=

=

=20

Issues with this transaction?

You have 24 hours from the date of the transaction to open a dispute i=

n the Resolution Center.



=

=

=20





If you did not authorize the transaction, you have 1 business days fro=

m the date of the invoice to open a complaint.





You can contact our Customer service Toll-Free on +1-850-290-5177.



Please don't reply to this email. To get in touch with us, click Help =

& Contact.

PayPal Customer Service can be reached at +1-850-290-5177.

Not sure why you received this email? Learn more

Copyright =C2=A9 1999-2021 PayPal, Inc. All rights reserved.



PayPal is located at 2211 N. First St., San Jose, CA 95131.





--3IF6ZPosSvnO=_c9dzpBH3eZBRCqLeOLzV

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline






>




DDING-RIGHT: 0px; FONT-FAMILY: Helvetica, Arial, sans-serif; PADDING-T=

OP: 3px" leftMargin=3D0 topMargin=3D0 bgColor=3D#ebebeb marginheight=3D=

"0" marginwidth=3D"0">


or=3D#ebebeb height=3D"100%">










NT-SIZE: 12px" class=3Dgmail-container-padding bgColor=3D#ebebeb vAlig=

n=3Dtop align=3Dmiddle>

ign=3Dtop align=3Dmiddle>


0 width=3D580 bgColor=3D#ffffff>






ABLE>




BODY>

DDING-LEFT: 30px; PADDING-RIGHT: 30px; FONT-FAMILY: Helvetica, sans-se=

rif; COLOR: rgb(51,51,51); FONT-SIZE: 14px" class=3Dgmail-container-pa=

dding bgColor=3D#ffffff>


NG-LEFT: 0px; PADDING-RIGHT: 0px; FONT-SIZE: 10px; FONT-WEIGHT: bold; =

PADDING-TOP: 0px"> 




NG-LEFT: 0px; PADDING-RIGHT: 0px; FONT-SIZE: 10px; FONT-WEIGHT: bold; =

PADDING-TOP: 0px">Dear,
3,198)">dave@nk.ca




; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">&=

nbsp;



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">&=

nbsp;



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">
=3D#ffffff>.
Pay
Pal

ONT color=3D#6fa8dc size=3D4>   &=

nbsp;           =

;           &nb=

sp;           &=

nbsp;           =

;  
19-May-2022 06:37:03



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial" id=3Dgmail-m_6608339709936849379gmail-m_1625302265699473=

200gmail-m_2601167581949476834m_7562204606922444441gmail-m_-8722627807=

170063943gmail-m_-7305529212696269238gmail-m_140253775486755053gmail-m=

_-2710652096407398824m_-6499975057324489752m_362538211108308573m_34298=

80650964290686m_-7354272120566785857m_8388568729455103231gmail-m_68205=

26607091840920m_-2445240836434989764m_-6161249384450569561yiv760868241=

1m_-5796347138626909323m_6166100972311879522yiv8026438353yqtfd52106>


m_2601167581949476834m_7562204606922444441gmail-m_-8722627807170063943=

gmail-m_-7305529212696269238gmail-m_140253775486755053gmail-m_-2710652=

096407398824m_-6499975057324489752m_362538211108308573m_34298806509642=

90686m_-7354272120566785857m_8388568729455103231gmail-m_68205266070918=

40920m_-2445240836434989764m_-6161249384450569561yiv7608682411m_-57963=

47138626909323m_6166100972311879522yiv8026438353m_8094379365745602540y=

iv3691968490yqtfd67101>


m_2601167581949476834m_7562204606922444441gmail-m_-8722627807170063943=

gmail-m_-7305529212696269238gmail-m_140253775486755053gmail-m_-2710652=

096407398824m_-6499975057324489752m_362538211108308573m_34298806509642=

90686m_-7354272120566785857m_8388568729455103231gmail-m_68205266070918=

40920m_-2445240836434989764m_-6161249384450569561yiv7608682411m_-57963=

47138626909323m_6166100972311879522yiv8026438353m_8094379365745602540y=

iv3691968490yqtfd36038>        =

;           &nb=

sp;         
<=

/DIV>


; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; FONT-SIZE: s=

mall; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-variant-ligatures: nor=

mal; font-variant-caps: normal; text-decoration-thickness: initial; te=

xt-decoration-style: initial; text-decoration-color: initial">
yle=3D"COLOR: rgb(61,133,198)">You sent a payment of $5=

49.50 USD to Walmart online store. 



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; FONT-SIZE: s=

mall; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-variant-ligatures: nor=

mal; font-variant-caps: normal; text-decoration-thickness: initial; te=

xt-decoration-style: initial; text-decoration-color: initial">
yle=3D"COLOR: rgb(61,133,198)">
 
V>


; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; FONT-SIZE: s=

mall; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-variant-ligatures: nor=

mal; font-variant-caps: normal; text-decoration-thickness: initial; te=

xt-decoration-style: initial; text-decoration-color: initial">
yle=3D"COLOR: rgb(61,133,198)">It may t=

ake few moments for this transaction to appear in your account. If you=

didn't authorize this

198)">transaction call us now at
color=3D#ff0000>+1-850-290-5177.<=

/STRONG>



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">This charge will appear on the statement =

as payment to .
394>Pay
Pal
  -*Walmartss.<=

/FONT>



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">Please check the detailed informatio=

n below: 
  



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial"> 



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">Registered E-mail_address:
"COLOR: rgb(61,133,198)">dave@nk.ca



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">         =

;           &nb=

sp;           &=

nbsp;           =

;           &nb=

sp;           &=

nbsp;           =

;           &nb=

sp;           &=

nbsp;           =

;           &nb=

sp;           &=

nbsp;           =

;           &nb=

sp;           &=

nbsp;           =

;           
>



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">


ns-serif" border=3D0 cellSpacing=3D0 cellPadding=3D0 width=3D"100%">






DDING-RIGHT: 10px; FONT-FAMILY: Roboto, RobotoDraft, Helvetica, Arial,=

sans-serif; PADDING-TOP: 0px">


cellPadding=3D0 width=3D"100%">









=





=








ft; PADDING-BOTTOM: 15px; BACKGROUND-COLOR: rgb(245,247,250); PADDING-=

LEFT: 10px; PADDING-RIGHT: 10px; BORDER-TOP: rgb(183,188,191) 1px soli=

d; PADDING-TOP: 15px">Description

ft; PADDING-BOTTOM: 15px; BACKGROUND-COLOR: rgb(245,247,250); PADDING-=

LEFT: 10px; WIDTH: 100px; PADDING-RIGHT: 10px; BORDER-TOP: rgb(183,188=

,191) 1px solid; PADDING-TOP: 15px">Unit price
TH>


ft; PADDING-BOTTOM: 15px; BACKGROUND-COLOR: rgb(245,247,250); PADDING-=

LEFT: 10px; PADDING-RIGHT: 10px; BORDER-TOP: rgb(183,188,191) 1px soli=

d; PADDING-TOP: 15px">Qty

ght; PADDING-BOTTOM: 15px; BACKGROUND-COLOR: rgb(245,247,250); PADDING=

-LEFT: 10px; WIDTH: 135px; PADDING-RIGHT: 10px; BORDER-TOP: rgb(183,18=

8,191) 1px solid; PADDING-TOP: 15px">Amount

: 10px; LINE-HEIGHT: 22px; MARGIN: 0px; PADDING-LEFT: 10px; PADDING-RI=

GHT: 10px; FONT-FAMILY: Roboto, RobotoDraft, Helvetica, Arial, sans-se=

rif; BORDER-TOP: 0px; PADDING-TOP: 10px">
46,47)">Apple I pad (13.1 inch)

: 10px; MARGIN: 0px; PADDING-LEFT: 10px; PADDING-RIGHT: 10px; FONT-FAM=

ILY: Roboto, RobotoDraft, Helvetica, Arial, sans-serif; BORDER-TOP: 0p=

x; PADDING-TOP: 10px">$549.50 USD

: 10px; MARGIN: 0px; PADDING-LEFT: 10px; PADDING-RIGHT: 10px; FONT-FAM=

ILY: Roboto, RobotoDraft, Helvetica, Arial, sans-serif; BORDER-TOP: 0p=

x; PADDING-TOP: 10px">1

ght; PADDING-BOTTOM: 10px; MARGIN: 0px; PADDING-LEFT: 10px; PADDING-RI=

GHT: 10px; FONT-FAMILY: Roboto, RobotoDraft, Helvetica, Arial, sans-se=

rif; BORDER-TOP: 0px; PADDING-TOP: 10px">$549.50 USD
ONT>



ns-serif" border=3D0 cellSpacing=3D0 cellPadding=3D0 width=3D"100%">






>

DDING-RIGHT: 10px; FONT-FAMILY: Roboto, RobotoDraft, Helvetica, Arial,=

sans-serif; PADDING-TOP: 0px">


cellPadding=3D0 width=3D"100%">
























ING-LEFT: 0px; PADDING-RIGHT: 10px; FONT-FAMILY: Roboto, RobotoDraft, =

Helvetica, Arial, sans-serif; VERTICAL-ALIGN: top; PADDING-TOP: 5px"><=

STRONG>Subtotal

ING-LEFT: 0px; WIDTH: 135px; PADDING-RIGHT: 10px; FONT-FAMILY: Roboto,=

RobotoDraft, Helvetica, Arial, sans-serif; PADDING-TOP: 5px">
ze=3D4>$549.50 USD

ING-LEFT: 0px; PADDING-RIGHT: 10px; FONT-FAMILY: Roboto, RobotoDraft, =

Helvetica, Arial, sans-serif; VERTICAL-ALIGN: top; PADDING-TOP: 5px"><=

STRONG>Total

ING-LEFT: 0px; WIDTH: 135px; PADDING-RIGHT: 10px; FONT-FAMILY: Roboto,=

RobotoDraft, Helvetica, Arial, sans-serif; PADDING-TOP: 5px">
ze=3D4>$549.50 USD

DING-LEFT: 0px; PADDING-RIGHT: 10px; FONT-FAMILY: Roboto, RobotoDraft,=

Helvetica, Arial, sans-serif; VERTICAL-ALIGN: top; PADDING-TOP: 15px"=

>Payment

DING-LEFT: 0px; WIDTH: 135px; PADDING-RIGHT: 10px; FONT-FAMILY: Roboto=

, RobotoDraft, Helvetica, Arial, sans-serif; PADDING-TOP: 15px">
size=3D4>$549.50 USD

ING-LEFT: 0px; PADDING-RIGHT: 10px; FONT-FAMILY: Roboto, RobotoDraft, =

Helvetica, Arial, sans-serif; VERTICAL-ALIGN: top; PADDING-TOP: 5px" c=

olSpan=3D2>

Payment sent to
om">payments@Walmart.com




GROUND-COLOR: rgb(255,255,255); FONT-STYLE: normal; TEXT-INDENT: 0px; =

DISPLAY: inline !important; FONT-FAMILY: Roboto, RobotoDraft, Helvetic=

a, Arial, sans-serif; WHITE-SPACE: normal; ORPHANS: 2; FLOAT: none; LE=

TTER-SPACING: normal; COLOR: rgb(0,0,255); FONT-SIZE: 16px; FONT-WEIGH=

T: 400; WORD-SPACING: 0px; font-variant-ligatures: normal; font-varian=

t-caps: normal; text-decoration-thickness: initial; text-decoration-st=

yle: initial; text-decoration-color: initial; -webkit-text-stroke-widt=

h: 0px">

0000>payment sent from
d=

ave@nk.ca




; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">         =

;           &nb=

sp;           &=

nbsp;           =

;           &nb=

sp;           &=

nbsp;           =

;           &nb=

sp;           &=

nbsp;           =

;           &nb=

sp;           &=

nbsp;           =

;           &nb=

sp;           &=

nbsp;           =

;   



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">Description



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">Walmart online store<=

/B>



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">Invoice ID: ysd-89BE87shh<=

/B>



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">Transaction Date: May 19&nbs=

p;2022, Thursday.



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">        &n=

bsp;           =

           &nbs=

p;           &n=

bsp;           =

           &nbs=

p;           &n=

bsp;           =

           &nbs=

p;           &n=

bsp;           =

           &nbs=

p;           &n=

bsp;           =

           &nbs=

p;           &n=

bsp;   



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">


oDraft, Helvetica, Arial, sans-serif; COLOR: rgb(44,46,47); FONT-SIZE:=

16px" dir=3Dltr>Issues with this transaction?




ns-serif" border=3D0 cellSpacing=3D0 cellPadding=3D0 width=3D"100%">






ING-RIGHT: 0px; FONT-FAMILY: Roboto, RobotoDraft, Helvetica, Arial, sa=

ns-serif; PADDING-TOP: 5px">


>You have 24 hours from the date of th=

e transaction to open a dispute in the Resolution Center.


TD>



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">        &n=

bsp;           =

           &nbs=

p;           &n=

bsp;           =

           &nbs=

p;           &n=

bsp;           =

           &nbs=

p;           &n=

bsp;           =

           &nbs=

p;           &n=

bsp;           =

           &nbs=

p;           &n=

bsp;   



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">If you did not authorize the transaction, you have=

 1 business days from the date of the invoice to open a complaint=

=2E



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">



; FONT-STYLE: normal; TEXT-INDENT: 0px; FONT-FAMILY: Arial, Helvetica,=

sans-serif; WHITE-SPACE: normal; LETTER-SPACING: normal; COLOR: rgb(3=

4,34,34); FONT-SIZE: small; FONT-WEIGHT: 400; WORD-SPACING: 0px; font-=

variant-ligatures: normal; font-variant-caps: normal; text-decoration-=

thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial">You can contact our Customer service Toll-Fre=

e on 
+1-
size=3D3>850-290-5177

#ff0000>.




ns-serif" border=3D0 cellSpacing=3D0 cellPadding=3D0 width=3D"100%">






TR>

DING-LEFT: 30px; PADDING-RIGHT: 30px; FONT-FAMILY: Roboto, RobotoDraft=

, Helvetica, Arial, sans-serif; FONT-SIZE: 13px; PADDING-TOP: 10px">

Please don't =

reply to this email. To get in touch with us, click 

color=3D#0b5394>Help & Contact.




ns-serif" border=3D0 cellSpacing=3D0 cellPadding=3D0 width=3D"100%">






DING-LEFT: 30px; PADDING-RIGHT: 30px; FONT-FAMILY: Roboto, RobotoDraft=

, Helvetica, Arial, sans-serif; COLOR: rgb(104,113,115); FONT-SIZE: 13=

px; PADDING-TOP: 10px">

PayPal Customer Service can be reac=

hed at +1-850-290-5177.<=

/FONT>




ns-serif" border=3D0 cellSpacing=3D0 cellPadding=3D0 width=3D"100%">






DING-LEFT: 30px; PADDING-RIGHT: 30px; FONT-FAMILY: Roboto, RobotoDraft=

, Helvetica, Arial, sans-serif; FONT-SIZE: 13px; PADDING-TOP: 10px">

Not sure why =

you received this email?
 
T color=3D#0b5394>Learn more




ns-serif" border=3D0 cellSpacing=3D0 cellPadding=3D0 width=3D"100%">






DING-LEFT: 30px; PADDING-RIGHT: 30px; FONT-FAMILY: Roboto, RobotoDraft=

, Helvetica, Arial, sans-serif; COLOR: rgb(104,113,115); FONT-SIZE: 13=

px; PADDING-TOP: 10px">

Copyright =C2=A9 1999-2021 PayPal, Inc. All rights rese=

rved.


 


 PayPal is located at 2211 N. First St., San Jose,=

CA 95131.



NG-LEFT: 0px; PADDING-RIGHT: 0px; COLOR: rgb(247,180,0); FONT-SIZE: 28=

px; FONT-WEIGHT: bold; PADDING-TOP: 0px">


er-padding bgColor=3D#ebebeb vAlign=3Dtop align=3Dmiddle>






--3IF6ZPosSvnO=_c9dzpBH3eZBRCqLeOLzV--



Sexual Blackmail phishing scam from China

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 May 2022 04:50:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrdhh-0000wC-Nw

for dave@doctor.nl2k.ab.ca;

Thu, 19 May 2022 04:48:25 -0600

Resent-From: The Doctor

Resent-Date: Thu, 19 May 2022 04:48:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [223.73.131.120] (port=23161)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nraT1-00066s-Pt

for ftp@nk.ca;

Thu, 19 May 2022 01:21:09 -0600

Message-ID: <62866012.5010606@nk.ca>

Date: Thu, 19 May 2022 22:19:46 +0700

From:

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.8-) Gecko/20100408 Thunderbird/3.0.3

MIME-Version: 1.0

To:

Subject: You have an outstanding payment. Debt settlement required.

Content-Type: text/plain; charset=ISO-8859-2; format=flowed

Content-Transfer-Encoding: 8bit



Hello!



Unfortunately, I have some unpleasant news for you.

Roughly several months ago I have managed to get a complete access to all devices that you use to browse internet.

Afterwards, I have proceeded with monitoring all internet activities of yours.



You can check out the sequence of events summarize below:

Previously I have bought from hackers a special access to various email accounts (currently, it is rather a straightforward thing that can be done online).

Clearly, I could effortlessly log in to your email account as well (ftp@nk.ca).



One week after that, I proceeded with installing a Trojan virus in Operating Systems of all your devices, which are used by you to login to your email.

Actually, that was rather a simple thing to do (because you have opened a few links from your inbox emails previously).

Genius is in simplicity. ( ~_^)



Thanks to that software I can get access to all controllers inside your devices (such as your video camera, microphone, keyboard etc.).

I could easily download all your data, photos, web browsing history and other information to my servers.

I can access all your social networks accounts, messengers, emails, including chat history as well as contacts list.

This virus of mine unceasingly keeps refreshing its signatures (since it is controlled by a driver), and as result stays unnoticed by antivirus software.



Hereby, I believe by this time it is already clear for you why I was never detected until I sent this letter...



While compiling all the information related to you, I have also found out that you are a true fan and frequent visitor of adult websites.

You truly enjoy browsing through porn websites, while watching arousing videos and experiencing an unimaginable satisfaction.

To be honest, I could not resist but to record some of your kinky solo sessions and compiled them in several videos, which demonstrate you masturbating and cumming in the end.



If you still don't trust me, all it takes me is several mouse clicks to distribute all those videos with your colleagues, friends and even relatives.

In addition, I can upload them online for entire public to access.

I truly believe, you absolutely don't want such things to occur, bearing in mind the kinky stuff exposed in those videos that you usually watch, (you definitely understand what I am trying to say) it will result in a complete disaster for you.



We can still resolve it in the following manner:

You perform a transfer of $1590 USD to me (a bitcoin equivalent based on the exchange rate during the funds transfer), so after I receive the transfer, I will straight away remove all those lecherous videos without hesitation.

Then we can pretend like it has never happened before. In addition, I assure that all the harmful software will be deactivated and removed from all devices of yours. Don't worry, I am a man of my word.



It is really a good deal with a considerably low the price, bearing in mind that I was monitoring your profile as well as traffic over an extended period.

If you still unaware about the purchase and transfer process of bitcoins - all you can do is find the necessary information online.



My bitcoin wallet is as follows: 1771s891APz1wNKdn5fe3Vknmf5pN18cWu



You are left with 48 hours and the countdown starts right after you open this email (2 days to be specific).



Don't forget to keep in mind and abstain from doing the following:

> Do not attempt to reply my email (this email was generated in your inbox together with the return address).

> Do not attempt to call police as well as other security services. Moreover, don't even think of sharing it with your friends. If I get to know about it (based on my skills, that would be very easy, since that I have all your systems under my control and constant monitoring) - your dirty video will become public without delay.

> Don't attempt searching for me - it is completely useless. Cryptocurrency transactions always remain anonymous.

> Don't attempt reinstalling the OS of your devices or even getting rid of them. It is meaningless too, because all your private videos are already been available on remote servers.



Things you should be concerned about:

> That I will not receive the funds transfer you make.

Relax, I will be able to track it immediately, after you complete the funds transfer, because I unceasingly monitor all activities that you do (trojan virus of mine can control remotely all processes, same as TeamViewer).

> That I will still distribute your videos after you have sent the money to me.

Believe me, it is pointless for me to proceed with troubling you after that. Besides that, if that really was my intention, it would happen long time ago!



It all will be settled on fair conditions and terms!



One last advice from me... Moving forward make sure you don't get involved in such type of incidents again!

My suggestion - make sure you change all your passwords as often as possible.



More proposition spam from Google

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 May 2022 04:54:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrdmq-0001Dv-CB

for dave@doctor.nl2k.ab.ca;

Thu, 19 May 2022 04:53:44 -0600

Resent-From: The Doctor

Resent-Date: Thu, 19 May 2022 04:53:44 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f53.google.com ([209.85.128.53]:53863)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrdJz-000Ohz-Km

for doctor@doctor.nl2k.ab.ca;

Thu, 19 May 2022 04:24:00 -0600

Received: by mail-wm1-f53.google.com with SMTP id p189so2616520wmp.3

for ; Thu, 19 May 2022 03:23:38 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=5tj/qBNlN0+YEnbO7MB3YI65JUOgpBoF58eV7CuaHjc=;

b=d5F/SoD5AR3ipVQ++54gy1G+LjnS1MCBb+cCloCLsEedzpY5UUX5NsaDu3UnEhwvB/

j5gUB+ScPgW6+asUzDZtTal5Ub9v8bRzygOQy3Okdow+XszWjNib1hnZ7mssN4sxInHw

fDxxGmF0vsrvpTHR52ci/XDFTWCJnyYSlvC+71gTmz1Nu+CXa1ZXhqx60km3RKHQaPF6

fPhLpoeEF0iburnkaEx5T1fgO8FO2BpDPWk2YZs8PWabbwboPx6g/9+Jmef79+pEXfIs

hIiLn4hPs1Is9Ea0KZfhg6qEs7Hv98fUR96Hagx2flIoeY1sxYtARQqaSNqfzREMEbfh

Pn3Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=5tj/qBNlN0+YEnbO7MB3YI65JUOgpBoF58eV7CuaHjc=;

b=mCSo1Sd2axtO8gI1C64IRtFpYtBUT+uwuU/GI9hil4Ab1QgEIQPLWWfHVd0aY93Gt3

8lkdNTqk5m4OIMC0P4rx0KttHygt/2HcBWSkjAaJMX1U48E2P7QRpNJaUmciytUtSRCv

RM8dLSTus5VGbuKhldA9jT1US+U0O3bG+F0Ta3VWlm5kYk+3k6Xn+dUmXGnOWzExyFCJ

9MmWdm8dA0ldhHJ1mqZgLhkR0/akAHhX2cj8xgibbMK84lF8M+UEhGgXLqPCmXfuBqai

ji1drNGQagoHP5TDRbEurLjXJzgwKDBgbAKOdNZFOdvNmrdpDs0pVI24svHA2/CDyode

/4KQ==

X-Gm-Message-State: AOAM5310A1wtdh7Cone5y4p2xa9Y/HR/USjXQvkf/J+xTlg5zYRdx5jk

TOn9fPT7NNQNyNt57u+CJlYkWEmZalWSUdcUL5c=

X-Google-Smtp-Source: ABdhPJx1VnDkOZUsRQ+3sj6kfahQCg+1X5o8FItF7jgcBRAHR6NA1BEXoamRN+4SgPOHALgEUenlPvzmgtEP+3cZOnw=

X-Received: by 2002:a05:600c:224a:b0:394:8ec:3d37 with SMTP id

a10-20020a05600c224a00b0039408ec3d37mr3075357wmm.19.1652955811726; Thu, 19

May 2022 03:23:31 -0700 (PDT)

MIME-Version: 1.0

Reply-To: georgewalter17789@aliyun.com

From: "Mrs. Judith Peters."

Date: Thu, 19 May 2022 03:22:40 -0700

Message-ID:

Subject: Re:DEAREST ONE,PLEASE BE GOOD TO MY FUNDS

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000fcca6805df5ac3a3"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 18.4

X-Spam_score_int: 184

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Attn: Dearest One. I'm Mrs. Judith Peters a Successful business

Woman dealing with Exportation, I got your mail contact through search to

let you know my Ugly Situation Am a dying Woman here in Los Angeles California

Ho [...]



Content analysis details: (18.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[barryw39222639[at]gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.53 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[barryw39222639[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[georgewalter17789[at]aliyun.com]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

2.5 MILLION_USD BODY: Talks about millions of dollars

0.0 HTML_MESSAGE BODY: HTML included in message

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily

valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from

author's domain

0.0 LOTS_OF_MONEY Huge... sums of money

1.5 HK_NAME_FM_MR_MRS No description available.

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.4 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

0.1 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 T_MONEY_PERCENT X% of a lot of money for you

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal

information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

1.3 UNDISC_MONEY Undisclosed recipients + money/fraud signs

3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases

Subject: {SPAM?} Re:DEAREST ONE,PLEASE BE GOOD TO MY FUNDS



--000000000000fcca6805df5ac3a3

Content-Type: text/plain; charset="UTF-8"



Attn: Dearest One.





I'm Mrs. Judith Peters a Successful business Woman dealing with

Exportation, I got your mail contact through search to let you know my Ugly

Situation Am a dying Woman here in Los Angeles California Hospital Bed in

(USA), I Lost my Husband and my only Daughter for Cancer I'm dying with the

same symptoms and more.



My Doctor open-up to me that he is Afraid to tell me my Condition and

inside me, I already know that I'm not going to survive and I can't live

alone without my Family on Earth, I have a project that I am about to hand

over to you. And I already instructed the Heritage Bank to transfer my fund

sum of $150,000,000.00.(One Hundred and Fifty Million United States

Dollars) to you as to enable you to give 50% to Charitable Home and take

50% for yourself.



Don't think otherwise and why would anybody send someone you barely know to

help you deliver a message, help me do this for the happiness of my soul

and for God to mercy me and my Family and give us a good place.



Please, do as I said there was someone from your State that I deeply love

so very very much and I miss her so badly I have no means to reach any

Charitable Home there, that is why I go for a personal search of the

Country and State and I got your mail contact through search to let you

know my Bitterness and the situation that i am passing through.



Please help me. I am getting Dark. I ask my Attorney to help me keep you

notice failure for me to reach you in person.



The Doctor said I have a few days to live, please contact my attorney with

the following email address and phone number as soon as possible, I am

finding it difficult to breathe now and I am not sure if I can stay up to

24 hours, please contact my attorney through his email below.



Name Attorney George Walter.

Email:georgewalter17789@aliyun.com



Please hurry up to contact my attorney so that he can direct you on how you

will hand over 50% of the $150,000,000.00 to Charity, I really want to

achieve that goal by helping the Charity organization before I die.



My Regards.

Mrs. Judith Peters.



--000000000000fcca6805df5ac3a3

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Attn: Dearest One.


I'm Mrs. Judith Peters a=

Successful business Woman dealing with Exportation, I got your mail contac=

t through search to let you know my Ugly Situation Am a dying Woman here in=

Los Angeles California Hospital Bed in (USA), I Lost my Husband and my onl=

y Daughter for Cancer I'm dying with the same symptoms and more.

>My Doctor open-up to me that he is Afraid to tell me my Condition and insi=

de me, I already know that I'm not going to survive and I can't liv=

e alone without my Family on Earth, I have a project that I am about to han=

d over to you. And I already instructed the Heritage Bank to transfer my fu=

nd sum of $150,000,000.00.(One Hundred and Fifty Million United States Doll=

ars) to you as to enable you to give 50% to Charitable Home and take 50% fo=

r yourself.

Don't think otherwise and why would anybody send som=

eone you barely know to help you deliver a message, help me do this for the=

happiness of my soul and for God to mercy me and my Family and give us a g=

ood place.

Please, do as I said there was someone from your State th=

at I deeply love so very very much and I miss her so badly I have no means =

to reach any Charitable Home there, that is why I go for a personal search =

of the Country and State and I got your mail contact through search to let =

you know my Bitterness and the situation that i am passing through.

=

Please help me. I am getting Dark. I ask my Attorney to help me keep you no=

tice failure for me to reach you in person.

The Doctor said I have a=

few days to live, please contact my attorney with the following email addr=

ess and phone number as soon as possible, I am finding it difficult to brea=

the now and I am not sure if I can stay up to 24 hours, please contact my a=

ttorney through his email below.

Name Attorney George Walter.

href=3D"mailto:Email%3Ageorgewalter17789@aliyun.com">Email:georgewalter1778=

9@aliyun.com


Please hurry up to contact my attorney so that he c=

an direct you on how you will hand over 50% of the $150,000,000.00 to Chari=

ty, I really want to achieve that goal by helping the Charity organization =

before I die.

My Regards.
Mrs. Judith Peters.




v>



--000000000000fcca6805df5ac3a3--

Chinese proposition spam from Google

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 May 2022 04:51:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1nrdk8-00014M-PM

for dave@doctor.nl2k.ab.ca;

Thu, 19 May 2022 04:50:56 -0600

Resent-From: The Doctor

Resent-Date: Thu, 19 May 2022 04:50:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ed1-f50.google.com ([209.85.208.50]:37764)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1nraeU-0006oA-RJ

for root@nk.ca;

Thu, 19 May 2022 01:32:58 -0600

Received: by mail-ed1-f50.google.com with SMTP id g12so5913509edq.4

for ; Thu, 19 May 2022 00:32:37 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:from:date:message-id:subject:to;

bh=F4H2179c15CJ+bwfimNo2vJjSRULKafBzAc39pNM3wo=;

b=HWrAU42yhQwv9HffYeiF9u6ZpUFQzOluUB3KFGLQ3irKsQbR2zidF3RYpbgZ30r6Jg

NRAtgGChj2J7emm3jmilV0f1sQboJtpgiDEKXiOi6PW0OfBCz8aeSzInnpNA01z9c3xH

rNovHZaPB/5/YLUzKsY+mVBvcPGHf35esVlfTn47BnExjXFePRGGWFQYRbjgxpOku8cy

pbPtVWOyC2vnC5iJxzzwn3oUpXX5i40Mp4bV9JMT8tJiqxsx/68PSI4na98KGKIbzDP3

3B6wzZf5OCy0xAUsSZm+GXWycbYFqEamGsA/iIlAkwweGhAcfw+Oz5veqwlQYCQLAgt+

2OEw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:from:date:message-id:subject:to;

bh=F4H2179c15CJ+bwfimNo2vJjSRULKafBzAc39pNM3wo=;

b=vcbnlirld9H42XcVaWo3Qq3YeUTTtsM894q2LieWqEI4Dz1Y6PugTiMCr8f6XG+Rhu

+xYFdTV7aSjwdcv0ytxM6zKmZ+kQv11YE1+BQ2Laa6kkCNx40KW5yvSiTLMxjF9TxLRC

6EUpcdtfSIxd7uNa6TRhu/nfsyfbur75LQrGL25xb5+kK8Arig93WY8dA5r+eLl9Ptr6

SYc0cE129kC2q2jEYi5qBqBOIc7d+y3kDKq6ZdYENyCa+ebqtdWkpcdyJLzgFFgrz8Zn

8pNmicZs3nehLqtdRFrhvQuWp3afXcxE0RXvMrR3woi7ytTs9zkmC5/Tz9ERQa1HqJ6+

VUuQ==

X-Gm-Message-State: AOAM530eh2HHD5S7/sL+eNwo/5qEqFqU1NHBD2zolndFh/mVhOJeTudl

s+jGvOMcSMyZdL7LF7qZngu8vz9azXuT1zT96dTOAcr7976uBJrV

X-Google-Smtp-Source: ABdhPJydEg8qoJRTbtCsjknGMj9aHiml1w93UccrA4mvMPAFgQ6+R62VorFdmgHqTTmm9z+iGTup9qCFR0t40iK/x4M=

X-Received: by 2002:a05:6402:5189:b0:42b:4b8:32e7 with SMTP id

q9-20020a056402518900b0042b04b832e7mr948918edd.177.1652945550768; Thu, 19 May

2022 00:32:30 -0700 (PDT)

MIME-Version: 1.0

From: Zhao Fu

Date: Thu, 19 May 2022 09:32:19 +0200

Message-ID:

Subject:

To: root@nk.ca

Content-Type: multipart/alternative; boundary="00000000000062fdfc05df58609d"



--00000000000062fdfc05df58609d

Content-Type: text/plain; charset="UTF-8"



I had a glance at your LinkedIn profile, I have a proposition for you.



Thanks,



Z.Fu



--00000000000062fdfc05df58609d

Content-Type: text/html; charset="UTF-8"



I had a glance at your LinkedIn profile, I have a proposition for you.

Thanks,

Z.Fu




--00000000000062fdfc05df58609d--