SEO spam from Microsoft Outlook servers

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 Jul 2022 15:36:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oF0JG-0007FI-SS;

Fri, 22 Jul 2022 15:35:46 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 Jul 2022 15:35:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee ,

See root

Received: from mail-dm6nam04olkn2011.outbound.protection.outlook.com ([40.92.45.11]:7680 helo=NAM04-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEwkd-000DDz-74

for root@nk.ca;

Fri, 22 Jul 2022 11:47:52 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=TTeQEUMQjPKgG38/QOklF5mRrcb07IbJvUOmEVerlD0ingOf/8LWR5SFhcsWkYXrXYxVNR0FzNwHM/WMvWck5TExjMOUsAD8hBoAc4GKeed1SKk/gaiLdQgJQv0rUw3hVsCf2OYpraA1+XxyiEE7Um43fUVNVRbXdo3tOeZzbxO6Ggsf5PFMsTWfO/uAvxZGP+GtFSb7EUR+benY4UHYBw+v37/d9NuFnQpibDycBFC4fGSJ1y+pt7hRKWqfJEQnLpnRiMXsdVDko2+tvZu1J02MMjTHHXOj/DxrCw1Il1N1x36dD6lZnzQEdBp6+6jZ0eZJtY2t+2J+kk0eJConWA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=ejazVwK9rUe7pdfz1BaDoQYN60miWNMwAzdz0fmj98E=;

b=oTlj+YSE8KiFfKAZCuCFDWqrLljMEMilyn58r4fh0z48vQdADPMMF0etwI3v3e3W0+31+rUD2t6QQ/AjIuwA+cL6NLmSphJ6afGwas9ty2pWdKigB/fq3gtsTpfU3ry6jmasVnvxPuGR2558T6Jd7t38tNuBoqtUuIfjk4uDhNZGvfrRfV73iOkeup22K5xoLQAwcMVAgt0M4OTd/Ee/o6rq3xIKuk0ZCyKlzKpkZTQ4ZdU+8WuE/PaA0ehRfal22rAur0YdaVRDyjaYp2ri4HeIcnximlf8/OjThAe4omxnvf85HH9uszBJoIijoGFtPphy6sTlhE+pgd6PGs9UdQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=ejazVwK9rUe7pdfz1BaDoQYN60miWNMwAzdz0fmj98E=;

b=WS4ppnF3Vx/JnqKfQRDVwt1G3Ts4u2UvUuLtHM9etGBWfIhJ4J2vxy922joNwbCGhMDaD6E2o0+Gf86HQFFAUpy29dv4IcXzixpR4jBqYTrlS5rfguq2EV+5zmE5A6BQiSf535csGdKnEKFQI8rYH82RLvfUD9ho/lBvdVlxQhyKjj+loV2pDojHLu8EvrZGknIgpi9b4dOqCV0HPIS+uGEYUz2kME9NXKvevOlLS9ygHdftrZTMIUXnx+0z4TEs9AN9t5NfkLjo4m5H1C8DmwGUyubXMUZ9NP42D1aoVJjCAflosA2+lIgZY/cKsKEWm07YUbhtpjNBEz/l7/vyEQ==

Received: from DM6PR04MB4218.namprd04.prod.outlook.com (2603:10b6:5:9e::28) by

SA2PR04MB7482.namprd04.prod.outlook.com (2603:10b6:806:14e::5) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.5458.19; Fri, 22 Jul 2022 17:47:11 +0000

Received: from DM6PR04MB4218.namprd04.prod.outlook.com

([fe80::c086:53f4:f6b0:b76a]) by DM6PR04MB4218.namprd04.prod.outlook.com

([fe80::c086:53f4:f6b0:b76a%3]) with mapi id 15.20.5458.019; Fri, 22 Jul 2022

17:47:11 +0000

From: Amelia Elzey

Subject: Proposal

Thread-Topic: Proposal

Thread-Index: AQHYnfL07tjUud1hHkeCWHDpSYo9Dw==

Date: Fri, 22 Jul 2022 17:47:11 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

suggested_attachment_session_id: c4c2e12e-d826-ea7a-17cc-e49c4f8893d3

x-tmn: [8H1uvlMDZMRJ0PpizefOY3o6PCZu33Bd]

x-ms-publictraffictype: Email

x-ms-office365-filtering-correlation-id: 84c411a1-025d-4a95-1710-08da6c0a34ab

x-ms-exchange-slblob-mailprops:

aVwBqh5jh9vvoYlFu6wJC9hIvufR4WqV1jtk+OW+Ps7Xp5ngUcTwqYR0jnn2D6K4sylormyFvIqHjrlmvhW7Z4ujQoHAuznwBrrZVakRWeAnk4/2/wRPFvcezSGdQLVhIip9RXpCuK6HZ3YdfeqmJVH4FdSE/aLuTxnfF7k4p1OSuVq8HTjGC9rr2scJOnIUId8buEuxkxOnyZAoT/tJpYBMzaTgv69ZB1e01bIM+4kc4nVhgY0p6R5V32EKMUxQmm8B9P8zeoUad+WRRKsaTTB+7jOsa11SSvMJfVb3Zjt2wQIYSAI4e/cb4XXnqSxMu6osAw2j+udWCVhOoDchyaZqFx0uAouVsM1AINERrWmibTQF1T09JNF+VzVpiQx1gehZ+N+Y7F+DyY5GM2M0nsVdTAs/86s8UVBQOg/oipJB8dpviPAd7Z4Tr1QzDzwzzjNq5S+TswaW50vQENiahYNhqy8heWPIZ9sVU3WVz0NM/lIow2BjE6SgdyhpiQdmfWeOzZZ6v9aQbfug9XZtPT/WDLx/LJ0hY8FPpXse8pTitw47L/Gn4dWh5OsuIrr6OUFLi2gK4VusdVSknEyBvw==

x-ms-traffictypediagnostic: SA2PR04MB7482:EE_

x-microsoft-antispam: BCL:0;

x-microsoft-antispam-message-info:

x7ErQ5DHXKQdzxOV6mC8u/gQ1qwvpLpWDqtkf7CfgJvxeBaUFc9xZM9EuS5yqB2IumpQkLHAZ5CI/NWDKIzy17Xg8EsPoXRiAkKIBW+7+SSR06OHjdl1zImjeElp+hZk2i+PeNi63M7waZT+BIyGggpDg0QXFxZlJERe4fdzgFRT3h1lfsgYmIvBBM8JekPpwG5QwnQxy+eHf131bI6LKvI+0FH2Mk2laJcrCxH7Q7zApMXffwSp1Af+M5EQBjEGzaEfZLK/2RSytCgdmKfuW95XCCr7QKMmZ0+DI076jcG/Lgwi1H9rY5yvVN1e621xOPEJjP8pE4hZuCu3kqpMOJnfD0aWxS6wZFvXEAMwbYVhtvUP2QtBZCoIv70A2wM4vtQFX89d5lCdtyKnRgTTGWTz6j7b9dv9x6Hg5eKm0namKgxbQc+r3KrrYqldP+UUecpgyvAT+s9zCCQFSyp4t4lXuMa41m7FXZ+RhUqW7TEPFxSG9aRri1XhSHB4ZqLdNtW142Y71+KnUKugqv39WTnhkxzhvY5r26TaIoVMZaI7uEwb5gYdgb84b7aDXfq541OcR0nZZO7DlEazINgYikXT6n0UqzDDzNst5Y1oM+l9QuKg1IOkoBYVjTuf67Ln

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?kqzMwJ5ncFHK03LwHY1Ew0KoRBovTRO8rMZgSTmxmYaB5JK7V0MDR68R?=

=?Windows-1252?Q?3zlZpygWIRlb/mh6WD3q59aM9yLmKDSx3v8lYXAN59LWKWokVQ3oAyr+?=

=?Windows-1252?Q?/wFgPojR05N6hZNzzK2NCXKngs+aORt4B5gtH/vzgIin4LL2HwbVdktc?=

=?Windows-1252?Q?YtG18lsOCHfEqgeDwYVSC82XBwjEMPB1KZ++qjeKD3HrQfOxjgj3INrJ?=

=?Windows-1252?Q?QfbNH687XNZB/Qn63O6h3Ie8IVpk9WOwxIjgJyXalEonZtZ0XpCvRx7e?=

=?Windows-1252?Q?4ezLCMBfC5IIcVNpv6zs78LOTCIh2+hTwVJVJolgGodukapdIxexSk9H?=

=?Windows-1252?Q?+FcckmIDjg4PLnwgQ1qkh23X0XfDpt4hDGmL07PMl9rhbFAPAhwM0/Ec?=

=?Windows-1252?Q?ewqx22tBy4VaeKRJ9QuYGQPzpWWyj8PURf7v081Y29Uytz/G061Sedc6?=

=?Windows-1252?Q?ExVEbJ3gDqDfm6v32Ep3cE15rqiWDLGHxfn6leRBiuq+RboZA1VTe69u?=

=?Windows-1252?Q?2CYnZ5Fb/nhuaLG5lREjjG08SoOkqlqDwYuu9O37YTTE7R8pCFkLkj0B?=

=?Windows-1252?Q?vW/DFxDqBfwUvab5FbcIqCd2VcqR31qQHwHS+VnGab+C7+5uliE+aWOD?=

=?Windows-1252?Q?1X4J2H26WN89fQpeaLLiA4eSn685xhgMyo4kUBKu3MCrxXaqgtxoDy4a?=

=?Windows-1252?Q?tNudQW1MyX+zz0PqGplDgWSJ3c6YM6fYMRc54apiI+vlOwv74Mo0Pmm1?=

=?Windows-1252?Q?EctINa3ZB+/WWVuVltQP3TUqKe0w+aioAUOXVYP0+7YMtvp2AWOep4NF?=

=?Windows-1252?Q?579SLYExEfEzmPG07JRFpFamoFN08kCVFfKVIf5rEofhsljgazUivuR1?=

=?Windows-1252?Q?P2THrS391tqnwmHVFzOzzOlDghN7jOV1QGmClxaGzDt1SF7tTr7gZ5ER?=

=?Windows-1252?Q?z1kDHTNxK4XCfM6cD8ZsmbcfGYN0ga0F/fKsGBYAzDT/ZUId64mpZ3IY?=

=?Windows-1252?Q?jyqG8UwgCl9U9stqTDgR7HklSDQIoG4ELKnxOy2cbWVYXC86Pd49BUHz?=

=?Windows-1252?Q?yCQnvyEOfz3w0tkKtH8AWJQ7nKoIYR68Te/hr+AvKfncd81+t8H93h4i?=

=?Windows-1252?Q?uKtJyetaHnVJ3HjpebOM34FFCSSg9q7G8a0zd5/7dR2j1gOCiPp0ZUHf?=

=?Windows-1252?Q?dN7cx4BTe9KfQj+7CZ3KaBQPQcx0rWi8CK9riYzw83KEVxEI6LXIjNW0?=

=?Windows-1252?Q?GaO1ThCK3BuvuMSkYI0EkoPDaqERGFx4avABQzmF/hE8FvmWxwg31mjg?=

=?Windows-1252?Q?73dTP6QtuXIp+j62148L8qmZ7BARQF9yDIeaxKN41cGf9hXLx3smn9vC?=

=?Windows-1252?Q?0pvfsZNSMXFLaA=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_DM6PR04MB42182D0B870C9D2EEBBD1BFCBE909DM6PR04MB4218namp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DM6PR04MB4218.namprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 84c411a1-025d-4a95-1710-08da6c0a34ab

X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2022 17:47:11.5290

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA2PR04MB7482



--_000_DM6PR04MB42182D0B870C9D2EEBBD1BFCBE909DM6PR04MB4218namp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hello,

Hope everything is fine with you!

I I found your web contact email from Google. I would like to discuss a bus=

iness opportunity with you .

Would you like to be listed at the top of every major search engine such as=

Google, Yahoo! & Bing for multiple search phrases (keywords) relevant to y=

our products / services?

We are a team of professionals which includes 40+ full time SEO experts (Go=

ogle Certified). We are proud to inform you that our team handled 250+ SEO =

projects.

We will be glad to assist you with offering our services.

Contact us for the best quote for your website & we'll place your website o=

n 1st page Google ranking for targeted keywords.

PS: I will be happy to send the =93Proposal=94 and =93Pricing=94 further mo=

re.

Kinds Regards,

Amelia,





--_000_DM6PR04MB42182D0B870C9D2EEBBD1BFCBE909DM6PR04MB4218namp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">


-family:"Times New Roman", "serif"">


t;serif";mso-fareast-font-family:"Times New Roman"">Hello,
:p> 




-family:"Times New Roman", "serif"">


t;serif";mso-fareast-font-family:"Times New Roman"">Hope eve=

rything is fine with you! 




-family:"Times New Roman", "serif"">


t;serif";mso-fareast-font-family:"Times New Roman"">I
tyle=3D"color:black;border:none windowtext 1.0pt;mso-border-alt:none window=

text 0in;padding:0in">

I found your web contact email from Google. I would like to dis=

cuss a business opportunity with you . 




-family:"Times New Roman", "serif"">


t;serif";mso-fareast-font-family:"Times New Roman"">Would yo=

u like to be listed at the top of every major search engine such as Google,=

Yahoo! & Bing for multiple search phrases (keywords) relevant to

your products / services? 




-family:"Times New Roman", "serif"">


t;serif";mso-fareast-font-family:"Times New Roman"">We are a=

team of professionals which includes 40+ full time SEO experts (Google Cer=

tified). We are proud to inform you that our team handled 250+ SEO

projects. 




-family:"Times New Roman", "serif"">


t;serif";mso-fareast-font-family:"Times New Roman"">We will =

be glad to assist you with offering our services. 
p>


-family:"Times New Roman", "serif"">


t;serif";mso-fareast-font-family:"Times New Roman"">Contact =

us for the best quote for your website & we'll place your website on 1s=

t page Google ranking for targeted keywords. 




-family:"Times New Roman", "serif"">


t;serif";mso-fareast-font-family:"Times New Roman"">PS: I wi=

ll be happy to send the =93Proposal=94 and =93Pricing=94 further more.=

 




-family:"Times New Roman", "serif"">


quot;serif";mso-fareast-font-family:"Times New Roman"">Kinds=

Regards,
tica Neue","serif";mso-fareast-font-family:"Times New R=

oman""> 




-family:"Times New Roman", "serif"">


quot;serif";mso-fareast-font-family:"Times New Roman"">Ameli=

a
e","serif";mso-fareast-font-family:"Times New Roman&quo=

t;">, 














--_000_DM6PR04MB42182D0B870C9D2EEBBD1BFCBE909DM6PR04MB4218namp_--

Domain selling Spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 Jul 2022 09:32:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEucm-00024x-2m

for dave@doctor.nl2k.ab.ca;

Fri, 22 Jul 2022 09:31:32 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 Jul 2022 09:31:32 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yb1-f174.google.com ([209.85.219.174]:39509)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEuR7-000PM9-4o

for sales@nk.ca;

Fri, 22 Jul 2022 09:19:40 -0600

Received: by mail-yb1-f174.google.com with SMTP id r3so8556557ybr.6

for ; Fri, 22 Jul 2022 08:19:11 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:references:in-reply-to:from:date:message-id:subject:to;

bh=9re6nx+UDrAReT1802Mn2Z0D7espKw8h82tF/SkNI2c=;

b=oMS/rBR1BIDY/UYcbwmBn6lBsKhsgovO6POt+TEdFmG7OO+VZXmz/HIMxFBHeC/396

YgQasDrZpzx36XCxm7QoS00UTF3e0C94frT6eswvaCPY+EiZ2A8xw2iEZTZC4Ou/JUYq

+p+BtIj3S1aaUphgRllTxeFdNR2E4hqDDqNsWviAB4RJUsw/nPkw8klJBV0np2igT4vo

U6bq379K8aIMWxqXHH8LKFponRdOP2/a1jntzpVy1S6krUjcgfqR30CC9hfpPITxMi0W

5gmCd396rkS8elYOnE095M/D5Kab2/068HwXECtSC8GEK6jP1lLGLydHkQmseYw8w9Wq

X0fQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:references:in-reply-to:from:date

:message-id:subject:to;

bh=9re6nx+UDrAReT1802Mn2Z0D7espKw8h82tF/SkNI2c=;

b=TGQqT8JdRTv9M5flec7YVipWXY9ig830ie4dnyg4lJzGLqTHi9ewwEeqTeUPJfpb5z

Ng5MN+uy8wsdoyxordAClKm2bzerp36fS4cavefhKmKslxRrSOSVkHMRprtEIZGiCLFt

2R7t2C7S/lJLGWlWPetQiUhmi7O2jfJfQxYO2VgvamjVKJYyirNKVOReKM077J5pjzjw

GZbGHP8DUHgCX5DzLIwUKPrik/kubcaab83ZyZHwSVhBgSbvpn5Yy8QVhY7fz5t69/7f

I1snAOFdR9tvcgX8hnovxNP289AJW2+5EM7uXVfop7fSoUoj81aka49KvzoWpd+jI8UQ

RZpA==

X-Gm-Message-State: AJIora+g50RQA0dFWTrvVd6hO1pnlFNArrSe8O36bTlDscUtvHTQY5Pm

/gx7FXDgfceB9410DPlLxPhkRhYbp8nGKE/4nKemLwRaAeE=

X-Google-Smtp-Source: AGRyM1v14p+ShxAhKkJnVopNGyL0YdV7qSM1Jwvwtz2sGSg9lvGzeRP5P/Z4CbC5usHXtkJBtIO0lkqYjKgFkRHYFzE=

X-Received: by 2002:a25:4004:0:b0:670:9441:14b with SMTP id

n4-20020a254004000000b006709441014bmr455533yba.131.1658503145499; Fri, 22 Jul

2022 08:19:05 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Michael Davis

Date: Fri, 22 Jul 2022 16:18:36 +0100

Message-ID:

Subject: Re: Edmonton Broadband

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000d8ae7805e4665a45"



--000000000000d8ae7805e4665a45

Content-Type: text/plain; charset="UTF-8"



Happy weekend,



www.EdmontonBroadband.com is still available for sale.



We have now reduced the price of the domain to $300.



This is our final offer on the website domain.



If you are interested, visit www.EdmontonBroadband.com for immediate

acquisition. Price is now $300 only.



Regards,

Michael Davis.



On Mon, May 9, 2022, 6:49 PM Michael Davis wrote:



> Hello,

>

> EdmontonBroadband.com is listed for sale on Dan Domain Marketplace.

>

> The domain is often checked up on the internet in Edmonton. To capture

> more targeted customers for your business, redirect this massive domain to

> your primary website or build a new massive one on it.

>

> When you have 2 or more domains, it helps to throw a wider range and

> visibility than just 1.

>

> Go to www.EdmontonBroadband.com for immediate acquisition @ $499 only.

>

> Domain is also available @ GoDaddy.

>

> Best Regards,

> Michael Davis

> From Crown Domains.

>



--000000000000d8ae7805e4665a45

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Happy weekend,
<=

br>
www=

.EdmontonBroadband.com is still available for sale.=C2=A0

=3D"auto">
We have now reduced the price of the =

domain to $300.

This is =

our final offer on the website domain.=C2=A0


iv>
If you are interested, visit
ontonBroadband.com">www.EdmontonBroadband.com for immediate acquisition=

. Price is now $300 only.=C2=A0


=3D"auto">Regards,
Michael Davis.=C2=A0
<=

br>
On Mon,=

May 9, 2022, 6:49 PM Michael Davis <
ail.com">michaeldav2559@gmail.com> wrote:

=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=

ing-left:1ex">
=C2=A0Hello,


v dir=3D"auto">EdmontonBroadband.com is listed for sale on Dan Domain Marke=

tplace.=C2=A0

The domain=

is often checked up on the internet in Edmonton. To capture more targeted =

customers for your business, redirect this massive domain to your primary w=

ebsite or build a new massive one on it.=C2=A0

<=

/div>
When you have 2 or more domains, it helps to throw a=

wider range and visibility than just 1.=C2=A0

<=

/div>
Go to
arget=3D"_blank" rel=3D"noreferrer">www.EdmontonBroadband.com for immed=

iate acquisition @ $499 only.=C2=A0


ir=3D"auto">Domain is also available @ GoDaddy.=C2=A0

">
Best Regards,
Michael =

Davis
From Crown Domains.






--000000000000d8ae7805e4665a45--

Business investment spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 Jul 2022 09:31:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEubx-00021V-A4

for dave@doctor.nl2k.ab.ca;

Fri, 22 Jul 2022 09:30:41 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 Jul 2022 09:30:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-il1-f193.google.com ([209.85.166.193]:41659)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEtvr-000KNh-RD

for doctor@doctor.nl2k.ab.ca;

Fri, 22 Jul 2022 08:47:15 -0600

Received: by mail-il1-f193.google.com with SMTP id d4so2402143ilc.8

for ; Fri, 22 Jul 2022 07:46:50 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=3V7SvSbu0tGl9ojhG/fZRHDe8uteqtSYYE8V4qOvkOA=;

b=MFWm6olOBxjJ1kWSOc7b7OVb1YMxhpdGKZ2R0ddduFJZjGHTurZJhWdmLv2eBp+HJH

4lX3wRJoCm6HMP5KhSgEnWfl7moEp3fCmWsH910Iy+tfCL808U2/KZgO/kSrnlGvyFW+

TifyGnnasubYh0sKBaH6XHnH04N33TiyuzpeJHOSXuRKvrgq0IperEYMBXnuNNaQBsjH

CNCQUL3jdBvjnpvt2rMxCUZFSAbafEx4GyU53QfgOLe8xr/HboPHcsQPMyqR3UhMzRzy

tjGa0HWNulhpNZbJ+7PSABjpKX8a//KEkY6vhU9ct1P3JNL0fdUHFFRlhWTKXxuM0jOP

DmwQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=3V7SvSbu0tGl9ojhG/fZRHDe8uteqtSYYE8V4qOvkOA=;

b=hIvDfxgoJzUjp8SOYvW3p6OexBijHFPf87G/1izyMEm+trQ0YdrjBGAB/fLONEVEKM

dHwScmexnZaV07V9AQhKBlpTupr6g9VzQ3ZQEb9pJayzh89rLdxrhrGgBKG5xjN7xaom

unJ7xgy7LNl8Z9iLNtMFXYjPY/UatN8vDJ+P+UCRlot7jkr1ta1bolhC8VWq7J7HLM/n

eEbJ/D+eBg+KMpE7sjYKEotX/6PNVC2V2yQ1T4Vfa6+pNSOYm6g6+7Swg0wX36dMlNXR

JUf58+6dw7SiYT2NGRaB49UiCouNSdq93GZEwnL/AfZWXgOxnPDRHLQ3MKooh7/wtJ3X

2gEg==

X-Gm-Message-State: AJIora9pUY1wToGf7cndduErvS6X9aukMi8+ArrSWYZM1uTE5wO7cDTM

Itpd5Qr4fWhv78SvHDLQD/PqNOU7kBAV5jZPKAs=

X-Google-Smtp-Source: AGRyM1tHAvVDe0e3MJvX3atlujeyLjgjZvXjCJyph1S6UwGKfnUj1cIjk2bMSlvNG8Sm5aZSeFQlyLHE/IQr3bpjseA=

X-Received: by 2002:a92:ce81:0:b0:2dc:fbec:d023 with SMTP id

r1-20020a92ce81000000b002dcfbecd023mr121083ilo.155.1658501204575; Fri, 22 Jul

2022 07:46:44 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:6638:4901:0:0:0:0 with HTTP; Fri, 22 Jul 2022 07:46:43

-0700 (PDT)

Reply-To: saifemohammed100@gmail.com

From: Mr Saife Mohammed

Date: Fri, 22 Jul 2022 14:46:43 +0000

Message-ID:

Subject: Hello

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 15.5

X-Spam_score_int: 155

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello dear,, How are you today with your family, Hope all

is well?. Please, I would like you to give an urgent attention to this proposal.

I have a very lucrative business transaction which requires your utmost di

[...]



Content analysis details: (15.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.166.193 listed in wl.mailspike.net]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[saifemohammed100[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[mrezekieljeremiah22[at]gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[mrezekieljeremiah22[at]gmail.com]

2.6 HK_SCAM_N13 BODY: No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 HK_NAME_FM_MR_MRS No description available.

0.0 T_HK_NAME_FM_MR_MRS No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.1 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 T_MONEY_PERCENT X% of a lot of money for you

3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Hello



Hello dear,,



How are you today with your family, Hope all is well?. Please, I would

like you to give an urgent attention to this proposal.

I have a very lucrative business transaction which requires your

utmost discretion.

Though, I know it would come to you at uttermost surprise. I am Mr.

Saife Mohammed, A banker by profession.

Please, I want to transfer the sum of ($15.5M) dollars into your bank

account. This business is 100% risk free.

Your share will be 40% while 60% for me.



E-mail Address: (saifemohammed100@gmail.com)



Thanks for your anticipated co-operation.

Best regards.



Mr. Saife Mohammed,

T-Shirt promotional spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@nl2k.ab.ca

Delivery-date: Fri, 22 Jul 2022 07:11:00 -0600

Received: from mail-wm1-f66.google.com ([209.85.128.66]:43685)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEsQd-00098X-MH

for dave@nl2k.ab.ca;

Fri, 22 Jul 2022 07:10:58 -0600

Received: by mail-wm1-f66.google.com with SMTP id j29-20020a05600c1c1d00b003a2fdafdefbso2480195wms.2

for ; Fri, 22 Jul 2022 06:10:30 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=from:reply-to:mime-version:date:message-id:subject:to;

bh=dQ07XRaXlmNzsF+UmSAPcrnDbRWQ8pZB3Hx4pL4CHRs=;

b=CYm1VtmC+hLOLjWtJRSPTekTYjHWfX1YoSOl8UHejIGKHtje8PH53Ajc+OGjpzU6Qn

xuik6Uw6VPBn9q+HMy2acQWjdD8kI4MmFldUSA/B7OJQ4JH+S1d/++Iy0qVPSbwv4Zwc

ogrfQPu3atalhpzcxb5JpnjKoy0/H/Ozx3npyliaYvVuI7+SfU8LdGmKgX0Dg0jn5AOz

4De1XiIlbc9nCsE0EZf031FYc91Y2hWy2j30Lfe8DMgJo6x35UyJS78wBLP4eqZ+eC3S

XhQgzi/4SvqcRu/dIzY2M8voQ2lW/CIP+JjMlIUsCXrqhzTVEYuc/6EGxF1dgswLHYej

CoGA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:from:reply-to:mime-version:date:message-id

:subject:to;

bh=dQ07XRaXlmNzsF+UmSAPcrnDbRWQ8pZB3Hx4pL4CHRs=;

b=aSprR+IPLqJ3xTF4qLk4g6NPcAhiYnIg8R8MmB0GyO8GY73l2XW/5esvdngFisJzmx

UOJy+aeIrMSgo9AHuXENCgGAzuXoCnTkmEOuTvEK0+ZMGVrBqam52Yec0gjPXgyATKfD

SRUikuAcUS69NixcNZrdV1gTmuQLKbKOcaKhMRv6vZUKv8jZFTu5xSITorEwbHTHQm+J

XbQUDKRYtEoysQCeDpzL+aOCQb9uwr9AOVWnHT35oxjAG5Ecb5I+NHZ3G7wRXJU0uykU

VSPpvIjfuU4/2dvN8eV58BbNoQrHemx1jA2ohoCovniwKOBo5nMFZiSfamLrwC8N3kqW

rNWA==

X-Gm-Message-State: AJIora9wM2fY6NFB3a7u71cBYzhBc2Zh78n0BuCl/TbBo+R6cGpPPPO+

VWdOpadRwEMQnqlFUnAwlRkllkUg6mOnkWHyWQ==

X-Google-Smtp-Source: AGRyM1vF/RdBRwsKOgnnMOVhnCm3L/2K5rnRbWxOWUcuRKeqvjOSVFxYFFVVLl4XqY/GAsIlGA0EiN0fA4GLmCIf1EA=

X-Received: by 2002:a7b:ce01:0:b0:3a2:e106:f648 with SMTP id

m1-20020a7bce01000000b003a2e106f648mr12505147wmc.195.1658495423710; Fri, 22

Jul 2022 06:10:23 -0700 (PDT)

Received: from 241470334944 named unknown by gmailapi.google.com with

HTTPREST; Fri, 22 Jul 2022 09:10:23 -0400

From: Lucy at SpringTee

Reply-To: nancy@customshirts.com

MIME-Version: 1.0

Date: Fri, 22 Jul 2022 09:10:22 -0400

Message-ID:

Subject: (Important) Dave, Did you forget your Shirts?

To: dave@envirosearch.ca

Content-Type: multipart/alternative; boundary="000000000000978b3505e4648e3d"

Bcc: dave@nl2k.ab.ca

X-Spam_score: 10.2

X-Spam_score_int: 102

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Top Picks Gifts For Dave And Family [image: Top Picks Gifts

For Dave And Family] Put

Dave on the front of your shirts, or add names and numbers to the back of

your tees. [image: Funny Dave Facts NSD23 Unisex Short Sleeve Classic Tee]

BUY [...]



Content analysis details: (10.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: gossby.click]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URIs: tintucmedia.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL

blocklist

[URIs: tintucmedia.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.66 listed in wl.mailspike.net]

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: gossby.click (click)]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[zoanngoc[at]gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} (Important) Dave, Did you forget your Shirts?



--000000000000978b3505e4648e3d

Content-Type: text/plain; charset="UTF-8"



Top Picks Gifts For Dave And Family

[image: Top Picks Gifts For Dave And Family]





Put Dave on the front of your shirts, or add names and numbers to the back

of your tees.

[image: Funny Dave Facts NSD23 Unisex Short Sleeve Classic Tee]



BUY IT NOW



Take a look at the whole catalogue and get the custom name t-shirt you

want. We have a great variety so you can choose and wear the clothes you

want.

More designs you would love:

[image: Yes Dave Is Awesome NSD21 Unisex Short Sleeve Classic Tee]



SHOP NOW

[image: If Your Name Is Dave You're Pretty Damn Perfect NSD29 Unisex Short

Sleeve Classic Tee]

SHOP NOW

[image: If Dave Can't Fix It We Are All Screwed NSD10 Unisex Short Sleeve

Classic Tee]

SHOP NOW

[image: Nobody Is Perfect But If Your Name Is Dave You're Pretty Damn Close

NSD41 Unisex Short Sleeve Classic Tee]



SHOP NOW

You received this message because you've registered or accepted our

invitation to receive emails from us, or you've made a purchase from our

Store. If you no longer wish to receive these emails, click the link

below: Unsubscribe



NameCify Store - 5570 West 1730 South, Suite 900, Salt Lake City UT, 84104



--000000000000978b3505e4648e3d

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




itial-scale=3D1">
v=3D"Content-Type"> Top Picks Gifts For Dave And Family =


1.0 ">
bgcolor=3D"#f9f9f9" align=3D"center" width=3D"100%" border=3D"0" cellspaci=

ng=3D"0" cellpadding=3D"0" style=3D"border:1px solid #cccccc;padding-top:10=

px;max-width:700px"> =


=3D"0" align=3D"center"> =


y>

click/JnfSlyj1658123403360tibo" target=3D"_blank" rel=3D"noopener noreferre=

r"> 3D"Top
style=3D"padding-top:11px;padding-bottom:11px;padding-left:15px;padding-ri=

ght:15px;display:block; font-family:Arial, sans-serif; font-size:30px; line=

-height:34px; color:#000000; max-width:700px;" src=3D"https://trello.com/1/=

cards/61686050855c7970e99a4225/attachments/6168606591f4ac2b8b00fb92/preview=

s/6168606691f4ac2b8b00fba0/download/namecify.jpg" width=3D"200" border=3D"0=

">

ble-layout:fixed;padding-top:0px;padding-bottom:0px;padding-left:14px;paddi=

ng-right:14px">
g=3D"0" width=3D"100%" style=3D"table-layout:fixed;border-top-width:4px;bor=

der-top-style:solid;border-top-color:#444444"> =

=


le-layout:fixed">

pse:collapse;table-layout:fixed;color:#222;font-family:"New York"=

,Georgia;font-size:15px;line-height:1.4;letter-spacing:0;text-align:left;ma=

x-width:100%;word-wrap:break-word;padding-top:0px;padding-bottom:0px;paddin=

g-left:15px;padding-right:15px" valign=3D"top" align=3D"center"> =

=

=


rder-collapse:collapse;table-layout:fixed">


=3D"color:#222;display:block;font-family:"New York",Georgia;font-=

size:15px;font-style:normal;font-weight:normal;line-height:1.4;letter-spaci=

ng:0;text-align:left"> Put Dave on the front of your shirts, or add names a=

nd numbers to the back of your tees.


tr>
;padding:0;font-size:0;padding-top:0px;padding-bottom:0;padding-left:9px;pa=

dding-right:9px;text-align:center" valign=3D"top">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%"> <=

tbody> =


collapse;table-layout:fixed">
sby.click/mtXcBaK1658123422277" style=3D"word-wrap:break-word;max-width:100=

%;color:#15c;font-weight:normal;text-decoration:underline" target=3D"_blank=

" rel=3D"noopener noreferrer"> 3D"Funny=<br
Dave Facts NSD23 Unisex Short Sleeve Classic Tee" src=3D"https://img.cart-=

checkout.com/api/campaigns/CM_FWNDS90/mockup.png?p=3DFRONT&s=3Dhanes-52=

50&c=3DBlack&imageId=3DUnisexCrew_FRONT&u=3DFRONT%3DNilSOgOjbht=

YGz2sZyRPqg%253D%253D-0.0-0.0-1.0-1430321158%26BACK%3DNilSOgOjbhtYGz2sZyRPq=

g%253D%253D-0.0-0.0-1.0-1430321158&ms=3DS" style=3D"border:0;height:aut=

o;line-height:100%;outline:none;text-decoration:none;max-width:100%;padding=

-bottom:0;display:inline;vertical-align:top;font-size:12px;width:100%;max-w=

idth:650px;padding:0;border-width:0;" width=3D"546px" align=3D"middle"> =
=


family:"New York",Georgia;font-size:14px;line-height:1.3;letter-s=

pacing:0;text-align:left;max-width:100%;word-wrap:break-word;padding-top:20=

px;padding-bottom:0px;padding-left:18px;padding-right:18px" valign=3D"top">=


=3D"center" style=3D"border-collapse:separate;table-layout:fixed;border-top=

-left-radius:5px;border-top-right-radius:5px;border-bottom-right-radius:5px=

;border-bottom-left-radius:5px;background-color:#999;background-color:#35ae=

28;border-radius:3px;border-bottom-color:#28851e;border-bottom-width:2px;bo=

rder-bottom-style:solid;border-collapse:separate"> =

=


er-collapse:collapse;table-layout:fixed;color:white;font-family:"New Y=

ork",Georgia;font-size:16px;color:#ffffff;font-weight:normal;font-size=

:16px;font-family:"New York",Georgia" valign=3D"middle" align=3D"=

center">
123422277" style=3D"word-wrap:break-word;max-width:100%;font-weight:normal;=

line-height:100%;text-align:center;text-decoration:underline;color:#15c;fon=

t-family:"New York",Georgia;font-size:22px;text-decoration:none;d=

isplay:inline-block;padding-top:11px;padding-bottom:11px;padding-left:20px;=

padding-right:20px;color:#ffffff;font-weight:normal;font-size:16px;font-fam=

ily:"New York",Georgia" target=3D"_blank" rel=3D"noopener norefer=

rer"> BUY IT NOW =

se:collapse;table-layout:fixed;color:#222;font-family:"New York",=

Georgia;font-size:14px;line-height:1.3;letter-spacing:0;text-align:left;max=

-width:100%;word-wrap:break-word;padding-top:0px;padding-bottom:0px;padding=

-left:15px;padding-right:15px" valign=3D"top">
0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">
y> =


apse;table-layout:fixed;text-align:left">


=3D"color:#222;display:block;font-family:"New York",Georgia;font-=

size:15px;font-style:normal;font-weight:normal;line-height:1.4;letter-spaci=

ng:0;text-align:left"> Take a look at the whole =

catalogue and get the custom name t-shirt you want. We have a great variety=

so you can choose and wear the clothes you want.
p>


lign=3D"center" style=3D"border-collapse:collapse;table-layout:fixed;color:=

#222;font-family:"New York",Georgia;font-size:14px;line-height:1;=

letter-spacing:0;text-align:left;max-width:100%;word-wrap:break-word;paddin=

g-top:0px;padding-bottom:0px;padding-left:18px;padding-right:18px"> =

=

=


"color:#222;display:block;font-family:"New York",Georgia;font-siz=

e:16px;font-style:normal;font-weight:bold;line-height:1.1;letter-spacing:0;=

text-align:left;padding-top:0px;padding-bottom:20px;padding-left:1px;paddin=

g-right:1px" valign=3D"middle" align=3D"left"> More =

designs you would love:
=


lign=3D"center">
layout:fixed" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" border=3D"=

0"> =


=3D"border-collapse:collapse;table-layout:fixed" width=3D"50%" valign=3D"to=

p">
ayout:fixed;min-width:100%" width=3D"100%" cellspacing=3D"0" cellpadding=3D=

"0" border=3D"0"> =

=


pse;table-layout:fixed" valign=3D"top"> =


width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" border=3D"0" align=3D"l=

eft"> =

=

=


=3D"border-collapse:collapse;table-layout:fixed;padding:0;font-size:0;paddi=

ng-top:0px;padding-bottom:0;padding-left:9px;padding-right:9px;text-align:c=

enter" valign=3D"top">
ef=3D"https://gossby.click/pPMHeyv1658123417672" style=3D"word-wrap:break-w=

ord;max-width:100%;color:#15c;font-weight:normal;text-decoration:underline"=

target=3D"_blank" rel=3D"noopener noreferrer"> =

3D"Yes
Sleeve Classic Tee" src=3D"https://img.cart-checkout.com/api/campaigns/CM_F=

WS83PT/mockup.png?p=3DFRONT&s=3Dhanes-5250&c=3DBlack&imageId=3D=

UnisexCrew_FRONT&u=3DFRONT%3DF7DF%252BVierYReUY9ddqCCuA%253D%253D-0.0-0=

.0-1.0-1430321158%26BACK%3DF7DF%252BVierYReUY9ddqCCuA%253D%253D-0.0-0.0-1.0=

-1430321158&ms=3DS" style=3D"border:0;height:auto;line-height:100%;outl=

ine:none;text-decoration:none;max-width:100%;padding-bottom:0;display:inlin=

e;vertical-align:top;font-size:12px;width:100%;max-width:550px;padding:0;bo=

rder-width:0;" width=3D"100%" align=3D"middle"> =
=

ble style=3D"border-collapse:collapse;table-layout:fixed" width=3D"100%" ce=

llspacing=3D"0" cellpadding=3D"0" border=3D"0"> =

style=3D"border-collapse:collapse;table-layout:fixed" valign=3D"top"> =


e-layout:fixed" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" border=

=3D"0" align=3D"left"> =

=

=

=


font-family:"New York",Georgia;font-size:14px;line-height:1.3;let=

ter-spacing:0;text-align:left;max-width:100%;word-wrap:break-word;padding-t=

op:9px;padding-bottom:9px;padding-left:18px;padding-right:6px" valign=3D"to=

p">

>

ollapse:collapse;table-layout:fixed;width:100%!important" width=3D"100%" ce=

llspacing=3D"0" cellpadding=3D"0" border=3D"0"> =

=

=


style=3D"border-collapse:collapse;table-layout:fixed;min-width:60px;padding=

-left:10px;padding-right:10px" valign=3D"top" align=3D"center"> =


ut:fixed;border-top-left-radius:5px;border-top-right-radius:5px;border-bott=

om-right-radius:5px;border-bottom-left-radius:5px;background-color:#999;bac=

kground-color:#35ae28;border-radius:3px;border-bottom-color:#28851e;border-=

bottom-width:2px;border-bottom-style:solid;border-collapse:separate" width=

=3D"" cellspacing=3D"0" cellpadding=3D"0" border=3D"0"> =

=

=

=


> =


te;font-family:"New York",Georgia;font-size:16px;color:#ffffff;fo=

nt-weight:normal;font-size:16px;font-family:"New York",Georgia" v=

align=3D"middle" align=3D"center"> =


3417672" style=3D"word-wrap:break-word;max-width:100%;font-weight:normal;li=

ne-height:100%;text-align:center;text-decoration:underline;color:#15c;font-=

family:"New York",Georgia;font-size:22px;text-decoration:none;dis=

play:inline-block;padding-top:10px;padding-bottom:10px;padding-left:10px;pa=

dding-right:10px;color:#ffffff;font-weight:normal;font-size:16px;font-famil=

y:"New York",Georgia" target=3D"_blank" rel=3D"noopener noreferre=

r"> SHOP NOW =

 =
=
le-layout:fixed" width=3D"50%" valign=3D"top">
e style=3D"border-collapse:collapse;table-layout:fixed;min-width:100%" widt=

h=3D"100%" cellspacing=3D"0" cellpadding=3D"0" border=3D"0"> =

=3D"top">
e:collapse;table-layout:fixed;min-width:100%" width=3D"100%" cellspacing=3D=

"0" cellpadding=3D"0" border=3D"0" align=3D"left"> =

=

=

=


ble-layout:fixed;padding:0;font-size:0;padding-top:0px;padding-bottom:0;pad=

ding-left:9px;padding-right:9px;text-align:center" valign=3D"top"> =


aVt1658123404061" style=3D"word-wrap:break-word;max-width:100%;color:#15c;f=

ont-weight:normal;text-decoration:underline" target=3D"_blank" rel=3D"noope=

ner noreferrer">
t=3D"If Your Name Is Dave You're Pretty Damn Perfect NSD29 Unisex Short=

Sleeve Classic Tee" src=3D"https://img.cart-checkout.com/api/campaigns/CM_=

FW52KYP/mockup.png?p=3DFRONT&s=3Dhanes-5250&c=3DBlack&imageId=

=3DUnisexCrew_FRONT&u=3DFRONT%3DcBojLysXpP1ssRW79Jbxcw%253D%253D-0.0-0.=

0-1.0-1430321158%26BACK%3DcBojLysXpP1ssRW79Jbxcw%253D%253D-0.0-0.0-1.0-1430=

321158&ms=3DS" style=3D"border:0;height:auto;line-height:100%;outline:n=

one;text-decoration:none;max-width:100%;padding-bottom:0;display:inline;ver=

tical-align:top;font-size:12px;width:100%;max-width:550px;padding:0;border-=

width:0;" width=3D"144" align=3D"middle"> =
=

yle=3D"border-collapse:collapse;table-layout:fixed" width=3D"100%" cellspac=

ing=3D"0" cellpadding=3D"0" border=3D"0">
> =

=


=3D"border-collapse:collapse;table-layout:fixed" valign=3D"top"> =


out:fixed" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" border=3D"0" =

align=3D"left"> =

=

=

=


mily:"New York",Georgia;font-size:14px;line-height:1.3;letter-spa=

cing:0;text-align:left;max-width:100%;word-wrap:break-word;padding-top:9px;=

padding-bottom:9px;padding-left:18px;padding-right:6px" valign=3D"top"> =

:collapse;table-layout:fixed;width:100%!important" width=3D"100%" cellspaci=

ng=3D"0" cellpadding=3D"0" border=3D"0"> =

=

=


=3D"border-collapse:collapse;table-layout:fixed;min-width:60px;padding-top:=

0px;padding-right:10px;padding-left:10px;padding-bottom:0px" valign=3D"top"=

align=3D"center">
r-collapse:separate;table-layout:fixed;border-top-left-radius:5px;border-to=

p-right-radius:5px;border-bottom-right-radius:5px;border-bottom-left-radius=

:5px;background-color:#999;background-color:#35ae28;border-radius:3px;borde=

r-bottom-color:#28851e;border-bottom-width:2px;border-bottom-style:solid;bo=

rder-collapse:separate" width=3D"" cellspacing=3D"0" cellpadding=3D"0" bord=

er=3D"0"> =

=

=

=


;table-layout:fixed;color:white;font-family:"New York",Georgia;fo=

nt-size:16px;color:#ffffff;font-weight:normal;font-size:16px;font-family:&q=

uot;New York",Georgia" valign=3D"middle" align=3D"center"> =


://gossby.click/zoYJaVt1658123404061" style=3D"word-wrap:break-word;max-wid=

th:100%;font-weight:normal;line-height:100%;text-align:center;text-decorati=

on:underline;color:#15c;font-family:"New York",Georgia;font-size:=

22px;text-decoration:none;display:inline-block;padding-top:10px;padding-bot=

tom:10px;padding-left:10px;padding-right:10px;color:#ffffff;font-weight:nor=

mal;font-size:16px;font-family:"New York",Georgia" target=3D"_bla=

nk" rel=3D"noopener noreferrer"> =

SHOP NOW =
=

=

=

=


:5px;padding-bottom:5px" valign=3D"top" align=3D"center">
=


align=3D"top" align=3D"center">
collapse;table-layout:fixed" width=3D"100%" cellspacing=3D"0" cellpadding=

=3D"0" border=3D"0"> =

=


50%" valign=3D"top">
:collapse;table-layout:fixed;min-width:100%" width=3D"100%" cellspacing=3D"=

0" cellpadding=3D"0" border=3D"0"> =

=

<=

/table>

er-collapse:collapse;table-layout:fixed" valign=3D"top"> =


d;min-width:100%" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" border=

=3D"0" align=3D"left"> =

=


r> =


ont-size:0;padding-top:0px;padding-bottom:0;padding-left:9px;padding-right:=

9px;text-align:center" valign=3D"top"> =


ord-wrap:break-word;max-width:100%;color:#15c;font-weight:normal;text-decor=

ation:underline" target=3D"_blank" rel=3D"noopener noreferrer"> =

3D"If
t We Are All Screwed NSD10 Unisex Short Sleeve Classic Tee" src=3D"https://=

img.cart-checkout.com/api/campaigns/CM_FW104HK/mockup.png?p=3DFRONT&s=

=3Dhanes-5250&c=3DBlack&imageId=3DUnisexCrew_FRONT&u=3DFRONT%3D=

1dcfRBVQW7PurgytsI145Q%253D%253D-0.0-0.0-1.0-1430321158%26BACK%3D1dcfRBVQW7=

PurgytsI145Q%253D%253D-0.0-0.0-1.0-1430321158&ms=3DS" style=3D"border:0=

;height:auto;line-height:100%;outline:none;text-decoration:none;max-width:1=

00%;padding-bottom:0;display:inline;vertical-align:top;font-size:12px;width=

:100%;max-width:550px;padding:0;border-width:0;" width=3D"100%" align=3D"mi=

ddle"> =

le-layout:fixed" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" border=

=3D"0"> =

=


layout:fixed" valign=3D"top">
le=3D"border-collapse:collapse;table-layout:fixed" width=3D"100%" cellspaci=

ng=3D"0" cellpadding=3D"0" border=3D"0" align=3D"left"> =

=

=


se;table-layout:fixed;color:#222;font-family:"New York",Georgia;f=

ont-size:14px;line-height:1.3;letter-spacing:0;text-align:left;max-width:10=

0%;word-wrap:break-word;padding-top:9px;padding-bottom:9px;padding-left:18p=

x;padding-right:6px" valign=3D"top"> =
=
=


100%!important" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" border=

=3D"0"> =

=

=


layout:fixed;min-width:60px;padding-left:10px;padding-right:10px" valign=3D=

"top" align=3D"center">
border-collapse:separate;table-layout:fixed;border-top-left-radius:5px;bord=

er-top-right-radius:5px;border-bottom-right-radius:5px;border-bottom-left-r=

adius:5px;background-color:#999;background-color:#35ae28;border-radius:3px;=

border-bottom-color:#28851e;border-bottom-width:2px;border-bottom-style:sol=

id;border-collapse:separate" width=3D"" cellspacing=3D"0" cellpadding=3D"0"=

border=3D"0"> =

=

=

=


lapse;table-layout:fixed;color:white;font-family:"New York",Georg=

ia;font-size:16px;color:#ffffff;font-weight:normal;font-size:16px;font-fami=

ly:"New York",Georgia" valign=3D"middle" align=3D"center"> =


https://gossby.click/knCjpmb1658123414368" style=3D"word-wrap:break-word;ma=

x-width:100%;font-weight:normal;line-height:100%;text-align:center;text-dec=

oration:underline;color:#15c;font-family:"New York",Georgia;font-=

size:22px;text-decoration:none;display:inline-block;padding-top:10px;paddin=

g-bottom:10px;padding-left:10px;padding-right:10px;color:#ffffff;font-weigh=

t:normal;font-size:16px;font-family:"New York",Georgia" target=3D=

"_blank" rel=3D"noopener noreferrer"> =

SHOP NOW =

le=3D"border-collapse:collapse;table-layout:fixed" width=3D"50%" valign=3D"=

top">
-layout:fixed;min-width:100%" width=3D"100%" cellspacing=3D"0" cellpadding=

=3D"0" border=3D"0"> =

=


llapse;table-layout:fixed" valign=3D"top"> =


0%" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" border=3D"0" align=

=3D"left"> =

=

=


tyle=3D"border-collapse:collapse;table-layout:fixed;padding:0;font-size:0;p=

adding-top:0px;padding-bottom:0;padding-left:9px;padding-right:9px;text-ali=

gn:center" valign=3D"top"> <=

a href=3D"https://gossby.click/UCyeHHX1658123411169" style=3D"word-wrap:bre=

ak-word;max-width:100%;color:#15c;font-weight:normal;text-decoration:underl=

ine" target=3D"_blank" rel=3D"noopener noreferrer"> =

3D"Nobody
Is Dave You're Pretty Damn Close NSD41 Unisex Short Sleeve Classic Tee"=

src=3D"https://img.cart-checkout.com/api/campaigns/CM_FWHSE3D/mockup.png?p=

=3DFRONT&s=3Dhanes-5250&c=3DBlack&imageId=3DUnisexCrew_FRONT&am=

p;u=3DFRONT%3D%252FPZA0ZgHssDxpH0gx71f3Q%253D%253D-0.0-0.0-1.0-1430321158%2=

6BACK%3D%252FPZA0ZgHssDxpH0gx71f3Q%253D%253D-0.0-0.0-1.0-1430321158&ms=

=3DS" style=3D"border:0;height:auto;line-height:100%;outline:none;text-deco=

ration:none;max-width:100%;padding-bottom:0;display:inline;vertical-align:t=

op;font-size:12px;width:100%;max-width:550px;padding:0;border-width:0;" wid=

th=3D"144" align=3D"middle"> =

td>

-collapse:collapse;table-layout:fixed" width=3D"100%" cellspacing=3D"0" cel=

lpadding=3D"0" border=3D"0"> =

=


table>

lapse:collapse;table-layout:fixed" valign=3D"top"> =


th=3D"100%" cellspacing=3D"0" cellpadding=3D"0" border=3D"0" align=3D"left"=

> =


> =


order-collapse:collapse;table-layout:fixed;color:#222;font-family:"New=

York",Georgia;font-size:14px;line-height:1.3;letter-spacing:0;text-al=

ign:left;max-width:100%;word-wrap:break-word;padding-top:9px;padding-bottom=

:9px;padding-left:18px;padding-right:6px" valign=3D"top"> =

e-layout:fixed;width:100%!important" width=3D"100%" cellspacing=3D"0" cellp=

adding=3D"0" border=3D"0"> =

=


e> =


pse:collapse;table-layout:fixed;min-width:60px;padding-top:0px;padding-righ=

t:10px;padding-left:10px;padding-bottom:0px" valign=3D"top" align=3D"center=

">
ate;table-layout:fixed;border-top-left-radius:5px;border-top-right-radius:5=

px;border-bottom-right-radius:5px;border-bottom-left-radius:5px;background-=

color:#999;background-color:#35ae28;border-radius:3px;border-bottom-color:#=

28851e;border-bottom-width:2px;border-bottom-style:solid;border-collapse:se=

parate" width=3D"" cellspacing=3D"0" cellpadding=3D"0" border=3D"0"> =

=

=

=

=


xed;color:white;font-family:"New York",Georgia;font-size:16px;col=

or:#ffffff;font-weight:normal;font-size:16px;font-family:"New York&quo=

t;,Georgia" valign=3D"middle" align=3D"center"> =


UCyeHHX1658123411169" style=3D"word-wrap:break-word;max-width:100%;font-wei=

ght:normal;line-height:100%;text-align:center;text-decoration:underline;col=

or:#15c;font-family:"New York",Georgia;font-size:22px;text-decora=

tion:none;display:inline-block;padding-top:10px;padding-bottom:10px;padding=

-left:10px;padding-right:10px;color:#ffffff;font-weight:normal;font-size:16=

px;font-family:"New York",Georgia" target=3D"_blank" rel=3D"noope=

ner noreferrer"> SHOP NO=

W =

le>

=3D"border-collapse:collapse;table-layout:fixed;padding-top:5px;padding-bot=

tom:5px" valign=3D"top" align=3D"center">

=3D"#efefef">
se;table-layout:fixed" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" b=

order=3D"0" align=3D"center"> =

=


able>

valign=3D"top" align=3D"center">
der-collapse:collapse;table-layout:fixed" width=3D"100%" cellspacing=3D"0" =

cellpadding=3D"0" border=3D"0" align=3D"center"> =


>

=3D"0" border=3D"0" align=3D"center"> =

=

=


eft:15px;padding-right:15px;font-size:12px" valign=3D"middle" align=3D"cent=

er"> You received this message because you've registered or accepted ou=

r invitation to receive emails from us, or you've made a purchase from =

our Store. If you no longer wish to receive these emails, click the link be=

low:
blank" rel=3D"noopener noreferrer" style=3D"color:#b7b7b7"> Unsubscribe
>
=
=


lign=3D"center"> =

=

=


e> =


:15px;padding-bottom:20px; font-size: 12px; tex" valign=3D"middle" align=3D=

"center"> NameCify Store - 5570 West 1730 South, Suite 900, Salt Lake City =

UT, 84104
=

e/62d562826d37a04ffd31c90f" class=3D"CToWUd" height=3D"0" width=3D"1">
y>



--000000000000978b3505e4648e3d--

Well Fargo UN Phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 Jul 2022 08:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEtPB-000Pq1-Sy

for dave@doctor.nl2k.ab.ca;

Fri, 22 Jul 2022 08:13:25 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 Jul 2022 08:13:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oi1-f194.google.com ([209.85.167.194]:33521)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEpLW-000KrW-BB

for root@doctor.nl2k.ab.ca;

Fri, 22 Jul 2022 03:53:27 -0600

Received: by mail-oi1-f194.google.com with SMTP id s188so5125205oie.0

for ; Fri, 22 Jul 2022 02:53:01 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to

:content-transfer-encoding;

bh=Lievo06A9L+P0KlnGB9eb2eUU/0FWAP3zf3ejZPmgDM=;

b=fUhC7CbYL+3rHJAo+sTABh3stUPOq2/CiTIRLJcZIGnThDHHfUQNAbPGbqDtsmaLw0

Zz+//3TithQzAinnB5sVN1RKTRjL48gXeRdPE+vT399LOzqY7n3SvdhOcwMGZlsI2PeK

dqrSgHGKwvpA0qP6j/QoXv57a9We67JMYb2O5p39OtMH9ZICwmE6Y0sjpq0FxcTqaV+k

sbBOG0D+ye4w4bCdvT/YaFKf3vmfaE+ukSL9b8oALMEQa9KlpsNcJyyOLFNCXPID3D1S

YSmsuj+QJB8t5YLZpXf83pCgVCr69KaxcaXoZh1TrpMlyHu/vUR04SsPGTbqhh0WyQRO

X21Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to:content-transfer-encoding;

bh=Lievo06A9L+P0KlnGB9eb2eUU/0FWAP3zf3ejZPmgDM=;

b=hB6M+HLmu8tHKzdQHnEjF+c9MH/rM7N+w6wdsuf2yx8m4rFzGCP9u5rewX4q/i76eX

duDDrdrAYU/9YDbNzEItuoF3KXJOwTEIcRIi3L9iWu1s7MDXtPBgl28zLQe3X2LKPpof

zlu5MhHzRg0cUqVfLcf6B042gbVnLJXSnIHhICj+fnelZi8e9vX4gi89w/RqE5/yEOlb

rzSKXPGNUi2QwhkiQuwzTK/4sQDOrImJq16t1iZOh41fHuIP1eN94MxWN42r78AXGgEU

ODjoRtAMS5JcVQ7Z5gyGqbXEI7vrLVE9VUjGy4GR3mmisb34XKgnZtFWbF4Ht5aqhRcJ

mUeQ==

X-Gm-Message-State: AJIora+b1/eQnvQ3z7/1aZ5nojiy1dl/27IBL3Rr0Ga0JzjpHIQ1GoLO

u/3oOeGMsgmRBmgAO02C7K6rNsSlZCr1IPxgIow=

X-Google-Smtp-Source: AGRyM1uxd+TK2PxOgiI12M4FGCXQoExssPE/kv/lsBhan/5VOkG1W7JJt9lj/OGfEyoez8CcwJWDrd+U/J+Dde7nc5M=

X-Received: by 2002:aca:eb45:0:b0:33a:6c4a:3224 with SMTP id

j66-20020acaeb45000000b0033a6c4a3224mr6737273oih.272.1658483575042; Fri, 22

Jul 2022 02:52:55 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:6358:9103:b0:af:d05f:987e with HTTP; Fri, 22 Jul 2022

02:52:54 -0700 (PDT)

Reply-To: fargobank@yahoo.com

From: Wells Fargo Bank

Date: Fri, 22 Jul 2022 02:52:54 -0700

Message-ID:

Subject: Wells Fargo Notify You

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Bcc: root@doctor.nl2k.ab.ca

X-Spam_score: 24.4

X-Spam_score_int: 244

X-Spam_bar: ++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Congratulations!! Your payment has been approved and endorsed

by the United Nation Organization authorities, Your details information has

been confirmed with the instruction and approvals given from International

Monetary Fund and Federal Bureau Investigation (FBI, Washington DC, USA regards

the deposited of [...]



Content analysis details: (24.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.194 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[unionw366[at]gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[unionw366[at]gmail.com]

1.1 HK_SCAM_N3 BODY: No description available.

2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in

phishing mails

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as

"accounts suspended", "account credited",

"account verification"

2.0 HK_SCAM No description available.

2.9 YOU_INHERIT Discussing your inheritance

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.1 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal

information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Wells Fargo Notify You



Congratulations!!



Your payment has been approved and endorsed by the United Nation

Organization authorities,



Your details information has been confirmed with the instruction and

approvals given from International Monetary Fund and Federal Bureau

Investigation (FBI, Washington DC, USA regards the deposited of fund

from IMF, sum US$10,700,000.00. as full payment of your inheritance

fund.



Due to the incessant scam activities going around the globe, Federal

Bureau Investigation (FBI) and Homeland Security Director, MG Timothy

J. Weinberg, Adjutant General and Director State Military Department

,Washington Military Dept., Bldg 1 Camp Murray, WA 98430-5000 has

instructed our Financial Institution to use high Performance in

Banking System set up Barclay=E2=80=99s Personal On-line Banking Account.



The sum of US$10,700,000.00 was was deposited in our bank and we have

been instructed to pay your directly via personal on-line bank



The Management has resolved to open Personal On-line Banking Account

for you with our bank and then give you the on-line access which will

enable you to check and make electronics wire transfer out to any part

of the world of your choice.



We are going to have this account open on your name as soon as you

reply to this important e-mail and give you your new open account

information=E2=80=99s for your record.



Once we show you prove of fund by giving you the new Personal On-line

Account and your real account balance of US$10,700,000.00 which is

your Part payment of the full amount credited to you



We are only given you the benefit of doubt by agreeing in showing you

that we are capable of opening the new account on your behalf and give

you the full on line access for your record.



Let me know that you agree and understand the important of this matter

before we go ahead and get this matter completed for you because we

are professional in handling international matters like this.



Kindly Send the Above information to enable us set the account open for you=

.



Full Name:

Full Address:

Direct Telephone Number:





Please, reconfirm your direct cell phone number to enable voice communicati=

on

Looking forward for your next letter

Thank you for your patient.

Regards



Mr Steven Sharma





PLEASE SEND YOUR NAME AS IT IS CLEARLY WRITTEN IN YOUR PASSPORT AND ID

CARDS SO THAT WE WILL NOT MAKE MISTAKE IN OPENING OF THE NON

RESIDENTIAL BANK ACCOUNT UNDER YOUR NAME

UN Charity Donation Spam

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 Jul 2022 15:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oF0E6-0006o8-4e

for dave@doctor.nl2k.ab.ca;

Fri, 22 Jul 2022 15:30:26 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 Jul 2022 15:30:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-cy1gcc01bn2020.outbound.protection.outlook.com ([52.100.19.20]:36841 helo=EUR04-VI1-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

id 1oExr1-000ImA-RU

for sales@nk.ca;

Fri, 22 Jul 2022 12:58:32 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=Mo9RbyFAEwMDIA27hZfvWtkQ5vrYyWB7SDw4LjOMhj1frVcVanzqqS6cCmJDdFozWVP6PlGV/9mpML+Q7+PzPLKOki8VmcTZuf6Wna7wMctRF4H/u11XUE0XDQEfwNDA38emfDOS3pyG0T5EhVw4pDUW+zeTzW4+hPZ0/HGZJ4oxC9kpD6NTHzNcEwq0ieZJfPn1qYkO3G1V7srBXnW3YGeQ5ENUid3HDM3+5/Dm0pQZeG6MURNtPvQrQ6zxVKCYAV0j2Qe8ZAxvj0UsTgfodfu9rKFxGyfh8SPhsOVrGnfD5n0HpuQbXUJvFujZmop/z+DkKvCZLjk55CRePtO5EA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=psglYXmtwCzWN28DaqpH5gqqB1TacLupP6Yx1K3dEj4=;

b=PdSmanAetRdzXxAds2fLZYfu1PNynQgLvhwuPDl6SIZNeUPTPlHG2OacC1snPZvyDhTUqIfP6MAuyn93OPyganDfVuo9vnNk7jkMPgf6ZNLLAkQSDMvsVvi9Q6SAt3YFyl79jw+wkMe68j3zK/OJpwFxW+mGDk4UXn8J6diUtoLp9fW3WITMAoFP7/LlFUc9FdFHkFSnGtWP8Y2jf9Zjay/wkeyeyxTmBpAQ0s9StDchXjkscKkb2JDpKhPQUDtIloxXGvbSiNpYkW5k7Me5//GUijeZ+7w9Ev9Srm8oMHgDGmuqRNWicEYOM+XFDA/gjEdNS6g4MiBEXtC3T4XXqA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

193.183.126.23) smtp.rcpttodomain=nk.ca smtp.helo=smtp.husqvarnagroup.com;

dmarc=none; dkim=none (message not signed); arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=Husqvarnagroup.onmicrosoft.com; s=selector1-Husqvarnagroup-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=psglYXmtwCzWN28DaqpH5gqqB1TacLupP6Yx1K3dEj4=;

b=Lqqww7jFl33b3RmC1BlVcGZMj8M4/Swv/t7KY0e5ybkYf9Y9V06XH7Dt/hbiAiR55AbnZEH7SlDAFsEKYUMD1/iMEuPpVki/Txh0rVTg1TEbXV+Vqt042EhR1CE7gUD7bVc3NgnYb0eZdXOquE31D20WCJU9lswBQSgop1kXpnU=

Received: from AM6P193CA0100.EURP193.PROD.OUTLOOK.COM (2603:10a6:209:88::41)

by AM0PR0402MB3346.eurprd04.prod.outlook.com (2603:10a6:208:23::15) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5438.23; Fri, 22 Jul

2022 18:57:48 +0000

Received: from AM5EUR02FT032.eop-EUR02.prod.protection.outlook.com

(2603:10a6:209:88:cafe::a3) by AM6P193CA0100.outlook.office365.com

(2603:10a6:209:88::41) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5458.18 via Frontend

Transport; Fri, 22 Jul 2022 18:57:48 +0000

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 193.183.126.23)

smtp.helo=smtp.husqvarnagroup.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=;

Received-SPF: None (protection.outlook.com: smtp.husqvarnagroup.com does not

designate permitted sender hosts)

Received: from smtp.husqvarnagroup.com (193.183.126.23) by

AM5EUR02FT032.mail.protection.outlook.com (10.152.8.109) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id

15.20.5458.17 via Frontend Transport; Fri, 22 Jul 2022 18:57:47 +0000

Received: from AS400TGT.CP.ELECTROLUX-NA.COM ([10.80.249.221]) by smtp.husqvarnagroup.com with Microsoft SMTPSVC(8.5.9600.16384);

Fri, 22 Jul 2022 20:58:01 +0200

Received: from [192.168.43.247](::ffff:129.205.124.216[129.205.124.216])

by AS400TGT.CP.ELECTROLUX-NA.COM (IBM i SMTP 7.3.0) with TCP;

Fri, 22 Jul 2022 04:26:23 -0500

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: YOU HAVE A DONATION

To: Recipients <>

From: "UNITED WORLD CHARITY ORGANIZATIONS" <>

Date: Fri, 22 Jul 2022 17:24:26 +0800

Reply-To: unitednationsworldcharityorgan@gmail.com

Message-ID:

X-OriginalArrivalTime: 22 Jul 2022 18:58:01.0399 (UTC) FILETIME=[F7506470:01D89DFC]

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-Office365-Filtering-Correlation-Id: a51c2dd3-2dce-4072-11bc-08da6c1411a8

X-MS-TrafficTypeDiagnostic: AM0PR0402MB3346:EE_

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?iso-8859-1?Q?CTpji4Hos4GPO36y8TfCCPNziW6eJuez4l9BQdy4+1ONJKlqU4BQ/J+tAJ?=

=?iso-8859-1?Q?R3tSaRfaoCNEtEh0yR2gV9LGEg5qvHMWiI74YOPMECGnwN7rsDJQAf5yqB?=

=?iso-8859-1?Q?TyjylTLQ7kx2/gUPpOQe/3oWU7xzn5iLKdd7S0zVa08M6AX//pklfxnDCV?=

=?iso-8859-1?Q?xmcyOokuj7hwSvfGM4hK6wVVtQ6sLu25BOrBdhi8LPrg+T+u0JBGnM90XE?=

=?iso-8859-1?Q?f+jhE3II0P+X9LCBmAqTZVrGa76P59rr8RrCMh/yZAOIRayLwi0u1Q+sYU?=

=?iso-8859-1?Q?du4/L61xWDWBlyQHiaByxdaE3UGNbtxn6aOXj66lGjRHSQrgDLjOt8DTS8?=

=?iso-8859-1?Q?SQr/G7wEOd3+C3uIy1yxQ2h3v2PwLm/iSW9h6fppn4qXL9hB7Lqa1gDiuR?=

=?iso-8859-1?Q?cTmo6MOzqen6sSKn6iB7PqCkWzI8rwR/t3z5e5IMyX6OAjRyy98JA9Hbxn?=

=?iso-8859-1?Q?Dl31QIEcNUnnJ8joWilFpoavbiN3ZHubnNwGYDJm1kmd8DGwIqX15vDX9w?=

=?iso-8859-1?Q?cGSQRsnCY3PqikFyw7MZCFMEg5OnifKFvEii8JauLzTkBwVtKzzsPsq4nQ?=

=?iso-8859-1?Q?RV+6jiX4cvqQnk6UHgjYY67ojOTgJgAkpRN3bZQkEBcLPpalM0scwmu8P4?=

=?iso-8859-1?Q?vgXsKuhmkE6IRU7VZFVXx0hZFzdmfONjRwnUNjZt0E/7iaruZXE7IvpnJq?=

=?iso-8859-1?Q?8Q0mhdfPlrLt6VO+PChPIn5GuQQGt4Hb+KI0o0VA2qisvHf2QGx5/OtpAD?=

=?iso-8859-1?Q?rWvJc5NShuYBYkBUtXj+7wwn69A7HsHjtSNb7a//Lnj1fMayWqKLTlwhrK?=

=?iso-8859-1?Q?I+HFEKcaITIBwP8lCVKY+Qr8RzHJgs2T9y4ITMDpWO+o6KLq0zuKVRiHrN?=

=?iso-8859-1?Q?ntpPozGrv5Clgv+H5UVk/bE5zSstmR18RezjMdlgjUtoVjf4AkgKA8pHrz?=

=?iso-8859-1?Q?tKOMPILSEw1eF4tNNOf5y7i+FnTNdVfzHIOSFH3OpTA43gTajREC/kh+Y7?=

=?iso-8859-1?Q?UuuSSosUMfDHY9UnBbKO8smOVJpT0eWZd1eh5aqYbplmp+Gom0HYPm9J01?=

=?iso-8859-1?Q?ZL2Rpbl6Nc/ezeGmyJa3mMKVuHa/am/zLv8nL9BE9DVikjFYi8sQSqPJ01?=

=?iso-8859-1?Q?WTpgmf39borot/rNn1zVH/pzU7wJwvjCX0r6ZdHYTqNAEU1jhzvtqIBbk0?=

=?iso-8859-1?Q?XS99etK+cwvD9g=3D=3D?=

X-Forefront-Antispam-Report:

CIP:193.183.126.23;CTRY:SE;LANG:en;SCL:6;SRV:;IPV:NLI;SFV:SPM;H:smtp.husqvarnagroup.com;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230016)(4636009)(39860400002)(376002)(136003)(346002)(396003)(5005620100009)(40470700004)(46966006)(5660300002)(26005)(4743002)(508600001)(4744005)(356005)(41300700001)(8936002)(86362001)(2860700004)(316002)(40460700003)(109986005)(83380400001)(47076005)(956004)(336012)(81166007)(3480700007)(42882007)(40480700001)(35950700001)(70206006)(8676002)(70586007)(78352004)(2906002)(82310400005)(82740400003)(1557600019);DIR:OUT;SFP:1501;

X-OriginatorOrg: Husqvarnagroup.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2022 18:57:47.6469

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: a51c2dd3-2dce-4072-11bc-08da6c1411a8

X-MS-Exchange-CrossTenant-Id: 2a1c169e-715a-412b-b526-05da3f8412fa

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=2a1c169e-715a-412b-b526-05da3f8412fa;Ip=[193.183.126.23];Helo=[smtp.husqvarnagroup.com]

X-MS-Exchange-CrossTenant-AuthSource:

AM5EUR02FT032.eop-EUR02.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR0402MB3346

X-Spam_score: 11.4

X-Spam_score_int: 114

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: YOU HAVE A DONATION OF 2,000,000.00 GBP OF COVID19 SUPPORT

FROM UNITED WORLD CHARITY ORGANIZATIONS, FOR CHARITABLE WORK IN YOUR COUNTRY,

TO RECEIVE YOUR DONATION AMOUNT KINDLY SEND YOUR FULL DETAILS T [...]



Content analysis details: (11.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.2 TO_MALFORMED To: has a malformed address

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

2.6 FROM_NO_USER From: has no local-part before @ sign

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 FORGED_SPF_HELO No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

Subject: {SPAM?} YOU HAVE A DONATION



YOU HAVE A DONATION OF 2,000,000.00 GBP OF COVID19 SUPPORT FROM UNITED WORL=

D CHARITY ORGANIZATIONS, FOR CHARITABLE WORK IN YOUR COUNTRY, TO RECEIVE Y=

OUR DONATION AMOUNT KINDLY SEND YOUR FULL DETAILS TO VIA unitednationsworld=

charityorgan@gmail.com





The information in this email may be confidential and/or legally privileged=

. It has been sent for the sole use of the intended recipient(s). If you ar=

e not an intended recipient, you are strictly prohibited from reading, disc=

losing, distributing, copying or using this email or any of its contents, i=

n any way whatsoever. If you have received this email in error, please cont=

act the sender by reply email and destroy all copies of the original messag=

e. Please also be advised that emails are not a secure form for communicati=

on, and may contain errors.

Nigerian Gmail spam

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 Jul 2022 08:13:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEtOR-000PKd-Kx

for dave@doctor.nl2k.ab.ca;

Fri, 22 Jul 2022 08:12:39 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 Jul 2022 08:12:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f51.google.com ([209.85.167.51]:38713)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEnsn-000Cpw-AJ

for root@doctor.nl2k.ab.ca;

Fri, 22 Jul 2022 02:19:45 -0600

Received: by mail-lf1-f51.google.com with SMTP id p11so1642333lfu.5

for ; Fri, 22 Jul 2022 01:19:19 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:reply-to:from:date:message-id:subject:to;

bh=jFJoWAWm1uAAeYCNk3QZInkIxf7MCWMHdiE0z0rY95I=;

b=N/egeJ8HzGu5qD7b1f8DJ1ZBls/znxr75id8mnL7aM+5wXvD6nufZKGMr47So0DOtO

Z4EHJwhTbV8AdR+FJlzqmogbyY+kpLnj8eGi+2QQ6tzJ34mLnHTBCHb0aQRU5Nf01Nhu

+DS7qikpdwIFb5Enhkn6It9J4R6wmDG+Gc4f7YlLaQoDFWlLSelS13KBN//rIjnXPVUS

1dunuLB1ZkY1lyAGdkPtdzKKGdj7f8pTpccCcadOd+51LcHnl380p05B0WqkUWCz/ess

QiPvlg8tKzlorGiKWCma7u0MNOgUnieMjklqiDMM2LzZgeRW1w0NldpljZWSGKgcABdH

njDw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:reply-to:from:date:message-id

:subject:to;

bh=jFJoWAWm1uAAeYCNk3QZInkIxf7MCWMHdiE0z0rY95I=;

b=Oa9qw6c/5QGh+kgpgiSZqNrfstp+tiP7I2Uviz7Qjerrs7jN9QjBH8ohwdQo19n8bX

ABXEBapahK9x9FT/3mEMA42M872+mLEGbkqGF5gqcXJAwLN3dYxGa+ij74emAegPtcvt

lEvv8grMBlqvSI8gpWagy+Dw9vcWzgSgdDHLdO4HkP9ooqf0lHJV5f2oulpjPYINdfnK

U4L68wY+aWdg3jfhkoXJK6xU5ts/QfiudvVYslhCgt/cIEGVCtP6mQdbJEMRJkwvldo1

b3ztvU5D4DyWFOYV/aZHlDNxWd3UKJXHHrjab/RVhQpFapaxzwpo2Zs5PLeAylXAa4uy

2VSA==

X-Gm-Message-State: AJIora/TW1RSdQG1lY55M1Off/ijuLB4XccPRKOuiviIdONaDdO/mzn+

1R1L8dEKXUvYh3NtTuDAzqDClMRI4yYkWqIWgTM=

X-Google-Smtp-Source: AGRyM1tL/jLRsREvpFjG++xpPnefcO2k1fFj8+AWYT7QzPaBkvyl+SByUKqd9JssN6eeZG4ZzQtHyGkv/2NTv0aDxHI=

X-Received: by 2002:ac2:4e03:0:b0:485:74c4:97ce with SMTP id

e3-20020ac24e03000000b0048574c497cemr849335lfr.13.1658477952474; Fri, 22 Jul

2022 01:19:12 -0700 (PDT)

MIME-Version: 1.0

Reply-To: unitedata@yandex.com

From: DR YURI AKOTA

Date: Fri, 22 Jul 2022 09:19:03 +0100

Message-ID:

Subject: RE: INHERITANCE FUND

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000039b97b05e4607df4"

Bcc: root@doctor.nl2k.ab.ca

X-Spam_score: 29.8

X-Spam_score_int: 298

X-Spam_bar: +++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: CENTRAL BANK OF NIGERIA PHASE II, GARKIFEDERAL CAPITAL TERRITORY

ABUJA-NIGERIA REF: CBN-0XX2/987 TEL: +23409168493316 EMAIL: cbnauditor@yandex.com

ATTN: BENEFICIARY RE: INHERITANCE FUND TRANSFER NOTIFICATION



Content analysis details: (29.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.51 listed in wl.mailspike.net]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[rt.rev.dr.jdonal.esq[at]gmail.com]

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

3.6 NA_DOLLARS BODY: Talks about a million North American dollars

0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

0.0 HTML_MESSAGE BODY: HTML included in message

1.2 UPPERCASE_75_100 message body is 75-100% uppercase

2.9 YOU_INHERIT Discussing your inheritance

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_HK_NAME_FM_DR No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.1 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

1.5 MONEY_ATM_CARD Lots of money on an ATM card

0.0 FILL_THIS_FORM Fill in a form with personal information

2.0 FILL_THIS_FORM_LONG Fill in a form with personal information

2.2 FILL_THIS_FORM_LOAN Answer loan question(s)

0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)

0.0 MONEY_FORM Lots of money if you fill out a form

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

1.8 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of

money

3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} RE: INHERITANCE FUND



--00000000000039b97b05e4607df4

Content-Type: text/plain; charset="UTF-8"



CENTRAL BANK OF NIGERIA

PHASE II, GARKIFEDERAL CAPITAL TERRITORY

ABUJA-NIGERIA

REF: CBN-0XX2/987

TEL: +23409168493316

EMAIL: cbnauditor@yandex.com





ATTN: BENEFICIARY



RE: INHERITANCE FUND TRANSFER NOTIFICATION



THIS IS TO NOTIFY YOU THAT YOUR FUND WHICH IS THE TOTAL SUM OF TEN MILLION

FIVE HUNDRED THOUSAND DOLLARS (US$10, 500,000.00), AS YOUR

CONTRACT/INHERITANCE FUND HAVE BEEN PROGRAMMED FOR IMMEDIATE PAYMENT TO

YOU. AND YOUR INHERITANCE FUND PAYMENT HAS BEEN FINALIZED TO BE RELEASED TO

YOU AS THE LEGITIMATE BENEFICIARY OF THE FUND, VIA HSBC ATM DEBIT CARD.



MEANWHILE, WE WANT YOU TO CLARIFY IF YOU INDEED APPROVE A WOMAN FEW DAYS

AGO TO CLAIM YOUR FUND ON YOUR BEHALF, WHO NOW CLAIM THAT SHE IS YOUR

REPRESENTATIVE SENT BY YOU TO RECEIVE YOUR FUND.



THE REQUIRED INFORMATION IS AS STATED BELOW:



1. YOUR NAME:

2. YOUR ADDRESS:

3. YOUR TELEPHONE:

4. FAX:

5. AGE:

6. SEX:

7. YOUR OCCUPATION:



NOTE THAT THIS ATM CARD WILL BE SENT TO YOU THROUGH THE COURIER SUCH AS

FEDEX, UPS OR ANY COURIER COMPANY OF YOUR CHOICE FOR THE DELIVERY OF YOUR

ATM CARD TO YOU FOR YOUR EASY CASHING OF YOUR CONTRACT SUM OF US$10,

500,000.00. FROM THE OFFICE OF THE PRESIDENCY, THIS REPUTABLE BANK HAS BEEN

APPROVED IN CONJUNCTION WITH THE HSBC BANK LONDON,THEY HAS BEEN ACCREDITED

TO HANDLE AND MAKE PAYMENT TO ALL FOREIGN CONTRACT/INHERITANCE FUNDS

BENEFICIARIES THIS SECOND QUARTER PAYMENT OF THE YEAR 2022 THEREFORE, WE

WAIT TO HEAR FROM YOU SOON.



WE ARE WAITING TO HERE FROM YOU AS SOON AS POSSIBLE.



YOURS REGARDS,



DR YURI AKOTA

DIRECTOR OF FOREIGN OPERATIONS DEPARTMENT

CENTRAL BANK OF NIGERIA (CBN)

TEL: +23409168493316



--00000000000039b97b05e4607df4

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =

=C2=A0CENTRAL BANK OF NIGERIA
=C2=A0 =C2=A0 =C2=A0 =C2=A0 PHASE II, GARK=

IFEDERAL CAPITAL TERRITORY
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=

=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ABUJA-NIGERIA
=C2=A0 =C2=A0 =C2=A0 =C2=

=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0REF: CBN-0XX2/987
=C2=A0 =

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0TEL: =C2=A0+23409168=

493316
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0EMAIL: =C2=

=A0cbnauditor@yandex.com =C2=

=A0 =C2=A0
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=

=A0 =C2=A0 =C2=A0 =C2=A0
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=

=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =

=C2=A0 =C2=A0 =C2=A0 =C2=A0
ATTN: BENEFICIARY
=C2=A0
=C2=A0 =C2=A0=

=C2=A0 =C2=A0 =C2=A0 =C2=A0RE: INHERITANCE FUND TRANSFER NOTIFICATION
<=

br>THIS IS TO NOTIFY YOU THAT YOUR FUND WHICH IS THE TOTAL SUM OF TEN MILLI=

ON FIVE HUNDRED THOUSAND DOLLARS (US$10, 500,000.00), AS YOUR CONTRACT/INHE=

RITANCE FUND HAVE BEEN PROGRAMMED FOR IMMEDIATE PAYMENT TO YOU. AND YOUR IN=

HERITANCE FUND PAYMENT HAS BEEN FINALIZED TO BE RELEASED TO YOU AS THE LEGI=

TIMATE BENEFICIARY OF THE FUND, VIA HSBC ATM DEBIT CARD.

MEANWHILE, =

WE WANT YOU TO CLARIFY IF YOU INDEED APPROVE A WOMAN FEW DAYS AGO TO CLAIM =

YOUR FUND ON YOUR BEHALF, WHO NOW CLAIM THAT SHE IS YOUR REPRESENTATIVE SEN=

T BY YOU TO RECEIVE YOUR FUND.

THE REQUIRED INFORMATION IS AS STATED=

BELOW:

1. YOUR NAME:
2. YOUR ADDRESS:
3. YOUR TELEPHONE:
4=

. FAX: =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=

=A0
5. AGE:
6. SEX:
7. YOUR OCCUPATION:

NOTE THAT THIS ATM =

CARD WILL BE SENT TO YOU THROUGH THE COURIER SUCH AS FEDEX, UPS OR ANY COUR=

IER COMPANY OF YOUR CHOICE FOR THE DELIVERY OF YOUR ATM CARD TO YOU FOR YOU=

R EASY CASHING OF YOUR CONTRACT SUM OF US$10, 500,000.00. FROM THE OFFICE O=

F THE PRESIDENCY, THIS REPUTABLE BANK HAS BEEN APPROVED IN CONJUNCTION WITH=

THE HSBC BANK LONDON,THEY HAS BEEN ACCREDITED TO HANDLE AND MAKE PAYMENT T=

O ALL FOREIGN CONTRACT/INHERITANCE FUNDS BENEFICIARIES THIS SECOND QUARTER =

PAYMENT OF THE YEAR 2022 THEREFORE, WE WAIT TO HEAR FROM YOU SOON.

W=

E ARE WAITING TO HERE FROM YOU AS SOON AS POSSIBLE.

YOURS REGARDS,
r>
DR YURI AKOTA
DIRECTOR OF FOREIGN OPERATIONS DEPARTMENT
CENTRAL=

BANK OF NIGERIA (CBN)
TEL: +23409168493316




--00000000000039b97b05e4607df4--

Donation spam from outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 Jul 2022 08:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEtMx-000OKh-IY

for dave@doctor.nl2k.ab.ca;

Fri, 22 Jul 2022 08:11:07 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 Jul 2022 08:11:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vi1eur05hn2225.outbound.protection.outlook.com ([52.100.175.225]:49504 helo=EUR05-VI1-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

id 1oEmAR-000PCh-S5

for doctor@doctor.nl2k.ab.ca;

Fri, 22 Jul 2022 00:29:49 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=MuJo02Cft0wCEM7XSCw/JccHeJBQceQFQnKtuUjRy82cNHcOsG2keI+xI75VMSTHlOeg+J26sJFL9n/QnG50jVmIvBS2iXuH7LzRtieTBOg58cyA9WE0AogCCL63G4ohMIr9Yc+E+LB5CKJYRXsgeqGM/YJPjrOO404VYQ4trBh6w0jjyLIonlIW7jApSR18HS4vc8tMsZ4sVUNztgiv2DJvhrbiN6z2aFNXJhY7/NkqyvjZ37XNZmkiz7njOpI7/eaoo6afLVT4dHz3JVvaDwkgUWep3FBglNgNxC7X2g1LKJFigVcfl+64PCLLAHhR/Gdwu4+ikUBfs8iRAnKbtQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=vKbVtJ06D/6eKG87vLG6Cm0zynXdVFDSSHU/1Oz2mEw=;

b=OHiwSAnpYt63UakIcZUpCHnzwI0p5kZ/s0WJRi+v99XzVLdCsQI95neFsqbnu2JL2e8laREgaM6lYKtPtAVC7b0GqgVztfNup/vvZvF2g56O7yJ9/ZFMg6PxQPe5S0Y8MZ3NeU0k2igLklaZv7CirCNENxwivrHZR+/myrrRr6LIKV84337xtawLCMDDWQM/I4AVKTm+VLVVmZnBfWFYKILUATvMVvvhV6uTq2uYkGMmUOBhunLRaVHInycVKSpDCfijF4KXWE1EGamf8nRZ4bmqk4cnPgz0BEHN95WT0sjW8VWLrAL/jGUsQ+aX3V3vkDK+8MA5AxTG9TEXGj7HEA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

193.183.126.23) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.helo=smtp.husqvarnagroup.com; dmarc=none; dkim=none (message not

signed); arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=Husqvarnagroup.onmicrosoft.com; s=selector1-Husqvarnagroup-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=vKbVtJ06D/6eKG87vLG6Cm0zynXdVFDSSHU/1Oz2mEw=;

b=ZeDr9RRWqUwoJKTsUn0WqIXiMOX0Pse4f9WAVEHZ1YLamIvdOp960asACAcI3fmZFGiBsB3DXzeJviloXMdZLtk32xsDZvdt8Atir+D+cMJTFoa97tP5nFptUM3D0BfitXwM+Iuouq86n8rg4vQN2llm0eJO+zMJGCGNVDK188I=

Received: from AM5PR0502CA0018.eurprd05.prod.outlook.com

(2603:10a6:203:91::28) by DU0PR04MB9372.eurprd04.prod.outlook.com

(2603:10a6:10:35b::7) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5458.19; Fri, 22 Jul

2022 06:29:18 +0000

Received: from AM5EUR02FT019.eop-EUR02.prod.protection.outlook.com

(2603:10a6:203:91:cafe::d2) by AM5PR0502CA0018.outlook.office365.com

(2603:10a6:203:91::28) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5458.19 via Frontend

Transport; Fri, 22 Jul 2022 06:29:18 +0000

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 193.183.126.23)

smtp.helo=smtp.husqvarnagroup.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=;

Received-SPF: None (protection.outlook.com: smtp.husqvarnagroup.com does not

designate permitted sender hosts)

Received: from smtp.husqvarnagroup.com (193.183.126.23) by

AM5EUR02FT019.mail.protection.outlook.com (10.152.8.169) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id

15.20.5458.17 via Frontend Transport; Fri, 22 Jul 2022 06:29:18 +0000

Received: from AS400TGT.CP.ELECTROLUX-NA.COM ([10.80.249.221]) by smtp.husqvarnagroup.com with Microsoft SMTPSVC(8.5.9600.16384);

Fri, 22 Jul 2022 08:29:01 +0200

Received: from [192.168.43.247](::ffff:129.205.124.216[129.205.124.216])

by AS400TGT.CP.ELECTROLUX-NA.COM (IBM i SMTP 7.3.0) with TCP;

Fri, 22 Jul 2022 01:28:29 -0500

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: YOU HAVE A DONATION

To: Recipients <>

From: "UNITED WORLD CHARITY ORGANIZATIONS" <>

Date: Fri, 22 Jul 2022 14:26:23 +0800

Reply-To: unitedworldcharityorg@gmail.com

Message-ID:

X-OriginalArrivalTime: 22 Jul 2022 06:29:01.0536 (UTC) FILETIME=[55117E00:01D89D94]

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-Office365-Filtering-Correlation-Id: 75740f3b-3f61-48f0-d41c-08da6bab8174

X-MS-TrafficTypeDiagnostic: DU0PR04MB9372:EE_

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?iso-8859-1?Q?Et3/iukul0FsII2VQW/jkN6aFwrkFTY+bxgw0nt4GYwHCcpglkzZcvycyZ?=

=?iso-8859-1?Q?IurUMfuPruT7XXHQmaqPvS9Ae0BY75fkUPjkv0OXwe3yvsdKJXzmgfrMnB?=

=?iso-8859-1?Q?OXyWaAGKPNdHpTJ0f3aDQLF6TfgEYkE1uejayOiUMvHqlxD06I7rAKsRsd?=

=?iso-8859-1?Q?BL1TQ77kj7eIcqdRMILlV5gS6qc74Iuy/bIw9B5P3HopOh3bpIGCrcIDlP?=

=?iso-8859-1?Q?1FCbbbXzXScLBwAAn9UXmHH87GVgLtdoZwyJDCXnoITWPBevrMkNllpcFq?=

=?iso-8859-1?Q?9OUFMR4HnDHsofLkYjW9AaJZFeeew99LbCtWV4A1Ua1vGFc34nkn3ONv2r?=

=?iso-8859-1?Q?NeLz6FAkHHGa5jutSlfzvV6l3fN/dLmD/O6gEeEu5tc0ZHEVWvkJXWPlwP?=

=?iso-8859-1?Q?+QzbWZsCZvB6mL8yoONtyxUBtsLApzA18aKWKW+O/cUhfFkgZg+CspshKw?=

=?iso-8859-1?Q?T3+gFEUbwdI5N9xhn2ZSVfg+8oZW67qZq9reza5vMFxMi+FlCcFsBErnLH?=

=?iso-8859-1?Q?0btxa0f9vcmDRFGvw43UrmwZ1aBacaSW5Dq3G/0guWIQfahQaRqYeVPT92?=

=?iso-8859-1?Q?jeoKzeze4rAp8ZBH+81U8YYBv3o/d/gjM5+kWRMa6ImcmTIx2r5wpXywPy?=

=?iso-8859-1?Q?ww5GdQWw2SWjuMWSOzwO23yJXUc521gU/cwwqL8DvyaPO63yG2xWJGRH1Q?=

=?iso-8859-1?Q?0ZPCzY84fgRN4d7QGwCae+75b2RyAqgoVXihNBjt2vHk+qlmU13HCcfyuc?=

=?iso-8859-1?Q?OphdbCzOkmYY7z7CzyR2G23O3t6YSZhMoTp8owDTb+VMWX9FNDw3RZ58Si?=

=?iso-8859-1?Q?wI/CPHs1duUPMqOpRfx7ljZTgUBoklDbdtVYMf+SG4LpnlCpqNQPO+YRl+?=

=?iso-8859-1?Q?7ujo7aGhi4i9p3692InjaFW5UDmrKjKe4/0FFZdo9D+LtPnoJCfSr1wdKU?=

=?iso-8859-1?Q?n8eIdEgrI1zfYvtf8YVjEUlHyAtrahpEdCKCnqD7JB1KQtPDtIrbt04+Vo?=

=?iso-8859-1?Q?ncSn02cT4iER+J+MwOEnsoPji7/kS9L5aP4z/vjT+YuRvMifC7nbcFRxpA?=

=?iso-8859-1?Q?77DjM+rbY3Rc+Bf5q6f1DbLwNoLYPF19D0xhu7tvCWlqKJeNyi8NlamL5C?=

=?iso-8859-1?Q?FUjD82ZUz32dtbahOm+ODD0cayTBpqu5Ls9uWKZ7mbjBML+2srEQSVao5E?=

=?iso-8859-1?Q?rEaALN0BIlKDjA=3D=3D?=

X-Forefront-Antispam-Report:

CIP:193.183.126.23;CTRY:SE;LANG:en;SCL:6;SRV:;IPV:NLI;SFV:SPM;H:smtp.husqvarnagroup.com;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230016)(4636009)(39860400002)(396003)(346002)(376002)(136003)(5005620100009)(40470700004)(46966006)(8936002)(4744005)(5660300002)(356005)(81166007)(82740400003)(40460700003)(4743002)(109986005)(956004)(2860700004)(316002)(26005)(508600001)(41300700001)(6666004)(3480700007)(336012)(47076005)(83380400001)(42882007)(8676002)(78352004)(70206006)(70586007)(35950700001)(40480700001)(86362001)(2906002)(82310400005)(1557600019);DIR:OUT;SFP:1501;

X-OriginatorOrg: Husqvarnagroup.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2022 06:29:18.0593

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 75740f3b-3f61-48f0-d41c-08da6bab8174

X-MS-Exchange-CrossTenant-Id: 2a1c169e-715a-412b-b526-05da3f8412fa

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=2a1c169e-715a-412b-b526-05da3f8412fa;Ip=[193.183.126.23];Helo=[smtp.husqvarnagroup.com]

X-MS-Exchange-CrossTenant-AuthSource:

AM5EUR02FT019.eop-EUR02.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR04MB9372

X-Spam_score: 11.2

X-Spam_score_int: 112

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: YOU HAVE A DONATION OF 2,000,000.00 GBP OF COVID19 SUPPORT

FROM UNITED WORLD CHARITY ORGANIZATIONS, FOR CHARITABLE WORK IN YOUR COUNTRY,

TO RECEIVE YOUR DONATION AMOUNT KINDLY SEND YOUR FULL DETAILS T [...]



Content analysis details: (11.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.2 TO_MALFORMED To: has a malformed address

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

2.6 FROM_NO_USER From: has no local-part before @ sign

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.175.225 listed in wl.mailspike.net]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 FORGED_SPF_HELO No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

Subject: {SPAM?} YOU HAVE A DONATION



YOU HAVE A DONATION OF 2,000,000.00 GBP OF COVID19 SUPPORT FROM UNITED WORL=

D CHARITY ORGANIZATIONS, FOR CHARITABLE WORK IN YOUR COUNTRY, TO RECEIVE Y=

OUR DONATION AMOUNT KINDLY SEND YOUR FULL DETAILS TO VIA unitedworldcharity=

org@gmail.com





The information in this email may be confidential and/or legally privileged=

. It has been sent for the sole use of the intended recipient(s). If you ar=

e not an intended recipient, you are strictly prohibited from reading, disc=

losing, distributing, copying or using this email or any of its contents, i=

n any way whatsoever. If you have received this email in error, please cont=

act the sender by reply email and destroy all copies of the original messag=

e. Please also be advised that emails are not a secure form for communicati=

on, and may contain errors.

Home Depot phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 Jul 2022 08:09:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEtK1-000MMa-Iv

for dave@doctor.nl2k.ab.ca;

Fri, 22 Jul 2022 08:08:05 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 Jul 2022 08:08:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.144.177.232] (port=59531 helo=pwhealthcare.net)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

id 1oEhEP-0001aA-1a

for doctor@nl2k.ab.ca;

Thu, 21 Jul 2022 19:13:33 -0600

From:_Reward On Hold! Please Confirm

Subject:_Don’t miss your chance to win a makita power drill

Date: Fri, 22 Jul 2022 03:12:37 +0200

To: doctor@nl2k.ab.ca

Reply-To: "Adobe Creative Cloud"

MIME-Version: 1.0

X-mailer: nlserver, Build 6.7.0

Message-ID:

X-250ok-CID: P26341-121020

TenantHeader: 1d0e6311-6f98-4c5b-8b0e-RlKTa9SGJWACrg3bQ1qyQPy

Affinity: prod.default

X-cust_MessageID: 1938757681

X-cust_DeliveryID: 350826

X-cust_InstanceName: aci_prod

MessageMaxRetry:2

MessageRetryPeriod: 3600

MessageWebValidityDuration: 2592000

MessageValidityDuration: 432000

X-cust_IMSOrgID:

Content-Transfer-Encoding: 7bit

Content-Type: text/html; charset="UTF-8"

X-Spam_score: 10.4

X-Spam_score_int: 104

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: SURVEY ABOUT: THE HOME DEPOT THE HOME DEPOT Please tell us

about your: THE HOME DEPOT Experiences and as a thank you, you can select

from several exclusive offer rewards! Supply is extremely limited so act

fast today!



Content analysis details: (10.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: page.link]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

0.3 MIME_8BIT_HEADER Message header contains 8-bit character

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.1 SUBJ_ILLEGAL_CHARS Subject: has too many raw illegal characters

1.5 HDRS_MISSP Misspaced headers

0.1 SUBJECT_NEEDS_ENCODING Subject is encoded but does not specify

the encoding

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} _Don’t miss your chance to win a makita power drill

























































Beneficiary spam from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 21 Jul 2022 18:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEgED-000MQR-A2

for dave@doctor.nl2k.ab.ca;

Thu, 21 Jul 2022 18:09:13 -0600

Resent-From: The Doctor

Resent-Date: Thu, 21 Jul 2022 18:09:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f67.google.com ([209.85.217.67]:39649)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEewB-000FUb-T0

for sales@nk.ca;

Thu, 21 Jul 2022 16:46:38 -0600

Received: by mail-vs1-f67.google.com with SMTP id c3so2888063vsc.6

for ; Thu, 21 Jul 2022 15:46:10 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=mime-version:from:date:message-id:subject:to;

bh=xMTFpimUC0J4TVaEa1NLKJX46BeN/gkjX2Yo1PHwi2g=;

b=lqyJE6eznWGiIl4P5bP4epC7YWXsLNbLJTO8zH5oOX5KHuR3Pox9DYIEQcpurPQDW1

Pnx8iZKVeCSBY47DZ260CZCKAkyl11giSVEXITesetSsVFLPW0USg3+VpxEmjNOYfgFO

g+vtuOyL1gU1ODuhAGzaxJMXNCQ+8SnfPblirnz80LhkRIjEdDd0yEJV/rC7Ocr3f9N4

P2WF8cIgmuhqb90ebL6Gf8MIRxcZPbV1IBCb72JgZY+jzJZ4hd1jU4OEDsMZJ2GeSHZP

MaEMMHs8LBWgcdBuKBdmED2cSJl+Euhixp3DyxH0S/iEx5q/A+z38KF1Wu8q6RiqYsVI

KZJQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=x-gm-message-state:mime-version:from:date:message-id:subject:to;

bh=xMTFpimUC0J4TVaEa1NLKJX46BeN/gkjX2Yo1PHwi2g=;

b=E4sn7WJhUlrACUslckyZGN0nfrs2PCNNObILzxpKY1pRJAzx/TAYjVm8JQj5KMhK2s

zhiTkLg6DnxSUb5jgD8GYKSdN6SC2Is71ecZxbCFojgD5HnXQ2y8m8Fl7k7tI6iTNudN

Obe7EjBkSHEZWYjiTQENc6zCIRIH8n4koMIHDkL5hArpHo1WFQ09X+i1pq+RA2naWHOc

4iI6AbOLLeGm0W8UWVYxsRkm1Pfljo8XjV8cWqd/28wCuyJZ/5KAwPN9PB91aYzuz9FR

65e13tl3dABkUMLyJIGUVW1vgjwhGmduVs0WenX47/e/2R6MUgexmzvgHl60Mw3XnCnd

/I6A==

X-Gm-Message-State: AJIora/B1KO5PeA4EHZfd5FossAFtxZUdVByVw6fi33dq4hsHLnnzixA

5HXXnEHgWQPB8MXiEt/orH2FcGemwR4DiSy6o0U=

X-Google-Smtp-Source: AGRyM1uoBIy6R9pBT6G4X6wzFfoHzJXecoNqz+jSkpj+mBqFBYmg6S0ZVFsV2VsjCUoo0zJzrpWD1Mrk9ikyQG1t/lk=

X-Received: by 2002:a67:b843:0:b0:356:6c55:dda1 with SMTP id

o3-20020a67b843000000b003566c55dda1mr234103vsh.52.1658443564653; Thu, 21 Jul

2022 15:46:04 -0700 (PDT)

MIME-Version: 1.0

From: Andrew McHattie

Date: Thu, 21 Jul 2022 23:45:51 +0100

Message-ID:

Subject: LETTER

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000008d208905e4587b6a"

Bcc: sales@nk.ca

X-Spam_score: 12.5

X-Spam_score_int: 125

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: My name is Andrew McHattie, A Management Accountant and an

External Auditor for financial institutes. I currently work with a team of

external auditors who were retained after the outbreak of covid-19 [...]



Content analysis details: (12.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.67 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[tinihamed93[at]gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[andrewmchattie6[at]gmail.com]

2.7 UNCLAIMED_MONEY BODY: People just leave money laying around

0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

2.5 MILLION_USD BODY: Talks about millions of dollars

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_MONEY_PERCENT X% of a lot of money for you

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} LETTER



--0000000000008d208905e4587b6a

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



My name is Andrew McHattie, A Management Accountant and an External Auditor

for financial institutes. I currently work with a team of external auditors

who were retained after the outbreak of covid-19 pandemic to audit

financial activities.



In the course of a routine audit of our books last quarter, I discovered

some investment accounts that have been dormant for one year now. Most of

the accounts belong to a single beneficiary who died during the covid-19

pandemic. (Four million five hundred thousand united states dollars)in the

intent of the deceased depositor who died intestate and as such, no

next-of-kin has come forward all these Months to lay claim to the

investment.( Names now withheld for security reasons ) Since this is our

second letter to you.



I contacted you because you bear the same last name with the deceased

expatriate investor/depositor who died as a result if covid-19 and

therefore I can present you as the beneficiary to the inheritance since

there is no written will from our late investor. My service's aim is to

provide you with a complete service as I'm prepared to provide you with all

the documents required by the holding Bank to enable them to release these

inheritance funds to you . we can secure the funds in this bank account for

ourselves instead of allowing it to be transmitted as =E2=80=9Cunclaimed fu=

nds=E2=80=9D

into the Treasury of the Government.



All the papers required will be processed in your acceptance of this deal

as we are prepared to offer you 40%,50% for me, while 10% should be given

to any orphanage Home/Hospitals/clinics to support the needy worldwide.



I request that you kindly respond to me with acceptance:





Your prompt response is highly imperative.



Andrew McHattie



--0000000000008d208905e4587b6a

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



My name is Andrew McHattie, A Management Accountant and an=

External Auditor for financial institutes. I currently work with a team of=

external auditors who were retained after the outbreak of covid-19 pandemi=

c to audit financial activities.

In the course of a routine audit of=

our books last quarter, I discovered some investment accounts that have be=

en dormant for one year now. Most of the accounts belong to a single benefi=

ciary who died during the covid-19 pandemic. (Four million five hundred tho=

usand united states dollars)in the intent of the deceased depositor who die=

d intestate and as such, no next-of-kin has come forward all these Months t=

o lay claim to the investment.( Names now withheld for security reasons ) S=

ince this is our second letter to you.

I contacted you because you b=

ear the same last name with the deceased expatriate investor/depositor who =

died as a result if covid-19 and therefore I can present you as the benefic=

iary to the inheritance since there is no written will from our late invest=

or. My service's aim is to provide you with a complete service as I'=

;m prepared to provide you with all the documents required by the holding B=

ank to enable them to release these inheritance funds to you . we can secur=

e the funds in this bank account for ourselves instead of allowing it to be=

transmitted as =E2=80=9Cunclaimed funds=E2=80=9D into the Treasury of the =

Government.

All the papers required will be processed in your accept=

ance of this deal as we are prepared to offer you 40%,50% for me, while 10%=

should be given to any orphanage Home/Hospitals/clinics to support the nee=

dy worldwide.

I request that you kindly respond to me with acceptanc=

e:


Your prompt response is highly imperative.

Andrew McHa=

ttie




--0000000000008d208905e4587b6a--

Urgency spam from Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 21 Jul 2022 15:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEe1z-000ApV-AP

for dave@doctor.nl2k.ab.ca;

Thu, 21 Jul 2022 15:48:27 -0600

Resent-From: The Doctor

Resent-Date: Thu, 21 Jul 2022 15:48:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-am6eur05hn2249.outbound.protection.outlook.com ([52.100.174.249]:14432 helo=EUR05-AM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oEdfT-0008sm-3m

for doctor@doctor.nl2k.ab.ca;

Thu, 21 Jul 2022 15:25:16 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=Eo21l8ENeV6iAPgf64s4gkOTRaReubg+0bplALxP4P/R8DYWHXqlca4TFhu7GzUwm7Lr0YapfJzXC25BNu5nulU+aN+3yu8EPq7PEREyoqW+PgZrvgQl4uX/yG/wdhIm1oitGsYnfuCrqIa4oybcJIM/JG5NhWVI9uHxfMaBj+IcrE+b1LdbSvaQSev9iuzA03T0BF7wJF2wcjjy4tboe8ifvEH/u8RQ42/yvVtYuEGNH2KNgO6lX45NFYUUVByIi4YimbEbwGsLpbaDmfEpCsP7cxmOdb9hMjMaD7UlMeJo2wPbZd9PhiZvn+3vCqKzTVn6GsPbcSnHXzbr853sGw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=NPRvuS1lylBXPFPS7bRSqdxncLyN3FrXzLFg1hRG9Ys=;

b=XaZDNXMYaelALUl5JyB4azGNgBr76mbeajapbCsiDPv6Ei8v6usV7MqfVcKdiYmmNO+UzFynM2I/5cJn5xKk/9UC+TYLn0T1TPu1nA7kW9estKar9Tjug7BmSfq/fru+sDgQGdbu/29CoIX9TNWr2Vc2h+Apd6fJ1OGhvkXTB7/TiJQ84svkGM0knSeBc8gVwAn4AR72TN/yKXEJ78wPfVWLb7ZnNyRvLQ93eNzivU3a3K2nH+ojRYWq+whT11msNaHrF9k6dk+oHXSL/8s1gFXL8dDfx0D/drPTaNLcSKEBacyNq4j9D1NQc8Wl/fQuY8o8HaG9seJygPIex40dkA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

193.183.126.23) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=hkma-online.com; dmarc=none action=none

header.from=hkma-online.com; dkim=none (message not signed); arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=Husqvarnagroup.onmicrosoft.com; s=selector1-Husqvarnagroup-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=NPRvuS1lylBXPFPS7bRSqdxncLyN3FrXzLFg1hRG9Ys=;

b=HfNKjRhlF6NTVYDaN5Q33qWBxR2xlF5cy+xbm5PCmdbfpbg19bLtrfShNr9aMsWGbuTvh7BvnyrLf0ce754WXSzsgP37YhNlAwopRQcUN8x32y2FUSr2oL08eltzOc3LtM6Z0+geuYPKX5Xqz94ooPMvggX3HMXTCZJETH9JbQY=

Received: from SV0P279CA0051.NORP279.PROD.OUTLOOK.COM (2603:10a6:f10:13::20)

by AM9PR04MB8455.eurprd04.prod.outlook.com (2603:10a6:20b:414::22) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5458.19; Thu, 21 Jul

2022 21:24:45 +0000

Received: from HE1EUR02FT038.eop-EUR02.prod.protection.outlook.com

(2603:10a6:f10:13:cafe::85) by SV0P279CA0051.outlook.office365.com

(2603:10a6:f10:13::20) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5458.18 via Frontend

Transport; Thu, 21 Jul 2022 21:24:45 +0000

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 193.183.126.23)

smtp.mailfrom=hkma-online.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=hkma-online.com;

Received-SPF: None (protection.outlook.com: hkma-online.com does not designate

permitted sender hosts)

Received: from smtp.husqvarnagroup.com (193.183.126.23) by

HE1EUR02FT038.mail.protection.outlook.com (10.152.11.30) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id

15.20.5458.17 via Frontend Transport; Thu, 21 Jul 2022 21:24:44 +0000

Received: from AS400TGT.CP.ELECTROLUX-NA.COM ([10.80.249.221]) by smtp.husqvarnagroup.com with Microsoft SMTPSVC(8.5.9600.16384);

Thu, 21 Jul 2022 23:24:28 +0200

Received: from [107.161.81.132](107.161.81.132.static.quadranet.com[107.161.81.132])

by AS400TGT.CP.ELECTROLUX-NA.COM (IBM i SMTP 7.3.0) with TCP;

Thu, 21 Jul 2022 16:24:34 -0500

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Re: Hello ....

To: Recipients

From: "Mr. Eddie Yue"

Date: Fri, 22 Jul 2022 05:23:55 +0800

Reply-To: eddy@edyue.website

Message-ID:

X-OriginalArrivalTime: 21 Jul 2022 21:24:29.0193 (UTC) FILETIME=[42D59790:01D89D48]

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-Office365-Filtering-Correlation-Id: 9b23ba4c-6ce0-49cb-c11a-08da6b5f6e50

X-MS-TrafficTypeDiagnostic: AM9PR04MB8455:EE_

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?iso-8859-1?Q?2A04cZqVDlhEIQqA9GYPgDRPVqBSZfGnV9RUKudejqXr+C8ZF1SoPrLkUa?=

=?iso-8859-1?Q?fSbD09yfZjTkIZucqzwAfPnNuoxEDWfBxf4+76fFEuTJcGuQLggM7Yx5U9?=

=?iso-8859-1?Q?J8o1/bcNe/Z2XAWcF9TnJFLG9obrvByOfsWCvmsvKcSpO4vWNFlfcNbZDB?=

=?iso-8859-1?Q?bPc+9u5BAO9Nq6SFJjdatohl/SlR7lEo+N3H5bAzUSeE3kLp8fNCrlQo+D?=

=?iso-8859-1?Q?QVwDx9B/lVyafITbyhZqNiMpd9TZMrvxBWZsbtkcIhnIkbV2pTa1w4fkPd?=

=?iso-8859-1?Q?SUOx51XDNiqsgfEKMMA+3bgQ/nSTVHei7BFzmh28UZujU/sRHKt7ahOtCN?=

=?iso-8859-1?Q?rsCUnA2XRE8ZXXqqw66dHCkWNXTR6tv0PNNhDOCIjU1nzzNDZo+WLXtffZ?=

=?iso-8859-1?Q?Ow4RGeJklrCDKG3o/2t9HnmK9nYr5Ds7g6OYxsLCNKCp1izF4hQc2mV8JF?=

=?iso-8859-1?Q?3Z0wC8WIRMoq7Wq2AWBultDSrrLwwBhpyzxPI21opZMmrXNW5iIWYMt9p4?=

=?iso-8859-1?Q?HKYlZB7A7YNO6Ngc5cT9VQVpXB6uD/V5oFodf+vC4CaEvPHlX1mIWteXsy?=

=?iso-8859-1?Q?FZ9ujMRSQXClHwEFzY5AkxR6NPuSJqSdr+5Cwg8AWXcpWhEqzwIiQv244y?=

=?iso-8859-1?Q?3qB+HQnHZplsF5dcI1YlvU4K2qz7+MTBGJkSxI2dA/dt6taYazYz5Sy6Ns?=

=?iso-8859-1?Q?fu7AjWp4HZEOy/yF/baJ+iXpoTYS36mcFQwKaeSAm/ZMY7Yfu+dgbz26cZ?=

=?iso-8859-1?Q?FOfkXbh86X4DtLZsQhQ/TwWHQXcirFHdJ8UKu4jMw1oqvfaKSz9orTjS8W?=

=?iso-8859-1?Q?8NHCZPgD0vlCE/ew1WuPyy7dufGqWJ6bdeSKhngEgcn63hgkmaWSgnlzX0?=

=?iso-8859-1?Q?oVNPE+fy0wr2AQL1U66IyG0R1yxKPPESKwr5QO10b/fsaAxFd+PeRWn8bd?=

=?iso-8859-1?Q?cvojTkFD47zvujyPK3UAwYT7ZI+wcFxPrdQxzLvh3B274DLdYGYzUqLtMo?=

=?iso-8859-1?Q?ky17qgjdIGXjKgGTzB1WV/JqEO4q62xo4UHa+bYkeFJvpt0ge/E6VPUyI2?=

=?iso-8859-1?Q?mie1ep6hU7NDuHONoPm+r+ctnSqUwAKL9v+UjmTCx42LQI9GLbaNXEB040?=

=?iso-8859-1?Q?FYZahWBttjspWWfBCPvYrAk+S2RoveAp30/S9mYXraYBVcCgZNA//HlCJU?=

=?iso-8859-1?Q?9d7f3JRQU0S3aw=3D=3D?=

X-Forefront-Antispam-Report:

CIP:193.183.126.23;CTRY:SE;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:smtp.husqvarnagroup.com;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230016)(4636009)(346002)(396003)(39860400002)(136003)(376002)(40470700004)(46966006)(336012)(956004)(82310400005)(7116003)(6200100001)(47076005)(83380400001)(2906002)(6666004)(4744005)(41300700001)(26005)(9686003)(498600001)(35950700001)(40480700001)(3480700007)(81166007)(86362001)(70586007)(82740400003)(8936002)(316002)(6862004)(5660300002)(70206006)(40460700003)(356005)(8676002)(62346012);DIR:OUT;SFP:1501;

X-OriginatorOrg: Husqvarnagroup.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Jul 2022 21:24:44.2260

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 9b23ba4c-6ce0-49cb-c11a-08da6b5f6e50

X-MS-Exchange-CrossTenant-Id: 2a1c169e-715a-412b-b526-05da3f8412fa

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=2a1c169e-715a-412b-b526-05da3f8412fa;Ip=[193.183.126.23];Helo=[smtp.husqvarnagroup.com]

X-MS-Exchange-CrossTenant-AuthSource:

HE1EUR02FT038.eop-EUR02.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR04MB8455



Hello,







I have an Obligation I will like you to complete for me, I am ready to give=

you a commission for your time. Reply for details.





Mr. Eddie Yue





The information in this email may be confidential and/or legally privileged=

. It has been sent for the sole use of the intended recipient(s). If you ar=

e not an intended recipient, you are strictly prohibited from reading, disc=

losing, distributing, copying or using this email or any of its contents, i=

n any way whatsoever. If you have received this email in error, please cont=

act the sender by reply email and destroy all copies of the original messag=

e. Please also be advised that emails are not a secure form for communicati=

on, and may contain errors.