Shoppers' Drug Mart phish from Poland

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 16 Aug 2022 13:09:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oO1v7-000CcJ-Rc

for dave@doctor.nl2k.ab.ca;

Tue, 16 Aug 2022 13:08:09 -0600

Resent-From: The Doctor

Resent-Date: Tue, 16 Aug 2022 13:08:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [31.6.70.209] (port=37184 helo=bnc.ca)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oNyme-000GML-4w

for postmaster@nl2k.ab.ca;

Tue, 16 Aug 2022 09:47:17 -0600

MIME-Version: 1.0

From: Shoppers Drug Mart

Subject: Take Part In Our Marketing Surveyand Get $90 PROMO REWARD

Reply-To: repostmasterply@bnc.ca

Received: from bnc.ca (31.6.70.209) by bnc.ca id 7M0offos9YPq for ; Tue, 16 Aug 2022 16:44:17 +0200 (envelope-from

To: postmaster@nl2k.ab.ca

Content-Transfer-Encoding: 7bit

Content-Type: text/html; charset="UTF-8"

Date: Tue, 16 Aug 2022 16:44:17 +0200

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: A gift for you !🎁Here is your $90 voucher!🐰 If you

no longer wish to receive these emails please unsubscribe here



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=bounce%40bnc.ca;ip=31.6.70.209;r=doctor.nl2k.ab.ca]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=bnc.ca;ip=31.6.70.209;r=doctor.nl2k.ab.ca]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of

words

0.1 MISSING_MID Missing Message-Id: header

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 GOOG_STO_IMG_HTML Apparently using google content hosting to

avoid URIBL

Subject: {SPAM?} Take Part In Our Marketing Surveyand Get $90 PROMO REWARD









A gift for you !🎁Here is your $90 voucher!🐰















If you no longer wish to receive these emails please



unsubscribe here








Nigerian Gmail spam

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 16 Aug 2022 07:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oNwbl-0000dz-De

for dave@doctor.nl2k.ab.ca;

Tue, 16 Aug 2022 07:27:49 -0600

Resent-From: The Doctor

Resent-Date: Tue, 16 Aug 2022 07:27:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f179.google.com ([209.85.128.179]:46066)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oNwW6-000Pke-Mj

for doctor@doctor.nl2k.ab.ca;

Tue, 16 Aug 2022 07:22:02 -0600

Received: by mail-yw1-f179.google.com with SMTP id 00721157ae682-3246910dac3so149934577b3.12

for ; Tue, 16 Aug 2022 06:21:41 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc;

bh=XJcCtdzHlHc6RVHmnid6Iplysw0jrvS/xcLsOeW1J6o=;

b=kq7bjDTRPAV1YCSmK4zVotYwBJSN36XtBWRA4w1mV6xA2TB3Qw54ZAlw1NkMBRnXa3

oGdpQzHQArYjWFTv85+GTxNrHT+Z7W79HBV6VmBdzyQE6DCRrJ330LUBA3GesZ5gT0PS

wpikDW0nxIIqudn7I4xVUpNzEwWK6s1NmfzwkLKzOq2+RJAbxRC+fp0ajZAU1HYGcw2l

xVkEaSBNHAlWKTHLaHs0Q3xyET8FsEfbWFGs/afhwiVT/vqYrhQHoM00XppuO+no94+B

f/jjC2NEoLW1kCxmzhMWOzLpMhVXR7HAwOsylHiJbHfxPbip40SdZVzNJo+4IibX6fzy

JUEA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc;

bh=XJcCtdzHlHc6RVHmnid6Iplysw0jrvS/xcLsOeW1J6o=;

b=PrtYtm2LSq9+Mjko93uWe9QbOSuUhyfQiv2rejlAS8AceUePlcWGTxpp06SaAxWEYD

sXByDDXpWLb6gW1COSMQJBA++Ebe8NgOjHlIcnsMxjTQ5ApCmrPbsBpu6x0PASXN1xBz

5Bpav6daAk63HQaUX+1dWenvwJQbqks6xR29g6oW9TSpbcHxMUapYVg7nOIlUYIqmpTp

G+gTWrAb1uMGnEosbSg3wEGbtx7oXnLPqDCvy/q7TbTde8gDYD4P0ZBf4I0YszErdJIr

gcvdKRjc9sSI/9X55vbpLoa3IWnFPiZS6R5CTEnz1E+eMUO6uUuQxmhtoxbCJUPHmZfP

Ia1w==

X-Gm-Message-State: ACgBeo1JFRxa+/jS5JE7D18FaCrcq1a+tZ7JqAgZhfHV2Gx2Ho8qlBoL

P+O/A9iYBp8Iofnwz29qRIvM4JSjlrFq4c4gSjo=

X-Google-Smtp-Source: AA6agR5X6fViq9W7CcqyvwV/iu8YTq+iZ9eiZXW/w3hdT01aSCwxJFbtYQERgfTaafxeygbpFy7JdI1EFuwc2hGut+I=

X-Received: by 2002:a0d:e28c:0:b0:334:2a33:b923 with SMTP id

l134-20020a0de28c000000b003342a33b923mr1016304ywe.177.1660656095172; Tue, 16

Aug 2022 06:21:35 -0700 (PDT)

MIME-Version: 1.0

From: "Dr. Umar Bello"

Date: Tue, 16 Aug 2022 06:21:22 -0700

Message-ID:

Subject: GREETINGS:

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000a59cba05e65ba04f"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 11.5

X-Spam_score_int: 115

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: GREETINGS: I am contacting you on a business deal of $19.5

Million US Dollars, ready for transfer into your account if we make this

claim, we will share it 60%/40%.100% risk free and it will be legally backed

up with government approved If you are interested reply for more details.





Content analysis details: (11.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.179 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[bellalogan584[at]gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[bellalogan584[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

3.6 NA_DOLLARS BODY: Talks about a million North American dollars

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_HK_NAME_FM_DR No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.1 RISK_FREE No risk!

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} GREETINGS:



--000000000000a59cba05e65ba04f

Content-Type: text/plain; charset="UTF-8"



GREETINGS:



I am contacting you on a business deal of $19.5 Million US Dollars,

ready for transfer into your account



if we make this claim, we will share it 60%/40%.100% risk free and it

will be legally backed up with government approved If you are

interested reply for more details.



Kindly reply for more details Waiting for your reply Make Sure You

Write To My Via E-mail Address...(umarbellod46@gmail.com)



Best regards

Dr.Umar Bello,



--000000000000a59cba05e65ba04f

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



GREETINGS:
=C2=A0 =C2=A0
=C2=A0 I am contacting you=

on a business deal of $19.5 Million US Dollars,
ready for transfer into=

your account

if we make this claim, we will share it 60%/40%.100% r=

isk free and it
will be legally backed up with government approved If yo=

u are
interested reply for more details.

Kindly reply =C2=A0for m=

ore details Waiting for your reply =C2=A0Make Sure You
Write To My Via E=

-mail Address...(umarbellod46@gma=

il.com
)

Best regards
Dr.Umar Bello,




--000000000000a59cba05e65ba04f--

Nigerian Spam from Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 16 Aug 2022 06:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oNvvC-0007Ai-Jv

for dave@doctor.nl2k.ab.ca;

Tue, 16 Aug 2022 06:43:50 -0600

Resent-From: The Doctor

Resent-Date: Tue, 16 Aug 2022 06:43:50 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f169.google.com ([209.85.210.169]:37667)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oNv5W-0000vc-3f

for root@doctor.nl2k.ab.ca;

Tue, 16 Aug 2022 05:50:29 -0600

Received: by mail-pf1-f169.google.com with SMTP id f30so9136435pfq.4

for ; Tue, 16 Aug 2022 04:50:05 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc;

bh=PUvn+STq1OJAxLGd8TKdiz1s0nXuNQWcsjGVYttJSRE=;

b=pUjYnK8iMAYKuFDef5wVzX6uCrQS+cei+sL/l4+aBlrDx7Rtw4FM9z4qqKftYeTnER

fktrScMhEfHLogLfj9mGJZX2QgbC6a/bxLSyhD8A+Q6Y2UGafEQcVSBvQ8JSnOC/gWBX

VYPwvgQHWCjLcIfj62lhNzECILWDK23lajQYzRs+AN2b0p/Mr5/iZ3NwLIT4v3DmA8J2

5zQq4uSdrQLKhfUK6OBpAh2kKwfWq+LQPwtHIVEBixFC3TQNgEFLsQLjX9PrKLDxhUrM

9mKkzcxnx+aw5D2pS7JnDE0s27tnCpniKSwLty80WHdjsh2qt9cNF6wIXJ48qC7wkNbG

um9Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc;

bh=PUvn+STq1OJAxLGd8TKdiz1s0nXuNQWcsjGVYttJSRE=;

b=5vEmrapjMqFLBmdAT8XlBoghb/xDnr8bWJOfu8uO75H3y+JQ3FxLN8KGFvbxS6iMNA

xdyIzBuWlPp6pP+TnCL/D9ZiXjypzmy21MChkJ3rcab7UgTsCSwVSn8IqsDnHp03P7KC

LE/l0BuG8s6eFaHVM8pwXOs5l90Rcwo0xI6Zj0tckkw0T3wtUC4pp7GWKgk/+ha6bNub

fsDjXZM9MT7/Cq7MkviYjOFYTFXQwiJui4hxADwnCj0/CrYFvgBWOYFiNUE+/oeN/3LQ

Sd2vVuj8nJ0rWM4uqrjB8XWG4xRMY7s+6wufXBbcszc2wkcpHCPAIq3t4a1rFNvwIzmf

yZCg==

X-Gm-Message-State: ACgBeo1CnQkzZzPZSRDxAT6OSBbG+TK9Kb9+9BYVJkfG2PnXQ/kQs1g1

ycmdzfCDrnuhA/DNVrCJmRtGVQ3+dsPHg9U3RrI=

X-Google-Smtp-Source: AA6agR4RY/nAIjsUD7jvZ4qqELK+KSI6nWB+iEhkSv8DzAG7+3tDZzY0R4jTeyVUw6309wXC2NQ3qpu5hA/eHpu9b8s=

X-Received: by 2002:a63:82c1:0:b0:41b:db18:73e2 with SMTP id

w184-20020a6382c1000000b0041bdb1873e2mr17557738pgd.195.1660650599615; Tue, 16

Aug 2022 04:49:59 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:6a21:1515:b0:8b:65d2:8cf1 with HTTP; Tue, 16 Aug 2022

04:49:58 -0700 (PDT)

Reply-To: zhancheung88@gmail.com

From: Zhan Cheung

Date: Tue, 16 Aug 2022 04:49:58 -0700

Message-ID:

Subject: Re

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: root@doctor.nl2k.ab.ca

X-Spam_score: 9.0

X-Spam_score_int: 90

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: -- My name is Zhan Cheung, I am a public bank officer here

in Wing Hang Bank, Hong Kong and I have 18,991,674 USD. that I want to leave

the country. I need a good partner, someone I can trust. It is r [...]



Content analysis details: (9.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.169 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[cterkumbur[at]gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[zhancheung88[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.7 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Re



--

My name is Zhan Cheung, I am a public bank officer here in Wing Hang

Bank, Hong Kong and I have 18,991,674 USD. that I want to leave the

country. I need a good partner, someone I can trust. It is risk free

and legal. Reply to my email:



zhancheung88@gmail.com



For more information:



Mr Zhan Cheung

Nigerian spam from Microsoft Outlook servers

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 16 Aug 2022 06:43:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oNvts-00071J-On

for dave@doctor.nl2k.ab.ca;

Tue, 16 Aug 2022 06:42:28 -0600

Resent-From: The Doctor

Resent-Date: Tue, 16 Aug 2022 06:42:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oln040092074101.outbound.protection.outlook.com ([40.92.74.101]:4151 helo=EUR04-DB3-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oNroI-0000PF-Ld

for doctor@doctor.nl2k.ab.ca;

Tue, 16 Aug 2022 02:20:36 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=jo3VDu8HboCDq9sFROf4Qnj4+7Eczc2oQTwlBs67rPX1Di7lebRQI04V/A3+Ha7bz3WHdcbZbNFMbmlONB+ykPhLQhpZM/CykKd/ZEarr4iONQo93uCkIAO0GSL0NyxP9urXigvywbawk4RXQdF5ILC/m9gBjACQlvyyQEHQkTI0BirgSqNAm01Y/RuWXphI8VxxPP7t7J1go41vxyqzAhlIfPFKV+BjEP6FwvIE7Xh4Kvs79jf8QxUEwlk1Owe2448mmV//IZK3DU36N5cEUCWJa3efy91m5MEnAoEYQOVfKWm7FilgcFAWEecGWq7+dbdH3AokFKeLI926brQfoQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=VD+LxN8JfvpSrLgDRJ4x7/mVqPFRSAqY1j2NyAI9Qd0=;

b=P0PjYTsn6xl+tSe/gycJVgHYwfoTfWbwtyGAZV4ZeDSiJGm2lgw4fHSd7e0BlkdJTlE34LzQ5x5kAdPuFJN0lmMeIx+ZNSEFNtMes4E8y64Z82hsobK+wP09yE+7++rgq4uMp8aqHJgPDkIpom13OvMMC6RTcSC6rlhMKtepVohEohsLWhPeMvDnQkppKhyE3YkgxiaIY9HHRZB9kAIomNX3mCMmezb25TLI37b208zN5Xz771e8rXVEJVk4Z9W/8R2b+B4/zv4OTs29H3QefEoHEaq60KwwyE98CImjiMq3h8gzXrkSCfbWSx5dzwd63QdaV0/VQFuScUq0c4eh7A==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=VD+LxN8JfvpSrLgDRJ4x7/mVqPFRSAqY1j2NyAI9Qd0=;

b=CmtXD96dafrnxYM4nBKqZ5g9x2eXSlXM+ATJ9ObZvwtuk15uBs+Tmy0ACEa1asgyngTAuhd+AsOZDk5ZBZdP6UsLl7a+k9p4187i6tgoSlrw9b70wbyTeFPGfZb4nc+cvGuakoqkOVdMew8pl3ZUbKQnjsKVy2XRwMa5Qj9hAviWa6cl0D6CHqHrlLGJr2OHxEPI9OeQwsb9ES5rX+cCv5zcHkWzo1U3Xtsutgx5fNzpvDIgn8sOYFyiuQFasPan3XxAtdhqacl9NplbDgYwWqWEsV3+WZWd7c3KsOvRL6bsvCzc63sxLjy6Jz0E+If4bu/L98H80BL/+De6bYgR5Q==

Received: from VE1PR06MB7040.eurprd06.prod.outlook.com (2603:10a6:800:1a6::12)

by DB6PR06MB2998.eurprd06.prod.outlook.com (2603:10a6:6:3::12) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.5504.17; Tue, 16 Aug 2022 08:19:55 +0000

Received: from VE1PR06MB7040.eurprd06.prod.outlook.com

([fe80::9976:26d4:84a8:fd89]) by VE1PR06MB7040.eurprd06.prod.outlook.com

([fe80::9976:26d4:84a8:fd89%5]) with mapi id 15.20.5525.011; Tue, 16 Aug 2022

08:19:55 +0000

From: dl dl

Subject: ATTN -. MANAGING DIRECTOR

Thread-Topic: ATTN -. MANAGING DIRECTOR

Thread-Index: AQHYsUj3LTi8SQGhe0qBWn1OiIm6Vg==

Date: Tue, 16 Aug 2022 08:19:55 +0000

Message-ID:



Accept-Language: fr-FR, en-US

Content-Language: fr-FR

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-tmn: [V+LWRmmodNA9XmuPVKhPojA5ViW5Kx0g]

x-ms-publictraffictype: Email

x-ms-office365-filtering-correlation-id: 3f00c4bc-e38a-4e49-3e17-08da7f6019e6

x-ms-exchange-slblob-mailprops:

NS9Gj58uCj3z6McvRDh3PVC/sdMJu4ONZg4LO1eqd/LxmuH75pxIw5xVa3Ivyek9kpX5fEPEjaYxb1w5kOWES8AtYykNgDd6Ca5r5OluPFVGYtuxMoAl/KmC+6PG5mylz6+CbLX97ptYE7otATx1939Pi+tmvbIuay/GIG9yIJ3WRs75uRRemEj7u/7mFAVTD0VJJk2Q1bkyOtMTvVYEFItKrGvKLrZHaYAjlO7kxNTF2OTnpu7Q698IO5nEDL2mr7N4e1VSh3ra581vUumYtf4fRvoV8Y4iauNa/Bj2iG83EcLgBanQ/J4ZL6dXWPgwsUUEfzh/pdhWzONVxtIX+ejCoOQ0VLjVFiYleAqO5UEBG5tSGHEyej2HdWK2EtzpUHYKJsNn1JHGXF2BpCMABT3NIZeEFAzcr6huLz/dVyT22d4AN72mI4tpEgIrMGfmMtA0srsL1U7NWr+zwrJgcy38oUmlaJnay91EZj33r0kRBGPUZ9a7kgvQpEJexh8ZF1pFw5lFaZUpDA/PajqGOO7CtUJvSBcoCYxjXNEc5nZs962rKpKXXPDPTXLd+cu9jUZSgS89ldsPJAf+RpNrm57kgsFv51+MppJyAYdHaTuWIgcqVuap5/czw5XkhL96bT4ZPT9xtfAOKxCU2Slq2xiaakwUDDltRUbAxp4bcN6A/3X0W7/cikN8BY1CVfe5gt4Hpi83f7q/DUtrnTHoLQ==

x-ms-traffictypediagnostic: DB6PR06MB2998:EE_

x-microsoft-antispam: BCL:0;

x-microsoft-antispam-message-info:

Xi33zd/vOltQS05IsH4he+9XLPq6l3U9NgFvheMREbmOQ6ohBrJ3HpoYeS2wwrhmj/SVj8tgnvwhwr5qkAny8zW/NcUW39ydSSm4DdCfCejCWvMZtQpB54a1X3Lhfb9yzFG2jm2Pcm9H4teVTfNBraszzXa8RjQL7pMdJ2RsMuUZ+nP6ds9+Krsm9e5mDzSPes4ZNAiZl7XBCH48cVXBNcFCu3t4blCMX0pA5sYMxICNvBiy3+Pt1B/60VbnFZum8qCYjpbIAOwLFr2HsfUUogIJ+00jGmMzmxNuD5gdS/6pe/YrDC7hWYHCY8oQM/ymCgxjwX4QLEENrLnnyLa3XZ+3xXzgp3wZeH7oJ5lhiZU2w3R2U/xXRGeju15jri6ya9sVExgH2Jh+MfTf3Dp6tP5xZtlYMcl1oW+TszcWs8BY9uFJ3gtsN0zPJLyOo7FjRO2eR/GwgoRg3jgQmII9UuwvhwkI49FJINztx1N2+785WVL4i1HAjCcCE7qaM53+oR4VJp4KMBmuAIhv00n/+5iAHDLjJJIxaFfkIlKyAAjxuJoKzFs1DwVd45ulmJkclbBqV7DoHPPunATEy4F8I8MMARv6idLyp8pRLT9MHaXIbQnfwxAy+xE7/FW0LGJU

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?cNDvZMxW+XOt2MGju7kM8P7tDIIxU5Un/s6ZmdubvP+TohD7gscIg0Q/fX?=

=?iso-8859-1?Q?vu4JPp5Xb4Vtsg44Vi40W+7p3e98PlNMAAWNh5Yze+dB1ozZSrFHcl0JXX?=

=?iso-8859-1?Q?8Cb1zsE+BkCSeWAHdwINqTaRQMCVaiciqSMNwMjkx2seMQij0xcGBPPKnX?=

=?iso-8859-1?Q?bSKLDh+TykgpxqjkhWR7xJ8yBFizTeTIGY2ZqF//68z36yrCIQY8jyCP4h?=

=?iso-8859-1?Q?CLoj5A86gQ6DMcG8216cMGdJhkoML7+bOmm7tY2VaeaG+QiOwxZAxcroDL?=

=?iso-8859-1?Q?OktTIKzdWjxmQTP8ULaUmcTmdeA8Kmgtr4DE8aSDprbAwYcVMS3ixa38+Y?=

=?iso-8859-1?Q?n371uRCqEklCkVtzI3gECnUko8yoQIxSTZx2nFrrh500s//5MXSgHRzt0P?=

=?iso-8859-1?Q?BjUZObBM09blx826NS3w0W3lXWE9BXP+VSPeZVjcMvIeyGvCJkb57UwXiA?=

=?iso-8859-1?Q?YyXxfLpreygNG7U3EI41YW6ZGmuOwH2c5nvKnYrMLpWkOeFEZ7zHJB/aUs?=

=?iso-8859-1?Q?zqpF6COaZC0VVWZg0P/bfCmZgpV2yjnGYyxM9G4oKTjukK4KCBNo6M20bc?=

=?iso-8859-1?Q?/2oGM86KPRwN52/8TfHnndNCGm6hqE/Qfl3PYlsZTnBCA/pkzs6B8CGIoN?=

=?iso-8859-1?Q?qy9KeJhtDVvX3JZVl+yra+3HlHGK9oHK4KlHaWDU1Rm+GY4sl+hh8OTyLD?=

=?iso-8859-1?Q?nalcYX+LWJsuw+Zbt1hjHpKzBjp11Rj3dx7SEBLgH+5bEc0C019RE2CyfG?=

=?iso-8859-1?Q?6MdXnmLkUusqACFJvH9jwjLa5nzqOVcV2x+LLN9GLZGqeoEqzDvP6oB0Qs?=

=?iso-8859-1?Q?/X/SHEHIVeC2lIvlTSQcPYyj3Itqx81wvFCf6RU65eQFWtOsW4zvzTpcvW?=

=?iso-8859-1?Q?NKDgkrXNb3+6jHrYSNf7DruqvitXbI1ouEJovMA4InyvgEmtfCpqXLce8W?=

=?iso-8859-1?Q?cgbqEwtz0+Tr8Uo2N4mjw5RbS0H+g3dvYqANhflQOzqlizoLakNc7FooSs?=

=?iso-8859-1?Q?Z1RVe+E8mc+m9CTtTyptuftkzINsjfSWqui5n+NHY4G8p4B0+cYVCtRWdQ?=

=?iso-8859-1?Q?mJF+rNsN6/yiP+qnku+sI4WJXgUu+IyW8owJvAsSO6VGerK3utpaACGscd?=

=?iso-8859-1?Q?tJGjTVp+rwuIjMCmsBlMmXHRsopYzZgx48L33HvCGjtttA0YEg9MyAdcme?=

=?iso-8859-1?Q?hi+UK3XhYpqcPX3Ifdv4bkVLMn8juAUq2A2erKlvEZTfRvdITNJSkQ5W2h?=

=?iso-8859-1?Q?spzkcw0nkjuHhj586gD36evkvXASrXRGZ4lB/ZGUmm6sznQfo4utLtrVWo?=

=?iso-8859-1?Q?nhtlVeJXnL9otG6GkQYoyzXXXA=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_VE1PR06MB70405774D5FD8AFD0A1C4847C36B9VE1PR06MB7040eurp_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-6e454.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: VE1PR06MB7040.eurprd06.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 3f00c4bc-e38a-4e49-3e17-08da7f6019e6

X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2022 08:19:55.3829

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR06MB2998

X-Spam_score: 9.5

X-Spam_score_int: 95

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ATTN -. MANAGING DIRECTOR Dear Sir, I am writing this letter

out of a genuine desperation to find a reliable partner in the unfolding

partnership in a transaction so profitable and simple.I seek your help, attention

and genuine co-opera [...]



Content analysis details: (9.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[dondonalddon[at]hotmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.4 MALFORMED_FREEMAIL Bad headers on message from free email

service

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 FREEMAIL_REPLY From and body contain different freemails

2.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} ATTN -. MANAGING DIRECTOR



--_000_VE1PR06MB70405774D5FD8AFD0A1C4847C36B9VE1PR06MB7040eurp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



ATTN -. MANAGING DIRECTOR



Dear Sir,



I am writing this letter out of a genuine desperation to find a reliable pa=

rtner in the unfolding partnership in a transaction so profitable and simpl=

e.I seek your help, attention and genuine co-operation to our mutual benefi=

t and I believe that you will not let down the trust and confidence I am ab=

out to repose on you.



MY NAME IS Shelten Neth.,I have been working in a public Relations firm tha=

t pays me about two hundred dollars each month.On the 30th of june 2019,our=

company made a very big financial breakthrough when we made contact with A=

LHAJI NADDAH (xi) and began to supply him his cow medicines. ALHAJI NADDAH =

(xi) is THE PRESIDENT OF AFRI DYNAMICS COMPANY FARMS) is a millionaire farm=

er with CATTLE FARMS in MALI, SENEGAL, GUINEA,BURKINA FASO, CHAD REP, and a=

new one located at SOUTH AFRICA.



Moreover, he is the greatest supplier of cattle beef and other dairy produc=

ts to the whole of West Africa.He has informed us about the huge amount of =

money he spends on the purchase of a particular but very important cattle m=

edicine. Precisely, he buys US$ 4,800 per carton.He asked if our organisati=

on can source for a cheaper supplier.We did market research and discovered =

that we can buy these medicines in Europe for US$2,000 per carton. We moved=

a proposal to ALHAJI NADDAH, to supply him at US$4,400 per carton which th=

ey accepted.As these supplies progressed and our company is doing fine,I re=

quested to my boss for an increase in our salary.he was so upset that he sa=

cked me without benefits and ten years of dedicated workmanship.



I was so desperate that I went to the ALHAJI and infomed ALHAJI NADDAH (XI)=

,that I have a foriegn contact that will be willing to supply him this same=

products at US$4,400. Per carton. ALHAJI NADDAH in turn confided to me tha=

t he is about to place order for two or three thousand cartons following a =

suspected outbreak of disease in his farms.I assured ALHAJI NADDAH that my =

foriegn contact will be in the position to manufacture and supply to him,in=

fact I convinced him that my former boss usually buy from my foriegn conta=

ct and that is why he sales to him at a higher price.



HOWEVER,I INFORMED ALHAJI NADDAH THAT HE WILL HAVE TO PAY CASH IN ADVANCE B=

EFORE MY FORIEGN CONTACT WILL SUPPLY TO HIM.For the moment he has stopped a=

ll contact with my boss.Please consider on how to handle this profitable pr=

oject and kindly contact me immediately for more details and negotiations a=

s regards my commission.However,I will insist that my commission will be 20=

% of the total profit.Note: We will buy two or three thousand cartons at US=

$2000. We sell to them at US$4,400 Dollars, our client pays cash before lif=

ting the goods.(They must not know our purchase point in Europe).



Thanks and God bless you.



Mr.Shelten Neth.

Email to:zimneth05@gmail.com



--_000_VE1PR06MB70405774D5FD8AFD0A1C4847C36B9VE1PR06MB7040eurp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

ATTN -. MANAGING DIRECTOR






Dear Sir,







I am writing this letter out of a genuine desperation to find a reliab=

le partner in the unfolding partnership in a transaction so profitable and =

simple.I seek your help, attention and genuine co-operation to our mutual b=

enefit and I believe that you will

not let down the trust and confidence I am about to repose on you.







MY NAME IS Shelten Neth.,I have been working in a public Relations fir=

m that pays me about two hundred dollars each month.On the 30th of june 201=

9,our company made a very big financial breakthrough when we made contact w=

ith ALHAJI NADDAH (xi) and began

to supply him his cow medicines. ALHAJI NADDAH (xi) is THE PRESIDENT OF AF=

RI DYNAMICS COMPANY FARMS) is a millionaire farmer with CATTLE FARMS in MAL=

I, SENEGAL, GUINEA,BURKINA FASO, CHAD REP, and a new one located at SOUTH A=

FRICA.







Moreover, he is the greatest supplier of cattle beef and other dairy p=

roducts to the whole of West Africa.He has informed us about the huge amoun=

t of money he spends on the purchase of a particular but very important cat=

tle medicine. Precisely, he buys

US$ 4,800 per carton.He asked if our organisation can source for a cheaper=

supplier.We did market research and discovered that we can buy these medic=

ines in Europe for US$2,000 per carton. We moved a proposal to ALHAJI NADDA=

H, to supply him at US$4,400 per

carton which they accepted.As these supplies progressed and our company is=

doing fine,I requested to my boss for an increase in our salary.he was so =

upset that he sacked me without benefits and ten years of dedicated workman=

ship.







I was so desperate that I went to the ALHAJI and infomed ALHAJI NADDAH=

(XI),that I have a foriegn contact that will be willing to supply him this=

same products at US$4,400. Per carton. ALHAJI NADDAH in turn confided to m=

e that he is about to place order

for two or three thousand cartons following a suspected outbreak of diseas=

e in his farms.I assured ALHAJI NADDAH that my foriegn contact will be in t=

he position to manufacture and supply to him,in fact I convinced him that m=

y former boss usually buy from my

foriegn contact and that is why he sales to him at a higher price.







HOWEVER,I INFORMED ALHAJI NADDAH THAT HE WILL HAVE TO PAY CASH IN ADVA=

NCE BEFORE MY FORIEGN CONTACT WILL SUPPLY TO HIM.For the moment he has stop=

ped all contact with my boss.Please consider on how to handle this profitab=

le project and kindly contact me

immediately for more details and negotiations as regards my commission.How=

ever,I will insist that my commission will be 20% of the total profit.Note:=

We will buy two or three thousand cartons at US$2000. We sell to them at U=

S$4,400 Dollars, our client pays

cash before lifting the goods.(They must not know our purchase point in Eu=

rope).







Thanks and God bless you.







Mr.Shelten Neth.


Email to:zimneth05@gmail.com










--_000_VE1PR06MB70405774D5FD8AFD0A1C4847C36B9VE1PR06MB7040eurp_--

SEO spam from Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 16 Aug 2022 06:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oNvsi-0006su-PM

for dave@doctor.nl2k.ab.ca;

Tue, 16 Aug 2022 06:41:16 -0600

Resent-From: The Doctor

Resent-Date: Tue, 16 Aug 2022 06:41:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qt1-f176.google.com ([209.85.160.176]:39697)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oNqTJ-000GHj-U0

for sales@nk.ca;

Tue, 16 Aug 2022 00:54:47 -0600

Received: by mail-qt1-f176.google.com with SMTP id s11so7487666qtx.6

for ; Mon, 15 Aug 2022 23:54:21 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version:from:to:cc;

bh=bJtksrI6/S9hYbDAOy7j/DYyJRxWOrOohUhQlez0YTE=;

b=Z6EekeacN2gOBVsc9X7YP/memsDNxk10nVFDc9sFO1Yg6CcS5//F/1eV/b/5+AQN5K

PYSRxM5nRzpCM5y5pH9r9pK7hVu2kbXWf5DMAvfzjN7XPjB9C1Q4OrxqLp1XIpXq+PxB

j033N2QRI/D4Kfa3kSp/LpKT3piTjjqukpWHOzj4jd8Cplt1mRzJOQLjfBSZMakEg0bJ

pMCRRMJ3P45fozq8EAz59zt0wltNZGHii/eC13cNq8+E52eNfsoGwRd0K8ANvJhB/tmV

THZhwAcMDrEHROJHdUbYBFDMPGuR8t/AOKi7VakQmUMJe8hb9hIF0COiyeMQIzpgkQxh

8I5Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version

:x-gm-message-state:from:to:cc;

bh=bJtksrI6/S9hYbDAOy7j/DYyJRxWOrOohUhQlez0YTE=;

b=kZq04ESqSqKsDiEX/DBF991uPp//tZd/DmAwiS77jwjAVPLpwVjmikyHTnTF1FLVOJ

NPrbxxjM+MT1OgvKev1L/ArGrgO/6e92IFQZoyev6owycnVhgRA0iyilVpXxeCV5PAdx

9Ux4cxljNMHv5Nqw1ENE5BQ2pTFVjQSBuR+U0nbxLzKpQTFLVuIOuWj0PXqKEuR2M3K9

J4KYMO0EvfBy1RCGoZCRVZ3I2uUx2ifnTl+Z3dNXpbdm9RRbU/B50Ln71XDeBMzMOrIL

KiVA2kAjhX6geQgG+SN2YL7xoCEtfzP30SvpthiKuSu/U2Y1EbjWrK+js8Lpg0wunrcs

4wrA==

X-Gm-Message-State: ACgBeo0tsxY36lDoIgT/SFMdSRHfmcQzuy2AOux5vycY3ZPgjgtUFFVB

MsP0c9N+/0MyAll9aIzgdA65f6jHnztA42ClUSSecDUZnXI=

X-Google-Smtp-Source: AA6agR66bi4M4RUwQBIj6+YQWztltyvAAFrdNFU3XQAvRtRedGTGdlJepIuMNHMFPj7cdej0bQFQC0MetVQyFf44Sfc=

X-Received: by 2002:a05:622a:34a:b0:343:6a5f:2f0 with SMTP id

r10-20020a05622a034a00b003436a5f02f0mr17499929qtw.238.1660632855511; Mon, 15

Aug 2022 23:54:15 -0700 (PDT)

Received: from 52669349336 named unknown by gmailapi.google.com with HTTPREST;

Mon, 15 Aug 2022 23:54:15 -0700

Received: from 52669349336 named unknown by gmailapi.google.com with HTTPREST;

Mon, 15 Aug 2022 23:54:13 -0700

MIME-Version: 1.0

Sender: Joseph Jeremy

From: Joseph Jeremy

Date: Mon, 15 Aug 2022 23:54:15 -0700

X-Google-Sender-Auth: J-vLFTKNgajRb-Cdzjt0lgMt2Mk

Message-ID:

Subject: Incredible Online Presence : nk.ca

To: Sales

Content-Type: multipart/alternative; boundary="0000000000007484ba05e656372c"



--0000000000007484ba05e656372c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello nk Team,



It=E2=80=99s a pleasure to be in touch with you.



Without a shadow of doubt you always want your website on top to attract

maximum business and we are second to none when it comes to delivering you

the best result. Given a chance we can share our ideas and implement new

approaches to achieve the desired goal.





There are some major factors which must be taken into consideration while

moving into online competition. Please find below some of the major points:





- Technically sound websites are always prioritized by Google.

- Proper selection and placement of keywords are important.

- More engagement on Social Media sites.

- Unique Contents makes a website noticeable.

- Understand Competitors strategy before implementing any change.



There=E2=80=99s been a lot to discuss for better results on your site as

traditional methods cause negative influence. Our Team can show you the

right direction and guidelines to overcome the flaws. Given consent I would

love to present a detailed analysis report on your website.





Should you need any further clarification, please do not hesitate to

contact us. Feel free to email us or provide us with your contact number

and the best time to call you. Once you revert we will get back to you from

our corporate ID.

















Joseph Jeremy



Digital Marketing Analyst



--------------------------------------------------



--0000000000007484ba05e656372c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




e-height:normal">Hello=

nk=C2=A0Team,=C2=A0





It=E2=80=99s a pleasure to be in touch with you.





Without a shadow of doubt you always want your website on top to attract

maximum business and we are second to none when it comes to delivering you =

the

best result. Given a chance we can share our ideas and implement new approa=

ches

to achieve the desired goal.





=




There are some major factors which must be taken into consideration while

moving into online competition. Please find below some of the major points:=

=C2=A0




  • >=C2=A0Technically sound websites are always prioritized by Google.
    <=

    /li>
  • =C2=A0Proper s=

    election and placement of keywords are important.

  • =3D"verdana, sans-serif" color=3D"#000000">=C2=A0More engagement on Social =

    Media sites.

  • 0000">=C2=A0Unique Contents makes a website noticeable.

  • t face=3D"verdana, sans-serif" color=3D"#000000">=C2=A0Understand Competito=

    rs strategy before implementing any change.


Normal" style=3D"margin-bottom:0.0001pt;line-height:normal">
erdana, sans-serif" color=3D"#000000">

There=E2=80=99s been a lot to discuss for better results on your site=C2=A0=

as

traditional methods cause negative influence.=C2=A0Our Team can show you th=

e

right direction and guidelines to overcome the flaws. Given consent=C2=A0I

would love to present a detailed analysis report on your website.
an>





=




Should you need any further clarification, please do not hesitate to contac=

t

us. Feel free to email us or provide us with your contact number and the be=

st

time to call you. Once you revert we will get back to you from our corporat=

e

ID.





=

=C2=A0
ont>





=






=






=

=C2=A0
ont>





=

=C2=A0
ont>






or=3D"#000000">Joseph Jeremy


ace=3D"verdana, sans-serif" color=3D"#000000">Digital

Marketing Analyst


a, sans-serif">---------------------------------=

-----------------





--0000000000007484ba05e656372c--

Nigerian Gmail spam

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Aug 2022 23:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oNovI-000OCi-FQ

for dave@doctor.nl2k.ab.ca;

Mon, 15 Aug 2022 23:15:28 -0600

Resent-From: The Doctor

Resent-Date: Mon, 15 Aug 2022 23:15:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wr1-f66.google.com ([209.85.221.66]:40798)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oNmrS-0009dJ-CI

for doctor@nl2k.ab.ca;

Mon, 15 Aug 2022 21:03:27 -0600

Received: by mail-wr1-f66.google.com with SMTP id bu15so2537075wrb.7

for ; Mon, 15 Aug 2022 20:03:02 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc;

bh=+gETPVq1/31XSt8TCJEtNNAvfeaHtQl6QlHGr7nBtW8=;

b=NuhiXIOLCnSnzXATmxt6ZyCi3jzdcAOxePnsVnfa8Cw70yB1vD+HH6rqU2sCGvGN6V

RU68QPGKaDGGomkJzQK2LvGCRSYzKTaw81v6cVaSNizsPt5CSXffWLZm4/F1otbt0Ze0

118EmlR0myVyqoqafzwLWD1/NG9ayxltnQtP1Ff9QEDMxEXg5xsnBeYsZxj38wYJcVtT

m7Tw1qvz4wc55Sx2u0v+NwfWZp6TSKFY0f5KrGqpNUyNVuNAtgoIC2ssAZT7GSVTpIQY

AlCGa6Rud/KV8OVj8QD/ablFR1Za5C3ixhld/wXI1HTRRwgeGY+NSbwCT/IWIWEfer7o

fvsg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc;

bh=+gETPVq1/31XSt8TCJEtNNAvfeaHtQl6QlHGr7nBtW8=;

b=eJKJ27aaT0IKFnVraxuNmpYL/AvvY6gVzT0idLO/wgXHyqwPErLHFEEtYIBzuQ4RTS

cmFZWxtyqGnHmVwR4B26a/6yZ1RI9PAEe8+sD+uHoIVbMr0YpStpKZE1y4r9nxfy6OmM

skzGPFs8YHtFZq25swyKc5YAKQzv3OBg7TC7rABQZhJ/LLCAY02AdC0RWKbYHUo7BAJE

rkRyyUxE2OmAdDZTQqcIAkpdtoC5YzSuU7liAZQ0/in+2AzG6xto9/NytTTzHKtgF0nZ

Q0knovfUvh8vUhjeZhgzUFP3P+DG9u0/4jXfLUsvUxqmZZ361XIcXAvpr6tjjmxUWIHe

Bg2g==

X-Gm-Message-State: ACgBeo2101MQZkhC1K4UvEp5Duy4yj9z6RWq8bx1mRcN7WgUGILasg80

elF9RIyFbsJsDcQ+xWTAKXWnvBoQXApBmkq4jmw=

X-Google-Smtp-Source: AA6agR4rOwwEWXXKIugeX1O1yWT/OVp9YQ8UeNWknsUYb8CRcLNnMwS8WBxw2ibrEB9YtZnjVa6zxjGZEpZLLTvCtbk=

X-Received: by 2002:a5d:60d0:0:b0:220:4e23:9934 with SMTP id

x16-20020a5d60d0000000b002204e239934mr10127231wrt.474.1660618975234; Mon, 15

Aug 2022 20:02:55 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:6000:1846:0:0:0:0 with HTTP; Mon, 15 Aug 2022 20:02:54

-0700 (PDT)

Reply-To: fotisangelos3@gmail.com

From: "Fotis Angelos (GCP.)"

Date: Tue, 16 Aug 2022 04:02:54 +0100

Message-ID:

Subject: VERY URGENT.

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 23.2

X-Spam_score_int: 232

X-Spam_bar: +++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Good day to you. I am Mr. Fotis Angelos and a personal Accountant

Director of National bank of Greece. It is with a good spirit of heart that

I opened up this great opportunity to you. A deceased client of mine that

s [...]



Content analysis details: (23.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.66 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[jeangomez385[at]gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[jeangomez385[at]gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[fotisangelos3[at]gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 MILLION_USD BODY: Talks about millions of dollars

2.5 HK_SCAM_N2 BODY: No description available.

0.1 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 HK_SCAM No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.7 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 XFER_LOTSA_MONEY Transfer a lot of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal

information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

Subject: {SPAM?} VERY URGENT.



Good day to you.



I am Mr. Fotis Angelos and a personal Accountant Director of National

bank of Greece. It is with a good spirit of heart that I opened up

this great opportunity to you. A deceased client of mine that shares

almost the same name as yours died as a result of heart-related

condition on march 2015, He died due to the death of the members of

his family in the plane crash disaster on the 8th of March 2014 in

Malaysia where they all lost their lives. You can read the website

below.



https://www.bbc.com/news/business-59517821



There is a draft account opened in my bank in 1999 by the deceased. He

was a CEO/a textile company owner, business man, a miner at Halkidiki

Peninsula mining company here in Greece. He was a geologist and

consultant to several other mining conglomerates operating in Greece,

China, Taiwan, Japan, Indonesia, Pakistan, Vietnam all in Asia.

Before he passed away on 12th march 2015 he had nobody as the next of

kin to his Bank account.



The amount in this account is currently $19,500,000 (Nineteen Million

Five Hundred Thousand United States Dollars) I want to present you as

his beneficiary/next of kin, I will use my position and influence in

our bank to make them release this money to you for us to share.



Let me know if you are interested in working with me by sending your

full name, Mobile telephone and fax number. As soon as I hear from

you, I will direct you on what to do next.



Best Regards,

Mr. Fotis Angelos.