Leads spam from Hotmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 18 Aug 2022 14:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOlpw-000BGy-Qh

for dave@doctor.nl2k.ab.ca;

Thu, 18 Aug 2022 14:09:52 -0600

Resent-From: The Doctor

Resent-Date: Thu, 18 Aug 2022 14:09:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-maxind01on2124.outbound.protection.outlook.com ([40.107.222.124]:56426 helo=IND01-MAX-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOhJK-000M9d-Ky

for sales@nk.ca;

Thu, 18 Aug 2022 09:19:59 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=lZxIIc32t1lRKLGS+C7bX9XyHG07qM7yrmWYQ+hpux/GNgq2MXht8KLon2GPwL4FBC4BD2IVv5/sgjEE+L3imoTwo05fka1iM32veCD2msM8XR0G4+bf5eWYpJLEAUzNEpTK8ZzWsdWJQzOQqWDwA21k+VK19IiHkdd08mOqXLhODgjHd8bMqA7ihUzx3xtfcgGsSe1T3Ba/zVESmdfH0yfh/xKCWMxaYSMFdGRTT7jDlw2ydmfTk1wpSGMJ7ricRL/UOyuUJAEI/jXQ3pYz4z6nvKk7/61+bLLlItECJebBPhTy5lolqX/pyY57LtnE1DKSFjSdLDgvpgRGZ44nVQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=hImPePHoo6kfLa7mi3sE302zX69N5KhRZgJZHn0o+Kg=;

b=FBCxR/s+tipjl82+uBQ4oZ7KMGMfRYJP/D6CFh1ZqoE8nKnHqYmCDY/QYyPjEN471DnjBThJ0eLE5fqG8TFlCoMw28O0KcNiaQnOVVO/Pwpuh7dJvvW+lH+7iNC9z64PbrL36WpigAbYcJOaXmmSO2BSgRhXHvRTnJa1v7nhqAgm9FTvlj9rmzYg1r8t164eMb0PP+1SbHHZAKj32gNdG0sbxtaLrE1LliPWuWkS6FSl3kX5PMTOR31VILG2PardQllQ5P/i3Fn0Xlye59wLDhNzHriSg/hHULyfM4/16W+ff8HMmMm8Hkz1vxYYDSKtD77wnirlCbmvaeSgoW0twA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=datasolutionusa.com; dmarc=pass action=none

header.from=datasolutionusa.com; dkim=pass header.d=datasolutionusa.com;

arc=none

Received: from MA1PR01MB2857.INDPRD01.PROD.OUTLOOK.COM (2603:1096:a00:39::20)

by PN2PR01MB4793.INDPRD01.PROD.OUTLOOK.COM (2603:1096:c01:29::14) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5504.20; Thu, 18 Aug

2022 15:19:28 +0000

Received: from MA1PR01MB2857.INDPRD01.PROD.OUTLOOK.COM

([fe80::3d85:e78f:45e4:ff93]) by MA1PR01MB2857.INDPRD01.PROD.OUTLOOK.COM

([fe80::3d85:e78f:45e4:ff93%2]) with mapi id 15.20.5504.022; Thu, 18 Aug 2022

15:19:28 +0000

From: Nancy Ward

To: "sales@nk.ca"

Subject: Re: Leads

Thread-Topic: Re: Leads

Thread-Index: AdizFbJPY2VH7DzTQpSctl35JAvWoQ==

Date: Thu, 18 Aug 2022 15:18:04 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

authentication-results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=datasolutionusa.com;

x-ms-publictraffictype: Email

x-ms-office365-filtering-correlation-id: 2a42536b-f1a9-4ea8-87d2-08da812d0add

x-ms-traffictypediagnostic: PN2PR01MB4793:EE_

x-ms-exchange-senderadcheck: 1

x-ms-exchange-antispam-relay: 0

x-microsoft-antispam: BCL:0;

x-microsoft-antispam-message-info:

pLEnVLJa+mcrIdYzXRaVYZ/Hb+uDVFbhC+fvpLmsEQgvUcDOWyEtWJ/1sXnY0rDO3HJc3S7lx9WIJoqJGvkkW5NU1Vbd00JD+Y+wKauETJICu1AG+ApttMMv2y22XwpFRsT8ukTOJDJzrQvOz9fWZdvfxON2JlIHBkN7IjQnjhyw8NL8bTDCUYC8HxQYvPtdmxVNrzvP/1DAtk3EH952LHKQyhxiSxwWbFCjNSRh39/7IfdMGlXOFxxCX9DXA8sJNrC297wIefmfHTxwUlhaXlW/dSpOfTYE8T2/05AI5ggCQP1k3OMOkim+/YCqTiQ6zcXkrfePhljCW1mDG5FWT20WAjkRgXMQYbwcYEzyRM6jRuhworccVoC0Jf53hqOyOXKYGzp/wXqfNH9cWlVdOu5q8BuJsK9BifFQMQU8Uzh9VuK64SydeeJ1x5L+9heyiTq/NpUydcaib6CW2D9AUizVYg9o0hPcHvIQ2uP9Ok+5oeuL1PJiZ6660QRm+lHyG73RLvTKDvSkxAJ0yslNMS+bciPi/r36whwXgicbUFM3MTe7AAasxy17Ii/Hf8aoLB6baQPS4npsLNIK3hw+1N4JVYiqewj66IABL8Yl4ov+oFqIJmOSh7kwxJBghXHCMf+2QpFrnhRvSYbHnKPzD2ZIBF34TopuZJnl4cKcIq5SPfJClKxJY7VHOCBInJHkE2TAXkWaN8YI+hCe3s9+VRVmxcI5+d4rCkNN/+w33xB4xPReGr6iwmbtlPbnv2N5Fr5SQqezC7PMbbWaInJAsQ==

x-forefront-antispam-report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MA1PR01MB2857.INDPRD01.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230016)(34096005)(136003)(376002)(396003)(39850400004)(346002)(366004)(448600002)(122000001)(38100700002)(55016003)(38070700005)(3480700007)(83380400001)(6916009)(6666004)(44832011)(4744005)(41300700001)(5660300002)(52536014)(38610400001)(33656002)(64756008)(71200400001)(186003)(2906002)(9686003)(586005)(4743002)(7116003)(26005)(76116006)(8936002)(86362001)(7696005)(6506007)(66946007)(66556008)(66476007)(66446008)(8676002)(20850200004);DIR:OUT;SFP:1102;

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?us-ascii?Q?izcogEQxF6ezBK2HhdUwttn1I0dfERxpVgSIJ9LPr3adT5pTn5/MfbQYIBET?=

=?us-ascii?Q?t1DGy+m8Wzq0DToIiIH5KnORpMSvqZUSRdwbNVO2T/Jueu6sGu4hyyZiC05Z?=

=?us-ascii?Q?sSMHp7V4k91XRi09VPNr26nQTM6eSglFbspnkVo7YNrfUPfJ+yKa9fjHQGl/?=

=?us-ascii?Q?u7Is2xTq2GSpnmSbvZFxLeDwmKmgqSMjs90+qfXg1MSO35n02NeSfocEXK6M?=

=?us-ascii?Q?Pls3iHFqlg+D2Q6EFyWkVtCPArAZfOMD/9BsAe8sxiakaC87LXJAGbslkbCg?=

=?us-ascii?Q?H3IIiSW9gto4hxPvhon544XrDlvHR6lzfi929hjsDb3hoJvoz1rusJqNrFYY?=

=?us-ascii?Q?rgmEJsXeIKwoJvOoTvIU1HJnc3YuVMTNZJDgTBbIYF59gCIWkSIdO+QSSy3O?=

=?us-ascii?Q?qa5/eEc8r9a/D5cEP7E0qq+UQA7hxP+cYvm23DAKzU/oYavVMQzmU696Gx9Z?=

=?us-ascii?Q?ThOca49xlTV9zPpPVyDf24rr3esGjkLz8yaxbZ8MJG2EK/Z2AREofMqrcgSa?=

=?us-ascii?Q?wSaf69YAX9nT60Plt9R6lR+u+vyeIJJFpvFsqzCdj+8RWnqfiA4r8+3O/3/L?=

=?us-ascii?Q?/WbSf3EsAXRMCtSFfDaMbf99Y7lIoq+PgAOAcg9Ksug5aKRO/puWuNFukfHy?=

=?us-ascii?Q?g/1JRe2Mac+rDom1pi5nfDDRX2GLlBu0hx7wEKy+Inst66pb4N1uDDD5Sc5v?=

=?us-ascii?Q?MD3dXba5xwInz9tYzwuMyhnehFnig7ljz6PL7OHWZ/KRxbevHfvga43RLLkD?=

=?us-ascii?Q?L3hq5VzqtvIugEQ8sBM1Sx2cRi//yDtEgPvnSN3kB8HwmTYiERvZqyv4AUwb?=

=?us-ascii?Q?IldShRSeTIDkkAxxK8uraj+FXonJE/c4Yo+hmYvdK5bfR3n97Qn1OrWXSEyV?=

=?us-ascii?Q?3/gv2TQn2q2F4HRRJ1rjWiodKyc5bf6KwL//rXkRIkMWvBdJcWcVg/XgPV3I?=

=?us-ascii?Q?WybvSOxXB/O1HAV/J7bgSD1hIJ1HTSGDVSAvgRYc/yn4CZs+bUvv2fukVt0D?=

=?us-ascii?Q?AlZqH0r6uRLufzhTb5LAyHL8kzZx0jOgl3yMI2HEH3P2kKUxnJUh6DF1vgR6?=

=?us-ascii?Q?zocLsXG4g0OtKgRlq1ZbImWjEJFUKAJm4viGCM1Dlo0T7fRfPvx344ip2h5Y?=

=?us-ascii?Q?6mbRcnY19Pjw8zhhFePnmzkP3eeYsdWAFX5i9ZYXbUin4IgWHJMtg/j7ZZYc?=

=?us-ascii?Q?zb/sdO7k4H2IGhLy1Ig+rFauKCreE7Q9bd8+ibOUSrh6Cve+WLY7oxC10FhP?=

=?us-ascii?Q?JW0kqmp0+yfbGZuXjQjcgUue57xIi4vylyAYQsd2mdoLE6xEKsFQ6FVv8P28?=

=?us-ascii?Q?A3IoWQ/hGrga0a6Q1y/JoJfkS+BeLom7RNs7pmpquUauNkJIzwg5lsIJ91ST?=

=?us-ascii?Q?WBpq0mY3aIzy5B7jDpjT249Wv+F42JLzktacNu4AeJAb6kkwMmahOrCyfL3A?=

=?us-ascii?Q?CvIC4qo2p8wLUSvREW5FHMxpz1IB8rDPo0bbOBKZJbwJSOy6MzoTXil29aph?=

=?us-ascii?Q?sQJ4G4C0BprsYo5X/gD9ujN/nYSnigurCLa1cSXM/jslGehJrPSi5pdkMVo4?=

=?us-ascii?Q?W+eQtipoF3vyjf8VpORKwW1QlORiGbDUR3lztUOwGQeznf2IXKl+tc5m0pDf?=

=?us-ascii?Q?qg=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_MA1PR01MB285709DCC9543313C8E0FFBB8E6D9MA1PR01MB2857INDP_"

MIME-Version: 1.0

X-OriginatorOrg: datasolutionusa.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: MA1PR01MB2857.INDPRD01.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-Network-Message-Id: 2a42536b-f1a9-4ea8-87d2-08da812d0add

X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Aug 2022 15:18:04.5488

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: ec36d058-c405-45f7-8d0c-dafd72eec12b

X-MS-Exchange-CrossTenant-mailboxtype: HOSTED

X-MS-Exchange-CrossTenant-userprincipalname: VNV9WUMykzWHGiXK8uVaqUEgjDrEtR5vX29lzsAD/StZx15ztPEQuPjwLVXXIdcNlKvE9pGSvgWrsk8xMfxrvvAX/oEotdqo/vtQIaoHD2g=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PN2PR01MB4793



--_000_MA1PR01MB285709DCC9543313C8E0FFBB8E6D9MA1PR01MB2857INDP_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Hello,



I'm following up on my previous email to check if you would be interested i=

n procuring the email list of Hospitals, Doctors, Clinics, Hospital executi=

ves, Laboratories, Research Centers, Nurses, Specialists etc.?



If yes, please let me know your target criteria along with the geography, s=

o that we can get back to you with updated counts, few samples and more inf=

ormation on our list.



Thanks, and regards

Nancy Ward

To remove from this mailing: reply with subject line as " LEAVE US."





--_000_MA1PR01MB285709DCC9543313C8E0FFBB8E6D9MA1PR01MB2857INDP_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">




>












:"Cambria",serif">Hello,




le=3D"font-family:"Cambria",serif"> 
>




=3D"_Hlk111453497">I&=

#8217;m following up on my previous email to


"font-family:"Cambria",serif">check if you would be interested in=

procuring the email list of

Hospitals, Doctors, Clinics, Hospital executives, Laboratories, Research=

Centers, Nurses, Specialists etc.?




le=3D"font-family:"Cambria",serif"> 
>




le=3D"font-family:"Cambria",serif">If yes, please let me know you=

r target criteria along with the geography, so that we can get back to you =

with updated counts, few samples and more information

on our list.




le=3D"font-family:"Cambria",serif"> 
>




le=3D"font-family:"Cambria",serif">Thanks, and regards




le=3D"font-family:"Cambria",serif">Nancy Ward    &=

nbsp;           




rk:_Hlk111445195">
uot;,sans-serif;color:gray">To remove from this mailing: reply with subject=

line as " LEAVE US."
lk111445195">
",sans-serif;color:#222222">



 











--_000_MA1PR01MB285709DCC9543313C8E0FFBB8E6D9MA1PR01MB2857INDP_--

Donation spam from gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 18 Aug 2022 14:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOlpg-000BFl-SG

for dave@doctor.nl2k.ab.ca;

Thu, 18 Aug 2022 14:09:36 -0600

Resent-From: The Doctor

Resent-Date: Thu, 18 Aug 2022 14:09:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-io1-f50.google.com ([209.85.166.50]:34526)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOh9m-000LHk-6r

for doctor@nl2k.ab.ca;

Thu, 18 Aug 2022 09:10:05 -0600

Received: by mail-io1-f50.google.com with SMTP id x64so1304595iof.1

for ; Thu, 18 Aug 2022 08:09:44 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version:from:to:cc;

bh=fq/FMo3N2YZ5gAL5l22vJq0j+A2OZhZuCvLwNurrkgc=;

b=hE2tyEoqtgPhcee3RMUbAXWocsFr6zWX0Tre6aOJS6cdWjsieRkGfQyRFSDp6zdUVe

LdokgfeTJ/hTlXe+pfW3pAnGn9kPQvm7q8WRiV42vgyRUKi8dYkgeilDpOFYAuikWCG5

SSxlWRUwqJU4hXo1u4tSZ8MLgLR+0mzW28kA/IWyCv8JIstdruyXozKb5+qs39OM8oj7

mndA0BVN+jbRwrjsPNHrMcVLrbjs+o0ie64mlXJQbrF6Prhw/N9me4dnFldO/8IgELNe

ih3xWS1d1lVGcTc8GI5WpOo31OpX22VUQcrGpX03NmS6TnpXBt4ASHEBs9lpeljEtKZL

kjXA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version

:x-gm-message-state:from:to:cc;

bh=fq/FMo3N2YZ5gAL5l22vJq0j+A2OZhZuCvLwNurrkgc=;

b=zGTJjrtzIItO9JXnG3ULrkbwtfR1kNyO2q2ORtaHpPICDNc1cz86QR+NTXxiyfRixu

x1rzFUdC/ltJgP5g4yEUhf/y+XPiLqGsP0ytWuLlSGGWloiIlo109eGgJoAleCkIG+A9

tkzFIgM5glERLHS6gL/AMwez0dRxIbVaEOTB0tlgF94EMrDODpftKGx8EfbnVMt/CknZ

pZ/oeIRqZ2o0QATo0w0u3rw47tHlN1P7gjoGcxz4K0d8aPCSuUzAvV7eI3A5NqLDhIfo

qn4NEYx2iESEbWkdGJjtqww0u3f9NwWx6+KjZvDsxHJ2KQuSAH40wSb0X4MobeYhsIwz

JaWg==

X-Gm-Message-State: ACgBeo1H/33CXjPhIXiONfDOIkenhboUOiP8nBymDEs9lE2a6DrwIs3m

HWBUQoEII8XB+WG49uYg8KdJCBYhkWZsM0DcHp4=

X-Google-Smtp-Source: AA6agR7oeUNpeoXSgy6tfzLE37RkkXWMAHrNUfq3cBJ4fL+ozy+1fRP7J+dZtp7ukFi0k7Tkh7oxb4nPylAQBXaUtvU=

X-Received: by 2002:a05:6638:14c5:b0:343:4296:3d28 with SMTP id

l5-20020a05663814c500b0034342963d28mr1612332jak.36.1660835378514; Thu, 18 Aug

2022 08:09:38 -0700 (PDT)

MIME-Version: 1.0

Sender: elizabeth.hoisington2@gmail.com

Received: by 2002:a05:6e02:681:0:0:0:0 with HTTP; Thu, 18 Aug 2022 08:09:37

-0700 (PDT)

From: "Mrs Yu. Ging Yunnan"

Date: Thu, 18 Aug 2022 15:09:37 +0000

X-Google-Sender-Auth: xFxwNMMEmOLqIsB1jWMINXUscfs

Message-ID:

Subject: hello dear

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: hello I am Mrs Yu. Ging Yunnan, and i have Covid-19 and the

doctor said I will not survive it because all vaccines has been given to

me but to no avian, am a China woman but I base here in France because am

married here and I have no child for my late husband and now am a widow.



Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.166.50 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[elizabeth.hoisington2[at]gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[elizabeth.hoisington2[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 MILLION_USD BODY: Talks about millions of dollars

1.5 HK_NAME_FM_MR_MRS No description available.

0.0 T_HK_NAME_FM_MR_MRS No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} hello dear



hello

I am Mrs Yu. Ging Yunnan, and i have Covid-19 and the doctor said I

will not survive it because all vaccines has been given to me but to

no avian, am a China



woman but I base here in France because am married here and I have no

child for my late husband and now am a widow.



My reason of communicating you is that i have $9.2million USD which

was deposited in BNP Paribas Bank here in France by my late husband

which am the next of



kin to and I want you to stand as the beneficiary for the claim now

that am about to end my race according to my doctor.



I will want you to use the fund to build an orphanage home in my name

there in your country, please kindly reply to this message urgently if

willing to handle this project.



Mrs Yu. Ging Yunnan.

CRedit link phish from Amazon

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 18 Aug 2022 14:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOlpU-000BEb-IX

for dave@doctor.nl2k.ab.ca;

Thu, 18 Aug 2022 14:09:24 -0600

Resent-From: The Doctor

Resent-Date: Thu, 18 Aug 2022 14:09:24 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from b224-14.smtp-out.eu-central-1.amazonses.com ([69.169.224.14]:45981)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from <01070182b16f64ac-c3b6d33d-8595-4be4-a04d-07e45e9ace04-000000@mailout-ses.dreimann.net>)

id 1oOgrY-000JbX-HO

for root@nk.ca;

Thu, 18 Aug 2022 08:51:16 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=hduf2vvbwixozlk4qcqaet765lv6bsqi; d=dreimann.net; t=1660834243;

h=To:Date:From:Subject:Message-ID:MIME-Version:Content-Transfer-Encoding:Content-Type:List-ID;

bh=We4AKjip1+N50Oy+IFJxmaV2ZerpePU+sojPEnOOYJM=;

b=O6IVj4abWIxtgO34uJpVU30Q1HfmO0WHqS8pbZiWbxGxl9HBNgnz80uhQdx922v6

OlHGgwwh0CVzedfa0+0BGzdyS5OmdGiJcx59fPUfBdkH1L/Hk8BCWzHU0Ir43k0p4Jg

2VY6OSeAOq/llN8D2rfi8Uyhk3z7zEYxGgpMgjPrPs3e687+CVPnCZi9lJN6GBunsVt

dgoUb+CXs1v+dL1Buv+9olorCUXR18VkDv506Y+JtRol4WdK6ptdOtuviRzJ+OjVZim

HsxI4Hw+9e5oB+3RpZvdY7X25slnXgkSvaqZ+YvtDxGK4i5zrOznpjFNy0g8kanCf2r

cts0TG4ChA==

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=54ecsf3zk7z4mwxwwox7z7bg6e5gwjsz; d=amazonses.com; t=1660834243;

h=To:Date:From:Subject:Message-ID:MIME-Version:Content-Transfer-Encoding:Content-Type:List-ID:Feedback-ID;

bh=We4AKjip1+N50Oy+IFJxmaV2ZerpePU+sojPEnOOYJM=;

b=AhMyYyQjhTG8qsi9s/Kd72f0F8HQeIRw9lBcgO8mZ3iXCHKQb2qkha8zMWoHSXBx

L9Wg5sbzapga6QjP7pmcA7X/+aVDg2Yjt7rSd3S0T6+ULZS1ttNg4OMnpZ061laI+mV

q3dUVFkHWUPzyNvZyTJ41wCV+GG3YuSMhGSlLqQc=

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dreimann.net;

s=mail2016021301; t=1660834241;

h=from:from:reply-to:subject:subject:date:date:message-id:message-id:

to:to:cc:mime-version:mime-version:content-type:content-type:

content-transfer-encoding:content-transfer-encoding:list-id;

bh=We4AKjip1+N50Oy+IFJxmaV2ZerpePU+sojPEnOOYJM=;

b=ABIsT/RnpswI9lghnqUG57coJyJwEO4WUvUqd0HFvu4Ba6ExaeZItWVo2OMXQg6ps4GP3X

be2jrl41j3ELOQNXdtpgDfR2IIdls9D93y06EiaSefltE3b4qSs3/ZTTKn/v2t5AqQ/Kty

U9xvFVwyOajYMIjWnyDqvm26ej8qug9dLtRyp46Gbfl3sO89lVgpbp2S8uJH3Ah5Ux3cZh

MfA/8j3mnjLd2piWF0WAFyhPMYpHSwDzC4P4LiBrn3DS41oYLpcPOjYP3a8TOLD5uWPejc

Udx7Htge/0e+GeZyD/8fBasK0zjJcAJEIhKXGLrP6FSmE5x4lSKnEFyG9Z2cfuoWsteeiD

hNOGRKCqtbKdVoqVeeQqdmZAahFL1nWqCGkcTrMpTuc+m9LQ8E08vcsoD8UDw++kHQqAB5

CbhBo5lENqEfbCVqR5mNf30zLPGAIuAJcIQXQUI8TqICkeB2NeeCxLaGcsg5UBkcAX9SDE

F4fJMmdNyv44w3vUrF+rjU4TyEDI9dxaEnmFHUIZk7lDJe/qu0hgcjol2WwQPvk/xdnHWo

pMnZfkH3nsDTrIFh2fxgazQw/NQyJJC/uvIUqD18t34Wnn7tGL6aJ37V8FKN/vxCpOnUq5

JJcvXa9+swymO8SipcvpXJ6qGyV9umuIokB/+KuBnBq2sVv15v7lg=

To:

Date: Thu, 18 Aug 2022 14:50:43 +0000

From: "Credit Manager"

Subject: Copy of the contract.

Message-ID: <01070182b16f64ac-c3b6d33d-8595-4be4-a04d-07e45e9ace04-000000@eu-central-1.amazonses.com>

MIME-Version: 1.0

Content-Transfer-Encoding: base64

Content-Type: text/plain; charset=UTF-8

X-rpcampaign: 07730-(93662120

List-Issue: NO

List-ID: x_78759351:x_04909:personal:dreimann.net

Feedback-ID: 1.eu-central-1.ivh71NtaoJZZ1GljfwUMZ7/BYavLah20QgFqzcrMPjs=:AmazonSES

X-SES-Outgoing: 2022.08.18-69.169.224.14



QmVsb3cgdGhlIHNpZ25lZCBjcmVkaXQgZG9jdW1lbnRzLgpQbGVhc2UgY2hlY2sgeW91ciBkb2N1

bWVudCwgYWxsIGlzIHdlbGwKCmh0dHA6Ly9zaGFyZWRmaWxlLWlkMzM5NDI0OS40NzM4OTU4NzQ4

LWlkLmNsdWIvP2NhMTg9MTYzNmUyYjZlNjA0NDdmNmY2Mjc=

Nigerian claim spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 18 Aug 2022 07:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOfIh-000JcW-By

for dave@doctor.nl2k.ab.ca;

Thu, 18 Aug 2022 07:11:07 -0600

Resent-From: The Doctor

Resent-Date: Thu, 18 Aug 2022 07:11:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f179.google.com ([209.85.128.179]:46960)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOdMv-000Geg-Rs

for doctor@doctor.nl2k.ab.ca;

Thu, 18 Aug 2022 05:07:26 -0600

Received: by mail-yw1-f179.google.com with SMTP id 00721157ae682-31f445bd486so30827107b3.13

for ; Thu, 18 Aug 2022 04:07:04 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=content-transfer-encoding:to:subject:message-id:date:from:reply-to

:mime-version:from:to:cc;

bh=8gNr7rgvzp12gCtVFJ/tOq/YgmtELRGTjodDRR9bQNA=;

b=Zi+A628qBWZaqvwesxMATyUKtV19XST8WNctDAaxjcpARk7PO3JPHO5KuJUIrOB1sR

KxmlWbTiOu7B+HYt/v25wtwIEG/Nwv54stwA1Uh5lnYLMJDOyxrs/pOUTVtIQOwN6k62

MtkUob4S2/MGJEP3GlqaHwbzs9e9ANXp9k/LQy5drxfZ0C0sCGTFcQFVMUvpZXDc+ce3

4qILVuxKW7kUGufx11nEC1qUWkRJWykoHgDYDY786VLEo2AZTkb4UQ+HqRCLvn+Df9d4

ckBlG//VOyXHgoQTDLiU2MRhjtpspKUdDjf1dYHQcntzrdzPQHxge6ynFq6MG6i9Xosq

rvYw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=content-transfer-encoding:to:subject:message-id:date:from:reply-to

:mime-version:x-gm-message-state:from:to:cc;

bh=8gNr7rgvzp12gCtVFJ/tOq/YgmtELRGTjodDRR9bQNA=;

b=Ur3oojxHt0PFlf96J8srzthli2oc6arhCLTdEeOruzeu7v8Wdff/czawBLneMTyGzh

IJh/oyj1dBh4gJ3gLtzYwt2wiLkD75Kthp4kjSgz2pCqvOEoi12CEWO/Wq5iDtBHq1K7

FSiVDYo5vbL003436zt2KtGLvCtdMt9xI3kzJvps+XZ2DGpULwFe9S5dXv7r2PtI4Wn5

pkxiiW8Fx9qC0ou2DEsdyEcYF/0lElJ2wPAulrNel5MiaNhnmtPWClCbo14tqUA90WwY

OedZ8Gh7AXSHCtSZ2waSmKLTHGSic3iPOec/Axtm/EhXaVkp2CEVIq2rkQNCaiqRbQ8Z

kTdA==

X-Gm-Message-State: ACgBeo0FRXR9ov7dOLXtcjigc1uABWYvvGG2sZ0FoD+lXY4ZrhLe2yD7

1lrTSLM8s2GGJkkGyQsdaPtalt7N2xb8/FYduys=

X-Google-Smtp-Source: AA6agR4wSJmNZ15aXC9BjRbX2SCTAu8HlRy2f//G/bFV0qUIKO0ryAHwPNdsDzfux5f3R/HStfASC1q6GDeI6UUfs2M=

X-Received: by 2002:a0d:cc0f:0:b0:334:c52e:83c4 with SMTP id

o15-20020a0dcc0f000000b00334c52e83c4mr2171134ywd.324.1660820818493; Thu, 18

Aug 2022 04:06:58 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a25:4ed5:0:0:0:0:0 with HTTP; Thu, 18 Aug 2022 04:06:57

-0700 (PDT)

Reply-To: juliebannie1901@yahoo.com

From: julie bannie

Date: Wed, 17 Aug 2022 23:06:57 -1200

Message-ID:

Subject: HELLO DEAR

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: base64

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 13.2

X-Spam_score_int: 132

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, I hope that this mail reach you in good health, please do not be upset

with my mail and if you find it not interested please delete it and

ignore it as i do not mean [...]



Content analysis details: (13.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.179 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[mbodjndeye51[at]gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[mbodjndeye51[at]gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[juliebannie1901[at]yahoo.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.7 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} HELLO DEAR



SGVsbG8sDQoNCknCoGhvcGXCoHRoYXTCoHRoaXPCoG1haWzCoHJlYWNowqB5b3XCoGluwqBnb29k

wqBoZWFsdGgswqBwbGVhc2XCoGRvwqBub3TCoGJlwqB1cHNldA0Kd2l0aMKgbXnCoG1haWzCoGFu

ZMKgaWbCoHlvdcKgZmluZMKgaXTCoG5vdMKgaW50ZXJlc3RlZMKgcGxlYXNlwqBkZWxldGXCoGl0

wqBhbmQNCmlnbm9yZcKgaXTCoGFzwqBpwqBkb8Kgbm90wqBtZWFuwqB0b8Kgb2ZmZW5kwqB5b3XC

oGluwqBhbnl3YXkuwqBJwqBhbcKgTXPCoEp1bGllDQpCZW5uaWUswqBJwqBhbcKgd29ya2luZ8Kg

YXPCoGF1ZGl0aW5nL2ZpbmFuY2XCoGRlcGFydG1lbnTCoG9wZXJhdGluZ8KgaW7CoG9uZQ0Kb2bC

oHRoZcKgbGVhZGluZ8KgYmFua8KgaGVyZcKgaW7CoFNlbmVnYWwswqBhbmTCoEnCoHdhbnTCoHRv

wqBpbmZvcm3CoHlvdcKgdGhhdMKgYW4NCmFtb3VudMKgb2bCoFVTJDYsMDAwLjAwMMKgTWlsbGlv

bsKgd2lsbA0KYmXCoG1vdmVkwqBvbsKgeW91csKgbmFtZcKgYXPCoHRoZcKgRm9yZWlnbsKgQnVz

aW5lc3PCoFBhcnRuZXLCoHRvwqBvdXLCoGxhdGUNCmRlY2Vhc2VkwqBjdXN0b21lcsKgTXLCoFdh

bGVlZMKgSGF6YWHCoFNhbGltLMKgScKgbmVlZMKgeW91csKgcGFydG5lcnNoaXDCoHRvDQpyZWNl

aXZlwqB0aGlzwqBtb25lecKgYXPCoHdlwqBzaGFsbMKgc2hhcmXCoHRoZcKgbW9uZXnCoGluwqB0

aGXCoHJhdGlvwqBvZsKgNDIvNTglLg0KWW91wqB3aWxswqByZWNlaXZlwqB0aGlzwqBhbW91bnTC

oHRocm91Z2jCoERpcGxvbWF0aWPCoG1lYW5zwqBvcsKgdGhyb3VnaMKgYmFuaw0KdG/CoGJhbmvC

oHRyYW5zZmVyLg0KDQppwqB3b3VsZMKgbGlrZcKgYWJzb2x1dGXCoGNvbmZpZGVudGlhbGl0ecKg

YW5kwqByZXN0wqBhc3N1cmVkwqB0aGF0wqBpwqBhbcKgaGVyZQ0KdG/CoGRpcmVjdMKgeW91wqBh

bmTCoGhlbHDCoHlvdcKgd2l0aMKgYWxswqBpbmZvcm1hdGlvbsKgcmVxdWlyZWTCoGZvcsKgdXPC

oHRvDQphY2hpZXZlwqB0aGlzwqBwcm9qZWN0wqBmb3LCoHNlY3VyaXR5wqByZWFzb24swqB0aGXC

oGRpcmVjdG9ywqBib2FyZMKgaGFzwqBoZWxkDQphwqBtZWV0aW5nwqByZWdhcmRpbmfCoHRoaXPC

oHVuY2xhaW1lZMKgZnVuZMKgZm9ywqBvdXLCoGxhdGXCoGRlY2Vhc2XCoGN1c3RvbWVyDQp3aG/C

oGRpZXPCoHllYXJzwqBhZ2/CoGFuZMKgbm/CoGZhbWlsecKgb3LCoG5leHTCoG9mwqBraW7CoHRv

wqBhcHBsecKgZm9ywqB0aGXCoGNsYWltDQpzb8KgacKgd2lsbMKgZ3VpZGXCoHlvdcKgdG/CoGFw

cGx5wqBhc8KgdGhlwqBidXNpbmVzc8KgcGFydG5lcsKgYW5kwqBnaXZlwqB5b3UNCmRpcmVjdGl2

ZXPCoHRvwqBmb2xsb3fCoHNvwqB0aGXCoHByb2plY3TCoGNhbsKgYmXCoHN1Y2Nlc3NmdWxsecKg

YWNoaWV2ZWTCoGFuZA0Kd2lsbMKgZGVsZXRlwqBhbGzCoHlvdXLCoGluZm9ybWF0aW9uwqBmcm9t

wqBvdXLCoGJhbmvCoHN5c3RlbcKgb25jZcKgd2UNCnN1Y2Nlc3NmdWxsecKgYWNoaWV2ZcKgdGhp

c8KgZnVuZMKgd2l0aMKgbXnCoHBvc2l0aW9uwqBpbsKgdGhlwqBiYW5rLg0KDQpQbGVhc2XCoHNl

bmTCoHlvdXLCoGZ1bGzCoGNvbnRhY3TCoGRldGFpbHPCoHN1Y2jCoGFzLg0KDQoxKcKgeW91csKg

ZnVsbMKgbmFtZXMuDQoyKcKgeW91csKgZGlyZWN0wqB0ZWxlcGhvbmXCoG51bWJlcnMuDQozKcKg

eW91csKgY291bnRyecKgYW5kwqBob21lwqBhZGRyZXNzLg0KNCnCoHlvdXLCoGFnZcKgYW5kwqBv

Y2N1cGF0aW9uLg0KNSnCoHlvdXLCoHBhc3Nwb3J0wqBjb3B5wqBvcsKgYW55wqBvZsKgeW91csKg

SUTCoGNhcmQuDQoNCm1vcmXCoGRldGFpbHPCoG9uwqBob3fCoHRvwqBjbGFpbcKgdGhlwqBmdW5k

wqB3aWxswqBiZcKgZ2l2ZW7CoHVwb27CoHlvdXLCoHJlcGx5Lg0KDQpZb3VywqBxdWlja8KgcmVz

cG9uc2XCoHdpbGzCoGJlwqBoaWdobHnCoGFwcHJlY2lhdGVkLg0KDQpZb3Vyc8Kgc2luY2VyZWx5

LA0KDQpNc8KgSnVsaWXCoEJlbm5pZS4NCg==

Sexual Blackmail phishing

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 18 Aug 2022 07:13:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOfJx-000Pa6-H2

for dave@doctor.nl2k.ab.ca;

Thu, 18 Aug 2022 07:12:25 -0600

Resent-From: The Doctor

Resent-Date: Thu, 18 Aug 2022 07:12:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mob-109-118-16-191.net.vodafone.it ([109.118.16.191]:44541)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOfFT-0004NQ-RG

for sales@nk.ca;

Thu, 18 Aug 2022 07:07:53 -0600

Message-ID: <323380E4568157323380E45681573233@Y340QUF>

From:

To:

Subject: Don't miss your unsettled payment. Complete your debt payment now.

Date: 18 Aug 2022 15:43:18 +0100

MIME-Version: 1.0

Content-Type: text/plain;

charset="ibm852"

Content-Transfer-Encoding: 8bit

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2900.5931

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5994

X-Spam_score: 11.7

X-Spam_score_int: 117

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi! Sadly, there are some bad news that you are about to hear.

About few months ago I have gained a full access to all devices used by you

for internet browsing. Shortly after, I started recording all int [...]



Content analysis details: (11.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel

letters

1.0 HK_RANDOM_FROM From username looks random

1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)

[109.118.16.191 listed in ix.dnsbl.manitu.net]

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 BITCOIN_XPRIO Bitcoin + priority

0.5 PDS_BTC_ID FP reduced Bitcoin ID

0.9 BITCOIN_EXTORT_01 Extortion spam, pay via BitCoin

0.0 PDS_BTC_MSGID Bitcoin ID with T_MSGID_NOFQDN2

3.2 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP

addr 1)

0.0 HDR_ORDER_FTSDMCXX_DIRECT Header order similar to spam

(FTSDMCXX/boundary variant) + direct-to-MX

0.0 MIMEOLE_DIRECT_TO_MX MIMEOLE + direct-to-MX

3.1 DOS_OE_TO_MX Delivered direct to MX with OE headers

0.0 NO_FM_NAME_IP_HOSTN No From name + hostname using IP address

Subject: {SPAM?} Don't miss your unsettled payment. Complete your debt payment now.



Hi!



Sadly, there are some bad news that you are about to hear.

About few months ago I have gained a full access to all devices used by you for internet browsing.

Shortly after, I started recording all internet activities done by you.



Below is the sequence of events of how that happened:

Earlier I purchased from hackers a unique access to diversified email accounts (at the moment, it is really easy to do using internet).

As you can see, I managed to log in to your email account without breaking a sweat: (sales@nk.ca).



Within one week afterwards, I installed a Trojan virus in your Operating Systems available on all devices that you utilize for logging in your email.

To be frank, it was somewhat a very easy task (since you were kind enough to open some of links provided in your inbox emails).

I know, you may be thinking now that I'm a genius.



With help of that useful software, I am now able to gain access to all the controllers located in your devices (e.g., video camera, keyboard, microphone and others).

As result, managed to download all your photos, personal data, history of web browsing and other info to my servers without any problems.

Moreover, I now have access to all accounts in your messengers, social networks, emails, contacts list, chat history - you name it.

My Trojan virus continues refreshing its signatures in a non-stop manner (because it is operated by driver),

hence it remains undetected by any antivirus software installed in your PC or device.



So, I guess now you finally understand the reason why I could never be caught until this very letter...



During the process of your personal info compilation, I could not help but notice that you are a huge admirer and regular guest of websites with adult content.

You endure a lot of pleasure while checking out porn websites, watching nasty porn movies and reaching breathtaking orgasms.

Let me be frank with you, it was really hard to resist from recording some of those naughty solo scenes with you in main role and compiling them in special videos

that expose your masturbation sessions, which end with you cumming.



In case if you still have doubts, all I need is to click my mouse and all those nasty videos with you will be shared to friends, colleagues, and relatives of yours.

Moreover, nothing stops me from uploading all that hot content online, so all public can watch it too.

I sincerely hope, you would really not prefer that to happen, keeping in mind all the dirty things you like to watch,

(you certainly know what I mean) it will completely ruin your reputation.



However, don't worry, there is still a way to resolve this:

You need to carry out a $1450 USD transfer to my wallet (equivalent amount in bitcoins depending on exchange rate at the moment of funds transfer),

hence upon receiving the transaction, I will proceed with deleting all the filthy videos with you in main role.

Afterwards, we can forget about this unpleasant accident. Furthermore, I guarantee that all the malicious software will also be erased from your devices and accounts.

Mark my words, I never lie.



That is a great bargain with a low price, I assure you, because I have spent a lot of effort while recording

and tracking down all your activities and dirty deeds during a long period of time.

In case if you have no idea how to buy and transfer bitcoins - feel free to check the related info on the internet.



Here is my bitcoin wallet for your reference: 1ReCKyhNPdHkbNCjf3EyRgr6XZX78rURd



>From now on, you have only 48 hours and countdown has started once you opened this very email (in other words, 2 days).



The following list contains things you should definitely abstain from doing or even attempting:

> Abstain from trying to reply this email (since the email is generated inside your inbox alongside with return address).

> Abstain from trying to call or report to police or any other security services. In addition, it's a bad idea if you want to share it with your friends,

hoping they would help. If I happen to find out (knowing my awesome skills, it can be done effortlessly,

because I have all your devices and accounts under my control and unceasing observation) - kinky videos of yours will be share to public the same day.

> Abstain from trying to look for me - that would not lead anywhere either. Cryptocurrency transactions are absolutely anonymous and cannot be tracked.

> Abstain from reinstalling your OS on devices or throwing them away. That would not solve the problem as well,

since all your personal videos are already uploaded and stored at remote servers.



Things you may be confused about:

> That your funds transfer won't be delivered to me.

Chill, I can track down any transactions right away, so upon funds transfer I will receive a notification as well,

since I still control your devices (my trojan virus has ability of controlling all processes remotely, just like TeamViewer).

> That I am going to share your dirty videos after receiving money transfer from you.

Here you need to trust me, because there is absolutely no point to still bother you after receiving money.

Moreover, if I really wanted all those videos would be available to public long time ago!



I believe we can still handle this situation on fair terms!



Here is my last advice to you... in future you better ensure you stay away from this kind of situations!

My advice - don't forget to regularly update your passwords to feel completely secure.



Central Asian Bank spam from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 18 Aug 2022 07:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOfHA-00078h-Ef

for dave@doctor.nl2k.ab.ca;

Thu, 18 Aug 2022 07:09:32 -0600

Resent-From: The Doctor

Resent-Date: Thu, 18 Aug 2022 07:09:32 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f68.google.com ([209.85.217.68]:39786)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOa1g-000JtT-Hj

for majordomo-Owner@nk.ca;

Thu, 18 Aug 2022 01:33:17 -0600

Received: by mail-vs1-f68.google.com with SMTP id c3so687681vsc.6

for ; Thu, 18 Aug 2022 00:32:55 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc;

bh=yH/SF0+EmCb353hDcQ/0QVkq0oVhfOab4UR3jEYnb3Q=;

b=hUicacqeTE/pN/j5/5VCXQ8KP2SPyevQmv79u6jbrUPCnvPiFj/5nYUO/q4JZDatWG

/8VnmtWAhWN8Q3/8Azyc2ORpob8+gHkKElG/TpXcp7V0Xbe/4z9p2OciT4rbDuf7hRfd

OvPHIRdsmb9y+ZwpLhHjBQgDxSwDvP6TZrTuNVjBhxUNlJPVneFSOZdKo9REsCzXHob5

2sJ3YgiocUSiv1bhVfTdxKa/8rQCmwBwsp8yTVxdPfKhLzJvjQJiVkTaQJSktj5Jy7JC

arFUzlBRYMe91/lhTb1iOjdQ7AhtGgLrwCbqVN7HymxDeEKGVxK9DEuUFewz4WdZvGfO

a75g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc;

bh=yH/SF0+EmCb353hDcQ/0QVkq0oVhfOab4UR3jEYnb3Q=;

b=XtSRx8JcIOQHoUTY1GmuL+B774VfGSdVKrJvvmcgJwW0u9V5HU9zOjMXIQp/C6BNW0

dz3NYw5wHfoyFKoMwgb+Lx8hty5GasgobSTkYK85L2qQVHXE6WF+V215dIlkGPpt4xY4

Tfiy3/hmYpTrFjxPJ86U4YM0XJUBEsQCLEla8JM02PBdtibqc2CX2rnPVhk9xZJG9LAf

NnTU20KK1TunOjNW6UfQ1OphuUxK63cfVRN8K3kvE+Pk6vw8R8VjN2Uze17vT/BSDhRI

+dEMCsxwmss7qEm8lvvRgJyh3PXBxTrn0sEluNBIpVzZrcfSVh3dNEkTw05XCNJ6xljV

/Jmw==

X-Gm-Message-State: ACgBeo3gLsNTYc9u80/t4qweIW0iURhB87SVr7hC8KCKT6la4eyMkeWv

3NuuPrRs2yz9NyAOX/rMOK1KvMAW2yAIbwLWJJ8=

X-Google-Smtp-Source: AA6agR7HokR2k2rgrrgP+CN0Wby3ulQjFIYay9UCYcwGw/LVMzg033xSwLGE70EuwwAtRJVdOgAMScMWl4Hdrg2W/d8=

X-Received: by 2002:a67:a44d:0:b0:38a:ce33:da9e with SMTP id

p13-20020a67a44d000000b0038ace33da9emr791119vsh.17.1660807969400; Thu, 18 Aug

2022 00:32:49 -0700 (PDT)

MIME-Version: 1.0

Reply-To: bankcentralasiahalobcaxxx@gmail.com

From: Bank Central Asia

Date: Thu, 18 Aug 2022 14:32:35 +0700

Message-ID:

Subject: BANK CENTRAL ASIA - ALWAYS BY YOUR SIDE

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000000e6b3105e67efd3d"

Bcc: majordomo-Owner@nk.ca

X-Spam_score: 16.5

X-Spam_score_int: 165

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: BANK CENTRAL ASIA - JAKARTA INDONESIA FOREIGN REMITTANCE DEPARTMENT

PRE-PAYMENT ADVICE: (U.N-W.B.O-I.M.F-B.C.A -5100-12/22)



Content analysis details: (16.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.68 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[centralasiab09[at]gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[centralasiab09[at]gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.7 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 LOTTO_DEPT Claims Department

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} BANK CENTRAL ASIA - ALWAYS BY YOUR SIDE



--0000000000000e6b3105e67efd3d

Content-Type: text/plain; charset="UTF-8"



BANK CENTRAL ASIA - JAKARTA INDONESIA



FOREIGN REMITTANCE DEPARTMENT



PRE-PAYMENT ADVICE: (U.N-W.B.O-I.M.F-B.C.A -5100-12/22)



>From The Desk of Mr. Andreas Rahmat Reinhard, Director Foreign Remittance

Department of Bank Central Asia.



Facts and statistics gathered from our human resource database we found out

you have worked extremely hard to get your payment but to no avail because

of the unstable and dishonest officials at the helm of affairs. Your

fund was moved to our bank by the United Nation Debt and Foreign Assets

Committee, Valued $9,200,000 and we are mandated to recover and remit

unpaid debts owed to beneficiaries and companies across the globe to ensure

justice is done through our due processes which are our terms and

conditions of service.



Note: You are obligated to confirm this account, if it is your correct

account information? BBVA Compass, 15 South 20th Street Suite 1202

Birmingham, Alabama 35233 USA because our Bank will not be held responsible

if there should be any wrong transfer.



Thank you for your cooperation.



Regards



Mr. Andreas Rahmat Reinhard



Director Foreign Remittance Department



IMPORTANT NOTICE REGARDING THIS ELECTRONIC MESSAGE:



This message may contain privileged or confidential information. If you are

not the intended recipient of this email, please delete the message and

notify the sender so that we may correct our records.



--0000000000000e6b3105e67efd3d

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




t-size:12pt;font-family:"Times New Roman","serif"">
n style=3D"font-family:Tahoma,"sans-serif";color:black">BANK CENT=

RAL ASIA - JAKARTA INDONESIA


text-align:justify;font-size:12pt;font-family:"Times New Roman",&=

quot;serif"">
color:black">FOREIGN REMITTANCE DEPARTMENT


0cm 0.0001pt;text-align:justify;font-size:12pt;font-family:"Times New=

Roman","serif"">
sans-serif";color:black">PRE-PAYMENT ADVICE: (U.N-W.B.O-I.M.F-B.C.A -5=

100-12/22)


rgin-left:0cm;font-size:12pt;font-family:"Times New Roman","=

serif"">
:black">From The Desk of Mr. Andreas Rahmat Reinhard,=C2=A0Director Foreign=

Remittance Department of Bank Central Asia.=C2=A0


xt-align:justify;margin-right:0cm;margin-left:0cm;font-size:12pt;font-famil=

y:"Times New Roman","serif"">
:Tahoma,"sans-serif";color:black">Facts and statistics gathered f=

rom our human resource database=C2=A0we found out you have worked extremely=

hard to get your=C2=A0payment=C2=A0but to no avail because of the unstable=

and dishonest officials at the helm of affairs. Your fund=C2=A0was moved t=

o our bank=C2=A0by the=C2=A0United Nation=C2=A0Debt=C2=A0and=C2=A0Foreign A=

ssets Committee, Valued $9,200,000 and we are mandated to recover and remit=

unpaid debts owed=C2=A0to beneficiaries and companies across the globe=C2=

=A0to ensure justice is done through our due processes which are our terms =

and conditions of service.


right:0cm;margin-left:0cm;font-size:12pt;font-family:"Times New Roman&=

quot;,"serif"">
";color:black">Note: You are obligated to confirm this account, if it =

is your correct account information?=C2=A0BBVA Compass, 15 South 20th Stree=

t Suite 1202 Birmingham, Alabama 35233 USA=C2=A0because our Bank will not b=

e held responsible if there should be any wrong transfer.


e=3D"text-align:justify;margin-right:0cm;margin-left:0cm;font-size:12pt;fon=

t-family:"Times New Roman","serif"">
-family:Tahoma,"sans-serif";color:black">Thank you=C2=A0for your =

cooperation.


fy;font-size:12pt;font-family:"Times New Roman","serif"=

">Reg=

ards


size:12pt;font-family:"Times New Roman","serif"">
style=3D"font-family:Tahoma,"sans-serif";color:black">Mr. Andreas=

Rahmat Reinhard


ustify;font-size:12pt;font-family:"Times New Roman","serif&q=

uot;">
>Director Foreign Remittance Department


:9.75pt;text-align:justify;margin-right:0cm;margin-left:0cm;font-size:12pt;=

font-family:"Times New Roman","serif"">
=3D"font-size:8pt;font-family:Tahoma,"sans-serif";color:black">IM=

PORTANT NOTICE REGARDING THIS ELECTRONIC MESSAGE:


"margin:0cm 0cm 0.0001pt;text-align:justify;font-size:12pt;font-family:&quo=

t;Times New Roman",serif">


ign:justify;margin-right:0cm;margin-left:0cm;font-size:12pt;font-family:&qu=

ot;Times New Roman","serif"">
nt-family:Tahoma,"sans-serif";color:black">This message may conta=

in privileged or confidential information. If you are not the intended reci=

pient of this email, please delete the message and notify the sender so tha=

t we may correct our records.





--0000000000000e6b3105e67efd3d--

Nigerian Gmail spam

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 18 Aug 2022 00:35:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOZ6k-0007wA-Sy

for dave@doctor.nl2k.ab.ca;

Thu, 18 Aug 2022 00:34:22 -0600

Resent-From: The Doctor

Resent-Date: Thu, 18 Aug 2022 00:34:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f171.google.com ([209.85.210.171]:34463)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOYbw-0003a1-01

for root@doctor.nl2k.ab.ca;

Thu, 18 Aug 2022 00:02:36 -0600

Received: by mail-pf1-f171.google.com with SMTP id f28so651366pfk.1

for ; Wed, 17 Aug 2022 23:02:10 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc;

bh=Uj2eUJMFARxsfQk+XVIcOBkxReEtHB96/kDVT2c9r3Y=;

b=btH/VAVqzNp93gYyrgKcWWYI1f1Roz0KYHbK0w3YmUheVecZhNhhX/wMeyd4Kh3iEF

9lxXyxJT7SRXdPKRl4shjBzvjokXWKR1CxQ3bWdYFEerE+A8FOtpi1Ngu4d1yAMf4Aw6

QdY739D6OoqoGjA1oKkVE1+hZblA2zV9pb7Rlsd2eXJgu2tvhM/47aP09PrhR+9wgiol

kDGMlVmRNnP1VCqfm+WPoLpOMVv9ByS7+Rdw2hI6a1yzwq5prSZbnRAncGDaL2ri6HxU

xDL5Imimb7REo0yBxTUIMkIdrzV7/warn58FTqX5rl8TA4UtINpzC5zaqg6lH2l7oxkK

6cBQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc;

bh=Uj2eUJMFARxsfQk+XVIcOBkxReEtHB96/kDVT2c9r3Y=;

b=Gf3BXgVfQSWRyJqjZB5H7iQOuQT8uougv060g/KMsvyhYCIVUbfZzpSmBq+z8v7m++

n8So9qMzZBNtZwkGqGxN46OfP8BfdhIFLC+khm4jcXPvH/Lqz1MXas+TieLlScg0fE3L

yWdTiz4+/Ti3K9DDWyuuvaBdNJhk/8Eyl4cC4w+JEQs9/8M+uakkDgdqgXAKbpTCW8H3

a0hkv6JJ5TK++TW0Fecl9TKh+MEKJ1eQmfzB7srJZ1yayXP9eKyW7b1jXbTi9594TSW8

57ci9K3sB15NNoppXrEjrF07AUzPOb3Qt7i8+ljPtOszTF+nVw2pQtfSLrMwuZyZclZc

kPJg==

X-Gm-Message-State: ACgBeo2bFaoaqdNSedRz0S8DuhC5WwuuzPR4bl9S962oIILNFguM/fwE

IvnYJx/jnkkb/l6KSRCTasdvfZMVxpPBdfFTBA8=

X-Google-Smtp-Source: AA6agR774EELUesOpo5HZ7IijApVQCY0NJSlGGW7vNzrWxu6a0wHQh0T1KQ/eTsd270ZX6dlXPAaIDiJlfAVqVqAlPw=

X-Received: by 2002:a05:6a00:cc7:b0:52f:2ada:11c5 with SMTP id

b7-20020a056a000cc700b0052f2ada11c5mr1518028pfv.19.1660802525252; Wed, 17 Aug

2022 23:02:05 -0700 (PDT)

MIME-Version: 1.0

Reply-To: bankcentralasiahalobcaxxx@gmail.com

From: Bank Central Asia

Date: Thu, 18 Aug 2022 13:01:51 +0700

Message-ID:

Subject: BANK CENTRAL ASIA - ALWAYS BY YOUR SIDE

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000008f4f2505e67db8ce"

Bcc: root@doctor.nl2k.ab.ca

X-Spam_score: 16.5

X-Spam_score_int: 165

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: BANK CENTRAL ASIA - JAKARTA INDONESIA FOREIGN REMITTANCE DEPARTMENT

PRE-PAYMENT ADVICE: (U.N-W.B.O-I.M.F-B.C.A -5100-12/22)



Content analysis details: (16.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.210.171 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[centralasia364[at]gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[centralasia364[at]gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.7 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

0.0 LOTTO_DEPT Claims Department

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} BANK CENTRAL ASIA - ALWAYS BY YOUR SIDE



--0000000000008f4f2505e67db8ce

Content-Type: text/plain; charset="UTF-8"



BANK CENTRAL ASIA - JAKARTA INDONESIA



FOREIGN REMITTANCE DEPARTMENT



PRE-PAYMENT ADVICE: (U.N-W.B.O-I.M.F-B.C.A -5100-12/22)



>From The Desk of Mr. Andreas Rahmat Reinhard, Director Foreign Remittance

Department of Bank Central Asia.



Facts and statistics gathered from our human resource database we found out

you have worked extremely hard to get your payment but to no avail because

of the unstable and dishonest officials at the helm of affairs. Your

fund was moved to our bank by the United Nation Debt and Foreign Assets

Committee, Valued $9,200,000 and we are mandated to recover and remit

unpaid debts owed to beneficiaries and companies across the globe to ensure

justice is done through our due processes which are our terms and

conditions of service.



Note: You are obligated to confirm this account, if it is your correct

account information? BBVA Compass, 15 South 20th Street Suite 1202

Birmingham, Alabama 35233 USA because our Bank will not be held responsible

if there should be any wrong transfer.



Thank you for your cooperation.



Regards



Mr. Andreas Rahmat Reinhard



Director Foreign Remittance Department



IMPORTANT NOTICE REGARDING THIS ELECTRONIC MESSAGE:



This message may contain privileged or confidential information. If you are

not the intended recipient of this email, please delete the message and

notify the sender so that we may correct our records.



--0000000000008f4f2505e67db8ce

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




t-size:12pt;font-family:"Times New Roman","serif"">
n style=3D"font-family:Tahoma,"sans-serif";color:black">BANK CENT=

RAL ASIA - JAKARTA INDONESIA


text-align:justify;font-size:12pt;font-family:"Times New Roman",&=

quot;serif"">
color:black">FOREIGN REMITTANCE DEPARTMENT


0cm 0.0001pt;text-align:justify;font-size:12pt;font-family:"Times New=

Roman","serif"">
sans-serif";color:black">PRE-PAYMENT ADVICE: (U.N-W.B.O-I.M.F-B.C.A -5=

100-12/22)


rgin-left:0cm;font-size:12pt;font-family:"Times New Roman","=

serif"">
:black">From The Desk of Mr. Andreas Rahmat Reinhard,=C2=A0Director Foreign=

Remittance Department of Bank Central Asia.=C2=A0


xt-align:justify;margin-right:0cm;margin-left:0cm;font-size:12pt;font-famil=

y:"Times New Roman","serif"">
:Tahoma,"sans-serif";color:black">Facts and statistics gathered f=

rom our human resource database=C2=A0we found out you have worked extremely=

hard to get your=C2=A0payment=C2=A0but to no avail because of the unstable=

and dishonest officials at the helm of affairs. Your fund=C2=A0was moved t=

o our bank=C2=A0by the=C2=A0United Nation=C2=A0Debt=C2=A0and=C2=A0Foreign A=

ssets Committee, Valued $9,200,000 and we are mandated to recover and remit=

unpaid debts owed=C2=A0to beneficiaries and companies across the globe=C2=

=A0to ensure justice is done through our due processes which are our terms =

and conditions of service.


right:0cm;margin-left:0cm;font-size:12pt;font-family:"Times New Roman&=

quot;,"serif"">
";color:black">Note: You are obligated to confirm this account, if it =

is your correct account information?=C2=A0BBVA Compass, 15 South 20th Stree=

t Suite 1202 Birmingham, Alabama 35233 USA=C2=A0because our Bank will not b=

e held responsible if there should be any wrong transfer.


e=3D"text-align:justify;margin-right:0cm;margin-left:0cm;font-size:12pt;fon=

t-family:"Times New Roman","serif"">
-family:Tahoma,"sans-serif";color:black">Thank you=C2=A0for your =

cooperation.


fy;font-size:12pt;font-family:"Times New Roman","serif"=

">Reg=

ards


size:12pt;font-family:"Times New Roman","serif"">
style=3D"font-family:Tahoma,"sans-serif";color:black">Mr. Andreas=

Rahmat Reinhard


ustify;font-size:12pt;font-family:"Times New Roman","serif&q=

uot;">
>Director Foreign Remittance Department


:9.75pt;text-align:justify;margin-right:0cm;margin-left:0cm;font-size:12pt;=

font-family:"Times New Roman","serif"">
=3D"font-size:8pt;font-family:Tahoma,"sans-serif";color:black">IM=

PORTANT NOTICE REGARDING THIS ELECTRONIC MESSAGE:


"margin:0cm 0cm 0.0001pt;text-align:justify;font-size:12pt;font-family:&quo=

t;Times New Roman",serif">


ign:justify;margin-right:0cm;margin-left:0cm;font-size:12pt;font-family:&qu=

ot;Times New Roman","serif"">
nt-family:Tahoma,"sans-serif";color:black">This message may conta=

in privileged or confidential information. If you are not the intended reci=

pient of this email, please delete the message and notify the sender so tha=

t we may correct our records.





--0000000000008f4f2505e67db8ce--

Medical spam/phish from CloudWebManage New York City

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 18 Aug 2022 00:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOZ3A-0006ra-1u

for dave@doctor.nl2k.ab.ca;

Thu, 18 Aug 2022 00:30:40 -0600

Resent-From: The Doctor

Resent-Date: Thu, 18 Aug 2022 00:30:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [45.126.126.25] (port=39847 helo=ear-pro.net)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

id 1oOTta-000Nb1-Jb

for doctor@doctor.nl2k.ab.ca;

Wed, 17 Aug 2022 19:00:30 -0600

From:_Hair Health

Subject:_Doctor Forced To Resign After Unveiling Hair Regrowth Hack

Date: Thu, 18 Aug 2022 02:59:04 +0200

To: doctor@doctor.nl2k.ab.ca

Reply-To: "Adobe Creative Cloud"

MIME-Version: 1.0

X-mailer: nlserver, Build 6.7.0

Message-ID:

X-250ok-CID: P26341-121020

TenantHeader: 1d0e6311-6f98-4c5b-8b0e-rWM5LDPcfDUFB1j6IO8jxNT

Affinity: prod.default

X-cust_MessageID: 1938757681

X-cust_DeliveryID: 350826

X-cust_InstanceName: aci_prod

MessageMaxRetry:2000

MessageRetryPeriod: 3600

MessageWebValidityDuration: 2592000

MessageValidityDuration: 432000

X-cust_IMSOrgID:

Content-Transfer-Encoding: 7bit

Content-Type: text/html; charset="UTF-8"

X-Spam_score: 10.8

X-Spam_score_int: 108

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: This is shocking! A weird doctor from New Jersey was forced

out of his practice after he unveiled a billion-dollar secret he wasn't supposed

to know. The real reasonwhy you are losing your hair…



Content analysis details: (10.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of

words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

2.5 HDRS_MISSP Misspaced headers

0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML

only

Subject: {SPAM?} _Doctor Forced To Resign After Unveiling Hair Regrowth Hack



This is shocking!





A weird doctor from New Jersey was forced out of his practice after he unveiled a billion-dollar secret he wasn't supposed to know.





The real reasonwhy you are losing your hair…









And the simple daily habit you can do to restore it, no matter of your age or current condition.





His secret is so amazing, it sent the entire hair regrowth industry back to the drawing board, and it’s currently losing them millions of dollars.





His method is available for a very short period of time and only to selected people.





See if you qualify here...



USPS Phish from France

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 17 Aug 2022 16:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oORaW-0007Va-Ck

for dave@doctor.nl2k.ab.ca;

Wed, 17 Aug 2022 16:32:36 -0600

Resent-From: The Doctor

Resent-Date: Wed, 17 Aug 2022 16:32:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 163-172-255-117.rev.poneytelecom.eu ([163.172.255.117]:38352 helo=sd-130379.localdomain)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOPME-000FlL-Qo

for doctor@doctor.nl2k.ab.ca;

Wed, 17 Aug 2022 14:09:46 -0600

Received: by sd-130379.localdomain (Postfix, from userid 1001)

id BD622A8B66B; Wed, 17 Aug 2022 20:07:04 +0000 (UTC)

To: doctor@doctor.nl2k.ab.ca

Subject: =?UTF-8?Q?USPS=C2=AE_Expected_Delivery?=

Date: Wed, 17 Aug 2022 20:07:04 +0000

From: Support

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_c35642b2d243446f0009b8b19254dbfa"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--b1_c35642b2d243446f0009b8b19254dbfa

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit























Hi there,















































Â

 We have issues with your shipping address



USPS Allows you to Redeliver your package to your address in case of delivery failure or any other case.You can also track the package at any time, from shipment to delivery.

UPDATE HERE TO FIX YOUR BILLING



















































Head of Customer SuccessÂ





















































Â





















































 | USPS , 750 B St #1400, San Diego, CA 92101, United States







































--b1_c35642b2d243446f0009b8b19254dbfa

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit



































Hi there,












































Â


 We have issues with your shipping address




USPS Allows you to Redeliver your package to your address in case of delivery failure or any other case.
You can also track the package at any time, from shipment to delivery.



UPDATE HERE TO FIX YOUR BILLING






















































Head of Customer SuccessÂ




























































Â
















































 | USPS , 750 B St #1400, San Diego, CA 92101, United States


























--b1_c35642b2d243446f0009b8b19254dbfa--