Connector spam from Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 28 Aug 2022 05:20:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oSGEd-000DRT-Nz

for dave@doctor.nl2k.ab.ca;

Sun, 28 Aug 2022 05:13:47 -0600

Resent-From: The Doctor

Resent-Date: Sun, 28 Aug 2022 05:13:47 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-tycjpn01olkn2047.outbound.protection.outlook.com ([40.92.99.47]:56130 helo=JPN01-TYC-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oS70s-0005rh-3r

for doctor@nl2k.ab.ca;

Sat, 27 Aug 2022 19:23:02 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=jZMJB1mF5rNMObbt1H/LQr6w03vKTFJRgi7qwxZqiTWH4+Fp9rWCyrE0gSBiE5mGm4n91lThSHtBVtFHzZf3Ym0bmL6+VHcDUY3OUjTlCv7sI3ZtpmZLuqLJnZLzxHxyzbbtIrV7/Eu1kQPXyxQVDgPP76G6QVzUOvvqX2bVHWKCcx/ZsHrkeeRzAyTvPVIKjWqEkvFQHXJFREAeVM5EHodpb4Z1ZUdxZzjJo9JErK5EKQBdhwtK5klp0oWcOw3jCi2qy2NIzYd6alf8BgYV0JygAL/wZVcGjNxeodCRWhoTxEZMh76SIRD5KxKpdDaWsridwMG6dSXVO3wZ2XIgYQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=P0Nuyh4WRS74j52b8qkENLRhi4Bf89YVmrnI4JURLU8=;

b=BPtwgdaXQM63lcchwD36ncC6UyLcu9Br+Ngx+G57oBHBqb/jM1LPPLc3cSsuN1tT/wBXtSh+SMiBNc5yK+Akfd5xNvOx3oj96sw7FT1qJR9N6cZ+DjzJEzHsxGr34iptNCLALYBCIwFTYF6XMU+F6qBHvLfr/VR6PTQbj7s+vgMjDFKq96++Dya7E2bK1oNum1TsoRaVW1TzjwYAzbDno8CQiBlYoLR/HujHG7xkKvgjLaBM1dctGDni6o8ziGbZfRgP/rODZsTL08l003rxJk51Xbtk3OlZmr21zWeSr1IXoUeTx3sipgPUgXjyX3J9ejPC5UPBKUEtSW+ZHXa4/Q==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=P0Nuyh4WRS74j52b8qkENLRhi4Bf89YVmrnI4JURLU8=;

b=nvCwMKCW7uNMlAQxRf4qqre9lwBgiQd6XMMyvVwOYaJknwM8QWXn3scbXI9iXXIrbl13DzPwiWyLj0Y0ZMaTxxoYL8nnrYFPP2s9lK+20sb5PiI0qBzyNZosUMIXiSu1I1TDENuKMaqVUQkD52VAEHBswMVGDZGHQjv4R9rDHkqvbiYhlAGDq2CLHbaOarUux8VBXCzPaL+B/K1aZJyqXKqgQPLPZFXsBkmkufheTC1p9aLTloSq7Ta7dkpkp9+rjX6NhkieGtcnJ12tzpFn/4w9NjH2vmKW0j6yQaFti8AxgvtAAjUqZKqoF1qoGlFQZMCuruKV7SZlAg0V1wyTzg==

Received: from OS3P286MB1096.JPNP286.PROD.OUTLOOK.COM (2603:1096:604:126::13)

by OSZP286MB1535.JPNP286.PROD.OUTLOOK.COM (2603:1096:604:1b3::14) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5566.15; Sun, 28 Aug

2022 01:22:11 +0000

Received: from OS3P286MB1096.JPNP286.PROD.OUTLOOK.COM

([fe80::a0d8:a92b:3fd3:716e]) by OS3P286MB1096.JPNP286.PROD.OUTLOOK.COM

([fe80::a0d8:a92b:3fd3:716e%9]) with mapi id 15.20.5566.019; Sun, 28 Aug 2022

01:22:11 +0000

From: top top

Subject: Connector Sales,

Thread-Topic: Connector Sales,

Thread-Index: AQHYunyZIye1YNJVA0OTzBTET16tFg==

Date: Sun, 28 Aug 2022 01:22:11 +0000

Message-ID:



Accept-Language: zh-CN, en-US

Content-Language: zh-CN

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-tmn: [9ZgP2dmm5964g3Rj+akUVGqmhkHDvC3T]

x-ms-publictraffictype: Email

x-ms-office365-filtering-correlation-id: 514883ed-288d-44b6-8189-08da8893bb84

x-ms-traffictypediagnostic: OSZP286MB1535:EE_

x-microsoft-antispam: BCL:0;

x-microsoft-antispam-message-info:

2M7wnoQIH+MKp/wsB7b9GCjH0xVaX3DbSbW9umE83H7ZCBTxvmJ2hxAf391cT8CeSFvXFhcT9ffMsNld8iyajes3EKeux3+s9zwVjm2qdDIHpLbJ4M1M1nqDNC6OnOVi6LCWLT8DHiyO56EIggL8l2dMArhZKR/l5B5F1jUTkxvyJwfqXkgxE7Yx/F++UvkuBblUGg4o47+JBaETz6qrfxUGdWRner2axIE4kRDTGtBRjhy1VYB/ZUP4IWtLpPaYjiqReeAQQ7prLSNOtBC/S5zlAHv22hQnLecLXgoKPpVG/g/ORbZCNvYQV4D+ZW+Ipsb54wHkyouVzKhf9yL6Na5mchTkKCrrx3IiChw7rTY1jsj2bMwUQZ9I4T8rPZPzlJXK3oRSUBDCqJsy2JHOZxNFx76mRVZcERAgdCfdc5ng1gq531Y3367Y1yNebwvDg6V2tboyGxcA3NHYxWfqM7+pE8dVKCXfCH9BBy4B2/70u6dtLSnnRmPeeuHj6o8ssC9x4ynNiK9M0Xgvi9VkQPUiqwWPd05XNwO4vjZbdlJEN3l+5QQ2z9OmDVwge6ALTvKDFJ6a0GvyTPpcxaN2we3uBHg0pS3QKw9dWMmADXEsG+osxu8FW/32gmD3a3Ss

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?gb2312?B?cW1KOEc0dkRUaDhlZlZSamFaMDdzOHdnSlNPUFRvVHY1eUZHU0toVjZKbWZK?=

=?gb2312?B?WTIyVDc0NnZObWI2Mnl2azczN0FEZFVlZmcvZXF1dUtoK1VPbWtsUGdHWnJ4?=

=?gb2312?B?RFhad0paRWo5M1g1YmFoelBTZU40RWprR0ZxbWlZYTI3eklaRlZqVjJQdFBw?=

=?gb2312?B?UC9EeCsvenVod0pTS1hzT2RVVWFrd3hLRnRaK0RmcVVid3Z6ZkxIZ3B4c2JN?=

=?gb2312?B?YWF1eUpCaVZxRmthVmMzRVMzOURDVExZaVYrOWVBWU43dlBIdEwzekRuaGV4?=

=?gb2312?B?VndFd3lyc04xcXlVdDNJSFlMZldaSkw3aXh1WUhIQVRWVkhjTWVkb2JRMzlU?=

=?gb2312?B?c3RiM0VtR2Jhc1F2MnJBeDJSeUpIeVUrUkhaeWUxeVBVbjgrUEVOVUtXRkZv?=

=?gb2312?B?N3M5L0tzK1NnZXBTamYwSE5MQ1B4b1dGUmI1MktFMW82L1p5azJpSWpDT25n?=

=?gb2312?B?cEx4OXNnVStzS1V1NmtYSmplZ0RoblBCLzZRc0lNQlpxOExjVFlTcUZRWUNF?=

=?gb2312?B?S3lEeTFsZ08wWER1bXcxNU1qaTJCaTFNbWZ2aVFndGw3MU9id21iN0NRVTRz?=

=?gb2312?B?RmwyTG40KytSK3h0bElIVDlpaVcwY2VJVExXOEl6a0svSy9GZC9Da3BoV0dP?=

=?gb2312?B?N3NCWmZPc0RDRXJrOTU3OC9zSnJJT3JDVThKTmMwcU02RXd1OFNLQ2IvSGUv?=

=?gb2312?B?bFl2TGM5U0R1L1ZCWjZKK3lUNDhsMDdhM3BLc0FEZk9HeXhWZ2ZRS05SdVdJ?=

=?gb2312?B?SmN0KzR4TkVtbTVuUXF4ZU1EK3V2eFhzRGFGbmE5T01UVFh3cWF1cW8xWjhh?=

=?gb2312?B?dXhVUjFVUU44a0JQajRpaEc0MHhWbHcvWW5TeFUxcGpjbTVneUtUMWJjRE5T?=

=?gb2312?B?YmcwWXBtaHVBaU0zSE84WDl6UDdvL2ZsNTE0T1NDang4UENjbnB6Qmg3OXFU?=

=?gb2312?B?anVTRGNnRFJ6a0lHL3lGSlRBc29lTGUwdi9wNHNBRDdsbFlYRU02azVyTHdi?=

=?gb2312?B?Nk9mWGJFbHdQL2hCc0c5Ylk3UW4wZ0FQMFRGaXNvalVnbVZIa3Q0K1pPc3Vt?=

=?gb2312?B?Y3g3ZXgydDFCRXdrL1ZuSTFaYzB6ZFFhOTkxamJyN2srcDNodytNcFJaUlVX?=

=?gb2312?B?Y3lMZXlkY21CM2JtZjFoQXUxWVBlWnJBZXdYSUQvdEExM0FDR3h3N2dmdkhJ?=

=?gb2312?B?R0lWTWFOdDh0S3Q4YmNIRDQvQldmMmVVZXdiMXhuTW1mNmxKSDM1eXJxTXo4?=

=?gb2312?B?RnNJbGg1ejlzM0tvVTJtSkVsQVIzSHFFUnR0TER2U0owbUczVko4Z2pmc3Rs?=

=?gb2312?B?eE8yN0JUZ05Yd2lWS09kYk5WU1RyOWs4NUNTQVJSVnluNnU5Rks2akt1UGhM?=

=?gb2312?B?YU05SkpQRWw3YUlhQ1lCRGE4TStZbmFhN21LMGtxUFVwN2o5cGNjMnM5dU9t?=

=?gb2312?B?dUpGZmRodFFpeGRYczlnbGhHRm1LV3JCZ3dRYTV1eGx3Ymg5bkhCcDVyZ2ky?=

=?gb2312?B?SGE0SkNIZUdyNThteFI0RFVJanh2Q3Y2S3ptSDVQanljRjhvcnVwemM5QlZt?=

=?gb2312?B?MjRrMkRlcDR3dno3bjhxYk9Rd3B0K0tmQW9nYy80R3JsL2tOODF1U0ZxbEw4?=

=?gb2312?B?ZURoYmRuWGxNT2RSRkd3NTF4YXJsaU1obzJqOThyV1BJZSt2MlE0ZEllNlgv?=

=?gb2312?B?aytnUzh4OWJnektXRmxnRDdCcDJ4aTBXZzVNUkpkVC9XcCtZZHFtRVhnPT0=?=

Content-Type: multipart/alternative;

boundary="_000_OS3P286MB1096EE43D942394FA1D075B894779OS3P286MB1096JPNP_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-05f45.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: OS3P286MB1096.JPNP286.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 514883ed-288d-44b6-8189-08da8893bb84

X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Aug 2022 01:22:11.3627

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: OSZP286MB1535



--_000_OS3P286MB1096EE43D942394FA1D075B894779OS3P286MB1096JPNP_

Content-Type: text/plain; charset="gb2312"

Content-Transfer-Encoding: base64



SGVsbG8sDQpHb29kIGRheSENCkRvIHlvdSBoYXZlIG5lZWQgQ29ubmVjdG9yIGluIHJlY2VudGx5

Pw0KV2UgY2FuIGJhc2Ugb24geW91IGRlc2lnbiB0byBlc3RpbWF0ZSBjb3N0aW5nLiBJIGJlbGll

dmUgb3VyIGZhY3RvcnkgY2FuIGdpdmUgeW91IHJlYXNvbmFibGUgcHJpY2UgYW5kIGdvb2QgcXVh

bGl0eS4NCg0KV2UgYXJlIHZlcnkgcHJvZmVzc2lvbmFsIENvbm5lY3RvciBmYWN0b3J5cyBoYXZl

IG1vcmUgdGhlbiAxMiB5ZWFycy4NCg0KTG9va2luZyBmb3J3YXJkIHRvIGhlYXJpbmcgZnJvbSB5

b3Ugc29vbi4NCkJlc3QgUmVnYXJkcywNCkFuZHkNCg==



--_000_OS3P286MB1096EE43D942394FA1D075B894779OS3P286MB1096JPNP_

Content-Type: text/html; charset="gb2312"

Content-Transfer-Encoding: quoted-printable
















: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Hello,

Good day!


Do you have need Connector in recently?


We can base on you design to estimate costing. I believe our factory c=

an give you reasonable price and good quality.


 


We are very professional Connector factorys have more then 12 years.
div>






Looking forward to hearing from you soon.


Best Regards,


Andy










--_000_OS3P286MB1096EE43D942394FA1D075B894779OS3P286MB1096JPNP_--

donation spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 27 Aug 2022 14:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oS1S8-000IEH-3Y

for dave@doctor.nl2k.ab.ca;

Sat, 27 Aug 2022 13:26:44 -0600

Resent-From: The Doctor

Resent-Date: Sat, 27 Aug 2022 13:26:44 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f50.google.com ([209.85.160.50]:46947)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oS0tZ-000Eil-Eb

for doctor@nl2k.ab.ca;

Sat, 27 Aug 2022 12:51:05 -0600

Received: by mail-oa1-f50.google.com with SMTP id 586e51a60fabf-11c5505dba2so6032981fac.13

for ; Sat, 27 Aug 2022 11:50:43 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc;

bh=onAkx+shiWrYY6L6/IV7g7skzN0SAGwVGnmRJfCTi+E=;

b=ckg5qrEWXp6Z0Nlv/kxoKc7JqmAnglTpnCF2KlWQHmzz0CLmkP/tWMZ5YfyVv4jRJv

+ExVn54ZJQ+tqzBkfCK96kCB8/CfJBk4hOg1Vkh2jgfX3Tby7qqvLs2481N/JTcbWBWD

O0bFXHXUTiQLnTJNjlBh7qjC/Z+WCwBPKl4pyWiqwDjzhUwU9gtjfWGDqE9Xv2j9dqy5

pWAuQHaEchXegX2fQlv58rj0aY+iEdh7osfNVzRHCrALTDnaXrFQGPe/kmX3kfAY5ca2

9QBxj4oGmYY25TDzMLHlPd2yGPem3r7+ZwxntzROG8HV/YKBTVqKFeouKTYP2hU5iU0K

Ic7A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc;

bh=onAkx+shiWrYY6L6/IV7g7skzN0SAGwVGnmRJfCTi+E=;

b=6dD/aYOv4wnvnd0bMQi4Zzn9HZJWH0sUrPrJLWm3h5Kc85e1gRXaokNdu+iXe2VJEf

Tr5y+fmCmJ0oycp6s0C0VnePiBXe8z48HxcUWJiH4WNPp2eZm8gpqftOwIcgfulUVvHl

xzAON+fpQh8djyWtqx9uBTH4OnIet6y9LRUIuwZppjXCzE14vTgUtQ4idFzrflZRG+IZ

12MUpIQOBb4FSvHO1q6YHwI3ZZaB7WMgf4EYKgKx7aDYwJQ5jk11v0+h2EMQB+g/QMAA

6xb4TQBYCi92oLouo2ILL/P5QHNLL03aL/6XRRQsxlXs2PyXv9O1Wtf7jF/FKAD7Oy+q

R+dw==

X-Gm-Message-State: ACgBeo0SMsTBNtAXGA5v+HmS3rAcPAqfpWmko+y+a18qKHSjG3HRDX0q

OH1L0sxTcBiFcnXemGLZMEjwS1Wy/aHmIv+BhAM=

X-Google-Smtp-Source: AA6agR4orjZRUuM251Vm17F6In6zs6niTuQ53NunrxW2zEtC+v0EM5SFFj5rvqz+vtCFFrluV8hgod6glKb0keksERE=

X-Received: by 2002:a05:6870:7386:b0:11e:cf33:9023 with SMTP id

z6-20020a056870738600b0011ecf339023mr613130oam.86.1661626237998; Sat, 27 Aug

2022 11:50:37 -0700 (PDT)

MIME-Version: 1.0

Reply-To: fcpdonations2020@gmail.com

From: "Mr & Mrs Frances & Patrick Connolly"

Date: Sat, 27 Aug 2022 18:50:25 +0000

Message-ID:

Subject: voluntary donation

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000aa601e05e73d81bf"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: PLEASE READ: We are Mr & Mrs Frances & Patrick Connolly, we

live in Moira, Northern Ireland and we are the successful winner of £115m

Euro Millions win who have decided to choose you as one of the 50 [...]



Content analysis details: (10.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.50 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[obedtetteh241[at]gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[obedtetteh241[at]gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[fcpdonations2020[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 HK_NAME_FM_MR_MRS No description available.

0.0 T_HK_NAME_FM_MR_MRS No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.7 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} voluntary donation



--000000000000aa601e05e73d81bf

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



PLEASE READ: We are Mr & Mrs Frances & Patrick Connolly, we live in Moira,

Northern Ireland and we are the successful winner of =C2=A3115m Euro Millio=

ns

win who have decided to choose you as one of the 50 lucky winners to

receive this month of August, 2022 Donation which happens to be =C2=A3925,0=

00.

For more information on this please reach out to this email:

fcpdonations2020@gmail.com



--000000000000aa601e05e73d81bf

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



PLEASE READ: We are Mr & Mrs Frances & Patrick Con=

nolly, we live in Moira, Northern Ireland and we are the successful winner =

of =C2=A3115m Euro Millions win who have decided to choose you as one of th=

e 50 lucky winners to receive this month of August, 2022 Donation which hap=

pens to be =C2=A3925,000. For more information on this please reach out to =

this email: fcpdonations2020@=

gmail.com




--000000000000aa601e05e73d81bf--

Ukrainian Wife Phishing from Vietnam

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Sat, 27 Aug 2022 08:01:00 -0600

Received: from [14.166.141.48] (port=53500 helo=static.vnpt.vn)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRwMa-00080I-Ai

for dave@nk.ca;

Sat, 27 Aug 2022 08:00:47 -0600

Message-ID: <054D89B7.260774@vnpt.vn>

List-Unsubscribe:

Date: Sat, 27 Aug 2022 21:00:35 +0700

From: Bettine S. Brueggemann

MIME-Version: 1.0

To: Dave

Subject: Find a perfect Ukrainian wife.

Content-Type: multipart/alternative;

boundary="7C4F0A708A0752151ED09CD010B2CF876"

X-Spam_score: 39.2

X-Spam_score_int: 392

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Noone backcomb photosensitise because of poisonous overtrump,

no honors. By bus scarlet, as loggia?Take that sexy cat :-0My name is Bettine

from Moldova. I found you on facebook :)I am a simple woman [...]



Content analysis details: (39.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: life.my]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URIs: beautywoman.cn]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL

blocklist

[URIs: beautywoman.cn]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of

words

1.0 J_WEEDS_V FULL: Dec/Hex char Enc [Vv]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_J FULL: Dec/Hex char Enc [Jj]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

3.2 FOUND_YOU I found you...

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_REMOTE_IMAGE Message contains an external image

3.0 HTML_ENTITY_ASCII Obfuscated ASCII

Subject: {SPAM?} Find a perfect Ukrainian wife.



This is a multi-part message in MIME format.

--7C4F0A708A0752151ED09CD010B2CF876

Content-Type: text/plain; charset="UTF-8"; format=flowed

Content-Transfer-Encoding: quoted-printable



Noone backcomb photosensitise because of poisonous overtrump, no honors. =

By bus scarlet, as loggia?Take that sexy cat :-0My name is Bettine from =

Moldova. I found you on facebook :)I am a simple woman with a big dream =

to create a happy loving family and I will work hard for it. I am a very =

optimistic and positive person. I consider that every problem has a =

solution. I am a very easy going person, I love meeting people and just =

enjoying the simple things in life.my account is over there: =

http://BettineXX.beautywoman.cnIt is me-I hope you will find me there =

and we will become friends 8-) Call me!



--7C4F0A708A0752151ED09CD010B2CF876

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable








UTF-8">Noone backcomb photosensitise because of poisonous =<br /><br /> overtrump, no honors. By bus scarlet, as loggia?







Take that =

sexy cat :-0


My name is =

Bettine from Moldova. I =

found you on faٗcebook =

:-)




I am a =

simp͝le woman with a =

big dream to create a =

happy loving =

famȉly aٟnd I will =

work hard for it. I ảm a =

very optimistiٝc and =

positiv֕e person. I =

consider that every =

problem has a =

s֭oluti̢onٍ. I am a =

very ea֥s͡y going =

pe֕rson, I lͅove =

meeti̿ng people =

anَd just enjoying =

the simple things in =

life.
















I hope you =

will find me ther֨e =

and we will become =

frie͜nds 8-) Call =

me!






--7C4F0A708A0752151ED09CD010B2CF876--

Investment spam from outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 27 Aug 2022 05:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRu6r-0005B2-Lq

for dave@doctor.nl2k.ab.ca;

Sat, 27 Aug 2022 05:36:17 -0600

Resent-From: The Doctor

Resent-Date: Sat, 27 Aug 2022 05:36:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-bn7nam10hn2231.outbound.protection.outlook.com ([52.100.155.231]:27781 helo=NAM10-BN7-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRrn7-000GFh-Gz

for doctor@netknow.ca;

Sat, 27 Aug 2022 03:07:54 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=jpnieAtg6myc4XE258MP168OkW+zrSbS0S8KZcXAoHcaalPcP+z/xrQw7cHDYqkQN3fAbT3YjjmwPvqSp2YrihsPGPDQ4c+v6rmZmlwN0/eTPCuPdKvbrEKO4l8mnu1KFPmSMeMNiITEC4r05fySxMHWQf7tqwTnWqGvUsHCsvC4VQKqqfxSFY1WuJQNzE8kZwyJITJi+n3C5r0pt/VcWz+SGro5/kTDUusoZx14/5dG4TqZt9atrxBB78N01YFG8+bnLnY16jaKQ5LriNtlbargtgCMH00a2rUJ7NC7d14e+l+nEY7w4zM6bMkllErYHYpWLUfP27lGRUDU3oGsZQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=NHevMeavkGecYRbCvmrsqgknaD2yS1YgrYARupDO5yw=;

b=bDoHf/ZwLLKZ7kXm7PXEloej1HLfei601LnOxbf6LcgfA/aZruT7ibjuoPwe19q8KBEcTqr0Cmw8fC4kETtNSxjiqxi12FVMTj/v1w7Vlr5rzn/2/mSwdpDLoJ+mriiURjiaXxIPUcEjNE9bc7USZ4Nqini3MBo2sNrohfNz+41pgd5QkBkXaMI4HDkxcJ1fR3ikWeQciFA10dSY1AxBeLcW0V7t/JCvyk8ko8NCLtSTeB1cCIcr/e4rK9nNsGBg07UAhRC++SLdiQoVKOAKBV3zRVwH2sIQhgNwDmiMbz3kfTMp6j3sBuoOgudZhCLoyp2ZQw/8N1dam+5qTxQkEg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

40.123.37.200) smtp.rcpttodomain=aol.com smtp.mailfrom=protege.cll;

dmarc=none action=none header.from=protege.cll; dkim=none (message not

signed); arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=cpncorp.onmicrosoft.com; s=selector1-cpncorp-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=NHevMeavkGecYRbCvmrsqgknaD2yS1YgrYARupDO5yw=;

b=UnD8zfdhvRMpRCFNvMedtQqXk3mSzwWS0WYBN0/pqWdQIZRDHPWenDVXwBejzXAT6DCZfV7P8Vyx0pcLsG4yiGqHEoAPLxprFsSeBYpfBaGmwFRnWIjgJzmfre4hMP0g30gmSUhwqMnpqsV1q+c8zI6cp5+MZz8K9imo5CKHZYY=

Received: from MW4PR04CA0194.namprd04.prod.outlook.com (2603:10b6:303:86::19)

by DM6PR18MB3052.namprd18.prod.outlook.com (2603:10b6:5:167::19) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5566.16; Sat, 27 Aug

2022 09:07:14 +0000

Received: from MW2NAM04FT064.eop-NAM04.prod.protection.outlook.com

(2603:10b6:303:86:cafe::5e) by MW4PR04CA0194.outlook.office365.com

(2603:10b6:303:86::19) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5566.15 via Frontend

Transport; Sat, 27 Aug 2022 09:07:14 +0000

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 40.123.37.200)

smtp.mailfrom=protege.cll; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=protege.cll;

Received-SPF: None (protection.outlook.com: protege.cll does not designate

permitted sender hosts)

Received: from mailedge.calpine.com (40.123.37.200) by

MW2NAM04FT064.mail.protection.outlook.com (10.13.30.189) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.5566.15 via Frontend Transport; Sat, 27 Aug 2022 09:07:14 +0000

Received: from PZPWEXCAS04.na.calpine.com (10.221.16.100) by

PZPWEXEDGE02.calpine.com (10.221.8.135) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id

15.1.2375.31; Sat, 27 Aug 2022 04:06:53 -0500

Received: from PZPWEXCAS04.na.calpine.com (10.221.116.146) by

PZPWEXCAS04.na.calpine.com (10.221.116.146) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id

15.1.2375.28; Sat, 27 Aug 2022 04:06:53 -0500

Received: from User (10.221.98.196) by relay.calpine.com (10.221.116.146) with

Microsoft SMTP Server id 15.1.2375.28 via Frontend Transport; Sat, 27 Aug

2022 04:06:48 -0500

Reply-To:

From: "Mrs. Shaidi Hashmatullah"

Subject: My capital re-investment.

Date: Sat, 27 Aug 2022 02:06:53 -0700

MIME-Version: 1.0

Content-Type: text/plain; charset="Windows-1251"

Content-Transfer-Encoding: quoted-printable

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Message-ID: <4685aa71-13d2-4e3c-b5d8-bad6574a0bd3@PZPWEXCAS04.na.calpine.com>

To: Undisclosed recipients:;

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-Office365-Filtering-Correlation-Id: fda97fe7-7165-45d4-d004-08da880b8897

X-MS-TrafficTypeDiagnostic: DM6PR18MB3052:EE_

CPN-SPAM: Auth Check Pass

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?windows-1251?Q?PmDr1+aMQT1qkhjtwVbjmW/UIlDoVe7VO/nvoMpFX5RL2sOgCT3Dul+3?=

=?windows-1251?Q?c2z6fNNAoAR64yDM/0wVqyMSswozCtWoDGOWBiOynb87qZ8g3hg/ZnWt?=

=?windows-1251?Q?2erZ2rVNT4KWhL+w2U+BwMuaP0eb5MzQH6mLA7u5ra9vAyITq6MNPK5N?=

=?windows-1251?Q?4y/po00SWv5H85FEWkZphLyjZnixsQcjszvi30tDVU2x+psOLP9qpRfb?=

=?windows-1251?Q?yKweoilDYNlr39WSR78T90duuTyEgzRGoGe254Di2exmx4o/9sETYSnw?=

=?windows-1251?Q?moS+Fs4mYNyBom1WfVTHP6fVt4b9j29oedXDyMPvPvHPztsI2vIqxVGE?=

=?windows-1251?Q?Fe5IvrI3N6BqW808KRCIL2gQfQxmX3Yotib0HWN+CjY3KWvoHzFQm8Cp?=

=?windows-1251?Q?KGCPzvusCNJ45+5NCmTRvekxm4Z1AW919xsGWewJVjGJ7607dsttct5i?=

=?windows-1251?Q?MxdW5Y4n2DtQE+eFJ2zCUOTzw2Us5B+Ov+Bd+mWwFyuYHN7N1AyHG+3E?=

=?windows-1251?Q?9QjgqQ3mpRx6qv7YUMPGJSqg6qHtFbel48HzPmYmKY1c00qFzivvHTO3?=

=?windows-1251?Q?y1l/Eu+D57W3R8mV2kaoA0yv35YvCaJwRtXLra3FDo5cKLMdlFzR+ZO5?=

=?windows-1251?Q?ayY67fHDS7Ne+/8U8ax8bXn0k21RAZH97Nk621rb31M6ve4bMvCeJKVQ?=

=?windows-1251?Q?mZJKgGKBqGNfyFfDaffwQhFOQpCQrKu8fbI9zywsuthY3KOm5/eqMdQe?=

=?windows-1251?Q?FD4g8ID9KdB8S6kZLjUgzhIqtwUEA/+l2NHNuJ0xcD0X0DAW3F5L0Q+K?=

=?windows-1251?Q?CNzNuHM7mUBYg18tVirzdrrvIpObtO+cUU0Ii4YZGeiiBrS2/L/4Bvgf?=

=?windows-1251?Q?afCUrdtc/OszEIQI5DYjh/1F4S2HvDzqx5jWXbg24gVbDJu+c6LMsmS9?=

=?windows-1251?Q?5Dze9wB1GenOEh5l/aaQgHkWFyu8/bX8sN2QTV6QoQlndMAXgSZ82lyR?=

=?windows-1251?Q?nBH4DWy3wPBGgbtXkvY4oU5zxG+cX1Grm3Xuh8W/vz1BRaf7H0E73HRM?=

=?windows-1251?Q?CJQERAfVAt9q1fOcaCC3Ch2O2PE6AQXDhkPQW9B7sWv/Sfx0Fd0F95qJ?=

=?windows-1251?Q?uwWBbu7XmLe2d53wJTC6CK/dPpcyvw+VeGoCYncc6WlTcTSqxB/ZL5U3?=

=?windows-1251?Q?iU3x4//7+obnz5pXhm77JGFtOdPfyd6wajqTz9R9zMLyS1URXX1tvyb5?=

=?windows-1251?Q?uZpLYQrlWawMS8v2FJ/8go697vu+Lgzxl9lfPhLm?=

X-Forefront-Antispam-Report:

CIP:40.123.37.200;CTRY:US;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:mailedge.calpine.com;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230016)(4636009)(346002)(396003)(39860400002)(136003)(376002)(46966006)(40470700004)(86362001)(31696002)(3480700007)(81166007)(40460700003)(356005)(2860700004)(82740400003)(316002)(7366002)(7416002)(8936002)(7406005)(70586007)(5660300002)(8676002)(70206006)(35950700001)(83380400001)(336012)(47076005)(41300700001)(40480700001)(9686003)(498600001)(26005)(82310400005)(6666004)(109986005)(2906002)(31686004)(4001630100005);DIR:OUT;SFP:1501;

X-OriginatorOrg: cpncorp.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Aug 2022 09:07:14.2296

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: fda97fe7-7165-45d4-d004-08da880b8897

X-MS-Exchange-CrossTenant-Id: 7406f7f1-ef6e-49f3-a9c0-002b8bc12056

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=7406f7f1-ef6e-49f3-a9c0-002b8bc12056;Ip=[40.123.37.200];Helo=[mailedge.calpine.com]

X-MS-Exchange-CrossTenant-AuthSource:

MW2NAM04FT064.eop-NAM04.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR18MB3052

X-Spam_score: 7.0

X-Spam_score_int: 70

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello my friend, I am Mrs. Shaidi Hashmatullah, from Kabul,

Capital of Afghanistan. With due respect I contact you due to the crisis

in Afghanistan, i am looking to co-operate with you on a mutually interesting

and re [...]



Content analysis details: (7.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 NSL_RCVD_FROM_USER Received from User

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.155.231 listed in wl.mailspike.net]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[shaidihashmatullah01[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 HK_NAME_MR_MRS No description available.

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} My capital re-investment.



Hello my friend,



I am Mrs. Shaidi Hashmatullah, from Kabul, Capital of Afghanistan. With due=

respect I contact you due to the crisis in Afghanistan, i am looking to co=

-operate with you on a mutually interesting and rewarding project and/or tr=

ansaction with you, I desire to relocate my investment capital abroad where=

it will generate more returns.

I will appreciate your response. Please let me know your ideas and knowledg=

e regarding this investment offer. Any viable investment idea you suggest t=

o me will be considered.



Looking forward to hearing from you.



Best regards,





Mrs. Shaidi Hashmatullah

COMPANY CONFIDENTIALITY NOTICE: The information in this e-mail may be confi=

dential and/or privileged and protected by work product immunity or other l=

egal rules. No confidentiality or privilege is waived or lost by mis-transm=

ission. If you are not the intended recipient or an authorized representati=

ve of the intended recipient, you are hereby notified that any review, diss=

emination, or copying of this e-mail and its attachments, if any, or the in=

formation contained herein is prohibited. If you have received this e-mail =

in error, please immediately notify the sender by return e-mail and delete =

this e-mail from your computer system.

Urgency Spam from Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Aug 2022 18:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRk9i-000NTr-5F

for dave@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 18:58:34 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Aug 2022 18:58:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-tyzapc01hn2225.outbound.protection.outlook.com ([52.100.223.225]:26254 helo=APC01-TYZ-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRjGH-000IVj-Py

for root@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 18:01:23 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=lopZBzwPElu2ZIP5p9Bii/IucbJPo/tV5iEuZzFHdUd3pIUoXTfowYQlGSjUk4+mvQa5wE5Zf2g04JBehtzrqNpCgWPPtFZazmzZPdaBStxJUNNtznq4c6rCJRKZXB2b/ailkEK4jEgzu/W0CsrLu5D3cm8sMDvjogv+mety2rrySsGne79n81oFYmcC+8J+sh2qWCE7pB5xZSBlTtlQoot6VcSQk6wcm9mcD2K2UhctxJy6AAfXWuRlsUYW0hPIq5P+3IblGLkgqvdoEpvDxbTj9UH9RmiTejiZIqn+hSnfj1BWdqRMsdVZrlQpM/QFHWdtAR+SpDqK+B8XqMmz+g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=8/EKDgDFlelzveFN4ZSvpNtzC3KZ4k5UxzwLD1haQU8=;

b=XvcMyNjOzyEKk8dGHdhs1zeTN0VkPLEqYZHd2VMhQprZWH6I+7R6Be8IMWoBrQQA6vrjurMY10g3RFUY/P0IMc9wPQYCtyouxjPDWZ4c8lV+/BHbjau7fOl1KUlK1c6F3wDC5qk+8vOZbiuisTw8+fsIIuFCnFf+9ozQOxAkHyqw4/SvVZjxLintLPCZGFXaOa+S5inrg6pWMDESFc5AUwJecswnjbufmB9DqXY9wmwTTY670w0KF3Dy337Ojo8XWJT3dd6S2WTULIISMH+JG34uAGoeWed3FA+p29hTYvLwTqxxM3kfn3+lJ2sq1sD30R/gmKKDJ0ZWn6T3SIypCQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is

185.222.58.60) smtp.rcpttodomain=cpart.kz smtp.mailfrom=t4.cims.jp;

dmarc=bestguesspass action=none header.from=t4.cims.jp; dkim=none (message

not signed); arc=none (0)

Received: from SGAP274CA0016.SGPP274.PROD.OUTLOOK.COM (2603:1096:4:b6::28) by

SG2PR04MB5429.apcprd04.prod.outlook.com (2603:1096:4:172::8) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.5525.10; Sat, 27 Aug 2022 00:00:48 +0000

Received: from SG2APC01FT0031.eop-APC01.prod.protection.outlook.com

(2603:1096:4:b6:cafe::e1) by SGAP274CA0016.outlook.office365.com

(2603:1096:4:b6::28) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5566.15 via Frontend

Transport; Sat, 27 Aug 2022 00:00:48 +0000

X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 185.222.58.60)

smtp.mailfrom=t4.cims.jp; dkim=none (message not signed)

header.d=none;dmarc=bestguesspass action=none header.from=t4.cims.jp;

Received-SPF: Pass (protection.outlook.com: domain of t4.cims.jp designates

185.222.58.60 as permitted sender) receiver=protection.outlook.com;

client-ip=185.222.58.60; helo=User; pr=M

Received: from mail.prasarana.com.my (58.26.8.159) by

SG2APC01FT0031.mail.protection.outlook.com (10.13.36.89) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id

15.20.5566.15 via Frontend Transport; Sat, 27 Aug 2022 00:00:48 +0000

Received: from MRL-EXH-02.prasarana.com.my (10.128.66.101) by

MRL-EXH-02.prasarana.com.my (10.128.66.101) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id

15.1.2176.14; Sat, 27 Aug 2022 08:00:33 +0800

Received: from User (185.222.58.60) by MRL-EXH-02.prasarana.com.my

(10.128.66.101) with Microsoft SMTP Server id 15.1.2176.14 via Frontend

Transport; Sat, 27 Aug 2022 08:00:23 +0800

Reply-To:

From: "Mrs. Ann Zainab Abdullah"

Subject: Re: Did You Receive My last Email?

Date: Sat, 27 Aug 2022 02:00:33 +0200

MIME-Version: 1.0

Content-Type: text/html; charset="Windows-1251"

Content-Transfer-Encoding: 7bit

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Message-ID: <655ffa6f-c65b-4aa1-84e0-3678a3a8aa3e@MRL-EXH-02.prasarana.com.my>

To: Undisclosed recipients:;

X-EOPAttributedMessage: 0

X-MS-Exchange-SkipListedInternetSender: ip=[185.222.58.60];domain=User

X-MS-Exchange-ExternalOriginalInternetSender: ip=[185.222.58.60];domain=User

X-MS-PublicTrafficType: Email

X-MS-Office365-Filtering-Correlation-Id: e159c72a-67cc-41c6-87b4-08da87bf3278

X-MS-TrafficTypeDiagnostic: SG2PR04MB5429:EE_

X-MS-Exchange-AtpMessageProperties: SA|SL

X-MS-Exchange-SenderADCheck: 0

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?windows-1251?Q?2AoYbKIN9rN0MwmKq8rhynvjKeWQH1pHqLDuioOkFJywsBZ1l7QPSns2?=

=?windows-1251?Q?lj8NumZqwxEU5Q0kWSeT2uWekyLWqjDhMc0onnIZs/f255cRuOpX97M9?=

=?windows-1251?Q?MzlOjYIS7h3CZ42CC5F+/2+etRX1q5Yp1Pz8Mkm4IinG0L4lHChhCEhr?=

=?windows-1251?Q?bTaS2saQ1e1u7IhcxC6Ity1aICJdrDMEKjU5+ig9jYPVlg6tqYRf0S0q?=

=?windows-1251?Q?w9yADQuGM2DYyiyNdrBsVLPhGS0p3ESGkyH4aJ+WThZFnQGIXJWzAJXN?=

=?windows-1251?Q?7JIpnf56x5U0EWu6ZR1gvKKvNdsNZqDRvj9eUwBqBF5odqfIx1nte0cQ?=

=?windows-1251?Q?Lr369x43CESJw4mCC54IMa+Mgz8A0FT5eUmbBnKT6okbJdRdkC2ZJha6?=

=?windows-1251?Q?2gvewAPRRV69PKfRfe3oYqIOUsCF9KLoLO+xa7CJFDzJeAIQGM55VF/w?=

=?windows-1251?Q?oB5uuk/auxQJJj5jzmivMDW20meBrbnsqs+e6a7tM5fsHBDrAyMR0Q9m?=

=?windows-1251?Q?tAknM9dym8WAVNa2+bPrAvndxRZSwbYm2ZFWvEJp0kzKOHd4BW4rB7Al?=

=?windows-1251?Q?pYD2D14yoNxI4Ov+artjRfgfgotNEcQunFvkH0O9nztPEHOTwOK3anJB?=

=?windows-1251?Q?JGDxygNIfoDqHmhnbwemzuRzpmZhjZl4qAJEWKpgtYPCWjLs+1n8czHP?=

=?windows-1251?Q?GiwwGF1tFfxgf0zoA9nwPhzzT3b6OsNtAPkhTyITDY4e02sWBZTic9vl?=

=?windows-1251?Q?bEhbgMuxv7A+5c88dfX3R0+XziqNaB5kFCLL2A4YRESkHunrawpZvgtm?=

=?windows-1251?Q?vhctbCtyzqrgj82j3jUhuBzXDEXAt8jL7Zr0u7ENPCzidsu+RDLyyR41?=

=?windows-1251?Q?d3HEmitIR1F97elXPRbG5mKxQkR5KJYCs+bpVMqV1Lzo+MT64sBIjOj5?=

=?windows-1251?Q?0XzPMSb32WolkvM6ioceN4q2JQnZ7iEKWI2s48oZx3lWk8BKqQLf+/Wc?=

=?windows-1251?Q?DEvAdGMSYp8tVpkSL9g/tlBbJV3AAUKKI/oAy2s5aJF70FwBjCrdSL8Q?=

=?windows-1251?Q?IYVX3Hsh61fryKgn7sYqwoiqp46E61U/X81y4JEflisIzoQxLxKeHSbV?=

=?windows-1251?Q?YBrLtingwoPZDEzhwma/cQNcWlzUGj1XLCluveqa0PRS1Z5k8/wo1TGA?=

=?windows-1251?Q?ML45ioTL0HUQkOpMgp7AhLFZIjUUo0c6s0yLX/mA/O90CE708hhot1fy?=

=?windows-1251?Q?sKquhyFHiP9yoIxYejIbOyMmxR7JfQ1Z2OSOLK0q/yNCvDXxjbv4PiAU?=

=?windows-1251?Q?KqDho8IgR14VikjGtg3UouTW/Wc54q3wVNUePPDjB2V8KWezH010kowD?=

=?windows-1251?Q?62vcBsK0hlkYW5YUnjnFXQOKVNr+AB6EpDDwRiuFok8yeB/7p4l5PfDY?=

=?windows-1251?Q?7dd495qw6zm4tvrGKIrxcufll9oAKxcu2Q7a25JGlEfNNR/yF6BD06cg?=

=?windows-1251?Q?nElLbyArn0tl1m/SU3ceU0vVCMKPr5vwTDdenZSTLnjXXYmi/7hH96XI?=

=?windows-1251?Q?UF8OOBtp0jcFsheUOL7pbI8U/sHX2xB1Kv8jNQbL7ZxRzLkMJd5xuVxD?=

=?windows-1251?Q?NlrdZindHSMj/lnm/ZXcwBEoUp54Pkbody0Ucmwd+n2LR39gs/4KxI+g?=

=?windows-1251?Q?pti1Z+wWoUkK58S++yukNp89xuCQRM90Oe6m9MMYyNKdyXhZ2LWUNAv4?=

=?windows-1251?Q?skvCPnWpTRH2eCeF7KLTfX9clptSeIouaO3U7MqDmWNke7xHzm3RE/Ki?=

=?windows-1251?Q?rWgkcA=3D=3D?=

X-Forefront-Antispam-Report:

CIP:58.26.8.159;CTRY:NL;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:User;PTR:modularisation.naturescar.com;CAT:OSPM;SFS:(13230016)(39860400002)(376002)(396003)(136003)(346002)(46966006)(40470700004)(31696002)(109986005)(86362001)(70206006)(8936002)(70586007)(156005)(32850700003)(36906005)(82740400003)(2906002)(40460700003)(316002)(7416002)(7406005)(956004)(8676002)(41300700001)(336012)(47076005)(5660300002)(83380400001)(9686003)(81166007)(35950700001)(26005)(82310400005)(40480700001)(6666004)(558084003)(498600001)(31686004)(2700400008);DIR:OUT;SFP:1501;

X-OriginatorOrg: myprasarana.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Aug 2022 00:00:48.0672

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: e159c72a-67cc-41c6-87b4-08da87bf3278

X-MS-Exchange-CrossTenant-Id: 3cbb2ff2-27fb-4993-aecf-bf16995e64c0

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3cbb2ff2-27fb-4993-aecf-bf16995e64c0;Ip=[58.26.8.159];Helo=[mail.prasarana.com.my]

X-MS-Exchange-CrossTenant-AuthSource:

SG2APC01FT0031.eop-APC01.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2PR04MB5429

X-Spam_score: 6.5

X-Spam_score_int: 65

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: I look forward to your response and cooperation toward this

great charity work. Truly Yours, Mrs. Ann Zainab



Content analysis details: (6.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 NSL_RCVD_FROM_USER Received from User

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.223.225 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

0.0 HK_NAME_MR_MRS No description available.

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

0.0 FAKE_REPLY_C No description available.

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} Re: Did You Receive My last Email?



I look forward to your response and cooperation toward this great charity work.



Truly Yours,

Mrs. Ann Zainab

SEO spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Aug 2022 14:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRgLV-000NID-AE

for dave@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 14:54:29 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Aug 2022 14:54:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f176.google.com ([209.85.208.176]:38674)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRe5E-000AbG-1i

for sales@nk.ca;

Fri, 26 Aug 2022 12:29:37 -0600

Received: by mail-lj1-f176.google.com with SMTP id s8so2368654ljj.5

for ; Fri, 26 Aug 2022 11:29:10 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=webdesignoutsourcers-com.20210112.gappssmtp.com; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version:from:to:cc;

bh=Cy8D8sK1/xLxTFOHJjlt1cRkN5XE1wBgRPoU2ENtT58=;

b=DF4qnd5ZQZkPhTEjCsCJi0Odqo3S29CmnXIOOtmua6ys/NsdSOEUIG2G+UPW6voneX

FHPL2wMoqYIxWkEk6769H9v0zboPYXm97TfZo8tt454pCmhTHvqmIf8KmSSioChFI5bJ

E+49iHKoczHwFMslhY4KsCt/ZzGvRCCWGQDVwp1DpPiPfTS+axVR9rfQl0rRqTIr+j5a

QpVcprOtkHYdvVevuH9U82UDoR8AQBYukZJ+I6nGSeN9vgDSUxnd9Ehkp8PfbX1i+0B8

jAVNdyDhiF+imYOjVZ6/fUbWw4V5Vb1Ua5tbtMTCDAk2kwsnFrmqP8qeXBrQfFSAZNi4

1/3w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version

:x-gm-message-state:from:to:cc;

bh=Cy8D8sK1/xLxTFOHJjlt1cRkN5XE1wBgRPoU2ENtT58=;

b=q7wLgDsQdWPOiO/gru6N4mLvajAkEkWMBOwE1sf/p0cMWspCUcA4O4BPTk5iJuOzxO

gc/sY5M8UsEx85MA4AYj5eA/5TVGYvhFNwcAigcYiZSdgl6SrnxKL46xt9b0QoSBEMeU

mv6RwZtVICljStSHQeTGR7wDqTPK+9c/bQ1r44h7aqFUFmykDB2Si4We7XkXTJAi9ZhG

wukSKqp9ecTTsjI4IOlnl31wtgpEnQu9M8WjygKXocp2VGmcGFbz2R5oKI7+uu1WJmnw

9jpUdSWa6KWE/QbfxX5s+TSZ8bRjpKmAtVJSsmyqIsDhCL0/zGfNgilZ4UkkdOMTrcMW

/UBw==

X-Gm-Message-State: ACgBeo1khzlnUUVa7FAvV33cGvBsbk2WQGVnpP1tB3lanFg1bhswYPUm

JNaewm1RsNorx/fKptCnqmW+ek8IoKzbNOYCoHUgbzO0Z8qcog==

X-Google-Smtp-Source: AA6agR6KEgtF92VcollSKULUOHlyvog9xf751fkTTW3UMGXbRgN84ZMMOGb1wpWg+smfID6CZXtotirHf4UyH/Nt6Yc=

X-Received: by 2002:a05:651c:238c:b0:261:d468:d633 with SMTP id

bk12-20020a05651c238c00b00261d468d633mr2636239ljb.479.1661538543455; Fri, 26

Aug 2022 11:29:03 -0700 (PDT)

Received: from 586015324275 named unknown by gmailapi.google.com with

HTTPREST; Fri, 26 Aug 2022 14:29:02 -0400

MIME-Version: 1.0

Sender: Fahad Hassen

From: Fahad Hassen

Date: Fri, 26 Aug 2022 14:29:02 -0400

X-Google-Sender-Auth: H5yvPH2XgWbqv68Xj56cgyZvHAE

Message-ID:

Subject: mypaintsshop website question - Google Business Profile

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000a9d63505e7291610"



--000000000000a9d63505e7291610

Content-Type: text/plain; charset="UTF-8"



Hi,



I found your email from mypaintsshop.com and would like to ask if anyone is

handling your digital marketing as a whole? If not, I am eager to take this

up for you and can guarantee results - I am really enthusiastic about this

and if you too are excited to discuss, I can send you my strategy for your

quick review, of course under no obligation. Who knows - it could be a game

changer if everything strikes up right and if no action taken, no reward

can be expected anyway.



A little about me - I am Fahad Hassen, and I am a Google certified "Google

My Business" specialist, and "Google Ads" specialist - I will give you

verifiable references upon interest. With "Google My Business", you will

not pay anything to Google and with the correct setup, you can get very

good results. But with Google Ads of course, you can get quick results but

it comes at a cost, and if you have a good process to handle the traffic,

you could strike it big.



If I send you a small overview report, will you give it 10min to read? That

is all I want to know and if you say "Yes", I will send it in :-)



Fahad Hassen

(Google My Business/Google Ads specialist, certified by Google Inc)



Note - I'll send in my contact details, LinkedIn, website and work samples

upon your interest. I have been working with local businesses on their

digital marketing for the past 20 years and I am sure you will be impressed

with what I can do for you. I get the certifications renewed every year

from Google, and will present it to you upon reply. Thank you.



--000000000000a9d63505e7291610

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,

I found your email from
ntsshop.com">mypaintsshop.com and would like to ask if anyone is handli=

ng your digital marketing as a whole? If not, I am eager to take this up fo=

r you and can guarantee results - I am really enthusiastic about this and i=

f you too are excited to discuss, I can send you my strategy for your quick=

review, of course under no obligation. Who knows - it could be a game chan=

ger if everything strikes up right and if no action taken, no reward can be=

expected anyway.

A little about me - I am Fahad Hassen, and I am a =

Google certified "Google My Business" specialist, and "Googl=

e Ads" specialist - I will give you verifiable references upon interes=

t. With "Google My Business", you will not pay anything to Google=

and with the correct setup, you can get very good results. But with Google=

Ads of course, you can get quick results but it comes at a cost, and if yo=

u have a good process to handle the traffic, you could strike it big.

r>If I send you a small overview report, will you give it 10min to read? Th=

at is all I want to know and if you say "Yes", I will send it in =

:-)

Fahad Hassen
(Google My Business/Google Ads specialist, certif=

ied by Google Inc)
=C2=A0
Note - I'll send in my contact details,=

LinkedIn, website and work samples upon your interest. I have been working=

with local businesses on their digital marketing for the past 20 years and=

I am sure you will be impressed with what I can do for you. I get the cert=

ifications renewed every year from Google, and will present it to you upon =

reply. Thank you.




--000000000000a9d63505e7291610--

Nigerian Gmail spam

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Aug 2022 10:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRcDu-000PwA-2z

for dave@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 10:30:22 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Aug 2022 10:30:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f68.google.com ([209.85.210.68]:34452)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRbJd-000KVt-QN

for doctor@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 09:32:18 -0600

Received: by mail-ot1-f68.google.com with SMTP id q39-20020a056830442700b0063889adc0ddso1242330otv.1

for ; Fri, 26 Aug 2022 08:31:56 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc;

bh=45M5w7GXGhDaHEQwL25lX9CTGRVaeOJaQXcMnDBQBJA=;

b=Whwrk+Tv0ND8qfQnhD3YJZWKo48t/V5ocNnwxwyc6meJJT809NuIRKF73pVANvmWzg

Yuit4rPF1uD3qDggQObwTX9nEbPY1bxmkjXI7fNzqOtQfXPsxAn7ZZK+y7Nndlsxas0B

tnASJkA7MlxW98AzcDrEIQkcA09/0fXTvPiIRILh0PMrFjTG9obguUTSICVUztUm0B+d

YPZdiW0YX1i1jYcLvSWQpDnd6k907IuhP5k8MPDO012rclyIW4zS0czIAFYwZc8Ryc8D

OBsSxHfEMAO01B1d6ma2JEIwTRjZL4TJNJOu9H1bpvib0VgdtqmB0xkB6JqhI3wh0Fs1

xkdg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc;

bh=45M5w7GXGhDaHEQwL25lX9CTGRVaeOJaQXcMnDBQBJA=;

b=eNdrdge7FIIpILeSQrb7Me+uP1yVZTUozXD3uQZAWiDCRJ/DQaFS8etNGCbieAJKKx

xqyXa58VwLkA2/HTujNltMdr7gSovxSPhN5+anvfvFsl+KW0PotTvnlE/tao4p5Pj88Q

u6ZM75L5ttZTuc01Xot7I8fIYTTq22YE8JvvalSSgYZKy+WlNZBb1/N+Fyf1/tFqpdW7

Hiwnbh1PUzJF+5KGss7xH/rD27/nbs5s+smjoR+MSAmbuYFQbf2YSKjcQmRzNcpF1lLU

LOg/z/bh0GFB//qBJHc1P8RMtQ317Scx/EGS789iaOFGuu0eUGQ2votFnfbBPUfcdMML

+8Vw==

X-Gm-Message-State: ACgBeo0yp+tUXFx1ypGDKCUHNKYVCielt6/eI08jn5QUmU/gz0+/X+h8

y5c04JlcGqjqlyj7NulMn+Hqxie8x7TflrR41yk=

X-Google-Smtp-Source: AA6agR4kZ80nVwiXnJ6iiNX83SE85pNMZcw4p426vCh/hpFY2lTOgx5dWBiCWNZz1flUbelddWcFszSCKlCHFn7e73I=

X-Received: by 2002:a05:6830:18c4:b0:636:ee33:158e with SMTP id

v4-20020a05683018c400b00636ee33158emr1590921ote.239.1661527910426; Fri, 26

Aug 2022 08:31:50 -0700 (PDT)

MIME-Version: 1.0

From: Mrs Aisha Al-Qaddafi

Date: Fri, 26 Aug 2022 08:31:30 -0700

Message-ID:

Subject: MY Beloved one, i need your assistance

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000e2af6305e7269c88"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 11.8

X-Spam_score_int: 118

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: MY Beloved one, i need your assistance Please bear with me.

I am writing this letter to you with tears and sorrow from my heart. I am

Aisha Muammar Gaddafi, the only daughter of the embattled president of Libya,

Hon. Muammar Gaddafi. I know my mail might come to you as a surprise because

you don’t know me, but due to the unso [...]



Content analysis details: (11.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

DNSWL was blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[209.85.210.68 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.68 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[leahsamson87[at]gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[leahsamson87[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 HK_SCAM_N2 BODY: No description available.

0.1 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

1.0 HK_SCAM_N15 BODY: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 HK_NAME_FM_MR_MRS No description available.

0.0 T_HK_NAME_FM_MR_MRS No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 HK_SCAM No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 XFER_LOTSA_MONEY Transfer a lot of money

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} MY Beloved one, i need your assistance



--000000000000e2af6305e7269c88

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



MY Beloved one, i need your assistance



Please bear with me. I am writing this letter to you with tears and sorrow

from my heart.



I am Aisha Muammar Gaddafi, the only daughter of the embattled president of

Libya, Hon. Muammar Gaddafi. I know my mail might come to you as a surprise

because you don=E2=80=99t know me, but due to the unsolicited nature of my

situation here in Refugee camp Ouagadougou Burkina Faso i decided to

contact you for help. I have passed through pains and sorrowful moments

since the death of my father. At the same time, my family is the target of

Western nations led by Nato who want to destroy my father at all costs. Our

investments and bank accounts in several countries are their targets to

freeze.



My Father of blessed memory deposited the sum of $27.5M (Twenty Seven

Million Five Hundred Thousand Dollars) in a Bank at Burkina Faso which he

used my name as the next of kin. I have been commissioned by the (BOA) bank

to present an interested foreign investor/partner who can stand as my

trustee and receive the fund in his account for a possible investment in

his country due to my refugee status here in Burkina Faso.



I am in search of an honest and reliable person who will help me and stand

as my trustee so that I will present him to the Bank for the transfer of

the fund to his bank account overseas. I have chosen to contact you after

my prayers and I believe that you will not betray my trust but rather take

me as your own sister or daughter. If this transaction interests you, you

don't have to disclose it to anybody because of what is going on with my

entire family, if the United nation happens to know this account, they will

freeze it as they freeze others, so please keep this transaction only to

yourself until we finalize it.



Sorry for my pictures. I will enclose it in my next mail and more about me

when I hear from you okay.



Yours Sincerely

Best Regard,

Aisha Gaddafi



--000000000000e2af6305e7269c88

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



MY Beloved one, i need your assistance

Please bear =

with me. I am writing this letter to you with tears and sorrow from my hear=

t.

I am Aisha Muammar Gaddafi, the only daughter of the embattled pr=

esident of Libya, Hon. Muammar Gaddafi. I know my mail might come to you as=

a surprise because you don=E2=80=99t know me, but due to the unsolicited n=

ature of my situation here in Refugee camp Ouagadougou Burkina Faso i decid=

ed to contact you for help. I have passed through pains and sorrowful momen=

ts since the death of my father. At the same time, my family is the target =

of Western nations led by Nato who want to destroy my father at all costs. =

Our investments and bank accounts in several countries are their targets to=

freeze.

My Father of blessed memory deposited the sum of $27.5M (Tw=

enty Seven Million Five Hundred Thousand Dollars) in a Bank at Burkina Faso=

which he used my name as the next of kin. I have been commissioned by the =

(BOA) bank to present an interested foreign investor/partner who can stand =

as my trustee and receive the fund in his account for a possible investment=

in his country due to my refugee status here in Burkina Faso.

I am =

in search of an honest and reliable person who will help me and stand as my=

trustee so that I will present him to the Bank for the transfer of the fun=

d to his bank account overseas. I have chosen to contact you after my praye=

rs and I believe that you will not betray my trust but rather take me as yo=

ur own sister or daughter. If this transaction interests you, you don't=

have to disclose it to anybody because of what is going on with my entire =

family, if the United nation happens to know this account, they will freeze=

it as they freeze others, so please keep this transaction only to yourself=

until we finalize it.

Sorry for my pictures. I will enclose it in m=

y next mail and more about me when I hear from you okay.

Yours Since=

rely
Best Regard, =C2=A0
Aisha Gaddafi




--000000000000e2af6305e7269c88--

Business deal spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Aug 2022 08:03:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRZuT-000BwN-Pt

for dave@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 08:02:09 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Aug 2022 08:02:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f174.google.com ([209.85.210.174]:44622)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRYOo-0008dq-4D

for doctor@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 06:25:26 -0600

Received: by mail-pf1-f174.google.com with SMTP id f17so1385155pfk.11

for ; Fri, 26 Aug 2022 05:25:04 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc;

bh=4IAVCA2gJTTjDt5CBjLggMJFJuBSUP41/Lvi+HTqvVI=;

b=Hi2HpAK1yqHNv8ZJAjUUQVvu/VaJoMdZP2U9qLSSsp0N3GQr63+HtJflOqAV3+Wqkv

zPmAIFZEVisSDLO3fSN6070WHOvnD3aycgWBHN0+z95yLo2vzcctR7T96v+6vlENjQMG

CeMjes9YEs9eN0lphxJR7avwLJofMPQGj0u2qVd0aaEfEAZOnB/pB4k6ok9lEnN/NOnh

d8t6PHKzP467hp0YG0w8MJ4/bMrnYfE7VCKImQVRvcB2YJNQ/ueB5xQSA+gBneEAtRkG

12X49/kNYrE/vLATGkEnucplZ+gRdvlQCXTtiHAMWsKwZRIY6kuU7b6rb+3h4R+uZT40

2krQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc;

bh=4IAVCA2gJTTjDt5CBjLggMJFJuBSUP41/Lvi+HTqvVI=;

b=Rr3uBf9+BmM2grdqv4OZY5AWqiqMAp9NM8UjcBkx+AtdUMJr9bGtJsK1/nJjFt38x9

0pfq41X2uIMYenLoTenlyX7faMm+ArDuKSwL0d+8DX/yVgeoqSzaN4990VTWHeNWqiQt

esohKyQqUhTLH4xwPYNBmUeyZyn6chV+siWyrqGgfRrz3j+j3cJl4TKVkMfJgFlp6jnU

wdWXIgCVKIu2YgmqvlapJLWLuvAobcPV4l0LvLJX208PPT2mOX6DtfJGQBm4tHw4B315

7Ao7CBLax3mQ1CsufCfvwVw02USE/FWSuRAB6H7D6SiiIWcDuXBw3mf27wNDpCfh/ItM

DrbQ==

X-Gm-Message-State: ACgBeo1jX2QzHinQMK6Wq4FMFxa1m1+FQdxMdw2inWF4xysiNEP9PZhj

jQY3sVXyugIpyOX0u/gzT+IiIUlfz8Pph8n3C6U=

X-Google-Smtp-Source: AA6agR6xvnytaeYdZtNYeqXPsePMrnbBVDx55vnGbLoW8Uts2rwTaJUif96M+Y6Cs+oO3uwBZiH44IALgPGc0RnLfgw=

X-Received: by 2002:a65:6755:0:b0:41d:70c1:be0 with SMTP id

c21-20020a656755000000b0041d70c10be0mr3145387pgu.99.1661516699418; Fri, 26

Aug 2022 05:24:59 -0700 (PDT)

MIME-Version: 1.0

From: "Dr. Umar Bello"

Date: Fri, 26 Aug 2022 05:24:45 -0700

Message-ID:

Subject: Greetings dear Friend:

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000a846f905e7240097"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 13.3

X-Spam_score_int: 133

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings dear Friend: I am contacting you on a business deal

of $19.5 Million US Dollars, ready for transfer into your account if we make

this claim, we will share it 60%/40%.100% risk free and it will be legally

backed up with government approved If you are interested reply for more details.





Content analysis details: (13.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.174 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[a0sis4ite31[at]gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends

in digit

[a0sis4ite31[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

3.6 NA_DOLLARS BODY: Talks about a million North American dollars

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_HK_NAME_FM_DR No description available.

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

3.1 RISK_FREE No risk!

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Greetings dear Friend:



--000000000000a846f905e7240097

Content-Type: text/plain; charset="UTF-8"



Greetings dear Friend:



I am contacting you on a business deal of $19.5 Million US Dollars,

ready for transfer into your account



if we make this claim, we will share it 60%/40%.100% risk free and it

will be legally backed up with government approved If you are

interested reply for more details.



Kindly reply for more details Waiting for your reply Make Sure You

Write To My Via E-mail Address...(umarbellod46@gmail.com)



Best regards

Dr.Umar Bello,



--000000000000a846f905e7240097

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings dear Friend:
=C2=A0 =C2=A0
=C2=A0 I am co=

ntacting you on a business deal of $19.5 Million US Dollars,
ready for t=

ransfer into your account

if we make this claim, we will share it 60=

%/40%.100% risk free and it
will be legally backed up with government ap=

proved If you are
interested reply for more details.

Kindly reply=

=C2=A0for more details Waiting for your reply =C2=A0Make Sure You
Write=

To My Via E-mail Address...(umar=

bellod46@gmail.com)

Best regards
Dr.Umar Bello,




--000000000000a846f905e7240097--

Bank deposit phish from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Aug 2022 08:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRZu8-000Btw-Ay

for dave@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 08:01:48 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Aug 2022 08:01:48 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-il1-f169.google.com ([209.85.166.169]:40460)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRXbc-0004Jt-03

for doctor@nl2k.ab.ca;

Fri, 26 Aug 2022 05:34:36 -0600

Received: by mail-il1-f169.google.com with SMTP id m8so457686ilg.7

for ; Fri, 26 Aug 2022 04:34:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version:from:to:cc;

bh=g+G6KwMGqKTv9KBq+u9XSag1LenF14W0ni2JrKw/1S4=;

b=WHl8RkNZgEGFJFMiLBRTBdo/rowkvdwxJRJqMjroTEsUwAF+mPcCSZMW4yq5nYrQFY

Dlnx08q3KumEZHi/36wymLuTYfc2Hgy5mGetYhaAxIWwrbm3xHF8Dfz9spOlusE2pUHP

ObvlO5Y+9LmxClyaeFrzrxLPoiArfw1EOku9deXJKdyQ1kaR+ScovOvZsBAHIqh56aJ8

zAe9CysZMiFgpWVXIUvFMR6MrCuJPv8MiZeaZ3iAkptb3YivjGOaBQshjI2pYZOd1faG

NWa9XOApEmjO5ZNIRXcmopKpd3d5nu/ts7MKNCTODm0Q2Ic0I3qGP+EtQOayFHMX9C1V

gPdA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:sender:mime-version

:x-gm-message-state:from:to:cc;

bh=g+G6KwMGqKTv9KBq+u9XSag1LenF14W0ni2JrKw/1S4=;

b=vTgVvkGWF76jRuBqoQOK67+AD/0PnUy2FndHDXO3nTgxHmPeK77Lrir4qdXJvqV/EZ

l3XI+/8GDkbAphQtqoF1WNqK16MuHrSs128C70RwiKGNYsKlWEdSPL1kAE/O1yqyh43D

296CnxVCAfJhTWhO9TmmuY273kcizP3hHQVu1xXgm5yCOMWeqWIvpni+U8ajcWqz2Q7G

ZiMgMGZCYOd3THbPzTL1rdcMiSQeuinWZS8MrWJpv5yC6d96apfMfhudTA2GRsCUhv3x

8AtTiae+yEK1eTmPR5lUB/y5rpQdikRMKoQ4siye2mgfFDrrVhqc+HBQ9jYEp/tXadjX

Obeg==

X-Gm-Message-State: ACgBeo2cybyWYrTMUaCy5YmuqAf+R4fUqS/Niv1a1Ngtkgy8lX/+TM9h

JaKgnEl6RcDyAaBkh7hi4k4jbfqj13t8VL8wNmU=

X-Google-Smtp-Source: AA6agR4lvJ0cTeEtYcMwjiaWMTAFHN44viHHry81nKSBHzDyCijG/IgEArFKxXExeHqtZra1ARBlN7rUkAUgBYvbG+A=

X-Received: by 2002:a92:c6c2:0:b0:2e9:627c:78bc with SMTP id

v2-20020a92c6c2000000b002e9627c78bcmr3795174ilm.288.1661513643284; Fri, 26

Aug 2022 04:34:03 -0700 (PDT)

MIME-Version: 1.0

Sender: bombirialfred@gmail.com

Received: by 2002:a4f:f186:0:0:0:0:0 with HTTP; Fri, 26 Aug 2022 04:34:02

-0700 (PDT)

From: sofiaoleksander

Date: Fri, 26 Aug 2022 12:34:02 +0100

X-Google-Sender-Auth: KJea-Phrr-9oE243_-kbqZ_lqZs

Message-ID:

Subject: Dearest,

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 7.1

X-Spam_score_int: 71

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dearest, My Name is, sofia oleksander, a 20 years old girl

from Ukraine and am presently in a refugee camp here in Poland. I lost my

parents in the recent war in Ukraine, right now am in a refugee camp in Pol

[...]



Content analysis details: (7.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.166.169 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[sofiaoleksander2[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 MILLION_USD BODY: Talks about millions of dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.0 TVD_PH_BODY_META No description available.

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Dearest,



Dearest,



My Name is, sofia oleksander, a 20 years old girl from Ukraine and

am presently in a refugee camp here in Poland. I lost my parents in

the recent war in Ukraine, right now am in a refugee camp in Poland.

Please am in great need of your help in transferring my late father

deposited fund, the sum of $3.5 MILLION UNITED STATES DOLLAR, he

deposited in a bank in United State.



the deposited money was from the sale of the company shares death

benefits payment, and entitlements of my deceased father by his

company. I have every necessary document for the fund, I seek for an

honest foreigner who will stand as my foreign partner and investor. I

just need this fund to be transferred to your bank account so that I

will come over to your country and complete my education over there in

your country. as you know, my country has been in a deep crisis due to

the recent war and I cannot go back.



Please I need your urgent,

sofia oleksander,

Oil Nigerian spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 26 Aug 2022 07:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRZqL-000BZq-VQ

for dave@doctor.nl2k.ab.ca;

Fri, 26 Aug 2022 07:57:53 -0600

Resent-From: The Doctor

Resent-Date: Fri, 26 Aug 2022 07:57:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f65.google.com ([209.85.128.65]:46726)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRU0C-000C17-8V

for sales@nk.ca;

Fri, 26 Aug 2022 01:43:45 -0600

Received: by mail-wm1-f65.google.com with SMTP id k6-20020a05600c1c8600b003a54ecc62f6so361114wms.5

for ; Fri, 26 Aug 2022 00:43:22 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc;

bh=LeeQxhXRRGI+H/HFNWXMdSDJLgJ0hJDp+WrfttuPZRI=;

b=XWc4mTPpzPkibXfrxUsHgktE/FfLxM0NDlfsiC8tyqjcVEQLyflMTZCyVPDaTx6QLY

GRtyj7zeOX116kjcEvQogiGmcSVgBd0/xMGyMT4iz6zuChdKPcc0ZEtkJvuUwqr0Qi1t

IAkcJP9dyCUGulYPm8PAvTsigeeQOaHKxauG2oCa4xBP/4IGnt4V//ZvI+WqylOWKKHe

sp2D+X2VICJICsYzenEkquIhI33OgvCnK/0ILhLvYVLoqnEeqfCcID1SACXibUBnu4Vb

KRK1ZLrOOh/cr7SWxxNd/j9McqFlXs2tLfIqioqxG/MWuc0KankXIR9RoiXofOtAUP6e

7FNQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc;

bh=LeeQxhXRRGI+H/HFNWXMdSDJLgJ0hJDp+WrfttuPZRI=;

b=pG1zHHFW00oqndElyKulLSfsZY+B0fnzw3X2sCJeqqTD8cw3h1MFRNT9YVypfTJ7wb

gBQncg5e/mFpr4m4JzYQSCEiHhFVINOI0/uKT/1h1EWPfWd80yaCzV+q2hA5VpOKAQ7d

F9i0ycKg59hqexTmzWuU8c08JacWYEs0+ob+ILhO5c17nXOjqpbY6Ie+NPrmvYV9adul

Ix5DP0MH0WAju00vLNG68HTQm9CrndS9tvR2RhXz1H3oclwXWbChvdzxUk9NaN/kAE2W

l1AGEh6yng/i/ivx63sbw7zzag675KWUjnkv1ydAQfVXmZHcwdmYt8vzJPRpZ4iV0LuP

iN4w==

X-Gm-Message-State: ACgBeo0P5IhSW33bzEsRjp3Mt3dlewQ56NvOYNW9a1d5b/AvPzX79QeY

WTyAOK1C4Q8Mc2qJNIRDNmSU7ww8epAdWJy6zg==

X-Google-Smtp-Source: AA6agR66ZQlQYyklIkQ2OdYYYyMT0XUk8XfYqe7uEvCMvVn3SBvg2Wsn6JVjm1TDtTgsHahGuvojHfDDzxHJCEs2vS8=

X-Received: by 2002:a7b:ca58:0:b0:3a5:3c1c:6d71 with SMTP id

m24-20020a7bca58000000b003a53c1c6d71mr10473194wml.118.1661499796200; Fri, 26

Aug 2022 00:43:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: michaeladrian.cs@yahoo.com

From: Michael Adrain

Date: Fri, 26 Aug 2022 08:43:06 +0100

Message-ID:

Subject: Petroleum & Oil Marketing

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000025a02605e72011d8"

Bcc: sales@nk.ca

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: -- Attention: Dear Friend, I wish to introduce you to this

highly prospective crude oil sale venture, I propose that you may become

a partner the a crude oil & Petroleum products sales project under the umbrella

of the West Afr [...]



Content analysis details: (10.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.65 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[michadrian.cs[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain

different freemails

3.2 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.7 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

2.8 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Petroleum & Oil Marketing



--00000000000025a02605e72011d8

Content-Type: text/plain; charset="UTF-8"



--

Attention: Dear Friend,



I wish to introduce you to this highly prospective crude oil sale venture,

I propose that you may become a partner the a crude oil & Petroleum

products sales project under the umbrella of the West Africa Petroleum &

Oil Marketing Agency.

In this project, we will register you as our partner and act as

representative in selling crude oil & Petroleum products to the end buyers.



In the end of period review, some of the companies could not actualize

their target in the project as a result of incapability, so their license

have been frozen and declared vacant.

We will re-assign the failed license to you, this will give you the legal

authority to act as agent/representative.



The assignment of the crude oil & Petroleum products sale and refining

license allocation to you the privilege to operate as first lifters of

crude oil & Petroleum products from the block. This attracts US$2.00

discount per barrel to the lifter on crude oil. The US$2.00 is our

(lifter) entitlement from the local petroleum agency, also been able to get

final buyers entitles you also to a US$1.00 discount from the discount

given to the end buyer as "mandates", as you are expected to be lifting 2

million barrels per month from the block.



This totals to US$6 million gross coming to your group per transaction.

What is so interesting about the project is that whereby you do not have

immediate end buyer, such people who do not have license would be ready

buyers on the spot and you part with your due commission.

We will gladly appreciate your kind interest to be part of this venture,

get back to me.





Mr. Michael Adrain

W. Licensing & Procurement Department.

WAOPMA Crude Oil & Petroleum Product Marketing Agency.

Official E-mail; wacoppma@consultant.com



--00000000000025a02605e72011d8

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





--

il=3D"gmail_signature">
<=

div>Attention: Dear =

Friend,

-size:12px">

e=3D"font-size:12px">I

wish to introduce you to this highly prospective crude oil sale=20

venture, I propose that you=C2=A0 may become a partner the a crude oil &=

;=20

Petroleum products sales project under the umbrella of the West Africa=20

Petroleum & Oil Marketing Agency.

=3D"#000000">In

this project, we will register you as our partner and act as=20

representative in selling crude oil & Petroleum products to the end=20

buyers.

-size:12px">

e=3D"font-size:12px">In

the end of period review, some of the companies could not actualize=20

their target in the project as a result of incapability, so their=20

license have been frozen and declared vacant.

color=3D"#000000">We will re-assign the fai=

led license to you, this will give you the legal authority to act as agent/=

representative.

=3D"font-size:12px">

pan style=3D"font-size:12px">The

assignment of the crude oil & Petroleum products sale and refining=20

license allocation to you the privilege to operate as first lifters of=20

crude oil & Petroleum products from the block.=C2=A0 This attracts=20

US$2.00 discount per barrel to the lifter on crude oil. The US$2.00 is=20

our

e:12px">(lifter)

entitlement from the local petroleum agency, also been able to get=20

final buyers entitles you also to a US$1.00 discount from the discount=20

given to the end buyer as "mandates", as you are expected to be l=

ifting 2

million barrels per month from the block.=C2=A0

ont color=3D"#000000">

v>
This

totals to US$6 million gross coming to your group per transaction. What

is so interesting about the project is that whereby you do not have=20

immediate end buyer, such people who do not have license would be ready=20

buyers on the spot and you part with your due commission.
v>
We will gladl=

y appreciate your kind interest to be part of this venture, get back to me.=


2px">

nt-size:12px">

yle=3D"font-size:12px">Mr. Michael Adrain

color=3D"#000000">W. Licensing & Procur=

ement Department.

le=3D"font-size:12px">WAOPMA Crude Oil & Petroleum Product Marketing Ag=

ency.




--00000000000025a02605e72011d8--

Wealth spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 25 Aug 2022 22:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRRKc-000OHy-6S

for dave@doctor.nl2k.ab.ca;

Thu, 25 Aug 2022 22:52:34 -0600

Resent-From: The Doctor

Resent-Date: Thu, 25 Aug 2022 22:52:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f180.google.com ([209.85.214.180]:34512)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRQEX-000Jat-E2

for root@doctor.nl2k.ab.ca;

Thu, 25 Aug 2022 21:42:17 -0600

Received: by mail-pl1-f180.google.com with SMTP id io24so544190plb.1

for ; Thu, 25 Aug 2022 20:41:52 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc;

bh=SRD61DhjE+olsWnXHhz0T7pdvB9WWyr7Cqd6nWIbZsw=;

b=jJMZCp+VllG0p5ytiYgib3FjYaeYCjktstzj9Ryp3+2Ak4g3o7QenFFZ/ZGTh4Kief

Kb08SHCLwiAloWjCfBJ/vBrkuyBiO2RYBtg5gtBQUMcfceyrBq0KwFJzsrxu2aC76g3a

CbwDBY1qRBvXwAMp0tRwY+/MGN76klnv+Vx59RpyElQMY6NbeHTFwNy66uF6giE9ZVfN

v6czdZ7r9uW3JDE+ax+g70ZHC7sQq1AqXQyg8Hixs4PFPCXhtZDdgv5OyIgFuBr18VgT

yUDYuOeDE8yEiIqMRVvZMucqll0NyHiTwlTK+8TllZ2qgdyM06X1/RTk70+Yak2BbB8u

XKig==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc;

bh=SRD61DhjE+olsWnXHhz0T7pdvB9WWyr7Cqd6nWIbZsw=;

b=8B40jgVSMtUZmGEOjAFAUsnxl6waO4uAp0+h+H3lP4TtjNJr9Qfg6xR1erMxtYINXT

Qni42+gfTuztEVetIlkTq2RBx0SvriTLFmd2hO29hfC+NxZj4tywaXwF5Z/HjqlTP/Qq

eDJLqBzWb5LbFQWkp9qkCl+RNbKYGx5ZSsr0XmFgoZ2nhfLj7W49QGAZGkDp/eEXNjYb

MmsMHESdsZfAkNLYEDESAhmjXICYG1AOyReMJEwCxIi3la1W3GPdttF/NzrU4tXVsgIY

5DGup5ytQFeT7RhpXUQtBikW1XmXcqs0JvhKt1JxwE2EVYja2tHBNipcE8wItWGhRuJJ

fK7Q==

X-Gm-Message-State: ACgBeo1DSccVsbhtcoRSOwT6KDcAd6hXD1mVMCyyU3l52OsOTfeHE6MR

Yj4Pyd6BI0jGmtRlk9uUZuz9RmlKz6+1A6+PO/0=

X-Google-Smtp-Source: AA6agR6KAgsbR/c/s3dl84np4oJKXpxmsfY6LoydEZOZkoDB4JOFxjiK4qqsEHCk6hWY3BqCx/0lC//ufFPE0pf2m7s=

X-Received: by 2002:a17:90b:1a85:b0:1fb:1f0b:dd43 with SMTP id

ng5-20020a17090b1a8500b001fb1f0bdd43mr2283105pjb.213.1661485306613; Thu, 25

Aug 2022 20:41:46 -0700 (PDT)

MIME-Version: 1.0

From: Graham Fabin

Date: Fri, 26 Aug 2022 04:41:15 +0100

Message-ID:

Subject: LIFE TRANSFORMING WORD-WEALTH

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000080140405e71cb14c"

Bcc: root@doctor.nl2k.ab.ca



--00000000000080140405e71cb14c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings



My name is Graham Eric Fabin, a Poland citizen and a banker by profession,

but I lived in the United States and United Kingdom almost all my entire

life. I am pleased to have found your contact information and I would

appreciate your quick response, so I can provide you with more information

on why I contacted you.



If you=E2=80=99re interested to hear the LIFE TRANSFORMING WORD/WEALTH, jus=

t

respond via this Email: erikagraham27@gmail.com



Regards,

Graham Eric Fabin



--00000000000080140405e71cb14c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings=C2=A0

=

My name is Graham Eric Fabin, a Poland citizen and a banker by profess=

ion, but I lived in the United States and United Kingdom almost all my enti=

re life. I am pleased to have found your contact information and I would ap=

preciate your quick response, so I can provide you with more information on=

why I contacted you.

If you=E2=80=99re interested=

to hear the LIFE TRANSFORMING WORD/WEALTH, just respond via this Email:
href=3D"mailto:erikagraham27@gmail.com">erikagraham27@gmail.com
<=

div>
Regards,
Graham Eric Fabin




--00000000000080140405e71cb14c--

UPS phish from Qualtrics LLC Utah

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 25 Aug 2022 12:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRHnL-0000uV-K1

for dave@doctor.nl2k.ab.ca;

Thu, 25 Aug 2022 12:41:35 -0600

Resent-From: The Doctor

Resent-Date: Thu, 25 Aug 2022 12:41:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp8.iad1.qemailserver.com ([162.247.216.57]:30546)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oREwS-0007BA-R0

for root@nk.ca;

Thu, 25 Aug 2022 09:38:56 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=simple/relaxed; t=1661441900;

s=qualtrics_e60519; d=ups.com;

h=Date:From:Sender:Reply-To:To:Message-ID:Subject:MIME-Version:Content-Type:List-Unsubscribe;

l=24035; bh=PUfpdaBph3u+bWKHgN6+vx0w38djNOnsN95ctMbMXNI=;

b=eCeOC4etQTs5NKLcJGVicHWRf+9VpsWhQ8vZMDWMjsHfmkA42HydN9K5/daZeiSk

nJtg1eziJjshX65BR3OXoLOCn9LqPIMpNVd9TaMna5CKCgqtyQ9gQ7rlM8DVC1Pf4KV

uGMWjdkqd6bswyllpmNZC79AE1HHYei5vogF5XSE=

Date: Thu, 25 Aug 2022 09:38:20 -0600 (MDT)

From: Greg Kane

Sender: Greg Kane

Reply-To: Greg Kane

To: Dave Yadallee

Message-ID: <2036187397.25414813.1661441900691@jwm9-app.iad1.qprod.net>

Subject: UPS And I Would Like Your Opinion

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_Part_25414810_479863320.1661441900681"

X-QUMID: UR_57O4FTykC6btlop-EMD_vi0a4BxuJFar0n5-CTR_3faB95BI2LeT9SS-SV_5pe7qC7lyj23Hfw

List-Unsubscribe: ,



------=_Part_25414810_479863320.1661441900681

Content-Type: multipart/alternative;

boundary="----=_Part_25414811_1381060667.1661441900681"



------=_Part_25414811_1381060667.1661441900681

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: quoted-printable













Dear Valued Customer,



We'd like to hear about your experience with UPS as a recipient of an

international shipment(package originating from outside of Canada). Please =

take

2 minutes to complete this survey.





Based on your experience receiving international shipments via UPS, how

likely are you to recommend UPS to a friend or colleague? Not at all likely

Extremely likely 0


xuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_PopulateRespo=

nse=3D%7B%22QID1%22:%220%22%7D&Q_PopulateValidate=3D1>

1


xuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_PopulateRespo=

nse=3D%7B%22QID1%22:%221%22%7D&Q_PopulateValidate=3D1>

2


xuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_PopulateRespo=

nse=3D%7B%22QID1%22:%222%22%7D&Q_PopulateValidate=3D1>

3


xuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_PopulateRespo=

nse=3D%7B%22QID1%22:%223%22%7D&Q_PopulateValidate=3D1>

4


xuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_PopulateRespo=

nse=3D%7B%22QID1%22:%224%22%7D&Q_PopulateValidate=3D1>

5


xuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_PopulateRespo=

nse=3D%7B%22QID1%22:%225%22%7D&Q_PopulateValidate=3D1>

6


xuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_PopulateRespo=

nse=3D%7B%22QID1%22:%226%22%7D&Q_PopulateValidate=3D1>

7


xuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_PopulateRespo=

nse=3D%7B%22QID1%22:%227%22%7D&Q_PopulateValidate=3D1>

8


xuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_PopulateRespo=

nse=3D%7B%22QID1%22:%228%22%7D&Q_PopulateValidate=3D1>

9


xuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_PopulateRespo=

nse=3D%7B%22QID1%22:%229%22%7D&Q_PopulateValidate=3D1>

10


xuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_PopulateRespo=

nse=3D%7B%22QID1%22:%2210%22%7D&Q_PopulateValidate=3D1>

You can also access directly <>here


xuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail>

.



Thank you for your participation.





Greg Kane

VP of Marketing, UPS Canada







This message was sent to you by United Parcel Service Canada Ltd.

1930 Derry Road East, Mississauga, ON L5S 1E2, ups.com.



You can update your email preferences


ss=3Droot@nk.ca>

orunsubscribe*


@nk.ca>

from UPS marketing email at any time. For information on UPS's privacy

practices refer to theUPS Privacy Notice


.page>

.



Note: If you unsubscribe from UPS marketing emails you may continue to

receive other email from UPS such as UPS Quantum View=C2=AE Notify shipment=

alerts,

details about your account(s) and operational information regarding existin=

g

products,

services and systems.



=C2=A92022 United Parcel Service of America, Inc. UPS, the UPS brandmark, a=

nd the

color brown are trademarks of United Parcel Service of America, Inc. All ri=

ghts

reserved.






faB95BI2LeT9SS&LID=3DUR_57O4FTykC6btlop&DID=3DEMD_vi0a4BxuJFar0n5&BT=3DdXBz=

Y3g&_=3D1>

------=_Part_25414811_1381060667.1661441900681

Content-Type: multipart/related;

boundary="----=_Part_25414812_1072820933.1661441900681"



------=_Part_25414812_1072820933.1661441900681

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




=3Dutf-8">
name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=3D1.0 ">
eta name=3D"format-detection" content=3D"telephone=3Dno">






adding=3D"0" cellspacing=3D"0" width=3D"100%">

=09

=09=09

=09=09=09

=09=09

=09



=09=09=09
=3D"0" class=3D"em_main_table" style=3D"width: 600px;" width=3D"600">

=09=09=09=09

=09=09=09=09=09

=09=09=09=09=09=09

=09=09=09=09=09

=09=09=09=09

=09=09=09

10px 10px;" valign=3D"top">

=09=09=09=09=09=09


dent: 0in; vertical-align: baseline; unicode-bidi: embed; direction: ltr; -=

ms-word-break: normal;">


=09=09=09=09=09=09 





=09=09=09=09=09=09


dent: 0in; vertical-align: baseline; unicode-bidi: embed; direction: ltr; -=

ms-word-break: normal;">
.ups.com/CP/Graphic.php?IM=3DIM_do5cUjGPXD1tt8G" style=3D"width: 600px; hei=

ght: 150px;" width=3D"600">


=09=09=09=09=09=09


=09=09=09=09=09=09
y:Verdana,Geneva,sans-serif;">Dear Valued Customer,


=09=09=09=09=09=09


=09=09=09=09=09=09
y:Verdana,Geneva,sans-serif;">We'd like to hear about your experience with =

UPS as a recipient of an international shipment (package origi=

nating from outside of Canada). Please take 2 minutes to com=

plete this survey.


=09=09=09=09=09=09 





=09=09=09=09=09=09
yle=3D"background-color:rgb(217,212,216);border:1px solid #BEBBBE;border-ra=

dius:3px;font-family:arial,sans-serif;max-width:600px;">

=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09

=09=09=09=09=09=09

px 16px;">
a,Geneva,sans-serif;">Based on your experience receiving international ship=

ments via UPS, how likely are you to recommend UPS to a friend or colleague=

?


=09=09=09=09=09=09=09=09=09
g=3D"0" style=3D"color:#A5A5A5;font-size:13px;" width=3D"100%">

=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09

k">
a,sans-serif;">Not at all likely
ck">
va,sans-serif;">Extremely likely


=09=09=09=09=09=09=09=09=09


=09=09=09=09=09=09=09=09=09
g=3D"0" style=3D"text-align:center;" width=3D"100%">

=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09=09

border-radius:3px;background:#fff;border:1px solid #fff;">
nt-family:Verdana,Geneva,sans-serif;">
ps.com/jfe/form/SV_5pe7qC7lyj23Hfw?Q_DL=3Dvi0a4BxuJFar0n5_5pe7qC7lyj23Hfw_C=

TR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_PopulateResponse=3D%7B%22QID1%22=

:%220%22%7D&Q_PopulateValidate=3D1" style=3D"display:block;text-decorat=

ion:none;color:#000000;background:#fff;line-height:40px;border-radius:3px;w=

hite-space:nowrap;">0
>

=09=09=09=09=09=09=09=09=09=09=09=09		&nb=

sp;
border-radius:3px;background:#fff;border:1px solid #fff;">
nt-size:16px;">
ef=3D"https://customerfeedback.ups.com/jfe/form/SV_5pe7qC7lyj23Hfw?Q_DL=3Dv=

i0a4BxuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_=

PopulateResponse=3D%7B%22QID1%22:%221%22%7D&Q_PopulateValidate=3D1" sty=

le=3D"display:block;text-decoration:none;color:#000000;background:#fff;line=

-height:40px;border-radius:3px;white-space:nowrap;">1
>

=09=09=09=09=09=09=09=09=09=09=09=09		&nb=

sp;
border-radius:3px;background:#fff;border:1px solid #fff;">
nt-size:16px;">
ef=3D"https://customerfeedback.ups.com/jfe/form/SV_5pe7qC7lyj23Hfw?Q_DL=3Dv=

i0a4BxuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_=

PopulateResponse=3D%7B%22QID1%22:%222%22%7D&Q_PopulateValidate=3D1" sty=

le=3D"display:block;text-decoration:none;color:#000000;background:#fff;line=

-height:40px;border-radius:3px;white-space:nowrap;">2
>

=09=09=09=09=09=09=09=09=09=09=09=09		&nb=

sp;
border-radius:3px;background:#fff;border:1px solid #fff;">
nt-size:16px;">
ef=3D"https://customerfeedback.ups.com/jfe/form/SV_5pe7qC7lyj23Hfw?Q_DL=3Dv=

i0a4BxuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_=

PopulateResponse=3D%7B%22QID1%22:%223%22%7D&Q_PopulateValidate=3D1" sty=

le=3D"display:block;text-decoration:none;color:#000000;background:#fff;line=

-height:40px;border-radius:3px;white-space:nowrap;">3
>

=09=09=09=09=09=09=09=09=09=09=09=09		&nb=

sp;
border-radius:3px;background:#fff;border:1px solid #fff;">
nt-size:16px;">
ef=3D"https://customerfeedback.ups.com/jfe/form/SV_5pe7qC7lyj23Hfw?Q_DL=3Dv=

i0a4BxuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_=

PopulateResponse=3D%7B%22QID1%22:%224%22%7D&Q_PopulateValidate=3D1" sty=

le=3D"display:block;text-decoration:none;color:#000000;background:#fff;line=

-height:40px;border-radius:3px;white-space:nowrap;">4
>

=09=09=09=09=09=09=09=09=09=09=09=09		&nb=

sp;
border-radius:3px;background:#fff;border:1px solid #fff;">
nt-size:16px;">
ef=3D"https://customerfeedback.ups.com/jfe/form/SV_5pe7qC7lyj23Hfw?Q_DL=3Dv=

i0a4BxuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_=

PopulateResponse=3D%7B%22QID1%22:%225%22%7D&Q_PopulateValidate=3D1" sty=

le=3D"display:block;text-decoration:none;color:#000000;background:#fff;line=

-height:40px;border-radius:3px;white-space:nowrap;">5
>

=09=09=09=09=09=09=09=09=09=09=09=09		&nb=

sp;
border-radius:3px;background:#fff;border:1px solid #fff;">
nt-size:16px;">
ef=3D"https://customerfeedback.ups.com/jfe/form/SV_5pe7qC7lyj23Hfw?Q_DL=3Dv=

i0a4BxuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_=

PopulateResponse=3D%7B%22QID1%22:%226%22%7D&Q_PopulateValidate=3D1" sty=

le=3D"display:block;text-decoration:none;color:#000000;background:#fff;line=

-height:40px;border-radius:3px;white-space:nowrap;">6
>

=09=09=09=09=09=09=09=09=09=09=09=09		&nb=

sp;
border-radius:3px;background:#fff;border:1px solid #fff;">
nt-size:16px;">
ef=3D"https://customerfeedback.ups.com/jfe/form/SV_5pe7qC7lyj23Hfw?Q_DL=3Dv=

i0a4BxuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_=

PopulateResponse=3D%7B%22QID1%22:%227%22%7D&Q_PopulateValidate=3D1" sty=

le=3D"display:block;text-decoration:none;color:#000000;background:#fff;line=

-height:40px;border-radius:3px;white-space:nowrap;">7
>

=09=09=09=09=09=09=09=09=09=09=09=09		&nb=

sp;
border-radius:3px;background:#fff;border:1px solid #fff;">
nt-size:16px;">
ef=3D"https://customerfeedback.ups.com/jfe/form/SV_5pe7qC7lyj23Hfw?Q_DL=3Dv=

i0a4BxuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_=

PopulateResponse=3D%7B%22QID1%22:%228%22%7D&Q_PopulateValidate=3D1" sty=

le=3D"display:block;text-decoration:none;color:#000000;background:#fff;line=

-height:40px;border-radius:3px;white-space:nowrap;">8
>

=09=09=09=09=09=09=09=09=09=09=09=09		&nb=

sp;
border-radius:3px;background:#fff;border:1px solid #fff;">
nt-size:16px;">
ef=3D"https://customerfeedback.ups.com/jfe/form/SV_5pe7qC7lyj23Hfw?Q_DL=3Dv=

i0a4BxuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_=

PopulateResponse=3D%7B%22QID1%22:%229%22%7D&Q_PopulateValidate=3D1" sty=

le=3D"display:block;text-decoration:none;color:#000000;background:#fff;line=

-height:40px;border-radius:3px;white-space:nowrap;">9
>

=09=09=09=09=09=09=09=09=09=09=09=09		&nb=

sp;
border-radius:3px;background:#fff;border:1px solid #fff;">
nt-size:16px;">
ef=3D"https://customerfeedback.ups.com/jfe/form/SV_5pe7qC7lyj23Hfw?Q_DL=3Dv=

i0a4BxuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3Demail&Q_=

PopulateResponse=3D%7B%22QID1%22:%2210%22%7D&Q_PopulateValidate=3D1" st=

yle=3D"display:block;text-decoration:none;color:#000000;background:#fff;lin=

e-height:40px;border-radius:3px;white-space:nowrap;">10
td>

=09=09=09=09=09=09=09=09=09=09=09


=09=09=09=09=09=09=09=09=09


=09=09=09=09=09=09 



=09=09=09=09=09=09


dent: 0in; vertical-align: baseline; unicode-bidi: embed; direction: ltr; -=

ms-word-break: normal;">
-family:Verdana,Geneva,sans-serif;">You can also access directly 
ef=3D"
fw?Q_DL=3Dvi0a4BxuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS&Q_CHL=3De=

mail'>here">
_5pe7qC7lyj23Hfw?Q_DL=3Dvi0a4BxuJFar0n5_5pe7qC7lyj23Hfw_CTR_3faB95BI2LeT9SS=

&Q_CHL=3Demail">here.


=09=09=09=09=09=09


=09=09=09=09=09=09
y:Verdana,Geneva,sans-serif;">Thank you for your participation.
n>


=09=09=09=09=09=09 





=09=09=09=09=09=09


dent: 0in; vertical-align: baseline; unicode-bidi: embed; direction: ltr; -=

ms-word-break: normal;">
-family:Verdana,Geneva,sans-serif;">Greg Kane


=09=09=09=09=09=09VP of Marketing, UPS Canada


=09=09=09=09=09=09


=09=09=09=09=09=09 





=09=09=09=09=09=09


1px solid rgb(217,212,216); border-image: none; text-align: center; line-he=

ight: normal; text-indent: 0in; vertical-align: baseline; unicode-bidi: emb=

ed; direction: ltr; -ms-word-break: normal; background-color: rgb(217,212,2=

16);">This message w=

as sent to you by United Parcel Service Canada Ltd.


=09=09=09=09=09=091930 Derry Road East, Mississauga, ON L5S 1E2, ups.com.
r>

=09=09=09=09=09=09


=09=09=09=09=09=09You can
es/enteremail?loc=3Den_CA&emailAddress=3Droot@nk.ca">update your email =

preferences or
bscribe?loc=3Den_CA&id=3Droot@nk.ca">unsubscribe* from UPS marketin=

g email at any time. For information on UPS's privacy practices refer to th=

e
ivacy-notice.page">UPS Privacy Notice.


=09=09=09=09=09=09


=09=09=09=09=09=09*Note: If you unsubscribe from UPS marketing emails you m=

ay continue to receive other email from UPS such as UPS Quantum View=C2=AE =

Notify shipment alerts, details about your account(s) and operational infor=

mation regarding existing products,


=09=09=09=09=09=09services and systems.


=09=09=09=09=09=09


=09=09=09=09=09=09=C2=A92022 United Parcel Service of America, Inc. UP=

S, the UPS brandmark, and the color brown are trademarks of United Parcel S=

ervice of America, Inc. All rights reserved.



=09=09=09=09=09=09 



=09=09=09=09=09=09


>
amp;RID=3DCTR_3faB95BI2LeT9SS&LID=3DUR_57O4FTykC6btlop&DID=3DEMD_vi=

0a4BxuJFar0n5&BT=3DdXBzY3g&_=3D1">



=09=09=09=09=09=09


=09=09=09
3D""
ack.ups.com/WRQualtricsContacts/Watermark.php?UID=3DUR_57O4FTykC6btlop&=

EMD=3DEMD_vi0a4BxuJFar0n5&CGC=3DCTR_3faB95BI2LeT9SS&SV=3DSV_5pe7qC7=

lyj23Hfw">

------=_Part_25414812_1072820933.1661441900681--



------=_Part_25414811_1381060667.1661441900681--



------=_Part_25414810_479863320.1661441900681--

More Sexual Blackmail phishing scam from Greece

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 25 Aug 2022 07:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRCcD-000Mhr-85

for dave@doctor.nl2k.ab.ca;

Thu, 25 Aug 2022 07:09:45 -0600

Resent-From: The Doctor

Resent-Date: Thu, 25 Aug 2022 07:09:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [62.74.84.54] (port=23624 helo=ppp062074084054.access.hol.gr.84.74.62.in-addr.arpa)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRA3d-0005Zu-5p

for sales@nk.ca;

Thu, 25 Aug 2022 04:25:58 -0600

Date: 25 Aug 2022 15:09:28 +0200

From:

X-Priority: 3

Message-ID: <119754601.202208251525@nk.ca>

To:

Subject: Waiting for the payment.

MIME-Version: 1.0

Content-Type: text/plain; charset="windows-1250"

Content-Transfer-Encoding: 8bit

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello! Have you recently noticed that I have e-mailed you

from your account? Yes, this simply means that I have total access to your

device. For the last couple of months, I have been watching you. Still wondering

how is that possible? Well, you have been infected with malware originating

from an adult website that you visited. You may not [...]



Content analysis details: (5.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=sales%40nk.ca;ip=62.74.84.54;r=doctor.nl2k.ab.ca]

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 BITCOIN_XPRIO Bitcoin + priority

0.5 PDS_BTC_ID FP reduced Bitcoin ID

0.9 BITCOIN_EXTORT_01 Extortion spam, pay via BitCoin

1.0 BITCOIN_SPAM_07 BitCoin spam pattern 07

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.0 TO_EQ_FM_SPF_FAIL To == From and external SPF failed

0.0 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF

failed

Subject: {SPAM?} Waiting for the payment.



Hello!

Have you recently noticed that I have e-mailed you from your account?

Yes, this simply means that I have total access to your device.



For the last couple of months, I have been watching you.

Still wondering how is that possible? Well, you have been infected with malware originating from an adult website that you visited. You may not be familiar with this, but I will try explaining it to you.



With help of the Trojan Virus, I have complete access to a PC or any other device.

This simply means I can see you at any time I wish to on your screen by simply turning on your camera and microphone, without you even noticing it. In addition, I have also got access to your contacts list and all your correspondence.



You may be asking yourself, "But my PC has an active antivirus, how is this even possible? Why didn't I receive any notification?" Well, the answer is simple: my malware uses drivers, where I update the signatures every four hours, making it undetectable, and hence keeping your antivirus silent.



I have a video of you wanking on the left screen, and on the right screen - the video you were watching while masturbating.

Wondering how bad could this get? With just a single click of my mouse, this video can be sent to all your social networks, and e-mail contacts.

I can also share access to all your e-mail correspondence and messengers that you use.



All you have to do to prevent this from happening is - transfer bitcoins worth $1450 (USD) to my Bitcoin address (if you have no idea how to do this, you can open your browser and simply search: "Buy Bitcoin").



My bitcoin address (BTC Wallet) is: 17wkbqoaUCUUxw3N1QocutFJTH47Zb8jPQ



After receiving a confirmation of your payment, I will delete the video right away, and that's it, you will never hear from me again.

You have 2 days (48 hours) to complete this transaction.

Once you open this e-mail, I will receive a notification, and my timer will start ticking.



Any attempt to file a complaint will not result in anything, since this e-mail cannot be traced back, same as my bitcoin id.

I have been working on this for a very long time by now; I do not give any chance for a mistake.



If, by any chance I find out that you have shared this message with anybody else, I will broadcast your video as mentioned above.



Listing spam from Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 25 Aug 2022 07:09:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oRCai-000KHx-F3

for dave@doctor.nl2k.ab.ca;

Thu, 25 Aug 2022 07:08:12 -0600

Resent-From: The Doctor

Resent-Date: Thu, 25 Aug 2022 07:08:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-maxind01on2052.outbound.protection.outlook.com ([40.107.222.52]:19778 helo=IND01-MAX-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oR8lQ-000ORv-LJ

for doctor@netknow.ca;

Thu, 25 Aug 2022 03:03:18 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=iMyYmVfjhXgriM65z27PDCpB6l0Q6Cjst9le1mZ+oH8EVWSQ7OH8LV3bM0A79dh5k3DW0wRSobIRQwavU0hoKQZO/RiAQLKtJ7qIAR8kthu0ZyjA3dLUpaF81oWcn8rMmlj9rWk7yW6hjeKiYolFuEVTV+hU9megb7KzSBceZqeZwhPU+6922RVCCwaEvCqzb8n5QM0FB8WN/btrQmATqdKGxO3AcbYErrB0jBSN3Eb+w5ZvRkspDBLySq4RPjR+w0bb5Ra1e4afp4XsWtaaLT0lgCu04F2em7BKndAVZYWzg3GvoHpbQHEMzhQMsnzI2HwhvnnTkdin6nLStAcD5w==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=uqHgb7BFXFVnNDTy4orZ4g7S/bFZUowRSOXlrocMfxk=;

b=SZzNWIQgL3jyIgyZYs5W1TDm92YmnE1I9WTepIoJ79YwD4IUm4obgwMejkkXdcWuRKtIcMr0BLW73QL8iLmLY/59cR2IPfO1n7qUb/HyaBlp6+q4qvlsnMG/ugx6lf/HNuqyu60fSq7FOP3ycq50V7MyMi1lhso6rYgFRtxRj8cZicPG/XwCZd2+lk9OuSwi9Q/QkAW8cvR3zupVMMmjjyG9bU5eVtCDhOntqkUWUumTMgRisMJsTJSXRt2lqz7J7JMEkSddmbsZuRhKBpgWvKLkdh5doc/c6XhSap6k8X547a5diiso9B5YTosMIU021SPt2nNCYleGRJAAmlojQg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=buyersfunnel.live; dmarc=pass action=none

header.from=buyersfunnel.live; dkim=pass header.d=buyersfunnel.live; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=buyersfunnel.live;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=uqHgb7BFXFVnNDTy4orZ4g7S/bFZUowRSOXlrocMfxk=;

b=P8FawKJMnkZVKR/zeEFskNRdzwVP/Kn0zZiWEkbEGYIA2l9iquaQFA5vkrHwnzDsU9txURsnPnxD8TglmVWgitojCuQGZy2PnMJzVc2T7zsNse4iJra2CuuQPXuOTrfoYLrjf9+ioJ/RUqoyCp/a+BCsT2rx5slgIU36QcCdADMoTLOktS9q3htDZSQIUgk9WteSnzMlr21sYZ3TAOqI+CrOqVqjySB9/LQ756ANRys4Fb+HtWHTfCVRjVNExtrbp0RklhN4sn1fNnF1aGipyTGKPDSMBC/GesZ39oRLUxy3dTrkx/VmwxENcvb0FPjpQ1cyiMWJe5Nf6S7+Z/m36Q==

Received: from BM1PR01MB2132.INDPRD01.PROD.OUTLOOK.COM (2603:1096:b00:46::16)

by PNZPR01MB4285.INDPRD01.PROD.OUTLOOK.COM (2603:1096:c01:1c::5) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5566.15; Thu, 25 Aug

2022 09:02:30 +0000

Received: from BM1PR01MB2132.INDPRD01.PROD.OUTLOOK.COM

([fe80::205e:c520:7e3e:3798]) by BM1PR01MB2132.INDPRD01.PROD.OUTLOOK.COM

([fe80::205e:c520:7e3e:3798%7]) with mapi id 15.20.5546.025; Thu, 25 Aug 2022

09:02:30 +0000

From: Christopher Wald

To: "doctor@netknow.ca"

Subject: Netknow

Thread-Topic: Netknow

Thread-Index: Adi4YWbLXkHtZ8jiSimZPZoQcsf+SA==

Date: Thu, 25 Aug 2022 09:02:30 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

authentication-results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=buyersfunnel.live;

x-ms-publictraffictype: Email

x-ms-office365-filtering-correlation-id: b24d2535-1a16-4e2d-d01c-08da86788a68

x-ms-traffictypediagnostic: PNZPR01MB4285:EE_

x-ms-exchange-senderadcheck: 1

x-ms-exchange-antispam-relay: 0

x-microsoft-antispam: BCL:0;

x-microsoft-antispam-message-info:

usgzd42Tpoapw4Hq48MnxQ7fJ62xpWAV5RTV18mXN61iv/8hxN62OFpGC00INk6vaMoCkGzM2PNkdlmQye0osuxCUIgfPi60PoFr1VfFAcYpOKIH8krEGGWbaOlOT8a3GuhNuZmnbvR6XCGvh8G1jCIIcisIa0sWi7Q4iHZ36TCAcsaB+4R43iFaOnDYWDhU8eJXecFuHSsq+zyhafMtP4m/H1QyzXuUeT8nKiXvOKBhwiw1FawNsmnvHiJn3EQ75xtcCsSQgUU402YkxG/JvD7Q0NUdJ7ha2KKSNDQMxIRxU98qXSGOkZfr52oao1WNr8tJcNT8UzLl+2Y+dugdWMnIDwzzhwqOa2B+GLP6gyaaO1pKAvNxLd8orWCxg2biRt0DnlPNOWs+eDBnp1RUmSqd9XjPAu5QbJjmn7EmPg7QIfVMMQ7PTgPXI4oR5N4tKuf2QFkqrzhgAJL/vBn1n/fkzgAeGXQ1u3xPV8tpNszPwxN7fO3zeS077eDd1xWizuZykxYkcZJfTQmIPLjcdBdh55NXK9/8+53ZNqua3fqSR9sj3WS0JrMnWJ4heMa6DIW4j3kBhwr6YaQ302WGfWFx8kP78GDgjsSewz+A5cEYI74kHB0h7h11BH7DMHjtBnD2NWhdykfCFDbBO872r2c/SW3+15dc0lUP8bjROR+NI6UsRQLF4HAHK0vcVIpKcLwwivOiDnhIu8rkvEOBBy0gHXpbhK0iv5CjV4Yw3QHAq+D0BymYfSWteYXIU2uB

x-forefront-antispam-report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BM1PR01MB2132.INDPRD01.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230016)(396003)(346002)(136003)(366004)(376002)(39860400002)(55016003)(7116003)(3480700007)(186003)(9686003)(26005)(478600001)(41300700001)(33656002)(7696005)(4744005)(2906002)(8676002)(6506007)(9326002)(5660300002)(86362001)(52536014)(6916009)(8936002)(316002)(38070700005)(122000001)(71200400001)(76116006)(66476007)(38100700002)(64756008)(66556008)(66446008)(66946007);DIR:OUT;SFP:1101;

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?us-ascii?Q?m1nq7W85ixRcvO7UI5J5qZS+Qe/EnfIEkyKW7VJf7em4YcqjX7AgFxTEji6p?=

=?us-ascii?Q?/mSmqYyvgZg/3KozDskpos1//LVvWRiCJ4omuZHHQMlm5FEfCspCJ5qHYlWc?=

=?us-ascii?Q?kf/2mHHz6RydViKE5/fvpNwxUYMR8pgs3ii3rPW+kiBtGW8Md0jjkt/54dVm?=

=?us-ascii?Q?yla1TzWsZXEIYgM+oUuFP1Px8r4cg9x4iNUpf2bPrT6qpQJzK2i2T7e/Yw8/?=

=?us-ascii?Q?NQ8/DwhWAPSndyUPJIiHnEjYjTrFha4yBAHIAy8j/qsMnYQFWmuTvM1EGR9Q?=

=?us-ascii?Q?rMKaXUKSJ0U24HGnc62AMdQVH0cDwt6SKQAaeEsMXJeZMykHEHpDFshC8emF?=

=?us-ascii?Q?dkYlVwE9XJPZ5/DdV4XaeiQjEWQ7L+zADa7q3duWqWCLc2NE+uDwjh9wag1Y?=

=?us-ascii?Q?eapLp1fuwLNgIoMaGUtTZgb3wiXhqQvMcYItBY0t25/ogu8S1iOU5I5MF5O9?=

=?us-ascii?Q?3PWb53e10nR2K7LPEf9zcsK8tMwMuohhQzfk4ADq3L2X0lKGb545EfZ3uFSV?=

=?us-ascii?Q?czU+HxZVjSZofPHv1qEUmIlMmSghlFi0UgXJuCZWurpcj+rxQr0OCwruyUxm?=

=?us-ascii?Q?itMAZOiYT/jPiYRdQJuQs0Kh1I62TyJTi46C6oFZcPzlB7KV9OwGE4HtkC9J?=

=?us-ascii?Q?7qIqGhmT+qRVmwTxa58BZcNdnKLbF0xdGVRAcfWGkTAh3irLl2IkJLNzXCBq?=

=?us-ascii?Q?IRvF2d9XwBQef5O+89WDQ831Yngww5dtHTdyfmec82+J3eWy6dtNqwc2LkRS?=

=?us-ascii?Q?6o7+S02NsGzrgyHwkREubjsqHfl+uErapYTX/ZUGWFpzESCwg4CA2Tfh2AOi?=

=?us-ascii?Q?8oeTH5EzzH2s6pnJ1EeSKZN9vzFLZNOeMtfKqigwL3HGt9/b6ur+sjyzqeal?=

=?us-ascii?Q?0h30+53cF+ET9bpLz8Byv78xAUjtfIhq0DMEVOHYmJwlFeBLVjOvTTZgwFuv?=

=?us-ascii?Q?0E8FLcMYCPhfbYDfHeWxY6fVyclMvxIsZJI3UvxEVs+8a/7pTFTMYFhJvrWU?=

=?us-ascii?Q?m+d2f8UCMWA762DljW3IQCamZERUYKyeN7AyJwZLnL9m+aoZeRE/2z9dzY0S?=

=?us-ascii?Q?MwWE0FrjRa5+8VqXbC9KOG/ox1MdXxMhO9z9rTvrJEfDl62bHcRwSw3Of74z?=

=?us-ascii?Q?63P8BtMPenJwR9DS3OcJgs0oUyaFZAEp7XJ7Fqu36061AZa996e2M9YU2NMZ?=

=?us-ascii?Q?sXSZ4m2GsZNNzJwhtDlX6tMGH9w6h+DJ6ZpRJezXMSu7YPjYA6F/56HFOkgk?=

=?us-ascii?Q?OpxH0Kg9bpRHWpCvcNpATwWR0yb9KwYBnN4hjeMyib3YyczlyBFu+6fpXOUz?=

=?us-ascii?Q?17x9TB71FqcXAA1SMutXE3qxGEeHxQxVPgPLZGsQyKy1c8OqGP9rN/MT4cNJ?=

=?us-ascii?Q?Ws87cIps82DWkXvrF+imffTFTYi5LLyjppCWCnqYR/0Y2VZZHtFaPwizppNa?=

=?us-ascii?Q?SvxwFaF9qHPQd+qkqelZdViEUEYA1+YyUGe2HZry3IBoEKi+1MI/GpmO0Imp?=

=?us-ascii?Q?nQqbA1Cq4rzYiRSRaayu6y8Q0t477yHSKVkv3bXK4Fzj+en+9EScWqe/NP3t?=

=?us-ascii?Q?Suaj4/iPHYD01kx5vR5dLdcblmV7uftJVjkYDGsn?=

Content-Type: multipart/alternative;

boundary="_000_BM1PR01MB2132CFB72A7BE2B6EB63DB7BCC729BM1PR01MB2132INDP_"

MIME-Version: 1.0

X-OriginatorOrg: buyersfunnel.live

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: BM1PR01MB2132.INDPRD01.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-Network-Message-Id: b24d2535-1a16-4e2d-d01c-08da86788a68

X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Aug 2022 09:02:30.2200

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 7047b193-5265-42e1-b22f-6d997067a26a

X-MS-Exchange-CrossTenant-mailboxtype: HOSTED

X-MS-Exchange-CrossTenant-userprincipalname: cBmRcqlgjnRaZztHAeYG5y6qMDoSHBD6TQPLScDpT85Gcdh1g1jYlk15wmD7GA0ySfVNmTBU+1pZlofQs4n/sA==

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PNZPR01MB4285



--_000_BM1PR01MB2132CFB72A7BE2B6EB63DB7BCC729BM1PR01MB2132INDP_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Hi,

Would you be interested in reaching out all the registered attendees from "=

Total Store Expo 2022"

All Contacts are opt-in and permission based. The list is complete with ful=

l contact details.

If interested, please let me know for more information & discount cost to a=

cquire the list.

Regards,

J Wald

Business Analyst



--_000_BM1PR01MB2132CFB72A7BE2B6EB63DB7BCC729BM1PR01MB2132INDP_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">




>








break-word">



Hi,



Wo=

uld you be interested in reaching out all the registered attendees from =

220;Total Store Expo 2022<=

b>”
r:black">



All
n>Contacts
"EN-US" style=3D"color:black"> are opt-in and permission based. The list is=

complete with full contact details.=



If intere=

sted, please let me know for more information & discount cost to acquir=

e the list.




le=3D"color:black">Regards,
p>


style=3D"color:black">J Wald



Busines=

s Analyst
n>











--_000_BM1PR01MB2132CFB72A7BE2B6EB63DB7BCC729BM1PR01MB2132INDP_--

Dating phish from China

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Thu, 25 Aug 2022 00:45:00 -0600

Received: from [179.51.119.51] (port=64247 helo=hvtelevision.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oR6ao-000DNP-4W

for dave@nk.ca;

Thu, 25 Aug 2022 00:44:00 -0600

Message-ID:

List-Unsubscribe:

Date: Thu, 25 Aug 2022 01:45:13 -0500

From: Mrs. Isabeau Strzelecki

MIME-Version: 1.0

To: Dave

Subject: Do you want me again? I love you madly I want .

Content-Type: multipart/alternative;

boundary="------------14819887588916101496"

X-Spam_score: 35.5

X-Spam_score_int: 355

X-Spam_bar: +++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: It is oblique, in the evening Above physician.Good afternoon

my body explorer.My name is Isabeau. I am from Russia. I saw you on instagramI

am interested in chatting with you, what do you think about [...]



Content analysis details: (35.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: day.my]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL

blocklist

[URIs: freebeautygirls.cn]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URIs: freebeautygirls.cn]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[179.51.119.51 listed in bb.barracudacentral.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of

words

1.0 J_WEEDS_V FULL: Dec/Hex char Enc [Vv]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_K FULL: Dec/Hex char Enc [Kk]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 HK_NAME_MR_MRS No description available.

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Do you want me again? I love you madly I want .



This is a multi-part message in MIME format.

--------------14819887588916101496

Content-Type: text/plain; charset="Windows-1252"; format=flowed

Content-Transfer-Encoding: quoted-printable



It is oblique, in the evening Above physician.Good afternoon my body =

explorer.My name is Isabeau. I am from Russia. I saw you on instagramI =

am interested in chatting with you, what do you think about it? Are you =

often visit this site if not, we can talk in other social networks. I =

will be waiting to you answer with hurry. Have a wonderful day.My page =

is - http://Isabeau83.freebeautygirls.cnIt's my photo:I hope you will =

find me there and we will become friends :-D I'm ready for chat!



--------------14819887588916101496

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable




"text/html; charset=3DWindows-1252">It is oblique, in the evening =<br /><br /> Above physician.







Good =

afternoon my body =

explorer.




My =

name is Is͜abea͠u. I =

am f͇rom Russia. I saw you =

on instagram


I am =

interested in chatting =

with you, what do =

you think about it? =

Ar̨e you o̢ften visit =

this site if not, we =

caͤn talk in other =

socia͇l =

networks. I will =

be waiting to you =

answer with hurry. Have =

a wonderful day.










I hope =

yoͭu will find me =

there and we will become =

friends :-D I'm =

reaٔdy for chat!








--------------14819887588916101496--