SEO spam from Microsoft Outlook servers

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 23 Sep 2022 04:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1obgIl-0002sS-OW

for dave@doctor.nl2k.ab.ca;

Fri, 23 Sep 2022 04:52:59 -0600

Resent-From: The Doctor

Resent-Date: Fri, 23 Sep 2022 04:52:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-os0jpn01olkn2095.outbound.protection.outlook.com ([40.92.98.95]:17597 helo=JPN01-OS0-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1obbJ5-000MnD-5u

for sales@nk.ca;

Thu, 22 Sep 2022 23:33:05 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=IugnMe94aWqZaly1R45P3zaQKx1C+UuBET8Oh+/mvsUqrFboXAygB1Ct/8bGOL01McOEtZ5jVa+R4RzaFdrS6eM/OP+OzUMNcdBE7OgKNS9y61HEsFRaVPPxFDvotqpEZEcxg0d7Tu4J6Yduszxd3DyOoNKdJtEAtSIvc4GgXAO7HZ8ljinPS9wT3NggSOdyOCnPoljpxNDr0+P84JbDrKa/AiBmsAJJapGNpWp8TGhIrNsn6On5fRxO8/mQHf641gMT/rGcvcNpTtXTSHEYu1fP62fzpeD+cG/pPcfB6bX9MqUpP5kv5hZ/R3lQB4SPRZzHjt5oVKgDQrd98oYaLg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=dNDeBH7IC+rwJx95S2gIdA5iPQyBLUPbFrQt5Eqpl4E=;

b=XEyYW/qhERuLyMxU8fKEkYOscmr70Nzfu3Ttbv1EGaiqKd1FQReCcV2RJUReo5j7wdFi8Q42x2tbMW4NxWyqIjl7ffo4wWGaDeifBKbarL9Ldp6eMj/Lfw2phdaAL+c7vEjc2FX9JER60TuJpEOXj6KTrFgZu2XdiUfJBMT5fn6XqDOoLRyoLISvvGlQOF/EdmnJE6Fx/xM8XDCtic8dB4FaEWTMG1eHtnUokhAaAWvWH5HfC+kDwVGQ70jiTpc1cBjmgmpTRJWEVOgTkGecXS/8xnXF/uWQYqi0hx2CY8On624ye/WRFvxmG0MNqU7xLsCGX//QxF1t47bGinIkrg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=dNDeBH7IC+rwJx95S2gIdA5iPQyBLUPbFrQt5Eqpl4E=;

b=BZxfSXo4SRn2fMv0SfC08Ns8i2WvFyC/WWDxu0IX4C0T8cBPnTTHdNMrg2Tk0uK65HARRXa354IvQbmo1moOx7JskYb+ozZV0fCO686zl5rP01kGg6J/pDDULHmoCqY1FUJK8KF7XxJVysCFRg4oK/gYv5Oibnq6VaHWnNLwHpNxP5U/12xfsGyhDrUfjPkPuycUX/uJ5HE3S4HNpRd4r1PHwnHyNwXC48DSUvcjsK0sMG2gc50r0Kni3LTtgUbuq0gmnw7hE5RqvkyAKfseaJw/l5nZlyLzUzrBXV8YGEQQvG9CPGWaquCWixAbobysxqHdkLRea/BOXfi4LaVFJA==

Received: from OS3P286MB1994.JPNP286.PROD.OUTLOOK.COM (2603:1096:604:1a1::9)

by TYCP286MB2115.JPNP286.PROD.OUTLOOK.COM (2603:1096:400:13b::12) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5654.16; Fri, 23 Sep

2022 05:32:07 +0000

Received: from OS3P286MB1994.JPNP286.PROD.OUTLOOK.COM

([fe80::f577:6f43:9a77:eaa0]) by OS3P286MB1994.JPNP286.PROD.OUTLOOK.COM

([fe80::f577:6f43:9a77:eaa0%9]) with mapi id 15.20.5654.017; Fri, 23 Sep 2022

05:32:07 +0000

From: Nancy Verma

Subject: Best web services provider!!!

Thread-Topic: Best web services provider!!!

Thread-Index: AQHYzw3SWWFqpqi+ik6YoLQsiyEpdA==

Date: Fri, 23 Sep 2022 05:32:07 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-tmn: [pqVjH7RfpypRFfOSnm8adReJZG8NH2jy85k7e625/lHMONITAHAx9708X845wKqO]

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: OS3P286MB1994:EE_|TYCP286MB2115:EE_

x-ms-office365-filtering-correlation-id: 545fff27-36c7-4a97-2ebe-08da9d24f4b5

x-microsoft-antispam: BCL:0;

x-microsoft-antispam-message-info:

DASQSiaiZe4clmR3hhiInMdgEID0pZCUzvjpNO39vng9adH6o0mFt9Dlg2oD50s2fHsDBeTZmakgu8vVpbklEsH1tKvjW3s5b9iWLspsHbKquwU92H+Z1XqBbo0t0ruz6jTBpHlYtK7VIaziVvhkowuXO9Lh8t3wGdH7zTso/5xcaMgw9po4I2loNBvI5Vk7KtmvxpyjmPuvCtiFQJxfIqcgbAQPo4pB8lCo1DY2LScevlIljdVcC5XfWQN4y4TyC/svNPSssHjOXsm9vhUWBiS6auvlHnKOLWLcdtdJuHMfmLAE58fLcEeBbpN0wRfB1SoiJzp5UdUi79IcaIt7AJY+fTcDC1b38VBqcv0hhLS7x5IXZgVvtKQ4p2zDSmHlBy5X0NWkxNwO5FKFLX62uEuD65F3CAd8Khr2oAZ3ApyjfPcilxmW5c6Jj9Ab+OFRX7/s2U76GAnaGWzV7nJ1jVFUuUPiYBk8Wbj584JFHlhGubwBdTHM3pcRQr29utRSEU5tr7AletBYjyrkyUg/QMdI5tUNheAYYotUhmZC+QK3EpXWVDmGz1HGL3gGO7e75M7TfYJRPRmU0sVM5XyICJpY5aHGaF+Fgs8SFqgfa84CLZc6NtzeofzbnrXeGvIl

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?FSZfrhlyhI3dSL77zyjqvpj1/o7B2+ZeGJjED6rMOGCyfnqI5mBQrgddys?=

=?iso-8859-1?Q?3wxTig+HyIIoHMYbxvtWwaK5cHSbQhRBKjwyEK5qxwvi/uyGTBNM1CUDQp?=

=?iso-8859-1?Q?cxlbpe2vGGpJ/CV0nxVEeY8N7O8wTWTYD2p3n+4Hs+4X7lC3ThUeK5jLSO?=

=?iso-8859-1?Q?6FS6g2RxciBY1hXdoMWaVCfkZ5664iuCh1CA6OvUewHAyI72wW/xlEXEgU?=

=?iso-8859-1?Q?xlzxqblr9SUZYUo0EbOwXPO9wo2rQbNvFWVfjRPfmRuS0MO8SkXcPPcWBR?=

=?iso-8859-1?Q?D5GXc+hpA9xzivRsYfEhdlTTjoUtCzD1fHpBq/UqgsqdtOtUOTARKqUdoC?=

=?iso-8859-1?Q?PS8ux8snhNGH3z10yj6qKlaQiw7FNrNfOxvl0Z/4hRiGU2DwH2WPnj+L1k?=

=?iso-8859-1?Q?0+2REvXjb7fX+GJlXyM8t2zFK2nwNT4n+zrOD+LoLryGMYvCmbvfqa1MMC?=

=?iso-8859-1?Q?FcGFWiGspa4zVGl9W9Es5j++bQYMeHenJ5xOUWKpMjLn4YkjLfLwGczJfY?=

=?iso-8859-1?Q?amOaGPGRdBaItWAskCq8BhykkrGxiE6TEU4swbpL9N7uIb7eVcF4zmm+Qc?=

=?iso-8859-1?Q?TT5VbLwodXIlJlVeuCQancYyjZ7COUmrseDsKBw6rCamVXuORaBc5Z8mmT?=

=?iso-8859-1?Q?Vf/AAiM22rTTp3vU34s0gJByPXAAe5RoHCCwR5AkKoiJz97oyNqeuygv4m?=

=?iso-8859-1?Q?nnff/vGMuZoPtWjb+NpTNVMPKhaHl/x+mIxkXlMvtLqOInqJkfkYzd50K7?=

=?iso-8859-1?Q?2TDEbgiNQX6tCP4YqCbrHYRvy4Ak2syINRedauXSaJ8O4NingrToU5tCaz?=

=?iso-8859-1?Q?d8qzVwgW1iwMYoEDhSqACNLa/Fd1mqJip9oj1gSxjZBvN1ErMo9uXTqtkC?=

=?iso-8859-1?Q?PUIwLQk1C2QKPIxHicJYRjAiVzxPNou3E1JdV+7qbTXnA34qsVv43xTq8k?=

=?iso-8859-1?Q?qTTL0C665CJSVbM07NRZuj6b+liL7KtPUGDpwj5zzWRGEMuoH8U5EeBcbY?=

=?iso-8859-1?Q?QAofLXIccZUzt+6UvtSJmlRdRWoVExoBqh3akW57YFQ0ySvscbm6NOfY4s?=

=?iso-8859-1?Q?1NMoh5X5I1lcV0xsW1q4GKTHgFVWdnDkAtXbaBm0XkNAR6+K0YVVTI4B5G?=

=?iso-8859-1?Q?yKhyQuK9O2esY1CTliq4oFm9dCulc4IK1n7bhRp6RepqP4hdJWuhgR88QB?=

=?iso-8859-1?Q?D2G7EFQeItx1M9/wpYYujrEUG3HVpMJf3KiwGvG9ijbz8z/R/uXPZOhnRV?=

=?iso-8859-1?Q?YxYWWjZYywJpfsnej18C8RncDdVKfu5wNVuKDINQbIgb83IxB2gVh/LWCP?=

=?iso-8859-1?Q?cnucYzz3uo+27a5Jxnx9Gq7RjKIMpwCsBBnTwM1If32wvgwZOQrZTKA6lD?=

=?iso-8859-1?Q?427yLyGpYHbX4ZVPDUe+NBks7LlvGnEFKd4Kv/w7EriR7RmfoFJG4=3D?=

Content-Type: multipart/alternative;

boundary="_000_OS3P286MB199445899EDF1ABE561F00CFB1519OS3P286MB1994JPNP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: OS3P286MB1994.JPNP286.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 545fff27-36c7-4a97-2ebe-08da9d24f4b5

X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Sep 2022 05:32:07.6088

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYCP286MB2115

X-Spam_score: 5.6

X-Spam_score_int: 56

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I am a Website developer by profession. I have 8+ years

of experience, We design websites that have the potential to grab the attention.How

our web design services can help you? I have expertise in the following technologies:





Content analysis details: (5.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[wordpress_expert.nancy[at]outlook.com]

-0.0 SPF_PASS SPF: sender matches SPF record

1.2 MISSING_HEADERS Missing To: header

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.1 TW_TJ BODY: Odd Letter Triples with TJ

0.0 HTML_MESSAGE BODY: HTML included in message

1.4 MALFORMED_FREEMAIL Bad headers on message from free email

service

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.9 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Best web services provider!!!



--_000_OS3P286MB199445899EDF1ABE561F00CFB1519OS3P286MB1994JPNP_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hi,

I am a Website developer by profession. I have 8+ years of experience, We =

design websites that have the potential to grab the attention.How our web d=

esign services can help you?



I have expertise in the following technologies:



HTML

 CSS3

Javascript

 Reactjs

Angular

 Vuejs

Jquery

 Nodejs

Python

 Django

Flask

 MongoDB

Express

 Bootstrap

Material UI

 Tailwind

Ajax

 Fetch

Axios

 PSD to HTML



Please let us know in case you are interested. I would really appreciate yo=

ur response. Thanks in advance!!!



Regards,

Nancy Verma







--_000_OS3P286MB199445899EDF1ABE561F00CFB1519OS3P286MB1994JPNP_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">


ily:"Calibri", "sans-serif"">


lass=3D"ContentPasted0">Hi, 
>




ily:"Calibri", "sans-serif";mso-margin-top-alt:auto;mar=

gin-bottom:.0001pt">


lass=3D"ContentPasted0">I am a Website developer
:yes" class=3D"ContentPasted0"> 

by profession. I have 8+ years of experience,
font-size:12.0pt;font-family:"Times New Roman","serif";=

mso-fareast-font-family:"Times New Roman"" class=3D"ContentPasted=

0">We design websites that have the potential to grab the attention.How

our web design services can help you? <=

/o:p>




ily:"Calibri", "sans-serif"">

<=

o:p class=3D"ContentPasted0"> 




ily:"Calibri", "sans-serif"">


" class=3D"ContentPasted0">I have expertise in the following technologies:<=

o:p class=3D"ContentPasted0"> 






  • ;" class=3D"ContentPasted0">HTML <=

    /span>

  • ;serif"" class=3D"ContentPasted0">
    ss=3D"ContentPasted0">     CSS3 =


  • ;,"serif"" class=3D"ContentPasted0">
    es" class=3D"ContentPasted0">     Javascript
    sted0"> 

  • ew Roman","serif"" class=3D"ContentPasted0">
    so-spacerun:yes" class=3D"ContentPasted0">     Reactjs
    "ContentPasted0"> 

  • ot;Times New Roman","serif"" class=3D"ContentPasted0">
    style=3D"mso-spacerun:yes" class=3D"ContentPasted0">     Angular
    p class=3D"ContentPasted0"> 

  • family:"Times New Roman","serif"" class=3D"ContentPaste=

    d0"> =

    Vuejs 

  • =3D"font-family:"Times New Roman","serif"" class=3D"Con=

    tentPasted0">&nbs=

    p;    Jquery 

  • pan style=3D"font-family:"Times New Roman","serif"" cla=

    ss=3D"ContentPasted0">
    ed0">     Nodejs 
    li>

  • uot;" class=3D"ContentPasted0">
    ntentPasted0">     Python =


  • t;serif"" class=3D"ContentPasted0">
    ass=3D"ContentPasted0">     Django&nb=

    sp;

  • uot;,"serif"" class=3D"ContentPasted0">Flask
    Pasted0"> 

  • New Roman","serif"" class=3D"ContentPasted0">MongoDB
    ass=3D"ContentPasted0"> 

  • ly:"Times New Roman","serif"" class=3D"ContentPasted0">=

    Express 

  • e=3D"font-family:"Times New Roman","serif"" class=3D"Co=

    ntentPasted0">Bootstrap

     

  • nt-family:"Times New Roman","serif"" class=3D"ContentPa=

    sted0">Material UI 

    • >
    class=3D"ContentPasted0">Tailwind =


  • t;serif"" class=3D"ContentPasted0">
    ass=3D"ContentPasted0">     Ajax =

    ;

  • t;,"serif"" class=3D"ContentPasted0">
    yes" class=3D"ContentPasted0">     Fetch
    0"> 

  • oman","serif"" class=3D"ContentPasted0">
    pacerun:yes" class=3D"ContentPasted0">     Axios
    ntPasted0"> 

  • es New Roman","serif"" class=3D"ContentPasted0">
    =3D"mso-spacerun:yes" class=3D"ContentPasted0">     PSD to HTML
    class=3D"ContentPasted0"> 



ily:"Calibri", "sans-serif"">

<=

o:p class=3D"ContentPasted0"> 




ily:"Calibri", "sans-serif"">


lass=3D"ContentPasted0">Please let us know in case you are interested. I wo=

uld really appreciate your response. Thanks in advance!!!
entPasted0"> 




ily:"Calibri", "sans-serif"">

<=

o:p class=3D"ContentPasted0"> 




ily:"Calibri", "sans-serif"">


lass=3D"ContentPasted0">Regards, <=

/span>




ily:"Calibri", "sans-serif"">


" class=3D"ContentPasted0">Nancy Verma <=

/o:p>




ily:"Calibri", "sans-serif"">

<=

o:p class=3D"ContentPasted0"> 














--_000_OS3P286MB199445899EDF1ABE561F00CFB1519OS3P286MB1994JPNP_--

Nigerian Gmail spam

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 22 Sep 2022 17:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1obVPQ-000Dv0-SF

for dave@doctor.nl2k.ab.ca;

Thu, 22 Sep 2022 17:15:08 -0600

Resent-From: The Doctor

Resent-Date: Thu, 22 Sep 2022 17:15:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp11-ia4-sp3.mta.salesforce.com ([13.110.74.202]:43422)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1obTav-0007er-QS

for doctor@nl2k.ab.ca;

Thu, 22 Sep 2022 15:18:58 -0600

Authentication-Results: mx2-ia4-sp3.mta.salesforce.com x-tls.subject="/C=US/ST=California/L=San Francisco/O=salesforce.com, inc./OU=0:app;1:ia4;2:ia4-sp3;3:na150;4:prod/CN=na150-app2-15-ia4.ops.sfdc.net"; auth=pass (cipher=ECDHE-RSA-AES256-GCM-SHA384)

Received: from [10.180.202.81] ([10.180.202.81:56189] helo=na150-app2-15-ia4.ops.sfdc.net)

by mx2-ia4-sp3.mta.salesforce.com (envelope-from )

(ecelerity 4.4.0.19839 r(msys-ecelerity:tags/4.4.0.0^0)) with ESMTPS (cipher=ECDHE-RSA-AES256-GCM-SHA384

subject="/C=US/ST=California/L=San Francisco/O=salesforce.com, inc./OU=0:app;1:ia4;2:ia4-sp3;3:na150;4:prod/CN=na150-app2-15-ia4.ops.sfdc.net")

id E1/D1-10547-021DC236; Thu, 22 Sep 2022 21:18:24 +0000

Date: Thu, 22 Sep 2022 21:18:24 +0000 (GMT)

From: BARIS ISMAIL

Message-ID:

Subject: Hello Dear,

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_Part_9915_1983144822.1663881504854"

X-Priority: 3

X-SFDC-LK: 00D4x000008Zq0e

X-SFDC-User: 0054x000006IFUI

X-Sender: postmaster@salesforce.com

X-mail_abuse_inquiries: http://www.salesforce.com/company/abuse.jsp

X-SFDC-TLS-NoRelay: 1

X-SFDC-Binding: iCBT705cy8bBFz3B

X-SFDC-EmailCategory: apiSingleMail

X-SFDC-Interface: internal

X-Spam_score: 18.9

X-Spam_score_int: 189

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Dear, My name is barrister Baris Ismail of Ismailchambers.

I am sending you this email over the interest of my late client from your

country who was a contractor with the Turkish rail network here in Turkey

[...]



Content analysis details: (18.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail

provider

[mustafabaris193[at]gmail.com]

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received'

headers

1.2 MISSING_HEADERS Missing To: header

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.7 UNCLAIMED_MONEY BODY: People just leave money laying around

2.5 HK_SCAM_N2 BODY: No description available.

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

1.4 MALFORMED_FREEMAIL Bad headers on message from free email

service

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.0 HK_SCAM No description available.

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and

EnvelopeFrom freemail headers are

different

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 MONEY_BARRISTER Lots of money from a UK lawyer

0.0 T_MONEY_PERCENT X% of a lot of money for you

0.0 FILL_THIS_FORM Fill in a form with personal information

2.0 FILL_THIS_FORM_LONG Fill in a form with personal information

0.0 MONEY_FORM Lots of money if you fill out a form

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

1.8 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of

money

Subject: {SPAM?} Hello Dear,



------=_Part_9915_1983144822.1663881504854

Content-Type: multipart/alternative;

boundary="----=_Part_9914_888878578.1663881504854"



------=_Part_9914_888878578.1663881504854

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 7bit



Hello Dear,



My name is barrister Baris Ismail of Ismailchambers. I am sending you this email over the interest of my late client from your country who was a contractor with the Turkish rail network here in Turkey in the late 80s and early 90s. He was a man loved by all before his tragic death. Since his demise, we have made several attempts to reach a family member or any relative to no avail.



The bank contacted me to present his next of kin to claim his deposit of $36,000,000.00 with Turkish business bank (ISBANK) here in turkey within the next 7 working days or the bank will confiscate his account as an unclaimed fund, because of this mandate, I went in search and i find out you are also from the same country, I am writing to inform you that I will like to present you to the bank as his next of kin. You will be entitled to 50%, I will take 50% also.



Before we proceed, I will like you to send me your personal data such as:



Your full names



Address, City, Country, Telephone numbers,

Private email Occupation, Date of birth

Marital Status



As soon as you provide your contact details, I will complete the application and forward it to the bank to get in contact with you regarding the fund transfer proper. Do not be afraid, everything will work out in good faith and you will never have anything to regret.



Warmest Regards,

Barrister Baris Ismail

------=_Part_9914_888878578.1663881504854

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 7bit











Hello Dear,





My name is barrister Baris Ismail of Ismailchambers. I am sending you this email over the interest of my late client  from your country who was a contractor with the Turkish rail network here in Turkey in the late 80s and early 90s. He was a man loved by all before his tragic death. Since his demise, we have made several attempts to reach a family member or any relative to no avail.





The bank contacted me to present his next of kin to claim his deposit of $36,000,000.00 with Turkish business bank (ISBANK) here in turkey within the next 7 working days or the bank will confiscate his account as an unclaimed fund, because of this mandate, I went in search and i find out you are also from the same country, I am writing to inform you that I will like to present you to the bank as his next of kin. You will be entitled to 50%, I will take 50% also.





Before we proceed, I will like you to send me your personal data such as:





Your full names





Address, City, Country,  Telephone numbers,


Private email Occupation, Date of birth


Marital Status





As soon as you provide your contact details, I will complete the application and forward it to the bank to get in contact with you regarding the fund transfer proper. Do not be afraid, everything will work out in good faith and you will never have anything to regret.





Warmest Regards,


Barrister Baris Ismail



------=_Part_9914_888878578.1663881504854--



------=_Part_9915_1983144822.1663881504854--

Business proposal spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 22 Sep 2022 06:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1obL0B-000G2k-Ro

for dave@doctor.nl2k.ab.ca;

Thu, 22 Sep 2022 06:08:23 -0600

Resent-From: The Doctor

Resent-Date: Thu, 22 Sep 2022 06:08:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f178.google.com ([209.85.214.178]:45702)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1obKxv-000Foe-3k

for doctor@doctor.nl2k.ab.ca;

Thu, 22 Sep 2022 06:06:06 -0600

Received: by mail-pl1-f178.google.com with SMTP id w20so8545134ply.12

for ; Thu, 22 Sep 2022 05:05:46 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date;

bh=UPzctBJcv3u67+uiASrVG8iGAgp2dBHyaMZD8K2Mh+k=;

b=GU1778pcfWqalRhQ8QoOCjJ2c8Pe7Dv18I/K8lZtEUNLj6BtxgoySINIZ+jlyN0sLv

mh2mHuK/gqpHI5A4AgOnlH6KvcX5b2YuGY2VaV2MaYdap3HHrc06gRf7iwiAB05rY5yP

qv+3IpJe5N1pJw1EO8diaTaWaeojh4ZFHjWhn00NKL3eM9+zotR4qEAgO5JOZY/vR5Gg

Ez+2t9kCOz2E+oCetC8lgBsd42Fu2u4j7SOKxqEK95qr+g1SM3U4FbPQDShdOlhNSjXE

HpZOAK6vwVDxUZtWjPqpIOFCV62VnVtmVzOimnuC2VzeHaUHEwIVqnC9wRd7VXbLuup8

/ZNg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date;

bh=UPzctBJcv3u67+uiASrVG8iGAgp2dBHyaMZD8K2Mh+k=;

b=Q6WCfivKt3eiiEIWFcQxN1CSvZtYTff3oKlypQjmrWwzUQHyiScBF3U8s2z0VEXXsM

8kBpxhrwIsGKjkKELL7piuYMD663yXtvE8bUTMZq8ovS54R0CSFdePEa9QeLre0cENV0

XDq5hDRYnZNutppREzOml309mccw6u3rY8Zy1DLEu99grsCFgsnFbA4VggoOXZAGzFMu

vkAaje6dvXTRTqmuFmjH/642fQ6+THB1irCncE81jkllXPjQ7xj/7cNFnp4HuFFud8IH

+RvzsWk1D/Bj64dPzsOe4BZWLqpWjWQlDeJf0wAZPD5CQEPmCv/qoWYyVa140Z1fQjhe

LxIg==

X-Gm-Message-State: ACrzQf1F9DH8p/YuAEmF2SGevBnPo86pYotNXVbvVzy2OgIEGGPZKwCR

UKyaFP2bI704GXBHbSwEkNnbXFLdQ8MHBnJdM5s=

X-Google-Smtp-Source: AMsMyM6+Uu6a7wW3g4DNKRPKoy6atJ/Wa2mLgnrAOuihVPYP/YdGEkePMJ6kzNxYkt+l9PIb4X2pYlNBe1c5QGYMdX0=

X-Received: by 2002:a17:90b:306:b0:202:b9a4:b0aa with SMTP id

ay6-20020a17090b030600b00202b9a4b0aamr3475026pjb.78.1663848340479; Thu, 22

Sep 2022 05:05:40 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a05:6a11:10b:b0:2f4:5b92:d58f with HTTP; Thu, 22 Sep 2022

05:05:39 -0700 (PDT)

Reply-To: dr.lisaw222@gmail.com

From: Dr Lisa Williams

Date: Thu, 22 Sep 2022 05:05:39 -0700

Message-ID:

Subject: Hello Am Dr Lisa.

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@doctor.nl2k.ab.ca



--

Greeting to you,



Am Dr Lisa from the United States.



I have a business proposal for investment. So I need partner urgently.



I will share some of my pics and more details about myself when I get

your response.



Thanks

With love

Lisa

sexual blackmail phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 22 Sep 2022 04:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1obJqY-000FqV-3p

for dave@doctor.nl2k.ab.ca;

Thu, 22 Sep 2022 04:54:22 -0600

Resent-From: The Doctor

Resent-Date: Thu, 22 Sep 2022 04:54:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [197.113.53.135] (port=46744)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1obH3Q-000KOM-Us

for root@nk.ca;

Thu, 22 Sep 2022 01:55:35 -0600

From:

To:

Subject: You have outstanding debt.

Date: 22 Sep 2022 08:33:06 +0000

Message-ID: <002101d8ce61$0487cb3f$0df9e0bf$@nk.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="iso-8859-3"

Content-Transfer-Encoding: 8bit

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: Aceyrn6r1n9wgqbweyrn6r1n9wgqbw==

Content-Language: en

x-cr-hashedpuzzle: 2D4= e1yu ohnh jwtd dwe1 yuoh nhjw tddw e1yu ohnh jwtd dw3p yh7o tpdb y9lw 3pyh;1;7otpdby9lw3pyh7otpdby9lw3pyh7otpdby9lw3pyh7otpdb;Sosha1_v1;7;\{72082681-5DB5-02FA-69EA-4D9179CE36A5\};ZQB3AGUAZg3pyh7otpdby9lw3pyh7otpdby9lw3pyh7otpdb;22 Sep 2022 08:33:06 +0000;eluc3lhoc6entbel

x-cr-puzzleid: \{72082681-5DB5-02FA-69EA-4D9179CE36A5\}

X-Spam_score: 8.1

X-Spam_score_int: 81

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello there! Unfortunately, there are some bad news for you.

Around several months ago I have obtained access to your devices that you

were using to browse internet. Subsequently, I have proceeded with tracking

do [...]



Content analysis details: (8.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=root%40nk.ca;ip=197.113.53.135;r=doctor.nl2k.ab.ca]

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.5 PDS_BTC_ID FP reduced Bitcoin ID

1.0 BITCOIN_YOUR_INFO BitCoin with your personal info

1.0 BITCOIN_SPAM_07 BitCoin spam pattern 07

0.0 TO_EQ_FM_SPF_FAIL To == From and external SPF failed

1.4 DOS_OUTLOOK_TO_MX Delivered direct to MX with Outlook headers

1.0 BITCOIN_MALWARE BitCoin + malware bragging

0.0 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF

failed

1.0 MALWARE_NORDNS Malware bragging + no rDNS

Subject: {SPAM?} You have outstanding debt.



Hello there!



Unfortunately, there are some bad news for you.

Around several months ago I have obtained access to your devices that you were using to browse internet.

Subsequently, I have proceeded with tracking down internet activities of yours.



Below, is the sequence of past events:

In the past, I have bought access from hackers to numerous email accounts (today, that is a very straightforward task that can be done online).

Clearly, I have effortlessly logged in to email account of yours (root@nk.ca).



A week after that, I have managed to install Trojan virus to Operating Systems of all your devices that are used for email access.

Actually, that was quite simple (because you were clicking the links in inbox emails).

All smart things are quite straightforward. (^^)



The software of mine allows me to access to all controllers in your devices, such as video camera, microphone and keyboard.

I have managed to download all your personal data, as well as web browsing history and photos to my servers.

I can access all messengers of yours, as well as emails, social networks, contacts list and even chat history.

My virus unceasingly refreshes its signatures (since it is driver-based), and hereby stays invisible for your antivirus.



So, by now you should already understand the reason why I remained unnoticed until this very moment...



While collecting your information, I have found out that you are also a huge fan of websites for adults.

You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.

I have recorded several kinky scenes of yours and montaged some videos, where you reach orgasms while passionately masturbating.



If you still doubt my serious intentions, it only takes couple mouse clicks to share your videos with your friends, relatives and even colleagues.

It is also not a problem for me to allow those vids for access of public as well.

I truly believe, you would not want this to occur, understanding how special are the videos you love watching, (you are clearly aware of that) all that stuff can result in a real disaster for you.



Let's resolve it like this:

All you need is $1350 USD transfer to my account (bitcoin equivalent based on exchange rate during your transfer), and after the transaction is successful, I will proceed to delete all that kinky stuff without delay.

Afterwards, we can pretend that we have never met before. In addition, I assure you that all the harmful software will be deleted from all your devices. Be sure, I keep my promises.



That is quite a fair deal with a low price, bearing in mind that I have spent a lot of effort to go through your profile and traffic for a long period.

If you are unaware how to buy and send bitcoins - it can be easily fixed by searching all related information online.



Below is bitcoin wallet of mine: 1CiqhHbPPNKHyX9AiMBFKp6ydxcM5WJyBW



You are given not more than 48 hours after you have opened this email (2 days to be precise).



Below is the list of actions that you should not attempt doing:

> Do not attempt to reply my email (the email in your inbox was created by me together with return address).

> Do not attempt to call police or any other security services. Moreover, don't even think to share this with friends of yours. Once I find that out (make no doubt about it, I can do that effortlessly, bearing in mind that I have full control over all your systems) - the video of yours will become available to public immediately.

> Do not attempt to search for me - there is completely no point in that. All cryptocurrency transactions remain anonymous at all times.

> Do not attempt reinstalling the OS on devices of yours or get rid of them. It is meaningless too, because all your videos are already available at remote servers.



Below is the list of things you don't need to be concerned about:

> That I will not receive the money you transferred.

- Don't you worry, I can still track it, after the transaction is successfully completed, because I still monitor all your activities (trojan virus of mine includes a remote-control option, just like TeamViewer).

> That I still will make your videos available to public after your money transfer is complete.

- Believe me, it is meaningless for me to keep on making your life complicated. If I indeed wanted to make it happen, it would happen long time ago!



Everything will be carried out based on fairness!



Before I forget...moving forward try not to get involved in this kind of situations anymore!

An advice from me - regularly change all the passwords to your accounts.



Aggressive Domain spam from Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 22 Sep 2022 04:52:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1obJnV-000BQu-9t

for dave@doctor.nl2k.ab.ca;

Thu, 22 Sep 2022 04:51:13 -0600

Resent-From: The Doctor

Resent-Date: Thu, 22 Sep 2022 04:51:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f67.google.com ([209.85.216.67]:37814)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1obEB6-0005Bs-MT

for root@nk.ca;

Wed, 21 Sep 2022 22:51:16 -0600

Received: by mail-pj1-f67.google.com with SMTP id o99-20020a17090a0a6c00b002039c4fce53so1000566pjo.2

for ; Wed, 21 Sep 2022 21:50:55 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20210112;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date;

bh=3wGOfSB8JV+INzqgCHRIMdKLCxPUJCt4eTdVZzEm/S4=;

b=Oe0yGDXTq34aiGwAnq7Kc7FRLqPqpIbodzOYJjRjuaUXu8ash2XF96dSi3gBkBDlLS

A3ZMizvQXI4SE6vYvFlneMaDVdH+a2FmuyJ6RpNE99oUY+jGBPhGhYa9OAqilHOtUCOf

Dniz8id2cLAlz6JDEwNWEGXYx1hm9kH8Yjfp3y1cDa3qrL1xxdwYTFgaXvYbXKNz8Iy9

LfXTA5YCtSQ2gfkgg3H9VdvjjqYbpC3dqNOvqTeVm34TLYSh9F0E2OmzkfAOhj1rWJrI

gZeJMsmgd7eRi8bwYs7r/MeKcD2MbMZ+BdBsTTI36u+qd51LP8Z+2Y9zpukX2A8JzHo0

Y5Cg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20210112;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date;

bh=3wGOfSB8JV+INzqgCHRIMdKLCxPUJCt4eTdVZzEm/S4=;

b=nxgu9spR/qNulHbON9uOrLjjI8T2XuxWsP21PowFthZM5+0vhFrhtrxFc6Va82NcJv

RmjHMosBrsq/bkomCHYHEz/VS7GDKOw3zFZz+nZoh6L/deKhrdDiMBi1LejBMqNqnk5y

p2DsHvpGirTE4sXB5h3CZQtXl2jhbeJewXpnjS44NiYJtlxNjEEwwSZqvC1z0coRbXE7

g1rntOV/ZBegdYJmPBoGMVWzZXTVMPzEUm7u1vBsNV9I41G/f5J5QYfiuetOtPlQjcq/

wKYQSiNoyZI1rQLM0AEvKdWrPoo4eQWiBOEXjiuBlJD/6Zd4COaAkyqzUak/YCoFTEqH

rOig==

X-Gm-Message-State: ACrzQf3wwPFLqOni9vAcda3IKA4sX9q70zJ2nBEMwQ0bGX4mV6t/NtvJ

x5Osy18q+q74cxFT4acZN+hqH7j40k1q0CoAdbwHyngP

X-Google-Smtp-Source: AMsMyM6ipKaRvqzswn9FFJ9rTBpt6byisygvGZ0cUjUFtJpwx0tXLQXdJyDsLxtqPmJpZ+g1KUMTWUwhPdf5TMlrz/Q=

X-Received: by 2002:a17:902:ce81:b0:178:8e0a:5615 with SMTP id

f1-20020a170902ce8100b001788e0a5615mr1503956plg.109.1663822249986; Wed, 21

Sep 2022 21:50:49 -0700 (PDT)

MIME-Version: 1.0

From: Hung Dehoyos

Date: Thu, 22 Sep 2022 06:50:38 +0200

Message-ID:

Subject: fulltimeshopp.com

To: root@nk.ca

Content-Type: multipart/alternative; boundary="0000000000002e0dc305e93cce48"



--0000000000002e0dc305e93cce48

Content-Type: text/plain; charset="UTF-8"



Hey there!



Are you interested in fulltimeshopp.com? If so, please let me know and I

will send you more info. No website comes with it, only the name is on sale.



Have a nice day!

Hung Dehoyos



--0000000000002e0dc305e93cce48

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hey there!

Are you intereste=

d in fulltimeshopp.com? If so, ple=

ase let me know and I will send you more info. No website comes with it, on=

ly the name is on sale.

Have a nice day!

>Hung Dehoyos





--0000000000002e0dc305e93cce48--