gallifrey.nk.ca Email Storage Quota Exceeded

DHL phish from Digital ocean

Phishing attempt to get Netknow user passwords

nk.ca users targeted for their credentials

Phish to get your RBC account

Lotter winner phish

Posted by Dave Yadallee on Tuesday, September 27. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 27 Sep 2022 16:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1odIdb-0008Ob-1O

for dave@doctor.nl2k.ab.ca;

Tue, 27 Sep 2022 16:01:11 -0600

Resent-From: The Doctor

Resent-Date: Tue, 27 Sep 2022 16:01:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [143.198.149.77] (port=50746 helo=monetizer.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1odDfR-0007QJ-KJ

for sales@nk.ca;

Tue, 27 Sep 2022 10:42:50 -0600

X-priority: 3

Received: by monetizer.com (Postfix, from userid 33)

id 150C741F8F; Tue, 27 Sep 2022 16:41:14 +0000 (UTC)

To: sales@nk.ca

Subject: =?UTF-8?B?REhMIC0gU2hpcG1lbnQgdHJhY2tpbmcgW1hXODQyMzkxNzUwQ0Fd?=

X-PHP-Originating-Script: 0:index.php

Reply-by: newlettre@3rh.fr

From: =?UTF-8?B?RVhQUkVTUw==?=

Reply-To: se@acscom.fr

Message-ID: <2e40779e5d1b02f0366a166bd29ba9a2@acscom.fr>

X-Mailer: PHPMailer 884143503ef322523a54fba15620b668

List-Unsubscribe: mailto:bounce388-s1owO3nrNW4JcMW@acscom.fr?subject=list-unsubscribe

X-priority: 2

Content-Type: multipart/alternative;

boundary="1884143503ef322523a54fba15620b668"

Date: Tue, 27 Sep 2022 16:41:14 +0000 (UTC)

X-Spam_score: 7.9

X-Spam_score_int: 79

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: YOUR PACKAGE IS WAITING FOR DELIVERY

Content analysis details: (7.9 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_RED Contains an URL listed in the URIBL redlist

[URIs: krazyweasel.com]

0.0 SPF_HELO_NEUTRAL SPF: HELO does not match SPF record (neutral)

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level

mail domains are different

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or

identical to background

0.0 HTML_MESSAGE BODY: HTML included in message

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or

Formatted Colors in HTML

2.0 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required

MIME headers

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} =?UTF-8?B?REhMIC0gU2hpcG1lbnQgdHJhY2tpbmcgW1hXODQyMzkxNzUwQ0Fd?=

This is a multi-part message in MIME format.

--1884143503ef322523a54fba15620b668

Content-Type: text/plain; charset=UTF-8

YOUR PACKAGE IS WAITING FOR

DELIVERY

Dear

Customer,

DHL

informs you that your shipment XW842391750CA is

still waiting for your instructions.

It

will be delivered as soon as the costs are paid.

Fees

to be paid: 4.26 CAD

Pay

now

Sincerely,

DHL

DHL

Express | Help

and support | Privacy

Notice | CONTACT US

2022 © DHL International GmbH. All rights reserved.

opyright @ 2000-2022 by John

Wiley & Sons, Inc., or related companies.

All rights reserved

ite Map

ights &

Permissions

rivacy Policy

erms of Use

--1884143503ef322523a54fba15620b668

Content-Type: text/html; charset=UTF-8

http-equiv="content-type">

style="width: 303.594px; color: rgb(255, 255, 255); font-family: Helvetica,Arial,sans-serif; font-size: 16px; font-style: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; background-color: rgb(255, 255, 255);">

style="margin: 0px; padding: 0px; list-style-type: none; list-style-image: none; list-style-position: outside;">

style="background-color: transparent; text-decoration: none; color: rgb(255, 255, 255);">

style="border-collapse: collapse; font-style: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; color: rgb(34, 34, 34); font-family: Arial,Helvetica,sans-serif; font-size: small; text-align: start; background-color: rgb(255, 255, 255);"

border="0" cellpadding="0" cellspacing="0"

width="100%">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

align="center">

style="border: thin solid rgb(235, 235, 235); background: rgb(255, 255, 255) none repeat scroll 0% 50%; -moz-background-clip: initial; -moz-background-origin: initial; -moz-background-inline-policy: initial; border-collapse: collapse; width: 600px; font-family: Arial,Helvetica,sans-serif; font-size: 12px; text-align: center;"

align="center" bgcolor="#ffffff" cellpadding="0"

cellspacing="0" width="600">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

align="left" valign="top">

border="0" cellpadding="0" cellspacing="0"

width="100%">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">
src="https://krazyweasel.com/unnamed.jpg" alt=""

class="v1CToWUd"

style="vertical-align: middle; width: 600px; height: 114px;">

border="0" cellpadding="0" cellspacing="0"

width="100%">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

width="28">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">

border="0" cellpadding="0" cellspacing="0"

width="100%">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif; font-weight: bold;">

border="0" cellpadding="0" cellspacing="0"

width="100%">

style="margin: 0px; font-family: Arial,Helvetica,sans-serif; color: rgb(214, 4, 17); font-size: 18px; text-transform: uppercase;"

align="left" valign="top">

title="Rich Text Editor, MAIN_HEADING"

id="v1m_-8221325808561420624MAIN_HEADING" style="">
style="font-size: 14.4px; font-weight: 400;">
style="font-size: 11.52px; font-weight: 400;">
style="font-weight: bold;">YOUR PACKAGE IS WAITING FOR

DELIVERY

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">
style="">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

width="26">

border="0" cellpadding="0" cellspacing="0"

width="100%">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

width="28">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

align="left" valign="top">

border="0" cellpadding="0" cellspacing="0"

width="100%">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">

border="0" cellpadding="0" cellspacing="0"

width="100%">

style="margin: 0px; font-family: Arial,Helvetica,sans-serif; font-size: 14px;"

align="left" valign="top">

id="v1m_-8221325808561420624GREETING" style="">Dear

Customer,

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">

style="margin: 0px; font-family: Arial,Helvetica,sans-serif; font-size: 12px;"

align="left" valign="top">

id="v1m_-8221325808561420624BODY" style="">
style="font-weight: bold;">DHL

informs you that your shipment
style="font-weight: bold;">XW842391750CA is

still waiting for your instructions.
style="font-weight: bold;">
style="">

style="font-weight: bolder; color: rgb(0, 0, 0); font-family: Arial,sans-serif; font-size: 16px; font-style: normal; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; background-color: rgb(255, 255, 255);">It

will be delivered as soon as the costs are paid.

style="color: rgb(0, 0, 0); font-family: Arial,sans-serif; font-size: 16px; font-style: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; background-color: rgb(255, 255, 255);">

style="font-weight: bolder; color: rgb(0, 0, 0); font-family: Arial,sans-serif; font-size: 16px; font-style: normal; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; background-color: rgb(255, 255, 255);">
class="v1auto-style2" style="color: rgb(220, 25, 40);">Fees

to be paid: 4.26 CAD

style="border: 0px none ; margin: auto; padding: 0px; border-collapse: collapse; width: inherit; font-family: Tahoma; font-style: normal; font-variant: normal; font-weight: normal; font-size: 16px; line-height: normal; font-size-adjust: none; font-stretch: normal; background-color: rgb(255, 181, 0);"

border="0" cellpadding="0" cellspacing="0">

style="border: 0px none ; margin: auto; padding: 0px; font-family: Tahoma; font-style: normal; font-variant: normal; font-weight: normal; font-size: 16px; line-height: normal; font-size-adjust: none; font-stretch: normal; display: table-row-group;">

style="border: 0px none ; margin: auto; padding: 0px; background-color: inherit; font-family: Tahoma; font-style: normal; font-variant: normal; font-weight: normal; font-size: 16px; line-height: normal; font-size-adjust: none; font-stretch: normal; display: table-row;">

style="border: medium none ; margin: auto; padding: 15px 5px; font-family: "Merriweather Sans",Tahoma,Arial,sans-serif; font-style: normal; font-variant: normal; font-weight: normal; font-size: 15px; line-height: 15px; font-size-adjust: none; font-stretch: normal; text-align: center; display: table-cell; width: 182px; letter-spacing: 0px; text-decoration: none;"

align="center" valign="top">
href="https://krazyweasel.com/m/apps.html?id=PDWNRYI87ZQ1ISALSTH4PLZ2UHA9586VL3JC12L91BAJ3L4VFMZ47Z62HG"

class="v1fontLink" target="_blank" rel="noreferrer"

style="border: 0px none ; margin: auto; padding: 0px; color: rgb(54, 54, 54); text-decoration: none; background-color: transparent; font-family: Tahoma; font-style: normal; font-variant: normal; font-weight: normal; font-size: 15px; line-height: 15px; font-size-adjust: none; font-stretch: normal; display: block; letter-spacing: 0px; text-align: center;">Pay

now

border="0" cellpadding="0" cellspacing="0"

width="100%">

style="margin: 0px; font-family: Arial,Helvetica,sans-serif; font-size: 12px; width: 546px;">
style="">

title="Rich Text Editor, SIGNATURE_LINE1"

id="v1m_-8221325808561420624SIGNATURE_LINE1" style="">Sincerely,

title="Rich Text Editor, SIGNATURE_LINE2"

id="v1m_-8221325808561420624SIGNATURE_LINE2"

style="font-family: Arial,Helvetica,sans-serif; color: rgb(214, 4, 17); background-color: rgb(255, 255, 255);">DHL

border="0" cellpadding="0" cellspacing="0"

width="100%">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">

border="0" cellpadding="0" cellspacing="0"

width="100%">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

width="160">

alt="" class="v1CToWUd"

style="vertical-align: middle; width: 160px; height: 45px;">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">

style="margin: 0px; font-family: Verdana,Geneva,sans-serif; font-size: 10px; text-align: right;"

align="right">

title="Rich Text Editor, FOOTER_TEXT"

id="v1m_-8221325808561420624FOOTER_TEXT" style="">
href="#"

style="color: rgb(17, 85, 204); background-color: transparent; text-decoration: underline;">DHL

Express |
style="">
style="color: rgb(17, 85, 204); background-color: transparent; text-decoration: underline;">Help

and support |
style="">
style="color: rgb(17, 85, 204); background-color: transparent; text-decoration: underline;">Privacy

Notice |
target="_blank" rel="noreferrer"

style="color: rgb(17, 85, 204); text-decoration: none; background-color: transparent;">
style="text-decoration: underline;">CONTACT US

2022 © DHL International GmbH. All rights reserved.

border="0" cellpadding="0" cellspacing="0"

width="100%">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;">

style="margin: 0px; font-family: Roboto,RobotoDraft,Helvetica,Arial,sans-serif;"

width="26">

style="width: 595.5px; font-family: "Open Sans",sans-serif; font-size: 13px; font-style: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; background-color: rgb(255, 255, 255);">

data-cmp-data-layer="{"text-04f72f2e44":{"@type":"wiley/components/content/text","repo:modifyDate":"2022-02-15T14:07:22Z","xdm:text":"<p><a href="/copyright">Copyright @ 2000-2022</a> by <a href="/">John Wiley & Sons, Inc.,</a> or related companies. All rights reserved.</p>rn"}}"

id="text-04f72f2e44" class="cmp-text" style="">

style="text-decoration: none;">
style="color: rgb(255, 255, 255);">opyright @ 2000-2022
style="color: rgb(255, 255, 255);">by
href="https://www.wiley.com/" style="text-decoration: none;">
style="color: rgb(255, 255, 255);">John

Wiley & Sons, Inc.,
style="color: rgb(255, 255, 255);">or related companies.

All rights reserved

style="color: rgb(255, 255, 255); font-family: "Open Sans",sans-serif; font-size: 13px; font-style: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; background-color: rgb(255, 255, 255);">

style="">

data-cmp-data-layer="{"list-eae548835e-item-358f941ad5":{"@type":"wiley/components/content/list/item","repo:modifyDate":"2022-02-15T14:07:22Z","dc:title":"Site Map ","xdm:linkURL":"/sitemap"}}"

style="list-style-type: none; list-style-image: none; list-style-position: outside;">
style="border-left: medium none; padding-top: 0px; padding-bottom: 0px; padding-left: 0px ! important; line-height: normal;">
class="cmp-list__item-link" href="https://www.wiley.com/sitemap"

target="_self"

style="text-decoration: none; letter-spacing: 0.01em;">
class="cmp-list__item-text">
class="cmp-list__item-title">
style="color: rgb(255, 255, 255);">ite Map

Posted by Dave Yadallee on Tuesday, September 27. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 27 Sep 2022 07:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1odAqC-00049B-Mj

for dave@doctor.nl2k.ab.ca;

Tue, 27 Sep 2022 07:41:40 -0600

Resent-From: The Doctor

Resent-Date: Tue, 27 Sep 2022 07:41:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail0.wextopland.info ([79.110.62.159]:51546)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1odAjT-0002K3-VS

for sales@nk.ca;

Tue, 27 Sep 2022 07:34:48 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=wextopland.info;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:

Content-Transfer-Encoding; i=contatti@wextopland.info;

bh=BpSeY2rHaBCDYhQqTZAU7QX6+7KtLZu+glAIi2STsyU=;

b=I/T+zCUHEZ59FY1m50O+Ta0NO6ni54PF30G+hB3fW27OE7Q0eo27IpbTmrtqYlt60GEzH1H+WAyh

3xIM3xR7HcStjQiMF4/i04bQRY4dMO2hh3LCF9+8POfdmJvzcfnyOtHnWGvdChtVTfkQnqLmunOc

BlPwEoshM2SEBSCj8uE=

From: Email Server

To: sales@nk.ca

Subject: sales@nk.ca 10 PENDING MESSAGES VERIFY NOW TO RELEASE INBOX

Date: 27 Sep 2022 06:34:24 -0700

Message-ID: <20220927063424.BD24AAD2C269ED4E@wextopland.info>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.3

X-Spam_score_int: 73

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Dear sales You have some pending messages on your server.

Kindly AUTHENTICATE your sales@nk.ca account below to access on hold messages.

Content analysis details: (7.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URIs: wextopland.info]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} sales@nk.ca 10 PENDING MESSAGES VERIFY NOW TO RELEASE INBOX

Dear sales

You have some pending messages on your server.
>

Kindly AUTHENTICATE your sales@nk.ca account below to a=

ccess on hold messages.

Activation expires after 12hours f=

rom 9/27/2022 6:34:24 a.m. and your domain nk.ca will be blocked =

arent" border=3D"0">

late.goog/?_x_tr_hp=3Dbafybeibjpjtcpxjevs6t5ygr6d5&_x_tr_sl=3Dauto&_x_tr_tl=

=3Den&_x_tr_hl=3Den-US#sales@nk.ca" rel=3Dnoreferrer target=3D_blank>AUTHEN=

TICATE ACCOUNT HERE

=

Registry Team.

Posted by Dave Yadallee on Tuesday, September 27. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 27 Sep 2022 06:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1od9og-0007lP-LD

for dave@doctor.nl2k.ab.ca;

Tue, 27 Sep 2022 06:36:02 -0600

Resent-From: The Doctor

Resent-Date: Tue, 27 Sep 2022 06:36:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ns2.nl2k.ab.ca ([204.209.81.3]:26790 helo=gallifrey.nk.ca)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1od8MG-000Kch-Mq

for doctor@nk.ca;

Tue, 27 Sep 2022 05:02:38 -0600

Received: from [46.228.203.10] (port=58907 helo=gki.com)

by gallifrey.nk.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1od8Ls-000Fy9-5j

for root@gallifrey.nk.ca;

Tue, 27 Sep 2022 05:02:14 -0600

Reply-To:

From: Account Update

To: root@gallifrey.nk.ca

Subject: SERVICE MESSAGE: Your Quota has Been Exceeded

Date: 27 Sep 2022 13:01:48 +0200

Message-ID: <20220927130148.840450A439F3B3EC@gki.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: gallifrey.nk.ca Email Storage Quota Exceeded Hello root@gallifrey.nk.ca

The storage quota allocated to your email root@gallifrey.nk.ca is exceeded.

You will stop getting new emails if you do not upgrade.

Content analysis details: (9.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[46.228.203.10 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[f.morgan12[at]yahoo.com]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 URI_TRY_3LD URI: "Try it" URI, suspicious hostname

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 URI_FIREBASEAPP Link to hosted firebase web application,

possible phishing

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML

only

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: gallifrey.nk.ca Email Storage Quota Exceeded Hello root@gallifrey.nk.ca

The storage quota allocated to your email root@gallifrey.nk.ca is exceeded.

You will stop getting new emails if you do not upgrade.

Content analysis details: (9.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[46.228.203.10 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[f.morgan12[at]yahoo.com]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 URI_TRY_3LD URI: "Try it" URI, suspicious hostname

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.0 URI_FIREBASEAPP Link to hosted firebase web application,

possible phishing

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML

only

Subject: {SPAM?} SERVICE MESSAGE: Your Quota has Been Exceeded

;">

Hello root@gallifrey.nk.ca

The storage quota allocated to your email root@gallifrey.nk.ca =

is exceeded. You will stop getting new emails if you do not upgrade.

padding: 10px; text-align: center; width: 300px; margin: 0 auto; font-weigh=

t: 700;">

root@gallifrey.nk.ca">Upgrade Storage Quota

=20=20=20=20=20=20=20=20

Posted by Dave Yadallee on Tuesday, September 27. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 26 Sep 2022 17:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ocxxu-0000Bb-7Y

for dave@doctor.nl2k.ab.ca;

Mon, 26 Sep 2022 17:56:46 -0600

Resent-From: The Doctor

Resent-Date: Mon, 26 Sep 2022 17:56:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ns2.nl2k.ab.ca ([204.209.81.3]:35837 helo=gallifrey.nk.ca)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1ocv8b-000F51-6C

for doctor@nk.ca;

Mon, 26 Sep 2022 14:55:39 -0600

Received: from [46.228.203.10] (port=61917 helo=gki.com)

by gallifrey.nk.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1ocv8F-000MBS-AZ

for root@gallifrey.nk.ca;

Mon, 26 Sep 2022 14:55:19 -0600

Reply-To:

From: RBC Royal Bank

To: root@gallifrey.nk.ca

Subject: SERVICE MESSAGE: Your Account is on Hold

Date: 26 Sep 2022 22:54:51 +0200

Message-ID: <20220926225451.BE44AB1E0D786E06@gki.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 12.2

X-Spam_score_int: 122

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: RBC root@gallifrey.nk.ca, Account security is a top priority

for Royal Bank of Canada. Your account has been placed on hold. We sincerely

apologize for any difficulties this incident may have caused you.

Content analysis details: (12.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: glitch.me]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[46.228.203.10 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[f.morgan12[at]yahoo.com]

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX

X-Spam_score: 12.2

X-Spam_score_int: 122

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: RBC root@gallifrey.nk.ca, Account security is a top priority

for Royal Bank of Canada. Your account has been placed on hold. We sincerely

apologize for any difficulties this incident may have caused you.

Content analysis details: (12.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was

blocked. See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: glitch.me]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[46.228.203.10 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in

digit

[f.morgan12[at]yahoo.com]

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX

Subject: {SPAM?} SERVICE MESSAGE: Your Account is on Hold

w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
org/1999/xhtml" xmlns:o=3D"urn:schemas-microsoft-com:office:office" style=

=3D"font-family:arial, 'helvetica neue', helvetica, sans-serif">
charset=3D"UTF-8">
" name=3D"viewport">
ta http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge">
lephone=3Dno" name=3D"format-detection">RBC

ans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%;padding:0=

;Margin:0">

6">
0" cellpadding=3D"0" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;bor=

der-collapse:collapse;border-spacing:0px;padding:0;Margin:0;width:100%;heig=

ht:100%;background-repeat:repeat;background-position:center top">

lign=3D"top" style=3D"padding:0;Margin:0">
acing=3D"0" cellpadding=3D"0" align=3D"center" style=3D"mso-table-lspace:0p=

t;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;table-la=

yout:fixed !important;width:100%;background-color:transparent;background-re=

peat:repeat;background-position:center top">

=3D"padding:0;Margin:0">
ellpadding=3D"0" bgcolor=3D"#ffffff" align=3D"center" style=3D"mso-table-ls=

pace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;b=

ackground-color:#FFFFFF;width:600px">

g:0;Margin:0;padding-top:20px;padding-left:20px;padding-right:20px">
width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" style=3D"mso-table-lspac=

e:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px">
>

x">
tation" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:=

collapse;border-spacing:0px">

in:0;font-size:0px">

/9j/4AAQSkZJRgABAQAAAQABAAD/4gHYSUNDX1BST0ZJTEUAAQEAAAHIbGNtcwIQAABtbnRyUkd=

CIFhZWiAH4gADABQACQAOAB1hY3NwTVNGVAAAAABzYXdzY3RybAAAAAAAAAAAAAAAAAAA9tYAAQ=

AAAADTLWhhbmSdkQA9QICwPUB0LIGepSKOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

AlkZXNjAAAA8AAAAF9jcHJ0AAABDAAAAAx3dHB0AAABGAAAABRyWFlaAAABLAAAABRnWFlaAAAB=

QAAAABRiWFlaAAABVAAAABRyVFJDAAABaAAAAGBnVFJDAAABaAAAAGBiVFJDAAABaAAAAGBkZXN=

jAAAAAAAAAAV1UkdCAAAAAAAAAAAAAAAAdGV4dAAAAABDQzAAWFlaIAAAAAAAAPNUAAEAAAABFs=

lYWVogAAAAAAAAb6AAADjyAAADj1hZWiAAAAAAAABilgAAt4kAABjaWFlaIAAAAAAAACSgAAAPh=

QAAtsRjdXJ2AAAAAAAAACoAAAB8APgBnAJ1A4MEyQZOCBIKGAxiDvQRzxT2GGocLiBDJKwpai5+=

M+s5sz/WRldNNlR2XBdkHWyGdVZ+jYgskjacq6eMstu+mcrH12Xkd/H5////2wBDAAkGBwgHBgk=

ICAgKCgkLDhcPDg0NDhwUFREXIh4jIyEeICAlKjUtJScyKCAgLj8vMjc5PDw8JC1CRkE6RjU7PD=

n/2wBDAQoKCg4MDhsPDxs5JiAmOTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5O=

Tk5OTk5OTk5OTk5OTn/wAARCADhAOEDASIAAhEBAxEB/8QAHAABAAIDAQEBAAAAAAAAAAAAAAYH=

AwQFAQII/8QASRAAAQMDAQMHCAcGBQEJAAAAAQACAwQFEQYSITEHEzZBUWFxFCJUgZGTobIjMnS=

xs8HRFRZCUmLwFzNVcnMkNENEU4KSosLx/8QAGgEBAAIDAQAAAAAAAAAAAAAAAAQFAQMGAv/EAD=

gRAAEDAgQDBAgEBwEAAAAAAAEAAgMEEQUSITFBUXETM2GBBhQikaGx0fAVMsHxFiMkQlJT4ZL/2=

gAMAwEAAhEDEQA/ALxRERERERERERERERERERERERERERERERERERERERERERERERERERERERER=

ERERERERERERERERYpamCF2zLPFG4jOHPAOF8eXUfpcHvAs2KXWwi1/LqP0uD3gTy6j9Lg94EsV=

i4Wwi1/LqP0uD3gTy6j9Lg94EsUuFsItfy6j9Lg94E8uo/S4PeBLFLhbCLX8uo/S4PeBPLqP0uD=

3gSxS4Wwi1/LqP0uD3gTy6j9Lg94EsUuFsItfy6j9Lg94E8uo/S4PeBLFLhbCLX8uo/S4PeBfUd=

XTSvDI6iJ7jwa14JKWKXWZERYWURERERERERERERERERERERERFTPLKAdVU27/wLPnkUDwOwKec=

snSqm+ws+eRQRdHS9y3oudq++cstJRz1s7YKaB0sruDWjP8A+Lvs0Pd3NBIpmk9Rk3j4KT6No4L=

dp9ta8ASTNMsj+vZGcD2LiVGvqoyuNPSRNj/hDySfXhcvLjGJVlTJDhrBljNiXcT71ZsoqWCJr6=

pxu7UALlXPSlwttG+qn5gxsxnZdk7/AFLh4HYFcVxoW3i1eTyvdGJWtcXM4jgetR/9wKL02p9jf=

0WjC/S+ExEV7rPvwB2+PitlXgr849XHs24lV7gdgTA7ArC/cCi9NqfY39E/cCi9NqfY39FZfxdh=

X+w/+T9FF/Bavl8Qq9wOwJgdgVhfuBRem1Psb+ih+oLcy1XWWjje57GAYc7jvCnUGO0WISGKndc=

gX2I08+q0VOHz0zM8g06rm4HYEwOwL1FbqCvMDsCYHYF6iIvMDsCk/JmB+/Nr3dcv4T1GVJ+TPp=

za/GX8J61T907ofkttP3reoV9IiLmV0qIiIiIiIiIiIiIiIiIiIiIiIipnlk6VU32FnzyKCKd8s=

nSqm+ws+eRcfS1spnU1Xd7hHt0tK3LYzwkd/eB61cuq2UlGJX67AAbknQAeJKo5IXTVLmN/YLv6=

MuNPcLKbRNJszMY5mOBcw53jwzhRK/2GpskkbZ5I5GS52HMznAxxHVxXNdKeedLH9GS4uAacbPg=

slTWVVUGCpqZpgz6vOPLtnwyotJhUlJWPnhfaOQ3c0jjrsepXqasZNAI3t9pugPh4hbjdQXdrQ0=

XCYADAGVL9G1E9W5lRPeufeWuDqV3FpzuP99qr1eglpBBII6wtmI4NDVwGKMBhPENB/T5EFeaav=

khkD3EuHK5Uj1Be7pT3qshirZmRskIa0HcFz/3hvH+oT+1d2waSFxpW3C5VEgEvnNaDvI7XOK6D=

bFpIEtNbA5w4/wDWDd8VTfieE039P2WdzAAS1gOo0Kneq1kv83PlDtRd1tF5oG41lfJXCrqJJgw=

M2do8M7WfuUd1v0jqfBv3KaW9+nbHDKaaspWB+9x58Pc7Hryq8vlc25XWoq2NLWSO80HjgbgtOB=

j1jF5quGMsjy2FxbX2foSveIHs6JkL3Bzr8781oIiLt1QIiIiIpPyZ9ObX4y/hPUYUn5M+nNr8Z=

fwnrVP3Tuh+S20/et6hX0iIuZXSoiIiIiIiIiIiIiIiIiIiIiIiKmeWTpVTfYWfPIsToy3k4+i6=

ztO/9+9ZeWTpVTfYWfPIvvRckV007V2qU4LctPbsu4H1HPsXrGnmKigqP7WPa49PsqBSgPqpY+L=

mkBQFdfSdPT1d9p6aqibJFK17S0/7SfyWjcaKa3VstLO0h8Zx4jqI8V8UVTJRVcNTEfPicHBX1S=

01VK8Qu1c02I8RobqqiPZTDtBsdR81nvVF+z7rVUuMNjkIZvz5vFvwwtJWHcLfRawoY66jmEdWx=

uyQeo/yu/IqMS6Rvkby0UW2BwcyRuD8VVYdjtPJEI6l4ZK3RwcbajrvfdTKrD5WvLom5mHUEa6K=

caffS3fTdPE/D2BgjlYDje3G446t3rC9bQunqTTS2OijoRu23OaXEdzQNyi1n05qWimMlOWUjju=

dtSghw7wM5UnNvv8ANFsTXiKPPExQAH2ria6CCmneYKlhY4kjV12k8RkuL+JV/TySSxt7SIgjTY=

a+9fcelLNDLzsdGGv/AISXOcGntwSR7VWNxgbS3Cpp2ElkUrmNzxwDhWrYLZPa6aSKerdVOe/aD=

3ZyBjhvJVez2mtut+ro6SEvAqHhzzua3zjxKuPRmuLaio7afOxoHtOJt8dlBxWnBjj7OPK4k6D/=

AIuIimg5P58DNwjB6/oz+qf4fzf6jH7o/qug/ifCv9w9x+irfwms/wAPiPqoWimn+H83+ox+6P6=

riXnTVxtRc+SLnaccJo94x3jiFIpsdw+qf2cUoJ5aj52WqXDqmJuZ7Db75LjKT8mfTm1+Mv4T1G=

FJ+TPpza/GX8J6sZ+6d0PyWin71vUK+kRFzK6VERERERERERERERERERERERERUzyydKqb7Cz55=

FFLHdZbRcI6mPe3hIz+dvWFK+WTpVTfYWfPIuNLRU9NouOqdE11RVVA2Xni0DO4ew+1WsskQpo4=

pm5hIQ23W/yAuqVzXmoe9hsW6+5S662yh1VbY6inlaJMZjlA4f0uVb19FUW+qdTVUZjkb1HgR2j=

tC3tPX2oslTtMzJTv/wAyInce8dhVhTU9s1RbGv8Arxu+q8bnxns8e5c22eo9G5eylu+mJ0PFvh=

/zjuOIViY4sUZnZ7Mo3HP7/dVfQV1Vb5xNSzPieOOydx7iOsKcWTW8M5bDcmCB/wD5zfqHxHUov=

ftPVlmkJkHOU5PmytG719hXHV9VYdh2NwiU2dfZw3+/A+5V0VTU0D8m3gdvvorqmdLLSl1HJFzj=

hljnDaafYVArrdtVwVgppA+J7zhggiBD/wDacHK0NM6jntEzYpXOkonHzmcSzvb+iswVNO5kDxK=

zZmxzRz9fIzu9S4eWmf6PTlssLZmOvlJH72txHuKv2StxKO7HlhG4BXK05T3tjOcu1WHgjdDsDa=

Hi4fcsN51NbrM10MDWTVGSTHFgAE8S4jh96w61F5FLt0EmKVo+lbHuk8c9ngoLZrTVXiqEFM0YG=

97z9Vg7SpWGYVTYg12I1j2hnFrfZAt/lb9zzWmrrJaYimgaS7mdT5ffkt6fV96llc9lXzTSdzGs=

bge0ZXjdTageMtrJXDtETT/9VNLXpe020xiRjaipdwdLvyRxw3gst41Fb7JUxU00chc8ZPNtGGt=

zxO9SvxigklEFDRCTloBcDiNCfetfqVS1vaVE5b5n6qI2q+3yur2UjrqYZHj6PbhaQ53UDu3Z37=

1JKfUslLWNt17pTBO7AbJH5zJM7s46vj6l3ZjSRNbUS8y1oIxI4DAJ3Df6/itGSxU819ju0j3SP=

Y3DWHe0HqI+KpZ8UoKwkzU4YzKbZRY5hwBAHnmBsp0dLUQgZJMxvrfa3Qk/Cy4Wt7BQxW+S408b=

YJmObtBow14Jxw6jvyuTyZ9ObX4y/hPWfX158pqhbYXfRQHMhH8T8cPVn2rByZ9ObX4y/hPXa4B=

HUswq9S4kkEi+4bbQfr5qjrnROrh2QsARfrfVX0iItKs0RERERERERERERERERERERERFTPLJ0q=

pvsLPnkXxa6b9uaIfRw4NTTuOy3hvByB6wV98snSqm+ws+eRRzTF6dZa/nCC6nlw2Vo7O3xG9TM=

QpZp6FjqfvGEOb4kcPMXVVHMyOrcJPyu0PmuQ5rmOLXNLXNOCCMEFdPT96nstYJY/OhccSx9Th+=

qml907R3+AV9ulibO8ZDx9SXx7D3qvaykqKKd0FTC+KVvFrh/eV6ocRpMagdC8a7OYdx98+HgVq=

qKWahkD2nTgQrip56e40TJoy2Wnmb1jcQeohRDUGisl1RauJ3mncd3/pP5FcawXjya03O3zSlrJ=

YHOhyfqvxwHju9i6OnNZSQbFLcyZIuDZ+Lm/7u0d/FcrFg2KYVLLJQuuGn8p/uba/mRsdjyVw+t=

pKxjGVAsSN+R+/+qIyxSQyOjlY5kjTgtcMELoy3Z0tggtr9rbgqOcjd2Nwd3jkqxbvZbdfqdsjt=

nbLcx1EWCcdW/rCru+WCts0n0zNuAnzZmDzT49hXQ4ZjlHixayQZZGm9jz8Dx46bqtqqCeju5mr=

SN/DxUg0vrBzXMpLpJlp3MqDxHc79VKp2QWihnkpIoInSO2gHODGuee0qoFN7DWuvGlrjbqk7ck=

EZ2CeJbxbnwI+5VWP4BFE9tVDowubnaNrX3t8x7rKXhuIveDE/VwBynjtstzTVBWvvctyrq2mqH=

mMtAil2y3JHV1Bat70zU3W71FWa+lYx5Aa0uyQAMALn6BmbT1FxmcRiOlL/AGHKi7nF7i5xy4nJ=

PaVMgw6pOIyvjlDSxrWg5Bax1sBfS1lplqovVWBzL3JO/HqrahtrpdPfsuonZKea5oyNG7uPiNy=

+NPWirtERhkrjUQY81hZjYPcc8O5cXk3kcaathftY22u394x+SiMrbj5RKIhV42zjZ2u1UkWDzz=

z1VCZwGghxu0alwvca+z5KwfWxxxxVAjJJBG50t81JeUGztjLbpA3G24MmA7ep35exaPJn05tfj=

L+E9SSkbPctEvjrGPbOIXNPONOSW/VO/uAUb5M+nNr8ZfwnroPR+okdRS0spu6Ilt+Y4ffKyr66=

JoqY5mCwfY+fFX0iIsKeiIiIiIiIiIiIiIiIiIiIiIiIqZ5ZOlVN9hZ88iginfLJ0qpvsLPnkUE=

XR0vct6LnavvnLr2DUFXZZfozzlO4+fC47j3jsKn7DadV24OLBI0cQd0kR/v1FVSt20XOotNY2p=

p3bxuc08HjsKpMZwBtWfWaY5JhsRpfr9f0UyhxEw/ypfaYeHL75Lq3/SdZaw+eHNRSjJ2mjzmD+=

ofmPgo6rjoLpTVttbXtkDIS3aeXHGxjiD4Lhag0lS3Jjqq3lkNQ7zsD/Lk/Q96psK9K3sd6viTb=

EG2a3Hk4fqPdxU2swdrh2lKbje30Uc0lqOS11DaapeXUUhwcn/LPaO7tCsaofTPjbFOYnR1HmNa=

/BD8jOO/cqbqaeaknfBURujlYcOa7iF0Ki8PqLBT22QOL6ebbY/8ApwQB6iVMxn0bjr52VNOct/=

zEdNHDztfmtNDijqeN0Uovba/yXd1Jo10AdVWtrnxje6Di5v8At7fBcHT1wZbqmofKSGSU748AZ=

ySN3xHxUg0xrB0bmUd0ftR8GTni3ud3d6z6308x8T7rRtAc0ZmY3g4fzDv7Vqp62op5PwvFtQ/R=

r+fU8/He+/Ne5II5G+t0e43byUf0/en29lRE50QYaeQR5iaSX43AnGSM9R3LLFq+5R4+honeMAH=

3YUfRdLJhVJJI6R8YJdvoqttbOxoa1xFlY2mdQVFdR19TVRwMjpm7X0TSM7id+/uXLZygVIHnUE=

R8JCPyWKhqbRRacfFK6tDK6TDg3ZD8NxnHdnd28VntEOlKypipoKSrlmed3OZPrODjC5F1DQRST=

zTUrnMvpYaANFidxxv7ldCeoe2NjJQHW1ud7nThyXfp7u6v0tUXGWEQgxyYaDnhkZ9qifJn05tf=

jL+E9dXXNbBQWyGzUgazawXNb/Cwb8esrlcmfTm1+Mv4T1P9HKZrKOeoY3K2QktHJo2/VaMQlLq=

mKMm5ba58eKvpERbFNREREREREREREREREREREREREVM8snSqm+ws+eRQRTvlk6VU32FnzyKCLo=

6XuW9FztX3zkREUhR117NdvIqG40chcYqqBzWgdT8YB9ed/gF5ZNQ11neBE8yQdcLz5vq7FyUUK=

TDqaTtA9gIfa9/AWv1st7aqVmXKbZdlYlTHbdZ28yU7mxV8Q3bX1m9x7W96r6aKSCZ8MrCyRji1=

zTxBCy0FbUW+qZU00hZKw7j1Edh7l2dVPhuEVHeYGbPlLSyZo/hkbj8vuVZQ00mFzimBJhffLfd=

p3y9CL28R75dRK2sjMpFnt38Rz6hR5TjQl750G0VbtsEHmS49WN7PvwoOstLUSUtTFURHD4nBw9=

Sn4rhzMQpnQu34HkeB++Cj0dS6mlDxtx6Ls1+l7m26VMNJRSyQtedh+MNLTvG87lnp9EXeUAvEM=

QPHafkj2LPrK5VIr6aelqpo4aimZI1rXkDf3Lgfta4+nVPvCq2kfitTSsex7G3HFpJvseNt/BSp=

hRxTOa5rjrzFlKYeT+Q45+4tAHUyIn4khSK1WGCzUkraHZdVvbjnphnf1cOruCrT9rXH06p94V0=

LZqy6UMzTJUOqIc+dHJv3dx4hVmJYNjVTEWuqA4b5bZQbcNBr56KVS11DE+4jIPO9/vyWpf6O4U=

lxkNxBM0h2uczkP8D/AHhdXkz6c2vxl/CetzlBuEVTBb4oiCHt5/PXgjA/NafJn05tfjL+E9XuG=

1MlThoklaGmxFhtpcbcNtlCniZFWZWG4uPir6REVarlERERERERERERERERERERERERUzyydKqb=

7Cz55FBW7O0NrOznfjjhTrlk6VU32FnzyKCLo6XuW9FztX3zlZVi5OrTfLXBcKS7VfNSg+a6JoL=

SDgg+sL4qtCaYo6h9PVaqjhmZ9aOR0bXDxBKknJCSdJeFTJ+SrrlI6Z3Dxb8oUSN0r5nR5zYdFM=

kbFHC2TILlSYcl9HW0vP2u/Nnafqu2A5p9bSoHfLNW2K4Poq6MNlaMhzTlrx2g9YU95FG1PPXRw=

DvJdlgOfql+Tw78cfUvnlqfCau2RggztY8kZ3hpIx9y9xzSNqOxcbha5YY3Qdq0WKjuidO2zUs0=

lJNW1NPWMaXhrWAtc3PUe0ZClNfycWi3UoNdqOWmp3P3c7stYXY7zjOFHOSnpnT/APFJ8qm3LC1=

z9OUwa1zj5U3cBn+Fy8TveKgRh2hXuBjDTmQt1C4lHyd2K5FzLfqZtQ9oyRHsPx7Co5q7Rdfppr=

J3vZUUjzsiZgxsnscOpZ+Ta13GbVVHUxU8zYICXSylpa0DBGM9/Yp9ys3Cmp9Ky0Uj2+U1T2CJm=

d+GvDifDAx61kyyRztjzZgVgRRyQF5blIVOVdbLVsp2SbOKeIRMwOodq6+mNIXTUbtumjEVKDh1=

RJubnsA4k+C5VooX3O60lCw4NRK2PP8AKCd59Q3q+7vPBpbSs8lJE1jKSHZiZjdtcB8Stk8vq4E=

cQ1P381qpoe2JkkOgUGl5PNO23ZZdtRmGQjgXxxfNlfTOTayXKFz7Pf3TEDjtMlGe/Zwq0qaiar=

qJKiolfLNIdp73nJcVntdyq7TWx1lFM6KZh4g7nDsI6wvZgmtcSa/BYE8N7GPT4ry5xSU9dNSyT=

8+adxhDwSRhpxuz1Lu8mfTm1+Mv4T1GXuc97nuJc5xySesqTcmfTm1+Mv4T1tmFoXDwPyWmE3ma=

fEK+kRFzS6RERERERERERERERERERERERERUzyydKqb7Cz55FBFO+WXpVTfYWfPIoIujpe5b0XO=

1ffOV18kPRI/aX/cF8VUWkLtrGptldbXG57jzkj3Bkp2QcDDuOO4cF98kPRI/aX/cFXvKFLJBri=

tmieWSMexzXDiCGjBVeyPtKiQA23Vg+Ts6dhIvsrU1LNVaa04+Ww2+m2IAS5mMBjetwA4461Rly=

uFVdK2SsrZnTTyHLnH7gOodyvPQ+pYtTWgOkLBWwgMqI+/+YDsP6hVryjaSNirfLaOM/s2oduA/=

7p38vhxx7F7onCN5jePa5rxWtMjBIw+zyWPkp6Z0/wDxSfKrL5QL/VadtENXSRwyPfMIyJWkjGC=

eo9yrTkp6Z0//ABSfKp1yt01RVaep2U8EszxUtJbGwuONl3YsVIDqpodt+6UxLaVxbuo5b+Vesj=

maK63wPgz53MEtcB3AnBUr1Xo626lonV9KObr3xh8UwccPGMgEcMH81VFs0pfLnO2GC3VDATh0k=

rCxrO8kq86yrpdOWES1EobDSQtYC7i4gYAx2leakMie0wb+C90xfKxwm28VSvJ+RDra2CUYxK5p=

B6nbLgPjhWtymRvl0XcBGDloY447A8E/BUdBWS09xjrosNljmEze5wdkfFfoCz3S3arsZfG5r45=

mFk8WfOYSMEEdS2VwLJGS8AtdEWujfFzX53RS3UOgLzaap/k1PJW0fFksQBOOxzeIPwXMotJX+t=

kDIbVU7zjae3YaPEnCniaMjMHCygGCQHKWlcVSfkz6c2vxl/CeuDc6GW23CooZi0ywPLHFpyMjs=

Xe5M+nNr8ZfwnrExBhcRyPyWYARM0HmFfSIi5pdIiIiIiIiIiIiIiIiIiIiIiIiIoTylaTnv9LD=

V0IDq2mBGwd3OMO/APaOrxKpqrpKmilMVVTywSDcWysLT8V+m1r1tBSV8RirKaGojP8ADIwOHxU=

6nrnRNykXCg1FE2U5gbFUNY9Y3ixUXkdDLE2HbL8OjDjk8d/qXKu1yqbtXy11W5rp5cbRa3A3DH=

BXBc+TGw1e06lE9E87/o3lzfY7Kitw5KLrESaKtpalmOEmY3fmPiFPiqqcnMNCVClpagNynUBQ2=

y3iusdaKugm5uXZLTkZDh2Eda7Fw15fLlRy0dW+mlglbsuaYR/eVhrNEakpM7drlkA64iH/AHFc=

aqoK2k/7VR1EH/LE5v3hSLQyHNoSo95oxl1AWay3arste2uonNbO1paC5u0MEYO5SL/ErUvpFP7=

kKHZHaF7kL0+FjzdwuvDJpGCzTZS53KRqVzSPKYW94hGVH7rebleJRLcKyWocOAcfNb4NG4LRyv=

MjtCNhjYbtaAjppHiziSvVtW641tsqBUUNVLTy/wA0bsZHYRwI7isdNSVNWcU1NNOeyKMu+5dij=

0bqKrwY7TUNaeuQbH3rL3sAs4hYYx5N2grrU/KdqGJobIaWbA4uiwT7CsVbykajqo3MZUQ04PXF=

GAfacrdoOSu9Tlpq6mkpWHjhxkePUBj4qU2zktstOAa2WorHdYLubb/8d/xUF8lGw3sD0Cnsjq3=

6XIVQYqa+pcQJqmokOTjL3uJ6+0lWpyY6OqrZO673OIwzFhZDC4ec0Hi49h6seKnVutNvtcfN0N=

HBTt/oYAT4niVuqLUV5kbkaLBSYKERuzuNyiIir1PRERERERERERERERERERERERERERERERERE=

REWCWkppjmWmhkJ/mYCsBs9rJybbR+4b+i3kWcxHFYsFo/sa1/6bR+4b+izR0NHEcx0sDD/AExg=

LYRMx5pYIiIsLKIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiI=

iIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIi=

IiIiIiIi//2Q=3D=3D" alt style=3D"display:block;border:0;outline:none;text-d=

ecoration:none;-ms-interpolation-mode:bicubic" width=3D"150" height=3D"150"=

>

dding:0;Margin:0;padding-top:20px;padding-left:20px;padding-right:20px">
ble cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" style=3D"mso-table-l=

space:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px"=

>

560px">
esentation" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;border-colla=

pse:collapse;border-spacing:0px">

0;Margin:0;padding-bottom:10px;font-size:0">
0%" height=3D"100%" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentatio=

n" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:colla=

pse;border-spacing:0px">
tr>

px solid #333333;background:unset;height:1px;width:100%;margin:0px">

dding-left:20px;padding-right:20px">
"0" width=3D"100%" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;borde=

r-collapse:collapse;border-spacing:0px">

top" style=3D"padding:0;Margin:0;width:560px">
spacing=3D"0" width=3D"100%" role=3D"presentation" style=3D"mso-table-lspac=

e:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px">
>

it-text-size-adjust:none;-ms-text-size-adjust:none;mso-line-height-rule:exa=

ctly;font-family:arial, 'helvetica neue', helvetica, sans-serif;line-height=

:21px;color:#333333;font-size:14px">root@gallifrey.nk.ca,<=

br>
Account security is a top priority for Royal Bank of Canada. Yo=

ur account has been placed on hold. We sincerely apologize for any difficul=

ties this incident may have caused you.

What this mean for you
>
To regain Full access, all you need to do is login and see if your det=

ails are correct and validate your email on your file, you will be asked to=

answer randomly generated verification question.

What you c=

an do
To complete validation,
href=3D"https://peach-noiseless-zephyr.glitch.me" style=3D"-webkit-text-si=

ze-adjust:none;-ms-text-size-adjust:none;mso-line-height-rule:exactly;text-=

decoration:underline;color:#098ed0;font-size:14px">Login Here To Verify Acc=

ount

Please don't reply directly to this automactically=

generated e-mail message.

Thank You,
We appreciate your bussines=

s.

Royal Bank of Canada Online Customer Care.

<=

br>

" align=3D"center" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;borde=

r-collapse:collapse;border-spacing:0px;table-layout:fixed !important;width:=

100%">

"es-content-body" cellspacing=3D"0" cellpadding=3D"0" bgcolor=3D"#ffffff" a=

lign=3D"center" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;border-c=

ollapse:collapse;border-spacing:0px;background-color:#FFFFFF;width:600px"><=

tr>

left:20px;padding-right:20px">
adding=3D"0" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;border-coll=

apse:collapse;border-spacing:0px">

tyle=3D"padding:0;Margin:0;width:560px">
=3D"0" cellpadding=3D"0" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt=

;border-collapse:collapse;border-spacing:0px">

e=3D"padding:0;Margin:0;display:none">

align=3D"center" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;border=

-collapse:collapse;border-spacing:0px;table-layout:fixed !important;width:1=

00%;background-color:transparent;background-repeat:repeat;background-positi=

on:center top">

class=3D"es-footer-body" cellspacing=3D"0" cellpadding=3D"0" bgcolor=3D"#f=

fffff" align=3D"center" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;=

border-collapse:collapse;border-spacing:0px;background-color:#FFFFFF;width:=

600px">

ttom:20px;padding-left:20px;padding-right:20px">
0" cellpadding=3D"0" align=3D"left" style=3D"mso-table-lspace:0pt;mso-table=

-rspace:0pt;border-collapse:collapse;border-spacing:0px;float:left">
class=3D"es-m-p20b" align=3D"left" style=3D"padding:0;Margin:0;width:270px=

">

ble-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing=

:0px">

-right" cellspacing=3D"0" cellpadding=3D"0" align=3D"right" style=3D"mso-ta=

ble-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing=

:0px;float:right">

270px">
so-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-sp=

acing:0px">

<=

/html>

September '22

Posted by Dave Yadallee on Tuesday, September 27. 2022

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 27 Sep 2022 06:30:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1od9iG-00024A-UB

for dave@doctor.nl2k.ab.ca;

Tue, 27 Sep 2022 06:29:24 -0600

Resent-From: The Doctor

Resent-Date: Tue, 27 Sep 2022 06:29:24 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from dslb-188-104-178-201.188.104.pools.vodafone-ip.de ([188.104.178.201]:50550 helo=zenbis.de)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1od6nV-000DLd-At

for bin@nl2k.ab.ca;

Tue, 27 Sep 2022 03:22:45 -0600

Received: from User ([103.133.111.146]) by zenbis.de with Microsoft SMTPSVC(10.0.17763.1697);

Tue, 27 Sep 2022 11:11:00 +0200

Reply-To:

From: "Mrs. Rachael Adams."

Subject: Attention: Claim/Pyment Update.

Date: Tue, 27 Sep 2022 02:11:01 -0700

MIME-Version: 1.0

Content-Type: text/plain;

charset="Windows-1251"

Content-Transfer-Encoding: 7bit

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Bcc:

Message-ID:

X-OriginalArrivalTime: 27 Sep 2022 09:11:00.0929 (UTC) FILETIME=[0FF46B10:01D8D251]

X-Spam_score: 39.9

X-Spam_score_int: 399

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: BMW LOTTERY DEPARTMENT 5070 WILSHIRE BLVD LOS ANGELES.CA 90036

UNITED STATES OF AMERICA. NOTE: If you received this message in your SPAM/JUNK

folder, that is because of the restrictions implemented by your Internet

Service Provider, we (BMW) urge you to treat it genuinely.

Content analysis details: (39.9 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP

address

[188.104.178.201 listed in dnsbl.sorbs.net]

0.0 NSL_RCVD_FROM_USER Received from User

0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam

1.2 MISSING_HEADERS Missing To: header

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=srvexchtcl01%40transoceanica.com.ec;ip=188.104.178.201;r=doctor.nl2k.ab.ca]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 FROM_MISSP_USER From misspaced, from "User"

1.0 FROM_MISSP_SPF_FAIL No description available.

1.9 REPLYTO_WITHOUT_TO_CC No description available.

3.0 BIGNUM_EMAILS Lots of email addresses/leads

0.0 LOTS_OF_MONEY Huge... sums of money

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

0.8 HK_LOTTO No description available.

0.0 HK_NAME_MR_MRS No description available.

0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool

1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS

0.0 MONEY_FROM_MISSP Lots of money and misspaced From

3.0 BIGNUM_EMAILS_FREEM Lots of email addresses/leads, free email

account

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To

0.0 FROM_MISSPACED From: missing whitespace

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

2.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free

email?

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

2.5 LOTTO_AGENT Claims Agent

0.0 LOTTO_DEPT Claims Department

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

0.0 FILL_THIS_FORM Fill in a form with personal information

2.0 FILL_THIS_FORM_LONG Fill in a form with personal information

2.5 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool

2.2 FILL_THIS_FORM_LOAN Answer loan question(s)

0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)

0.0 MONEY_FORM Lots of money if you fill out a form

1.8 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of

money

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

Subject: {SPAM?} Attention: Claim/Pyment Update.

BMW LOTTERY DEPARTMENT

5070 WILSHIRE BLVD

LOS ANGELES.CA 90036

UNITED STATES OF AMERICA.

NOTE: If you received this message in your SPAM/JUNK folder, that is because of the restrictions implemented by your Internet Service Provider, we (BMW) urge you to treat it genuinely.

Dear Winner,

This is to inform you that you have been selected for a prize of a brand new 2022 Model BMW 7 Series Car and a Cheque of $1,500,000.00 USD from the international balloting programs held on the 2nd section in the UNITED STATE OF AMERICA.

Description of prize vehicle, Model: 530iA Color (exterior): Metallic Silver Mileage: 5 Transmission: Automatic 6 Speed Options: Cold weather package, premium package, fold down rear seats w/ski bag, am fm stereo with single in dash compact disc player.

The selection process was carried out through random selection in our computerized email selection system (ESS) from a database of over 250,000 email addresses drawn from all the continents of the world which you were selected.

The BMW Lottery is approved by the British Gaming Board and also Licensed by the International Association of Gaming Regulators (IAGR). To begin the processing of your prize you are to contact our fiduciary claims agent for more information as regards procedures to the claim of your prize.

Contact Name: Mr.Bray Williams

E-mail Address: bray_williams@aol.com

Contact him by providing him with the below listed information's, also your secret pin code number BMW:255125HGDY03/23.

1. Name In Full :

2. Residential Address :

3. Nationality :

4. Age :

5. Sex

6. Occupation :

7. Direct Phone :

8. Present Country :

9. Email address :

10. pin code Number BMW:255125HGDY03/23

Please you are to provide him with the above listed information's as soon as possible so he can begin with the processing of your prize winnings.

Congratulations again from all our staff and thank you for being part of our promotional program.

Mrs. Rachael Adams.

THE DIRECTOR PROMOTIONS

BMW LOTTERY DEPARTMENT

UNITED STATES OF AMERICA