Domain Name sale spam from Google Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 05 Sep 2023 14:24:20 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qdcW8-000CzE-17

for dave@doctor.nl2k.ab.ca;

Tue, 05 Sep 2023 14:19:20 -0600

Resent-From: The Doctor

Resent-Date: Tue, 5 Sep 2023 14:19:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f68.google.com ([209.85.222.68]:55727)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qdcVJ-000AJX-1o

for sales@nk.ca;

Tue, 05 Sep 2023 14:18:33 -0600

Received: by mail-ua1-f68.google.com with SMTP id a1e0cc1a2514c-7a29ef55d5fso1222052241.3

for ; Tue, 05 Sep 2023 13:16:30 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1693944984; x=1694549784; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=0ACMso6Lf63qA12UtViIy5rQTKs7aeQMppcZ+HGHaf8=;

b=mxkTOJY9+qPdI1yjdgxqNxuQl7IHJPu7/+AYjVCEz8r1DY72H6LPNOxrG2IXlb2/bA

F32oBEHiCB21sxr2bCi+EyjD9pPC8zmmX+sIos+xGEwJ/1saEnrYXumY+RGEOxbh1gcC

CkF0uwo9BFmiPQyJtTbp73+LT8EwXt5J5A2jcpm3qUxqL2xiUj6ZFPlEdwiOGghG6EU2

xb0qyBN/sE7NN1OzptK6SBLnRfa8uX7KzAXusGaduLiVzVenud+n8hFA1PTiyqmZj9yQ

CCq9Dk9dwXavQucEB4qmHgFnlzpEWpcayvOkz/TdYKLiRepMcJqO2IW1U25ASVMxXJHd

PLFQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1693944984; x=1694549784;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=0ACMso6Lf63qA12UtViIy5rQTKs7aeQMppcZ+HGHaf8=;

b=QREIi4Dlcz8bXbz1eMFXg4c9tNtzTJ0KGW6AN/HXR6nPQG65e25FZbwwQ2ILzuLd/x

GtSMPSfMJTI831iLxoz/1T41dERsPqvGNJxW80meRa52caE9gDZXm7tEidFkAGR74mm2

/ywKsXN/OxumY86SY7dcBcsRHoOEISKOPVPCsqjGlxBOFIYN1ZEC8Q/LvHx02aA3KEUZ

q3NSEyp/m5dGMgX7sTPgZpJ5bW7Gof+wNoPCdR5vEgBJVD2UzxUMG4hMHU8IMJWsXaHq

8WQKsJsRDmsT8/PrhXQpU5VSSunLeej5PFdSv5+I6WoBaOuUW0nIDcXBm82rCmHw4Yp1

nTzw==

X-Gm-Message-State: AOJu0Yy8BGfBCly3WlG3HOB3AVvG5mHhnRc0xKMt8mcnFZlO1BOwsuk3

0dOy6BJ5lzjAkaYr3aAI7aSGaWj44SvLRQ5Qb9pBefjtpzI1zg==

X-Google-Smtp-Source: AGHT+IHXH4EC0CL7UCWnmFsbydNuZxBo0eFRoqHpq7lCPLdd8iguIset3XvllT38WJ8bryrQRcH6JLsfFSvA7pDGQ50=

X-Received: by 2002:a67:f954:0:b0:44e:d729:2a04 with SMTP id

u20-20020a67f954000000b0044ed7292a04mr942299vsq.19.1693944983273; Tue, 05 Sep

2023 13:16:23 -0700 (PDT)

Received: from 326440123436 named unknown by gmailapi.google.com with

HTTPREST; Tue, 5 Sep 2023 15:16:22 -0500

MIME-Version: 1.0

From: Sharon Laura

X-Streak-Sequence-Data: action-key=acn_BpjypxpNzTwZ7VUhIQ; recipient-key=rcp_BpjyJZpe3luCTOsFAQ

Date: Tue, 5 Sep 2023 15:16:22 -0500

Message-ID:

Subject: CANADA BROADBAND

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000ff44760604a24ce6"

X-Antivirus: AVG (VPS 230905-4, 9/5/2023), Inbound message

X-Antivirus-Status: Clean



--000000000000ff44760604a24ce6

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,



We are pleased to inform you that the premium website domain,

CanadaBroadband.ca, is now available for sale on GoDaddy's marketplace.



By acquiring this premium domain, your company can enhance its online

presence, attract targeted clients, and establish local authority in Canada=

.



When individuals in Canada search for keywords like Broadband or other

related terms, your company will appear at the top of the search results.



A one-time cost of $599 would make you the owner of the premium domain.



To take ownership, please visit www.CanadaBroadband.ca





Best regards

Sharon Laura

Massive Domains INC

=E1=90=A7



--000000000000ff44760604a24ce6

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,

We are pleased to inform you that the premiu=

m website domain, CanadaBroadband.ca, is now available for sale on GoDaddy&=

#39;s marketplace. =C2=A0

By acquiring this premium domain, your com=

pany can enhance its online presence, attract targeted clients, and establi=

sh local authority in Canada.

When individuals in Canada search for =

keywords like Broadband or other related terms, your company will appear at=

the top of the search results.

A one-time cost of $599 would make y=

ou the owner of the premium domain.

To take ownership, please visit =

www.CanadaBroadband.ca

>
Best regards
Sharon Laura
Massive=C2=A0Domains=C2=A0INC

>

3D""
=3D"width:0px;max-height:0px;overflow:hidden" src=3D"https://mailfoogae.app=

spot.com/t?sender=3Dac2hhcm9ubGF1cmE3NTNAZ21haWwuY29t&type=3Dzeroconten=

t&guid=3D664891a8-ade6-4bad-a0ee-e88096fd0aef">
size=3D"1">=E1=90=A7




--000000000000ff44760604a24ce6--

hinet phish involving payment

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 05 Sep 2023 14:15:04 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qdc76-000Lqy-2F

for dave@doctor.nl2k.ab.ca;

Tue, 05 Sep 2023 13:53:28 -0600

Resent-From: The Doctor

Resent-Date: Tue, 5 Sep 2023 13:53:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 60-249-148-149.hinet-ip.hinet.net ([60.249.148.149]:56598 helo=secure.net)

by doctor.nl2k.ab.ca with esmtp (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qdbWG-000MST-0B

for root@mail.nl2k.ab.ca;

Tue, 05 Sep 2023 13:15:31 -0600

From: Adobe_Share_Payment_Doc

To: root@mail.nl2k.ab.ca

Subject: ** VIRUS ***Merchant/Payroll (Invoice) Payment Document Via Adobe share

Date: 06 Sep 2023 03:13:00 +0800

Message-ID: <20230906031300.B1C1D83ABCA4E797@secure.net>

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_NextPart_000_0012_E2123A9E.CAC34C29"

X-Spam_score: 5.5

X-Spam_score_int: 55

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: You’re all done. Attached is the final agreement for your

reference. You're required to sign EFT Invoice #7801 Payment Approved- Agreement

Attached is the final agreement for your approved EFT Invoice. The document

is encrypted and attached to your email for your safety.



Content analysis details: (5.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[60.249.148.149 listed in bb.barracudacentral.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: cdn.glitch.me]

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 T_HTML_ATTACH HTML attachment to bypass scanning?

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.0 FILL_THIS_FORM Fill in a form with personal information

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

Subject: **
VIRUS ***{SPAM?} Merchant/Payroll (Invoice) Payment Document Via Adobe share

X-Antivirus: AVG (VPS 230905-4, 9/5/2023), Inbound message

X-Antivirus-Status: Infected

X-Attachment: Adobe_Approved_(Invoice)_Payment.html#1246483431 Virus: HTML:Phishing-CJK [Phish] Moved to chest



This is a multi-part message in MIME format.



------=_NextPart_000_0012_E2123A9E.CAC34C29

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable




=3DUTF-8"/>

ss=3D"_xWdq isFirstCard jCu2s" style=3D"PADDING-BOTTOM: 12px; PADDING-TOP: =

0px; PADDING-LEFT: 12px; MARGIN-LEFT: 8px; PADDING-RIGHT: 12px; MARGIN-RIGH=

T: 20px">




dex=3D0 aria-label=3D"Opens Profile Card for Pella Austin" class=3D"undefin=

ed lpc-hoverTarget" data-is-focusable=3D"true" data-lpc-hover-target-id=3D"=

react-target-v2-500">


coin-374">



&=

nbsp;
=




z8y1T GNqVo yxtKT allowTextSelection">














OR: #f0f0f0" cellSpacing=3D16 cellPadding=3D0 border=3D0>












cellSpacing=3D0 cellPadding=3D0 align=3Dcenter border=3D0>





=





















  3D"Adobe
images/emailNextGen/email-adobe-sign-logo.3@2x.png" width=3D165 data-imaget=

ype=3D"External">

R: #ffffff; LINE-HEIGHT: 18px" vAlign=3Dtop width=3D39 align=3Dright>
tyle=3D"DISPLAY: inline-block; BACKGROUND-COLOR: #ff0000" border=3D0 alt=3D=

Adobe src=3D"https://na4.documents.adobe.com/images/emailNextGen/email-adob=

e-tag-classic@2x.png" width=3D39 height=3D64 data-imagetype=3D"External"> <=

/TD>

 











IN-LEFT: auto; DISPLAY: block; MARGIN-RIGHT: auto" alt=3D"" src=3D"https://=

na4.documents.adobe.com/images/emailNextGen/checkmarkCircle@2x.png" data-im=

agetype=3D"External">



f; DISPLAY: none !important; LINE-HEIGHT: 1px; MAX-HEIGHT: 0px; VISIBILITY:=

hidden; opacity: 0">You’re all done. Attached is the final agreement=

for your reference.




GN: center; MARGIN: 0px">You're required to sign

=3Dtrue>EFT Invoice #7801 Payment Approved-  Agreement
>


GN: center; MARGIN: 0px"> 




GN: center; MARGIN: 0px"> 


















 




Attached is the final agreement for your appro=

ved EFT Invoice. The document is encrypted and attached to your email for y=

our safety.



ue>























3D"Powered
4.documents.adobe.com/images/emailNextGen/email-powered-by-adobe-sign-logo.=

3@2x.png" width=3D136 data-imagetype=3D"External">
 


To ensure that you continue receiving our =

emails, please add adobesign@adobesign.com to your address book or safe lis=

t.



© 2022 Adobe. All rights reserved.
>
; BORDER-RIGHT: 0px; BORDER-BOTTOM: 0px; COLOR: #ffffff; BORDER-LEFT: 0px; =

MAX-HEIGHT: 0px; VISIBILITY: hidden; opacity: 0" alt=3D"" src=3D"https://na=

4.documents.adobe.com/track/CBFCIBAA3AAABLblqZhCB1uUYUR8CgHBqPOmnOcTNtFnF9P=

nnh0GOzyn6YBCl8w0p22qLUNcqV0QwA3HxsYg*/blank.gif" data-imagetype=3D"Externa=

l">


V>




 


------=_NextPart_000_0012_E2123A9E.CAC34C29--



pen pal phish from Outlook

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 05 Sep 2023 08:49:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qdX71-0009Nx-35

for dave@doctor.nl2k.ab.ca;

Tue, 05 Sep 2023 08:33:03 -0600

Resent-From: The Doctor

Resent-Date: Tue, 5 Sep 2023 08:33:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-mw2nam04olkn2012.outbound.protection.outlook.com ([40.92.46.12]:46691 helo=NAM04-MW2-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qdW7R-000K51-0c

for www@nl2k.ab.ca;

Tue, 05 Sep 2023 07:29:29 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=lBTfScXvBEukdcqFCAFUvdYa450wJjwrB7hn9o0q9klk0RzRjbYmviGDJnqoxhtKEBE3P+PREzXPNx1nY8rLkSjilcr3ZT0yMIgjxWp3P1LdEL7+aMSi9wSXv8oGzCF3qDa/73Dw3eFk12WLNLxsHnO7IaWOunSrLl+hog/BKFpyhwnMWi7vSNpdjNUwbBCzZDzZgi/llLCZlwEF0/0a2Ojetv5nimBUhR+CM9Y/ZFBPqkrScg4XzR6CR3YNZazqBeO/97jXmWgo++QbmHWw4o7LLBlAVL1GAwcLnP2tj12oxKOppj0IArsoDXOF8juUvy5xTWG/cgf0Ae68XyLAkQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=kTpq0thRu4idZ2cCNlohDcNCHA00ySIYAItFUR4opw4=;

b=UpJDwqfQ9ZHQp2JWEYN2evEv4KEzG3o152d570CMyZLjTERAkdhm3kMlkewlaTe1ZzeXUzS+ptI4im4B6T2pDhgRzw/V2Zn4mT9uzzHLSIcA4+gOn4nX+f+T4HJD//P1UH1HNgcW0FFJSmISUuDfcokYv712aFz4sra9u40unouBnE+xQfLU0wEPY1nrEVZQLt8Tv7DmoD06MN2BGboiwRikcq5sS2e63Z9/gGJCC9sytSZtqJdv0d1Y2koH8EnZesxIXY9guCUT7W22LJI2+GvGO601q2y/WjgyZe/z4bwfqQxDLGQ0k+6Bd2hV98QrstAsWkTYsv0GtJxlMdBvsQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=kTpq0thRu4idZ2cCNlohDcNCHA00ySIYAItFUR4opw4=;

b=FUM4IrL8cd6sOKceYsAGjrLW1VEWc6TdqHuw1Hvh9AOBpU+yhETATCr7K7RBeh2RJ5PHlIN37n3cUglzC0Jzxiso5jKw0fXbICQYiE9jn5AldFNsX16dl+hd99QVs9vK1SAgdXIjFAs87510kkRHhib+nElWRg1PJNTTQD/boP2n8xVFWWxkHieEyj3vaoB+M5AUuid38VQkd+OOP+MPl1WX2bC5+ilyQyClnKNLvHaPEfL1660r/YlDvqW6fyByADv+jkLBGp7Z6fMz393f1e+CNK9TZeUfMtBwmfgrDKxtBWXCWTlUiXeRh0zmiaPnvPC3j5uv6ugkj3/owPeT6Q==

Received: from MW6PR11MB8410.namprd11.prod.outlook.com (2603:10b6:303:249::17)

by SJ2PR11MB8500.namprd11.prod.outlook.com (2603:10b6:a03:574::17) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6745.33; Tue, 5 Sep

2023 13:27:05 +0000

Received: from MW6PR11MB8410.namprd11.prod.outlook.com

([fe80::280b:2a:8172:f1fa]) by MW6PR11MB8410.namprd11.prod.outlook.com

([fe80::280b:2a:8172:f1fa%6]) with mapi id 15.20.6745.030; Tue, 5 Sep 2023

13:27:05 +0000

From: Berit Erik

Subject: Good Morning

Thread-Topic: Good Morning

Thread-Index: AQHZ3/u2ZTgrRKA6uk6V8TGr50lBjQ==

Date: Tue, 5 Sep 2023 13:27:04 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-tmn: [F+FHBk972Wl2kxVzzX1Ppuf8JXQ0CvD6enD/U1N0yFk=]

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: MW6PR11MB8410:EE_|SJ2PR11MB8500:EE_

x-ms-office365-filtering-correlation-id: 4505e732-3b65-4c66-8905-08dbae13cbcc

x-microsoft-antispam: BCL:0;

x-microsoft-antispam-message-info:

ziPr8US0haFyKwrI8pcjnwq6A71pb6wv0hgoQYeIDWK9cIqu8ejO4fIuNVwFj/rSCBad+sTaPCTIehs7sc1HBf0YvyNZCcQqLqfdBACWAB2znO9OwJphccWvzR0EGwpoHx5qM18LOuN904qyIaJK/WN/uPKE/zMnzWfB7/GrWcRnguzOSM83RKjjCaxPEX0E1WQaWGCDLdbrO/aoSwum5otUIPVRLiXyGhMF36goqNOusFccT/Nxz2XqLJ3Aug6OaPIaYL877eacZT6ninUeyavy7z8xinCHA5IekoFs6bHICaPTiaS6R8xkH/sMqqUbftcA7UeMDNGcUTgsbFLhK9EJFDYTF0Y2Gk0FjjJdvydm2Qlyq6lCwHXuyx+zwZXry1rCelbL7Xna96Ol9atR0qcJaWw/3vZv8uzAC6bC+sYWRBRc39+yARL/YU+g5q2xOis5rDoo7ob/rujXZz6BshcGNzrVFgKOwSUgDL3M2i8OVBVpX7xCQCRyXPc3Q7LdcDWxn2aUvydKr1/Q/F2DHZdiBzVPpwLegEuwJz0HJ4yo4TnDWuLCUbzgjhNWxwek

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?09lMhLA5dorIwtsFGSNb0JiPkFOGHyhazCXTW1P5ivH0SNfAeZ4u3mfS1k?=

=?iso-8859-1?Q?OKJHuR558eVetb01Ra8B1m3w2byskNTVRaW9y8ljEBUaITpYGCigViY5//?=

=?iso-8859-1?Q?TsN+U2JiTydrULTXgNWNFfY/YVwVbw7NwZ5hIH/d/PLKoVksjjKlhcKL6M?=

=?iso-8859-1?Q?WTdcQ1qAl4itFV2ShxscEbD1S4EkdTAQY6u+chULpsCca1e0EH/VEPe88T?=

=?iso-8859-1?Q?UNhzcPsjH0JQbrLynbVDv4uuZrb/cHsVgHHHhU5/l52nernGQ51hBs7k06?=

=?iso-8859-1?Q?vXmjTj+n/X9Jef3yScbNYUCW0S1HLJS8WR6wBVomVXPG49eiNNaRZZ67ds?=

=?iso-8859-1?Q?R9dnu/Vtj0aOuvSfPyMYTufR1GtjMWb8w/PBd+UUygYPaDSX+UGR8UFjuj?=

=?iso-8859-1?Q?7emltrXVAy1qWXVJGaDYfsW2kXtpFLqFiOXreZZqs3gVBzKyBRs+655i/p?=

=?iso-8859-1?Q?Q+8ILtxMmWuL2TPTPNtf4N1RM1whlBXuXNz0LuU0/IEuHHgxCfXSg2JJ2k?=

=?iso-8859-1?Q?JyB+w8Qtdk/kPEFLBnPmNrGfe+l4Q/9MkBDf3ldlaoSKI78InAj1cIqqhl?=

=?iso-8859-1?Q?4+Bh0MkpZaspX2G0Px+VGsiVPDWVUOkQAOoG9yo24BCgDsRPHWtU446E/o?=

=?iso-8859-1?Q?mvCF+DSi8yTmcT+xBJJSsUh5FxXbbgjs6NEdaTHU5w2ZNS/rDn9qB0K/v1?=

=?iso-8859-1?Q?c75dksUG3lOWx8EbyFWimheceL19OwR01eaiAvFPjiSeUmYr06byLaY6fJ?=

=?iso-8859-1?Q?1CG5bWQ16/ZfGG6OTKYF6E9liE5fRALAc0NCRZW+aqBgdH7rtYWQ43rWIt?=

=?iso-8859-1?Q?RKgUd8yFy22PeLILcW23UzsMpI0fdMZ8Mn4cDKHtg8E7Y+dv8onqMtObMy?=

=?iso-8859-1?Q?VHTTuqH13Asf02CRuZdmIOezsjFt0JS5pB9UaWSsqe3vcYa1r96FPK/qj6?=

=?iso-8859-1?Q?yETWHn34LIPts8uwnsQ8r+sRM2iz+KNLliMQIyYeptsXzNgVnTqYh0iYWz?=

=?iso-8859-1?Q?ADXBVC4+kV0sqpfsHZo3P9NfFPVKlbDKxdQWRZGZrdXhT3usXPHn7MVYLM?=

=?iso-8859-1?Q?l5sF1wGVemkW7pyC0L6v7y40W1EWvmBXxJfN6kTjdM4GGtL11KsZ9Si+Up?=

=?iso-8859-1?Q?b2/rHZEaXjFZ40bU79CpF8VQJ+t0ddJ21R/nYUXSMjal4Epun8Yls8bkum?=

=?iso-8859-1?Q?v1eZ/UdXI2diqKX/ufeWUyQdJ30tTEVDux4EuQibam2uwSPvp126uX/77b?=

=?iso-8859-1?Q?7inwCIWsYtuXkt1SU5uQ=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_MW6PR11MB84105171953CF4E44440AFD7A1E8AMW6PR11MB8410namp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: MW6PR11MB8410.namprd11.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 4505e732-3b65-4c66-8905-08dbae13cbcc

X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Sep 2023 13:27:04.9424

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR11MB8500

X-Antivirus: AVG (VPS 230905-4, 9/5/2023), Inbound message

X-Antivirus-Status: Clean



--_000_MW6PR11MB84105171953CF4E44440AFD7A1E8AMW6PR11MB8410namp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable







Hi



I hope that you are at your best and doing well. The purpose of this letter=

is seeking for a pen pal like friendship and I'd love to and be honored to=

be friends with you if you do not mind.. If the Idea sounds OK with you, j=

ust say yes and we can take it on from there. I look forward to hear hearin=

g from you.. My name is Berit From Sweden 36 years , this will mean a lot t=

o me to hear back from you.



Warm Regards

Berit



--_000_MW6PR11MB84105171953CF4E44440AFD7A1E8AMW6PR11MB8410namp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">









Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">











: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class=

=3D"ContentPasted0">

Hi






I hope that you are at your best and doing we=

ll. The purpose of this letter is seeking for a pen pal like friendship and=

I'd love to and be honored to be friends with you if you do not mind.. If =

the Idea sounds OK with you, just

say yes and we can take it on from there. I look forward to hear hearing f=

rom you.. My name is Berit From Sweden 36 years , this will mean a lot to m=

e to hear back from you.







Warm Regards


Berit
















--_000_MW6PR11MB84105171953CF4E44440AFD7A1E8AMW6PR11MB8410namp_--

More link spam from Gmail

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Tue, 05 Sep 2023 02:37:01 -0600

Received: from mail-ed1-f68.google.com ([209.85.208.68]:44497)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qdRFG-0004x0-1d

for dave@nk.ca;

Tue, 05 Sep 2023 02:17:14 -0600

Received: by mail-ed1-f68.google.com with SMTP id 4fb4d7f45d1cf-52a1ce529fdso2918824a12.1

for ; Tue, 05 Sep 2023 01:15:11 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1693901705; x=1694506505; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=f9oe21VYhfiCldKIAQGYcwCNVicktMETQk+tKzmdWQo=;

b=VlDuxHfSeWEgafGpPTPZymW8KgTfVhhh9TvE9JnF01NcDBytsJYhZlJ2zpRHAOX0qf

kbFVU8vHunUx9zpt7EvL5rhTinxz2xKj57CclY1XP5Df6pNbxZ0sLkbha94NWvcVIbIu

rI6xe547exzNNHDFf1cZQSqzcpzKTthapopLvJULv8T1u/8aJxj9wDqD87X9x+Ypobvv

ycI/Wiyyqjyx8UZ0oBO57w1lRBihJ4o4D2NUU4HT4ZhJOdsFJYrpnf1T7WFpM2QFFFNg

+ZFdF/gTHSBgd7Xn5MZvgiDW1c+zdw1IQj/A47Dgoj/6O9cCGVV6QOqq7YnhaF/56VEj

fcKw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1693901705; x=1694506505;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=f9oe21VYhfiCldKIAQGYcwCNVicktMETQk+tKzmdWQo=;

b=h07xet92SYH8HhyoCsOLWNim8YgsybNPIzCNM3mgbS2nLVwgj8MftxVEib8sbPQXN2

QkBPX9Tv5W3d4WYYtzH8WsNkBnOuA4Bw4M4TYW16odewJqhu8X5dSeZAgqMELjFC+1Fg

9WRunBugAz9zKITJ/uaMYJYaQ3oooOvjg5orUVjXgTqOWUiuZFZ4lHPNpHGW0A1rTTDN

H8YH+qXs+mE0kocC8K9LFwf0m9U7Q/rYifZu8nhxgM3GvSHMcCBTMdO4ocwD0/STiW+x

I3j15ZPCnNK8aa1XFdVu0sUZr8V5z0xIcFvcQ+E+GhRrnhJ+IlySMzCXVAfbb9i2OBbw

uWgg==

X-Gm-Message-State: AOJu0YziqPp0MHEbfIUwLR9bGUgPyA6Z6Hu2T68Pzm4o6J/ExE7UjNy2

IYGtdY8MepD0ZH3te5DWEVcKL7nf0yF532bys93ZHBwkaTj90XrP

X-Google-Smtp-Source: AGHT+IF2ZMSCTZ8pTXsV2cJzBLSZVVgWgpd1tMrUmGF+y7J+o7+PmgfFxhVL7+30qSCmmpvMC/conjH5huALeyWDzzE=

X-Received: by 2002:a05:6402:1c90:b0:52d:212d:78ed with SMTP id

cy16-20020a0564021c9000b0052d212d78edmr4982325edb.29.1693901705357; Tue, 05

Sep 2023 01:15:05 -0700 (PDT)

MIME-Version: 1.0

From: Herr Gomez Rodrigo

Date: Tue, 5 Sep 2023 08:14:58 +0000

Message-ID:

Subject:

To: dashwilson2003 , dave , dave

Content-Type: multipart/alternative; boundary="0000000000006eae00060498391c"

X-Spam_score: 6.7

X-Spam_score_int: 67

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: http://ipdlCzVVdK.llcion.cc/34546de4235m342356?affsub2=ONTMfUh&st=9/5/2023

1:14:58 AM http://ipdlCzVVdK.llcion.cc/34546de4235m342356?affsub2=ONTMfUh&st=9/5/2023

1:14:58 AM



Content analysis details: (6.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: ipdlczvvdk.llcion.cc]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: llcion.cc]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: llcion.cc]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.68 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[uncutneed2(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[uncutneed2(at)gmail.com]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 TVD_SPACE_RATIO No description available.

-0.0 T_SCC_BODY_TEXT_LINE No description available.

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.68 listed in wl.mailspike.net]

Subject: {SPAM?}

X-Antivirus: AVG (VPS 230905-4, 9/5/2023), Inbound message

X-Antivirus-Status: Clean



--0000000000006eae00060498391c

Content-Type: text/plain; charset="UTF-8"



http://ipdlCzVVdK.llcion.cc/34546de4235m342356?affsub2=ONTMfUh&st=9/5/2023

1:14:58 AM



--0000000000006eae00060498391c

Content-Type: text/html; charset="UTF-8"



http://ipdlCzVVdK.llcion.cc/34546de4235m342356?affsub2=ONTMfUh&st=9/5/2023 1:14:58 AM



--0000000000006eae00060498391c--

More link spam from Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 05 Sep 2023 07:25:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qdVlr-0005wE-1S

for dave@doctor.nl2k.ab.ca;

Tue, 05 Sep 2023 07:07:07 -0600

Resent-From: The Doctor

Resent-Date: Tue, 5 Sep 2023 07:07:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oi1-f194.google.com ([209.85.167.194]:47411)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qdRFK-0004xA-0F

for doctor@nl2k.ab.ca;

Tue, 05 Sep 2023 02:17:17 -0600

Received: by mail-oi1-f194.google.com with SMTP id 5614622812f47-3a9f88b663cso1645613b6e.3

for ; Tue, 05 Sep 2023 01:15:14 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1693901709; x=1694506509; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=1UdBNb3OnWLhEnFBxuXO5iU6xWmhgzSg3q+KMgzkDII=;

b=L0Z58L6YH9KIZ1OfcRr8/xy6yzLkT/rkQesH/ynyiKwy23/RC7KnH6qdurfwXGvgSi

bRxXB7TgNZ0vRH0f00kmfckkl7MIyq0/aTLmf13X7VzQl6C0M/6eQOVrGVwPLEpDUKcS

gprB84hAyDf4dlVW7YjDjD+fbipPV6+AgGpGtd6JnRNhitJCTCxmv1qfy3clGFH0Kvnw

9vhSdM3fVYzADduo+qc8Bw1tTF2l92EiV/X8/yAKHhpAfnn6gdrcza5t4GaiWi3Dw6ON

vrycX3Ttl9MII+MKNIgRBwJnL869BBPfdTHDbbqApV1OckoGgAuD2petTiiyL8Ik+Pog

nupw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1693901709; x=1694506509;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=1UdBNb3OnWLhEnFBxuXO5iU6xWmhgzSg3q+KMgzkDII=;

b=KTUNxakavEvCWmr0fFAKKIoEOmMDnM4sbQZEn1FwTpnjJAJ6P7V3A/XME3ERpOSVNI

TZI+X9h4KHaqCJHhr1fPlJW8O/RP/haW61SYL11FErUU/5R6mCZXPpTuSXfYcjEGBNUf

2qQDWMm/nAU/dcbG7vuZ9F9iJRI8j+wo14ULBAhRaqGcUrWE9PjIB27qnMHPCxqwY8D3

ktRqZAHX+uyKp32oyfN8Q2M3ticCo9t2yZuxqvX7/0wVKuKfZ/GGJETQ0duvmbTORWKe

sK7wiiFddreVOJXME1RsneI/sYY8J8+4Ut7yWVq7D0BMgcs+gb1b9jPpJphCenaNIxDy

RYcg==

X-Gm-Message-State: AOJu0Yyy0H6RUPW00GwqPotZ2TzmGyXiTfeGBS1RkkOVbdFqnewv+Ztb

2z7z4+tZQr/0kzwVXYBP+7G4yXNVVGTRGR+UhUXlTOiFbi5wja2x

X-Google-Smtp-Source: AGHT+IGZlPy4BSXzh8lOWpxdVjX9Izgjj05nlMQFp/Qc2meT9Up/Gk6jjvOv0QDTlpICrJfjigAP56kgPHh/SmCg7XU=

X-Received: by 2002:a54:448a:0:b0:3a7:1478:50a0 with SMTP id

v10-20020a54448a000000b003a7147850a0mr12708709oiv.46.1693901708766; Tue, 05

Sep 2023 01:15:08 -0700 (PDT)

MIME-Version: 1.0

From: MONICA DAN

Date: Tue, 5 Sep 2023 08:15:01 +0000

Message-ID:

Subject:

To: doctor , doug ,

drdexterhiggins

Content-Type: multipart/alternative; boundary="000000000000a2b1610604983911"

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: http://0D8v.llcion.cc/34546de4235m342356?affsub2=UCLvsGrfU&st=9/5/2023

1:15:01 AM http://0D8v.llcion.cc/34546de4235m342356?affsub2=UCLvsGrfU&st=9/5/2023

1:15:01 AM



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: llcion.cc]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: llcion.cc]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: 0d8v.llcion.cc]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.194 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[gaaferich(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.194 listed in wl.mailspike.net]

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 TVD_SPACE_RATIO No description available.

Subject: {SPAM?}

X-Antivirus: AVG (VPS 230905-4, 9/5/2023), Inbound message

X-Antivirus-Status: Clean



--000000000000a2b1610604983911

Content-Type: text/plain; charset="UTF-8"



http://0D8v.llcion.cc/34546de4235m342356?affsub2=UCLvsGrfU&st=9/5/2023

1:15:01 AM



--000000000000a2b1610604983911

Content-Type: text/html; charset="UTF-8"



http://0D8v.llcion.cc/34546de4235m342356?affsub2=UCLvsGrfU&st=9/5/2023 1:15:01 AM



--000000000000a2b1610604983911--

link spam from Google Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 05 Sep 2023 07:17:06 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96 (FreeBSD))

(envelope-from )

id 1qdVlk-0005SR-06

for dave@doctor.nl2k.ab.ca;

Tue, 05 Sep 2023 07:07:00 -0600

Resent-From: The Doctor

Resent-Date: Tue, 5 Sep 2023 07:06:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f194.google.com ([209.85.128.194]:61782)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96 (FreeBSD))

(envelope-from )

id 1qdR9F-0001LP-0X

for doctor@doctor.nl2k.ab.ca;

Tue, 05 Sep 2023 02:11:01 -0600

Received: by mail-yw1-f194.google.com with SMTP id 00721157ae682-59234aaca15so22015877b3.3

for ; Tue, 05 Sep 2023 01:08:57 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20221208; t=1693901332; x=1694506132; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=Z2e6mdRATa9rHPTSo/CA6rZ8VSvwx3Fat4bA2Q1KvZY=;

b=oHes76vz/CZgpIffbfTuf8tkxUc0PXtIK+Yw0Xc994kf6sldrUsr84jh8atHqw+dBw

NCVxIHymQXvrL5BtBv5nOIZAAUDjCUJ97B5EPjenbGHqAfOF8JDurtO0Q1ubpnXWq/hK

s8ewGjVsgMjhqHY+G9Omes8cx9ZUbJ7yrwFexH5JpF2yQvVL3wHVjghWnmOSY41UmuWr

yJWwwplqvb84jZ2+2UKIZMkBMLyM7BgHWp64jL/d3sB9XyAJ9cd0lUCyRly8+al/2vma

jj+btUf+6iAeX1nLbAP19IRAdAjGBpLnPZhedM/YD7mPoOIer7X//ZpB9DfMXRtBKMcB

r64w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20221208; t=1693901332; x=1694506132;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=Z2e6mdRATa9rHPTSo/CA6rZ8VSvwx3Fat4bA2Q1KvZY=;

b=Y2+/LqUP29zMLnkKVII/tp4xGvLvB2gR9ybSgAoEshJr3QKpWAy0nHRIkq5HxmTOnp

WrLiAVspFSmvFDNMNnMCJOiYFw5L6ZVgJX4uF5tWCgzC6TiC9A/OgbxwCrG/Csj2YNb8

B0jD4Px5hFzVQQ0bnQNBQSjpTGxzPVa8e5zeTSYqBCYTF8W2V1h+kTbB/IMnuC1rOULR

4Ju6dZE6m/XeQT96JDFu9agrwMRxMsh5poG/MibkHdPNXaCmvkTjioNI6F1U0u37UgVb

CZ2VDR8/7aexSbUpyaahxgE8h8am9aDK2O8QQ+LK8co/x47fjM87ieL1a3XzD+LSEdap

Z2xg==

X-Gm-Message-State: AOJu0Yxvl1cHgD7a0AiwWIbpxdxcFjYa9AoOsZcJ/PVAHZcb6W617e85

5sL+IfjZZcDZ7/tQSV/impzQ7FnsnkJ5ctWrZiQ=

X-Google-Smtp-Source: AGHT+IHyCoRNlfJGPe06WB/tchoA9pKeSizwO3Ib7M/ViOECDbzkJmS3xgqPA7SYy7cBFa26TmDnVaRtFOCBP1SSPPU=

X-Received: by 2002:a81:6d57:0:b0:583:d722:9ae9 with SMTP id

i84-20020a816d57000000b00583d7229ae9mr13989731ywc.41.1693901331805; Tue, 05

Sep 2023 01:08:51 -0700 (PDT)

MIME-Version: 1.0

From: LOAN OFFER

Date: Tue, 5 Sep 2023 08:08:45 +0000

Message-ID:

Subject:

To: ctetley , c degagne ,

doctor

Content-Type: multipart/alternative; boundary="0000000000002aba2c060498235f"

X-Spam_score: 6.2

X-Spam_score_int: 62

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: http://Wi.llcion.cc/34546de4235m342356?affsub2=jlYrmSK&st=9/5/2023

1:08:44 AM http://Wi.llcion.cc/34546de4235m342356?affsub2=jlYrmSK&st=9/5/2023

1:08:44 AM



Content analysis details: (6.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: wi.llcion.cc]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: llcion.cc]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: llcion.cc]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[ithottt12(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ithottt12(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.194 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.194 listed in list.dnswl.org]

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 TVD_SPACE_RATIO No description available.

Subject: {SPAM?}

X-Antivirus: AVG (VPS 230905-4, 9/5/2023), Inbound message

X-Antivirus-Status: Clean



--0000000000002aba2c060498235f

Content-Type: text/plain; charset="UTF-8"



http://Wi.llcion.cc/34546de4235m342356?affsub2=jlYrmSK&st=9/5/2023 1:08:44

AM



--0000000000002aba2c060498235f

Content-Type: text/html; charset="UTF-8"



http://Wi.llcion.cc/34546de4235m342356?affsub2=jlYrmSK&st=9/5/2023 1:08:44 AM



--0000000000002aba2c060498235f--