Phishing for nk.ca credentials from servesis.net

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 23 Oct 2023 16:01:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96.2 (FreeBSD))

(envelope-from )

id 1qv2v7-000AKy-0g

for dave@doctor.nl2k.ab.ca;

Mon, 23 Oct 2023 15:57:09 -0600

Resent-From: The Doctor

Resent-Date: Mon, 23 Oct 2023 15:57:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp-outbound.servesis.net ([176.53.66.210]:48339)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96.2 (FreeBSD))

(envelope-from )

id 1qv2d3-000HMR-0f

for sales@nk.ca;

Mon, 23 Oct 2023 15:38:34 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=tanksan.com.tr; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=Txt0I4XpNAgMCnwAElyZCh5HFEsXyA7NI6WGJhyzlNg=; b=4D8WtvZbPrpdzKpBNhR2yMvWWc

MNT1I9aMJhFPC1+Rs7qVqH3eCE4EVKhCaY6BUhC4O3S9O7cKA5A/jzIzGDpwNlIhPQ3++GQm0EGad

Tp3i4wFpSmhRTv5t/k99ADRTjgj+q3IFnGenj9euTtdDIf1z5FhgX5oKZwdOEDAU7QNE=;

Received: from 64-145-94-3.lax.as54203.net ([64.145.94.3]:51021 helo=r-115-60-62-5.consumer-pool.prcdn.net)

by server.servesis.net with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)

(Exim 4.87)

(envelope-from )

id 1qv2ax-0000ag-Eu

for sales@nk.ca; Tue, 24 Oct 2023 00:36:25 +0300

From: nk.ca

To: sales@nk.ca

Subject: Email Server Notification - Password Expiry 2023

Date: 23 Oct 2023 16:36:18 -0500

Message-ID: <20231023163611.388A673A2A859A17@tanksan.com.tr>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server.servesis.net

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - tanksan.com.tr

X-Get-Message-Sender-Via: server.servesis.net: authenticated_id: tanksan@tanksan.com.tr

X-Authenticated-Sender: server.servesis.net: tanksan@tanksan.com.tr

X-Spam_score: 5.9

X-Spam_score_int: 59

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: New Page 1 nk.ca Server - Password Expired The password to

your mailbox sales@nk.ca time out has expired. System will log you out and

generate a new password exactly at 4 hours from 24/10/2023.



Content analysis details: (5.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain

1.5 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain

1.5 PDS_FRNOM_TODOM_DBL_URL From Name to domain, double URL

Subject: {SPAM?} Email Server Notification - Password Expiry 2023







New Page 1






 
: none; letter-spacing: normal; font-family: Verdana, Geneva, sans-serif; f=

ont-size: 13px; font-style: normal; font-weight: 400; word-spacing: 0px; wh=

ite-space: normal; orphans: 2; widows: 2; background-color: rgb(241, 244, 2=

48); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-tex=

t-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-st=

yle: initial; text-decoration-color: initial;"=20

border=3D"0" cellspacing=3D"0" cellpadding=3D"0">










lpadding=3D"0">










(0, 0, 0);" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">








align: top;">



 



">








adding-left: 10px;">




=3D"0">








er-top-color: rgb(187, 187, 187); border-top-width: 0px; border-top-style: =

solid;">

 








 





lpadding=3D"0">










(0, 0, 0); background-color: rgb(255, 255, 255);" border=3D"0" cellspacing=

=3D"0" cellpadding=3D"0">








op: 0px; padding-bottom: 0px; vertical-align: top;">


">








adding-left: 10px;">




=3D"0">








er-top-color: rgb(187, 187, 187); border-top-width: 0px; border-top-style: =

solid;">

 







">








adding-left: 10px;">




=3D"0">








er-top-color: rgb(187, 187, 187); border-top-width: 0px; border-top-style: =

solid;">

 











lpadding=3D"0">










(0, 0, 0); background-color: rgb(255, 255, 255);" border=3D"0" cellspacing=

=3D"0" cellpadding=3D"0">








op: 0px; padding-bottom: 0px; vertical-align: top;">


">












y: "Trebuchet MS", "Lucida Grande", "Lucida Sans Unicode", "Lucida Sans", T=

ahoma, sans-serif; font-size: 12px;'>











nk.ca Server - Password Expired


 





 



">












y: Lato, Tahoma, Verdana, Segoe, sans-serif; font-size: 12px;">





The password to your  mailbox 
gb(17, 85, 204);" href=3D"mailto:sales@nk.ca" target=3D"_blank">sales@nk.ca=

 time=20

out has expired. System will log you out=20

and generate a new password exactly at=20

 4 hours from 24/10/2023.







           =

;            &n=

bsp;            =

;      

            &nb=

sp;            =

            &nb=

sp;      
188); font-size: 14px;">   =20

           =

;            &n=

bsp;            =

;       


You can continue using your current=20

password. Use the button below to keep=20

using current password.


 





 







lpadding=3D"0">










(0, 0, 0); background-color: rgb(255, 255, 255);" border=3D"0" cellspacing=

=3D"0" cellpadding=3D"0">








adding-top: 0px; padding-bottom: 0px; vertical-align: top; border-top-color=

: rgb(229, 234, 243); border-top-style: solid;">


0">












); border-image: none; color: rgb(255, 255, 255); padding-top: 5px; padding=

-bottom: 5px; font-family: Lato, Tahoma, Verdana, Segoe, sans-serif; displa=

y: block; background-color: rgb(61, 96, 251); text-decoration-line: none;" =

href=3D"https://bafybeiguuovk47lixr6nptc2ikf7eapoltyedkvhuywulpt4xwoy2ym7mi=

=2Eipfs.dweb.link/ipfs.io080823000.html?gixolrvjkasjfmjehgrtoalspunbywsakug=

uwdskgqmgngwdyt#c2FsZXNAbmsuY2E=3D" target=3D"_blank" rel=3D"noopener=20

noreferrer" data-saferedirectreason=3D"1" data-saferedirecturl=3D"https://w=

ww.google.com/url?q=3Dhttps://ipfs.io/ipfs/QmZi9v7NN62iacVHPEBV7kMeYHzJvHpu=

uxz67mJtkM13kA?filename=3D080823.htm?dfunadevhevontmvtoeadtrarsnikzsfsyzyrl=

umxvjmhslhsn#c2FsZXNAbmsuY2E=3D?drhcvrnbdogqsqrueoktxrefjsahxkqaqznxnxliykm=

rhhfnrl%23YWxla3NhbmRyYW1pY2hhbGFrNjdAZ21haWwuY29t&source=3Dgmail&u=

st=3D1695822878954000&usg=3DAOvVaw1dx9xWEdWuHQ_PISuoMMY0">

Keep Current Password



0">












y: Lato, Tahoma, Verdana, Segoe, sans-serif; font-size: 14px;">



           =

;            &n=

bsp;        





        Email is generate=

d by 
, 102); font-family: "Lucida Grande", Verdana, Arial, Helvetica, sans-serif=

; font-size: 11px; font-weight: 700; white-space: nowrap; background-color:=

rgb(249, 249, 249);'> nk.ca  Email Server for 
lor: rgb(17, 85, 204);" href=3D"mailto:sales@nk.ca" target=3D"_blank">sales=

@nk.ca



">








adding-left: 10px;">




=3D"0">








er-top-color: rgb(187, 187, 187); border-top-width: 1px; border-top-style: =

solid;">

 











lpadding=3D"0">










(0, 0, 0);" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">








align: top;">



 



">








adding-left: 10px;">




=3D"0">








er-top-color: rgb(187, 187, 187); border-top-width: 0px; border-top-style: =

solid;">

 








 








web SEO development spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 23 Oct 2023 07:18:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96.2 (FreeBSD))

(envelope-from )

id 1quuoN-00040x-0K

for dave@doctor.nl2k.ab.ca;

Mon, 23 Oct 2023 07:17:39 -0600

Resent-From: The Doctor

Resent-Date: Mon, 23 Oct 2023 07:17:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f193.google.com ([209.85.214.193]:50292)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96.2 (FreeBSD))

(envelope-from )

id 1qus07-0003Gd-1c

for root@nk.ca;

Mon, 23 Oct 2023 04:17:40 -0600

Received: by mail-pl1-f193.google.com with SMTP id d9443c01a7336-1bf55a81eeaso18913805ad.0

for ; Mon, 23 Oct 2023 03:15:37 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=thephpdeveloper-com.20230601.gappssmtp.com; s=20230601; t=1698056131; x=1698660931; darn=nk.ca;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=7xODz99/pmVeqQVZr9reHone3PIJCjZtZlcAF9gF5p8=;

b=KQdtqpCQ+4KBgR90CGTBTNzBLmBB43V3qdA08so7rpUN9q3wtwX4ia05I6ctarL5Hy

3Us3AV7LmtXHRFZxyn6XXUsQZRtOrLi2uYcaXUKBjk00q73wSEc5Vl9CgNqmWgJpTI0j

uP+gTcK5Q8spU6yukzRM5IQJjue8dgo3mhPimeo4Y0oIIVQCuSz/8f1WnnEDz/h0c9LL

Mj6UfQVGRAnZWJs0qDEd+kZKG3C6rGrx8yji3DTb5nmNX2IzJG/E1VPTKcnjhlLWICmO

sjyMXEv05j1Zr1lvgwPlDBlkxwkikhU8JZFw8DeMzwQoGIt7rY+sX1m4BUreWHdotY2I

DDaw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1698056131; x=1698660931;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=7xODz99/pmVeqQVZr9reHone3PIJCjZtZlcAF9gF5p8=;

b=c7fk0EfsBaIoO5nWSqkQQgDo4eKipgHWWFC6my2obDTAjLLnZHBwLGvWou84MWFsyi

moh7KXhOtEL9dGQm5blA2BVCzLqTeJr76M8+jZj7T7KbZqaBm1JJbHFVd8eWNXKPJ4Hn

21s+HklsAx5EZJlbLZGwhWlKxX3njLUFIjpEIsN396Rr1lynKktkYlkkRhwjJ29fc8FW

lkUhUh7dR6qFIjjTCXyoC3zwHkmzVH476/O+zlp4sr31t70ukZ9C7WxajnP5tYuY9viZ

FC7xtQSehdXxkYxLTW3zt1/ZYooIokqQhlW5Ev3RMPYbhsqCF/WXdhkawe6cB3aHdExJ

LczA==

X-Gm-Message-State: AOJu0YxR/IpNx5h2DyfPxDvNl8mvJimnc5ocrKreOTAJAZM/+RRBQKF7

lDnRWn8IOiOHgF7NmDPLtoZle7yjb3SK6aM5dJPFNA==

X-Google-Smtp-Source: AGHT+IHb63mGlDhnJeaJJ5glfwyRtFlaKhmGA15AIwWYivMSvTlsU7OjGFnXxOggJTJWYR6XwbfPRg==

X-Received: by 2002:a17:902:f251:b0:1ca:8b90:1cbd with SMTP id j17-20020a170902f25100b001ca8b901cbdmr5188587plc.0.1698056130864;

Mon, 23 Oct 2023 03:15:30 -0700 (PDT)

Received: from om ([122.161.78.182])

by smtp.gmail.com with ESMTPSA id f11-20020a170902ce8b00b001c5076ae6absm5601477plg.126.2023.10.23.03.15.29

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Mon, 23 Oct 2023 03:15:30 -0700 (PDT)

From: "Sita"

To:

Subject: Web development offers

Date: Mon, 23 Oct 2023 15:35:20 +0530

Message-ID: <206e801da0599$d89639f0$89c2add0$@com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_206E9_01DA05C7.F24E75F0"

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: AdoFemBQPcqAdFOlSPiCD2hhvXuCsw==

Content-Language: en-us

X-Antivirus: AVG (VPS 231023-2, 10/23/2023), Inbound message

X-Antivirus-Status: Clean



This is a multi-part message in MIME format.



------=_NextPart_000_206E9_01DA05C7.F24E75F0

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,







I'm web developer who builds amazing looking websites for your businesses.

I'd like to have the chance to show you how I can improve for your business.







I'm an expert in the Word Press website platform and many other platforms

and shopping carts.







I can upgrade your existing website or build you a new one completely that

has all of the modern features and functionality.







If you are interested, please let know.







Thanks,







Sita





------=_NextPart_000_206E9_01DA05C7.F24E75F0

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">

class=3DWordSection1>


style=3D'font-size:11.5pt'>Hi,


class=3Dxmsonospacing> 


class=3Dxmsonospacing>I’m web =

developer who builds amazing looking websites for your businesses. =

I’d like to have the chance to show you how I can improve for your =

business.


style=3D'font-size:11.5pt'> 


class=3Dxmsonospacing>I’m an =

expert in the Word Press website platform and many other platforms and =

shopping carts.


style=3D'font-size:11.5pt'> 


class=3Dxmsonospacing>I can upgrade =

your existing website or build you a new one completely that has all of =

the modern features and functionality.


class=3Dxmsonospacing>
style=3D'font-size:11.5pt'> 


class=3Dxmsonospacing>If you are =

interested, please let know.


style=3D'font-size:11.5pt'> 


class=3Dxmsonospacing>
style=3D'font-size:11.5pt'>Thanks,


class=3Dxmsonospacing>
style=3D'font-size:11.5pt'> 


class=3Dxmsonospacing>
style=3D'font-size:11.5pt'>Sita



------=_NextPart_000_206E9_01DA05C7.F24E75F0--



german language gmail spam

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 23 Oct 2023 07:17:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96.2 (FreeBSD))

(envelope-from )

id 1quune-0002Pj-1z

for dave@doctor.nl2k.ab.ca;

Mon, 23 Oct 2023 07:16:54 -0600

Resent-From: The Doctor

Resent-Date: Mon, 23 Oct 2023 07:16:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f50.google.com ([209.85.217.50]:48193)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96.2 (FreeBSD))

(envelope-from )

id 1quqmz-000LMO-00

for doctor@netknow.ca;

Mon, 23 Oct 2023 03:00:01 -0600

Received: by mail-vs1-f50.google.com with SMTP id ada2fe7eead31-457c4e4a392so701442137.0

for ; Mon, 23 Oct 2023 01:57:58 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1698051472; x=1698656272; darn=netknow.ca;

h=to:subject:message-id:date:from:reply-to:in-reply-to:references

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=IFgch/fm/UZEIbvXINH3hOXrKFqFv48qaIz91WZhUDA=;

b=Ivo07V4hyt+eP8tXec2T0Pu6xp/Bz+ly7pYJIe+aNs7pCmNYff97SuWw3uaI4i+ATf

i1/E6x2b38n2eaCCLlxAryJsf4NrhKD64l2rTboAMiOrmpoaP7prpSvXNOjffQ6klsi5

TwUs+7Op0m9nnI6bYDGFIjBhm9mrFzzcXTfnOa0V25T1Cuknrh6wd6yudYzW46N2NBX1

w9eFpoErcI3LnUEU1wnr/iNYb/HGa40qRMbN3IzkrDlQFQvi/8BcBPkgmP2OtpTrf4N3

wB944CIz3q0M5g3p7k69ACtWirJ50u4LS7U9bUUc677PF65YHXT5o9MfAHhrKQcwp+vM

VCxA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1698051472; x=1698656272;

h=to:subject:message-id:date:from:reply-to:in-reply-to:references

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=IFgch/fm/UZEIbvXINH3hOXrKFqFv48qaIz91WZhUDA=;

b=wrYlROydFztLBZyix9wQNXoinUp1FQFbraHayPZaUy5QSgyq4QUYZwLLG6LmyIOu0J

mlcZwP0gzdWcXfE7xtC5FOLD5FZMz8vT35GTLVXDf/8/gMDFQ06v3NE3Pc+dTy2cXKfh

g/I7lexBrYQ5ptwgyOK+3NmzmhgExVnbubF4xXKteF2L2akno8lE/WrBJk7yClBKBsVY

GWBeos/9gdxtGP6iBQ7MlWSwGdo04aOEk9YVVCeqzp21BQli6OjW1o/tjbWYhfBLGRuf

aeTiuR3AXX9f+P6xtXvxngvua3AIa08LD393FB3EDxut36tKWhBb+XnE1ONqNDHDDpSm

yKww==

X-Gm-Message-State: AOJu0YyGsjz539EnmdZe/6AZ/al9hVgBrJiG6tOWG4VbVlAm5jNIf7g8

BW7UBNnwScgFlxWu8LgEV4sZs2dbY0v5QjdbSBo=

X-Google-Smtp-Source: AGHT+IGyvsi9DLH6Z62QWcGySSTgAlBtEniINLAGNWExyuqtdxaPDBBL03wpGDAs7OT5GhBgBga+YSyq/yDMRyPVQVU=

X-Received: by 2002:a67:c190:0:b0:458:8ef9:a27d with SMTP id

h16-20020a67c190000000b004588ef9a27dmr5566143vsj.20.1698051472156; Mon, 23

Oct 2023 01:57:52 -0700 (PDT)

MIME-Version: 1.0

References:































































































































In-Reply-To:

Reply-To: dhldeliverycompanygreece@gmail.com

From: Peter Wilson

Date: Mon, 23 Oct 2023 01:57:37 -0700

Message-ID:

Subject: =?UTF-8?Q?Hallo=2C_mein_lieber_gl=C3=BCcklicher_Gewinner=2E?=

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000ceef6c06085e6a2e"

Bcc: doctor@netknow.ca

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Lieber glücklicher Gewinner. Mit dieser Nachricht möchten

wir Sie darüber informieren, dass Ihre E-Mail-Adresse gewonnen hat Die Summe

von 1.700.000,00 USD beträgt nur {EINE MILLION SIEBENHUNDERTTAUSEND DOLLAR}

in unserem Lott [...]



Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.217.50 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.50 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ekeneomor62(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[ekeneomor62(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.3 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.7 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} =?UTF-8?Q?Hallo=2C_mein_lieber_gl=C3=BCcklicher_Gewinner=2E?=

X-Antivirus: AVG (VPS 231023-2, 10/23/2023), Inbound message

X-Antivirus-Status: Clean



--000000000000ceef6c06085e6a2e

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Lieber gl=C3=BCcklicher Gewinner.



Mit dieser Nachricht m=C3=B6chten wir Sie dar=C3=BCber informieren, dass Ih=

re

E-Mail-Adresse gewonnen hat

Die Summe von 1.700.000,00 USD betr=C3=A4gt nur {EINE MILLION

SIEBENHUNDERTTAUSEND DOLLAR} in unserem Lotterieunternehmen MULTI

LOTTO in diesem Monat und Ihr Geld wird in eine ATM-Visa-Karte

umgewandelt, um Ihnen per Kurierdienst zugestellt zu werden.



Wir haben Ihr Visa-Card-Paket beim Kurierunternehmen hinterlegt und

weisen es an, uns bei der Zustellung Ihres Visa-Card-Pakets zu helfen,

sobald es von Ihnen h=C3=B6rt. Bitte kontaktieren Sie daher das

Zustellunternehmen =C3=BCber diese E-Mail hier {

dhldeliverycompanygreece@gmail.com } und Bitten Sie sie, Ihnen Ihre

ATM-Visa-Karte auszuh=C3=A4ndigen, die bei der Multi Lotto Lottery

Organization in der Verwahrung Ihres Unternehmens hinterlegt ist.



Aufrichtig,

Herr Peter Wilson

Direktor des Multi-Lotto-Unternehmens.



--000000000000ceef6c06085e6a2e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




gmail_quote">
<=

div class=3D"gmail_quote">Lieber gl=C3=BCcklicher Gewinner.





Mit dieser Nachricht m=C3=B6chten wir Sie dar=C3=BCber informieren, dass Ih=

re


E-Mail-Adresse gewonnen hat


Die Summe von 1.700.000,00 USD betr=C3=A4gt nur {EINE MILLION


SIEBENHUNDERTTAUSEND DOLLAR} in unserem Lotterieunternehmen MULTI


LOTTO in diesem Monat und Ihr Geld wird in eine ATM-Visa-Karte


umgewandelt, um Ihnen per Kurierdienst zugestellt zu werden.





Wir haben Ihr Visa-Card-Paket beim Kurierunternehmen hinterlegt und


weisen es an, uns bei der Zustellung Ihres Visa-Card-Pakets zu helfen,


sobald es von Ihnen h=C3=B6rt. Bitte kontaktieren Sie daher das


Zustellunternehmen =C3=BCber diese E-Mail hier {


dhl=

deliverycompanygreece@gmail.com } und Bitten Sie sie, Ihnen Ihre


ATM-Visa-Karte auszuh=C3=A4ndigen, die bei der Multi Lotto Lottery


Organization in der Verwahrung Ihres Unternehmens hinterlegt ist.





Aufrichtig,


Herr Peter Wilson


Direktor des Multi-Lotto-Unternehmens.












--000000000000ceef6c06085e6a2e--

DHL Phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 23 Oct 2023 07:18:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96.2 (FreeBSD))

(envelope-from )

id 1quuo5-0003l1-23

for dave@doctor.nl2k.ab.ca;

Mon, 23 Oct 2023 07:17:21 -0600

Resent-From: The Doctor

Resent-Date: Mon, 23 Oct 2023 07:17:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from rs228.mailgun.us ([209.61.151.228]:46078)

by doctor.nl2k.ab.ca with utf8esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96.2 (FreeBSD))

(envelope-from )

id 1qurC1-000OAq-2z

for root@nk.ca;

Mon, 23 Oct 2023 03:25:56 -0600

DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed;

d=mg.elegantthreadsembroidery.com; q=dns/txt; s=mx; t=1698053019;

x=1698060219; h=Content-Type: Content-Transfer-Encoding: Message-Id: To: To:

From: From: Subject: Subject: Mime-Version: Date: Sender: Sender;

bh=7wn8fHaD3K+mDmAXpa8h8QLfPKNLFpEHA840f/EQ4U8=;

b=V3HtJd19jMnGQ47H/z9Hhe1Pr248HnBC0LhIJBUetOBovUPMrceylNvFW7NuxYLi38JiiYDKrdQv8Gya7+r9bAIV83i/ek8p4dMPvxKzK0vO6mKFNDTh1daMnWuk4MGkYa6IkwulN4OGpK6MVfe7QYHMdzg2hOJG9fEJVMEEPmI=

X-Mailgun-Sending-Ip: 209.61.151.228

X-Mailgun-Sid: WyJlMDRmYSIsInJvb3RAbmsuY2EiLCJhNzE5ZWIiXQ==

Received: from ( []) by 3f5d0cb28bef with HTTP id

65363b9b4a69a73afc76b7dc; Mon, 23 Oct 2023 09:23:39 GMT

Sender: noreply=dhl-ae.com@mg.elegantthreadsembroidery.com

Date: Mon, 23 Oct 2023 09:23:39 +0000

Mime-Version: 1.0

Subject: Import Duty/Tax Payment Alert

From: DHL Express

To: root@nk.ca

Message-Id: <20231023092339.c916a682f967030c@mg.elegantthreadsembroidery.com>

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset="utf-8"

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: English | العربية Payment Request - Import duties

and charges IMPORT DUTY/TAX PAYMENT IS REQUIRED



Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.61.151.228 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.61.151.228 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

3.0 URI_WP_DIRINDEX URI for compromised WordPress site, possible malware

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware

Subject: {SPAM?} Import Duty/Tax Payment Alert

X-Antivirus: AVG (VPS 231023-2, 10/23/2023), Inbound message

X-Antivirus-Status: Clean




ent-Type" content=3D"text/html; charset=3Dutf-8">
=3D"600" border=3D"0" align=3D"center" cellpadding=3D"3" cellspacing=3D"3">=


serif;">English | =D8=A7=D9=

=84=D8=B9=D8=B1=D8=A8=D9=8A=D8=A9

nglish" id=3D"English">Payment Request - Import duties and charg=<br /><br /> es
scale=3D1.0">
=3D"100%">
r>

=3D"background: #ffffff; border: thin solid #ebebeb; width: 600px; font-fam=

ily: Arial, Helvetica, sans-serif; font-size: 12px; text-align: center;" al=

ign=3D"center" bgcolor=3D"#ffffff" cellpadding=3D"0" cellspacing=3D"0" widt=

h=3D"600">
r>

cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">

=3D"https://del.dhl.com/img/email_assets/images/header.jpg" alt=3D"DHL Logo=

" height=3D"114" width=3D"600">

" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">

=3D"28"> 
"0" width=3D"100%">

al, Helvetica, sans-serif; font-size: 20px; margin: 0px; text-transform: up=

percase; font-weight: bold;" align=3D"left" valign=3D"top">

bedby=3D"cke_93" title=3D"Rich Text Editor, MAIN_HEADING" aria-label=3D"Ric=

h Text Editor, MAIN_HEADING" role=3D"textbox" style=3D"position: relative;"=

spellcheck=3D"false" tabindex=3D"0" class=3D"cke_editable cke_editable_inl=

ine cke_contents_ltr cke_show_borders" id=3D"MAIN_HEADING">IMPORT DUTY/TAX =

PAYMENT IS REQUIRED
&n=

bsp;

cing=3D"0" width=3D"100%">
>
 
=3D"left" valign=3D"top">
=3D"0" width=3D"100%">
 

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">

llspacing=3D"0" width=3D"100%">

Helvetica, sans-serif; font-size: 14px;" align=3D"left" valign=3D"top">
aria-describedby=3D"cke_126" title=3D"Rich Text Editor, GREETING" aria-lab=

el=3D"Rich Text Editor, GREETING" role=3D"textbox" style=3D"position: relat=

ive;" spellcheck=3D"false" tabindex=3D"0" class=3D"cke_editable cke_editabl=

e_inline cke_contents_ltr cke_show_borders" id=3D"GREETING">Dear valued cus=

tomer,
 

Arial, Helvetica, sans-serif; font-size: 12px;" align=3D"left" valign=3D"t=

op">

-label=3D"Rich Text Editor, BODY" role=3D"textbox" style=3D"position: relat=

ive;" spellcheck=3D"false" tabindex=3D"0" class=3D"cke_editable cke_editabl=

e_inline cke_contents_ltr cke_show_borders" id=3D"BODY">Your DHL Express sh=

ipment with waybill number 5304121491 from SWEETCARE is arriving in the cou=

ntry. There is import duty/tax due on your shipment. The amount is =

AED 21.00.

We will pay your import duty/tax to the authorit=

ies on your behalf to speed regulatory clearance. To avoid any delivery del=

ay, please pay us this amount securely online now. Click
href=3D"https://del.dhl.com/AE/bspkKeS0i536?locale=3Den-AE" href=3D"https:/=

/emea01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdel.dhl.com%2=

FAE%2FbspkKeS0i536%3Flocale%3Den-AE&data=3D05%7C01%7C%7C8312333f50ca41d=

ac71308dbbbd343d6%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C638310288271=

222164%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6=

Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=3DKOLO5G0eASSRFPeP%2B26Tbe=

j%2B%2FP%2FrkUj%2BfBcy1waveOI%3D&reserved=3D0" originalsrc=3D"https://d=

el.dhl.com/AE/bspkKeS0i536?locale=3Den-AE" shash=3D"rp9fy5xQxY53oqBLbOWzebO=

iRok4+L8QUJz69hHJzm0N2lwWlUsjzUSPz2QUPuzo0R84a6kwXq8UMJpxttSKal/33miOyYnuy5=

YYuns1oiDgX4PEl1vxymGoKILkDHKkfz2VBoHkvp0IJ3034nibMEN/eWcl7eEU0BPB+96apLo=

=3D">here to pay, view the duty/tax calculation and download the releva=

nt documents.

You may track your shipment
https://ducadelcosma.ae/wp-includes/block-patterns/3/" href=3D"https://duca=

delcosma.ae/wp-includes/block-patterns/3/" originalsrc=3D"https://ducadelco=

sma.ae/wp-includes/block-patterns/3/" shash=3D"UdJzXimqNobZRED2RcshweZJTBp3=

c74LihM57d8IxTqfhZWeyfwciDAxfKqJPFIrzCpZU5CJhxmg0V4DvyRHv/F47tIbrXbO7uTRwXJ=

bZXPz1MZwx5D11b02vyZ4zCX1zCW9MsSMH/3dt+lnL73c3BQj2SXnO+hBxea34KuLTvk=3D">he=

re.

" cellspacing=3D"0" width=3D"100%">
>

ody>
 
align=3D"left" valign=3D"top" width=3D"130">
=3D"0" cellspacing=3D"0" width=3D"100%">

_of_prevonblurhandler=3D"null" _of_prevonfocushandler=3D"null" data-cke-sav=

ed-href=3D"https://del.dhl.com/AE/bspkKeS0i536?locale=3Den-AE" href=3D"http=

s://emea01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fdel.dhl.co=

m%2FAE%2FbspkKeS0i536%3Flocale%3Den-AE&data=3D05%7C01%7C%7C8312333f50ca=

41dac71308dbbbd343d6%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C638310288=

271382709%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBT=

iI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=3DkcBbpwbQ0Xn7dN3qliKRK=

pQ2rmp%2BnKQM73FJx2XUmkM%3D&reserved=3D0" originalsrc=3D"https://del.dh=

l.com/AE/bspkKeS0i536?locale=3Den-AE" shash=3D"YKwLgf5j2GS7/WEOFF7pScjHIzgG=

pb3W7sLj6QUNF7Z+V4yP89L9xcjwIcDyQ/SPlRF3GWObrKD7fnebdxJ0nQ21AaKOxpF7SCCd1eM=

M3z/Vq28vj8P1UonrESkaOuATatpaa+2VacxfCyUcPFZ2xH2gTqHHxAf4JCovR6Jnb1U=3D">
mg src=3D"https://del.dhl.com/img/email_assets/images/logo_pay_online.png" =

alt=3D"pay online" height=3D"74" width=3D"74">

=3D"title" style=3D"font-weight: bold; font-family: Arial, Helvetica, sans=

-serif; color: #D60000; font-size: 14px;" align=3D"center">

bedby=3D"cke_489" title=3D"Rich Text Editor, LOGO_TITLE" aria-label=3D"Rich=

Text Editor, LOGO_TITLE" role=3D"textbox" style=3D"position: relative;" sp=

ellcheck=3D"false" tabindex=3D"0" class=3D"cke_editable cke_editable_inline=

cke_contents_ltr cke_show_borders" id=3D"LOGO_TITLE">Duty/Tax Payment
>

llpadding=3D"0" cellspacing=3D"0" width=3D"100%">=

 

" width=3D"100%">

, Helvetica, sans-serif; font-size: 14px; margin-bottom: 0px; margin-top: 5=

px; text-transform: uppercase; font-weight: bold;">

"cke_225" title=3D"Rich Text Editor,SHPDTL_HEADING" aria-label=3D"Rich Text=

Editor, SHPDTL_HEADING" role=3D"textbox" style=3D"position: relative;" spe=

llcheck=3D"false" tabindex=3D"0" class=3D"cke_editable cke_editable_inline =

cke_contents_ltr cke_show_borders" id=3D"SHPDTL_HEADING">SHIPMENT Informati=

on

nt-family: Arial, Helvetica, sans-serif; font-size: 12px; width: 100%" bord=

er=3D"0" cellpadding=3D"5" cellspacing=3D"3" width=3D"100%">

class=3D"bold" style=3D"font-weight: bold" align=3D"left" bgcolor=3D"#F5F5F=

5" valign=3D"top" width=3D"150">

Rich Text Editor, HWB_LABEL" aria-label=3D"Rich Text Editor, HWB_LABEL" rol=

e=3D"textbox" style=3D"position: relative;" spellcheck=3D"false" tabindex=

=3D"0" class=3D"cke_editable cke_editable_inline cke_contents_ltr cke_show_=

borders" id=3D"HWB_LABEL">Waybill No.

=3D"#F5F5F5" valign=3D"top">5304121491

e=3D"font-weight: bold" align=3D"left" bgcolor=3D"#F5F5F5" valign=3D"top"><=

div aria-describedby=3D"cke_291" title=3D"Rich Text Editor, CUSTADDRESS_LAB=

EL" aria-label=3D"Rich Text Editor, CUSTADDRESS_LABEL" role=3D"textbox" sty=

le=3D"position: relative;" spellcheck=3D"false" tabindex=3D"0" class=3D"cke=

_editable cke_editable_inline cke_contents_ltr cke_show_borders" id=3D"CUST=

ADDRESS_LABEL">Address
ign=3D"top">**** tower 14**DUBAI DUBAI

der=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">
>

g=3D"0" width=3D"100%">
 

e border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">

width: 100%">

ditor, SIGNATURE_LINE2" aria-label=3D"Rich Text Editor, SIGNATURE_LINE2" ro=

le=3D"textbox" style=3D"position: relative; font-family: Arial, Helvetica, =

sans-serif; color: rgb(214, 4, 17); background-color: rgb(255, 255, 255);" =

spellcheck=3D"false" tabindex=3D"0" class=3D"cke_editable cke_editable_inli=

ne cke_contents_ltr cke_show_borders" id=3D"SIGNATURE_LINE2">DHL Express - =

Excellence. Simply delivered.

e border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">
 

cellspacing=3D"0" width=3D"100%">=

&nb=

sp;
rif; font-size: 10px; text-align: right" align=3D"right">

dby=3D"cke_522" title=3D"Rich Text Editor, FOOTER_TEXT" aria-label=3D"Rich =

Text Editor, FOOTER_TEXT" role=3D"textbox" style=3D"position: relative;" sp=

ellcheck=3D"false" tabindex=3D"0" class=3D"cke_editable cke_editable_inline=

cke_contents_ltr cke_show_borders" id=3D"FOOTER_TEXT">
ef=3D"http://www.dhl.ae/en/express.html" href=3D"https://emea01.safelinks.p=

rotection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.dhl.ae%2Fen%2Fexpress.html&am=

p;data=3D05%7C01%7C%7C8312333f50ca41dac71308dbbbd343d6%7C84df9e7fe9f640afb4=

35aaaaaaaaaaaa%7C1%7C0%7C638310288271382709%7CUnknown%7CTWFpbGZsb3d8eyJWIjo=

iMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C=

&sdata=3DwJqFxCZyeL7Rj%2FuEIU%2FDynvrvzmH0YSi5vfYaX1NyPM%3D&reserve=

d=3D0" originalsrc=3D"http://www.dhl.ae/en/express.html" shash=3D"ddHF7FV/2=

he2dbq5lcT2ogp0EG099xKT4otgDgiWqitAIr4YQ7mgoEv8BIO42mwcLf8Rgi5kGeldXTh0Mc7M=

6sqUr75OKONO16wW5qullYS2WSsxQXQpItTU0L/S4HEryJMhOrI+nkqGSsuYlVrveXpq/777mqO=

FMIUOW1ADI3g=3D">DHL Express |
=2Eae/en/contact_center/contact_expres=

s.html" href=3D"https://emea01.safelink=

s.protection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.dhl.ae%2Fen%2Fcontact_cent=

er%2Fcontact_express.html&data=3D05%7C01%7C%7C8312333f50ca41dac71308dbb=

bd343d6%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C638310288271382709%7CU=

nknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLC=

JXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=3DKhlazds3luTuPqtpg%2B33rV5bw24cj6PQ=

zzJgzBiAcmw%3D&reserved=3D0" originalsrc=3D"http://www.dhl.ae/en/contac=

t_center/contact_express.html" shash=3D"eIxQxI9tk+MfD5NKTXJrylRnJRMHwQO+o0f=

UwJpgoLMVorztCiEEwICcMeYKMRawtLRCaUAMMAugjHkERElV1bmEbCxC3CP5+mij1whuKzHL1l=

Rf5cPu/9U8gPHOWeeUY0hHp7UbeBoMvvi07NS5vOhtOQ5TsoNdw4297Vl0jpo=3D">Contact D=

HL |
ter/privacy-notice.html" href=3D"https://emea01.safelinks.protection.outloo=

k.com/?url=3Dhttps%3A%2F%2Fwww.logistics.dhl%2Fae-en%2Fhome%2Ffooter%2Fpriv=

acy-notice.html&data=3D05%7C01%7C%7C8312333f50ca41dac71308dbbbd343d6%7C=

84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C638310288271382709%7CUnknown%7CT=

WFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%=

3D%7C3000%7C%7C%7C&sdata=3DG48Ctj2bHBgK2HMT4WctuWzsbPVMAcvOa9QBfYeLBJE%=

3D&reserved=3D0" originalsrc=3D"https://www.logistics.dhl/ae-en/home/fo=

oter/privacy-notice.html" shash=3D"PVLu7pm/eEqh8UIfk9+ceelVKNq+E2wvIn4Aqff4=

yEAau9s43W/jvMIwgGAM2XRZ43sWY7ew9rfTPX1qlWXLzTfS9ih61fEMiBoWfMykxqZqjIq/IOF=

v9YiKTPtK1CbX1Xn5ZANzuDLqKjU8MzNzoA5Imjy9n3GZuvt1QjBbGCc=3D">Privacy Notice=


2023 =C2=A9 DHL International GmbH. All rights reserved.

" width=3D"100%">
 

dth=3D"26"> <=

/tr>
padding=3D"3" cellspacing=3D"3">
e>

spacing=3D"3">

ic">
ale=3D1, maximum-scale=3D1">
scale=3D1.0; maximum-scale=3D1.0; user-scalable=3Dyes;" name=3D"viewport"><=

title>DHL DO RTL
dth=3D"100%" cellpadding=3D"0" cellspacing=3D"0" border=3D"0" id=3D"backgro=

undTable" dir=3D"rtl">

border=3D"0" align=3D"center" cellpadding=3D"3" cellspacing=3D"3">
r>


web SEO development spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 22 Oct 2023 21:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96.2 (FreeBSD))

(envelope-from )

id 1quliF-0005vB-32

for dave@doctor.nl2k.ab.ca;

Sun, 22 Oct 2023 21:34:43 -0600

Resent-From: The Doctor

Resent-Date: Sun, 22 Oct 2023 21:34:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f181.google.com ([209.85.208.181]:60869)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.96.2 (FreeBSD))

(envelope-from )

id 1qulYH-000Gg3-1I

for sales@nk.ca;

Sun, 22 Oct 2023 21:24:29 -0600

Received: by mail-lj1-f181.google.com with SMTP id 38308e7fff4ca-2bfed7c4e6dso41974401fa.1

for ; Sun, 22 Oct 2023 20:22:27 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=webtechresearch-com.20230601.gappssmtp.com; s=20230601; t=1698031340; x=1698636140; darn=nk.ca;

h=to:subject:message-id:date:from:sender:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=fjm5KG5fEWLShVhboy2nLGJOBZeNj/fLYPexBnc8q/8=;

b=H5udMSSQWFrDBhVj8+S5dpW3C8vf1Ru+pyeCtbUEJUwpO4UU2m6ndc1f6nUlIdTae2

xnzjbekfO4q5NYiIWklW8vKbqbWXY/avbYHMbyj0ZjVkCAdF8qDq5n37tlQGdG09oHNL

JwTjJK/mkMcEglulylvSyvI3czvkJybuknU9Ycuq+2cS4YaNlmNAD1c9XonVIUf9P2oh

1xnWnLuhVrHb6YSNkDo2e81xhYjox9m+n9vtbGmX/vCxcryTXeSu95C4dPcX4TKaZcmF

QhNT2hSN64r0Di12J2jHnyE6gx/169Zc/UzYF40XOxhgXh2BZ/EWfv9L9Isr2TwK3IVM

ihHg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1698031340; x=1698636140;

h=to:subject:message-id:date:from:sender:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=fjm5KG5fEWLShVhboy2nLGJOBZeNj/fLYPexBnc8q/8=;

b=j1dhJoumZve34L8A+XwVE9L8B9Bk4yulQw+Wa7w0e0s83daHJqDT53AETzTIZWA5uU

aTgfzBstXNkpuSuiJcSuC8wLrXDRsBbystZ/dzeQWW4nqhys3+6kGnjit99J1NHFEH5z

W6wd8vpui+DavUZpPNhMP+QLs0j8WS72YCMGrFHHnK7UV2Q6eQVB3Op2hZqKaudVXdJ0

W8QJq/5/8F4LbF0jPs+N+JSITSl6/5cM4uEWNRnZVIWYG/0R7vXg6S48Sl13cUkawMhZ

yIHuX/6YXpuK2HXhNdccKVvr77fTUU51QjqFV2aEupEINsAqzj1hEh3muDVPn95Izlcc

5f6w==

X-Gm-Message-State: AOJu0YznNg6V22ETqD5vd5x7B22XTdXF+7wGFC+WrQAtq4g6dovhxEJW

oa0mXJCtB9vyQbnA125VmjBW58/eogXLdK45ofor+QP4WVGfcmSB

X-Google-Smtp-Source: AGHT+IHSIEVnvpVyZdEf94gXJnjCD5Dg8moJV8vdzopyjnLE42pG3OsbW2CpOhsqvRPw0PZj36lAz9ZrlfFkPq3uQ2M=

X-Received: by 2002:a05:651c:1505:b0:2c0:1982:3894 with SMTP id

e5-20020a05651c150500b002c019823894mr7243766ljf.3.1698031339416; Sun, 22 Oct

2023 20:22:19 -0700 (PDT)

Received: from 52669349336 named unknown by gmailapi.google.com with HTTPREST;

Mon, 23 Oct 2023 03:22:19 +0000

Received: from 52669349336 named unknown by gmailapi.google.com with HTTPREST;

Mon, 23 Oct 2023 03:22:18 +0000

MIME-Version: 1.0

Sender: Kristen Brown

From: Kristen Brown

Date: Mon, 23 Oct 2023 03:22:19 +0000

X-Google-Sender-Auth: -6KZctOZnr1DBCqw2bR6XoijjtY

Message-ID:

Subject: Re: nk.ca: 1st Page of Google!!!

To: Sales

Content-Type: multipart/alternative; boundary="000000000000cdc00a060859bab5"

X-Antivirus: AVG (VPS 231022-4, 10/22/2023), Inbound message

X-Antivirus-Status: Clean



--000000000000cdc00a060859bab5

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,



I was going through your website and I found it impressive!!! However, when

I search for your business keywords I see your competitors ranked on 1st

page whereas I am unable to see your website anywhere on the first page of

search engine results.



Your website is great in terms of design and content. However, it doesn=E2=

=80=99t

follow Search Engine Guidelines. So, it has a very low visibility in search

results.



If you are interested then I will send you SEO package and price list.



Kind Regards,







Kristen Brown! Business Development Executive



--------------------------------------------------------

Note: - Our next conversation will be on my corporate Email ID. If this

is something you are interested, please respond to this email. If this is

not your interest, don't worry, we will not email you again.

[image: beacon]



--000000000000cdc00a060859bab5

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




ign:justify;line-height:normal;font-size:11pt;font-family:Calibri,"san=

s-serif"">Hel=

lo,






height:normal;font-size:11pt;font-family:Calibri,"sans-serif"">
pan style=3D"font-family:Arial,"sans-serif"">I was going through =

your website and

I found it impressive!!! However, when I search for your business keywords =

I

see your competitors ranked on 1st page whereas I am unable to see your web=

site

anywhere on the first page of search engine results.






height:normal;font-size:11pt;font-family:Calibri,"sans-serif"">
pan style=3D"font-family:Arial,"sans-serif"">Your website is grea=

t in terms of

design and content. However, it doesn=E2=80=99t follow Search Engine Guidel=

ines. So, it

has a very low visibility in search results.






height:normal;font-size:11pt;font-family:Calibri,"sans-serif"">
pan style=3D"font-family:Arial,"sans-serif"">If you are intereste=

d then I will

send you SEO package and price list.






background-image:initial;background-position:initial;background-size:initia=

l;background-repeat:initial;background-origin:initial;background-clip:initi=

al;font-size:11pt;font-family:Calibri,"sans-serif"">
=3D"font-family:Arial,"sans-serif"">Kind

Regards,






background-image:initial;background-position:initial;background-size:initia=

l;background-repeat:initial;background-origin:initial;background-clip:initi=

al;font-size:11pt;font-family:Calibri,"sans-serif"">
=3D"font-family:Arial,"sans-serif"">=C2=A0






height:106%;font-size:11pt;font-family:Calibri,"sans-serif"">
n style=3D"font-family:Arial,"sans-serif"">Kristen

Brown! Business Development Executive=C2=A0
y:Arial,"sans-serif"">






height:normal;font-size:11pt;font-family:Calibri,"sans-serif"">
pan style=3D"font-family:Arial,"sans-serif"">--------------------=

------------------------------------






ans-serif";color:black">Note:
line-height:115%;font-family:Arial,"sans-serif";color:black">=C2=

=A0- Our next

conversation will be on my corporate Email ID. If this is something you are

interested, please respond to this email. If this is not your interest, don=

't

worry, we will not email you again.



69WtGLqzF8dEKlc32GbRxCiaRMRTWk8xiBI5aiwG1IjsRysrx_Yy9mtICVFCQZ89jOxJCbDz9-H=

KoRfvhyNk-2YLyO0o1_gjx7HbWgMNuu9ds4SIzXGurf3XvlXpraJkYDdOHBAxfvyv_1J17o87Cx=

ww" width=3D"1" height=3D"1" alt=3D"beacon" style=3D"display:none; display:=

none!important;">



--000000000000cdc00a060859bab5--