Money Phish from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Mar 2024 19:45:00 -0600

Received: from mail-ua1-f43.google.com ([209.85.222.43]:42307)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rm239-000000008AB-3eMI

for dave@doctor.nl2k.ab.ca;

Sun, 17 Mar 2024 19:44:32 -0600

Received: by mail-ua1-f43.google.com with SMTP id a1e0cc1a2514c-7e043f577c5so809841241.1

for ; Sun, 17 Mar 2024 18:42:32 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1710726146; x=1711330946; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=/XMJfvIFh3hE2nQIuR3SkLXyBsnuOsH7K8Hr+ejfBaA=;

b=W5hR/6R4gklGcPiQFqs/PMxnomE8fvIsGtDFSl+OZt4OTxybE1FKcvkIv5Su4eqyA3

BuvUS4kSrPWwGAIlJCWH5yDtb+SB8OX+HRZ0UoqimFHWelChXYTsJba11IR3WFMPpcpJ

0QtuRvpcmd6MpzHKXXe9v3xIz71AanG9FU+GrMqhu3mTX/n3VFto87tLWS+OWe1HNpZy

ybuIXzlamNboupzKCP5MOgoIW/Cg2Bn+HwDW53LprOR+GXi04Q6zlysI63hRDfrBcNxT

xY8yem55/wFqMIZo2qJLHQmL8YENQOF+3CMncjk8wqqUai16AbVzA4AHJGFKqqweek2f

3kRQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1710726146; x=1711330946;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=/XMJfvIFh3hE2nQIuR3SkLXyBsnuOsH7K8Hr+ejfBaA=;

b=ehjgLlx/GIc6DxUWRt4KKbLLMJV2fJPQCZk1D8wbpurHaH+EZNtZr6Jh5cZpMkQ7KL

o3eH7e2d4QISbZURiamQBNO7o/m5je0h1M0Lbezs3N3xfwAFrWXpnHFWm/b68223Sfdw

YnoqumAFCaZy9PmwoxUUpGefEae/+2WBSNRV1eqzhq4NkcUQLGI68yoac8jH0wPrc0UV

p9IKMG1iWKcj1qyhUQuT4AovzBWhpXNOa5jcKnY8KKA0tPpiymp9jiKB6DWroOt8diVv

w1eu3qNYjjErD0Bj1L0qpdQKFqWl94cGGF67O4dYygShWINnZQkeV8SeRHbRSjMJtRKk

JHAQ==

X-Forwarded-Encrypted: i=1; AJvYcCVB9TOWLw2FPj011SymOvOqKQl8yt73os2yirSIOAKTSGi8Xwmo8o/hqPU8kPNe5vPC8PWkJ4cRBsmOxIkI+kVDfWULGo5G

X-Gm-Message-State: AOJu0Yzqg3ykv7h1CNaibMvGcelF33jFSLJ1gEt70ZTYWJssMU/eqPR7

VyJuEL6CTEXMPe45Da+VeA1qVKKTo+PlL6Y5ZybVJ+Bpt75XfN0Yxoh2Scg5aIPR5JAibVtRfpX

axhsdDWYKze1Jle5R9XE0Uwix0LY=

X-Google-Smtp-Source: AGHT+IGLNhF2XdSVkvlKpayYeZcc3QYk7wKf46DmBx0jopAO3kivS0xBmNCDRWxJKb2xwymv5IYl5ME+Sym7u55HZtk=

X-Received: by 2002:a05:6102:365:b0:474:c681:9380 with SMTP id

f5-20020a056102036500b00474c6819380mr7227260vsa.15.1710726146041; Sun, 17 Mar

2024 18:42:26 -0700 (PDT)

MIME-Version: 1.0

Reply-To: AdeleElla1@mail.com

From: European Investment Bank

Date: Sun, 17 Mar 2024 18:42:10 -0700

Message-ID:

Subject: European Investment Bank

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000003e312f0613e57868"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 16.5

X-Spam_score_int: 165

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: *Attention: beneficiary of the fund,We have mandated the European

Investment Bank in London and the IMF to investigate the reason for the unnecessary

delay in disbursements authorized by law. During o [...]



Content analysis details: (16.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.43 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.43 listed in wl.mailspike.net]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[adeleella1(at)mail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[michaelstan449(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[michaelstan449(at)gmail.com]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

1.9 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 XFER_LOTSA_MONEY Transfer a lot of money

2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

Subject: {SPAM?} European Investment Bank



--0000000000003e312f0613e57868

Content-Type: text/plain; charset="UTF-8"



Attention: beneficiary of the fund,We have mandated the European

Investment Bank in London and the IMF to investigate the reason for the

unnecessary delay in disbursements authorized by law. During our

investigation, we discovered that your payment was delayed by corrupt bank

officials who tried to divert your money to their personal accounts.To

prevent this suspicious act, we have agreed with the European Investment

Bank in London and the International Monetary Fund (IMF) that we can manage

and monitor this payment. Avoid desperate situations with banks and other

authorities in criminal cases.We have received an irrevocable payment

guarantee for your MFD payment. We hereby inform you that the European

Investment Bank has decided to compensate you in the amount of USD

2,000,000.00 and transfer it to your bank account via bank transfer.please

contact the Corresponding Bank Customer care services, Ms. Adele Ella via

the email belowemail: AdeleElla1@mail.com Be sure to

contact the above bank immediately for final release and transfer of funds.

The European Investment Bank must transfer its funds to your bank account

without delay.I expect your prompt cooperation.Thank you.



--0000000000003e312f0613e57868

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Attention: beneficiary of=

the fund,
We have mandated the European Investment Bank in London and t=

he IMF to investigate the reason for the unnecessary delay in disbursements=

authorized by law. During our investigation, we discovered that your payme=

nt was delayed by corrupt bank officials who tried to divert your money to =

their personal accounts.

To prevent this suspicious act, we have agr=

eed with the European Investment Bank in London and the International Monet=

ary Fund (IMF) that we can manage and monitor this payment. Avoid desperate=

situations with banks and other authorities in criminal cases.

We h=

ave received an irrevocable payment guarantee for your MFD payment. We here=

by inform you that the European Investment Bank has decided to compensate y=

ou in the amount of USD 2,000,000.00 and transfer it to your bank account v=

ia bank transfer.
please contact the Corresponding Bank Customer care se=

rvices, Ms. Adele Ella via the email below
email: =C2=A0
o:AdeleElla1@mail.com">AdeleElla1@mail.com
Be sure to contact the ab=

ove bank immediately for final release and transfer of funds. The European =

Investment Bank must transfer its funds to your bank account without delay.=



I expect your prompt cooperation.

Thank you.
<=

/div>



--0000000000003e312f0613e57868--

Aeroplan Phish from MailGun

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 18 Mar 2024 12:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rmHbS-00000000GRq-1EXw

for dave@doctor.nl2k.ab.ca;

Mon, 18 Mar 2024 12:20:54 -0600

Resent-From: The Doctor

Resent-Date: Mon, 18 Mar 2024 12:20:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from m33-138.mailgun.net ([69.72.33.138]:22492)

by doctor.nl2k.ab.ca with utf8esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rmHUb-00000000G0d-2Vhh

for doctor@nl2k.ab.ca;

Mon, 18 Mar 2024 12:13:53 -0600

DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=mg.findtransfers.com; q=dns/txt; s=k1; t=1710785514; x=1710792714;

h=Content-Transfer-Encoding: Content-Type: MIME-Version: Message-ID: Date: Subject: Subject: To: To: From: From: Sender: Sender: List-Unsubscribe: List-Unsubscribe-Post;

bh=Mdr6/LHBgSEDtwM721/x9Ag5vA4bKLBP9GnUxks6TP4=;

b=ytfAFUZROa9J8zN1DG0hb5ZR1b9ZBaQ2lLrrQ5gCvxT8gAoL0oIsc59zwXhb8gdDxaMiuZ9bISI0xuUMAx2TwvNtnb+o7ErkHZPx7Z7szqSkN+jwLyQ1ydY+N8RCaSlYPJ9M+ydO+iph1lQVn8ZXZ1HrXsBu87Jo0/n7qHaEQ6Q=

X-Mailgun-Sending-Ip: 69.72.33.138

X-Mailgun-Sid: WyIxM2IxZSIsImRvY3RvckBubDJrLmFiLmNhIiwiMmZiNzU2Il0=

List-Unsubscribe-Post: List-Unsubscribe=One-Click

List-Unsubscribe: ,



Received: from mg.findtransfers.com ( [195.135.93.147]) by 6980d5785bf2 with

SMTP id 65f883e9b19633e62142aaa6; Mon, 18 Mar 2024 18:11:53 GMT

Sender: postmaster@mg.findtransfers.com

From: "Aeroplan"

To: doctor@nl2k.ab.ca

Subject: Urgent: Aeroplan Security Upgrade Required On Your Profile

Date: 18 Mar 2024 19:11:53 +0100

Message-ID: <20240318191153.29679F15779DCDD5@mg.findtransfers.com>

MIME-Version: 1.0

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Unsubscribe (this will stop ALL future emails from FindTransfers.com)





Content analysis details: (8.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[69.72.33.138 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.0 MIXED_HREF_CASE Has href in mixed case

2.7 SCC_BODY_URI_ONLY Very short body with something maybe clickable

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

Subject: {SPAM?} Urgent: Aeroplan Security Upgrade Required On Your Profile










56f60c49&p1=3Dt.co/BfgtqnC0Bi">
ro/diada.png">








3D""
fers.com/o/eJwEwEGuhCAMANDTyJK02FK6YPXNv0cBmTEzSoLeP_NaDr0IR7dnFARJzEjunamY=

Au-GXRJZMtNWVkoKlaJ1ju7IAQLBigkVkVcfNIr-I4vo9rdtvBCcL9-Pqz3Trrvv8_Z1nG7mNuo=

z5kJwfcPHW_HVfgEAAP__aT4l7A">

Aeroplan Phish from MailGun

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 18 Mar 2024 12:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rmHb9-00000000GR6-0ptF

for dave@doctor.nl2k.ab.ca;

Mon, 18 Mar 2024 12:20:35 -0600

Resent-From: The Doctor

Resent-Date: Mon, 18 Mar 2024 12:20:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from m33-138.mailgun.net ([69.72.33.138]:42047)

by doctor.nl2k.ab.ca with utf8esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rmHQM-00000000Ffa-2x7f

for doctor@netknow.ca;

Mon, 18 Mar 2024 12:09:30 -0600

DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=mg.findtransfers.com; q=dns/txt; s=k1; t=1710785241; x=1710792441;

h=Content-Transfer-Encoding: Content-Type: MIME-Version: Message-ID: Date: Subject: Subject: To: To: From: From: Sender: Sender: List-Unsubscribe: List-Unsubscribe-Post;

bh=2uviqdYkrMfsA/3pEnnmJnyP1LAYGv2V1E93OwU+ZtY=;

b=yeoCX90+D/UA9c2qTklCOlk1xTRUTGHU3r/GTmmvesWZd6aCBy+z9YG0yQqFW/U/tCsvA3LQ8KNX6E9GAhXmOkhmaCQJDmN//5q6bN3EyuZOHaDMqF7ML51UDsBgyTQNTSWLkN9Vr09VgqQKCsqDsin9Me8DQSJ1aUIkT7EkWhU=

X-Mailgun-Sending-Ip: 69.72.33.138

X-Mailgun-Sid: WyIzYjFmYiIsImRvY3RvckBuZXRrbm93LmNhIiwiMmZiNzU2Il0=

List-Unsubscribe-Post: List-Unsubscribe=One-Click

List-Unsubscribe: ,



Received: from mg.findtransfers.com ( [195.135.93.147]) by 510754b513e7 with

SMTP id 65f882d9059e869fd02bc718; Mon, 18 Mar 2024 18:07:21 GMT

Sender: postmaster@mg.findtransfers.com

From: "Aeroplan"

To: doctor@netknow.ca

Subject: Urgent: Aeroplan Security Upgrade Required On Your Profile

Date: 18 Mar 2024 19:07:20 +0100

Message-ID: <20240318190720.5EC8E747E7B42278@mg.findtransfers.com>

MIME-Version: 1.0

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Unsubscribe (this will stop ALL future emails from FindTransfers.com)





Content analysis details: (8.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[69.72.33.138 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 T_SCC_BODY_TEXT_LINE No description available.

2.0 MIXED_HREF_CASE Has href in mixed case

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

2.7 SCC_BODY_URI_ONLY Very short body with something maybe clickable

Subject: {SPAM?} Urgent: Aeroplan Security Upgrade Required On Your Profile










56f60c49&p1=3Dt.co/BfgtqnC0Bi">
ro/diada.png">








3D""
fers.com/o/eJwEwFEOwiAMANDTjE_SdsV2H_xodhBGQRczSBiJ1_dZpHpIeLgSURBEAzG6T0wF=

NwhZDkIqWouuB4MmNDWrFlZ3RgJiWFFxAyHwYX_pLiy7PJlIdGG43r6ezeZI7a5l3D73y41oPc8=

-FoZW5rf1n8_pHwAA__92Syao">

Canada Post Phish from Cape town South Africa

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Mar 2024 17:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rlzkO-0000000063Y-2Yna

for dave@doctor.nl2k.ab.ca;

Sun, 17 Mar 2024 17:16:56 -0600

Resent-From: The Doctor

Resent-Date: Sun, 17 Mar 2024 17:16:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [41.61.20.84] (port=50282 helo=dmv.ca)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rly3C-000000002hL-1FAC

for sales@nk.ca;

Sun, 17 Mar 2024 15:28:19 -0600

Received: by dmv.ca (Postfix, from userid 33)

id A2A594B6E26; Sun, 17 Mar 2024 21:32:10 +0200 (SAST)

To: sales@nk.ca

Subject: New delivery alert available / Nouvelle notification de livraison disponible

Date: Sun, 17 Mar 2024 21:32:10 +0200

From: Canada Post | Postes Canada

Reply-To: v3.eservicescom@gmail.com

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_f4df0949e23ec05dc4d9619f1eae803e"

Content-Transfer-Encoding: 8bit

X-Spam_score: 16.2

X-Spam_score_int: 162

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear customer, A parcel belonging to you has been declared

by customs. We kindly ask you to pay the taxes and duties of CAD 2.99 in

order to receive your package as soon as possible before it is returned to

sender [...]



Content analysis details: (16.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[41.61.20.84 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[41.61.20.84 listed in bl.score.senderscore.com]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: tt.vg]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: tt.vg]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: tt.vg]

2.5 URIBL_DBL_MALWARE Contains a malware URL listed in the DBL blocklist

[URI: tt.vg]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: tt.vg]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=no_reply%40canadapost-postescanada.ca;ip=41.61.20.84;r=doctor.nl2k.ab.ca]

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_RATIO_08 BODY: HTML has a low ratio of text to image area

-0.0 T_SCC_BODY_TEXT_LINE No description available.

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.1 NORDNS_LOW_CONTRAST No rDNS + hidden text

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} New delivery alert available / Nouvelle notification de livraison disponible



This is a multi-part message in MIME format.



--b1_f4df0949e23ec05dc4d9619f1eae803e

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit































Â

Â













































Dear customer,



A parcel belonging to you has been declared by customs. We kindly ask you to pay the taxes and duties of CAD 2.99 in order to receive your package as soon as possible before it is returned to sender in accordance with our terms and conditions of use.



Receive my package



Once your payment has been made, you will receive a payment confirmation by e-mail and we will call you on your phone number to deliver your parcel according to your availability.











Canada Post protects your security and privacy. We will never ask for your personal information (such as passwords or credit card numbers) by phone call. Please read our Privacy policy.



This message is intended only for the addressee. It may contain proprietary or confidential information. Any unauthorized dissemination, distribution or copying of this message is strictly prohibited. If you have received this message in error, please notify us immediately and delete the original message.

Â



Please don’t reply to this email. We cannot receive or respond to replies to this email. If you have any questions or comments, contact us online or call 1-877-376-1212.







canadapost-postescanada.ca





2701 Riverside Drive, Ottawa ON  K1A 0B1





Accessibility  |   Legal  |   Privacy





© Canada Post CorporationÂ







































Â

Â













































Cher(e) client(e),



Un colis vous appartenant a été déclaré par la douane. Nous vous demandons de bien vouloir vous acquitter des taxes et droits de CAD 2.99 afin de recevoir votre colis dans les meilleurs délais avant qu'il ne soit retourné à l'expéditeur conformément à nos conditions générales d'utilisation.



Recevoir mon colis



Une fois votre paiement effectué, vous recevrez une confirmation de paiement par e-mail et nous vous appellerons sur votre numéro de téléphone pour livrer votre colis selon vos disponibilités.











Postes Canada protège votre sécurité et votre vie privée. Nous ne vous demanderons jamais de renseignements personnels (comme des mots de passe ou des numéros de carte de crédit) par appel téléphonique. Veuillez lire notre politique de confidentialité.



Ce message est réservé à l’attention du destinataire. Il pourrait comporter de l’information exclusive ou confidentielle. Toute distribution, diffusion ou copie non autorisée du présent message est strictement interdite. Si vous avez reçu ce message par erreur, veuillez nous en aviser immédiatement et effacer le message original.

Â



Ne répondez pas à cet e-mail. Nous ne pouvons ni recevoir ni répondre aux réponses à ce courriel. Si vous avez des questions ou des commentaires, contactez-nous en ligne ou appelez le 1-877-376-1212.







canadapost-postescanada.ca





2701 Riverside Drive, Ottawa ON  K1A 0B1





Accessibility  |   Legal  |   Privacy





© Canada Post CorporationÂ

































--b1_f4df0949e23ec05dc4d9619f1eae803e

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable







=09






rial; font-size: 16px; font-weight: 400; word-spacing: normal;">




id=3D"x_x_ENGLISH_VERSION" style=3D"border-width: 0px; margin: 0px auto; p=

adding: 0px; color: rgb(85, 85, 85); font-family: helvetica, arial, verdana=

, sans-serif; font-size: 14px; vertical-align: baseline; border-collapse: c=

ollapse; border-spacing: 0px; transform: scale(1); background-color: rgb(24=

0, 240, 240);" width=3D"100%">

=09
lign: baseline; box-sizing: border-box;">

=09=09
lign: baseline; box-sizing: border-box;">

=09=09=09

=09=09

=09=09
lign: baseline; box-sizing: border-box;">

=09=09=09

=09=09

=09=09
lign: baseline; box-sizing: border-box;">

=09=09=09

=09=09

=09


ing: 0px; color: rgb(51, 51, 51); line-height: 24px; letter-spacing: 0.03em=

; font-family: Roboto, Helvetica, Arial, sans-serif; font-size: 16px; verti=

cal-align: middle; -ms-word-break: break-all; box-sizing: border-box;">

=09=09=09
_x_cpc-header" style=3D"border-width: 0px; margin: 0px auto; padding: 0px; =

vertical-align: baseline; border-collapse: collapse; max-width: 600px; bord=

er-spacing: 0px; transform: scale(1);" width=3D"100%">

=09=09=09=09
ertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09
ertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09

=09=09=09=09=09=09

=09=09=09=09=09

=09=09=09=09

=09=09=09

, 255); border-width: 2px 0px 1px; margin: 0px; padding: 24px; line-height:=

24px; letter-spacing: 0.03em; vertical-align: baseline; border-top-color: =

rgb(202, 38, 26); border-bottom-color: rgb(203, 203, 203); border-top-style=

: solid; border-bottom-style: solid; float: none; position: static; box-siz=

ing: border-box;">3D"Canada
ww.canadapost.ca/cpo/mc/emails/cpc/images/cpc-main-logo-EN@2x.png" style=3D=

"border-width: 0px; margin: 0px; padding: 0px; vertical-align: bottom; max-=

width: 100%; box-sizing: border-box;" width=3D"136" />
notifications.canadapost-postescanada.ca/info5/r/?id=3Dh8bf38d8,8ded733,450=

0553" style=3D"background: 0px 0px; border-width: 0px; margin: 0px; padding=

: 0px; color: rgb(4, 103, 198); box-sizing: border-box; text-decoration-lin=

e: none;" target=3D"_blank" title=3D"https://t.notifications.canadapost-pos=

tescanada.ca/info5/r/?id=3Dh8bf38d8,8ded733,4500553">=C2=A03D"Cana=<br
da Post" height=3D"auto" src=3D"https://www.canadapost.ca/cpo/mc/emails/cpc=

/images/mobile_cpc_logo.png" style=3D"border-width: 0px; margin: 0px; paddi=

ng: 0px; vertical-align: bottom; max-width: 100%; box-sizing: border-box;" =

width=3D"0" />
nd: rgb(255, 255, 255); border-width: 2px 0px 1px; margin: 0px; padding: 24=

px; line-height: 24px; letter-spacing: 0.03em; vertical-align: baseline; bo=

rder-top-color: rgb(202, 38, 26); border-bottom-color: rgb(203, 203, 203); =

border-top-style: solid; border-bottom-style: solid; float: none; position:=

static; box-sizing: border-box;">=C2=A0


=09=09=09

ing: 0px; color: rgb(51, 51, 51); line-height: 24px; letter-spacing: 0.03em=

; font-family: Roboto, Helvetica, Arial, sans-serif; font-size: 16px; verti=

cal-align: middle; -ms-word-break: break-all; box-sizing: border-box;">

=09=09=09
_x_cpc-banner" style=3D"border-width: 0px; margin: 0px auto; padding: 0px; =

vertical-align: baseline; border-collapse: collapse; max-width: 600px; bord=

er-spacing: 0px; transform: scale(1);" width=3D"100%">

=09=09=09=09
ertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09
ertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09

=09=09=09=09=09

=09=09=09=09

=09=09=09

n: 0px; padding: 0px; line-height: 24px; letter-spacing: 0.03em; vertical-a=

lign: middle; box-sizing: border-box;">3D""
adapost.ca/cpo/mc/emails/cpc/images/Chevrons_Image_600x125@2x_Opt2.png" sty=

le=3D"border-width: 0px; margin: 0px; padding: 0px; vertical-align: middle;=

max-width: 100%; box-sizing: border-box;" width=3D"600" />


=09=09=09

ing: 0px; color: rgb(51, 51, 51); line-height: 24px; letter-spacing: 0.03em=

; font-family: Roboto, Helvetica, Arial, sans-serif; font-size: 16px; verti=

cal-align: middle; -ms-word-break: break-all; box-sizing: border-box;">

=09=09=09
_x_cpc-main" style=3D"border-width: 0px; margin: 0px auto; padding: 0px; ve=

rtical-align: baseline; border-collapse: collapse; max-width: 600px; border=

-spacing: 0px; transform: scale(1);" width=3D"100%">

=09=09=09=09
ertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09
ertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09

=09=09=09=09=09

=09=09=09=09

=09=09=09

n: 0px; padding: 48px 24px 64px; line-height: 24px; letter-spacing: 0.03em;=

vertical-align: middle; box-sizing: border-box;">

=09=09=09=09=09=09


amily: tahoma,geneva,sans-serif;">Dear customer,





=09=09=09=09=09=09


amily: tahoma,geneva,sans-serif;">A parcel belonging to you has been declar=

ed by customs.
=3D"font-family: tahoma,geneva,sans-serif;">We kindly ask you to pay the ta=

xes and duties of=

=C2=A0CAD 2.99
s-serif;">=C2=A0in order to receive your package as soon as possible before=

it is returned to sender=C2=A0in accordance with our terms and cond=

itions of use.





=09=09=09=09=09=09


ps://tt.vg/YpEaj" style=3D"background: rgb(0, 74, 142); border-width: 15px =

60px; border-style: solid; border-color: rgb(0, 74, 142); border-radius: 30=

px; width: auto; text-align: center; color: rgb(22, 51, 0); line-height: 19=

px; letter-spacing: 0px; font-family: InterRegular, Helvetica, Arial, sans-=

serif; font-size: 16px; font-weight: bold; display: block; text-decoration-=

line: none;" target=3D"_blank"><=

strong>Receive my package





=09=09=09=09=09=09


amily: tahoma,geneva,sans-serif;">
tter-spacing: 0px; background-color: rgb(255, 255, 255);">Once your payment=

has been made, you will receive a payment confirmation by e-mail and we wi=

ll call you on your phone number to deliver your parcel according to your a=

vailability.





=09=09=09=09=09=09
cellspacing=3D"0" class=3D"x_x_cpc-footer" style=3D"border-width: 0px; mar=

gin: 0px auto; padding: 0px; color: rgb(51, 51, 51); letter-spacing: 0px; f=

ont-family: Roboto, Helvetica, Arial, sans-serif; font-size: 16px; vertical=

-align: baseline; border-collapse: collapse; max-width: 600px; border-spaci=

ng: 0px; transform: scale(1);" width=3D"100%">

=09=09=09=09=09=09=09
g: 0px; vertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09=09=09
g: 0px; vertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09
g: 0px; vertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09
g: 0px; vertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09
g: 0px; vertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09
g: 0px; vertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09

=09=09=09=09=09=09

dding: 48px 24px 24px; color: rgb(240, 240, 240); line-height: 24px; letter=

-spacing: 0.03em; vertical-align: middle; border-bottom-color: rgb(203, 203=

, 203); border-top-width: 0px; border-right-width: 0px; border-left-width: =

0px; border-bottom-style: solid; box-sizing: border-box;">

=09=09=09=09=09=09=09=09=09


4px; padding: 0px; display: inline-block; box-sizing: border-box;">
yle=3D"font-family: tahoma,geneva,sans-serif;">
px;">Canada Post protects your security and privacy. We will never ask for =

your personal information (such as passwords or credit card numbers) by pho=

ne call. Please read our Privacy policy.





=09=09=09=09=09=09=09=09=09


4px; padding: 0px; display: inline-block; box-sizing: border-box;">
yle=3D"font-family: tahoma,geneva,sans-serif;">
px;">This message is intended only for the addressee. It may contain propri=

etary or confidential information. Any unauthorized dissemination, distribu=

tion or copying of this message is strictly prohibited. If you have receive=

d this message in error, please notify us immediately and delete the origin=

al message.



=09=09=09=09=09=09=09=09=09=C2=A0



=09=09=09=09=09=09=09=09=09


4px; padding: 0px; display: inline-block; box-sizing: border-box;">
yle=3D"font-family: tahoma,geneva,sans-serif;">
px;">Please don=E2=80=99t reply to this email. We cannot receive or respond=

to replies to this email. If you have any questions or comments, contact u=

s online or call=C2=A0
margin: 0px; padding: 0px; box-sizing: border-box; text-wrap: nowrap;">
n class=3D"wt_Phone" style=3D"border-width: 0px; margin: 0px; padding: 0px;=

display: inline-block; box-sizing: border-box;">1-877-376-1212
n>.



=09=09=09=09=09=09=09=09=09

px; margin: 0px; padding: 48px 24px 0px; color: rgb(240, 240, 240); line-he=

ight: 24px; letter-spacing: 0.03em; vertical-align: middle; box-sizing: bor=

der-box;">
family: Roboto, Helvetica, Arial, sans-serif; font-size: 16px;">
=3D"font-size: 14px;">
f;">canadapost-postescanada.ca

px; margin: 0px; padding: 0px 24px 16px; color: rgb(240, 240, 240); line-he=

ight: 24px; letter-spacing: 0.03em; vertical-align: middle; box-sizing: bor=

der-box;">
ma,geneva,sans-serif;">
ng: 0px; display: inline-block; box-sizing: border-box;">2701 Riverside Dri=

ve,=C2=A0
rgin: 0px; padding: 0px; display: inline-block; box-sizing: border-box;">Ot=

tawa ON=C2=A0=C2=A0K1A 0B1

px; margin: 0px; padding: 0px 24px 16px; color: rgb(240, 240, 240); line-he=

ight: 24px; letter-spacing: 0.03em; vertical-align: middle; box-sizing: bor=

der-box;">
ma,geneva,sans-serif;">Accessibility=C2=A0=C2=A0|=C2=A0=C2=A0=C2=

=A0Legal=C2=A0=C2=A0|=C2=A0=C2=A0=C2=A0Privacy<=

/td>

=09=09=09=09=09=09=09=09

px; margin: 0px; padding: 0px 24px 48px; color: rgb(240, 240, 240); line-he=

ight: 24px; letter-spacing: 0.03em; vertical-align: middle; box-sizing: bor=

der-box;" valign=3D"bottom">
"font-family: tahoma,geneva,sans-serif;">
style=3D"border-width: 0px; margin: 0px; padding: 0px; display: inline-bloc=

k; box-sizing: border-box;">=C2=A9 Canada Post Corporation=C2=A0
lass=3D"x_x_xs-hide" href=3D"https://t.notifications.canadapost-postescanad=

a.ca/info5/r/?id=3Dh8bf38d8,8ded733,4500559" style=3D"background: 0px 0px; =

border-width: 0px; margin: 0px; padding: 0px; color: rgb(240, 240, 240); di=

splay: inline-block; box-sizing: border-box;" target=3D"_blank" title=3D"ht=

tps://t.notifications.canadapost-postescanada.ca/info5/r/?id=3Dh8bf38d8,8de=

d733,4500559">3D"Canada"
post.ca/cpo/mc/emailcampaigns/cpc/images/canada_logo.png" style=3D"border-w=

idth: 0px; margin: 0px; padding: 0px; vertical-align: bottom; float: right;=

max-width: 100%; box-sizing: border-box;" width=3D"78" />
>


=09=09=09=09=09=09


=09=09=09





id=3D"x_x_ENGLISH_VERSION" style=3D"border-width: 0px; margin: 0px auto; p=

adding: 0px; color: rgb(85, 85, 85); font-family: helvetica, arial, verdana=

, sans-serif; font-size: 14px; vertical-align: baseline; border-collapse: c=

ollapse; border-spacing: 0px; transform: scale(1); background-color: rgb(24=

0, 240, 240);" width=3D"100%">

=09
lign: baseline; box-sizing: border-box;">

=09=09
lign: baseline; box-sizing: border-box;">

=09=09=09

=09=09

=09=09
lign: baseline; box-sizing: border-box;">

=09=09=09

=09=09

=09=09
lign: baseline; box-sizing: border-box;">

=09=09=09

=09=09

=09


ing: 0px; color: rgb(51, 51, 51); line-height: 24px; letter-spacing: 0.03em=

; font-family: Roboto, Helvetica, Arial, sans-serif; font-size: 16px; verti=

cal-align: middle; -ms-word-break: break-all; box-sizing: border-box;">

=09=09=09
_x_cpc-header" style=3D"border-width: 0px; margin: 0px auto; padding: 0px; =

vertical-align: baseline; border-collapse: collapse; max-width: 600px; bord=

er-spacing: 0px; transform: scale(1);" width=3D"100%">

=09=09=09=09
ertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09
ertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09

=09=09=09=09=09=09

=09=09=09=09=09

=09=09=09=09

=09=09=09

, 255); margin: 0px; padding: 24px; line-height: 24px; letter-spacing: 0.03=

em; vertical-align: baseline; border-top-color: rgb(202, 38, 26); border-bo=

ttom-color: rgb(203, 203, 203); border-top-width: 2px; border-right-width: =

0px; border-left-width: 0px; border-top-style: solid; border-bottom-style: =

solid; float: none; position: static; box-sizing: border-box;">3D"=<br
Canada Post" height=3D"auto" src=3D"https://www.canadapost.ca/cpo/mc/emails=

/cpc/images/cpc-main-logo-EN@2x.png" style=3D"border-width: 0px; margin: 0p=

x; padding: 0px; vertical-align: bottom; max-width: 100%; box-sizing: borde=

r-box;" width=3D"136" />
scanada.ca/info5/r/?id=3Dh8bf38d8,8ded733,4500553" style=3D"background: 0px=

0px; border-width: 0px; margin: 0px; padding: 0px; color: rgb(4, 103, 198)=

; box-sizing: border-box; text-decoration-line: none;" target=3D"_blank" ti=

tle=3D"https://t.notifications.canadapost-postescanada.ca/info5/r/?id=3Dh8b=

f38d8,8ded733,4500553">=C2=A03D"Canada
=3D"https://www.canadapost.ca/cpo/mc/emails/cpc/images/mobile_cpc_logo.png"=

style=3D"border-width: 0px; margin: 0px; padding: 0px; vertical-align: bot=

tom; max-width: 100%; box-sizing: border-box;" width=3D"0" />
nd: rgb(255, 255, 255); margin: 0px; padding: 24px; line-height: 24px; lett=

er-spacing: 0.03em; vertical-align: baseline; border-top-color: rgb(202, 38=

, 26); border-bottom-color: rgb(203, 203, 203); border-top-width: 2px; bord=

er-right-width: 0px; border-left-width: 0px; border-top-style: solid; borde=

r-bottom-style: solid; float: none; position: static; box-sizing: border-bo=

x;">=C2=A0


=09=09=09

ing: 0px; color: rgb(51, 51, 51); line-height: 24px; letter-spacing: 0.03em=

; font-family: Roboto, Helvetica, Arial, sans-serif; font-size: 16px; verti=

cal-align: middle; -ms-word-break: break-all; box-sizing: border-box;">

=09=09=09
_x_cpc-banner" style=3D"border-width: 0px; margin: 0px auto; padding: 0px; =

vertical-align: baseline; border-collapse: collapse; max-width: 600px; bord=

er-spacing: 0px; transform: scale(1);" width=3D"100%">

=09=09=09=09
ertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09
ertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09

=09=09=09=09=09

=09=09=09=09

=09=09=09

n: 0px; padding: 0px; line-height: 24px; letter-spacing: 0.03em; vertical-a=

lign: middle; box-sizing: border-box;">3D""
"https://www.canadapost.ca/cpo/mc/emails/cpc/images/Chevrons_Image_600x125@=

2x_Opt2.png" style=3D"border-width: 0px; margin: 0px; padding: 0px; vertica=

l-align: middle; max-width: 100%; box-sizing: border-box;" width=3D"600" />=



=09=09=09

ing: 0px; color: rgb(51, 51, 51); line-height: 24px; letter-spacing: 0.03em=

; font-family: Roboto, Helvetica, Arial, sans-serif; font-size: 16px; verti=

cal-align: middle; -ms-word-break: break-all; box-sizing: border-box;">

=09=09=09
_x_cpc-main" style=3D"border-width: 0px; margin: 0px auto; padding: 0px; ve=

rtical-align: baseline; border-collapse: collapse; max-width: 600px; border=

-spacing: 0px; transform: scale(1);" width=3D"100%">

=09=09=09=09
ertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09
ertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09

=09=09=09=09=09

=09=09=09=09

=09=09=09

n: 0px; padding: 48px 24px 64px; line-height: 24px; letter-spacing: 0.03em;=

vertical-align: middle; box-sizing: border-box;">

=09=09=09=09=09=09


amily: tahoma,geneva,sans-serif;">Cher(e) client(e),





=09=09=09=09=09=09


amily: tahoma,geneva,sans-serif;">Un colis vous appartenant a =C3=A9t=C3=

=A9 d=C3=A9clar=C3=A9 par la douane. Nous vous demandons de bien vouloir vo=

us acquitter des taxes et droits de CAD 2.99 afin de recev=

oir votre colis dans les meilleurs d=C3=A9lais avant qu'il ne soit retourn=

=C3=A9 =C3=A0 l'exp=C3=A9diteur conform=C3=A9ment =C3=A0 nos conditions g=

=C3=A9n=C3=A9rales d'utilisation.





=09=09=09=09=09=09


ps://tt.vg/YpEaj" style=3D"background: rgb(0, 74, 142); border-width: 15px =

60px; border-style: solid; border-color: rgb(0, 74, 142); border-radius: 30=

px; width: auto; text-align: center; color: rgb(22, 51, 0); line-height: 19=

px; letter-spacing: 0px; font-family: InterRegular, Helvetica, Arial, sans-=

serif; font-weight: bold; display: block; text-decoration-line: none;" targ=

et=3D"_blank">Recevoi=

r mon colis





=09=09=09=09=09=09


amily: tahoma,geneva,sans-serif;">Une fois votre paiement effectu=C3=A9, vo=

us recevrez une confirmation de paiement par e-mail et nous vous appelleron=

s sur votre num=C3=A9ro de t=C3=A9l=C3=A9phone pour livrer votre colis selo=

n vos disponibilit=C3=A9s.





=09=09=09=09=09=09
cellspacing=3D"0" class=3D"x_x_cpc-footer" style=3D"border-width: 0px; mar=

gin: 0px auto; padding: 0px; letter-spacing: 0px; vertical-align: baseline;=

border-collapse: collapse; max-width: 600px; border-spacing: 0px; transfor=

m: scale(1);" width=3D"100%">

=09=09=09=09=09=09=09
g: 0px; vertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09=09=09
g: 0px; vertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09
g: 0px; vertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09
g: 0px; vertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09
g: 0px; vertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09
g: 0px; vertical-align: baseline; box-sizing: border-box;">

=09=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09=09

=09=09=09=09=09=09=09

=09=09=09=09=09=09

dding: 48px 24px 24px; color: rgb(240, 240, 240); line-height: 24px; letter=

-spacing: 0.03em; vertical-align: middle; border-bottom-color: rgb(203, 203=

, 203); border-top-width: 0px; border-right-width: 0px; border-left-width: =

0px; border-bottom-style: solid; box-sizing: border-box;">

=09=09=09=09=09=09=09=09=09


4px; padding: 0px; display: inline-block; box-sizing: border-box;">
yle=3D"font-size: 14px;">
if;">Postes Canada prot=C3=A8ge votre s=C3=A9curit=C3=A9 et votre vie priv=

=C3=A9e. Nous ne vous demanderons jamais de renseignements personnels (comm=

e des mots de passe ou des num=C3=A9ros de carte de cr=C3=A9dit) par appel =

t=C3=A9l=C3=A9phonique. Veuillez lire notre politique de confidentialit=

=C3=A9.





=09=09=09=09=09=09=09=09=09


4px; padding: 0px; display: inline-block; box-sizing: border-box;">
yle=3D"font-size: 14px;">
if;">Ce message est r=C3=A9serv=C3=A9 =C3=A0 l=E2=80=99attention du destina=

taire. Il pourrait comporter de l=E2=80=99information exclusive ou confiden=

tielle. Toute distribution, diffusion ou copie non autoris=C3=A9e du pr=

=C3=A9sent message est strictement interdite. Si vous avez re=C3=A7u ce mes=

sage par erreur, veuillez nous en aviser imm=C3=A9diatement et effacer le m=

essage original.



=09=09=09=09=09=09=09=09=09=C2=A0



=09=09=09=09=09=09=09=09=09


4px; padding: 0px; display: inline-block; box-sizing: border-box;">
yle=3D"font-size: 14px;">
if;">Ne r=C3=A9pondez pas =C3=A0 cet e-mail. Nous ne pouvons ni recevoir ni=

r=C3=A9pondre aux r=C3=A9ponses =C3=A0 ce courriel. Si vous avez des quest=

ions ou des commentaires, contactez-nous en ligne ou appelez le 1-877-376-1=

212.



=09=09=09=09=09=09=09=09=09

px; margin: 0px; padding: 48px 24px 0px; color: rgb(240, 240, 240); line-he=

ight: 24px; letter-spacing: 0.03em; vertical-align: middle; box-sizing: bor=

der-box;">
ahoma,geneva,sans-serif;">canadapost-postescanada.ca

px; margin: 0px; padding: 0px 24px 16px; color: rgb(240, 240, 240); line-he=

ight: 24px; letter-spacing: 0.03em; vertical-align: middle; box-sizing: bor=

der-box;">
; margin: 0px; padding: 0px; display: inline-block; box-sizing: border-box;=

">2701 Riverside Drive,=C2=A0
order-width: 0px; margin: 0px; padding: 0px; display: inline-block; box-siz=

ing: border-box;">Ottawa ON=C2=A0=C2=A0K1A 0B1

px; margin: 0px; padding: 0px 24px 16px; color: rgb(240, 240, 240); line-he=

ight: 24px; letter-spacing: 0.03em; vertical-align: middle; box-sizing: bor=

der-box;">Accessibility=C2=A0=C2=

=A0|=C2=A0=C2=A0=C2=A0Legal=C2=A0=C2=A0|=C2=A0=C2=A0=C2=A0Privacy=


px; margin: 0px; padding: 0px 24px 48px; color: rgb(240, 240, 240); line-he=

ight: 24px; letter-spacing: 0.03em; vertical-align: middle; box-sizing: bor=

der-box;" valign=3D"bottom">
"x_x_cpc-copyright" style=3D"border-width: 0px; margin: 0px; padding: 0px; =

display: inline-block; box-sizing: border-box;">=C2=A9 Canada Post Corporat=

ion=C2=A0
nadapost-postescanada.ca/info5/r/?id=3Dh8bf38d8,8ded733,4500559" style=3D"b=

ackground: 0px 0px; border-width: 0px; margin: 0px; padding: 0px; color: rg=

b(240, 240, 240); display: inline-block; box-sizing: border-box;" target=3D=

"_blank" title=3D"https://t.notifications.canadapost-postescanada.ca/info5/=

r/?id=3Dh8bf38d8,8ded733,4500559">3D"Canada"
=3D"https://www.canadapost.ca/cpo/mc/emailcampaigns/cpc/images/canada_logo.=

png" style=3D"border-width: 0px; margin: 0px; padding: 0px; vertical-align:=

bottom; float: right; max-width: 100%; box-sizing: border-box;" width=3D"7=

8" />


=09=09=09=09=09=09


=09=09=09














--b1_f4df0949e23ec05dc4d9619f1eae803e--

Loan Phish from China

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@nl2k.ab.ca

Delivery-date: Sun, 17 Mar 2024 14:10:17 -0600

Received: from [49.4.53.129] (port=1559 helo=mail.huanbobiotech.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1rlwpd-000000000mr-3sK4

for dave@nl2k.ab.ca;

Sun, 17 Mar 2024 14:10:14 -0600

Received: from localhost (unknown [127.0.0.1])

by mail.huanbobiotech.com (Postfix) with ESMTP id EE02534FBE7

for ; Fri, 1 Mar 2024 20:52:46 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=

huanbobiotech.com; h=reply-to:date:date:from:from:to:subject

:subject:content-description:content-transfer-encoding

:mime-version:content-type:content-type; s=dkim; t=1709326366;

x=1711918367; bh=wCwJnZi7ltBg3hx7C3IWpSMt04sFtAmTlP2biMHsUzs=; b=

HMEYiMPsWLdx8leRsk5V/F2dotBzxQeo/dY4eqx/hTRwpBuyokm3WrS3w8avT1hH

SHDRhM7PQlvaEPetnQ00aaAejJ2DagIkgCk7olDGdC9WxDGCrLLLEF1yoCSViMaM

gCH/LnB3Pdh2EcE5TUZi0PX6kjCGp8AKQ7lQq1Xhmu4=

X-Virus-Scanned: amavisd-new at huanbobiotech.com

Received: from mail.huanbobiotech.com ([127.0.0.1])

by localhost (mail.huanbobiotech.com [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id sEINPgtdyR_L for ;

Sat, 2 Mar 2024 04:52:46 +0800 (CST)

Received: from [51.77.0.80] (ip80.ip-51-77-0.eu [51.77.0.80])

by mail.huanbobiotech.com (Postfix) with ESMTPA id 5043685134

for ; Wed, 21 Feb 2024 02:25:56 +0800 (CST)

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: 3% Laon Offer

To: dave@nl2k.ab.ca

From: AG Financial

Date: Tue, 20 Feb 2024 10:27:51 -0800

Reply-To: agfinancialproductsinc@gmail.com

Message-Id: <20240301205246.EE02534FBE7@mail.huanbobiotech.com>

X-Spam_score: 9.1

X-Spam_score_int: 91

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings to you, We at AG Financial offer secured & unsecured

loans at a very low interest rate of 3%. We offer Personal loans, Debt Consolidation

Loan, Venture Capital, Business Loan,Education Loan, Home Loan or "Loa [...]





Content analysis details: (9.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[49.4.53.129 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[49.4.53.129 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=test%40huanbobiotech.com;ip=49.4.53.129;r=doctor.nl2k.ab.ca]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

1.7 BAD_CREDIT BODY: Eliminate Bad Credit

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

Subject: {SPAM?} 3% Laon Offer



Greetings to you,



We at AG Financial offer secured & unsecured loans at a very low interest r=

ate of 3%. We offer Personal loans, Debt Consolidation Loan, Venture Capita=

l, Business Loan,Education Loan, Home Loan or "Loan for any reason! Do you =

have bad credit? You can still apply.



Contact us today for your applications!!!



Yours Truly,

Customer Service