Nigerian spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 May 2024 06:58:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s50p3-00000000DL1-1k1f

for dave@doctor.nl2k.ab.ca;

Thu, 09 May 2024 04:16:21 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 May 2024 04:16:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f67.google.com ([209.85.219.67]:42111)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4v8y-00000000CoO-1not

for root@nk.ca;

Wed, 08 May 2024 22:12:38 -0600

Received: by mail-qv1-f67.google.com with SMTP id 6a1803df08f44-69b50b8239fso4315146d6.0

for ; Wed, 08 May 2024 21:10:37 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1715227832; x=1715832632; darn=nk.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=dADsO8o8dGW4L62NDBdaep7mT9RnqDrc8B6/4hPIhs0=;

b=La43CiRGvUGukTNWDfeC3RuhAaMyxwU12wqZbSIDENnQJFmLQrjEgddCmyNrD3SDDw

fbp45gvOKk6K829+4LLrb+3Cz/YYkkZADNShfBe+sxyrOtPU2IA4ZlfXBjCRo+52QcRO

yMQ3JFAkToVP8fw7a2W2zz9nxdhAEfmwpDt9o4v+DUqvk9a8Xq6+UQlAnns35bcgGBgy

qtVe8gkMUk0ZeDcIVLfOm6zVqa1qN6wFPkY7R4fIcLnhxNG3BeEQaLVE+t4JZZxNY0E5

tbhwW/B2WAbGIQsfPs0NjofIo/gL5VpCiUKXUIklmUvSOYgTU3nNtudGLrRfEGEPyr18

Rkqw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1715227832; x=1715832632;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=dADsO8o8dGW4L62NDBdaep7mT9RnqDrc8B6/4hPIhs0=;

b=IYvQ/s3vYU7x0KiTxfTyJ4UZ8VPyP+fATfuxnVpFcHw/fAFi+xzZPZ1YD0bWAhsZhf

lSwgEnMv/xbFxB5YyXsNAzqEKEvODwYjx1KYQQoZmCPxxvdQjJNcj5eE2F2dBp56PfG+

f+pvWzH2mlEcK6dK8zYi3V4j01UsdvvbIVAxBd3/pYzjSymE1CIihC1U+pmrCvagdqNU

j9Cl0fnCORwvC6WwX5MfWtYyl4YykTnPm2g+VMHJPFEATGu8o99rikJNOmpWtP5N9Bje

9o8gXBF6J6TYqG+eR2cRVlbrez4pADqJ/2qzfVFiiqjaXJEkipTFgeA+Li7QSjWH9D6T

R7aw==

X-Forwarded-Encrypted: i=1; AJvYcCUgTg7P4mYL/mzlM5BrnkXeDxwAx3FNba497t7L8Y9HgIqULM3qpBkqq/0W/dUEBcihQaL2buLfjzbh

X-Gm-Message-State: AOJu0YyRvusaWmssd1nxRrhhrKqfcg2TynmCCbdRT5FAIDr8pKfM+WAc

1bMRAZEpzVNbTrwNYRFW4EfY+uhj6QJZo8KN+WOpmiFlB1XA03JbeavzYFZWPXCO7JOWNISCCLA

j3tgWxEagSKfERroGd5Z8JlhMsEM=

X-Google-Smtp-Source: AGHT+IFvHm7/8KxcqoVwkxu70SxPdD+EJvcGAA/f9sxopPToFeFezrb+VDN663Z+rdr/STwQ7bO+RHQiScJKamTHORw=

X-Received: by 2002:a05:6214:242d:b0:6a0:ea1e:833d with SMTP id

6a1803df08f44-6a15cc69205mr28507446d6.27.1715227831789; Wed, 08 May 2024

21:10:31 -0700 (PDT)

MIME-Version: 1.0

Reply-To: lindabenson666666@gmail.com

From: Linda Benson

Date: Thu, 9 May 2024 05:10:14 +0100

Message-ID:

Subject: Hello

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000009f71340617fd99a5"

Bcc: root@nk.ca

X-Spam_score: 24.6

X-Spam_score_int: 246

X-Spam_bar: ++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear friend, I need your help I have an inheritance worth

$2.9 million US dollars that requires the help of a capable foreign partner,

please help me out of my present predicament to continue my educa [...]



Content analysis details: (24.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.219.67 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.67 listed in wl.mailspike.net]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

[209.85.219.67 listed in dnsbl.ahbl.org]

[209.85.219.67 listed in dnsbl.ahbl.org]

[209.85.219.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[lindabenson3304(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[lindabenson3304(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[lindabenson666666(at)gmail.com]

3.6 NA_DOLLARS BODY: Talks about a million North American dollars

2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!

0.0 HTML_MESSAGE BODY: HTML included in message

2.9 YOU_INHERIT Discussing your inheritance

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Hello



--0000000000009f71340617fd99a5

Content-Type: text/plain; charset="UTF-8"



Dear friend,

I need your help I have an inheritance worth $2.9 million US dollars that

requires the help of a capable foreign partner, please help me out of my

present predicament to continue my education which was interrupted by the

sudden death of my parents

I wait for your reply for more details

Thanks



--0000000000009f71340617fd99a5

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear friend,
I need your help I have an inheritance wor=

th $2.9 million US dollars that requires the help of a capable foreign part=

ner, please help me out of my present predicament to continue my education =

which was interrupted by the sudden death of my parents
I wait for your =

reply for more details
Thanks




--0000000000009f71340617fd99a5--

I1.01KL0LD37.4KI2.18KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 May 2024 06:58:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s50oy-00000000DKR-3iqT

for dave@doctor.nl2k.ab.ca;

Thu, 09 May 2024 04:16:16 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 May 2024 04:16:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f67.google.com ([209.85.219.67]:43173)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4v8y-00000000CoT-1ngV

for root@nl2k.ab.ca;

Wed, 08 May 2024 22:12:37 -0600

Received: by mail-qv1-f67.google.com with SMTP id 6a1803df08f44-6a0ff97a9c7so11986776d6.0

for ; Wed, 08 May 2024 21:10:37 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1715227832; x=1715832632; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=dADsO8o8dGW4L62NDBdaep7mT9RnqDrc8B6/4hPIhs0=;

b=AKrl8gtP6AOktbrTLMQNdT36ArO6gTeLYWxOFAXnhU+r/AHNdrxSlZsUe01/8edARA

qsdQe4JFaWLczoEzN9VhsCNjhAblDWexBguDUIRkju0+Y/2XQJXTetMG3HtcQ+AE0Ikj

qxKsVqnx9sHivH98J3vHQLkwcDJcbx3qR4LVTG4XDlHu8WtFMOhiCGpO/513mySEgeps

yL+SXDEYuc423PAI55pGtTg/rHQAOFw+AW5Oxl+B/Chd8f8VRin3+PwHu/zHMtpHkRe6

pGLllE0ueS2HlJhVFRPXfVCqs1cHsmU6CAM76CCvT1LKu40p5Xo5W98A4u77veaT3hnc

h5mw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1715227832; x=1715832632;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=dADsO8o8dGW4L62NDBdaep7mT9RnqDrc8B6/4hPIhs0=;

b=G5mnWijX6Ad2c3Rpp8xgEKJqPnCqk9oY7XF+Y9aLAuDlYmnUuCRAaf4mab3JQKbD7C

XGu1yU1yn09ywa0C0lvEKhVWfg6N/g5AtMYBP8DdS2mnTUn39BZ6klHxg3BmScxEJdOW

XwZ3m4EGe0njBTmGgTNHUlyJaIVojOGsR1pW7OzplRNCDB1ZZnglvVA9FU1p530txCM4

P/fosiD0kRKuAKv9xg8GlWzieUfaHAl1a48OXH8IAAm+g8ofgz3AnH5PjQC8eepWufdz

7x0xojqjrmMDNoJpdlN4m6IGbTwr6190YeLOqb8/LVj4SyfB4EufJS+rmdCImRIxdbG3

86pw==

X-Forwarded-Encrypted: i=1; AJvYcCU85yczHm52DA2hLCZbJmVT4792YgKA+Tbrz6/dl/DamcKH9OcZ2R7QFstxhWfMaaSum2qYxaZ2F7ZMKJhywuM=

X-Gm-Message-State: AOJu0YzjlC3hism7n7w7p6SSm0JqUVWmdS1kYVpV8XOqZnfPeaLUTEWr

ofFBPC2xM0J4A8OfTn5RCeBq3870P75+JU565jk6IzpNGnFHmn/8mQJWwq+bxogsSiKUjZUyhGg

iWZLdWX2ZCu8TBnbRNWdQRKrdSHM=

X-Google-Smtp-Source: AGHT+IFvHm7/8KxcqoVwkxu70SxPdD+EJvcGAA/f9sxopPToFeFezrb+VDN663Z+rdr/STwQ7bO+RHQiScJKamTHORw=

X-Received: by 2002:a05:6214:242d:b0:6a0:ea1e:833d with SMTP id

6a1803df08f44-6a15cc69205mr28507446d6.27.1715227831789; Wed, 08 May 2024

21:10:31 -0700 (PDT)

MIME-Version: 1.0

Reply-To: lindabenson666666@gmail.com

From: Linda Benson

Date: Thu, 9 May 2024 05:10:14 +0100

Message-ID:

Subject: Hello

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000009f71340617fd99a5"

Bcc: root@nl2k.ab.ca

X-Spam_score: 24.6

X-Spam_score_int: 246

X-Spam_bar: ++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear friend, I need your help I have an inheritance worth

$2.9 million US dollars that requires the help of a capable foreign partner,

please help me out of my present predicament to continue my educa [...]



Content analysis details: (24.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

[209.85.219.67 listed in dnsbl.ahbl.org]

[209.85.219.67 listed in dnsbl.ahbl.org]

[209.85.219.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.67 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.219.67 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[lindabenson3304(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[lindabenson3304(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[lindabenson666666(at)gmail.com]

3.6 NA_DOLLARS BODY: Talks about a million North American dollars

2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!

0.0 HTML_MESSAGE BODY: HTML included in message

2.9 YOU_INHERIT Discussing your inheritance

0.0 LOTS_OF_MONEY Huge... sums of money

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Hello



--0000000000009f71340617fd99a5

Content-Type: text/plain; charset="UTF-8"



Dear friend,

I need your help I have an inheritance worth $2.9 million US dollars that

requires the help of a capable foreign partner, please help me out of my

present predicament to continue my education which was interrupted by the

sudden death of my parents

I wait for your reply for more details

Thanks



--0000000000009f71340617fd99a5

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear friend,
I need your help I have an inheritance wor=

th $2.9 million US dollars that requires the help of a capable foreign part=

ner, please help me out of my present predicament to continue my education =

which was interrupted by the sudden death of my parents
I wait for your =

reply for more details
Thanks




--0000000000009f71340617fd99a5--

I1.01KL0LD37.4KI2.18KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Spanish language spam from ovh.net

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 May 2024 06:58:04 -0600

Received: from vps-b9f69b13.vps.ovh.net ([51.195.216.240]:41328)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s52WY-00000000Chk-2SRd

for dave@doctor.nl2k.ab.ca;

Thu, 09 May 2024 06:05:28 -0600

Received: by vps-b9f69b13.vps.ovh.net (Postfix, from userid 0)

id C320F8B524; Thu, 9 May 2024 11:48:50 +0000 (UTC)

To: dave@doctor.nl2k.ab.ca

Subject: Importe pendiente, pago requerido (94004540)

X-Mailer: Outlook/91.8.0

From: Ana Laura Gomez

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="b1a4df8e96aa32b7796c4ff1c78866bf"

Content-Transfer-Encoding: 7bit

Message-Id: <20240509120205.C320F8B524@vps-b9f69b13.vps.ovh.net>

Date: Thu, 9 May 2024 11:48:50 +0000 (UTC)

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: La Factura: dave@doctor.nl2k.ab.ca Ei mensaje está listo

para enviarse.



Content analysis details: (10.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[51.195.216.240 listed in dnsbl.ahbl.org]

[51.195.216.240 listed in dnsbl.ahbl.org]

[51.195.216.240 listed in dnsbl.ahbl.org]

[51.195.216.240 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[51.195.216.240 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[51.195.216.240 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[51.195.216.240 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[51.195.216.240 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[51.195.216.240 listed in will-spam-for-food.eu.org]

[51.195.216.240 listed in will-spam-for-food.eu.org]

[51.195.216.240 listed in will-spam-for-food.eu.org]

[51.195.216.240 listed in will-spam-for-food.eu.org]

[51.195.216.240 listed in will-spam-for-food.eu.org]

[51.195.216.240 listed in will-spam-for-food.eu.org]

[51.195.216.240 listed in will-spam-for-food.eu.org]

[51.195.216.240 listed in will-spam-for-food.eu.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: 6.183.205.92.host.secureserver.net]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.9 MANY_SUBDOM Lots and lots of subdomain parts in a URI

Subject: {SPAM?} Importe pendiente, pago requerido (94004540)



This is a MIME encoded message.

X-Priority: 1



--b1a4df8e96aa32b7796c4ff1c78866bf

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 8bit















 La Factura: dave@doctor.nl2k.ab.ca





Ei mensaje está listo para enviarse.





Com los seguinte archivos e vinculos adjunto.









 





Gracias por ser nuestro cliente.





Siempre estamos disponibles.







I1.01KL0LD37.4KI2.18KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Romance spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 May 2024 04:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s50qT-00000000DXu-33dl

for dave@doctor.nl2k.ab.ca;

Thu, 09 May 2024 04:17:49 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 May 2024 04:17:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm6nam10olkn2071.outbound.protection.outlook.com ([40.92.41.71]:5088 helo=NAM10-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4yVy-00000000Gis-1P4m

for doctor@nk.ca;

Thu, 09 May 2024 01:48:35 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=PJQCuK0gtTDc8J1yprfP0kL0phEdrfEf8wUkzM6/lip4iQ599u00WU+pgK+5m4e7UpBNqVCO1UUfXUrhAtK6nluGaSXiHesRLEiAIUDsER23XR8fkb5LVnZQgRZuKayKZBQI7OVMopGXDm030V6E8T5LRYIKjqb4lU7F1BWWSBPTqa/acIyE3eSf3YvJZsoKJS9JjIWrg4likh4lOmyJ/w/s/0EDFbljXoVB1rgbNHS+8icHo2nbOYdo3tNY7NBo11ioEpYcwsN9w0rH/vcUl5altTpDk2d9UHmoNEh/26/yJ8kGLw7I7GsPv4isvDtG61JUFmCxc2Oke0JR4QDjFA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=8u3slUMpA5iXalhy+ywCFqDvqEHKHmD5QJEOtldKMxQ=;

b=hV5YV3L8xDi2bID/XDAsE28rwAS3UiYzdBFjdVAeXIp4QmGnoSD4h4yNBSfFNpyg14gDtCjbM2oEmhVrkmbKCF52ZinGl831V8QCn8CnwERf8PtDoBrzCWK4zK9jTux3291YAUlgCaYNrEqHOsmoOE8ctuhufNwoAWQcG3YmZiWSEM8WHIPbrs0llSvWvvxznwJn7CtALg490fClCVC1kjUpi4Ih1zOfVUutakd9GR635eLoyrsN9TAon6MYRfxTb1JE6nayqBL/XmIhCAdSpDGLFLOHz0L27NA5Rt4g5jqOE/og2HvWDT01CAje6+vZ3EJs7tArOpS57Sv0bsYYJg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=8u3slUMpA5iXalhy+ywCFqDvqEHKHmD5QJEOtldKMxQ=;

b=tEzk9W0o1Fh3oV8drEOZRoE4DVV5u4/EliRNQGSHk0UfiwURqEwUX8MnwuE51WjQP+S36gtJLlbbRi5EDwCKf2p9VLmxIth2KgKADrf92+R6ItPeAtZ3q2xw9FopJ5X6W4G9yv2dvi7T3er9lNB0aOfLPKiF5CYTaVmw1/4ooQw/rlv1I1eBzdW9u63JH6laYT0J7eyujr4Ka2+8p8wWryvtNctzG+HVU5hO1pkrO9j2FCnJT55cnCgQj2xoOGmljoifbwmO3iNQv/bIoifwHotWwDiFVUMrKcbbrTU+Mm/2RmXdHGiR3STrbRe+5vSQTs5Q+N70Rq8OGhi5BuW22Q==

Received: from PH7PR20MB4265.namprd20.prod.outlook.com (2603:10b6:510:139::15)

by CH3PR20MB6471.namprd20.prod.outlook.com (2603:10b6:610:15a::15) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7544.47; Thu, 9 May

2024 07:46:21 +0000

Received: from PH7PR20MB4265.namprd20.prod.outlook.com

([fe80::7655:e2c7:7be7:755c]) by PH7PR20MB4265.namprd20.prod.outlook.com

([fe80::7655:e2c7:7be7:755c%6]) with mapi id 15.20.7544.046; Thu, 9 May 2024

07:46:21 +0000

Content-Type: multipart/alternative; boundary="===============2302785460182536916=="

Subject: Your friend mentioned you in their story.

From: CharmMatch

CC: CharmMatch

Date: Thu, 9 May 2024 07:45:19 +0000

X-TMN: [A90Xmqtgy5793fHevhSua8uRjhLnJknt]

X-ClientProxiedBy: FR2P281CA0099.DEUP281.PROD.OUTLOOK.COM

(2603:10a6:d10:9c::9) To PH7PR20MB4265.namprd20.prod.outlook.com

(2603:10b6:510:139::15)

Message-ID:



MIME-Version: 1.0

X-MS-Exchange-MessageSentRepresentingType: 1

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: PH7PR20MB4265:EE_|CH3PR20MB6471:EE_

X-MS-Office365-Filtering-Correlation-Id: 6c8200cb-35f4-4587-f6a3-08dc6ffc1dc2

X-Microsoft-Antispam:

BCL:0;ARA:14566002|9400799015|42300799006|461199019|3412199016|440099019|4601999003|1602099003|56899024|2406899030|1710799017;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?V2lrNW9nOXliZ2V5QnNyWmtkV3VER21qUktNRkt6UmthZ1pMYS82VjY2ZVhs?=

=?utf-8?B?bVZSQm9wQ3pORUd0MlZaNEt6WmFxNFRYMVNaNDkxV0kvU2ZDRTFVUTUrSzVw?=

=?utf-8?B?VmJiUk9ZcHh6ZGRHdHkzeHRhejVJMGFEK2hXdmJGRUo0SUNMSzUya0VwVTJS?=

=?utf-8?B?S0YweWFCTW53WDJMMlF3dUUvRXE3a2l5SzhjRDZnT2t1WEttNk1iSlJSNzRa?=

=?utf-8?B?c1N2VTI3NGk4c3Z5WE5yZm1sb2N0UWxGYnE1K0RwS1ROenh2WkI2WjQvbEdC?=

=?utf-8?B?Unk4cWNBQzY4ZmVTeVRVYmowUnBuMTJCeUNTcjhPOGpudjAvMkpRWmFIZHJx?=

=?utf-8?B?bW9pNVIxQjhGTzlLUTY3NThMdm4rOUFRbnRXQjd6SEtpVjBMRzZ2cmFPRlU2?=

=?utf-8?B?MWFvaDYvSFJJVWRiWjNSV2FKclpCUXY3NHF5by9KK2h6VjdZSDNCT1JhQUR0?=

=?utf-8?B?YnVzdWdHeks0aytUR09meVNpam0rYUR0bE9mY0d4bStEdUUxa1dyS3NFSXZZ?=

=?utf-8?B?VnA2Y3FZMzhvU01LUGtnQ1NPT2RDU0VYeWo2cDRVcGRyZjdKMXNZQzVPWEZr?=

=?utf-8?B?a2gxM1ppZSszRE1zb1czWE0xVGdXMi9SMnZZaGRDblFRenVpWWcvL2Y4TElC?=

=?utf-8?B?blg2RHBRZGNJc2pydFdRZjdEOVlOQkgvU2lTNWN5OTloK0xUSjY0ZU9OZVVW?=

=?utf-8?B?YlFONVVOd3JPcndhWlJIaWp5ejcxbkEybGQ1aEFTUi96K3VZVm9nTWk4Ykp4?=

=?utf-8?B?UmV0MEgzYXp2aC9LOE9TSThUVDRUVm9BdXJyTWpnaUJNcE10TVBuRzdwd1FZ?=

=?utf-8?B?cGJkUXFoY2hlSytyMlprMHBkamllNzM5bHBzdkdYSERQd0hZcDNkS0xjZ2pQ?=

=?utf-8?B?NlQ5SENuR2R0ZWhINkx3OUJranVObCtjU2h4MW9VZHZYeEJlc00ycjNkZ2VK?=

=?utf-8?B?KzhySWxYN3dzVVo1NHNOOFNGWWxQY0VvRHd0Z1gzOURueWw2L3I3T3hFM0ZW?=

=?utf-8?B?UUJ4TkJVeTlacVAvR3dqRFFyM1F0aFJiTVBXQ3llb2VyQ1N1VkJvZFkxWjlB?=

=?utf-8?B?L041T0YxTy8zZVZ6Q01vR0JtOHJDL1I0bzJQaTAzMlpYajd3NVdubXJJRTgv?=

=?utf-8?B?cUZkRUtNeFJJeG9HMGJFQkJta0hhNisxdVBsdGRDS0o0NlNDWVM1RjhuRmpJ?=

=?utf-8?B?amxZZUFNM2xGc3RZKzdBcS9CU3dDMEdFUkV3N1pHcE5mR3A0b2tFNFIzbjQx?=

=?utf-8?B?dEh4Q2s4LzBZMHVHbWU4Nmgva1B6MThCWFhSMGhHSW9UWm1kalpXcVYwVEtS?=

=?utf-8?B?bHJBVHJML1dxRjB2MHU2bmpxSmJPNXlFdG9KaGZQZ3huU0RlODlIY2xyTkJY?=

=?utf-8?B?VkgvaFVGN3k2MXJQbTdJU1dKSW5wSkQxY2M5cVhCNnR4WCtlRWxSYTkxWHdI?=

=?utf-8?B?UGk4OVZ5WWJpbmI2ejBucmsvVHlBa3A3MjZSVVhHejloWjdueXByL1Yya2Vw?=

=?utf-8?B?OVhKNUVNVU5KK1dleVdKVVJrMUZxWENibTNlcHg5Zm9hVGFDaE1aNlppbldE?=

=?utf-8?Q?xnJ10or9x2yAgLN8RDAA3j3mDqhyViksp6i5LCbGWv9ZAZ?=

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?SlkvTndPOXpIdVV6ZXNCOXNJNy85MytmOWlwenZvcUVrZ1FnRUVJaXBLNnIr?=

=?utf-8?B?OE8wT29yampMSGl0dkdsMUthYU85cXg2ZkFvZEl3c1FUTCtrVzNENkxPUGxQ?=

=?utf-8?B?eUs5bERLOUVmQWtzZGF3SEVWU2k5UlY3MWNJVXFZWmV2bUpnVjAvWk9lWTZ4?=

=?utf-8?B?akpreHFZSkZaK2dpSmxVQjZCcFowVXo0aHVCT0d4dnNlZUVpR200NU9oUkE4?=

=?utf-8?B?d3ZIQlh5eVQzTG5FejFSTXc5aDQvMkN6b01sQlFRYWk1dGJ2NGM0YjJRQXk3?=

=?utf-8?B?SEFnUjRmNG1nYWJaS2E4OXhJdTlVdFN0MCtXdDB0ZHZGUlBBY2tMQ1JDSVUr?=

=?utf-8?B?WjdYUjA4Umt3cUlZK2ZmelFyayswdTZtYUhDOXlXMEwwQ0oxWUFDR0xDYXJO?=

=?utf-8?B?TFBzNEtCQ0dEYnYrVUtDTFBxTXEwNVFhcEpWVjBhQ2txTE52ZWJ3dVc5YW16?=

=?utf-8?B?Wk9lZVZZNVZCVmhETElsNXplSHFmRXBRSi81WVNveWdwTi9tcWw3eEM5d2M5?=

=?utf-8?B?NS9ibzB4RjE2NEo3UFprTGw3cjI5K2RGb25rOWZ0bEk2Q21mR1JXNkEyanJT?=

=?utf-8?B?MEREaXBMZXpNSnR4cFVUQ20ycEF1N3JxQXpqWHpzbUlCQVl3VFNVK1pZOXEy?=

=?utf-8?B?RWdRVDgxRFlKVEl5b29pN2JLb2d1ejd3OHU0S085eEdZbDZEVHVGSmhJdi9S?=

=?utf-8?B?VjBWRk1Od0tZWXMyUkkzOVByMUovRkRVbW0wQjRYS0MvVEs3NHE3V0w3Mk5S?=

=?utf-8?B?N1dQTFBmdlVWVmN1Q095c3JtcGdWWk44RTdnWkFXSXBYUkR1anpaTnIrNGhT?=

=?utf-8?B?SitjMG5KUmhxZi9SUnozWlpubDBoUTQrWkY1VlJNL2FrYmE4RGszbEV4Nm5m?=

=?utf-8?B?L0gyUm9McHdzY3M5NUhGQVoyR3BDNXpLbURHbXdhNmlwUXlzNGsvY0JreXIw?=

=?utf-8?B?LzhUNjU5THhYdGhJVFFXcTI3czBIWjdud0R6YXNWVG8rYTV2SFNNQjd1eU1n?=

=?utf-8?B?NXp5SHRjYTczR3hqdVhQNEprMDJlY3Y5TCtqSW5lR1hSWDk5R3VkSk5kMmls?=

=?utf-8?B?MGZPTXkwZFV1Y2pvcDNpVThRaVY1K1Q5YUR6TWkwOTZPS0hsa0R3R3orSWlJ?=

=?utf-8?B?YWcrYWliYmhhYVk4VkpOYXdaVEQ1bXgyOXR2WUdid1pLOTQwS2M4M0RLOG1F?=

=?utf-8?B?WGZxQ08yMWFycW5SeCtNNDd1UHdUMmRxUTczT0JSbzY5Z0RvQ1lOMnBaRHhG?=

=?utf-8?B?QkZQVklpTURLMGFERjZXRExBVHV2OTdJcHplQnB2ZXRseGpvV2NsQktBWWxY?=

=?utf-8?B?WUROY1J4S21ESGQrcGpZQUxEVHdGcE1ObDRpdmhKTmJUT1I4cVo5QmVNWGRZ?=

=?utf-8?B?akxacVBZRGNXTzV4cWNnWld4Z1NzNmtCK0NTeFVvSkZiSWtBV3FSUXdSZmdV?=

=?utf-8?B?VmQ2cTNJeWhUYlRPYWdoRjJvOWp3RGNYcDJDQVZXc2tTaEtQSm5kQlArTElJ?=

=?utf-8?B?U2ZiSkpGL29PZjBreE95bmhLNlpGc3U5YXViYnFhZFpOdWRqaG1aZzJYRzlX?=

=?utf-8?B?Yit6TEVGcmQ3S0Zmdk9DbWpsQmRneFhUVW5RVjRLc08zRzI3bTZZeU1qdGZt?=

=?utf-8?B?SWc2a0tSclN2YWlzZDU0bUVIRko3S1RtMTV0TjlrdXAveXA0aTVWNGdXUW9o?=

=?utf-8?B?MVhHVFBHQVZtdnRoV2c4R1RKMFJ2czZZMTJHVGZIbzNmM1dNVDZSZG9nPT0=?=

X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-9803a.templateTenant

X-MS-Exchange-CrossTenant-Network-Message-Id: 6c8200cb-35f4-4587-f6a3-08dc6ffc1dc2

X-MS-Exchange-CrossTenant-AuthSource: PH7PR20MB4265.namprd20.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 May 2024 07:46:20.9504

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:

00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR20MB6471

X-Spam_score: 11.8

X-Spam_score_int: 118

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Discover Your Ideal Partner on HeartConnect 💖 Discover

Your Ideal Partner on HeartConnect 💖



Content analysis details: (11.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.92.41.71 listed in dnsbl.ahbl.org]

[40.92.41.71 listed in dnsbl.ahbl.org]

[40.92.41.71 listed in dnsbl.ahbl.org]

[40.92.41.71 listed in dnsbl.ahbl.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.92.41.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.92.41.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.92.41.71 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.92.41.71 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[40.92.41.71 listed in will-spam-for-food.eu.org]

[40.92.41.71 listed in will-spam-for-food.eu.org]

[40.92.41.71 listed in will-spam-for-food.eu.org]

[40.92.41.71 listed in will-spam-for-food.eu.org]

[40.92.41.71 listed in will-spam-for-food.eu.org]

[40.92.41.71 listed in will-spam-for-food.eu.org]

[40.92.41.71 listed in will-spam-for-food.eu.org]

[40.92.41.71 listed in will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.41.71 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[amilyahvittitoe20042816(at)hotmail.com]

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[amilyahvittitoe20042816(at)hotmail.com]

0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} Your friend mentioned you in their story.



--===============2302785460182536916==

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: base64



PCFET0NUWVBFIGh0bWw+PGh0bWwgbGFuZz0iZW4iPjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVpdj0i

Q29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPgo8bWV0YSBu

YW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxl

PTEuMCI+Cjx0aXRsZT5EaXNjb3ZlciBZb3VyIElkZWFsIFBhcnRuZXIgb24gSGVhcnRDb25uZWN0

PC90aXRsZT4KPC9oZWFkPgo8Ym9keSBzdHlsZT0iZm9udC1mYW1pbHk6IEFyaWFsLCBzYW5zLXNl

cmlmOyBiYWNrZ3JvdW5kLWNvbG9yOiAjZjdmN2Y3OyBtYXJnaW46IDA7IHBhZGRpbmc6IDA7Ij4K

Cjx0YWJsZSBjZWxscGFkZGluZz0iMCIgY2VsbHNwYWNpbmc9IjAiIGJvcmRlcj0iMCIgd2lkdGg9

IjEwMCUiIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiAjZjdmN2Y3OyI+Cjx0cj4KPHRkIGFsaWdu

PSJjZW50ZXIiPgo8dGFibGUgY2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIiBib3JkZXI9

IjAiIHdpZHRoPSI2MDAiIHN0eWxlPSJtYXgtd2lkdGg6IDYwMHB4OyBiYWNrZ3JvdW5kLWNvbG9y

OiAjZmZmZmZmOyI+Cjx0cj4KPHRkIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJwYWRkaW5nOiA0MHB4

IDA7Ij4KPGgxIHN0eWxlPSJmb250LXNpemU6IDI4cHg7IGNvbG9yOiAjMzMzMzMzOyBtYXJnaW46

IDA7Ij7wn5KWIERpc2NvdmVyIFlvdXIgSWRlYWwgUGFydG5lciBvbiBIZWFydENvbm5lY3Qg8J+S

ljwvaDE+CjwvdGQ+CjwvdHI+Cjx0cj4KPHRkIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJwYWRkaW5n

OiAwIDQwcHg7Ij4KPHAgc3R5bGU9ImZvbnQtc2l6ZTogMTZweDsgY29sb3I6ICM2NjY2NjY7IGxp

bmUtaGVpZ2h0OiAxLjY7Ij5HcmVldGluZ3MsPC9wPgo8cCBzdHlsZT0iZm9udC1zaXplOiAxNnB4

OyBjb2xvcjogIzY2NjY2NjsgbGluZS1oZWlnaHQ6IDEuNjsiPkZlZWxpbmcgZXhoYXVzdGVkIGZy

b20gdGhlIGVuZGxlc3Mgc2VhcmNoIGZvciB5b3VyIHBlcmZlY3QgbWF0Y2g/IExvb2sgbm8gZnVy

dGhlciEgSm9pbiBIZWFydENvbm5lY3QgYW5kIGVtYmFyayBvbiBhIGpvdXJuZXkgdG8gZmluZCBt

ZWFuaW5nZnVsIGNvbm5lY3Rpb25zLjwvcD4KPHAgc3R5bGU9ImZvbnQtc2l6ZTogMTZweDsgY29s

b3I6ICM2NjY2NjY7IGxpbmUtaGVpZ2h0OiAxLjY7Ij5BdCBIZWFydENvbm5lY3QsIHdlJ3JlIG1v

cmUgdGhhbiBqdXN0IGEgZGF0aW5nIHBsYXRmb3JtLiBXZSdyZSBkZWRpY2F0ZWQgdG8gaGVscGlu

ZyB5b3UgZGlzY292ZXIgeW91ciBpZGVhbCBwYXJ0bmVyLCBzb21lb25lIHdobyBjb21wbGVtZW50

cyB5b3VyIHBlcnNvbmFsaXR5IGFuZCBhc3BpcmF0aW9ucy48L3A+Cjx1bCBzdHlsZT0icGFkZGlu

Zy1sZWZ0OiAyMHB4OyBtYXJnaW4tdG9wOiAyMHB4OyBmb250LXNpemU6IDE2cHg7IGNvbG9yOiAj

NjY2NjY2OyBsaW5lLWhlaWdodDogMS42OyB0ZXh0LWFsaWduOiBsZWZ0OyI+CjxsaT48c3Ryb25n

PkN1c3RvbWl6ZWQgTWF0Y2hlczo8L3N0cm9uZz4gT3VyIGlubm92YXRpdmUgbWF0Y2hpbmcgc3lz

dGVtIGVuc3VyZXMgeW91J3JlIGludHJvZHVjZWQgdG8gaW5kaXZpZHVhbHMgd2hvIHNoYXJlIHlv

dXIgaW50ZXJlc3RzIGFuZCB2YWx1ZXMuPC9saT48YnI+CjxsaT48c3Ryb25nPkVuZ2FnaW5nIENv

bnZlcnNhdGlvbnM6PC9zdHJvbmc+IERpdmUgaW50byBhdXRoZW50aWMgY29udmVyc2F0aW9ucyB3

aXRoIGxpa2UtbWluZGVkIGluZGl2aWR1YWxzIHdobyBhcmUgZWFnZXIgdG8gY29ubmVjdCBvbiBh

IGRlZXBlciBsZXZlbC48L2xpPjxicj4KPGxpPjxzdHJvbmc+VHJ1ZSBDb25uZWN0aW9uczo8L3N0

cm9uZz4gQmlkIGZhcmV3ZWxsIHRvIHNoYWxsb3cgZW5jb3VudGVycy4gQXQgSGVhcnRDb25uZWN0

LCB3ZSdyZSBjb21taXR0ZWQgdG8gZm9zdGVyaW5nIGdlbnVpbmUgcmVsYXRpb25zaGlwcyB3aXRo

IGxvbmctbGFzdGluZyBwb3RlbnRpYWwuPC9saT4KPC91bD4KPHAgc3R5bGU9ImZvbnQtc2l6ZTog

MTZweDsgY29sb3I6ICM2NjY2NjY7IGxpbmUtaGVpZ2h0OiAxLjY7Ij5SZWFkeSB0byBmaW5kIHlv

dXIgaWRlYWwgcGFydG5lcj8gQ2xpY2sgYmVsb3cgdG8gam9pbiB5b3VyIHJlY29tbWVuZGF0aW9u

IGJ5IEhlYXJ0Q29ubmVjdCB0b2RheTo8L3A+CjxwIHN0eWxlPSJtYXJnaW4tdG9wOiAzMHB4OyBt

YXJnaW4tYm90dG9tOiA0MHB4OyI+PGEgaHJlZj0iaHR0cDovL2JpdC5seS80NHp0YjJLIiBzdHls

ZT0iYmFja2dyb3VuZC1jb2xvcjogIzExNTVjYzsgY29sb3I6ICNmZmZmZmY7IHRleHQtZGVjb3Jh

dGlvbjogbm9uZTsgcGFkZGluZzogMTJweCAyNHB4OyBmb250LXNpemU6IDE4cHg7IGJvcmRlci1y

YWRpdXM6IDMwcHg7Ij5DaGFybU1hdGNoPC9hPjwvcD4KPHAgc3R5bGU9ImZvbnQtc2l6ZTogMTZw

eDsgY29sb3I6ICM2NjY2NjY7IGxpbmUtaGVpZ2h0OiAxLjY7Ij5JZiB5b3UgaGF2ZSBhbnkgaW5x

dWlyaWVzIG9yIHJlcXVpcmUgYXNzaXN0YW5jZSwgb3VyIGRlZGljYXRlZCBzdXBwb3J0IHRlYW0g

aXMgaGVyZSBmb3IgeW91ITwvcD4KPHAgc3R5bGU9ImZvbnQtc2l6ZTogMTZweDsgY29sb3I6ICM2

NjY2NjY7IGxpbmUtaGVpZ2h0OiAxLjY7Ij5XaXNoaW5nIHlvdSBsb3ZlLCBsYXVnaHRlciwgYW5k

IHVuZm9yZ2V0dGFibGUgY29ubmVjdGlvbnMsPC9wPgo8cCBzdHlsZT0iZm9udC1zaXplOiAxNnB4

OyBjb2xvcjogIzY2NjY2NjsgbGluZS1oZWlnaHQ6IDEuNjsiPlRoZSBIZWFydENvbm5lY3QgVGVh

bTwvcD4KPC90ZD4KPC90cj4KPHRyPgo8dGQgYWxpZ249ImNlbnRlciIgc3R5bGU9InBhZGRpbmc6

IDIwcHggNDBweDsiPgo8cCBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBjb2xvcjogIzY2NjY2Njsi

PlRvIHVuc3Vic2NyaWJlIGZyb20gZnV0dXJlIGVtYWlscywgPGEgaHJlZj0iaHR0cDovL2N1dHQu

bHkvOHc1WWFvWVciIHN0eWxlPSJjb2xvcjogIzY2NjY2NjsgdGV4dC1kZWNvcmF0aW9uOiB1bmRl

cmxpbmU7IGZvbnQtd2VpZ2h0OiBib2xkOyI+Y2xpY2sgaGVyZTwvYT4uPC9wPgo8L3RkPgo=



--===============2302785460182536916==--

I1.01KLLD37.4KI2.18KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 May 2024 04:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s50p7-00000000DLV-01Z9

for dave@doctor.nl2k.ab.ca;

Thu, 09 May 2024 04:16:25 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 May 2024 04:16:24 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f194.google.com ([209.85.221.194]:43355)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4vGj-00000000DsB-39yj

for www@nl2k.ab.ca;

Wed, 08 May 2024 22:20:37 -0600

Received: by mail-vk1-f194.google.com with SMTP id 71dfb90a1353d-4df7ba13412so254636e0c.1

for ; Wed, 08 May 2024 21:18:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1715228313; x=1715833113; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=dADsO8o8dGW4L62NDBdaep7mT9RnqDrc8B6/4hPIhs0=;

b=GtZmo0I217JQC5pS3m4aHHD+SJ2yAYBsoBcynCg59FSoVIwn0JVyKEvhK9ZOMUGHtV

KS8TrApMt7uiBh/McIIwLSicRKBQnsbMZLN849VQkcWStvrKWz7+hJKc7f96R098ELf/

CppyOoQ2d9zMkU3njjDJ0bj4+oCfRoJzOh+kjAlXTfCvTe7EjEkGix8cz0hU/ZG8quND

iInbQDGSPz89HQ9fU5dC+j2wyjVlpsIElIUQkIvMmorRMV4bHLByZf+NyicJix3udmGX

1heTdeUMNZae7tWI8jQ1Czn3eV7ivhHwkA+8V0Cxt10w435YtUyteevW3U9eTvIMW9Yl

WGUQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1715228313; x=1715833113;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=dADsO8o8dGW4L62NDBdaep7mT9RnqDrc8B6/4hPIhs0=;

b=VSpa8lUA23Zre2BiEilCslE9uYbS17oo/iswnhZQMlO51c+HkIR6VKdWRafFTmkALV

eA3pqvsTEQhpx8o6xBf+dgndcsUJV5OZhZa1RUFO1zztSRZvwawxdymHOWPJ5ww8H0I9

SwhJiJv07q8j4s/ILwC0+IWYacQseBbcs9ohfWTUtemBAhAZawPLXM6j3IkD0fH0Yf5a

1xBp9o1LfkKBvYKkpym/tATD1i3ld3IItiZ9SLUORbanEYJCK+6hHoD9GpiivHQaPS9y

3LGiZ/E5M7axFGGNz+FbZSOk0vOkXkYweyWH31TOJD+DL7W38/0W3kxv4PNiDKRbM+J5

biHw==

X-Forwarded-Encrypted: i=1; AJvYcCULL+gJ6tNzBjNFwObtgvZi5KGgOOYv814hJUzFiAp01ML9JWgpNDWcvyQFqEH8bcAOb+6FwhuX0c5IcWDiSA==

X-Gm-Message-State: AOJu0YzuDsCR8R0yWRFjJ1YYRpBnxfjju8MSbpnRYAU28h0dGU+HuoRn

EMC6kjz0hIgGxQdnbSPjPK21yKGK8JStGn1+tgVzsYPYV4KhHH53mvXWqkkvq06JLSWjpYLS9KE

UI56+RAXEU1pQaC9bxxM2QAEgGXnPIMseckKIMD0H6SAVuQ==

X-Google-Smtp-Source: AGHT+IFvHm7/8KxcqoVwkxu70SxPdD+EJvcGAA/f9sxopPToFeFezrb+VDN663Z+rdr/STwQ7bO+RHQiScJKamTHORw=

X-Received: by 2002:a05:6214:242d:b0:6a0:ea1e:833d with SMTP id

6a1803df08f44-6a15cc69205mr28507446d6.27.1715227831789; Wed, 08 May 2024

21:10:31 -0700 (PDT)

MIME-Version: 1.0

Reply-To: lindabenson666666@gmail.com

From: Linda Benson

Date: Thu, 9 May 2024 05:10:14 +0100

Message-ID:

Subject: Hello

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000009f71340617fd99a5"

Bcc: www@nl2k.ab.ca

X-Spam_score: 24.6

X-Spam_score_int: 246

X-Spam_bar: ++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear friend, I need your help I have an inheritance worth

$2.9 million US dollars that requires the help of a capable foreign partner,

please help me out of my present predicament to continue my educa [...]



Content analysis details: (24.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.221.194 listed in dnsbl.ahbl.org]

[209.85.221.194 listed in dnsbl.ahbl.org]

[209.85.221.194 listed in dnsbl.ahbl.org]

[209.85.221.194 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.221.194 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.221.194 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.221.194 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.221.194 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.194 listed in will-spam-for-food.eu.org]

[209.85.221.194 listed in will-spam-for-food.eu.org]

[209.85.221.194 listed in will-spam-for-food.eu.org]

[209.85.221.194 listed in will-spam-for-food.eu.org]

[209.85.221.194 listed in will-spam-for-food.eu.org]

[209.85.221.194 listed in will-spam-for-food.eu.org]

[209.85.221.194 listed in will-spam-for-food.eu.org]

[209.85.221.194 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.194 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.194 listed in list.dnswl.org]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[lindabenson3304(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[lindabenson3304(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[lindabenson666666(at)gmail.com]

3.6 NA_DOLLARS BODY: Talks about a million North American dollars

2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!

0.0 HTML_MESSAGE BODY: HTML included in message

2.9 YOU_INHERIT Discussing your inheritance

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Hello



--0000000000009f71340617fd99a5

Content-Type: text/plain; charset="UTF-8"



Dear friend,

I need your help I have an inheritance worth $2.9 million US dollars that

requires the help of a capable foreign partner, please help me out of my

present predicament to continue my education which was interrupted by the

sudden death of my parents

I wait for your reply for more details

Thanks



--0000000000009f71340617fd99a5

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear friend,
I need your help I have an inheritance wor=

th $2.9 million US dollars that requires the help of a capable foreign part=

ner, please help me out of my present predicament to continue my education =

which was interrupted by the sudden death of my parents
I wait for your =

reply for more details
Thanks




--0000000000009f71340617fd99a5--

I1.01KL0LD37.4KI2.18KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Romance spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 May 2024 04:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s50qT-00000000DXu-33dl

for dave@doctor.nl2k.ab.ca;

Thu, 09 May 2024 04:17:49 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 May 2024 04:17:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dm6nam10olkn2071.outbound.protection.outlook.com ([40.92.41.71]:5088 helo=NAM10-DM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4yVy-00000000Gis-1P4m

for doctor@nk.ca;

Thu, 09 May 2024 01:48:35 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=PJQCuK0gtTDc8J1yprfP0kL0phEdrfEf8wUkzM6/lip4iQ599u00WU+pgK+5m4e7UpBNqVCO1UUfXUrhAtK6nluGaSXiHesRLEiAIUDsER23XR8fkb5LVnZQgRZuKayKZBQI7OVMopGXDm030V6E8T5LRYIKjqb4lU7F1BWWSBPTqa/acIyE3eSf3YvJZsoKJS9JjIWrg4likh4lOmyJ/w/s/0EDFbljXoVB1rgbNHS+8icHo2nbOYdo3tNY7NBo11ioEpYcwsN9w0rH/vcUl5altTpDk2d9UHmoNEh/26/yJ8kGLw7I7GsPv4isvDtG61JUFmCxc2Oke0JR4QDjFA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=8u3slUMpA5iXalhy+ywCFqDvqEHKHmD5QJEOtldKMxQ=;

b=hV5YV3L8xDi2bID/XDAsE28rwAS3UiYzdBFjdVAeXIp4QmGnoSD4h4yNBSfFNpyg14gDtCjbM2oEmhVrkmbKCF52ZinGl831V8QCn8CnwERf8PtDoBrzCWK4zK9jTux3291YAUlgCaYNrEqHOsmoOE8ctuhufNwoAWQcG3YmZiWSEM8WHIPbrs0llSvWvvxznwJn7CtALg490fClCVC1kjUpi4Ih1zOfVUutakd9GR635eLoyrsN9TAon6MYRfxTb1JE6nayqBL/XmIhCAdSpDGLFLOHz0L27NA5Rt4g5jqOE/og2HvWDT01CAje6+vZ3EJs7tArOpS57Sv0bsYYJg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=8u3slUMpA5iXalhy+ywCFqDvqEHKHmD5QJEOtldKMxQ=;

b=tEzk9W0o1Fh3oV8drEOZRoE4DVV5u4/EliRNQGSHk0UfiwURqEwUX8MnwuE51WjQP+S36gtJLlbbRi5EDwCKf2p9VLmxIth2KgKADrf92+R6ItPeAtZ3q2xw9FopJ5X6W4G9yv2dvi7T3er9lNB0aOfLPKiF5CYTaVmw1/4ooQw/rlv1I1eBzdW9u63JH6laYT0J7eyujr4Ka2+8p8wWryvtNctzG+HVU5hO1pkrO9j2FCnJT55cnCgQj2xoOGmljoifbwmO3iNQv/bIoifwHotWwDiFVUMrKcbbrTU+Mm/2RmXdHGiR3STrbRe+5vSQTs5Q+N70Rq8OGhi5BuW22Q==

Received: from PH7PR20MB4265.namprd20.prod.outlook.com (2603:10b6:510:139::15)

by CH3PR20MB6471.namprd20.prod.outlook.com (2603:10b6:610:15a::15) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7544.47; Thu, 9 May

2024 07:46:21 +0000

Received: from PH7PR20MB4265.namprd20.prod.outlook.com

([fe80::7655:e2c7:7be7:755c]) by PH7PR20MB4265.namprd20.prod.outlook.com

([fe80::7655:e2c7:7be7:755c%6]) with mapi id 15.20.7544.046; Thu, 9 May 2024

07:46:21 +0000

Content-Type: multipart/alternative; boundary="===============2302785460182536916=="

Subject: Your friend mentioned you in their story.

From: CharmMatch

CC: CharmMatch

Date: Thu, 9 May 2024 07:45:19 +0000

X-TMN: [A90Xmqtgy5793fHevhSua8uRjhLnJknt]

X-ClientProxiedBy: FR2P281CA0099.DEUP281.PROD.OUTLOOK.COM

(2603:10a6:d10:9c::9) To PH7PR20MB4265.namprd20.prod.outlook.com

(2603:10b6:510:139::15)

Message-ID:



MIME-Version: 1.0

X-MS-Exchange-MessageSentRepresentingType: 1

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: PH7PR20MB4265:EE_|CH3PR20MB6471:EE_

X-MS-Office365-Filtering-Correlation-Id: 6c8200cb-35f4-4587-f6a3-08dc6ffc1dc2

X-Microsoft-Antispam:

BCL:0;ARA:14566002|9400799015|42300799006|461199019|3412199016|440099019|4601999003|1602099003|56899024|2406899030|1710799017;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?V2lrNW9nOXliZ2V5QnNyWmtkV3VER21qUktNRkt6UmthZ1pMYS82VjY2ZVhs?=

=?utf-8?B?bVZSQm9wQ3pORUd0MlZaNEt6WmFxNFRYMVNaNDkxV0kvU2ZDRTFVUTUrSzVw?=

=?utf-8?B?VmJiUk9ZcHh6ZGRHdHkzeHRhejVJMGFEK2hXdmJGRUo0SUNMSzUya0VwVTJS?=

=?utf-8?B?S0YweWFCTW53WDJMMlF3dUUvRXE3a2l5SzhjRDZnT2t1WEttNk1iSlJSNzRa?=

=?utf-8?B?c1N2VTI3NGk4c3Z5WE5yZm1sb2N0UWxGYnE1K0RwS1ROenh2WkI2WjQvbEdC?=

=?utf-8?B?Unk4cWNBQzY4ZmVTeVRVYmowUnBuMTJCeUNTcjhPOGpudjAvMkpRWmFIZHJx?=

=?utf-8?B?bW9pNVIxQjhGTzlLUTY3NThMdm4rOUFRbnRXQjd6SEtpVjBMRzZ2cmFPRlU2?=

=?utf-8?B?MWFvaDYvSFJJVWRiWjNSV2FKclpCUXY3NHF5by9KK2h6VjdZSDNCT1JhQUR0?=

=?utf-8?B?YnVzdWdHeks0aytUR09meVNpam0rYUR0bE9mY0d4bStEdUUxa1dyS3NFSXZZ?=

=?utf-8?B?VnA2Y3FZMzhvU01LUGtnQ1NPT2RDU0VYeWo2cDRVcGRyZjdKMXNZQzVPWEZr?=

=?utf-8?B?a2gxM1ppZSszRE1zb1czWE0xVGdXMi9SMnZZaGRDblFRenVpWWcvL2Y4TElC?=

=?utf-8?B?blg2RHBRZGNJc2pydFdRZjdEOVlOQkgvU2lTNWN5OTloK0xUSjY0ZU9OZVVW?=

=?utf-8?B?YlFONVVOd3JPcndhWlJIaWp5ejcxbkEybGQ1aEFTUi96K3VZVm9nTWk4Ykp4?=

=?utf-8?B?UmV0MEgzYXp2aC9LOE9TSThUVDRUVm9BdXJyTWpnaUJNcE10TVBuRzdwd1FZ?=

=?utf-8?B?cGJkUXFoY2hlSytyMlprMHBkamllNzM5bHBzdkdYSERQd0hZcDNkS0xjZ2pQ?=

=?utf-8?B?NlQ5SENuR2R0ZWhINkx3OUJranVObCtjU2h4MW9VZHZYeEJlc00ycjNkZ2VK?=

=?utf-8?B?KzhySWxYN3dzVVo1NHNOOFNGWWxQY0VvRHd0Z1gzOURueWw2L3I3T3hFM0ZW?=

=?utf-8?B?UUJ4TkJVeTlacVAvR3dqRFFyM1F0aFJiTVBXQ3llb2VyQ1N1VkJvZFkxWjlB?=

=?utf-8?B?L041T0YxTy8zZVZ6Q01vR0JtOHJDL1I0bzJQaTAzMlpYajd3NVdubXJJRTgv?=

=?utf-8?B?cUZkRUtNeFJJeG9HMGJFQkJta0hhNisxdVBsdGRDS0o0NlNDWVM1RjhuRmpJ?=

=?utf-8?B?amxZZUFNM2xGc3RZKzdBcS9CU3dDMEdFUkV3N1pHcE5mR3A0b2tFNFIzbjQx?=

=?utf-8?B?dEh4Q2s4LzBZMHVHbWU4Nmgva1B6MThCWFhSMGhHSW9UWm1kalpXcVYwVEtS?=

=?utf-8?B?bHJBVHJML1dxRjB2MHU2bmpxSmJPNXlFdG9KaGZQZ3huU0RlODlIY2xyTkJY?=

=?utf-8?B?VkgvaFVGN3k2MXJQbTdJU1dKSW5wSkQxY2M5cVhCNnR4WCtlRWxSYTkxWHdI?=

=?utf-8?B?UGk4OVZ5WWJpbmI2ejBucmsvVHlBa3A3MjZSVVhHejloWjdueXByL1Yya2Vw?=

=?utf-8?B?OVhKNUVNVU5KK1dleVdKVVJrMUZxWENibTNlcHg5Zm9hVGFDaE1aNlppbldE?=

=?utf-8?Q?xnJ10or9x2yAgLN8RDAA3j3mDqhyViksp6i5LCbGWv9ZAZ?=

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?SlkvTndPOXpIdVV6ZXNCOXNJNy85MytmOWlwenZvcUVrZ1FnRUVJaXBLNnIr?=

=?utf-8?B?OE8wT29yampMSGl0dkdsMUthYU85cXg2ZkFvZEl3c1FUTCtrVzNENkxPUGxQ?=

=?utf-8?B?eUs5bERLOUVmQWtzZGF3SEVWU2k5UlY3MWNJVXFZWmV2bUpnVjAvWk9lWTZ4?=

=?utf-8?B?akpreHFZSkZaK2dpSmxVQjZCcFowVXo0aHVCT0d4dnNlZUVpR200NU9oUkE4?=

=?utf-8?B?d3ZIQlh5eVQzTG5FejFSTXc5aDQvMkN6b01sQlFRYWk1dGJ2NGM0YjJRQXk3?=

=?utf-8?B?SEFnUjRmNG1nYWJaS2E4OXhJdTlVdFN0MCtXdDB0ZHZGUlBBY2tMQ1JDSVUr?=

=?utf-8?B?WjdYUjA4Umt3cUlZK2ZmelFyayswdTZtYUhDOXlXMEwwQ0oxWUFDR0xDYXJO?=

=?utf-8?B?TFBzNEtCQ0dEYnYrVUtDTFBxTXEwNVFhcEpWVjBhQ2txTE52ZWJ3dVc5YW16?=

=?utf-8?B?Wk9lZVZZNVZCVmhETElsNXplSHFmRXBRSi81WVNveWdwTi9tcWw3eEM5d2M5?=

=?utf-8?B?NS9ibzB4RjE2NEo3UFprTGw3cjI5K2RGb25rOWZ0bEk2Q21mR1JXNkEyanJT?=

=?utf-8?B?MEREaXBMZXpNSnR4cFVUQ20ycEF1N3JxQXpqWHpzbUlCQVl3VFNVK1pZOXEy?=

=?utf-8?B?RWdRVDgxRFlKVEl5b29pN2JLb2d1ejd3OHU0S085eEdZbDZEVHVGSmhJdi9S?=

=?utf-8?B?VjBWRk1Od0tZWXMyUkkzOVByMUovRkRVbW0wQjRYS0MvVEs3NHE3V0w3Mk5S?=

=?utf-8?B?N1dQTFBmdlVWVmN1Q095c3JtcGdWWk44RTdnWkFXSXBYUkR1anpaTnIrNGhT?=

=?utf-8?B?SitjMG5KUmhxZi9SUnozWlpubDBoUTQrWkY1VlJNL2FrYmE4RGszbEV4Nm5m?=

=?utf-8?B?L0gyUm9McHdzY3M5NUhGQVoyR3BDNXpLbURHbXdhNmlwUXlzNGsvY0JreXIw?=

=?utf-8?B?LzhUNjU5THhYdGhJVFFXcTI3czBIWjdud0R6YXNWVG8rYTV2SFNNQjd1eU1n?=

=?utf-8?B?NXp5SHRjYTczR3hqdVhQNEprMDJlY3Y5TCtqSW5lR1hSWDk5R3VkSk5kMmls?=

=?utf-8?B?MGZPTXkwZFV1Y2pvcDNpVThRaVY1K1Q5YUR6TWkwOTZPS0hsa0R3R3orSWlJ?=

=?utf-8?B?YWcrYWliYmhhYVk4VkpOYXdaVEQ1bXgyOXR2WUdid1pLOTQwS2M4M0RLOG1F?=

=?utf-8?B?WGZxQ08yMWFycW5SeCtNNDd1UHdUMmRxUTczT0JSbzY5Z0RvQ1lOMnBaRHhG?=

=?utf-8?B?QkZQVklpTURLMGFERjZXRExBVHV2OTdJcHplQnB2ZXRseGpvV2NsQktBWWxY?=

=?utf-8?B?WUROY1J4S21ESGQrcGpZQUxEVHdGcE1ObDRpdmhKTmJUT1I4cVo5QmVNWGRZ?=

=?utf-8?B?akxacVBZRGNXTzV4cWNnWld4Z1NzNmtCK0NTeFVvSkZiSWtBV3FSUXdSZmdV?=

=?utf-8?B?VmQ2cTNJeWhUYlRPYWdoRjJvOWp3RGNYcDJDQVZXc2tTaEtQSm5kQlArTElJ?=

=?utf-8?B?U2ZiSkpGL29PZjBreE95bmhLNlpGc3U5YXViYnFhZFpOdWRqaG1aZzJYRzlX?=

=?utf-8?B?Yit6TEVGcmQ3S0Zmdk9DbWpsQmRneFhUVW5RVjRLc08zRzI3bTZZeU1qdGZt?=

=?utf-8?B?SWc2a0tSclN2YWlzZDU0bUVIRko3S1RtMTV0TjlrdXAveXA0aTVWNGdXUW9o?=

=?utf-8?B?MVhHVFBHQVZtdnRoV2c4R1RKMFJ2czZZMTJHVGZIbzNmM1dNVDZSZG9nPT0=?=

X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-9803a.templateTenant

X-MS-Exchange-CrossTenant-Network-Message-Id: 6c8200cb-35f4-4587-f6a3-08dc6ffc1dc2

X-MS-Exchange-CrossTenant-AuthSource: PH7PR20MB4265.namprd20.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 May 2024 07:46:20.9504

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:

00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR20MB6471

X-Spam_score: 11.8

X-Spam_score_int: 118

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Discover Your Ideal Partner on HeartConnect 💖 Discover

Your Ideal Partner on HeartConnect 💖



Content analysis details: (11.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.92.41.71 listed in dnsbl.ahbl.org]

[40.92.41.71 listed in dnsbl.ahbl.org]

[40.92.41.71 listed in dnsbl.ahbl.org]

[40.92.41.71 listed in dnsbl.ahbl.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.92.41.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.92.41.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.92.41.71 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.92.41.71 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[40.92.41.71 listed in will-spam-for-food.eu.org]

[40.92.41.71 listed in will-spam-for-food.eu.org]

[40.92.41.71 listed in will-spam-for-food.eu.org]

[40.92.41.71 listed in will-spam-for-food.eu.org]

[40.92.41.71 listed in will-spam-for-food.eu.org]

[40.92.41.71 listed in will-spam-for-food.eu.org]

[40.92.41.71 listed in will-spam-for-food.eu.org]

[40.92.41.71 listed in will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:139:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.41.71 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[amilyahvittitoe20042816(at)hotmail.com]

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[amilyahvittitoe20042816(at)hotmail.com]

0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} Your friend mentioned you in their story.



--===============2302785460182536916==

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: base64



PCFET0NUWVBFIGh0bWw+PGh0bWwgbGFuZz0iZW4iPjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVpdj0i

Q29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPgo8bWV0YSBu

YW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxl

PTEuMCI+Cjx0aXRsZT5EaXNjb3ZlciBZb3VyIElkZWFsIFBhcnRuZXIgb24gSGVhcnRDb25uZWN0

PC90aXRsZT4KPC9oZWFkPgo8Ym9keSBzdHlsZT0iZm9udC1mYW1pbHk6IEFyaWFsLCBzYW5zLXNl

cmlmOyBiYWNrZ3JvdW5kLWNvbG9yOiAjZjdmN2Y3OyBtYXJnaW46IDA7IHBhZGRpbmc6IDA7Ij4K

Cjx0YWJsZSBjZWxscGFkZGluZz0iMCIgY2VsbHNwYWNpbmc9IjAiIGJvcmRlcj0iMCIgd2lkdGg9

IjEwMCUiIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiAjZjdmN2Y3OyI+Cjx0cj4KPHRkIGFsaWdu

PSJjZW50ZXIiPgo8dGFibGUgY2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIiBib3JkZXI9

IjAiIHdpZHRoPSI2MDAiIHN0eWxlPSJtYXgtd2lkdGg6IDYwMHB4OyBiYWNrZ3JvdW5kLWNvbG9y

OiAjZmZmZmZmOyI+Cjx0cj4KPHRkIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJwYWRkaW5nOiA0MHB4

IDA7Ij4KPGgxIHN0eWxlPSJmb250LXNpemU6IDI4cHg7IGNvbG9yOiAjMzMzMzMzOyBtYXJnaW46

IDA7Ij7wn5KWIERpc2NvdmVyIFlvdXIgSWRlYWwgUGFydG5lciBvbiBIZWFydENvbm5lY3Qg8J+S

ljwvaDE+CjwvdGQ+CjwvdHI+Cjx0cj4KPHRkIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJwYWRkaW5n

OiAwIDQwcHg7Ij4KPHAgc3R5bGU9ImZvbnQtc2l6ZTogMTZweDsgY29sb3I6ICM2NjY2NjY7IGxp

bmUtaGVpZ2h0OiAxLjY7Ij5HcmVldGluZ3MsPC9wPgo8cCBzdHlsZT0iZm9udC1zaXplOiAxNnB4

OyBjb2xvcjogIzY2NjY2NjsgbGluZS1oZWlnaHQ6IDEuNjsiPkZlZWxpbmcgZXhoYXVzdGVkIGZy

b20gdGhlIGVuZGxlc3Mgc2VhcmNoIGZvciB5b3VyIHBlcmZlY3QgbWF0Y2g/IExvb2sgbm8gZnVy

dGhlciEgSm9pbiBIZWFydENvbm5lY3QgYW5kIGVtYmFyayBvbiBhIGpvdXJuZXkgdG8gZmluZCBt

ZWFuaW5nZnVsIGNvbm5lY3Rpb25zLjwvcD4KPHAgc3R5bGU9ImZvbnQtc2l6ZTogMTZweDsgY29s

b3I6ICM2NjY2NjY7IGxpbmUtaGVpZ2h0OiAxLjY7Ij5BdCBIZWFydENvbm5lY3QsIHdlJ3JlIG1v

cmUgdGhhbiBqdXN0IGEgZGF0aW5nIHBsYXRmb3JtLiBXZSdyZSBkZWRpY2F0ZWQgdG8gaGVscGlu

ZyB5b3UgZGlzY292ZXIgeW91ciBpZGVhbCBwYXJ0bmVyLCBzb21lb25lIHdobyBjb21wbGVtZW50

cyB5b3VyIHBlcnNvbmFsaXR5IGFuZCBhc3BpcmF0aW9ucy48L3A+Cjx1bCBzdHlsZT0icGFkZGlu

Zy1sZWZ0OiAyMHB4OyBtYXJnaW4tdG9wOiAyMHB4OyBmb250LXNpemU6IDE2cHg7IGNvbG9yOiAj

NjY2NjY2OyBsaW5lLWhlaWdodDogMS42OyB0ZXh0LWFsaWduOiBsZWZ0OyI+CjxsaT48c3Ryb25n

PkN1c3RvbWl6ZWQgTWF0Y2hlczo8L3N0cm9uZz4gT3VyIGlubm92YXRpdmUgbWF0Y2hpbmcgc3lz

dGVtIGVuc3VyZXMgeW91J3JlIGludHJvZHVjZWQgdG8gaW5kaXZpZHVhbHMgd2hvIHNoYXJlIHlv

dXIgaW50ZXJlc3RzIGFuZCB2YWx1ZXMuPC9saT48YnI+CjxsaT48c3Ryb25nPkVuZ2FnaW5nIENv

bnZlcnNhdGlvbnM6PC9zdHJvbmc+IERpdmUgaW50byBhdXRoZW50aWMgY29udmVyc2F0aW9ucyB3

aXRoIGxpa2UtbWluZGVkIGluZGl2aWR1YWxzIHdobyBhcmUgZWFnZXIgdG8gY29ubmVjdCBvbiBh

IGRlZXBlciBsZXZlbC48L2xpPjxicj4KPGxpPjxzdHJvbmc+VHJ1ZSBDb25uZWN0aW9uczo8L3N0

cm9uZz4gQmlkIGZhcmV3ZWxsIHRvIHNoYWxsb3cgZW5jb3VudGVycy4gQXQgSGVhcnRDb25uZWN0

LCB3ZSdyZSBjb21taXR0ZWQgdG8gZm9zdGVyaW5nIGdlbnVpbmUgcmVsYXRpb25zaGlwcyB3aXRo

IGxvbmctbGFzdGluZyBwb3RlbnRpYWwuPC9saT4KPC91bD4KPHAgc3R5bGU9ImZvbnQtc2l6ZTog

MTZweDsgY29sb3I6ICM2NjY2NjY7IGxpbmUtaGVpZ2h0OiAxLjY7Ij5SZWFkeSB0byBmaW5kIHlv

dXIgaWRlYWwgcGFydG5lcj8gQ2xpY2sgYmVsb3cgdG8gam9pbiB5b3VyIHJlY29tbWVuZGF0aW9u

IGJ5IEhlYXJ0Q29ubmVjdCB0b2RheTo8L3A+CjxwIHN0eWxlPSJtYXJnaW4tdG9wOiAzMHB4OyBt

YXJnaW4tYm90dG9tOiA0MHB4OyI+PGEgaHJlZj0iaHR0cDovL2JpdC5seS80NHp0YjJLIiBzdHls

ZT0iYmFja2dyb3VuZC1jb2xvcjogIzExNTVjYzsgY29sb3I6ICNmZmZmZmY7IHRleHQtZGVjb3Jh

dGlvbjogbm9uZTsgcGFkZGluZzogMTJweCAyNHB4OyBmb250LXNpemU6IDE4cHg7IGJvcmRlci1y

YWRpdXM6IDMwcHg7Ij5DaGFybU1hdGNoPC9hPjwvcD4KPHAgc3R5bGU9ImZvbnQtc2l6ZTogMTZw

eDsgY29sb3I6ICM2NjY2NjY7IGxpbmUtaGVpZ2h0OiAxLjY7Ij5JZiB5b3UgaGF2ZSBhbnkgaW5x

dWlyaWVzIG9yIHJlcXVpcmUgYXNzaXN0YW5jZSwgb3VyIGRlZGljYXRlZCBzdXBwb3J0IHRlYW0g

aXMgaGVyZSBmb3IgeW91ITwvcD4KPHAgc3R5bGU9ImZvbnQtc2l6ZTogMTZweDsgY29sb3I6ICM2

NjY2NjY7IGxpbmUtaGVpZ2h0OiAxLjY7Ij5XaXNoaW5nIHlvdSBsb3ZlLCBsYXVnaHRlciwgYW5k

IHVuZm9yZ2V0dGFibGUgY29ubmVjdGlvbnMsPC9wPgo8cCBzdHlsZT0iZm9udC1zaXplOiAxNnB4

OyBjb2xvcjogIzY2NjY2NjsgbGluZS1oZWlnaHQ6IDEuNjsiPlRoZSBIZWFydENvbm5lY3QgVGVh

bTwvcD4KPC90ZD4KPC90cj4KPHRyPgo8dGQgYWxpZ249ImNlbnRlciIgc3R5bGU9InBhZGRpbmc6

IDIwcHggNDBweDsiPgo8cCBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBjb2xvcjogIzY2NjY2Njsi

PlRvIHVuc3Vic2NyaWJlIGZyb20gZnV0dXJlIGVtYWlscywgPGEgaHJlZj0iaHR0cDovL2N1dHQu

bHkvOHc1WWFvWVciIHN0eWxlPSJjb2xvcjogIzY2NjY2NjsgdGV4dC1kZWNvcmF0aW9uOiB1bmRl

cmxpbmU7IGZvbnQtd2VpZ2h0OiBib2xkOyI+Y2xpY2sgaGVyZTwvYT4uPC9wPgo8L3RkPgo=



--===============2302785460182536916==--

I1.01KLLD37.4KI2.18KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 May 2024 04:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s50r1-00000000Ded-1J39

for dave@doctor.nl2k.ab.ca;

Thu, 09 May 2024 04:18:23 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 May 2024 04:18:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wr1-f41.google.com ([209.85.221.41]:51506)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4xBG-000000004xO-2ZEk

for root@doctor.nl2k.ab.ca;

Thu, 09 May 2024 00:23:06 -0600

Received: by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-34da4d6f543so355066f8f.3

for ; Wed, 08 May 2024 23:21:08 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1715235661; x=1715840461; darn=doctor.nl2k.ab.ca;

h=message-id:date:reply-to:content-transfer-encoding:to:subject:from

:from:to:cc:subject:date:message-id:reply-to;

bh=AwXinqgvgtP1/k/fXq7WD2Qr+5QPkMZVhGeI3tObyh0=;

b=jdfeO2b5XxKBeaacz4hFDFhukXdw7xIBYDmFZwBxHBu7VTc/8TeK4LSxB9J52k+DC2

9I+N3FO4WpSbgFF8t6+uCSqpKQNcfdLn58+fvn53Yg/zUYyW40PtSQk4KFhPyQI60SLT

9W5GCHk+1K/LrR3Ssk+wVZCfYPltn482z9m6qiXep7UFt/nFeT3GN9BbH6GfeKkJAjvh

S8ULd197hbh4lFHheIuZ/bXi0sjBexLZVj7+Xs5+8u7EKDE4+LVEe0VxKk92IXs+WnQu

3PeSBZydXjApg8QaxH6qdvy8lDQdG3B+5phUYp+I8x5C8DVhcbJPoBbC38ijR5xcvTuM

frdA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1715235661; x=1715840461;

h=message-id:date:reply-to:content-transfer-encoding:to:subject:from

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=AwXinqgvgtP1/k/fXq7WD2Qr+5QPkMZVhGeI3tObyh0=;

b=rEeV6qvdw6h8kGaZ5giAv9CqRYln/qGGQcNiAWK2Kzo+aAYLMRckF/2FRLVFNGWbzu

0dLsCnJ2uW7gFBsML/Cyy/7m+RU+9nzfe5iWNU1EQ4PoVkxn2o3feHlPwFyqO7+8xVPn

neWyG8OSBki3/x9l9bTaKZrCV15NtE88w83fg2TRjzeY4ydqtFVA5Serb6BObbI22FGu

UVnELQrkS6zCOZ+K7SnhkmD5m/Vhk0EKPUGmdzEoUyR3zD6pogOzAey4jDkUB+wuy6ZJ

0UrZFOIDX8nAX5Hyvdo7jkelwESM1kfufI/tTWxc4NgCWwT9GlIDXiMhWj453ZGuKRUG

flyg==

X-Gm-Message-State: AOJu0Yyl9L5nTJsDCVqtk97j3AR3q2wrXadjWZKC+OngSeuRNX9oJ+hP

Dk0ulFmtjsFMlnq6KKWD/u8G7kRpSGOodPNNsuK5DFDdDnqjOUoYm/Cdtma8Mco=

X-Google-Smtp-Source: AGHT+IEh8xT9k9mZAuyWY2kO9b7CiX0HUu+Nm7p2qU/J383681mPKK0f/TZ48pA5mcwKVfnnU00AGw==

X-Received: by 2002:a05:6000:255:b0:346:dace:5310 with SMTP id ffacd0b85a97d-34fcade245amr2829467f8f.22.1715235661591;

Wed, 08 May 2024 23:21:01 -0700 (PDT)

Received: from DESKTOP-4RT1RIS ([105.112.106.42])

by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-3502b79bd7asm769873f8f.17.2024.05.08.23.21.00

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Wed, 08 May 2024 23:21:01 -0700 (PDT)

From: "Mr. Kofi Adomakoh."

X-Google-Original-From: "Mr. Kofi Adomakoh."

Subject: Re: 09.05.2024.

To:

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable

Reply-To:

Date: Thu, 9 May 2024 07:20:47 -0700

Message-Id: <09472024052007BA3E517A1A$A40785763E@gmail.com>

X-Spam_score: 14.9

X-Spam_score_int: 149

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Re: 09.05.2024. Hello My name is Mr. Kofi Adomakoh.



Content analysis details: (14.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.221.41 listed in dnsbl.ahbl.org]

[209.85.221.41 listed in dnsbl.ahbl.org]

[209.85.221.41 listed in dnsbl.ahbl.org]

[209.85.221.41 listed in dnsbl.ahbl.org]

[105.112.106.42 listed in dnsbl.ahbl.org]

[105.112.106.42 listed in dnsbl.ahbl.org]

[105.112.106.42 listed in dnsbl.ahbl.org]

[105.112.106.42 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.221.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.221.41 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.221.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.221.41 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.41 listed in will-spam-for-food.eu.org]

[209.85.221.41 listed in will-spam-for-food.eu.org]

[209.85.221.41 listed in will-spam-for-food.eu.org]

[209.85.221.41 listed in will-spam-for-food.eu.org]

[209.85.221.41 listed in will-spam-for-food.eu.org]

[209.85.221.41 listed in will-spam-for-food.eu.org]

[209.85.221.41 listed in will-spam-for-food.eu.org]

[209.85.221.41 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.41 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.41 listed in list.dnswl.org]

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[drscothlee(at)gmail.com]

2.5 HK_SCAM_N2 BODY: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.5 HK_NAME_FM_MR_MRS No description available.

0.0 HK_SCAM No description available.

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

3.0 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} Re: 09.05.2024.






8859-1">


le=3D1">=20

Re:=<br /><br /> =20<br /><br /> 09.05.2024.



Hello=

My name=20

is Mr. Kofi Adomakoh.

 I came across your e-mail contact pr=

ior=20

to a private search while in need of an honest and sincere person to=20=



assist and partner with me, I'm a banker here in ABSA Bank Ghana Ltd i=

n=20

Ghana West Africa, I want to use this opportunity to discuss  fun=

d=20

transaction deal  with you, the money in question belong to one o=

f=20

our customers who died on April 2020 on a complicated issue related to=

=20

(COVID 19) Coronavirus, the customer deposited the money with our bank=

=20

without any next of kin and I am the account officer of the late=20

customer. I need a reliable partner to move and invest the fund as a j=

oint=20

venture or we share it among
ourselves.

Reply for further and=

=20

detailed information.

I wait for your most urgent and swift=20

positive response.
Thank you and Warm Regards.
Mr. Kofi Adomakoh=

=2E



=20





I1.01KL0LD37.4KI2.18KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

spanish language spam from ovh.net

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 May 2024 01:56:00 -0600

Received: from vps-b9f69b13.vps.ovh.net ([51.195.216.240]:40298)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4tcQ-0000000001U-3K7z

for dave@doctor.nl2k.ab.ca;

Wed, 08 May 2024 20:34:55 -0600

Received: by vps-b9f69b13.vps.ovh.net (Postfix, from userid 0)

id 22EFD8965C; Thu, 9 May 2024 02:26:35 +0000 (UTC)

To: dave@doctor.nl2k.ab.ca

Subject: Notificacion de cuenta impagada (97448887)

X-Mailer: Outlook/91.8.0

From: Hector Garcia

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="158ec3dac52c9c05a5386891c846dcb3"

Content-Transfer-Encoding: 7bit

Message-Id: <20240509023059.22EFD8965C@vps-b9f69b13.vps.ovh.net>

Date: Thu, 9 May 2024 02:26:35 +0000 (UTC)

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ¡Descarga tu Recibo de Pago Urgente! Estimado/a Cliente,

dave@doctor.nl2k.ab.ca Hoy 09/05/2024



Content analysis details: (10.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[51.195.216.240 listed in dnsbl.ahbl.org]

[51.195.216.240 listed in dnsbl.ahbl.org]

[51.195.216.240 listed in dnsbl.ahbl.org]

[51.195.216.240 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[51.195.216.240 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[51.195.216.240 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[51.195.216.240 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[51.195.216.240 listed in dnsbl.ahbl.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: 180.236.205.92.host.secureserver.net]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[51.195.216.240 listed in will-spam-for-food.eu.org]

[51.195.216.240 listed in will-spam-for-food.eu.org]

[51.195.216.240 listed in will-spam-for-food.eu.org]

[51.195.216.240 listed in will-spam-for-food.eu.org]

[51.195.216.240 listed in will-spam-for-food.eu.org]

[51.195.216.240 listed in will-spam-for-food.eu.org]

[51.195.216.240 listed in will-spam-for-food.eu.org]

[51.195.216.240 listed in will-spam-for-food.eu.org]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.9 MANY_SUBDOM Lots and lots of subdomain parts in a URI

Subject: {SPAM?} Notificacion de cuenta impagada (97448887)



This is a MIME encoded message.

X-Priority: 1



--158ec3dac52c9c05a5386891c846dcb3

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 8bit

















¡Descarga tu Recibo de Pago Urgente!







Estimado/a Cliente, dave@doctor.nl2k.ab.ca  Hoy 09/05/2024





Es importante que descargues tu recibo de pago lo antes posible. Por favor, asegúrate de obtener una copia para tus registros. Te recordamos que esta acción es urgente y necesaria.





Por favor, haz clic en el botón a continuación para iniciar la descarga de tu recibo. Agradecemos tu pronta atención a este asunto.







Descargar Recibo




Factura: FAC 90620007


Data del archivo: 09/05/2024






codigo de validad 34713988







I1.01KL0LD37.4KI2.18KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 May 2024 00:56:00 -0600

Received: from mail-wr1-f53.google.com ([209.85.221.53]:54369)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4xZG-000000008Dt-0MOt

for dave@doctor.nl2k.ab.ca;

Thu, 09 May 2024 00:47:53 -0600

Received: by mail-wr1-f53.google.com with SMTP id ffacd0b85a97d-34d7a32bdd3so272333f8f.0

for ; Wed, 08 May 2024 23:45:55 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1715237149; x=1715841949; darn=doctor.nl2k.ab.ca;

h=message-id:date:reply-to:content-transfer-encoding:to:subject:from

:from:to:cc:subject:date:message-id:reply-to;

bh=AwXinqgvgtP1/k/fXq7WD2Qr+5QPkMZVhGeI3tObyh0=;

b=SbVDuh/f/6pWftNQsgudx6KkbcfUxNM9WWbBk6l+YhCysZIRdEZV7gg2IyEf/sWQ4M

Zpafi7C45mNUBt2Xh0WC4AsdlSi26wbX926x/XbUsaMrFfFaDU7nrm5NGZKDP+cxj09H

CIn6YIMAFYs/T18M9fiBXa/5zXaK1R38CPv9/D/xnav8vBvtldUo/l/YeJJrclhfD4Zb

FIE10kjilRsYPKXoTiJ48ODq7E7O3ghRh/7yRGO66SdwLdGStsEkZ4eAdH3IxSoqntJp

y/vxcYgOOfborVslFFZOpjQtgb/J4i0mZiM8KHUkBeDgmYZgHqUgQxjpj8+DYKiReeFs

Eneg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1715237149; x=1715841949;

h=message-id:date:reply-to:content-transfer-encoding:to:subject:from

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=AwXinqgvgtP1/k/fXq7WD2Qr+5QPkMZVhGeI3tObyh0=;

b=i2z81XZRjyBFQJuPRDGgF3V4iIj3+tWXC148jOvZZH4TFYIBQCUSRzXBVo72rDC+41

+muAgUSoX6G3q6zTFxo258G1GcqVC83tfJnIYIEpnZ3JtHBzJwGknNKgc2+Wj8cqx1fq

/EA3b3haToky9qhFagXFOMKrtEgK5gx/h2A+ups2g5Ei+el95LNoWVVSUMcuNTR/aBJG

YZJ1fuG38g/yMTMdXVddHSWNIG2K9Fi79aNn2luPjBg0Q9+BKR97+ohv2ybmnbkz1dqH

6yTB4lNydBjuPmojvybxY2NxOUSPJqR0X/wn6Axzva4N+l/ZjCDsrvc8JuX3OfKv57xI

0KrQ==

X-Gm-Message-State: AOJu0Yytesj6WKI6ylGk81CJWPGijaV8jj94wUWIymDg1Ujgxk9SdEha

Jx3U235rJFs76Bh1DP1FMuff16lVR6TT0KaV35vU3rS7nGKWFMYxrdXlXuVdnd4=

X-Google-Smtp-Source: AGHT+IELQhR+DXsRyXcNKYNDpwE9nSyQcY/lrM0bj3Ap4q6cdR4t4cwHtyo9ISClqE3xTh6NrMPjmg==

X-Received: by 2002:adf:fecf:0:b0:34c:6629:9962 with SMTP id ffacd0b85a97d-34fca42eb2cmr3253802f8f.30.1715235659852;

Wed, 08 May 2024 23:20:59 -0700 (PDT)

Received: from DESKTOP-4RT1RIS ([105.112.106.42])

by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-3502b79bd7asm769873f8f.17.2024.05.08.23.20.58

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Wed, 08 May 2024 23:20:59 -0700 (PDT)

From: "Mr. Kofi Adomakoh."

X-Google-Original-From: "Mr. Kofi Adomakoh."

Subject: Re: 09.05.2024.

To:

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable

Reply-To:

Date: Thu, 9 May 2024 07:20:46 -0700

Message-Id: <09452024052007607C2BEE3B-72656D399C@gmail.com>

X-Spam_score: 14.9

X-Spam_score_int: 149

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Re: 09.05.2024. Hello My name is Mr. Kofi Adomakoh.



Content analysis details: (14.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[105.112.106.42 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

[105.112.106.42 listed in will-spam-for-food.eu.org]

[209.85.221.53 listed in will-spam-for-food.eu.org]

[209.85.221.53 listed in will-spam-for-food.eu.org]

[209.85.221.53 listed in will-spam-for-food.eu.org]

[209.85.221.53 listed in will-spam-for-food.eu.org]

[209.85.221.53 listed in will-spam-for-food.eu.org]

[209.85.221.53 listed in will-spam-for-food.eu.org]

[209.85.221.53 listed in will-spam-for-food.eu.org]

[209.85.221.53 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[105.112.106.42 listed in dnsbl.ahbl.org]

[105.112.106.42 listed in dnsbl.ahbl.org]

[105.112.106.42 listed in dnsbl.ahbl.org]

[105.112.106.42 listed in dnsbl.ahbl.org]

[209.85.221.53 listed in dnsbl.ahbl.org]

[209.85.221.53 listed in dnsbl.ahbl.org]

[209.85.221.53 listed in dnsbl.ahbl.org]

[209.85.221.53 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[105.112.106.42 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[105.112.106.42 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[105.112.106.42 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[105.112.106.42 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.53 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.53 listed in wl.mailspike.net]

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[drscothlee(at)gmail.com]

2.5 HK_SCAM_N2 BODY: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HK_SCAM No description available.

1.5 HK_NAME_FM_MR_MRS No description available.

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

3.0 ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} Re: 09.05.2024.






8859-1">


le=3D1">=20

Re:=<br /><br /> =20<br /><br /> 09.05.2024.



Hello=

My name=20

is Mr. Kofi Adomakoh.

 I came across your e-mail contact pr=

ior=20

to a private search while in need of an honest and sincere person to=20=



assist and partner with me, I'm a banker here in ABSA Bank Ghana Ltd i=

n=20

Ghana West Africa, I want to use this opportunity to discuss  fun=

d=20

transaction deal  with you, the money in question belong to one o=

f=20

our customers who died on April 2020 on a complicated issue related to=

=20

(COVID 19) Coronavirus, the customer deposited the money with our bank=

=20

without any next of kin and I am the account officer of the late=20

customer. I need a reliable partner to move and invest the fund as a j=

oint=20

venture or we share it among
ourselves.

Reply for further and=

=20

detailed information.

I wait for your most urgent and swift=20

positive response.
Thank you and Warm Regards.
Mr. Kofi Adomakoh=

=2E



=20





I1.01KL0LD37.4KI2.18KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 08 May 2024 23:56:00 -0600

Received: from mail-qv1-f67.google.com ([209.85.219.67]:43171)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4v8y-00000000CoP-1nry

for dave@doctor.nl2k.ab.ca;

Wed, 08 May 2024 22:12:37 -0600

Received: by mail-qv1-f67.google.com with SMTP id 6a1803df08f44-6a0ff97a9c7so11986826d6.0

for ; Wed, 08 May 2024 21:10:37 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1715227832; x=1715832632; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=dADsO8o8dGW4L62NDBdaep7mT9RnqDrc8B6/4hPIhs0=;

b=gmTHc37xZq8IRShT6GIG8nb3NmE5H2aRJ5egNwl43TrB0QI1/zvxSTSn1w00vwBbWi

FJaRZ+BMtnddFkoKhtJY1Ggj+E1SPqzxXgEE5DlZgMIhQ4PKJFLHjoUUQ8VokMajFFoZ

K+MgEbERK1DZkImwKtJWJOnuH5TboMp+sdS7QHx7vD7zHYI1KT98/fsgdQpumth/xyqu

n73vk3dRUJcG0vmwLSTEXh84pxYM+gstyKgnPXRk3zAgXT67DWk63YFc2pHbTWf1Cfrd

P4vIDzcTK0iKjUhNYA5DyuqC85ecSwYlYvueBgB8s3wD+12HPjb883g0RFR/94YcsBd+

V3uQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1715227832; x=1715832632;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=dADsO8o8dGW4L62NDBdaep7mT9RnqDrc8B6/4hPIhs0=;

b=j3AnJYwbYjmpa/Fyer1Ip3UQrxR/DGg970gDx1TU9E69nJo3CDagNTd87N0ygkr+aR

uGZUgM4G2VUK0J1tctZj5FVPmMYIfmPLyIs9mrccwdX2DvztSwgEPbgYXzl1Bh6ToT71

6hfsDogM7oYKyQdDewnOeCgNJ+n8m+98Ppe650vc+A+2D+hrjB+DTeV301Z1/2xAIRxp

GaMLpPyotjD8puvahGgf1qIe6AYAregqbxe1oqUN6hv2SVBuBN8q3Put6I/s1KBtfsVA

438+73nGCAL3FuGLQcTkHAT4CB8ThP3fISMas/5oflMc6RS21OKFoI73PfbhLRi7R6tR

fw/A==

X-Forwarded-Encrypted: i=1; AJvYcCVfgtak2sfhIk1EQWD+QzHcdA8PjfOaVajARStfpnOt0PDT+T+iw2RAsSz3AcP/ap281lO7qc+xut2vNoQS+d186udCiyxf

X-Gm-Message-State: AOJu0Ywu3L9ZhnOKe/l/Su4A8hZIvsQWDjqGpJp6/NgiD6p2C3dssu1W

WC1D6VXD6UkPZiESEcS8FcMSPD4xbBbGrfse709LLNewOckl38lHrx+jP8Uh3mDaE9wx/XyZNEJ

a+wsmNFghzGIkGrbgOjCsZ41Jf3E=

X-Google-Smtp-Source: AGHT+IFvHm7/8KxcqoVwkxu70SxPdD+EJvcGAA/f9sxopPToFeFezrb+VDN663Z+rdr/STwQ7bO+RHQiScJKamTHORw=

X-Received: by 2002:a05:6214:242d:b0:6a0:ea1e:833d with SMTP id

6a1803df08f44-6a15cc69205mr28507446d6.27.1715227831789; Wed, 08 May 2024

21:10:31 -0700 (PDT)

MIME-Version: 1.0

Reply-To: lindabenson666666@gmail.com

From: Linda Benson

Date: Thu, 9 May 2024 05:10:14 +0100

Message-ID:

Subject: Hello

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000009f71340617fd99a5"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 24.6

X-Spam_score_int: 246

X-Spam_bar: ++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear friend, I need your help I have an inheritance worth

$2.9 million US dollars that requires the help of a capable foreign partner,

please help me out of my present predicament to continue my educa [...]



Content analysis details: (24.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

[209.85.219.67 listed in dnsbl.ahbl.org]

[209.85.219.67 listed in dnsbl.ahbl.org]

[209.85.219.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.219.67 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

[209.85.219.67 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.67 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.219.67 listed in list.dnswl.org]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[lindabenson3304(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[lindabenson3304(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[lindabenson666666(at)gmail.com]

3.6 NA_DOLLARS BODY: Talks about a million North American dollars

2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

2.9 YOU_INHERIT Discussing your inheritance

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Hello



--0000000000009f71340617fd99a5

Content-Type: text/plain; charset="UTF-8"



Dear friend,

I need your help I have an inheritance worth $2.9 million US dollars that

requires the help of a capable foreign partner, please help me out of my

present predicament to continue my education which was interrupted by the

sudden death of my parents

I wait for your reply for more details

Thanks



--0000000000009f71340617fd99a5

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear friend,
I need your help I have an inheritance wor=

th $2.9 million US dollars that requires the help of a capable foreign part=

ner, please help me out of my present predicament to continue my education =

which was interrupted by the sudden death of my parents
I wait for your =

reply for more details
Thanks




--0000000000009f71340617fd99a5--

I1.01KL0LD37.4KI2.18KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Chinese products spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 08 May 2024 18:27:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4rcG-000000005X1-3oNB

for dave@doctor.nl2k.ab.ca;

Wed, 08 May 2024 18:26:32 -0600

Resent-From: The Doctor

Resent-Date: Wed, 8 May 2024 18:26:32 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreacentralazolkn19010001.outbound.protection.outlook.com ([52.103.74.1]:37110 helo=SE2P216CU007.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4rak-0000000050q-1GqZ

for doctor@nl2k.ab.ca;

Wed, 08 May 2024 18:25:03 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=FhV2/EdT5KiIV+6yc1/zgHPeGW2l7v3YsQo35zPDSLEc76JO6BOtewknf2pHowQi144x/mly9t+tYtXJmpPLugXfl/xB16YKF//DoUC9d9Xljq1Kmi1efLd9i+8wKqi/bnUfieS8tW8NowFaAhgjrZLFShDrbRcBntXGaC+DxWnc2+Ey2tgExe1AqLk2/Iq77Y8O1g4lDE5DFP+WoTf7iHzA1zsL4MXGRV3PddCl/0f7IABOoRfGaJOjhNXSQ77jIkN02Ip/iUQugXaTMADcrcn0aEJ0jBs3JNS/GrRqu/lfi9REHXePfrrJFK9HNjH6ohaygYyhL93MYqUHuFsH+g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=aEU5yZrw76XsejU6pDL2Z+ZfATh2E8IKwDl12vcmd1M=;

b=cG1owV/jWDcsyw23N1b4PN2KOnc91TZhHGkl/qf8mz9KJl0QOe08sADD3qklmADqNU+VjcoUdMdaItjOdc4zgIv8dAWGJ6Bvzy44HDRRajCcO/8Y6h3i6VLaRw5uuBafKqNWogLMGgSdjPw7jbYCxfQ7DKo2comc+0nxRyAcDfZWXn7wqTPhs6rB/N4F8BIL76b6OhZfFM+pTDLIbcPy8brFufoFpchhr4Snp7NvmKQUSmdF184y/KF08k2dhlQNmwwzAoEi72rXRNlrWiuKbi7n7Cv12IsQfQK25TL9uBbbR3cLztwt7FHdKHx/eEkk7uUVRBB1d9n7qIrYt34+9Q==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=aEU5yZrw76XsejU6pDL2Z+ZfATh2E8IKwDl12vcmd1M=;

b=e6ZQSiwngQvZO6kjXV0NcWHwUGNwVi3PjcXLKM6UOhI8ZcxcS0dMYuWXZVF7w8JQcOR8nGlumQQvfxqcsZ2R6EShLZq1CR8QRMZk9JydQJlxnSuZvFoE+ZF7VjmDE8VfTuA/Tqt+G7t5dkWRmx/ToMQLmUN/2o5cJg+ylr7UVibLsU0veoSw2m1Ia0pMEF5jnTC6wt1mFKw9uFVVyO4AzlmND0/NknuLuNkQWNnG5dUhFhRzLIUURhQpNuXhFfP7PCkPuxvHLqo7a7xWpfWFO7lwnOyqmGjSxdU1KQgUkz1OGIh8UdbU+ge8c3bYdeZVAyVzUpCO8AZsN8yIqT99WA==

Received: from SL2P216MB1903.KORP216.PROD.OUTLOOK.COM (2603:1096:101:100::10)

by PU4P216MB1273.KORP216.PROD.OUTLOOK.COM (2603:1096:301:a2::10) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7544.47; Thu, 9 May

2024 00:22:20 +0000

Received: from SL2P216MB1903.KORP216.PROD.OUTLOOK.COM

([fe80::f8aa:4358:9816:be20]) by SL2P216MB1903.KORP216.PROD.OUTLOOK.COM

([fe80::f8aa:4358:9816:be20%5]) with mapi id 15.20.7544.046; Thu, 9 May 2024

00:22:20 +0000

From: sales sales

Subject: Garment Supplier

Thread-Topic: Garment Supplier

Thread-Index: AQHaoabxX67LdASiAkmpKeqvpo0d+Q==

Date: Thu, 9 May 2024 00:22:20 +0000

Message-ID:



Accept-Language: zh-CN, en-US

Content-Language: zh-CN

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-tmn: [ooWQ3VFKBmyT1BRLWYOegtIRHBnFkPR3]

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SL2P216MB1903:EE_|PU4P216MB1273:EE_

x-ms-office365-filtering-correlation-id: 804faf7e-a3a8-4f2d-43e9-08dc6fbe1762

x-microsoft-antispam:

BCL:0;ARA:14566002|461199019|102099023|440099019|3412199016;

x-microsoft-antispam-message-info:

89bQX5z2d6ahJSa0T6yDbsnrmQdfsZVl0Sg+Y1mgOhbdcN2EpeFO0J6Ho0rLzlndSJ5P0fSQB0GFBe9Z802Fmsam9+Z0seelLJ+oFLVnsIZ1znDTThaQJowLZFgz48opuEcv+sGyboWlQILw15OIqR5bNEu0WwbvBJwT1BwLw6j7L/W6y330PVTpArhwJdATTQP6TcKAXpvV4Mggs5XoQ80EZb+EYiPYiQHuZzgs3Z4jTlohtE2Yc6vheQhR4Vqgq8EK+lCQGOgtg/6tUN0hV2JY1Gg1o5Ojp7/y1KzHwjosMFt/yP+qr8gvL+2U8rkj7v7aXiB7+IpRlTyflZe3iyTJrH7kVd1mRGjpuyiqpGrnzfzPD1qjUwo94MQkQL4pdFZ1Jtb1I4f5wX1sh2fb6/smA/gbm1w3eGg8PbTSukz2HwA+40tPgv8AEfuceDhad+Zg/X10RAiBQi9ygIYURBHqQMgJ5NS+cvX0qBghKF1/YGA26aRsJpt8B8pTRqcceW0KMBXBAuXTKuE78swvVUZOqCYoOLq6mRngcgB6SZ2sixThtT/Dz4xXuVob9WKN

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?gb2312?B?cU1mS0lOUkgvMG14empNS3JvSXkxMWFXRHJJY2pvc1FzbzNZWVJHZkZDMHJj?=

=?gb2312?B?anFSNVNOVUtkYXRpMzlReVhFMXNPb3NGSk1Ha3NMZWFQdzBQOFpndDVlN2xz?=

=?gb2312?B?TDJlRXpCSENxN0I5bWlkdXVxem5tTnZ1bmRRRWVicXgrS2s1MWU3MlVFWk9B?=

=?gb2312?B?YXM3UFZicnE4b1VzcTMvQXUzVnZhdXRhN2hiUmFBbU1CY05CMUd5em1kYm81?=

=?gb2312?B?d241VWZlREIzbFdUY2NiNWVES1IraVJONWlqV05KT3p4dkFkbWRFUDR2eVhO?=

=?gb2312?B?b3htMFF0T3BDd2xkMG4za1ZjR1ZiL2FPNHU4dSsyRXB5c0plMDhKdnRHVDNk?=

=?gb2312?B?Q1QyV05ad0N4SzRIV05ma2xnWUJ0RmZ4Q1JpU0NkTU1HMWpvb0dhUnh2WHd3?=

=?gb2312?B?WnVzL3VwOTdhTXZFTjlJa0k5clNoanpZUHpQZ3lJRG0vQ3hKeTNYVk1ZcDdh?=

=?gb2312?B?L01NMkhqbUNZaW5ldThLa241TDNvSER2WSszRm5wMldLVVB4Tko1cmlJMTBG?=

=?gb2312?B?WEpYTzNMelZFaCt0eFZCTmh1RTZKV3NDYlJkOENJVFR2cXdUYTRaVzI2bnJ1?=

=?gb2312?B?c0F5ejlSNU1UbDBoMkxJUGxRRjJZenZsOEkxUjdpckZmdUl4Rmczekd4NFhP?=

=?gb2312?B?cXY0SnkrVTNMQVR4K2R2Z1VSdFJDMWxvMUZGekFYVk5vc3NGZmRtZlQxR2M0?=

=?gb2312?B?SXJPdFo0OWxLaW9rRCtCVU5SN25zOVhaYUozOXRqZk15NTVTRzZaVkYzRGZt?=

=?gb2312?B?VmlSZU9weFJpYzlrTHo1aUFWMDE0K3VjY2QvYTRlU3p5bGYvcjgyb25ZSWlM?=

=?gb2312?B?bGR2V3RjTlFNTCtZeUxtWUhiVEJwZXUxZkJUTE5rNVlsajA3Rm96MUZsN0RF?=

=?gb2312?B?Vm1OYUsweUhoS3dDdGxLcFBuN3VzYmNsV3F3Szk0WSt1UWRGbVhoN1UxOWJj?=

=?gb2312?B?V0RpN29LWGM3bHlBYXdUb2JKdDMvaXhxVWg0TC9LYiszVC8xbHU0UHNvMHQ2?=

=?gb2312?B?SEVSZmJRcFlmQkRZN2ViZU1HdzZFU3I1ckpDSHZCOEdlVy9IMTNCK3hYVU1R?=

=?gb2312?B?ZVh4ejhpRHB2ejVQSzJ3bGhtYmxzOFpXYXRiYmlWZGM4NWdsZFpQRjRsRWtQ?=

=?gb2312?B?eDkrUjF0RDl1Tit6YkdQMEdPVzQra3V4MHZnUkx2a2plVlFONUVxUFZCdHpN?=

=?gb2312?B?T2haU0J5ZHdweGpGRmVPbndMcEJxZTN1OHo3SU94YnpQc0srOHNpWVE4M1BW?=

=?gb2312?B?U3JxcktvUGJlQ2R1V1c0cnFwRWx5V0FHWmlYaWlGaVppR2FLT0Y5S21YS25a?=

=?gb2312?B?VGJ5TUNpM3NoZ1ovWllJMWs4dEdTa09ZYTBzdFpPdGhiR2wwTTRPd05TeW9k?=

=?gb2312?B?d3Q5cGc3YmNlT0h1S3lUOFk4NzU2c1hnY0c4MWZheVlMUTUrQ3FYRkFmRnNN?=

=?gb2312?B?bEpXclNkYWF6aHpvbkYrS2IzaFJxbEZPMDNMcXVVcHp6cEtXNU5mZ3hYcWlr?=

=?gb2312?B?bTAvZkpqaWlNQVI4VXdmRktuMDNXamN4SkhHcmxYWlpIaFZyYkpwcm5xSHNn?=

=?gb2312?B?QS9IK0tpSTJ1MUtNWEsvL1REYnBNVDg4SDI0SmY5cGVFTFJacUJVT1dFM1Nm?=

=?gb2312?B?VldVM1NjSHFaNG1kMDNEWmN6NmxJaEE9PQ==?=

Content-Type: multipart/alternative;

boundary="_000_SL2P216MB19035EB582BCD2A096096D40ABE62SL2P216MB1903KORP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SL2P216MB1903.KORP216.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 804faf7e-a3a8-4f2d-43e9-08dc6fbe1762

X-MS-Exchange-CrossTenant-originalarrivaltime: 09 May 2024 00:22:20.5994

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PU4P216MB1273

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi There, Hope you’re in good health. I would like to introduce

our company. We’re Manufacturer & Exporter of Garment from China.Customize

designs, label & packing available. I’m sending our product catalog. If

you’re interested, we can provide you with a quote.



Content analysis details: (8.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.74.1 listed in dnsbl.ahbl.org]

[52.103.74.1 listed in dnsbl.ahbl.org]

[52.103.74.1 listed in dnsbl.ahbl.org]

[52.103.74.1 listed in dnsbl.ahbl.org]

[2603:1096:101:100:0:0:0:10 listed in]

[dnsbl.ahbl.org]

[2603:1096:101:100:0:0:0:10 listed in]

[dnsbl.ahbl.org]

[2603:1096:101:100:0:0:0:10 listed in]

[dnsbl.ahbl.org]

[2603:1096:101:100:0:0:0:10 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.74.1 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.74.1 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.74.1 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.74.1 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:101:100:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:100:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:100:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:100:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:100:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:100:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:100:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:100:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[52.103.74.1 listed in will-spam-for-food.eu.org]

[52.103.74.1 listed in will-spam-for-food.eu.org]

[52.103.74.1 listed in will-spam-for-food.eu.org]

[52.103.74.1 listed in will-spam-for-food.eu.org]

[52.103.74.1 listed in will-spam-for-food.eu.org]

[52.103.74.1 listed in will-spam-for-food.eu.org]

[52.103.74.1 listed in will-spam-for-food.eu.org]

[52.103.74.1 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.74.1 listed in list.dnswl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.74.1 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[sksales16(at)outlook.com]

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[sksales16(at)outlook.com]

0.0 HTML_MESSAGE BODY: HTML included in message

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} Garment Supplier



--_000_SL2P216MB19035EB582BCD2A096096D40ABE62SL2P216MB1903KORP_

Content-Type: text/plain; charset="gb2312"

Content-Transfer-Encoding: base64



SGkgVGhlcmUsDQpIb3BlIHlvdaGvcmUgaW4gZ29vZCBoZWFsdGguDQpJIHdvdWxkIGxpa2UgdG8g

aW50cm9kdWNlIG91ciBjb21wYW55Lg0KV2Whr3JlIE1hbnVmYWN0dXJlciAmIEV4cG9ydGVyIG9m

IEdhcm1lbnQgZnJvbSBDaGluYS5DdXN0b21pemUgZGVzaWducywgbGFiZWwgJiBwYWNraW5nIGF2

YWlsYWJsZS4NCg0KSaGvbSBzZW5kaW5nIG91ciBwcm9kdWN0IGNhdGFsb2cuIElmIHlvdaGvcmUg

aW50ZXJlc3RlZCwgd2UgY2FuIHByb3ZpZGUgeW91IHdpdGggYSBxdW90ZS4NCg0KV2UgYXJlIGxv

b2tpbmcgZm9yd2FyZCB0byBoYXZlIGdvb2QgYnVzaW5lc3Mgd2l0aCB5b3UuDQpCZXN0IFJlZ2Fy

ZHMNCkFuZHkNCg==



--_000_SL2P216MB19035EB582BCD2A096096D40ABE62SL2P216MB1903KORP_

Content-Type: text/html; charset="gb2312"

Content-Transfer-Encoding: quoted-printable
















nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Hi There,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hope you=A1=AFre in good health.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

I would like to introduce our company.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

We=A1=AFre Manufacturer & Exporter of Garment from China.Customize desi=

gns, label & packing available.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

I=A1=AFm sending our product catalog. If you=A1=AFre interested, we can pro=

vide you with a quote.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

We are looking forward to have good business with you.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Best Regards



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Andy








--_000_SL2P216MB19035EB582BCD2A096096D40ABE62SL2P216MB1903KORP_--

I1.01KL0LD37.4KI2.18KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Instagram followers spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dae@doctor.nl2k.ab.ca

Delivery-date: Wed, 08 May 2024 18:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4rSj-0000000047T-2Ejj

for dae@doctor.nl2k.ab.ca;

Wed, 08 May 2024 18:16:41 -0600

Resent-From: The Doctor

Resent-Date: Wed, 8 May 2024 18:16:41 -0600

Resent-Message-ID:

Resent-To: dae@doctor.nl2k.ab.ca

Received: from mail-oo1-f69.google.com ([209.85.161.69]:55667)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4pwI-00000000HZ7-2fXP

for sales@nk.ca;

Wed, 08 May 2024 16:39:11 -0600

Received: by mail-oo1-f69.google.com with SMTP id 006d021491bc7-5aa35f6f9b0so203082eaf.3

for ; Wed, 08 May 2024 15:37:12 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1715207827; x=1715812627; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=426rOXhj59wcoHsnJine/lJUNaPRSVXBh05bNKiufnM=;

b=aoQlbomaroi0D79dQ1hJ4x/mH7bj+lgfDnyHBc7RHMZ+qq3eJWicFmLALZe2/3si8o

lhdwtNEMiegeG3pWLf/uEl1TnOv7ny02Wa9wdQaJjQ6LSnU4CgJSsGZW7smBYGrmC2UI

05kR3UaJYq/VZhFC0aHqPtllQADGaIQeSyo0xkjFDcGYZUm8sL3aeLRM4itXqLUTwc70

vdkgTGh8IoAC5aXSWmAGFnqcVycGZJzLO8I04R37hyMT8z6QFkBnoC1QKe+8YbT6j0BQ

AwaHuY9wektg7lJErM41FqBYj2FAFMG900Bofw9ju30pz6tG6Zgn0wcBuiepN0rpBZ4t

zRMQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1715207827; x=1715812627;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=426rOXhj59wcoHsnJine/lJUNaPRSVXBh05bNKiufnM=;

b=rUAVJucV2KWXGWLz3Tf2Qt85NIJZq4zUyEyy43n18hVGaGkHaftj17mvJVm+eRbsPp

UwrZoiZL4UyWEp/dvE3VsVpAG6hXaPB/UhoGA/qIE2vBzoPKJ5ol2f+1IEdtqxWZWbjN

T/zagA9j5Qc8H0XMnQ3N0zV/1pPsYsNA6MlpWz/pfNBzkvR6VJ1qkGNHA/hsBMQevZqq

yml6ADJ0l+33CkJfyCD/ibFMTj5RvbFkklLoUKp1qbNlH/hfRDGJ5tJejU1HYwEdeijI

My7Rdq5shIQ3BHyGwl5bmAHXxs8iMFEsiXzMg6aj6Yd1V6VXPp7dm8IxsEZLg7AElCHm

4Zrw==

X-Gm-Message-State: AOJu0YzpnF+MLnPcv7VSysAqBNd9g2Xw1qaBW92xCUGerlhzsuXrXhWH

Pe/1geGSPw9/trNZxFpb5Hih4zhvGIZeZzRhXxLQo5q/eAEYf+4f9pOvbninr8zl4MLAl863vY0

=

X-Google-Smtp-Source: AGHT+IGzALxaPk0hPwUl9pzRQhosxPNLaIWW2lMxwSx/ZDl5TY42pNA0X9tPjfnsQeqfbCBHYH7gl061og==

MIME-Version: 1.0

X-Received: by 2002:a81:4e83:0:b0:61a:c933:47a with SMTP id

00721157ae682-62085a74750mr40110077b3.24.1715204197426; Wed, 08 May 2024

14:36:37 -0700 (PDT)

Message-ID:

Date: Wed, 08 May 2024 21:36:37 +0000

Subject: netknowyeg,Gifts 15K IG Followers here

From: sersanborokem@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi , Netknow Internet Service Get 100K Followers Instagram

NOW ! Please visit the web page below . [ https://linktr.ee/instamediamax?netknowyeg

]



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.69 listed in list.dnswl.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.69 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[sersanborokem(at)gmail.com]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.0 FREEMAIL_REPLY From and body contain different freemails

Subject: {SPAM?} netknowyeg,Gifts 15K IG Followers here



SGkgLA0KTmV0a25vdyBJbnRlcm5ldCBTZXJ2aWNlDQoNCg0KR2V0IDEwMEsgRm9sbG93ZXJzIElu

c3RhZ3JhbSBOT1cgIQ0KUGxlYXNlIHZpc2l0IHRoZSB3ZWIgcGFnZSBiZWxvdyAuDQoNClsgaHR0

cHM6Ly9saW5rdHIuZWUvaW5zdGFtZWRpYW1heD9uZXRrbm93eWVnIF0NCg0KRG8geW91IGhhdmUg

YWJvdXQgWyBMZXNzIHRoYW4gNTBLIF0gRm9sbG93ZXJzID8NClNwZWNpYWxzICBsaW1pdGVkICBP

ZmYgNDAlIFRvZGF5Li4uISEhDQpJbmNyZWFzZSBOb3cgLi4hISENCg0KLSBpbnN0YW50IHByb2Nl

c3MNCi0gU2FmZXN0IE1ldGhvZHMNCi0gUHJpdmFjeSBQcm90ZWN0aW9uDQotIFNwZWVkIDEwMEsg

Rm9sbG93ZXJzL2RheQ0KLSBIaWdoIFF1YWxpdHkgRm9sbG93ZXJzICYgUmVhbA0KLSBEcm9wLUJh

Y2sgR3VhcmFudGVlDQotIFRydXN0ZWQgU2VsbGVyIHRlc3RpbW9ueQ0KLSBTdGFydGluZyBnZXQg

NUsgRm9sbG93ZXJzIEluc3RhZ3JhbQ0KLSBHdWFyYW50ZWVkIHRvIGJlIHRoZSBjaGVhcGVzdA0K

DQpUaGFuayB5b3UsDQpSZWdhcmRzLA0Kc29jaWFsaW5zdGFtYXhAZ21haWwuY29tDQoNCkNvcHly

aWdodCDCqSAyMDE0IC0gMjAyNSBJbnN0YW1lZGlhTUFYLiBBbGwgUmlnaHRzIFJlc2VydmVkLg0K

I1.01KL0LD37.4KI2.18KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a

Instagram followers spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 08 May 2024 15:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4p4L-00000000ANG-0iOK

for dave@doctor.nl2k.ab.ca;

Wed, 08 May 2024 15:43:21 -0600

Resent-From: The Doctor

Resent-Date: Wed, 8 May 2024 15:43:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f198.google.com ([209.85.128.198]:47329)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.97.1 (FreeBSD))

(envelope-from )

id 1s4nFR-00000000Jv7-1UzS

for sales@nk.ca;

Wed, 08 May 2024 13:46:45 -0600

Received: by mail-yw1-f198.google.com with SMTP id 00721157ae682-61c9e36888bso1701567b3.2

for ; Wed, 08 May 2024 12:44:33 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1715197468; x=1715802268; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=SY+1I/qjfezyBwFATEahr4j/V/f3t/LiUx/L9JjdTcw=;

b=Psj9/1Cv84iEONck0djG6kg1EGEXtvJjDFahDvQHpWW+ZJHmgVSgHUDIN/h5zDjtl/

VtGYAZzFnh8T7NzA0okwEFvtr5x9VLJUOgMFHMjE3mhPDZZ9UDpobOUzE21PNa2KFW8E

uKEdKpDburMSZemmVhUm69b/dCLhhjT75HFBk1DbitubIFxLUNLfRtPvXpCHpDS3oTME

iSO8sT+ZzEnJhSsY1d/nDBefJYyiHRS+D5sEG79XAfpD8oTQb1N7DtmFnMiFof+BQ2cd

+HNuNkbojX+R3zyuG+Lt9eXnNWvYkLZS9jwnJVh6kvAoYlavUaJMBsIImX+zanTqEpot

j0BQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1715197468; x=1715802268;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=SY+1I/qjfezyBwFATEahr4j/V/f3t/LiUx/L9JjdTcw=;

b=oXpgPFcm51AKJohY48pnFUuARIdpqACnbd7uenetfnzfYHrfQ1Lb/ZMIa+c6PQhUgP

RZcfoJ7v+m14qYJR/+7tMov4hKcXlo3IDQL3wGbTDeUq+1szDIhMPcb02z51U4n6dBQV

fPaiXrXSARINp7ocGz0ZEg4La+FRaP4GCL1AlDgXfYERIb27UygJbN9dnJBdPV5os6Nj

h2X5PzSWKzgNVDf/D+xfp0iHIuw/WQ4rmRvqotKv+0l6SQGLEEIUdd9Zyln/gupxU8JR

SUZdUlbwcsd/9Sf2UD2Bqkah1q4GmPop7otH+9dxPQSLUn+gG4ITZoUt/hTEmttC0+r5

aDuw==

X-Gm-Message-State: AOJu0YwOZiJ/WE3VTSHQO1R6TvKvYVXPF4rZRAqg4Qr/cFDOBdiPw4Mr

OpLMbM0k2QseUkvwbbBCEvrhlYc3/LE1CMGwY0if3Yvvyv9Op3RYLycvHfQur7oH/OXy181kcpo

=

X-Google-Smtp-Source: AGHT+IEIzOBFeL9wWFIdXXad61YMR2Ve4gEDuyZ2dNKwX3yF4+92cggvuSFKC+5S/WwLZoTkteqzCBmw/w==

MIME-Version: 1.0

X-Received: by 2002:a05:6870:724b:b0:23c:1599:49bd with SMTP id

586e51a60fabf-24097c33e36mr1286753fac.16.1715129181017; Tue, 07 May 2024

17:46:21 -0700 (PDT)

Message-ID:

Date: Wed, 08 May 2024 00:46:21 +0000

Subject: netknowyeg,Gifts 10K IG Followers here

From: sersankrikul@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi , Netknow Internet Service Get 100K Followers Instagram

NOW ! Please visit the web page below . [ https://linktr.ee/instamediamax?netknowyeg

]



Content analysis details: (9.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.198 listed in dnsbl.ahbl.org]

[209.85.128.198 listed in dnsbl.ahbl.org]

[209.85.128.198 listed in dnsbl.ahbl.org]

[209.85.128.198 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.198 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.198 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.198 listed in will-spam-for-food.eu.org]

[209.85.128.198 listed in will-spam-for-food.eu.org]

[209.85.128.198 listed in will-spam-for-food.eu.org]

[209.85.128.198 listed in will-spam-for-food.eu.org]

[209.85.128.198 listed in will-spam-for-food.eu.org]

[209.85.128.198 listed in will-spam-for-food.eu.org]

[209.85.128.198 listed in will-spam-for-food.eu.org]

[209.85.128.198 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.198 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.198 listed in wl.mailspike.net]

0.8 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[sersankrikul(at)gmail.com]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.0 FREEMAIL_REPLY From and body contain different freemails

1.0 RCVD_IN_SORBS No description available.

Subject: {SPAM?} netknowyeg,Gifts 10K IG Followers here



SGkgLA0KTmV0a25vdyBJbnRlcm5ldCBTZXJ2aWNlDQoNCg0KR2V0IDEwMEsgRm9sbG93ZXJzIElu

c3RhZ3JhbSBOT1cgIQ0KUGxlYXNlIHZpc2l0IHRoZSB3ZWIgcGFnZSBiZWxvdyAuDQoNClsgaHR0

cHM6Ly9saW5rdHIuZWUvaW5zdGFtZWRpYW1heD9uZXRrbm93eWVnIF0NCg0KRG8geW91IGhhdmUg

YWJvdXQgWyA5NTIgXSBGb2xsb3dlcnMgPw0KU3BlY2lhbHMgIGxpbWl0ZWQgIE9mZiA0MCUgVG9k

YXkuLi4hISENCkluY3JlYXNlIE5vdyAuLiEhIQ0KDQotIGluc3RhbnQgcHJvY2Vzcw0KLSBTYWZl

c3QgTWV0aG9kcw0KLSBQcml2YWN5IFByb3RlY3Rpb24NCi0gU3BlZWQgMTAwSyBGb2xsb3dlcnMv

ZGF5DQotIEhpZ2ggUXVhbGl0eSBGb2xsb3dlcnMgJiBSZWFsDQotIERyb3AtQmFjayBHdWFyYW50

ZWUNCi0gVHJ1c3RlZCBTZWxsZXIgdGVzdGltb255DQotIFN0YXJ0aW5nIGdldCA1SyBGb2xsb3dl

cnMgSW5zdGFncmFtDQotIEd1YXJhbnRlZWQgdG8gYmUgdGhlIGNoZWFwZXN0DQoNClRoYW5rIHlv

dSwNClJlZ2FyZHMsDQpzb2NpYWxpbnN0YW1heEBnbWFpbC5jb20NCg0KQ29weXJpZ2h0IMKpIDIw

MTQgLSAyMDI1IEluc3RhbWVkaWFNQVguIEFsbCBSaWdodHMgUmVzZXJ2ZWQuDQo=

I1.01KL0LD37.4KI2.18KwhoissourceRank12.8MPIN0Summary reportDiagnosisDensity00n/a