Web / SEO / App spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 30 Aug 2024 06:40:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sk0us-00000000FaK-0NFS

for dave@doctor.nl2k.ab.ca;

Fri, 30 Aug 2024 06:39:50 -0600

Resent-From: The Doctor

Resent-Date: Fri, 30 Aug 2024 06:39:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f195.google.com ([209.85.214.195]:59474)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sk0bE-00000000Dkh-2nUD

for root@nk.ca;

Fri, 30 Aug 2024 06:19:39 -0600

Received: by mail-pl1-f195.google.com with SMTP id d9443c01a7336-2053f6b8201so287175ad.2

for ; Fri, 30 Aug 2024 05:17:41 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=itinsightlabs-online.20230601.gappssmtp.com; s=20230601; t=1725020255; x=1725625055; darn=nk.ca;

h=thread-index:content-language:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=a/BYozJQlUnMh+jGX60Fqh9zFAk7LYpYLDTrob+R1u8=;

b=EIrKn/Gu1LJpI6FRaMAMvPZyz4sbv9n4w3ZJdN6aOSvS1AIYMftOdduNp0eIpjYzlw

IpXZRdruDb0DIZltDAceSNQ+eq/4sUKZGf4GW0C2wUxFq6+3i+f/qTLgzgPX0pVAWcis

OkhUBvO0hEUvyNDfRdDgUhAG0A2MPAjIzIMUU3Du1kwB9ty/Qk53SjHNaL0jpuQeKeXe

M+PM+JInPOQaclFwCOnQMRDbX9k0u3WMp9cFgwi/VITnMZN/7NQt+IibgnmaNq3WZS0D

69oDw8zNM6TAnLuC7lH+8EIdKkki7uhAr0M3lDrMPrZOkgOI3aJi+MF/ftwdo79NyXx5

BVbQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1725020255; x=1725625055;

h=thread-index:content-language:mime-version:message-id:date:subject

:to:from:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=a/BYozJQlUnMh+jGX60Fqh9zFAk7LYpYLDTrob+R1u8=;

b=Lb60fwd3tleZFZ5bi8GdwmcdKbm8P/h124j6klPHu0OSrPh1/Q2kGaN66dr9IKs4zo

h2Eg4zfPuNC8E6OUQ3oKS3C5cAXmoz5RMei0mTMb5HqTYbSBdkKnLLOoBqOLNsW5E73C

RDB2qK/sqaIbaxMLVATHpqou//isx2xomFf+5hLpaT6Nbc7RyeQujA+pbJV5BwO1fuh8

4KEbermWMQBEpHpLGuYSFr+aMJy16eOmowOKVkofq5hpfVYHKixBAVa8fEvvBF9WPFVp

t0WV0clNmBdySGHpLOOmIJG7GNonD8bVVqoFGEuAiEEHPjkRoJbnmAIa+RNIzpH6pYIQ

12wQ==

X-Gm-Message-State: AOJu0YxKVZfzreI5dXNKqD6JNbghjDM8Oo9HqobBNDpG0+/OUf3BjLmO

2D2lmTplgN9/ametzmv9WmgsWirW+50w2M5TUK9cWsiIwCHoCe+wUJxuYuqV/Ra9VQ6VQ72el5a

nkBE=

X-Google-Smtp-Source: AGHT+IGtma00PB5IjFuKyaYrDXP/jsc+0tdotfrEOn6Vu4/tvksFo6IvE4mIMKuz1/Qrctk9IG2/BA==

X-Received: by 2002:a17:902:e5c2:b0:205:128c:5bb3 with SMTP id d9443c01a7336-205128c5d94mr60980365ad.26.1725020255457;

Fri, 30 Aug 2024 05:17:35 -0700 (PDT)

Received: from DESKTOPLBV3JSG ([2405:201:402e:a084:443c:9a72:b652:998e])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-205155560e9sm25519545ad.282.2024.08.30.05.17.33

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Fri, 30 Aug 2024 05:17:34 -0700 (PDT)

From: "Aarohi"

To:

Subject: SEO Services Proposal

Date: Fri, 30 Aug 2024 17:46:52 +0530

Message-ID: <3293d01dafad6$978c9890$c6a5c9b0$@online>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_3293E_01DAFB04.B144D490"

X-Mailer: Microsoft Office Outlook 12.0

Content-Language: en-us

Thread-Index: Adr6mmSzljmF7QClSn2r9LOod0Px8Q==

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Without your permission I was checking your website on

behalf your email "root@nk.ca" and see you have a good design and it looks

great, but it's not ranking on Google and other major search engine.



Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2405:201:402e:a084:443c:9a72:b652:998e listed in]

[will-spam-for-food.eu.org]

[2405:201:402e:a084:443c:9a72:b652:998e listed in]

[will-spam-for-food.eu.org]

[2405:201:402e:a084:443c:9a72:b652:998e listed in]

[will-spam-for-food.eu.org]

[2405:201:402e:a084:443c:9a72:b652:998e listed in]

[will-spam-for-food.eu.org]

[2405:201:402e:a084:443c:9a72:b652:998e listed in]

[will-spam-for-food.eu.org]

[2405:201:402e:a084:443c:9a72:b652:998e listed in]

[will-spam-for-food.eu.org]

[2405:201:402e:a084:443c:9a72:b652:998e listed in]

[will-spam-for-food.eu.org]

[2405:201:402e:a084:443c:9a72:b652:998e listed in]

[will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

[209.85.214.195 listed in dnsbl.ahbl.org]

[209.85.214.195 listed in dnsbl.ahbl.org]

[209.85.214.195 listed in dnsbl.ahbl.org]

[2405:201:402e:a084:443c:9a72:b652:998e listed in]

[dnsbl.ahbl.org]

[2405:201:402e:a084:443c:9a72:b652:998e listed in]

[dnsbl.ahbl.org]

[2405:201:402e:a084:443c:9a72:b652:998e listed in]

[dnsbl.ahbl.org]

[2405:201:402e:a084:443c:9a72:b652:998e listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.195 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.195 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

1.0 SEO_SUSP_NTLD SEO offer from suspicious TLD

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

Subject: {SPAM?} SEO Services Proposal



This is a multi-part message in MIME format.



------=_NextPart_000_3293E_01DAFB04.B144D490

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,



Without your permission I was checking your website on behalf your email

"root@nk.ca" and see you have a good design and it looks great, but it's not

ranking on Google and other major search engine.



I can help bring your website to the first page on Google.



If you were on page #1 you'd get so many new customers/ every day.



May I send you quote, package or price list? If interested.



Regards



Aarohi





------=_NextPart_000_3293E_01DAFB04.B144D490

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">

class=3DWordSection1>


style=3D'mso-margin-top-alt:auto;margin-bottom:10.0pt;line-height:115%'><=

span =

style=3D'font-size:11.0pt;line-height:115%;font-family:"Calibri","sans-se=

rif"'>Hi,


style=3D'mso-margin-top-alt:auto;margin-bottom:10.0pt;line-height:115%'><=

span =

style=3D'font-size:11.0pt;line-height:115%;font-family:"Calibri","sans-se=

rif"'>Without your permission I was checking your website on behalf your =

email “root@nk.ca” and see you have a good design and it =

looks great, but it's not ranking on Google and other major search =

engine.


style=3D'mso-margin-top-alt:auto;margin-bottom:10.0pt;line-height:115%'><=

span =

style=3D'font-size:11.0pt;line-height:115%;font-family:"Calibri","sans-se=

rif"'>I can help bring your website to the first page on =

Google.


style=3D'mso-margin-top-alt:auto;margin-bottom:10.0pt;line-height:115%'><=

span =

style=3D'font-size:11.0pt;line-height:115%;font-family:"Calibri","sans-se=

rif"'>If you were on page #1 you'd get so many new customers/ every =

day.


style=3D'mso-margin-top-alt:auto;margin-bottom:10.0pt;line-height:115%'><=

span =

style=3D'font-size:11.0pt;line-height:115%;font-family:"Calibri","sans-se=

rif"'>May I send you quote, package or price list? If interested.  =


style=3D'mso-margin-top-alt:auto;margin-bottom:10.0pt;line-height:115%'><=

span =

style=3D'font-size:11.0pt;line-height:115%;font-family:"Calibri","sans-se=

rif"'>Regards


style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'>Aarohi
n>



------=_NextPart_000_3293E_01DAFB04.B144D490--



Canada post phish from Italy

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 30 Aug 2024 00:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjvUx-00000000Bz6-0m6j

for dave@doctor.nl2k.ab.ca;

Fri, 30 Aug 2024 00:52:43 -0600

Resent-From: The Doctor

Resent-Date: Fri, 30 Aug 2024 00:52:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [156.54.212.124] (port=43957 helo=server-1513638-1.servercloud.wicity.it)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjsj7-00000000MF2-2ItH

for root@nk.ca;

Thu, 29 Aug 2024 21:55:16 -0600

Received: by server-1513638-1.servercloud.wicity.it (Postfix, from userid 10002)

id 4524CE53CD; Fri, 30 Aug 2024 05:53:07 +0200 (CEST)

To: root@nk.ca

Subject: Awaiting Instructions

Date: Fri, 30 Aug 2024 03:53:07 +0000

From: CA POST

Message-ID:

X-Priority: 3

X-Mailer: PHPMailer 5.2.8Securite The World with Root

Reply-To: CA POST

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_be1f4361f53a451d9136c8092a40b9b8"

X-Spam_score: 13.5

X-Spam_score_int: 135

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Reroute Reminder Please click on Show Images to see the content

of the message.



Content analysis details: (13.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

[156.54.212.124 listed in dnsbl.ahbl.org]

[156.54.212.124 listed in dnsbl.ahbl.org]

[156.54.212.124 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[156.54.212.124 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[156.54.212.124 listed in bl.score.senderscore.com]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: colegiomariazambrano.com/82.223.83.229]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: colegiomariazambrano.com/82.223.83.229]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} Awaiting Instructions



--b1_be1f4361f53a451d9136c8092a40b9b8

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: base64



UmVyb3V0ZSBSZW1pbmRlcg==





--b1_be1f4361f53a451d9136c8092a40b9b8

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: base64



PHAgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPiBQbGVhc2UgY2xpY2sgb24gPHNwYW4NCiAg

ICBzdHlsZT0iY29sb3I6IzAwMDBmZjsiPlNob3cgSW1hZ2VzIDwvc3Bhbj4gdG8gc2VlIHRoZSBj

b250ZW50IG9mDQogIHRoZSBtZXNzYWdlLjwvcD4NCjxwIHN0eWxlPSJ0ZXh0LWFsaWduOiBjZW50

ZXI7Ij4gPGENCiAgICBocmVmPSJodHRwczovL3JiZjYyMDc2cXkub25yb2NrZXQuc2l0ZS9jYW5h

ZGEvaG9tZS8iPjxpbWcgYWx0PSIiDQogICAgICBpZD0iaW1nMjMiIHNyYz0iaHR0cHM6Ly9jb2xl

Z2lvbWFyaWF6YW1icmFuby5jb20vcmVhZG1lLnBuZyINCiAgICAgIHdpZHRoPSI3MzYiIGhlaWdo

dD0iNzg5Ij48L2E+PC9wPg0KPHA+PC9wPg0KPHRhYmxlDQpzdHlsZT0iZm9udC1zaXplOiAxMi4w

cHg7Zm9udC1mYW1pbHk6IFJvYm90byAsIEFyaWFsO3dpZHRoOg0KICA2MDAuMHB4O2ZvbnQtd2Vp

Z2h0OiA0MDA7Y29sb3I6IHJnYig3OSw3OSw3OSk7Ym9yZGVyLXNwYWNpbmc6DQogIDAuMHB4O2xp

bmUtaGVpZ2h0OiAxNS4wcHg7YmFja2dyb3VuZC1jb2xvcjogcmdiKDIzOSwyMzksMjM5KTsiDQog

IHdpZHRoPSI2MDAiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMCIgYm9yZGVyPSIwIj4N

CiAgPHRib2R5Pg0KICAgIDx0cj4NCiAgICAgIDx0ZCBjb2xzcGFuPSIzIiBzdHlsZT0iaGVpZ2h0

OiA1LjBweDsiPjxicj4NCiAgICAgIDwvdGQ+DQogICAgPC90cj4NCiAgICA8dHIgd2lkdGg9IjYw

MCI+DQogICAgPC90cj4NCiAgPC90Ym9keT4NCjwvdGFibGU+DQo=







--b1_be1f4361f53a451d9136c8092a40b9b8--



Web / SEO / App spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 30 Aug 2024 06:40:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sk0uY-00000000FZD-0fst

for dave@doctor.nl2k.ab.ca;

Fri, 30 Aug 2024 06:39:30 -0600

Resent-From: The Doctor

Resent-Date: Fri, 30 Aug 2024 06:39:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f175.google.com ([209.85.208.175]:39877)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjzkl-000000008xn-2MNA

for sales@nk.ca;

Fri, 30 Aug 2024 05:25:25 -0600

Received: by mail-lj1-f175.google.com with SMTP id 38308e7fff4ca-2f3f2b86b2dso3097451fa.3

for ; Fri, 30 Aug 2024 04:23:28 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=scalemeup-in.20230601.gappssmtp.com; s=20230601; t=1725017001; x=1725621801; darn=nk.ca;

h=to:subject:message-id:date:from:sender:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=OJV8ofjP6XyIx0puMF5xy2rLNTMWO6Y42OFtLfl3UlE=;

b=sx7o9NZgD1Sb4ZFMm9FEvVm0pQnfnIMYuUVzIaFCpOHRlLeU1ysqwSGOwrsbr77kKk

hGR1AA1U+fFOuORoESa4lr2AGFhDvhFIs0phm7N+B+5qvaF+q4F9BfHh6In6NmpuFJND

fP4TbNBH8Kp3s7Cct6DK9CwjSQLi6OJeM2t4QGiRsJqRK5T02txjbXyDJoIr3kVIuOXz

Vo44E0/sD9lJpxkc5FYo8Nvl+xHtGgOvjTsBLW2Q5z6Bu3i6UI9c+rM+qV0GVvOJYljv

2UxIywYBNWETr/4iPGBB+cEId/KB0A4SIXVCM3rcTb/rtPig1fv9vQ6bvfNAUcFbMXWx

OGVQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1725017001; x=1725621801;

h=to:subject:message-id:date:from:sender:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=OJV8ofjP6XyIx0puMF5xy2rLNTMWO6Y42OFtLfl3UlE=;

b=tSJrcRPFoWrDylkHbnNXCyy67J2tAEElh38j2DwTF04S0ByKTnE8Y6HZygzgSrWGBV

n6YAAaHnQVIPQ7Of+bO3p0Y3WxAigLiegx4r8pc7Jc0ssKIQSZOe2I0gihILqxAJdpOf

XMNKNGEEIz+r4Ue8LWeV9MMn7J+34P0Cy0/6IGmRVWG5f0zQAr14kn8qA2l+44XW8+J6

IaKCTyvspdXPQIc1qd1l1zdYYf4ZpxCsIiIyZikrVXKiA1YoXbjGrg2vcvA+ddcGFuvC

jep8Lh+GGiXZYCSAVNvD4Kn3o+2G3oH9AUrGCuIsKwvpFCCzVU0AnQ+MG+IPdukIxgH/

wVCQ==

X-Gm-Message-State: AOJu0Yw7eVKWCkuaJYS6/2Zpp9hKF5uLJ9zRdUVCxnvQZmr3GFV2LS57

OX1wuPnRI5AWRk93PJMwwGruIORWLVjJb9NqPMED6ctmdM6q6NtOPdiyrwi42Hb/k7knoMSv/zy

lHnxMF/CrE3ApMINiejnBTZ6cKzsNd9Lw3VMvFUTfugb5dgferGE=

X-Google-Smtp-Source: AGHT+IG/dlTk6kAU9jHzFnPrzxlK55yw+jOSlT5i9uZpsYaKeIOf+X/0bpbQtV/gzf448niDy/3PDYQQZ6cei5N5Swc=

X-Received: by 2002:a05:6512:33c5:b0:535:4144:e682 with SMTP id

2adb3069b0e04-53546bc1e6emr712844e87.11.1725017000831; Fri, 30 Aug 2024

04:23:20 -0700 (PDT)

Received: from 207677539662 named unknown by gmailapi.google.com with

HTTPREST; Fri, 30 Aug 2024 06:23:19 -0500

MIME-Version: 1.0

Sender: tracy@scalemeup.in

From: tracy@scalemeup.in

Date: Fri, 30 Aug 2024 06:23:19 -0500

X-Google-Sender-Auth: NjjOTzg4i86HsuF4G1iRlWF2Ra0

Message-ID:

Subject: Ensure fundamental Needs of nk.ca

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="00000000000090f71d0620e4d128"



--00000000000090f71d0620e4d128

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi There,



I came across your website and was impressed by the quality of information

presented. However, I noticed that your website could benefit from some

improvements to its search engine optimization strategy.



My nk.ca is Tracy , we specialize in helping businesses like yours improve

their online presence and generate more leads through effective SEO

techniques. Our Google certified experts have extensive experience in

keyword research, on-page optimization, link building, content

optimization, latest web technologies, campaign optimization, local seo

improvement, lead generation and online reputation management and we can

help your website rank higher on search engines like Google.



If you find this interesting and want to learn more about how we can help

your business grow through SEO, Please reply back. I=E2=80=99ll schedule my

calendar and prepare a detailed plan of action for a more comprehensive way

of getting better success.





Regards



Tracy



--00000000000090f71d0620e4d128

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




eight:115%">Hi There,

nt>


pt">






nt face=3D"verdana, sans-serif">I came across your website and was

impressed by the quality of information presented. However, I noticed that =

your

website could benefit from some improvements to its search engine optimizat=

ion

strategy.






nt face=3D"verdana, sans-serif">My nk.ca is=C2=

=A0Tracy=C2=A0, we specialize in

helping businesses like yours improve their online presence and generate mo=

re

leads through effective SEO techniques. Our Google certified experts have

extensive experience in keyword research, on-page optimization, link buildi=

ng,

content optimization, latest web technologies, campaign optimization, local=

seo

improvement, lead generation and online reputation management and we can he=

lp

your website rank higher on search engines like Google.






nt face=3D"verdana, sans-serif">If you find this interesting and want

to learn more about how we can help your business grow through SEO, Please

reply back. I=E2=80=99ll schedule my calendar and prepare a detailed plan o=

f action for

a more comprehensive way of getting better success.


soNormal" style=3D"line-height:11.2pt;margin:0in 0in 10pt">
rdana, sans-serif">


ht:11.2pt;margin:0in 0in 10pt">Regards
font>


10pt">Tracy=C2=A0


=3D"MsoNormal" style=3D"line-height:11.2pt;margin:0in 0in 10pt;font-size:11=

pt;font-family:Calibri,"sans-serif"">
t;font-family:Verdana,"sans-serif"">





--00000000000090f71d0620e4d128--

Canada post phish from Italy

Posted by Dave Yadallee on
Return-path:

Envelope-to: dve@doctor.nl2k.ab.ca

Delivery-date: Fri, 30 Aug 2024 00:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjvV1-00000000BzE-0DCe

for dve@doctor.nl2k.ab.ca;

Fri, 30 Aug 2024 00:52:47 -0600

Resent-From: The Doctor

Resent-Date: Fri, 30 Aug 2024 00:52:47 -0600

Resent-Message-ID:

Resent-To: dve@doctor.nl2k.ab.ca

Received: from [156.54.212.124] (port=44232 helo=server-1513638-1.servercloud.wicity.it)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1sjsj7-00000000MF3-2IqX

for sales@nk.ca;

Thu, 29 Aug 2024 21:55:16 -0600

Received: by server-1513638-1.servercloud.wicity.it (Postfix, from userid 10002)

id 2F303E53D6; Fri, 30 Aug 2024 05:53:07 +0200 (CEST)

To: sales@nk.ca

Subject: Awaiting Instructions

Date: Fri, 30 Aug 2024 03:53:07 +0000

From: CA POST

Message-ID:

X-Priority: 3

X-Mailer: PHPMailer 5.2.8Securite The World with Root

Reply-To: CA POST

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_bdf6e38af58ec571b60a74ceb2d11a43"

X-Spam_score: 13.5

X-Spam_score_int: 135

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Reroute Reminder Please click on Show Images to see the content

of the message.



Content analysis details: (13.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

[156.54.212.124 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

[156.54.212.124 listed in dnsbl.ahbl.org]

[156.54.212.124 listed in dnsbl.ahbl.org]

[156.54.212.124 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[156.54.212.124 listed in dnsbl.ahbl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: colegiomariazambrano.com/82.223.83.229]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: colegiomariazambrano.com/82.223.83.229]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[156.54.212.124 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[156.54.212.124 listed in bl.score.senderscore.com]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

Subject: {SPAM?} Awaiting Instructions



--b1_bdf6e38af58ec571b60a74ceb2d11a43

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: base64



UmVyb3V0ZSBSZW1pbmRlcg==





--b1_bdf6e38af58ec571b60a74ceb2d11a43

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: base64



PHAgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPiBQbGVhc2UgY2xpY2sgb24gPHNwYW4NCiAg

ICBzdHlsZT0iY29sb3I6IzAwMDBmZjsiPlNob3cgSW1hZ2VzIDwvc3Bhbj4gdG8gc2VlIHRoZSBj

b250ZW50IG9mDQogIHRoZSBtZXNzYWdlLjwvcD4NCjxwIHN0eWxlPSJ0ZXh0LWFsaWduOiBjZW50

ZXI7Ij4gPGENCiAgICBocmVmPSJodHRwczovL3JiZjYyMDc2cXkub25yb2NrZXQuc2l0ZS9jYW5h

ZGEvaG9tZS8iPjxpbWcgYWx0PSIiDQogICAgICBpZD0iaW1nMjMiIHNyYz0iaHR0cHM6Ly9jb2xl

Z2lvbWFyaWF6YW1icmFuby5jb20vcmVhZG1lLnBuZyINCiAgICAgIHdpZHRoPSI3MzYiIGhlaWdo

dD0iNzg5Ij48L2E+PC9wPg0KPHA+PC9wPg0KPHRhYmxlDQpzdHlsZT0iZm9udC1zaXplOiAxMi4w

cHg7Zm9udC1mYW1pbHk6IFJvYm90byAsIEFyaWFsO3dpZHRoOg0KICA2MDAuMHB4O2ZvbnQtd2Vp

Z2h0OiA0MDA7Y29sb3I6IHJnYig3OSw3OSw3OSk7Ym9yZGVyLXNwYWNpbmc6DQogIDAuMHB4O2xp

bmUtaGVpZ2h0OiAxNS4wcHg7YmFja2dyb3VuZC1jb2xvcjogcmdiKDIzOSwyMzksMjM5KTsiDQog

IHdpZHRoPSI2MDAiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMCIgYm9yZGVyPSIwIj4N

CiAgPHRib2R5Pg0KICAgIDx0cj4NCiAgICAgIDx0ZCBjb2xzcGFuPSIzIiBzdHlsZT0iaGVpZ2h0

OiA1LjBweDsiPjxicj4NCiAgICAgIDwvdGQ+DQogICAgPC90cj4NCiAgICA8dHIgd2lkdGg9IjYw

MCI+DQogICAgPC90cj4NCiAgPC90Ym9keT4NCjwvdGFibGU+DQo=







--b1_bdf6e38af58ec571b60a74ceb2d11a43--