Web / SEO / App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 09:18:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHQA0-00000000KWh-3NDW

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 09:17:32 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 09:17:32 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-mw2nam12olkn2095.outbound.protection.outlook.com ([40.92.23.95]:64174 helo=NAM12-MW2-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHPkG-000000009iF-0baf

for sales@nk.ca;

Sat, 30 Nov 2024 08:51:00 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=br6EaUGh0sg0CAkHVuURo8CBgSzjZFPtUV+DcXCqLTciyv3gKiX8aNAU3aiDDLm3VaTYBk2fgm8JJhFuDUELh7V7s/odm5XjxckbPA5BXyNalIEBJafZ8UnoziOxw/JizcRKMolmXg/5ZhzDTw5SxrY419MXKBlopI411L5asYGUw/0O7eML+uroFw66qHMAnz7dlygbzaexifXWEyfLqwtYDVLmcGUJ7LBZ9llEg6g7DVQ0Go7TW1+ON8fePUMw4cWa+0FcECWArNKwb5+a0e0PVEMAnOg9ictqocsN1sMNr9D7c9glo6xv+WXeWz81VDYF4yHuhcqIZBBofuAH5Q==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=NNjyhMWGbwInuuTNqECOUT3++zbAx2CDEtxFNXQIQ2g=;

b=JhCiiwYBX0XKT6zFdyLko8vuhmTWxmae31zCrXRlmT+RXqIdQ6IszteM7QIGKt3qZ1w/xstwsTrpmq8WyGkbC7rACFlVtL+aw3LjYhwKdEI+q149dLqwxNECivZ68HkvDFGIldL27omU4EQDtcT2d5OMfeE5Lrd0iHNI3FIp2ZnBuvABDczLABcXpo7KMrjoZ7MUdseY8hicTVdOK+ggsW+bCR4f0QPx8rtV3r62jc1al2izbW7JQzWIFhORgFlewVAK7c+e6lt7k/RotvG1A2zjjpMIX1Nq94qVr9vTXLaDunWQqsab6OMeD8FTjKdiYCQlP5aoNChkX51QNSy9Bw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=NNjyhMWGbwInuuTNqECOUT3++zbAx2CDEtxFNXQIQ2g=;

b=mfCvxfo3LDR/cj3v7uPzj9e5Yq8ij4nRGNzek+V+9A8DjO25JYDOEpx5/zRK7WNZHRugmq+feA/n1nRvnKXdA2OQMPXNtChBsTPRVsuvJeYVxlY0nAZzrjIq4pzQ7u/3iZx7x0CaQ0uT0pLXHYUopu+a7vBHFQpakERRXHiIe1YlD++lCCDepUfl3FUiTDGa1IKLpEmSgvMxvYkVAnFszYtwoRk+gli/9Y+FJ6flA12t4QzBVLt1Dg5r45uw6Fq+O5gJKKrrvI90vhIByyssdkc5/GgPFFBD072WBXmVpAHsd5g+6ujNXHnSbQA5wJQjpm1wIB4XzRvw6jrPg8wjMQ==

Received: from SJ0PR84MB1797.NAMPRD84.PROD.OUTLOOK.COM (2603:10b6:a03:433::8)

by LV3PR84MB3377.NAMPRD84.PROD.OUTLOOK.COM (2603:10b6:408:1d1::14) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8207.16; Sat, 30 Nov

2024 15:48:50 +0000

Received: from SJ0PR84MB1797.NAMPRD84.PROD.OUTLOOK.COM

([fe80::bbe5:ae78:f55b:c67b]) by SJ0PR84MB1797.NAMPRD84.PROD.OUTLOOK.COM

([fe80::bbe5:ae78:f55b:c67b%3]) with mapi id 15.20.8207.014; Sat, 30 Nov 2024

15:48:50 +0000

From: Pooja Sharma

Subject: //// those errors? ////

Thread-Topic: //// those errors? ////

Thread-Index: AQHbQz9EvBrf4w9FQEqs8eshHEaJPA==

Date: Sat, 30 Nov 2024 15:48:49 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SJ0PR84MB1797:EE_|LV3PR84MB3377:EE_

x-ms-office365-filtering-correlation-id: 09b8d412-c62f-44f2-8f81-08dd11567bc9

x-microsoft-antispam:

BCL:0;ARA:14566002|461199028|8060799006|15080799006|19110799003|15030799003|8062599003|3412199025|440099028|102099032;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?VfGgvaePs9MLAKIBbi2nk3XF0HcYumy60zQuWB5qQoBcgwKAXtc+GiHT?=

=?Windows-1252?Q?xd+FdyJrpJm9Nj7u5nA/0xchS50PC4C5iKeYzSdY/cWDrBMNZtOj4p8g?=

=?Windows-1252?Q?Lc8U21+9LbNNwLV1ljTEoIeMNZH82LrdcnRPujIM93I5K1Hdz/KfY7Fc?=

=?Windows-1252?Q?hDdwR8lWUjmei2PbofEY4p0y7NbsDoGFqSNvN9o446kCJrZKN9urjdY/?=

=?Windows-1252?Q?RXujca5Gh2KXMhxi6uwpZTszxNn13VYnlnDtnccALTbWbTq8f7tSFwq9?=

=?Windows-1252?Q?DMyxUwgFH5WUtJcDqSHeGdxnnRnJ+P9R8IXWvgMmFpnPy/2euRSHOxa3?=

=?Windows-1252?Q?vd7TPyk7jYOG2DqMETPPMdBZIzSGinu2U9at+i2H1paua2QUfmoKPeU3?=

=?Windows-1252?Q?gXDV2UjpBjKEicCPYu2CKHFaHHi3VPUilO4unPbS2zvB6z65LiIuDSm2?=

=?Windows-1252?Q?kBcb+NcikMY0w4QjsJQNphADdpBLLPWEkWUr48arAy3rbGvungwqT28y?=

=?Windows-1252?Q?I/rlXk5pSk0PomzzaC3cF95Vx4FY3C41w1xk7dT6wJzn9DhP/8iuV5oR?=

=?Windows-1252?Q?VZd1Uy4shbAhUge0x+HzIGWuGvwlkT4IOD0gHrO/DeKXK4GyQnIQr2n8?=

=?Windows-1252?Q?Foe8Q5bq9JSEaHy1lq2/LSFxDA6PC9UcF147aOg4lIfIpVVTu5L3kp8B?=

=?Windows-1252?Q?BkUloPYXMzrSLTaAPNiDz+mEa8802MYdYCnoL+WS0kFjklPjSQ/NSdGK?=

=?Windows-1252?Q?ZeawoI7NPKzGQR4NhIPwN+sR8ANhEAVEweLApph7dK+nuDfUforC5Q1U?=

=?Windows-1252?Q?K+KnvRx8MbSvWxCfsERcZzFn7TSzxBYMwLRYO9b/uHZ5y7WKkfoWDtjv?=

=?Windows-1252?Q?fTIyB/Jp+TVPoyqXRcwS2l7P53cBH3lwSzx5QHAbY8rp6fsaIzaRfmlK?=

=?Windows-1252?Q?jNcXZ9tZ6Ud1XFKS0vYFTM0jEL37Z50CfKkhPR3rjUhzkha9LpundXmg?=

=?Windows-1252?Q?1f6zC4reR02x0wXHAvT8tJ1btJU/9Qo2hzr8eDh+zMQ3KhADlH8px0he?=

=?Windows-1252?Q?gnuZyF5hchNKv8VNC7DjeddRYXE8+KTyiuy71L++cs+DTZj4WVJ9z8bE?=

=?Windows-1252?Q?tl4=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?wSkIp0fAC21lRl9YodSTNY6kDXMRPQV77a3DWxVqkOoxOyIrJXO6A8SM?=

=?Windows-1252?Q?XbhQ72r6tIwGGTH6SHCBYB+CJRWxRHSh82uKV7ciGAKYmnAvdYNcmBy1?=

=?Windows-1252?Q?V5fwgh8ltiy4T1nt49jAQaAxhS3MKsrSB7o1K5tGTgjRbV/2TvaKMYF4?=

=?Windows-1252?Q?VrD2qfjQZW8kjHanfLprWyrlY1eSteFtCCUvAG1d6og8NHP1j3BXLbQg?=

=?Windows-1252?Q?1uFfIHXD9K1DlZpQl9gJj6mvXxEjsKl41zphOdmTT2hKmhl7mkbjnrje?=

=?Windows-1252?Q?vpgssYeXYYycyeSBpKknpoVtUOH82rx6lH+ItqhzH8z8i9wOni7XYjon?=

=?Windows-1252?Q?Ex1wWXYEUSitk7d3G4igPu6gGFmjWzzFT8SOvirvBcqpR6DFn8sWnytF?=

=?Windows-1252?Q?fLWspsEtBbBiepDH4KTrd2Os4F0xH1VqGNKr3/QK2jCBgl4gFProotyQ?=

=?Windows-1252?Q?jDnp5wZzWyfK5WdI34zWthd5FSJuR8ONmvcSUipd1m9kkrKmIM80Fzyk?=

=?Windows-1252?Q?vcuEfvGcj3756jjY/YCH2cwvk+GQq2/RIrKbVY6UJ/8ZsLPFTErs8Rhb?=

=?Windows-1252?Q?0zw34sBA+M2gtjwkbYwfQg09br0peMrvJ2TXJrZArC+6ygB0KhA4sm8w?=

=?Windows-1252?Q?ISxmsewwqHgq8emP1V84j07OZ4Fj73UAvun/QTbFtJSpZGGsc9Zbmukm?=

=?Windows-1252?Q?g59XhP0j0zZezkTemn9EBP9qu6Sq8icubseAFjRHoyg77I+4t1pqOXKM?=

=?Windows-1252?Q?Svu4A7SKIfsINgpR9eTMGSh0n1UoDFPOeAJZqu0ZYhV/Tr7HSixXKKo/?=

=?Windows-1252?Q?u9LAIfkh28OLeRN58xpMC98R7FDyEcPr76vS4zFGLkno48JiJEE3Avpm?=

=?Windows-1252?Q?x5pgN6O1BVJs+U+bEr/Lbgyy5ffHemETl9ZNISZFhU8IARif3bysUEzv?=

=?Windows-1252?Q?1p9EqEUJceHFIBi+MRzD89Q09RMTjYpQcrPJsTj1cU4wmlmrnGYbnKbf?=

=?Windows-1252?Q?W0Xg4jCBQgvhQ1OMDVItchZV1pZYdFW742+Bv5bTkVrvoRmDQaNaSztE?=

=?Windows-1252?Q?Zn3UiDL5OMdfr0UK2R7IVDWlw2IBdcxjS6JMfpT2t5S9FQkDT+uC2ag7?=

=?Windows-1252?Q?Eqmh1ZncMYwvNLZgfJ4+e9vha64zK55JtNOB3KiGPxRFRQReHodJIkqf?=

=?Windows-1252?Q?PHUyI5SymNJQwmi1H+/BxZ13q17ttW0LqQ11cLWAW1KJg/IHzrbPZ4Ur?=

=?Windows-1252?Q?yVsmoUrtDlWbErZRWZ+0jxXW0i/8s/zWgGnhpLVLaT854EBQ93WWMTQF?=

=?Windows-1252?Q?E+n8NMDZd7hMsuBbHsOc5iKoSGCWz/8AmlOrHTohzNsnQUd9NBrOoNxy?=

=?Windows-1252?Q?uC5yUYMDyTgRXIMC9qeI3lqee2UdjABeADk=3D?=

Content-Type: multipart/alternative;

boundary="_000_SJ0PR84MB179791A6C84A18B1D2A69E29952B2SJ0PR84MB1797NAMP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SJ0PR84MB1797.NAMPRD84.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 09b8d412-c62f-44f2-8f81-08dd11567bc9

X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Nov 2024 15:48:49.7681

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV3PR84MB3377

X-Spam_score: 7.5

X-Spam_score_int: 75

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Sir/ Ma'am I found problem on your website that are affecting

your online presence and Google ranking. I’d like to send a no-obligation

report outlining these problems?



Content analysis details: (7.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.92.23.95 listed in dnsbl.ahbl.org]

[40.92.23.95 listed in dnsbl.ahbl.org]

[40.92.23.95 listed in dnsbl.ahbl.org]

[40.92.23.95 listed in dnsbl.ahbl.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.92.23.95 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.92.23.95 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.92.23.95 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.92.23.95 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.92.23.95 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.23.95 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_SIGNED Message has a ARC signature

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[poojasharma006(at)outlook.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[poojasharma006(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

Subject: {SPAM?} //// those errors? ////



--_000_SJ0PR84MB179791A6C84A18B1D2A69E29952B2SJ0PR84MB1797NAMP_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi, Sir/ Ma'am



I found problem on your website that are affecting your online

presence and Google ranking.



I=92d like to send a no-obligation report outlining these problems?



Would you like me to send over of those errors?



Regards ahead of time.



Best Regards



Deepak Dhawan



Note: May I send you a quote/ Package/ Proposal?





--_000_SJ0PR84MB179791A6C84A18B1D2A69E29952B2SJ0PR84MB1797NAMP_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=

alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hi, Sir/ Ma'am



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

I found problem on your website that are affecting your online



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

presence and Google ranking.



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

I=92d like to send a no-obligation report outlining these problems?



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=

alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Would you like me to se=

nd over of those errors?



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Regards ahead of time.



margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=

alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Best Regards



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Deepak Dhawan



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Note: May I send you =

a quote/ Package/ Proposal?



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">












--_000_SJ0PR84MB179791A6C84A18B1D2A69E29952B2SJ0PR84MB1797NAMP_--

Intelcom phish from hostafrica.com

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 09:18:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHQ9a-00000000KVi-1cth

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 09:17:06 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 09:17:06 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [102.218.215.216] (port=55860 helo=positiveesolutions.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHPVV-000000009Ag-2iVt

for games@nl2k.ab.ca;

Sat, 30 Nov 2024 08:35:46 -0700

Received: by positiveesolutions.com (Postfix, from userid 33)

id BD3B2FDE53; Sat, 30 Nov 2024 17:14:38 +0200 (SAST)

To: games@nl2k.ab.ca

Subject: DragonFly - Please review your missed shipment!

Date: Sat, 30 Nov 2024 17:10:01 +0200

From: Intelcom Express

Reply-To: noreply@dragonflyshipping.ca

Message-ID: <742345008dfe2f378d27ef02db8ede9c@dragonflyshipping.ca>

List-Unsubscribe: mailto:bounce930-D52MRtsutv0iIVW@dragonflyshipping.ca?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1dab32d60da24c6a0c0c9c8682fcadcb0"

Content-Transfer-Encoding: 8bit

X-Spam_score: 18.9

X-Spam_score_int: 189

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Apologies, but we need to inform you that our delivery attempts

was unsuccessful as we couldn't reach you. Your package is awaiting delivery,

and for a nominal fee of CAD 2.11, you can reschedule it t [...]



Content analysis details: (18.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

[102.218.215.216 listed in dnsbl.ahbl.org]

[102.218.215.216 listed in dnsbl.ahbl.org]

[102.218.215.216 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[102.218.215.216 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[102.218.215.216 listed in zen.spamhaus.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ltc8h.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[102.218.215.216 listed in wl.mailspike.net]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

Subject: {SPAM?} DragonFly - Please review your missed shipment!



This is a multi-part message in MIME format.



--1dab32d60da24c6a0c0c9c8682fcadcb0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



















Â



Apologies, but we need to inform you that our delivery attempts was unsuccessful as we couldn't reach you. Your package is awaiting delivery, and for a nominal fee of CAD 2.11, you can reschedule it to a time that suits you best.



To proceed with rescheduling your delivery, kindly click on the button provided below:



Reschedule Delivery



Thank you for choosing Intelcom.



Â









This email was sent from an automated system. Please do not reply.



© 2024 Intelcom. All rights reserved.









--1dab32d60da24c6a0c0c9c8682fcadcb0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit



















Â





Apologies, but we need to inform you that our delivery attempts was unsuccessful as we couldn't reach you. Your package is awaiting delivery, and for a nominal fee of CAD 2.11, you can reschedule it to a time that suits you best.





To proceed with rescheduling your delivery, kindly click on the button provided below:





Reschedule Delivery





Thank you for choosing Intelcom.





Â











This email was sent from an automated system. Please do not reply.





© 2024 Intelcom. All rights reserved.















--1dab32d60da24c6a0c0c9c8682fcadcb0--



nk.ca credential phishing from google.com

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 07:45:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHOhd-0000000078F-3aDb

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 07:44:09 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 07:44:09 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 219.177.199.35.bc.googleusercontent.com ([35.199.177.219]:33344 helo=[10.88.0.5])

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tHKTG-00000000Mdt-46ON

for root@nk.ca;

Sat, 30 Nov 2024 03:13:10 -0700

Content-Type: multipart/related; boundary="===============9147796936855588233=="

MIME-Version: 1.0

From: "Nagindas Khandwala College ."

To: root@nk.ca

Subject: =?utf-8?q?MailBox_Requesting_Authentication!_For_root=40nk=2Eca_=3A?=

X-Priority: 2

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Root , You have an important mailbox update, please

click below to mailbox update complete. Update Mailbox You have 24 hours to

complete the update to avoid being logged out of your mailbox. Dis [...]



Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.199.177.219 listed in sbl-xbl.spamhaus.org]

[35.199.177.219 listed in sbl-xbl.spamhaus.org]

0.7 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL

[35.199.177.219 listed in zen.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.199.177.219 listed in zen.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

[35.199.177.219 listed in dnsbl.ahbl.org]

[35.199.177.219 listed in dnsbl.ahbl.org]

[35.199.177.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: ipfs.io/209.94.90.1]

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

3.2 URI_IPFSIO References Interplanetary File System PtP content via

ipfs.io, likely phishing

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.1 TO_IN_SUBJ To address is in Subject

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.2 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

1.0 XPRIO Has X-Priority header

0.0 URI_IPFS References Interplanetary File System PtP content, probable

phishing

Subject: {SPAM?} =?utf-8?q?MailBox_Requesting_Authentication!_For_root=40nk=2Eca_=3A?=



--===============9147796936855588233==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PEhUTUw+PEhFQUQ+DQo8TUVUQSBuYW1lPUdFTkVSQVRPUiBjb250ZW50PSJNU0hUTUwgMTEuMDAu

OTYwMC4xOTU5NyI+PC9IRUFEPg0KPEJPRFk+DQo8VEFCTEUgc3R5bGU9IkZPTlQtU0laRTogMTRw

eDsgRk9OVC1GQU1JTFk6IGFyaWFsOyBCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlOyBDT0xPUjog

cmdiKDQ0LDU0LDU4KSIgY2VsbFNwYWNpbmc9MCBjZWxsUGFkZGluZz0wIHdpZHRoPSIxMDAlIiBh

bGlnbj1jZW50ZXIgYmdDb2xvcj0jZjVmN2Y4IGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gt

U0laSU5HOiBib3JkZXItYm94Ij4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+

DQo8VEQgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giIGhlaWdodD0zMCB2QWxpZ249dG9w

IGFsaWduPWNlbnRlcj4mbmJzcDs8L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJv

cmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiB2QWxpZ249dG9w

IHdpZHRoPTYwMCBhbGlnbj1jZW50ZXI+DQo8VEFCTEUgc3R5bGU9Ik1BWC1XSURUSDogNjAwcHg7

IEJPUkRFUi1UT1A6IHJnYigyNDAsMjQxLDI0NikgMXB4IHNvbGlkOyBCT1JERVItUklHSFQ6IHJn

YigyNDAsMjQxLDI0NikgMXB4IHNvbGlkOyBCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlOyBCT1JE

RVItQk9UVE9NOiByZ2IoMjQwLDI0MSwyNDYpIDFweCBzb2xpZDsgQk9SREVSLUxFRlQ6IHJnYigy

NDAsMjQxLDI0NikgMXB4IHNvbGlkIiBjZWxsU3BhY2luZz0wIGNlbGxQYWRkaW5nPTAgYWxpZ249

Y2VudGVyIGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4N

CjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJPWC1TSVpJ

Tkc6IGJvcmRlci1ib3g7IE1BWC1XSURUSDogNjAwcHgiIGJnQ29sb3I9I2ZmZmZmZiB2QWxpZ249

dG9wIHdpZHRoPTYwMCBhbGlnbj1jZW50ZXI+DQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xMQVBT

RTogY29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCB3aWR0aD0iMTAwJSIgYWxp

Z249Y2VudGVyIGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94

Ij4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJPWC1T

SVpJTkc6IGJvcmRlci1ib3giIHZBbGlnbj10b3AgYWxpZ249Y2VudGVyPg0KPFRBQkxFIHN0eWxl

PSJCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlIiBjZWxsU3BhY2luZz0wIGNlbGxQYWRkaW5nPTAg

d2lkdGg9IjkyJSIgYWxpZ249Y2VudGVyIGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gtU0la

SU5HOiBib3JkZXItYm94Ij4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8

VEQgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giIHZBbGlnbj10b3AgYWxpZ249Y2VudGVy

Pg0KPFRBQkxFIHN0eWxlPSJCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlIiBjZWxsU3BhY2luZz0w

IGNlbGxQYWRkaW5nPTAgd2lkdGg9IjEwMCUiIGFsaWduPWNlbnRlcj4NCjxUQk9EWSBzdHlsZT0i

Qk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1i

b3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWlnaHQ9MzA+Jm5ic3A7

PC9URD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHls

ZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCIgaGVpZ2h0PTMyPiZuYnNwOzwvVEQ+PC9UUj4NCjxU

UiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJPWC1TSVpJTkc6

IGJvcmRlci1ib3giIHZBbGlnbj10b3A+DQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xMQVBTRTog

Y29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCB3aWR0aD0iOTAlIj4NCjxUQk9E

WSBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6

IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94OyBGT05ULVNJ

WkU6IDEycHg7IEZPTlQtRkFNSUxZOiBSb2JvdG8sIEFyaWFsOyBDT0xPUjogcmdiKDUxLDUxLDUx

KTsgTElORS1IRUlHSFQ6IDE4cHgiIHZBbGlnbj10b3A+PFNQQU4gc3R5bGU9IkJPWC1TSVpJTkc6

IGJvcmRlci1ib3g7IEZPTlQtV0VJR0hUOiBib2xkZXIiPkRlYXIgUm9vdCAsPC9TUEFOPjwvVEQ+

PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9URD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBi

b3JkZXItYm94Ij4NCjxURCBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCIgdkFsaWduPXRv

cD4NCjxUQUJMRSBzdHlsZT0iQk9SREVSLUNPTExBUFNFOiBjb2xsYXBzZSIgY2VsbFNwYWNpbmc9

MCBjZWxsUGFkZGluZz0wIHdpZHRoPSIxMDAlIiBib3JkZXI9MD4NCjxUQk9EWSBzdHlsZT0iQk9Y

LVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3gi

Pg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWlnaHQ9MjU+Jm5ic3A7PC9U

RD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHlsZT0i

Qk9YLVNJWklORzogYm9yZGVyLWJveDsgRk9OVC1TSVpFOiAxM3B4OyBGT05ULUZBTUlMWTogUm9i

b3RvLCBBcmlhbDsgQ09MT1I6IHJnYigxMDIsMTAyLDEwMik7IExJTkUtSEVJR0hUOiAxOXB4Ij5Z

b3UgaGF2ZSBhbiBpbXBvcnRhbnQgbWFpbGJveCB1cGRhdGUsIHBsZWFzZSBjbGljayBiZWxvdyB0

byBtYWlsYm94IHVwZGF0ZSBjb21wbGV0ZS48L1REPjwvVFI+PC9UQk9EWT48L1RBQkxFPjwvVEQ+

PC9UUj4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJP

WC1TSVpJTkc6IGJvcmRlci1ib3giIGhlaWdodD0yMCB2QWxpZ249dG9wIGFsaWduPWxlZnQ+Jm5i

c3A7PC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1T

SVpJTkc6IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiB2

QWxpZ249dG9wIGFsaWduPWNlbnRlcj4mbmJzcDsgDQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xM

QVBTRTogY29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCBhbGlnbj1jZW50ZXIg

Ym9yZGVyPTA+DQo8VEJPRFkgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPg0KPFRSIHN0

eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHlsZT0iQk9YLVNJWklORzogYm9y

ZGVyLWJveCIgYmdDb2xvcj0jZjM1NjVkIGhlaWdodD00MCB3aWR0aD0yODggYWxpZ249Y2VudGVy

PjxBIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94OyBGT05ULUZBTUlMWTogUm9ib3RvLCBB

cmlhbDsgVEVYVC1UUkFOU0ZPUk06IHVwcGVyY2FzZTsgQ09MT1I6IHJnYigyNTUsMjU1LDI1NSk7

IERJU1BMQVk6IGJsb2NrOyBMSU5FLUhFSUdIVDogNDBweDsgQkFDS0dST1VORC1DT0xPUjogdHJh

bnNwYXJlbnQ7IHRleHQtZGVjb3JhdGlvbi1saW5lOiBub25lIiBocmVmPSJodHRwczovL2lwZnMu

aW8vaXBmcy9iYWZ5YmVpZWFveWF4YnFscno3ZWY2aTM3ZGhyZW13NzVtMnN0Z2Z6anVhYmNrcHNh

aDJlNm5xenp3bT9maWxlbmFtZT1zcGxlcC5odG1sI3Jvb3RAbmsuY2EiIHJlbD1ub3JlZmVycmVy

IHRhcmdldD1fYmxhbms+VXBkYXRlIE1haWxib3g8L0E+PC9URD48L1RSPjwvVEJPRFk+PC9UQUJM

RT48L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPg0KPFREIHN0

eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWlnaHQ9MjAgdkFsaWduPXRvcCBhbGlnbj1s

ZWZ0PiZuYnNwOzwvVEQ+PC9UUj4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+

DQo8VEQgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giIHZBbGlnbj10b3A+DQo8VEFCTEUg

c3R5bGU9IkJPUkRFUi1DT0xMQVBTRTogY29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRp

bmc9MCB3aWR0aD0iMTAwJSIgYm9yZGVyPTA+DQo8VEJPRFkgc3R5bGU9IkJPWC1TSVpJTkc6IGJv

cmRlci1ib3giPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHls

ZT0iQk9YLVNJWklORzogYm9yZGVyLWJveDsgRk9OVC1TSVpFOiAxM3B4OyBGT05ULUZBTUlMWTog

Um9ib3RvLCBBcmlhbDsgQ09MT1I6IHJnYigxMDIsMTAyLDEwMik7IExJTkUtSEVJR0hUOiAxOXB4

Ij5Zb3UgaGF2ZSAyNCBob3VycyB0byBjb21wbGV0ZSB0aGUgdXBkYXRlIHRvIGF2b2lkIGJlaW5n

IGxvZ2dlZCBvdXQgb2YgeW91ciBtYWlsYm94LjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9U

RD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHlsZT0i

Qk9YLVNJWklORzogYm9yZGVyLWJveDsgQk9SREVSLUJPVFRPTTogcmdiKDIzOCwyMzgsMjM4KSAx

cHggc29saWQiIGhlaWdodD0yNT4mbmJzcDs8L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJ

Tkc6IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWln

aHQ9MjM+Jm5ic3A7PC9URD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94

Ij4NCjxURCBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCIgdkFsaWduPXRvcD5EaXNjbGFp

bWVyIA0KPFAgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3g7IE1BUkdJTi1UT1A6IDBweCI+

Jm5ic3A7PC9QPg0KPFAgc3R5bGU9J0JPWC1TSVpJTkc6IGJvcmRlci1ib3g7IEZPTlQtU0laRTog

OHB0OyBGT05ULUZBTUlMWTogIkNlbnR1cnkgR290aGljIiwgInRpbWVzIHJvbWFuIiwgc2VyaWY7

IENPTE9SOiByZ2IoOTIsODgsODgpOyBNQVJHSU4tVE9QOiAwcHg7IExJTkUtSEVJR0hUOiAxMHB0

JyBhbGlnbj1jZW50ZXI+VGhpcyBlbWFpbCZuYnNwO2lzIGludGVuZGVkIHNvbGVseSBmb3ImbmJz

cDtyb290QG5rLmNhPFNQQU4gc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPiZuYnNwOzwv

U1BBTj48U1BBTiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+Jm5ic3A7PC9TUEFOPg0K

Jm5ic3A7b25seS4gSXQgY29udGFpbnMgY29uZmlkZW50aWFsIGFuZC9vciBwcml2aWxlZ2VkIGlu

Zm9ybWF0aW9uLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50IG9yIGhhdmUg

cmVjZWl2ZWQgdGhpcyBlbWFpbCBpbiBlcnJvciwgeW91IG11c3Qgbm90IGNvcHksIGRpc3RyaWJ1

dGUsIGRpc2Nsb3NlIG9yIHRha2UgYW55IGFjdGlvbiBpbiByZWxpYW5jZSBvbiBhbnkgcGFydCBv

ZiBpdC4gSW4gc3VjaCBhIGNhc2UsIHlvdSBzaG91bGQgaW5mb3JtIHVzIGltbWVkaWF0ZWx5IGFu

ZCBkZWxldGUgdGhpcyBlbWFpbC48L1A+DQo8UCBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJv

eDsgRk9OVC1GQU1JTFk6IFRhaG9tYSwgVmVyZGFuYSwgU2Vnb2UsIHNhbnMtc2VyaWY7IENPTE9S

OiByZ2IoNTcsNjEsNzEpOyBURVhULUFMSUdOOiBjZW50ZXI7IE1BUkdJTjogMHB4OyBMSU5FLUhF

SUdIVDogMS4yIj4mbmJzcDs8L1A+DQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xMQVBTRTogY29s

bGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCB3aWR0aD0iOTAlIj4NCjxUQk9EWSBz

dHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJv

cmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94OyBGT05ULVNJWkU6

IDEycHg7IEZPTlQtRkFNSUxZOiBSb2JvdG8sIEFyaWFsOyBGT05ULVdFSUdIVDogNjAwOyBDT0xP

UjogcmdiKDUxLDUxLDUxKTsgTElORS1IRUlHSFQ6IDE4cHgiIHZBbGlnbj10b3A+bmsuY2EgJm5i

c3A7QWRtaW5pc3RyYXRvciBTZXJ2aWNlcy4gQWxsIFJpZ2h0cyBSZXNlcnZlZDwvVEQ+PC9UUj48

L1RCT0RZPjwvVEFCTEU+PC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48L1REPjwvVFI+DQo8VFIg

c3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBi

b3JkZXItYm94IiBoZWlnaHQ9MzI+Jm5ic3A7PC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48L1RE

PjwvVFI+PC9UQk9EWT48L1RBQkxFPjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9CT0RZPjwv

SFRNTD4=



--===============9147796936855588233==--

Web / SEO / App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 07:46:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHOir-000000007Ak-1L2t

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 07:45:25 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 07:45:25 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastasiaazolkn19011025.outbound.protection.outlook.com ([52.103.64.25]:5262 helo=HK3PR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHOFR-000000005aV-0qB6

for sales@nk.ca;

Sat, 30 Nov 2024 07:15:05 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=d6dnrQpXYOqICd+l9hY0gWXco5f7mE8qHRZOC2W9xhxgEoPYyxxNyWF2lsa3FXTkQA8dqE5UerZQAuBkBSTAAyzH5hH4moC8E8v2MBKCPIR7BzRIIQqg5QOUBifm4afJmHsjM8jW0+JfbAjeiXPiFd+g0kjh0qaE5RoZzv1w3j5/PfvnYKK/Cidv5hyBNwacy8HAjSvyW6A69SzWHjpOoWp1vzaNQITNrSK7swcUDod1ZiLEWC2fgpvcSFC5CUHiETu2XvkX4ihuMwUw2ZSJmGqMxWiSu6/n/SIVCVWkRE/+iBpxs4OJTyf6peLz4+xHXeB+yyT+7Ozqk9WgqiK3DA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=ngo09EQV1ijTv9q4yMT2HHK35oGBpIbhSMl9od1m56w=;

b=ihGw5zAWPZE3xSt0LqiXQ+JpGUvJi+/6dLTweAl92Z+uJoLcY6bKaGX4Ob1wBhBXEa0aCoVKaC7xZZutKmiW9SkMIrMNIQ82syRM+m0qQsE4RJI5um1jhPdrtCOwVWrUXr6feioNPzhM4YFG85Zv09rMeBlbf8hsG9UMQwY1PgB1VNebkddUyXhjpwZD2/Bko32KTKcXhUYDy2N2IT2uMmNueCCJ4/6T1mr9drSGg6+W2l60XKK/cP5Yre8B3iwlWrI3vP5EfS/wt4h2TP2wpm6coV/u4OLUCcmiQEFj7HOcrJdDHGoWskgBS71AFrrHOvLl/yOgniDB/D2xzt9WXg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=ngo09EQV1ijTv9q4yMT2HHK35oGBpIbhSMl9od1m56w=;

b=sjsLolUr2xD7u92B5q+FwrX/Ml6viEIfQUmBMS4YCGyarPFUOGyhMcOfRFc85ME7BbLUQW7Tp8Xv8INcs+RAM4cLH5uOND4AOVRgbJj2n/yn7UCDwCXULJK428sOOpMVE/Y9urxir8b94uLlySFx+0nGDAaqOWQUVLx/h/UPj0K89G2LRaD8gnFRf1vSoa0qHIBjqWOx5u9NJzcREmru/LdhYbokYUFWo93RL9cQ2O0IsEW8YmIr6kc8x0i2LMgsI+QPTg7TwP1siTdBMJf2WSendrk5cCjBSsajfD9XBNqQvVbTxjpdQzBLdZyzIzhdf4erA0DCAavc+CoQQgvN4g==

Received: from SI2PR02MB5225.apcprd02.prod.outlook.com (2603:1096:4:154::11)

by KL1PR02MB6917.apcprd02.prod.outlook.com (2603:1096:820:104::5) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8207.15; Sat, 30 Nov

2024 14:12:21 +0000

Received: from SI2PR02MB5225.apcprd02.prod.outlook.com

([fe80::d5b2:65f6:a67c:eec]) by SI2PR02MB5225.apcprd02.prod.outlook.com

([fe80::d5b2:65f6:a67c:eec%5]) with mapi id 15.20.8207.014; Sat, 30 Nov 2024

14:12:21 +0000

From: sonali seksena

Subject: cost_?#$

Thread-Topic: cost_?#$

Thread-Index: AQHbQzG8Vd2nXag2RkW/PQzvTguB6g==

Date: Sat, 30 Nov 2024 14:12:21 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SI2PR02MB5225:EE_|KL1PR02MB6917:EE_

x-ms-office365-filtering-correlation-id: 4b1bf9d0-6b50-4013-781d-08dd114901ae

x-microsoft-antispam:

BCL:0;ARA:14566002|461199028|7042599007|15080799006|19110799003|15030799003|8060799006|8062599003|102099032|3412199025|440099028;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?tg9dXcX0I8zSG6i1J9qx3u6o39vL2lh7G99d50cKS32B7H9ZH0haHg4lN7?=

=?iso-8859-1?Q?tIJ/NlWcBSP1sTRs7z0VanSsC11ioUxt09SwckHGRFeOTCNzDuGX7IDwsy?=

=?iso-8859-1?Q?eAfK6+cFNUlfEz4uXQ6c9mmbfwo68drPf4em10Sx9fYr+7e+DZ9ayG0HZY?=

=?iso-8859-1?Q?koCJLEG0hrPGda0GvygHOkPNYCwdB/coDbT0kn0q28llaNitl32hlqlN+p?=

=?iso-8859-1?Q?ZXlPvlM22+rY16G2+svWMDzIAPrt6stQcglVFS/OHacdM9xub7iYVOdjQv?=

=?iso-8859-1?Q?kq3EmfIXDqhJdp3GEJkTcEpLxLsv8qvNWWOTuFIYJZrlhId2JfFGMEPnu/?=

=?iso-8859-1?Q?JejZZ+uMmMwkn92iS8k5J6gPfhiUH7DR+uymBIbsxcjTi7FDZBhCHtHN1a?=

=?iso-8859-1?Q?81BVrS8kvzZ9gOOo3WhNiSxQD4VPtXP+QO3eXBQHKZxnK7Id7H1A76tOE6?=

=?iso-8859-1?Q?faeYPf7qGUIsJWXhO3r/MPP3pv0NIU1Tm+j1xul2ukhXqLtCMZtoDKePjn?=

=?iso-8859-1?Q?IjND6FImtZVrG362Udqahfj3qKha9R2e/qCTfnJVyHg10r7ObFZ9zbHQ41?=

=?iso-8859-1?Q?DKn0eXjm0d7UuMBZBMngtAb7NuKrffgUtFjMqEVN5DW55QOVkaP4NQ0qxd?=

=?iso-8859-1?Q?9+KVr/zPA/Iz1G2sU7cdNBVdlSggioKsEBfe8FmrjPODXY3SeggFgjUkle?=

=?iso-8859-1?Q?0/Mh8W4J/zvTxrJVtZbZazKGxPLFqJ3+M+YNF0Ow+gDX0dpujFK6rJ5RY0?=

=?iso-8859-1?Q?K+x8pRQ81iUwTtKyXH9pK+FeG273nU0GCj4x1ZnAeOSEmChlbIUkXJEzpU?=

=?iso-8859-1?Q?4SEaKWHjw2XzMiRZXBbFhK9HqK+I9CoJNhcCLHqV5rror+PeFMR5ab70qi?=

=?iso-8859-1?Q?WUa7sT+mc4xcu9MixQi7bQk/FbhLWLsc/8tOrT25iHVG8NOnE4YHWUD5QB?=

=?iso-8859-1?Q?AWEKbapjM3YqmTfPIjYp+ySAAjJ7iDvKjg+8oLHXTzpKKd6wIHiOr0omNZ?=

=?iso-8859-1?Q?fxMM4STT1V+1svZIDYI59M4l/WK7gQTIrNScb3nwJ2VnvJxwPWfUs+O3sl?=

=?iso-8859-1?Q?Esxs99wXCNBr6VBDP8QlrNjgGz3t67zdKhly7a57wOae?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?NFTwgwr+i0MPrq2lWge5SIi4qXYEPVWmkawWkKXAawUGQVJclE1rVmj8ti?=

=?iso-8859-1?Q?hqKnsbeeltd1l+7O3AJuEmIqshv5uSIm5Rpqnzz7i3BABcpCJfoBevKf3u?=

=?iso-8859-1?Q?IV3wydirnx3mqp+/lKW599D0HbcTmGLjsisIDBVN+nEGxmK1A1Wfq0xBsh?=

=?iso-8859-1?Q?NfDgnabOcCLhGbxsESL+ymJTkjgoBq9ql6dlm01qIand6W6WI9cndL0jMf?=

=?iso-8859-1?Q?NFoaftzvF8FvKXT+dUEF11MUJe/HxZPoRJcQqX/0M869W/JVD+rnRJGSVo?=

=?iso-8859-1?Q?WvpYXyB+v1yyUac9JWuamJLL6Q0g3BnPk/MgYNRQodPy1vq2eaj1gmnQ9K?=

=?iso-8859-1?Q?EHjVA58V/YAElpAQc3ojq4TKcOEiL1s+x4X+6cLgUX+F39Sm2xZrLLkCPZ?=

=?iso-8859-1?Q?cefyo1ETqLzOLSweKFNTj9gRQcnIyqyKF9c3mq74U+Hd6hDg1Hc0bnr/yO?=

=?iso-8859-1?Q?zGscYMDveJuZYLNNHNVN38hRv7kuI6+GydTZSXkA7/fBXd429k4pP1udAJ?=

=?iso-8859-1?Q?a4GTTXw2z13yUpxPIURTYd1SDViqKAPxUAD70fUfMf3xc7lyPA4+sS0iSc?=

=?iso-8859-1?Q?VOlvC07QJjLAgx1y0jDwu1ZJlX2Ve/49xys7JUzplaITDfB76zZEPuD2Jh?=

=?iso-8859-1?Q?A8X3YHXrjaUHjQRPG3Lz30IOQebWtJUgRBWzIT04EyizAhsHoQjHovPrR/?=

=?iso-8859-1?Q?whlCbVk6XJfpfTItJmzxsJQL7249UGmvA5/8ClFbyFqNU+j13OEdHNy/JS?=

=?iso-8859-1?Q?e8iBJySJNpoYVQ+Ajm5k43/uRmqTv1LEfm1wDVP42Br7/Dt03QsDl3VHvf?=

=?iso-8859-1?Q?u2cfhPghSV2og3XXNRnckj0ZDCa33HgQ7D8I+MUWjixAKI5hWPh0NhpS9y?=

=?iso-8859-1?Q?uHJcIAq1IktURcJJlUU+nkeGb6Z8FkhEVK3lv+rUhsDxWOHzFqE0V4FQ0b?=

=?iso-8859-1?Q?kmFsno80qeU7z9UF1P2t8M8ydJYlGpIk7328R79PomJS08vybFCa5R+uRE?=

=?iso-8859-1?Q?wQNv+HNPZFnsI0Z3vNmD2VXTKAOhqun8h0DfHRudtJ96L6Y6vi+kUXkvaZ?=

=?iso-8859-1?Q?THq4hshRsG5SsfaDVYyiYzkPai6F7Z9EizDWuuyKMAXz/28fnmZswkF0Au?=

=?iso-8859-1?Q?MxEa/DM5Ufqn9HvTz01Q++wPxVgE8faOS8RLURproBWaFmItnSI/ZE/xSa?=

=?iso-8859-1?Q?tzIt5Im+sxESuwJimZyIzAS39L8oG7BksCpjDNQHmkxOm5XzyhXbQr8Dz9?=

=?iso-8859-1?Q?Iui9PtOHiZ+36nYR76AolJJkSd5cDVTb3NklxZt6TcOY5b6v9dhhecCjPl?=

=?iso-8859-1?Q?UWt9mxnUU+GT/vJB+pyE9nMMtW8pP7sTkRwGVWRWQtWjFLw=3D?=

Content-Type: multipart/alternative;

boundary="_000_SI2PR02MB52258A771499552D8E33FC0BAE2B2SI2PR02MB5225apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SI2PR02MB5225.apcprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 4b1bf9d0-6b50-4013-781d-08dd114901ae

X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Nov 2024 14:12:21.4912

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: KL1PR02MB6917

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Good Morning, Sir/Mam,



Content analysis details: (7.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.64.25 listed in dnsbl.ahbl.org]

[52.103.64.25 listed in dnsbl.ahbl.org]

[52.103.64.25 listed in dnsbl.ahbl.org]

[52.103.64.25 listed in dnsbl.ahbl.org]

[2603:1096:4:154:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:1096:4:154:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:1096:4:154:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:1096:4:154:0:0:0:11 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.64.25 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.64.25 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.64.25 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.64.25 listed in dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.64.25 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.64.25 listed in list.dnswl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_SIGNED Message has a ARC signature

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[sonaliseksena(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

Subject: {SPAM?} cost_?#$



--_000_SI2PR02MB52258A771499552D8E33FC0BAE2B2SI2PR02MB5225apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hi,



Good Morning,



Sir/Mam,



sent you an email a few days ago in regards to the Digital Marketing Ser=

vice. I didn't get any response back from you,



May I send you a price list & cost? If interested,,



Still Waiting..



Thank You_!!



--_000_SI2PR02MB52258A771499552D8E33FC0BAE2B2SI2PR02MB5225apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Hi,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Good Morning,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Sir/Mam,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

   sent you an email a few days ago in regards to the Digital Mar=

keting Service. I didn't get any response back from you,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

May I send you a price =

list & cost? If interested,,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Still Waiting..



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Thank You_!!








--_000_SI2PR02MB52258A771499552D8E33FC0BAE2B2SI2PR02MB5225apcp_--

X-rated French OVH spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 07:42:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHOf7-0000000071f-1wOT

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 07:41:33 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 07:41:33 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip91.postal.corpustech.newsletter-verte.ovh ([139.99.186.91]:41441)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHInQ-00000000I6q-0Ju0

for doctor@nl2k.ab.ca;

Sat, 30 Nov 2024 01:25:51 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=newsletter-verte.ovh;

s=postal-w8ELVY; t=1732955133;

bh=75kQf7Dv0qL2+7vvp0UPbMGPr3wASepSN0I1l/cbWoE=;

h=message-id:list-unsubscribe-post:content-transfer-encoding:content-type:to:subject:from:date:mime-version:list-unsubscribe;

b=ihqMUNO1Z4ROa28odcREEoc10Ldib8pEDgGPwdrweK+MDZxaDZCXSAyEGLyUg0mr9tKzp0Vq

gbl2QHYKrckzPxOIxLl91V27GbRRdZdc1RpV8i2WOOG37pj2FAZbZU+UYXIli+OP8N/PGean

JKsmQUjpw4i5QrDx9WT3q5aDEv4=

X-Postal-MsgID: 0bNs2hxckfrKY8OX

Received: from postal.corpustech.newsletter-verte.ovh (172.18.0.3 [172.18.0.3]) by postal.corpustech.newsletter-verte.ovh with SMTP; Sat, 30 Nov 2024 08:25:31 -0000

Message-Id: <1732955131720807657.1.4868545805469959994@108052d93cab>

X-Listmonk-Campaign: b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c

X-Listmonk-Subscriber: e1d09125-499f-4cec-94d8-e6eccce26bf4

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8

To:

Subject: Rencontres Hard

From: "Rencontres Hard"

Date: Sat, 30 Nov 2024 08:25:31 +0000

Mime-Version: 1.0

List-Unsubscribe:

X-Spam_score: 11.9

X-Spam_score_int: 119

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Unsubscribe View in browser



Content analysis details: (11.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[139.99.186.91 listed in will-spam-for-food.eu.org]

[139.99.186.91 listed in will-spam-for-food.eu.org]

[139.99.186.91 listed in will-spam-for-food.eu.org]

[139.99.186.91 listed in will-spam-for-food.eu.org]

[139.99.186.91 listed in will-spam-for-food.eu.org]

[139.99.186.91 listed in will-spam-for-food.eu.org]

[139.99.186.91 listed in will-spam-for-food.eu.org]

[139.99.186.91 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[139.99.186.91 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[139.99.186.91 listed in zen.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[139.99.186.91 listed in dnsbl.ahbl.org]

[139.99.186.91 listed in dnsbl.ahbl.org]

[139.99.186.91 listed in dnsbl.ahbl.org]

[139.99.186.91 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[139.99.186.91 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[139.99.186.91 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[139.99.186.91 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[139.99.186.91 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

Subject: {SPAM?} Rencontres Hard








859-1" />








width=3D"599"

border=3D"0"

cellspacing=3D"0"

cellpadding=3D"0"

align=3D"center"

>






k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-txt1.gif"

alt=3D""

width=3D"405"

height=3D"121"

border=3D"0"

/>






k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-pic01.jpg"

alt=3D""

width=3D"194"

height=3D"592"

border=3D"0"

/>










k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-img01.jpg"

alt=3D""

width=3D"124"

height=3D"144"

border=3D"0"

/>






k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-img02.jpg"

alt=3D""

width=3D"124"

height=3D"144"

border=3D"0"

/>






k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-img03.jpg"

alt=3D""

width=3D"124"

height=3D"144"

border=3D"0"

/>










k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-txt2.gif"

alt=3D""

width=3D"405"

height=3D"34"

border=3D"0"

/>










k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-img04.jpg"

alt=3D""

width=3D"124"

height=3D"144"

border=3D"0"

/>






k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-img05.jpg"

alt=3D""

width=3D"124"

height=3D"144"

border=3D"0"

/>






k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-img06.jpg"

alt=3D""

width=3D"124"

height=3D"144"

border=3D"0"

/>










k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-txt3.gif"

alt=3D""

width=3D"405"

height=3D"92"

border=3D"0"

/>










k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-txt4.gif"

alt=3D""

width=3D"599"

height=3D"58"

border=3D"0"

/>













=20


: #888;">




ubscription/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c/e1d09125-499f-4cec-94d8-e6=

eccce26bf4" style=3D"color: #888;">Unsubscribe

  


ampaign/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c/e1d09125-499f-4cec-94d8-e6eccc=

e26bf4" style=3D"color: #888;">View in browser





 
//www.postal.corpustech.newsletter-verte.ovh/campaign/b4cac20c-c2f6-46c3-ab=

3e-fecea6ed3b5c/e1d09125-499f-4cec-94d8-e6eccce26bf4/px.png" alt=3D"" />
iv>





Nigerian Spam from Google

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 09:17:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHQ9A-00000000KUq-2EMx

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 09:16:40 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 09:16:40 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from eip.osc.tw ([210.242.50.220]:39096)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHOk2-0000000078s-3v1G

for root@nk.ca;

Sat, 30 Nov 2024 07:46:43 -0700

Received: from [195.178.110.25] (unknown [195.178.110.25])

(Authenticated sender: admin@eip.osc.tw)

by eip.osc.tw (Postfix) with ESMTPA id 72590C2AB938;

Sat, 30 Nov 2024 21:22:56 +0800 (CST)

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Respond now.

To: Recipients

From: "Mr. Femi Brown"

Date: Sat, 30 Nov 2024 05:22:50 -0800

Reply-To: info@bo-hatin-bor.ru

X-Spam_score: 11.2

X-Spam_score_int: 112

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: This mail is been writing to you because we have come to understand

that you have lost a lot of money all because you want to receive your fund

well note that all that have been put to a stop as the f [...]



Content analysis details: (11.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

[195.178.110.25 listed in dnsbl.ahbl.org]

[195.178.110.25 listed in dnsbl.ahbl.org]

[195.178.110.25 listed in dnsbl.ahbl.org]

[210.242.50.220 listed in dnsbl.ahbl.org]

[210.242.50.220 listed in dnsbl.ahbl.org]

[210.242.50.220 listed in dnsbl.ahbl.org]

[210.242.50.220 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[210.242.50.220 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_NAME_MR_MRS No description available.

1.3 MONEY_NOHTML Lots of money in plain text

1.0 XFER_LOTSA_MONEY Transfer a lot of money

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Respond now.



This mail is been writing to you because we have come to understand that

you have lost a lot of money all because you want to receive your fund

well note that all that have been put to a stop as the federal

government of Nigeria has promised to assist you with the sum of

$5million in other to compensate you and all you have to do is fill the

below information s.



1 full name



2 home phone and cell phone number



3 occupation



4 amount that was lost by you



Send this and get back at once.



Warm regards



Femi

AliExpress phish from Microsoft

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 18:15:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHC4W-00000000P0f-0pHY

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 18:14:56 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 18:14:56 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vi1eur03on2133.outbound.protection.outlook.com ([40.107.103.133]:29024 helo=EUR03-VI1-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHA44-00000000Ab1-1Z5O

for root@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 16:06:26 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=f3tbDlz2JO0MFMGDN4dgy+xF6yTwd2AIdv6u15OK3UeXKLpK5NlKVcXbPVMfe0YIquFBr1absCk1xFUKax8fswmXTAOsqFa7XOTUJDu8Pj9AAX5kKqeQWAX6dTDXLTHBS98L13fx5Nhj0MH1q90MZ8RcysycQmU97aFGjHmzkSoIUDeSuvRb///IZtPlmRqESPd2QVJ+HbcHYRaPdKDfOBcj5j/ZTF3lPeJuYZgdqyO6r3Ttdn2PpMZ2+zYEtfoc9Ky+8e2hJ15eD6c5ZsUb6qx3mX6h5zQ792RKZqoKKn8j6g2UsyQAbOrwhLoNBXq+BLmQGUG9+a8xZ1Xqj1vNHQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=+azpsvXIkauUHTC169M87G2qL/zrElN3GLrDYAQ1sSw=;

b=MrPoLIsPZQYpVGzSJvzON1h76j6+JMKIKMMXxBUU89YGqceTZ/FOlfhJ2Y4zsh2RyNzaTiUF/m6En7gNgBLb/1g8fbvHwPm0NBj+ICqayF84ietByIgjlylVbBd1Z3FQtOOza4184mJT9GCkN8w06g5IR2bqkFMeMqA5/RqEjtrz85f8lYafltmUDCXKoqCqWCqrvcFDsil5Fn5VZhMSa08Zjc0SxY9vW+1d9iFwxaTAYmL7u9KqbNSpTFYM6suQH7Bo32QuLeRmQLho+eVk3GcXkFX9oVrPhTu/6jN62WIDAXp11FD7bHcltX6oTk298t5oslZkO533YLEMuSDVKA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=giovanaalme.info; dmarc=pass action=none

header.from=giovanaalme.info; dkim=pass header.d=giovanaalme.info; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=GiovanaAlme.info;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=+azpsvXIkauUHTC169M87G2qL/zrElN3GLrDYAQ1sSw=;

b=UaEHe0o8PIdBByHAHoNCqqIkuZvX5W0unDYiKE/P7ZuFrkelV7k0vGC1FEY6c/1tiHce6jA/6PmKCDXPd1oAckKZSLFV1U3DIUsdvD/FyZP+tYkvS4F+9b1SZVKfQTHwc4V8Eth+2XxVVlWs20WWrbX2VHGxNrsL++w1IPFHRiLAcEIwjLmVQrGzGoxpIZf0fhX2lmpeYD0+3odufDTMJRWo5hrEJtn00Xwyka65hnHYcO7YzLiYoPkhOaQHdf5awj2cmwD33fl8y/3DlgqN5eY/Imn9hkcAVeIhPPp43nT35TMIIWOxmVMynuj+o6mhTRDh8GNR2peOlhQHXw+rYA==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=GiovanaAlme.info;

Received: from AM0P189MB0770.EURP189.PROD.OUTLOOK.COM (2603:10a6:208:19d::23)

by AM0P189MB0788.EURP189.PROD.OUTLOOK.COM (2603:10a6:208:191::13) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8207.15; Fri, 29 Nov

2024 23:04:17 +0000

Received: from AM0P189MB0770.EURP189.PROD.OUTLOOK.COM

([fe80::d144:16fd:8c72:758b]) by AM0P189MB0770.EURP189.PROD.OUTLOOK.COM

([fe80::d144:16fd:8c72:758b%6]) with mapi id 15.20.8207.014; Fri, 29 Nov 2024

23:04:17 +0000

Content-Type: text/html

To:

Subject: 🌟 Black Friday Starts NOW!

From: "AliExpress"

Date: Fri, 29 Nov 2024 23:04:16 +0000

X-ClientProxiedBy: MW4P220CA0026.NAMP220.PROD.OUTLOOK.COM

(2603:10b6:303:115::31) To AM0P189MB0770.EURP189.PROD.OUTLOOK.COM

(2603:10a6:208:19d::23)

Message-ID:



Importance: high

X-Priority: 1

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: AM0P189MB0770:EE_|AM0P189MB0788:EE_

X-MS-Office365-Filtering-Correlation-Id: 5d4af6ef-1db3-4471-f0ce-08dd10ca26bd

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|41320700013|69100299015|376014|1800799024|1032899013|4076899003|8096899003|2066899003|37730700002;

X-Microsoft-Antispam-Message-Info:

=?us-ascii?Q?p2lsl0mPRqdlWlMfMG2k5gp58H3lNbkZM1rVFT+Ps6KzrpvXi36ZHVUbQ9cz?=

=?us-ascii?Q?9VY0lOwfk2mLG+Jg4L//QQvp3Sb3G9KU11krc4li76LxN2t17EYyiapnhi8u?=

=?us-ascii?Q?LEgTVthpmTp35B6G0qG3RMaCuVA2z11OyyaiFpEy74cvWgk6B4dSCEIXmZ3D?=

=?us-ascii?Q?Ww+Zf2p+ZD39nlfZTdGMFddJPsFPRQiQZ49cEzClJVsGVG7HHikoDJLvSrmv?=

=?us-ascii?Q?+2z8ziCenTcSzHaEzEwcTlDh5E5+62kBSewptNy5+yS35kn8kwNNVOuJokxo?=

=?us-ascii?Q?TCwbgpDpLGofJl7rizWfT1XWrAXrT6V6/UgEE7SIN17XSPwI9xXK5ZiOqoLe?=

=?us-ascii?Q?Thp5PjlsbRbxBJInbkaBCTYnltcSY5mfP89Up7dY1lrVqoTiVx9leBnEZVSO?=

=?us-ascii?Q?4WReKS/9VkEJEaZTJEa/OFdH7PC/0RIuF6glbQUraP7U/pTgW5VLzXh+3T6I?=

=?us-ascii?Q?qPRKH0iM/3plQAwAqjceU44Ct+6APQkZMiDDxxaOO5n5GI5ToxJ1RHQCfWEG?=

=?us-ascii?Q?sxG42MDWTFTu86OqHKvCHFaV5YK3rAI/EvmIOakyBmLzjVuYkNhK4WwBJgLx?=

=?us-ascii?Q?DNgQC64dqyAFInsBvHsJDlC6l80BHNWgsHRB0EMN95IDx2udHgR1Cpbi9Z1N?=

=?us-ascii?Q?fth0zI5jN4pcNcLFlgSl8QBTZBIl0TC/rJQomc7gU1vrtnHZyZjvIb+L8PWX?=

=?us-ascii?Q?Toch2Yw2WL4PmwtHJtkDubKbdrPWlLtYJ6r8EqMTpauq/z9x8odbQSesLw0k?=

=?us-ascii?Q?qxqPf/OyVviJTqakD6UNkY8DyL4qIivHPiMq0rLQvyZZwITEPvlgAG2BQyon?=

=?us-ascii?Q?+JkVW/oda8MWRv4oAFk7MCuTGChKIs2d2Xk7BqBWK18KyaH+2X/MadmN9uLs?=

=?us-ascii?Q?P0tuh+IP95YCUTkYGwM6ASXFu32/QI0H0jxS+wRq8LIiCY6Q8BoRr1JTh3pB?=

=?us-ascii?Q?uKn2BrTvm0OQuF01bsE9sFFLX7eqsPN7l4JrMMFA1Z8UoPy6QMcaNeRlonj0?=

=?us-ascii?Q?nD+6KuxHYQCB3Iie0NFKc761bORGhDe8W6k/5UIVNPMzGgrIwPgLwX1tBUes?=

=?us-ascii?Q?fCQp6od7Is3XvxSrbGf2TWhIxC1iAg=3D=3D?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM0P189MB0770.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(41320700013)(69100299015)(376014)(1800799024)(1032899013)(4076899003)(8096899003)(2066899003)(37730700002);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?us-ascii?Q?VA5XqvKzVVjjX5fKQh6IZSTwgJsMcvugKbeLKaeIMEecd4p1+0RdDFVFEj8C?=

=?us-ascii?Q?zDDFQtGHhhVtIY3PYzFbwKGJfG5i8WKHnPOEy89fhXTyLNXBBpOjYvHVnDCx?=

=?us-ascii?Q?nYsxMfZFxdn1IChN/Xmz1N4HimkRWw45lxf52JbBxxOFcsE1oOzYWGhCou6A?=

=?us-ascii?Q?ZFinhYyPTcQ7i2VbZ7r9fAgsk4P/w8Qj7uAUC1paWTsOQ+S+YaNKJx+VnBzd?=

=?us-ascii?Q?I7fkhXKtvjiSOlv7RrzXeoXZLG1DRyb7u/BnvGdCyQNWKjsYN1dOJZ9hxs1Q?=

=?us-ascii?Q?mREsO6aOTd9wNniSV9oJrjkappYsf2ONbH6kYUvN37bUfLXPf4tJyBA+mgic?=

=?us-ascii?Q?Uo+44eXkwxFGw1+DY8OcjOAwf1DaxzW7TCpUx2CbAKQOeRzDHfHZr0kykVE3?=

=?us-ascii?Q?qT6T4TsSY46CVwjP/cofTWbsDRDdWkhR1pzZv+TXgJp3ETXjwAeQw/3LsE+q?=

=?us-ascii?Q?Xl9jY1he/6mB1Oxk/jUj4sJRpJyfNrQSBaS3MN9s8IxD2DkrX2Kl6A/UpZjB?=

=?us-ascii?Q?UgwA18HHjVRTLfcVTTT90/mANoY455E1P4PCAfMpNZk+Nbhy/g/cA4+F+spb?=

=?us-ascii?Q?993yoh39ysDwIB4GuIfYIP0oepbJC1Jrde5/1ZhrjC5Y8T+SN8blTRPsk0DN?=

=?us-ascii?Q?B2QEJ/RcCialKjz7NlPSlvl49XbZ0RUIzvmrPZhyY8A86kR/c/6ZGzcS7/xn?=

=?us-ascii?Q?doKkN2BlqirzJtLud/iVcU3rhFZ1rwU5Tjjv8Oqebu97vGi98DxeMGNKX2dt?=

=?us-ascii?Q?OH+t7AGEpXk6o63/Lk9UODz0GZ3zeHRSvAs62g4cQRqGmN6oYZMg2o5atgVA?=

=?us-ascii?Q?/EBOrBb/cfRE+jPzaccss6fT3VKmQkcakOglB+Wa1mWQ+9ogapp2D27emjnI?=

=?us-ascii?Q?d13q5+Tzr/1joYr14VR+WRPG4rAc5uvh2pZ/iBzw/mXWJ3s6q7ATFiMsGw0H?=

=?us-ascii?Q?UZsCk04IDA7uIQUl18MccukX+P5JWG5IobiYUL76joXz+2FvTp20Tz04pNam?=

=?us-ascii?Q?+g8ZEdvVtjXXHrArP8+A/cqz+7ho905aBQoYmwaUdOE/i8UaLMbia5pdJk2u?=

=?us-ascii?Q?Ba6kftlgbh+NNopxy8SoCCYiDiRLk/CmF7ZdBW2iFMMhVFbcnipyoY8D5aev?=

=?us-ascii?Q?T+xB76VNZXvuP6vDDAE/nlUiMCAaQlqbVPDZ4k8MH+nRpf1hH7HtXqVSDhu8?=

=?us-ascii?Q?3SgAJo3P/4mb8DSzD4s/oYpupoEd5GpMNJOs1r0kgeGuxN9ofV6Xe6GcnLZa?=

=?us-ascii?Q?5/bE/5GgKWyCcnZFaeJhE7oBPqapO+mvNHom0GNgSWgzwfLrZdk9mTg4HXEk?=

=?us-ascii?Q?YX5nl/M2JrOcD9H3QNXcgpEmus5k3g0BP/L/PZCyLIA8V3/t5y/bF6evulq+?=

=?us-ascii?Q?b9eyJ/n8OzdFXYyeFWYOpVQ70OJTTSP64wlRv/A4DpX6GfSFM/SRQvAiVvdU?=

=?us-ascii?Q?IiEOeM85LuxpGRakh7Nm89S8ZW1nrW7gLYSCE9qeOVDJ3bVjVZpxW9/S4aWF?=

=?us-ascii?Q?4JXMbV2IPy0ylytxhujU9NXUkPyaRe3clcyOWa5oS0Wp9/7MAdA8JFpNTX1k?=

=?us-ascii?Q?hgh904OX0SO5jQF7swYiu2cHzBYfFbLkqYSfuTBuVHNqXAwnIQ6AxzjdvEF+?=

=?us-ascii?Q?LmWFfP30VqnPt8n3VC2E2rw=3D?=

X-OriginatorOrg: GiovanaAlme.info

X-MS-Exchange-CrossTenant-Network-Message-Id: 5d4af6ef-1db3-4471-f0ce-08dd10ca26bd

X-MS-Exchange-CrossTenant-AuthSource: AM0P189MB0770.EURP189.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Nov 2024 23:04:17.6506

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: e5327ab5-1590-4b56-a638-22076be599a2

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: d3+s+O4645EVxjGAOe6oJl7VuVFTxpN7k+1qbVdLslpbOnTLUSSrFaOEuhTzW/NjlgQ7b2rS+orev8TkIE6rkgdU1909nISH6NadYnCb9eUlqN/IkeKiGCLJBWor7Mxp

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0P189MB0788

X-Spam_score: 18.2

X-Spam_score_int: 182

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (18.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

[40.107.103.133 listed in dnsbl.ahbl.org]

[40.107.103.133 listed in dnsbl.ahbl.org]

[40.107.103.133 listed in dnsbl.ahbl.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[dnsbl.ahbl.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[dnsbl.ahbl.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[dnsbl.ahbl.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: giovanaalme.info]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.103.133 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.3 MIME_8BIT_HEADER Message header contains 8-bit character

1.0 FORGED_SPF_HELO No description available.

1.1 IMG_ONLY_FM_DOM_INFO HTML image-only message from .info domain

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 🌟 Black Friday Starts NOW!













image





image






Alibaba phish from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 18:15:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHC4P-00000000Oz3-0mEf

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 18:14:49 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 18:14:49 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vi1eur05on2117.outbound.protection.outlook.com ([40.107.21.117]:36416 helo=EUR05-VI1-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH9kn-000000009fK-33Ul

for root@nk.ca;

Fri, 29 Nov 2024 15:46:30 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=T+0BMWhhpDeOjliLth7y6fUoZmxVETa6lUIGRGKIcjT2BwulsD/JsVjrrvySyFtLLTUuq+6h7ZsxuCMx6hMfYRHFNZT7m1MKV20tB77+5d72/MsoizJNE7ZzAERn6q/4dcht3tFV0YxQi/VFovhtv5B5MdDiFlexQz/yXtqVOKD6Q+JGoHUaanNTa7UIg6d1ROX3oYCIEPHPpgaJkcjbzTbh9rzWMzsNKAzZZDANHiPwMRv7MTPGDafqf4RRHEePUcne6CcAFiXWzApmUufvNWqJ77L7Z91FJym+Y7ClP5qL8DEhfQEjP/RofrFCjK9lNrf5u211x+IOLRHiU8ujew==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=+azpsvXIkauUHTC169M87G2qL/zrElN3GLrDYAQ1sSw=;

b=fp1Kjx53ybajiJA52ujDwgM6VFBwMZftef/0QM522+hk92IaflHQZM9sjRR3mAI0YPa9VbCNXYSLiQl/5MNg6JB1gTVU2KYkaa4RRKpU62cxc+jTZ2BWQ/5YTRcKfVP2kT6MdXuC6voKibPTsyn9blQHKcu0N17yxOpj9hopqDfxhdc0qt5UyICfc38u7yJjfYRsdOuGfXw1XX2TzmTelxLtuIBDO6O/S3AOcbRTCMWEKshEJFmckhDY1eEriPMahppipqJ7MKHb4KUxjEwWQdOb1gbDN5wCHMn7MDcDp8/jEd1xwM2+x6eQKbvTifSB26LdUIVKzv9a4g+rEDrsYQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=giovanaalme.info; dmarc=pass action=none

header.from=giovanaalme.info; dkim=pass header.d=giovanaalme.info; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=GiovanaAlme.info;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=+azpsvXIkauUHTC169M87G2qL/zrElN3GLrDYAQ1sSw=;

b=NT7u9ictZf/siv/UnOREGPWCAHuStvARMAGBAzMo7jAku99BFXCSKewThK91NDInWBoM9Eq1bw4kQMZvsT1/Z/O5VzpulpmNmlB+GzldC2MGYCVPl+YLoovAc1rTc8cX9CAiJxX7EWNixweBskFrShTwRUFBJVKehqAIL1whzLFNv3Byf8nwWX2nge7tctgtsdBDOmrZVx4sshUCzo43qt6ZOrTufiHQpmYh6Ui3tm9v3LxT1gQ/v7c6PWJ1DBwNNFEDVaI0hS4kDvf0kQqgCDmbBZ+8o9R/kquNqbNhj2XBtEP5Ui2MMYP0iGpLcQvSgxFDKs4QP6c1pAvu3YYUiQ==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=GiovanaAlme.info;

Received: from HE1P189MB0443.EURP189.PROD.OUTLOOK.COM (2603:10a6:7:58::15) by

GV1P189MB2292.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:97::5) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.8207.13; Fri, 29 Nov 2024 22:44:20 +0000

Received: from HE1P189MB0443.EURP189.PROD.OUTLOOK.COM

([fe80::43c2:3ef1:14cd:ffd2]) by HE1P189MB0443.EURP189.PROD.OUTLOOK.COM

([fe80::43c2:3ef1:14cd:ffd2%6]) with mapi id 15.20.8207.010; Fri, 29 Nov 2024

22:44:20 +0000

Content-Type: text/html

To:

Subject: 🌟 Black Friday Starts NOW!

From: "AliExpress"

Date: Fri, 29 Nov 2024 22:44:19 +0000

X-ClientProxiedBy: SGBP274CA0023.SGPP274.PROD.OUTLOOK.COM (2603:1096:4:b0::35)

To HE1P189MB0443.EURP189.PROD.OUTLOOK.COM (2603:10a6:7:58::15)

Message-ID:



Importance: high

X-Priority: 1

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: HE1P189MB0443:EE_|GV1P189MB2292:EE_

X-MS-Office365-Filtering-Correlation-Id: 039cc91a-3d94-4667-fa5a-08dd10c75d29

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|1032899013|1800799024|41320700013|69100299015|376014|4076899003|2066899003|8096899003|37730700002;

X-Microsoft-Antispam-Message-Info:

=?us-ascii?Q?RgaPRJUrasqx/sbWO7XP0t/Lfk2iieZBtWy0MP4ZAGJ+zVEWXbfAZNaAcCdu?=

=?us-ascii?Q?bkYGLV08rnUbOPenpZ4YiWmVlBUH6OYhLWzENbCSRUiLH0RDYJ7iv6PV0tlt?=

=?us-ascii?Q?XzvFeW5h+Bdgv80V2cicNnHxcaHWW89vGhTMFbK1PDRkuGz4b5AbU9ZpVAsR?=

=?us-ascii?Q?Qt3aESTbk3ycQwq4ktVHQFCP93kgSN5aBAbC+Y3vvGq8QYvNEx8Yh9XU2MUa?=

=?us-ascii?Q?Xj+hGR5ejAeiSEH2ZepnuWynyoRtLCxaxcgMC5k1y4J7f1uX+FjoXqHnPdrX?=

=?us-ascii?Q?3lVhGEuwjZe9rdQfPuKA9f3qjXtdY1QWpODayRSzH8Ehnyye2CCoaz3S15ZA?=

=?us-ascii?Q?GREInkJe3J7Ko+LmeRQ751FxMLK3cquj03F/yXb4JYO3aPchbpcvsX2k6fKB?=

=?us-ascii?Q?xbE4QyDtUZLkNmsZOCK5ilo2fhEdQgS5iAPQAQGjqUBO+rQtvRVnh6ELB9PV?=

=?us-ascii?Q?feFxUV/OmnXRdI9VIOUE6wfhyhNPYkSB0uJJYqrQFwNTqQcJ6blVqL36GX6g?=

=?us-ascii?Q?oW3d9XeLc7Ub0Xsz2BsPTACWJ2iS4HGyxX3T55lGoTSagGkKDFkSV7K9SgNn?=

=?us-ascii?Q?ll6U3DYwZGTGpkZcPzlfvB4sgT2p7FiS2w37AS+e/89CZMB+Z7D66cesjjzj?=

=?us-ascii?Q?vNeS/p0pKI0YKCrMUNyA6D0a55lT4y3pi5Ofvg+rll4V2oDHKEikRB4tv5XF?=

=?us-ascii?Q?guX6UJszBhzPN5rpzj457F4ttx6SBoO7USTivwSD0pWL8C92eo/UUgBzwmtJ?=

=?us-ascii?Q?rv8SxwMOVYlMLCM0E4tMM8mKiXQSC7+K0FhU49Q+T6uhk8Fo0k2ocD6I9BKd?=

=?us-ascii?Q?r3wuZDUD5ePQqHuXv0BO1R2CQRq/cvvDwxkiHunkbpoA++fUTTogzNngE5WK?=

=?us-ascii?Q?zSm8vSpyFzbERvbiru4fkt1IdoczxNjN4p6N4JnuZOcm+8a5texaL5CpbW9R?=

=?us-ascii?Q?k4Khv19A+SAPNa1ul1cUmq/PEa/CRrM1cqrV6H+AZQmTd9MlYA0/DV8sJn8/?=

=?us-ascii?Q?PaabQf52dULz0SeIa5W255jRBy4fRmeXvf036thRsB76QveOvhIaKJCQHZzq?=

=?us-ascii?Q?S/rc/UxUGGFjsKPFiMwp2J71Vsasxg=3D=3D?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:HE1P189MB0443.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1032899013)(1800799024)(41320700013)(69100299015)(376014)(4076899003)(2066899003)(8096899003)(37730700002);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?us-ascii?Q?a2MrLjWdytujXkPXxCEtsI/fslgmVP3+Hc4pi+bBStLfLuG+5hWvZ8gxRTPO?=

=?us-ascii?Q?Qzl44TmKuw0boRwqTMSqJ2J0lxRtrXwvhpldeSz9nCqCZvF+n3wxAzvZ19XG?=

=?us-ascii?Q?6+Sx8M722q1tt4NYqrWbhyg/eTnMOlUahd3IY4YbHaC2Ps53cd5SFOQDxcyO?=

=?us-ascii?Q?NVO2gW+1AMkUVWW8hf0kzSJl8KvWzEhU1dSy7FFJX8SgF8B/vXXRzvORY0LR?=

=?us-ascii?Q?rZ2BkPKSKg4NkGzr0qO0nFqPcD/pvr8phmuv7KKAAy3BO4SdJh43ZTSBKsGm?=

=?us-ascii?Q?UqymChCjyvJWRssNU1AQW3xEyJDANyAdzPAdc8TnXmtMvaW1MA/RfFlnp1q7?=

=?us-ascii?Q?0nn4WecwIt/LmQBK6nlVIUtKBVAqQweeuJWUWFnVpw8VpZjHf99Y9sxZ6Ird?=

=?us-ascii?Q?E8gsthWxZ0V42lvUfaAtDKQtxX7amTb3MqFa9fVG5H3dh3aHqPG4ljOdPUk9?=

=?us-ascii?Q?HWNhDrp8uAWYf30Q3hLvfHH1c4GHvnqGFFeDne6xPr6EX4pcwiJWRS3/wZM/?=

=?us-ascii?Q?ifWPLdKb/meHu/hg9/apMdI0xu3nUp9jkTgfwhLeRY8OW34+HpHN2X38qg0U?=

=?us-ascii?Q?4Q1lLqwS6Ufz18VQdUaEsEPHQIEInJxfrmPxMQcx8mNFDKa5MZlBVqmVuouD?=

=?us-ascii?Q?qdq0VqRWUePq0Iz5HNeHGG/AisBg2JVS8eglWYIczvb6IacMR+tBAlPnfJfY?=

=?us-ascii?Q?52MqyOGtZHULGu0mOM8Mmwr5NNnkfLHW5Zb23npFWY8DnBseVyPQ1IeRzdHN?=

=?us-ascii?Q?DUUvqz9Jz46ryGfI8Ss33jT97HhiUAvEbpQyPwx/jjSDfbZKel1Z3IGCUDNS?=

=?us-ascii?Q?v48OkOlXuhGgaK5gjDAf1gIG6kZOCl5TRWl+7KprSvuXaAp5YLOWVdaP7thm?=

=?us-ascii?Q?J2zvftJ7GNFQCtUEg7TJwynlbmW3Ttl3l8cHcfPntL8i8VDychvUh8BPkXIM?=

=?us-ascii?Q?F/8aZddVKokg7tvAApyu7xY8P3/ElliThUX+0FeENTgtXxNFvkP1emMJlQ6C?=

=?us-ascii?Q?gr1hxy2TZMD/DtJDHVnEeuxgSuoTM6gd7KwGIvk+1JCY9TKtPWcS6sgZ+3eh?=

=?us-ascii?Q?VQNDofsET0AQ72f3F3oZSjJooamp2XDIaT88m4tGmAaL06b5r6qhpZcvZWH1?=

=?us-ascii?Q?J7zY4Vk+VdOg7ThGu+6uLlWc3wgL4xttmHumvl7SOAA1ojrFtU0X9QGtJxec?=

=?us-ascii?Q?riM6damgWw8HES7mwahSoMOxJifk9kv5KDkpW5cifKQkQ3DBVviaJIWKyRnL?=

=?us-ascii?Q?4ByB9qGi8UDc4PYKMhy6gdFper68NeQWlmf0+rNuGPik3jI0G0Ma/gc3QTUG?=

=?us-ascii?Q?otbMxUegtbtQhQhWszl8KSxZZKrGDr+ilwBql2Eu0/gEHITPolj6zEgyC3Sx?=

=?us-ascii?Q?EHNN91lyUSqVsIyectlG90M8nkYa/+seNNDEQOH9ockpdmVHSzfLOzid+mYk?=

=?us-ascii?Q?V7ZNeNRR5IU5F+FKnJU/+H5IUW9YvvFZkJFmbTGp9DLP6DZXj6G9wVvPD815?=

=?us-ascii?Q?tlxsD2DCHL/kTali5SwT6F1ytqgDLJeQOJ4SeVvyykZ0S+wPnsMRYF1lfa0F?=

=?us-ascii?Q?wboqAhex3ct4yFjI+S5aGMUCeQsZT0YAopPcfxrSu+ctxpgtIZ63UuRUD3Q1?=

=?us-ascii?Q?5jJL7oPKay66PQAiJJgwel4=3D?=

X-OriginatorOrg: GiovanaAlme.info

X-MS-Exchange-CrossTenant-Network-Message-Id: 039cc91a-3d94-4667-fa5a-08dd10c75d29

X-MS-Exchange-CrossTenant-AuthSource: HE1P189MB0443.EURP189.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Nov 2024 22:44:20.4907

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: e5327ab5-1590-4b56-a638-22076be599a2

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: DdroZ0dxfo3mlsrTEhkv1rfpZDpx0MI4GLzR6McEkoHCCuN7MFC+iLlrJS0pHST1qlZ8fBeKeZ6xgFjz7qW7NlHmedLvXh09vL0UPMLWBa/6gf9XuAgkSqkCzjuKlkpv

X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1P189MB2292

X-Spam_score: 18.2

X-Spam_score_int: 182

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (18.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

[40.107.21.117 listed in dnsbl.ahbl.org]

[40.107.21.117 listed in dnsbl.ahbl.org]

[40.107.21.117 listed in dnsbl.ahbl.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: giovanaalme.info]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.21.117 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags

0.3 MIME_8BIT_HEADER Message header contains 8-bit character

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 FORGED_SPF_HELO No description available.

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

1.1 IMG_ONLY_FM_DOM_INFO HTML image-only message from .info domain

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 🌟 Black Friday Starts NOW!













image





image






Costco Phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 18:15:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHC4D-00000000OwO-4BTv

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 18:14:37 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 18:14:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 82.83.155.104.bc.googleusercontent.com ([104.155.83.82]:50488 helo=sncf-connect.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHAOY-00000000MZy-3DWk

for root@mail.nl2k.ab.ca;

Fri, 29 Nov 2024 16:27:35 -0700

Received: by sncf-connect.com (Postfix, from userid 1000)

id A3CCA485775; Fri, 29 Nov 2024 22:12:40 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sncf-connect.com; s=20230601; t=1726561367; x=1727166167; dara=sncf-connect.com;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=Nll/WDt2gQK3B1pLcBWnOeDo4ix8zlwU6y4wcQbET3e8Ud4yKxxayR97VfQaD/yEUB

/3lzrmI9aVrjMBKp4UBbzQEFy1CJ9o5KInk0Ue6G3N45uCA3KibMcA+hx3xlrX+tiQ7d

l5cSlBY1buJ29w5kVEMdgyVnBY3wARaW9fTRpkr29z3//BpwF1Ky4QG4nx42bq+y7GI/

fjLekQhu1kX0dCBNKI5S3BR9X+KLbFHRgJDrW5MAxF2G695yFOfybboVnR7bbN1LHnNC

VvJ4XTu8y6sgmXes+FmgCvhR0+deazi4IyT4hcGkUr3tgAZa7ZBs7/amS6XWB4t3ECbo

ThZA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1726561367; x=1727166167;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=hKeB+IPnwQCcgtmF/hdw8S8R1s6Ma7WWp9Kzfw6x8bdfXSg3eKLVGu1tp8GHKbCiF8

KD3+7DgE3aTLFVqHFJWorhQAU1kw6iaNZOqIq8LVHess6499p84z9qr9GgSNmmDdSmfT

Of+JW8FjnLMsA4uJ+e1HMQwkEtvU6aN6UCegBZI6UDXC7bCG4E66F7ygIkEN9Sb+jU7g

QMbQYlq1vGWQqXN0LcHOeootC1R4sKfMC9H635FcQcjFV/rhkLs/kH4S1dTfhQs+DKo7

BwBla4YFwO7tuS7S9sYYpPyK1ZdI+vQ4Y52FOUKnMZN+AL3BhWPAb5aPNkElNYJ6G7CI

mTAg==

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@sncf-connect.com header.s=20230601 header.b="Nll/WDt2";

spf=pass (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=sncf-connect.com;

dara=pass header.i=@sncf-connect.com

To: root@mail.nl2k.ab.ca

From: "Support"

Subject: 500$ Costco voucher back in stock, with ZERO cost

List-Unsubscribe-Post: List-Unsubscribe=One-Click

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

Message-Id: <20241129231257.A3CCA485775@sncf-connect.com>

Date: Fri, 29 Nov 2024 22:12:40 +0000 (UTC)

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Don't miss out on this incredible opportunity to stock

your pantry.



Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[104.155.83.82 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[104.155.83.82 listed in zen.spamhaus.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: upsearching.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: upsearching.com]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: upsearching.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: upsearching.com]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 500$ Costco voucher back in stock, with ZERO cost











 
















































































     
  Hello





Don't miss out on this incredible opportunity to stock your pantry.





Enter the contest today and you will be in draw to win $500 to spend at Costco, absolutely free! 		 






























 

















  Click Here  


 
  This contest is not sponsored or organized by mentioned brand  










Costco Phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 14:06:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH8Af-0000000064D-2Txs

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 14:05:01 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 14:05:01 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 82.83.155.104.bc.googleusercontent.com ([104.155.83.82]:40000 helo=sncf-connect.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH86h-000000005sQ-3Tny

for root@nl2k.ab.ca;

Fri, 29 Nov 2024 14:01:00 -0700

Received: by sncf-connect.com (Postfix, from userid 1000)

id BF2B422ADEC; Fri, 29 Nov 2024 20:34:42 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sncf-connect.com; s=20230601; t=1726561367; x=1727166167; dara=sncf-connect.com;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=Nll/WDt2gQK3B1pLcBWnOeDo4ix8zlwU6y4wcQbET3e8Ud4yKxxayR97VfQaD/yEUB

/3lzrmI9aVrjMBKp4UBbzQEFy1CJ9o5KInk0Ue6G3N45uCA3KibMcA+hx3xlrX+tiQ7d

l5cSlBY1buJ29w5kVEMdgyVnBY3wARaW9fTRpkr29z3//BpwF1Ky4QG4nx42bq+y7GI/

fjLekQhu1kX0dCBNKI5S3BR9X+KLbFHRgJDrW5MAxF2G695yFOfybboVnR7bbN1LHnNC

VvJ4XTu8y6sgmXes+FmgCvhR0+deazi4IyT4hcGkUr3tgAZa7ZBs7/amS6XWB4t3ECbo

ThZA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1726561367; x=1727166167;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=hKeB+IPnwQCcgtmF/hdw8S8R1s6Ma7WWp9Kzfw6x8bdfXSg3eKLVGu1tp8GHKbCiF8

KD3+7DgE3aTLFVqHFJWorhQAU1kw6iaNZOqIq8LVHess6499p84z9qr9GgSNmmDdSmfT

Of+JW8FjnLMsA4uJ+e1HMQwkEtvU6aN6UCegBZI6UDXC7bCG4E66F7ygIkEN9Sb+jU7g

QMbQYlq1vGWQqXN0LcHOeootC1R4sKfMC9H635FcQcjFV/rhkLs/kH4S1dTfhQs+DKo7

BwBla4YFwO7tuS7S9sYYpPyK1ZdI+vQ4Y52FOUKnMZN+AL3BhWPAb5aPNkElNYJ6G7CI

mTAg==

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@sncf-connect.com header.s=20230601 header.b="Nll/WDt2";

spf=pass (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=sncf-connect.com;

dara=pass header.i=@sncf-connect.com

To: root@nl2k.ab.ca

From: "Support"

Subject: 500$ Costco voucher back in stock, with ZERO cost

List-Unsubscribe-Post: List-Unsubscribe=One-Click

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

Message-Id: <20241129204515.BF2B422ADEC@sncf-connect.com>

Date: Fri, 29 Nov 2024 20:34:42 +0000 (UTC)

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Don't miss out on this incredible opportunity to stock

your pantry.



Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[104.155.83.82 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[104.155.83.82 listed in zen.spamhaus.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: upsearching.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: upsearching.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: upsearching.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: upsearching.com]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 500$ Costco voucher back in stock, with ZERO cost











 
















































































     
  Hello





Don't miss out on this incredible opportunity to stock your pantry.





Enter the contest today and you will be in draw to win $500 to spend at Costco, absolutely free! 		 






























 

















  Click Here  


 
  This contest is not sponsored or organized by mentioned brand  










Costco Phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 14:05:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH8AY-0000000063R-1m6g

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 14:04:54 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 14:04:54 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 82.83.155.104.bc.googleusercontent.com ([104.155.83.82]:58984 helo=sncf-connect.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH83M-000000005lK-1a8D

for doctor@nl2k.ab.ca;

Fri, 29 Nov 2024 13:57:32 -0700

Received: by sncf-connect.com (Postfix, from userid 1000)

id 02B55216D37; Fri, 29 Nov 2024 20:24:41 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sncf-connect.com; s=20230601; t=1726561367; x=1727166167; dara=sncf-connect.com;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=Nll/WDt2gQK3B1pLcBWnOeDo4ix8zlwU6y4wcQbET3e8Ud4yKxxayR97VfQaD/yEUB

/3lzrmI9aVrjMBKp4UBbzQEFy1CJ9o5KInk0Ue6G3N45uCA3KibMcA+hx3xlrX+tiQ7d

l5cSlBY1buJ29w5kVEMdgyVnBY3wARaW9fTRpkr29z3//BpwF1Ky4QG4nx42bq+y7GI/

fjLekQhu1kX0dCBNKI5S3BR9X+KLbFHRgJDrW5MAxF2G695yFOfybboVnR7bbN1LHnNC

VvJ4XTu8y6sgmXes+FmgCvhR0+deazi4IyT4hcGkUr3tgAZa7ZBs7/amS6XWB4t3ECbo

ThZA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1726561367; x=1727166167;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=hKeB+IPnwQCcgtmF/hdw8S8R1s6Ma7WWp9Kzfw6x8bdfXSg3eKLVGu1tp8GHKbCiF8

KD3+7DgE3aTLFVqHFJWorhQAU1kw6iaNZOqIq8LVHess6499p84z9qr9GgSNmmDdSmfT

Of+JW8FjnLMsA4uJ+e1HMQwkEtvU6aN6UCegBZI6UDXC7bCG4E66F7ygIkEN9Sb+jU7g

QMbQYlq1vGWQqXN0LcHOeootC1R4sKfMC9H635FcQcjFV/rhkLs/kH4S1dTfhQs+DKo7

BwBla4YFwO7tuS7S9sYYpPyK1ZdI+vQ4Y52FOUKnMZN+AL3BhWPAb5aPNkElNYJ6G7CI

mTAg==

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@sncf-connect.com header.s=20230601 header.b="Nll/WDt2";

spf=pass (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=sncf-connect.com;

dara=pass header.i=@sncf-connect.com

To: doctor@nl2k.ab.ca

From: "Support"

Subject: 500$ Costco voucher back in stock, with ZERO cost

List-Unsubscribe-Post: List-Unsubscribe=One-Click

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

Message-Id: <20241129204255.02B55216D37@sncf-connect.com>

Date: Fri, 29 Nov 2024 20:24:41 +0000 (UTC)

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Don't miss out on this incredible opportunity to stock

your pantry.



Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[104.155.83.82 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[104.155.83.82 listed in zen.spamhaus.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: upsearching.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: upsearching.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: upsearching.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: upsearching.com]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 500$ Costco voucher back in stock, with ZERO cost











 
















































































     
  Hello





Don't miss out on this incredible opportunity to stock your pantry.





Enter the contest today and you will be in draw to win $500 to spend at Costco, absolutely free! 		 






























 

















  Click Here  


 
  This contest is not sponsored or organized by mentioned brand  










Instagram followers spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 14:05:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH8AF-00000000632-3xUP

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 14:04:35 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 14:04:35 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-il1-f197.google.com ([209.85.166.197]:58472)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH6hQ-000000001jz-3NJh

for sales@nk.ca;

Fri, 29 Nov 2024 12:30:48 -0700

Received: by mail-il1-f197.google.com with SMTP id e9e14a558f8ab-3a7e1527971so2402475ab.0

for ; Fri, 29 Nov 2024 11:28:54 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1732908528; x=1733513328; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=1lq+Kkx9n4m7WcFSg/0zVm8p5ejfcHq2ERtcV30BRtg=;

b=dSBviVXIxtqV3+5Dv59jelSb+komDYHiM11OCs1MCGJeX868oVVfIAAOyYvcSqA+Xn

QpE5sQjuFxfxaMCo4qStdVkWB8zb3xHcVS0IzZqpRrxRZJWDYrMWd4HnZPv0yCE81rjd

DfnZ+HQ1iY/oX7fditglvOIHuf1y5q/pE5gH7unuSauqe+GhqB6tip6iq+jL0fz0uKkC

hnyj/PqIYzvIRdzOAtnYYf6L9irwLoOjdQ4kzg0302FMTHPKpwVRFiIwar7jSYdnlY1I

yvkVEZvg0tNhih7sAefr027rboNpAHWkTZCafCWq/2mAMZ6rBrEaGqbsxfF+HAAAPtpo

zQtw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732908528; x=1733513328;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=1lq+Kkx9n4m7WcFSg/0zVm8p5ejfcHq2ERtcV30BRtg=;

b=JG2Bqhto/LGoI7PG5BdsEMmfWs9OarZK5ipv5ID9SD8xhHgVky1FauNAllvvs8/H+F

EautMcNH4C4pvcFB0RI1lKFBY0VoceOKwxSJiwqR5pjJs00J1uZt0dzTieVO8xFTl7z8

+SuusdfmN+GXOM2iiGHOymDZe6TPhl+cbQlrjLABY+Oom/4mJkLVTryEvwQ3LfXuU+1e

Rx3crwFyHfFy8gUgvBz+mUaoWGI1eJ1dY+EUU51mPhTi4ed5oXJf9PKSJxqI2yQBZcT7

JqdAqQ5kzN7+rUWEz7QK+j9ubCCdkGSUSnpyI3DBl5Cp5NSijuFJPDsr58J7lO8qbMQP

28aw==

X-Gm-Message-State: AOJu0Yybhf7EyuuJwDbcxFaO0nyAuuPRsUtkM5OGXAn1AGiBIifn09C2

TthCn/rWmb7DcCSQD/lAHlUFxxfS/HF+fMNnPhBXr/GfVdHQsd+p/tIPqNmrLlwxMNVLelN4wxo

=

X-Google-Smtp-Source: AGHT+IFxdpR0nvzVcbuIc2/TPaRxlS8I2PnmaA5IVdiYglWe8MFXki0gscCT84M78dO0ey+RzVgslJlZoA==

MIME-Version: 1.0

X-Received: by 2002:a05:6e02:2143:b0:3a7:2204:c83e with SMTP id

e9e14a558f8ab-3a7c5562588mr136221795ab.10.1732908528003; Fri, 29 Nov 2024

11:28:48 -0800 (PST)

Message-ID:

Date: Fri, 29 Nov 2024 19:28:48 +0000

Subject: daveyadallee, Get 1,000 More Instagram Followers and 1,000 TIktok

Followers here

From: supattrasangboon@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi daveyadallee, We are from Instasocial. We found your Email

address on your Instagram page @daveyadallee. We Offers Instagram Followers,

Likes and Views services.



Content analysis details: (9.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.166.197 listed in will-spam-for-food.eu.org]

[209.85.166.197 listed in will-spam-for-food.eu.org]

[209.85.166.197 listed in will-spam-for-food.eu.org]

[209.85.166.197 listed in will-spam-for-food.eu.org]

[209.85.166.197 listed in will-spam-for-food.eu.org]

[209.85.166.197 listed in will-spam-for-food.eu.org]

[209.85.166.197 listed in will-spam-for-food.eu.org]

[209.85.166.197 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.166.197 listed in dnsbl.ahbl.org]

[209.85.166.197 listed in dnsbl.ahbl.org]

[209.85.166.197 listed in dnsbl.ahbl.org]

[209.85.166.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.166.197 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.166.197 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.166.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.166.197 listed in dnsbl.ahbl.org]

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[209.85.166.197 listed in psbl.surriel.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.166.197 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[supattrasangboon(at)gmail.com]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} daveyadallee, Get 1,000 More Instagram Followers and 1,000 TIktok

Followers here



Hi daveyadallee,



We are from Instasocial. We found your Email address on your Instagram page

@daveyadallee.



We Offers Instagram Followers, Likes and Views services.



The price is:



-$29 USD for 1,000 Instagram Followers and

- $9 USD For Instagram Post Likes.

- $7 USD For Instagram Video Views



Now you have 1708 Followers, maybe you are Interested?



Aspiring actors, musicians, and performers may seek a substantial following

to attract attention from industry professionals.

It can serve as a digital portfolio showcasing their talent..



You can See all packages here :



https://bestsocialnet.store/



If you have any questions, feel free to ask them here.

I apologize if this message bothers you,





Also, We have Youtube, Tiktok and Twitter services too, Please check it now.

Thank you,

Regards,

Desperation spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 14:05:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH89g-0000000061g-2oPj

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 14:04:00 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 14:04:00 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qt1-f180.google.com ([209.85.160.180]:57683)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH5A7-00000000D4B-1Nud

for root@nk.ca;

Fri, 29 Nov 2024 10:52:20 -0700

Received: by mail-qt1-f180.google.com with SMTP id d75a77b69052e-46679337c24so14999021cf.3

for ; Fri, 29 Nov 2024 09:50:23 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=fp-unila-ac-id.20230601.gappssmtp.com; s=20230601; t=1732902617; x=1733507417; darn=nk.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=i/yBwplXlfd6YYH8gBbvWxsfGHeL8nANiQPMHb7ULBw=;

b=ZjBrHfxzt6p3ysu1L4VrVfdpLDkocxtvgW6iMUKWZE6gr2V6ZfMVvquyouZCe0WPrj

ITz7orA+NfIMHKZojqiONCFrxTeDQgErgvf7A/ouUlsfJtBA26ysf6RoYZCsVQq2RG1n

8azNOHxkruLu6yCa1BIgVCkGEQtT4jyEC9nlFj5pvcWCUjIxXQbhQR8dZv5lJ9bU/Pkh

X8hrCaGskD/C/9n0aL8lbCWjVf0YyeqGixsFbKPeX6HaDWWZXGfR5nCHamUS741zuVKn

fsVQTRfQzMy/UzySxBx28++5OfLFMBmtG7GB1nnHxykU1G35b9mq67OPeV5qq5HMSODz

knNw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732902617; x=1733507417;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=i/yBwplXlfd6YYH8gBbvWxsfGHeL8nANiQPMHb7ULBw=;

b=PPRcXvVhk4q+RvIfd2qV8ysCRCw3a0P97dstF8Wo/G0aX8YczXsvZadsdLm9T9Lv/G

CX4nx85d0IK6ujvOocUWWpRwfLzmHEr4yN6fmdOFYVBY6w8W7/fAQe2xgx8EAhU77upf

h/8Z/vy/piuYdUCr43Sp5Sjb+6l+ZVdltvb4FphPX8vfZY22lgD3eWjxxO8C1myW0gkx

YGo3bw/u1M5TpuHnELVRnrHTy8eVpw/xkQ7+t5Z2lEr1+vZtsU+O7XgG2KHNDo0XBoH7

SvSM0vonxGrzYUHLK+R3I5ay/MJh1ogPQz5vqpGLsfNFwSFXKeT/i74SqVtSK8blvsEl

twWA==

X-Forwarded-Encrypted: i=1; AJvYcCUzxaAzVlQgainJM3XQiUw5d6tI96PYS27E5JNJ9zVF1bT5BWLV48znwiiYCKZ3RnTqenVE@nk.ca

X-Gm-Message-State: AOJu0Yxr/idIUxQMoLB5mTEaXU1TWKdLgQANWoktOwAMZfg61D0vYrdM

Q54M8JxI1ktXAAGEQeeTo2Ven9MIUasrifIGJ3QVxw/wH47RiQBmkzd9aEisvwmVzaJ9t63CG1w

k/NYjxfv5HbmoEfQnnlqRFPa+foWVqHZ/sxgHyg==

X-Gm-Gg: ASbGncv7V+XqOHf8oif3Ns/n7e4bZH6jVNExUPsXKIZ1q6q86byC/lkU/YzwD+4WOSI

25zQc67gyMHkBIv9MThJjQ3k5WLBt6Q==

X-Google-Smtp-Source: AGHT+IFuLGLgPqS1Bqt0+la9t6+eFYvXiUD9yPcpkTETIJhuhJ6fElmGXdVXk0UmjQJJOKpL2Bt4tQ23OKbNoc+lOc0=

X-Received: by 2002:a05:622a:588d:b0:466:84a8:687e with SMTP id

d75a77b69052e-466b3516909mr200067691cf.19.1732902616580; Fri, 29 Nov 2024

09:50:16 -0800 (PST)

MIME-Version: 1.0

Reply-To: konnia4loveth@gmail.com

From: Muhammad Reza

Date: Fri, 29 Nov 2024 17:50:03 +0000

Message-ID:

Subject: hii

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000e45d68062810d45c"

Bcc: root@nk.ca

X-Spam_score: 9.5

X-Spam_score_int: 95

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ¿Recibiste mi correo anterior? Por favor, espero leer tu

correo pronto. Did you receive my previous mail please i wait to read your

mail soon ¿Recibiste mi correo anterior? Por favor, espero leer tu correo

pronto. Did you receive my previous mail please i wait to read your mail

soon



Content analysis details: (9.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.160.180 listed in will-spam-for-food.eu.org]

[209.85.160.180 listed in will-spam-for-food.eu.org]

[209.85.160.180 listed in will-spam-for-food.eu.org]

[209.85.160.180 listed in will-spam-for-food.eu.org]

[209.85.160.180 listed in will-spam-for-food.eu.org]

[209.85.160.180 listed in will-spam-for-food.eu.org]

[209.85.160.180 listed in will-spam-for-food.eu.org]

[209.85.160.180 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.180 listed in dnsbl.ahbl.org]

[209.85.160.180 listed in dnsbl.ahbl.org]

[209.85.160.180 listed in dnsbl.ahbl.org]

[209.85.160.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.180 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.180 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.180 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.180 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.180 listed in wl.mailspike.net]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.5 ONE_WORD_SUBJECT Subject with only one lower-case word

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 HTML_MESSAGE BODY: HTML included in message

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} hii



--000000000000e45d68062810d45c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=C2=BFRecibiste mi correo anterior? Por favor, espero leer tu correo pronto=

.

..................................

Did you receive my previous mail please i wait to read your mail soon



--000000000000e45d68062810d45c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=C2=BFRecibiste mi correo anterior? Por favor, espero leer=

tu correo pronto.
..................................
Did you receive=

my previous mail please i wait to read your mail soon




--000000000000e45d68062810d45c--

Desparation spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 10:53:00 -0700

Received: from mail-qt1-f175.google.com ([209.85.160.175]:57354)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH5A9-00000000D4A-3lKa

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 10:52:21 -0700

Received: by mail-qt1-f175.google.com with SMTP id d75a77b69052e-46689dba2fbso15324551cf.2

for ; Fri, 29 Nov 2024 09:50:23 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=fp-unila-ac-id.20230601.gappssmtp.com; s=20230601; t=1732902617; x=1733507417; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=i/yBwplXlfd6YYH8gBbvWxsfGHeL8nANiQPMHb7ULBw=;

b=rXS5cbJnJsW6WUrExGQ36HaRApI6sOyiFDGkMxxKFoxkxc401DhUQVqV6uZerdI8/G

5V+jXtS/2ph4C/Mv5sOLvrZGYeXZtxuUv2R4Ci48OvEn8d8BIbS4QeLydS/xMxulJN04

YgFP8YoTs+JDVxLHw2qcUyU3ujnlk6R6LHUDZKFWE9KqCYUiOYbhgjIwA18HCYWz9DNM

yQTBGR9WZ1U3Xv9ZB29RNIN3ckoPal6+fJLqZSN9CObr+t6DEXA648xhGzr3Dj5LJW6P

h98Vfs8akCZxIfn4dBlJzVqZj1XGTW59ddWOsLW4dobdYVmQnV1plIU5haKN/Eot2g3h

b8rw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732902617; x=1733507417;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=i/yBwplXlfd6YYH8gBbvWxsfGHeL8nANiQPMHb7ULBw=;

b=UX3wjqBC1QGVTm6iRDuRgaiwEOJXYBT15kvseLEzCeJtPatKZ1WcvKXWXgeKPoMhCC

Py73PAK6gB/0v3jlkADMlp2BGC7cXjlL/CMvVpYu2tBiR4ufxkAdKLHmjdl9ERo94BOl

t+cjc8TwSnL7bz2WG+KuDVLDNlbzln5bJHJaNYJSl5v7aVZdg9zyeA6dd/2Uq+UFa2Cc

1r7JIa4UejuHJPYafdMSFYEad/sP3puenOJ5g3nwG1Km/5u147RDC7UKqomOHSprL1I+

4sI9fMoH6jY2Y8YlX2rZ7I1mZUtI4pyAsnSwZiFp+pi18aDSlUgbke3obnsp5kkq3Ox4

WrEw==

X-Forwarded-Encrypted: i=1; AJvYcCVHXhkcVWoRJnYKNhVila/tnhkSnpxEhtOuhMA++nEzIc6cCj3OogcgY7WyGatbOQGY9JyB@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Yw8XpJyyZAC0x2iSKy+EDRyctsbUyvOHCGcx+eewtg6vyUByvZz

2wf8oJSsjN11HMyQSzY1dpTd7QjJPwQK9ATYn9mFeT6sBjaVP5eSHgH/2bs7NakV8YJDFChcbI0

sPF3eItwPTJGhxhGXeFMs4mara4ap67YgaWXFqQ==

X-Gm-Gg: ASbGnctd9tvLpaFHzhbU69O8wxI99eFJpRrciHuVMo3sR8C3k/vAS2305YutcmBfViH

3Qf1B5ShJMjPprhhg8b87XAj8gIcBTg==

X-Google-Smtp-Source: AGHT+IFuLGLgPqS1Bqt0+la9t6+eFYvXiUD9yPcpkTETIJhuhJ6fElmGXdVXk0UmjQJJOKpL2Bt4tQ23OKbNoc+lOc0=

X-Received: by 2002:a05:622a:588d:b0:466:84a8:687e with SMTP id

d75a77b69052e-466b3516909mr200067691cf.19.1732902616580; Fri, 29 Nov 2024

09:50:16 -0800 (PST)

MIME-Version: 1.0

Reply-To: konnia4loveth@gmail.com

From: Muhammad Reza

Date: Fri, 29 Nov 2024 17:50:03 +0000

Message-ID:

Subject: hii

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000e45d68062810d45c"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ¿Recibiste mi correo anterior? Por favor, espero leer tu

correo pronto. Did you receive my previous mail please i wait to read your

mail soon ¿Recibiste mi correo anterior? Por favor, espero leer tu correo

pronto. Did you receive my previous mail please i wait to read your mail

soon



Content analysis details: (9.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.160.175 listed in will-spam-for-food.eu.org]

[209.85.160.175 listed in will-spam-for-food.eu.org]

[209.85.160.175 listed in will-spam-for-food.eu.org]

[209.85.160.175 listed in will-spam-for-food.eu.org]

[209.85.160.175 listed in will-spam-for-food.eu.org]

[209.85.160.175 listed in will-spam-for-food.eu.org]

[209.85.160.175 listed in will-spam-for-food.eu.org]

[209.85.160.175 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.175 listed in dnsbl.ahbl.org]

[209.85.160.175 listed in dnsbl.ahbl.org]

[209.85.160.175 listed in dnsbl.ahbl.org]

[209.85.160.175 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.175 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.175 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.175 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.175 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.175 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.160.175 listed in wl.mailspike.net]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.5 ONE_WORD_SUBJECT Subject with only one lower-case word

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 HTML_MESSAGE BODY: HTML included in message

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} hii



--000000000000e45d68062810d45c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=C2=BFRecibiste mi correo anterior? Por favor, espero leer tu correo pronto=

.

..................................

Did you receive my previous mail please i wait to read your mail soon



--000000000000e45d68062810d45c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=C2=BFRecibiste mi correo anterior? Por favor, espero leer=

tu correo pronto.
..................................
Did you receive=

my previous mail please i wait to read your mail soon




--000000000000e45d68062810d45c--

Burnout executive spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 14:04:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH89U-0000000060r-3mbd

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 14:03:48 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 14:03:48 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f51.google.com ([209.85.219.51]:60844)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH4ZP-00000000Ba6-3V6C

for root@nk.ca;

Fri, 29 Nov 2024 10:14:24 -0700

Received: by mail-qv1-f51.google.com with SMTP id 6a1803df08f44-6d87fffeb13so10004516d6.1

for ; Fri, 29 Nov 2024 09:12:25 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=themodernzen-co.20230601.gappssmtp.com; s=20230601; t=1732900338; x=1733505138; darn=nk.ca;

h=mime-version:date:subject:to:from:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=g8k8ZbtWGn1wwQqtcAIIFHwilBvO1iW/SFsGrPUwuFc=;

b=jVZzVeHGNQCvIy+cAJGFbYv10iuBZTXQX0hdRUu0ud5HGBSIHN8zLeG8sScrNmKzJA

N9UITUUdvPXNClMPioLZkmiLMVJ2zxMWE2IcwSg7tXt+sul46Gb5FZG8pUyGWxLnTr3R

WRmavcpejgJ6yZxYr3LQYiroljB9Zh3UTOYmvxM5IbXh5mUF/NK0vNNd09OMSA0BJ5Ox

YpBYF8ZdUCZwe2CFyeEhAY1xgtrZ5CH7iEyD1RPlwB8P2mSCJl13Y3D+42zlesGMnuEG

RQ3A0m1qEN2KwhwjEiJyc4EiJlxyJOMXw3UMhDj5GB89fHd7vpOqeFK5euNeRItvfDYn

ojlg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732900338; x=1733505138;

h=mime-version:date:subject:to:from:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=g8k8ZbtWGn1wwQqtcAIIFHwilBvO1iW/SFsGrPUwuFc=;

b=BuXFwlljX47mwnQkZf6YhvhjIfBHU5LKrDifVxeU5GT9+AbK4MRCbnJdOXFmdi7ZS4

kJ1DwA7Wxi7zFZ11chXdSLWPFxto8oXQTjYFSnaD0tr2RFFZPecfZGde0arQELsNSzOJ

v4aREBoBX0P7PSuX1Aq61aNovUfzvklZL+423AmdBKKfx/NkKJz/zfBezB+Ki9Rw4Rj9

EwKYsfh1xVhSKVKD7PS8SHOfP5TBz6BByDPlE+IeJwn0hfQls8Gh0sKcYquS+Nhb3CQy

F0qhbIf+hNMTJspb7rerKksgHl7gPjnwgUaWmn6+S/bQqPi3BsyPXoOl7U6XRB6js554

r9sw==

X-Gm-Message-State: AOJu0Yxi49sVC6f9ZLSmBkUyTWJbrE8/Gsnjx8vt7ebiebQ6aYZyKKWx

41ub2BcFsIk2iIS1IL7KcBCUluIGCBkWQ5ZDL2VZZ3QCRKzRFDR7uWRoA8+MR+hpH8x3oycVjrt

kRi0=

X-Gm-Gg: ASbGnctqt3VDF3+0W+wYFGhNzfXXdKXcXkzpdgm2+dCw4nrxeo/n9lSIssse5FI7tJg

IiU1JJGAkKKMCQxpes+Z/LgnwamMbmy1TidhnZGjNVKvVIcvBLXpn2t0ad7Q3PWK/3ytowdUMQs

BDOVMPHoCJvAGLOHMMWsS/ojwkkyYdUQriZbxc5nZlrtHiUHvPV0WruQDRjPLX4vydc+8yQ28gs

y0Crh0Uba8u4IGVQ/0Oj23vVpIdUqV4Z5EhBUgVCgmrK5gSs5rW5KQ7y5ODm/dWX1/5X+kSAJrq

AaGjsLhsmBFW4DYlImLAPGdveFsX0QAu0gHkKIqEZZHioQptyZ5/MthT/SYKmqE0C5BQZErk

X-Google-Smtp-Source: AGHT+IGQGsN/RqN4yn19l7IqRrDeTe7Kh3lwK63xz3PvTiOZdpY3kqubAILdt1CRKVRqJY/tKdsOwQ==

X-Received: by 2002:a05:6214:21e1:b0:6d4:1b2b:c836 with SMTP id 6a1803df08f44-6d864df756bmr172630816d6.47.1732900337664;

Fri, 29 Nov 2024 09:12:17 -0800 (PST)

Received: from f344c6ab-e364-4549-a321-809d3f26063c.local (ec2-98-81-119-116.compute-1.amazonaws.com. [98.81.119.116])

by smtp.gmail.com with ESMTPSA id 6a1803df08f44-6d881c4d3fcsm10862206d6.28.2024.11.29.09.12.15

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 29 Nov 2024 09:12:16 -0800 (PST)

Content-Type: multipart/alternative;

boundary="--_NmP-94b1e6a3046721da-Part_1"

Message-ID:

From: Ajanta

To: root@nk.ca

Subject: =?UTF-8?Q?Please_Tell_Me_=E2=80=9CNo!=22?=

Date: Fri, 29 Nov 2024 17:12:15 +0000

MIME-Version: 1.0

X-Spam_score: 8.6

X-Spam_score_int: 86

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Dave, I want you to tell me, “No, I don’t need help!”

I love hearing when professionals are thriving and have their stress under

control. But if you’re experiencing burnout, stress, or just feeling [...]





Content analysis details: (8.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[98.81.119.116 listed in will-spam-for-food.eu.org]

[98.81.119.116 listed in will-spam-for-food.eu.org]

[98.81.119.116 listed in will-spam-for-food.eu.org]

[98.81.119.116 listed in will-spam-for-food.eu.org]

[98.81.119.116 listed in will-spam-for-food.eu.org]

[98.81.119.116 listed in will-spam-for-food.eu.org]

[98.81.119.116 listed in will-spam-for-food.eu.org]

[98.81.119.116 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.219.51 listed in dnsbl.ahbl.org]

[209.85.219.51 listed in dnsbl.ahbl.org]

[209.85.219.51 listed in dnsbl.ahbl.org]

[209.85.219.51 listed in dnsbl.ahbl.org]

[98.81.119.116 listed in dnsbl.ahbl.org]

[98.81.119.116 listed in dnsbl.ahbl.org]

[98.81.119.116 listed in dnsbl.ahbl.org]

[98.81.119.116 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.219.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.219.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.219.51 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.219.51 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.219.51 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.51 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} =?UTF-8?Q?Please_Tell_Me_=E2=80=9CNo!=22?=



----_NmP-94b1e6a3046721da-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Hi Dave,



I want you to tell me, =E2=80=9CNo, I don=E2=80=99t need help!=

=E2=80=9D I love hearing when professionals are thriving and have their =

stress under control. But if you=E2=80=99re experiencing burnout, stress, =

or just feeling stuck in your career, let=E2=80=99s have a chat.=C2=A0



I=E2=80=99ve helped corporate professionals boost their productivity by up =

to 80%, regain their energy, and rebuild career confidence in just 90 days.=

=C2=A0



If that sounds like something you=E2=80=99d like, say =

=E2=80=9CYes=E2=80=9D and book a free Stress DNA consultation. I promise =

this call will be a turning point.



Book your consultation:=C2=A0https://th=

emodernzen.com/booking https://chainparthenprox.com/lt/1125899960363531/9sY=

gZWsBTKw_YTYYBbJfC





Ajanta

Founder "The Modern Zen"

peaceful progress possible.



--

----_NmP-94b1e6a3046721da-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Hi Dave,

I want you to tell me, “No, I don’t need =

help!” I love hearing when professionals are thriving and have their =

stress under control. But if you’re experiencing burnout, stress, or =

just feeling stuck in your career, let’s have a chat.=

 

I’ve helped corporate professionals boost their =

productivity by up to 80%, regain their energy, and rebuild career =

confidence in just 90 days. 

If that sounds like something =

you’d like, say “Yes” and book a free Stress DNA =

consultation. I promise this call will be a turning point.

Book your=

consultation: 
com/lt/1125899960363531/9sYgZWsBTKw_YTYYBbJfC" target=3D"_blank">https://th=

emodernzen.com/booking

Ajanta
Founder "The=

Modern Zen"
peaceful progress possible.



bJfC.png' alt=3D'line'>

----_NmP-94b1e6a3046721da-Part_1--