Web / SEO / App spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 18 Nov 2024 07:31:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tD2lf-00000000GhB-2aoU

for dave@doctor.nl2k.ab.ca;

Mon, 18 Nov 2024 07:30:19 -0700

Resent-From: The Doctor

Resent-Date: Mon, 18 Nov 2024 07:30:19 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f66.google.com ([209.85.161.66]:59644)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCzg0-00000000Nre-3BCi

for root@nk.ca;

Mon, 18 Nov 2024 04:12:49 -0700

Received: by mail-oo1-f66.google.com with SMTP id 006d021491bc7-5ebc1af9137so1843688eaf.2

for ; Mon, 18 Nov 2024 03:10:24 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=laravel-digital.20230601.gappssmtp.com; s=20230601; t=1731928215; x=1732533015; darn=nk.ca;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=B4qdg9dJRwNgzYCPAZcf4vd/lgI1sIS6lEJGc80AFgg=;

b=DcpIZbPishighZ8TesVNZX5bvQDiNSF7eQTbuWZLd7bwvkU+jQnV3S1Ur1U8pmcjpK

BRcwbZmM3Xw47my/ObjAgh2GjygmFcOplRAhyJw8p5Og08egomm0mubZCJZcgjPPYiNE

Z/bnmpJqGJuEfXt6rg/fjGjItepSQcefmyDmYIm5sbOaicM4D9p3PET2qf2XFms+L4FO

ewIg+tOpcLmWhLEs/5lqsPreox14UcCtFlehq0ihNP6hLJZiw2LR3gbIY2W+OgD9O5DQ

qqwZotst3jXjRjJAM6v0H/7onF3F7t5iGCcbwQolkWaZqh4w03Agi0GBrQRA/sgOwrDj

IV7w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1731928215; x=1732533015;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=B4qdg9dJRwNgzYCPAZcf4vd/lgI1sIS6lEJGc80AFgg=;

b=fUId47t4x7h1MBH+SKN2TnnBq9a+H55pkVMyHW5U/4Z3bWONS6zBhsVK54ktxIlQ4m

p5fDKV1/f4lH3dMmOugMk9Mz1Fj+3cuo5ev88G6KM22qQalwJFxKN5+5VMrs5rSPOSn9

smFIl5ZvpgUo8nsYvdSCQN8IPvV2JpZyZdAQrZ/YMgfwA2pDrDQLuNZJbdNRu+mIhavq

1MudV07M+baPlOBStZelzrMcEkoAk96E+Mx7ipG1t4iFwhhqmVpREtKje2L+mmHQaY53

NO2Lq9Br6IfdzFlXSt/jMD5+19/m9S/JIlrJQGEqRwdN7EFc0e0Img5g1MnKYDrGryLK

PNog==

X-Gm-Message-State: AOJu0YzlyBNsvOdSkrCKxla2I8vRd1ashtoYJ0E6B7G6CTBTJi4OJY3p

O2lLAZ8zdbtLcHYCdN2cxMFI8VqNEjlQfMInanB+R4SzU1c/cbq4Gt+M7nXjtRaVPp+ePRs4CzL

sO9w=

X-Google-Smtp-Source: AGHT+IF1velti8Ke66Fg6TVdlpsjWBGvwUbldvHWewoT6Z/Wf9GCcZkDPnTVpPIDncKJFYFvTCNTEQ==

X-Received: by 2002:a17:902:f64b:b0:211:f81f:8949 with SMTP id d9443c01a7336-211f81f8ddbmr93862665ad.0.1731926160039;

Mon, 18 Nov 2024 02:36:00 -0800 (PST)

Received: from Vikash ([122.161.78.29])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-211d0f34903sm53954745ad.158.2024.11.18.02.35.58

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Mon, 18 Nov 2024 02:35:59 -0800 (PST)

From: "Vikas"

To:

Subject: Create App Proposal

Date: Mon, 18 Nov 2024 16:05:29 +0530

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_FC40_01DB39D3.BC30F790"

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: Ads5mSmCPalTOaLSQVqqPeHADiRLug==

Content-Language: en-us

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello root@nk.ca, Would you be interested in building an app

for your business we have 8+ years experience? We are a professional Mobile

Application Development company. Our Mobile App Development Services include:





Content analysis details: (8.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[122.161.78.29 listed in dnsbl.ahbl.org]

[122.161.78.29 listed in dnsbl.ahbl.org]

[122.161.78.29 listed in dnsbl.ahbl.org]

[122.161.78.29 listed in dnsbl.ahbl.org]

[209.85.161.66 listed in dnsbl.ahbl.org]

[209.85.161.66 listed in dnsbl.ahbl.org]

[209.85.161.66 listed in dnsbl.ahbl.org]

[209.85.161.66 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[122.161.78.29 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[122.161.78.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[122.161.78.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[122.161.78.29 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[122.161.78.29 listed in will-spam-for-food.eu.org]

[122.161.78.29 listed in will-spam-for-food.eu.org]

[122.161.78.29 listed in will-spam-for-food.eu.org]

[122.161.78.29 listed in will-spam-for-food.eu.org]

[122.161.78.29 listed in will-spam-for-food.eu.org]

[122.161.78.29 listed in will-spam-for-food.eu.org]

[122.161.78.29 listed in will-spam-for-food.eu.org]

[122.161.78.29 listed in will-spam-for-food.eu.org]

[209.85.161.66 listed in will-spam-for-food.eu.org]

[209.85.161.66 listed in will-spam-for-food.eu.org]

[209.85.161.66 listed in will-spam-for-food.eu.org]

[209.85.161.66 listed in will-spam-for-food.eu.org]

[209.85.161.66 listed in will-spam-for-food.eu.org]

[209.85.161.66 listed in will-spam-for-food.eu.org]

[209.85.161.66 listed in will-spam-for-food.eu.org]

[209.85.161.66 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.66 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.66 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.66 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[209.85.161.66 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Create App Proposal



This is a multi-part message in MIME format.



------=_NextPart_000_FC40_01DB39D3.BC30F790

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hello root@nk.ca,







Would you be interested in building an app for your business we have 8+

years experience? We are a professional Mobile Application Development

company.







Our Mobile App Development Services include:







Education Apps, Event Apps, Finance Apps, Food Delivery Apps, Health &

Fitness Apps, News &. Magazine Apps, Real Estate Apps, Taxi Apps, Travel

Apps







(Create App for Pharmacy App)







If you're interested in creating an App or rebuilding the App completely may

I send you sample, Portfolio and company Details?







Please share your requirements and contact info or Skype id.







Thanks,



Vikas





------=_NextPart_000_FC40_01DB39D3.BC30F790

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">

class=3DWordSection1>


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>H=

ello
root@nk.ca


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>Woul=

d you be interested in building an app for your business we have 8+ =

years experience? We are a professional Mobile Application Development =

company. 


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>Our =

Mobile App Development Services include: 


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>E=

ducation Apps, Event Apps, Finance Apps, Food Delivery Apps, Health =

& Fitness Apps, News &amp. Magazine Apps, Real Estate Apps, =

Taxi Apps, Travel Apps


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>(Cre=

ate App for Pharmacy App)


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>&nbs=

p;


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>If =

you're interested in creating an App or rebuilding the App completely =

may I send you sample, Portfolio and company Details?


class=3DMsoNormal =

style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'><=

span style=3D'background:silver;mso-highlight:silver'>Please share your =

requirements and contact info or Skype id.    =


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>Than=

ks, 


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>V=

ikas



------=_NextPart_000_FC40_01DB39D3.BC30F790--



Bitcoin phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 18 Nov 2024 07:29:04 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tD2jv-00000000GSf-2yW9

for dave@doctor.nl2k.ab.ca;

Mon, 18 Nov 2024 07:28:31 -0700

Resent-From: The Doctor

Resent-Date: Mon, 18 Nov 2024 07:28:31 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zimbra.reseau.dalalu.fr ([195.101.66.48]:51326 helo=zimbra.dmz.dalalu.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuc5-000000009af-1nx7

for www@nl2k.ab.ca;

Sun, 17 Nov 2024 22:48:51 -0700

Received: from zimbra.dmz.dalalu.fr (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPS id C8D731AC56A20

for ; Mon, 18 Nov 2024 06:41:12 +0100 (CET)

Received: from localhost (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTP id 731E21AC6BDCE

for ; Mon, 18 Nov 2024 06:36:15 +0100 (CET)

Received: from zimbra.dmz.dalalu.fr ([127.0.0.1])

by localhost (zimbra.dmz.dalalu.fr [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id tvwr_FJHGEEs for ;

Mon, 18 Nov 2024 06:36:15 +0100 (CET)

Received: from DESKTOP-K3DIC07 (unknown [102.129.145.151])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPSA id 22AC41AC7BA7A

for ; Mon, 18 Nov 2024 06:36:13 +0100 (CET)

From: "Mr. Antoine"

Subject: Bitcoin Payment

To:

Content-Type: multipart/alternative; boundary="BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU"

MIME-Version: 1.0

Date: Mon, 18 Nov 2024 06:36:13 +0100

Message-Id: <202418110636126C48E6EF57$D432B89E5C@reseau.dalalu.fr>

X-Spam_score: 17.5

X-Spam_score_int: 175

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Mark Hoffman, We have deposited the 32 BTC which amount

to ($2,870,904.00 USD) as you requested into your bitcoin portfolio at https://pushkoin.com





Content analysis details: (17.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: pushkoin.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: pushkoin.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: pushkoin.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 HK_NAME_MR_MRS No description available.

1.9 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} Bitcoin Payment



This is a multi-part message in MIME format



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable





Hi Mark Hoffman,=20



We have deposited the 32 BTC which amount to ($2,870,904.00 USD) as yo=

u requested into your bitcoin portfolio at=20



https://pushkoin.com



Customer Id: 15971673

Password: Qm67Bz2



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable








8">


=3D1"> =<br /><br /> Bitcoin Payment



Hi Ma=

rk Hoffman,

We have deposited the 32 BTC which amount to ($2,87=

0,904.00 USD) as you requested into your bitcoin portfolio at
"https://pushkoin.com">https://pushkoin.com

Customer Id: 159=

71673
Password: Qm67Bz2







--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU--



Bitcoin phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Nov 2024 22:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuGm-000000008XO-2GP2

for dave@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 22:25:52 -0700

Resent-From: The Doctor

Resent-Date: Sun, 17 Nov 2024 22:25:52 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zimbra.reseau.dalalu.fr ([195.101.66.48]:57090 helo=zimbra.dmz.dalalu.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuDo-0000000085W-1zTI

for support@nk.ca;

Sun, 17 Nov 2024 22:22:59 -0700

Received: from zimbra.dmz.dalalu.fr (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPS id 381751ACD7ED9

for ; Mon, 18 Nov 2024 06:20:09 +0100 (CET)

Received: from localhost (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTP id 7F0311ACD9414

for ; Mon, 18 Nov 2024 06:18:39 +0100 (CET)

Received: from zimbra.dmz.dalalu.fr ([127.0.0.1])

by localhost (zimbra.dmz.dalalu.fr [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id jh4aSCpDCJBM for ;

Mon, 18 Nov 2024 06:18:39 +0100 (CET)

Received: from DESKTOP-K3DIC07 (unknown [102.129.145.151])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPSA id 2688E1ACD940E

for ; Mon, 18 Nov 2024 06:18:37 +0100 (CET)

From: "Mr. Antoine"

Subject: Bitcoin Payment

To:

Content-Type: multipart/alternative; boundary="BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU"

MIME-Version: 1.0

Date: Mon, 18 Nov 2024 06:18:37 +0100

Message-Id: <20241811061836ECEA0412D8$56DC8BEA87@reseau.dalalu.fr>

X-Spam_score: 17.5

X-Spam_score_int: 175

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Mark Hoffman, We have deposited the 32 BTC which amount

to ($2,870,904.00 USD) as you requested into your bitcoin portfolio at https://pushkoin.com





Content analysis details: (17.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: pushkoin.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: pushkoin.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: pushkoin.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HK_NAME_MR_MRS No description available.

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 LOTS_OF_MONEY Huge... sums of money

1.9 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} Bitcoin Payment



This is a multi-part message in MIME format



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable





Hi Mark Hoffman,=20



We have deposited the 32 BTC which amount to ($2,870,904.00 USD) as yo=

u requested into your bitcoin portfolio at=20



https://pushkoin.com



Customer Id: 15971673

Password: Qm67Bz2



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable








8">


=3D1"> =<br /><br /> Bitcoin Payment



Hi Ma=

rk Hoffman,

We have deposited the 32 BTC which amount to ($2,87=

0,904.00 USD) as you requested into your bitcoin portfolio at
"https://pushkoin.com">https://pushkoin.com

Customer Id: 159=

71673
Password: Qm67Bz2







--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU--



Greek language nk.ca credential phishing

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Nov 2024 22:28:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuID-000000008hQ-0Cyn

for dave@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 22:27:21 -0700

Resent-From: The Doctor

Resent-Date: Sun, 17 Nov 2024 22:27:21 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [172.245.185.165] (port=39876 helo=mail0.avutexclub.org)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuF6-000000008Ml-2CIn

for support@nk.ca;

Sun, 17 Nov 2024 22:24:19 -0700

From: Mail Delivery System nk.ca

To: support@nk.ca

Subject: =?UTF-8?B?zpcgzrTOuc61z43OuM+Fzr3Pg863IM+Ezr/PhSDOt867zrXOus+Ez4HOv869zrnOus6/z40gz4POv8+FIM+EzrHPh8+FzrTPgc6/zrzOtc6vzr/PhTog?=support@nk.ca =?UTF-8?B?zrjOsSDOsc+Azr/Ous67zrXOuc+Dz4TOtc6vIM6xz4DPjCA=?=11/17/2024 9:12:38 p.m.

Date: 17 Nov 2024 21:12:38 -0800

Message-ID: <20241117211238.ED017A71020D48DE@mail.stealthtelecom.net>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 15.5

X-Spam_score_int: 155

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Μήνυμα από αξιόπιστο διακομιστή.

Αγαπητέ πελάτη



Content analysis details: (15.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[172.245.185.165 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[172.245.185.165 listed in will-spam-for-food.eu.org]

[172.245.185.165 listed in will-spam-for-food.eu.org]

[172.245.185.165 listed in will-spam-for-food.eu.org]

[172.245.185.165 listed in will-spam-for-food.eu.org]

[172.245.185.165 listed in will-spam-for-food.eu.org]

[172.245.185.165 listed in will-spam-for-food.eu.org]

[172.245.185.165 listed in will-spam-for-food.eu.org]

[172.245.185.165 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[172.245.185.165 listed in dnsbl.ahbl.org]

[172.245.185.165 listed in dnsbl.ahbl.org]

[172.245.185.165 listed in dnsbl.ahbl.org]

[172.245.185.165 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[172.245.185.165 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[172.245.185.165 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[172.245.185.165 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[172.245.185.165 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[172.245.185.165 listed in zen.spamhaus.org]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.5 GB_CUSTOM_HTM_URI Custom html uri

1.5 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

Subject: {SPAM?} =?UTF-8?B?zpcgzrTOuc61z43OuM+Fzr3Pg863IM+Ezr/PhSDOt867zrXOus+Ez4HOv869zrnOus6/z40gz4POv8+FIM+EzrHPh8+FzrTPgc6/zrzOtc6vzr/PhTog?=support@nk.ca =?UTF-8?B?zrjOsSDOsc+Azr/Ous67zrXOuc+Dz4TOtc6vIM6xz4DPjCA=?=11/17/2024 9:12:38 p.m.


















px; letter-spacing: normal; font-family: Calibri, sans-serif, serif, EmojiF=

ont; font-size: 16px; font-style: normal; font-weight: 400; word-spacing: 0=

px; float: none; display: inline !important; white-space: normal; orphans: =

2; widows: 2; background-color: rgb(255, 255, 255); font-variant-caps: norm=

al; -webkit-text-stroke-width: 0px; font-variant-ligatures: normal; text-de=

coration-style: initial; text-decoration-color:=20

initial;">





5px 0px; width: 477px; color: rgb(32, 31, 30); text-transform: none; text-=

indent: 0px; letter-spacing: normal; font-family: wf_segoe-ui_semibold, "Se=

goe UI Semibold", "Segoe WP Semibold", "Segoe UI", "Segoe WP", Tahoma, Aria=

l, sans-serif, serif, EmojiFont; font-size: 15px; font-style: normal; font-=

weight: normal; text-decoration: none; word-spacing: 0px; vertical-align: b=

aseline; float: left; white-space: normal;=20

font-stretch: inherit; font-variant-caps: normal; -webkit-text-stroke-width=

: 0px; font-variant-ligatures: normal; font-variant-numeric: inherit; font-=

variant-east-asian: inherit; -webkit-text-size-adjust: auto;'>


t-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-s=

erif, serif, EmojiFont; font-size: 13px; vertical-align: baseline; font-str=

etch: inherit; background-color: rgb(244, 248, 245); font-variant-caps: inh=

erit; font-variant-ligatures: inherit; font-variant-numeric: inherit; font-=

variant-east-asian: inherit; font-variant-alternates: inherit;'>


nherit; vertical-align: baseline; font-stretch: inherit; font-variant-caps:=

inherit;">

Μήνυμα από αξι&=

#972;πιστο διακομ =

53;στή.



31, 30); text-transform: none; text-indent: 0px; letter-spacing: normal; fo=

nt-family: wf_segoe-ui_semibold, "Segoe UI Semibold", "Segoe WP Semibold", =

"Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-s=

ize: 15px; font-style: normal; font-weight: normal; text-decoration: none; =

word-spacing: 0px; vertical-align: baseline; white-space: normal; font-stre=

tch: inherit; font-variant-caps: normal;=20

-webkit-text-stroke-width: 0px; font-variant-ligatures: normal; font-varian=

t-numeric: inherit; font-variant-east-asian: inherit; -webkit-text-size-adj=

ust: auto;'>


ght: 30px; font-family: inherit; vertical-align: baseline; font-stretch: in=

herit; background-color: rgb(86, 166, 89); font-variant-caps: inherit;">
iv>


alibri, sans-serif, serif, EmojiFont; font-size: 16px; vertical-align: base=

line; font-stretch: inherit; font-variant-caps: inherit; font-variant-ligat=

ures: inherit; font-variant-numeric: inherit; font-variant-east-asian: inhe=

rit; font-variant-alternates: inherit;">


herit; vertical-align: baseline; font-stretch: inherit; font-variant-caps: =

inherit;">




px; letter-spacing: normal; font-family: Calibri, sans-serif, serif, EmojiF=

ont; font-size: 16px; font-style: normal; font-weight: 400; word-spacing: 0=

px; float: none; display: inline !important; white-space: normal; orphans: =

2; widows: 2; background-color: rgb(255, 255, 255); font-variant-caps: norm=

al; -webkit-text-stroke-width: 0px; font-variant-ligatures: normal; text-de=

coration-style: initial; text-decoration-color:=20

initial;">

Αγαπητέ πελάτ&#=

951;





px; letter-spacing: normal; font-family: Calibri, sans-serif, serif, EmojiF=

ont; font-size: 16px; font-style: normal; font-weight: 400; word-spacing: 0=

px; float: none; display: inline !important; white-space: normal; orphans: =

2; widows: 2; background-color: rgb(255, 255, 255); font-variant-caps: norm=

al; -webkit-text-stroke-width: 0px; font-variant-ligatures: normal; text-de=

coration-style: initial; text-decoration-color:=20

initial;">

Λόγω νέων ενημ&=

#949;ρώσεων στον δ&#=

953;ακομιστή μας =

64;ο email σας:


support@nk.ca
text-indent: 0px; letter-spacing: normal; font-family: Calibri, sans-serif=

, serif, EmojiFont; font-size: 16px; font-style: normal; font-weight: 400; =

word-spacing: 0px; float: none; display: inline !important; white-space: no=

rmal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-var=

iant-caps: normal; -webkit-text-stroke-width: 0px; font-variant-ligatures: =

normal; text-decoration-style: initial;=20

text-decoration-color: initial;">

θα σταματήσει &=

#957;α στέλνει και &=

#957;α λαμβάνει email ε&#=

940;ν δεν επαληθε =

65;τεί εντός 24 ωρώ&=

#957;





px; letter-spacing: normal; font-family: Calibri, sans-serif, serif, EmojiF=

ont; font-size: 16px; font-style: normal; font-weight: 400; word-spacing: 0=

px; float: none; display: inline !important; white-space: normal; orphans: =

2; widows: 2; background-color: rgb(255, 255, 255); font-variant-caps: norm=

al; -webkit-text-stroke-width: 0px; font-variant-ligatures: normal; text-de=

coration-style: initial; text-decoration-color:=20

initial;">

Για να διατηρή&=

#963;ετε τον λογαρ&#=

953;ασμό σας μαζί &#=

956;ας, παρακαλώ ε&#=

960;ιβεβαιώστε π^=

5;ρακάτω





baseline; font-stretch: inherit; font-variant-caps: inherit; font-variant-=

ligatures: inherit; font-variant-numeric: inherit; font-variant-east-asian:=

inherit; font-variant-alternates: inherit;">


31, 30); font-family: Arial, Helvetica, sans-serif, serif, EmojiFont; font-=

size: 15px; vertical-align: baseline; font-stretch: inherit; font-variant-n=

umeric: inherit; font-variant-east-asian: inherit;" dir=3D"ltr">


baseline;">


t-family: Roboto, RobotoDraft, Helvetica, Arial, sans-serif; font-size: 0px=

; font-stretch: inherit;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">=








); padding: 0px 15px; border-radius: 4px; border-collapse: collapse;" bgcol=

or=3D"#3558a8">


_x_gmail-m_4628436401360325222m_1270713067398412679m_-1564249429224047007gm=

ail-m_7976746255904800835LPlnk404747" style=3D"border-width: 0px; margin: 0=

px; padding: 15px 0px; border-radius: 4px; color: rgb(255, 255, 255); line-=

height: 21px; font-family: Helvetica, Arial, sans-serif; font-size: 18px; f=

ont-weight: 600; vertical-align: baseline; display: block; font-stretch: in=

herit; text-decoration-line: none;"=20

href=3D"https://myhconsultores.com/#support@nk.ca" target=3D"_blank" rel=3D=

"noopener noreferrer">
">ΕΠΑΛΗΘΕΥΩ
=

=20


baseline;"> 



herit; vertical-align: baseline; font-stretch: inherit; font-variant-caps: =

inherit;">



px; letter-spacing: normal; font-family: Roboto, Arial; font-size: 12px; fo=

nt-style: normal; font-weight: 600; word-spacing: 0px; float: none; display=

: inline !important; white-space: normal; orphans: 2; widows: 2; background=

-color: rgb(255, 255, 255); font-variant-caps: normal; -webkit-text-stroke-=

width: 0px; font-variant-ligatures: normal; text-decoration-style: initial;=

text-decoration-color: initial;">

©2024 nk.ca Administrator Service. All Rights Reserved

iv>


Bitcoin phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Nov 2024 22:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuGh-000000008X5-3hFh

for dave@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 22:25:47 -0700

Resent-From: The Doctor

Resent-Date: Sun, 17 Nov 2024 22:25:47 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zimbra.reseau.dalalu.fr ([195.101.66.48]:37432 helo=zimbra.dmz.dalalu.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCtyi-000000007L4-0lr1

for sales@nk.ca;

Sun, 17 Nov 2024 22:07:17 -0700

Received: from zimbra.dmz.dalalu.fr (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPS id 3A30E1AC7C822

for ; Mon, 18 Nov 2024 06:05:00 +0100 (CET)

Received: from localhost (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTP id BEF381AC7CA76

for ; Mon, 18 Nov 2024 06:02:20 +0100 (CET)

Received: from zimbra.dmz.dalalu.fr ([127.0.0.1])

by localhost (zimbra.dmz.dalalu.fr [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id puuwWT-E61mz for ;

Mon, 18 Nov 2024 06:02:20 +0100 (CET)

Received: from DESKTOP-K3DIC07 (unknown [102.129.145.151])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPSA id 75D601AC7D7D2

for ; Mon, 18 Nov 2024 06:02:19 +0100 (CET)

From: "Mr. Antoine"

Subject: Bitcoin Payment

To:

Content-Type: multipart/alternative; boundary="BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU"

MIME-Version: 1.0

Date: Mon, 18 Nov 2024 06:02:19 +0100

Message-Id: <18182024110206B5E873499F$F81060374F@reseau.dalalu.fr>

X-Spam_score: 17.5

X-Spam_score_int: 175

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Mark Hoffman, We have deposited the 32 BTC which amount

to ($2,870,904.00 USD) as you requested into your bitcoin portfolio at https://pushkoin.com





Content analysis details: (17.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: pushkoin.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: pushkoin.com]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: pushkoin.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 HK_NAME_MR_MRS No description available.

1.9 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} Bitcoin Payment



This is a multi-part message in MIME format



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable





Hi Mark Hoffman,=20



We have deposited the 32 BTC which amount to ($2,870,904.00 USD) as yo=

u requested into your bitcoin portfolio at=20



https://pushkoin.com



Customer Id: 15971673

Password: Qm67Bz2



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable








8">


=3D1"> =<br /><br /> Bitcoin Payment



Hi Ma=

rk Hoffman,

We have deposited the 32 BTC which amount to ($2,87=

0,904.00 USD) as you requested into your bitcoin portfolio at
"https://pushkoin.com">https://pushkoin.com

Customer Id: 159=

71673
Password: Qm67Bz2







--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU--



Bitcoin phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Nov 2024 22:28:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuHt-000000008fJ-1Ejp

for dave@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 22:27:01 -0700

Resent-From: The Doctor

Resent-Date: Sun, 17 Nov 2024 22:27:01 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zimbra.reseau.dalalu.fr ([195.101.66.48]:52012 helo=zimbra.dmz.dalalu.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCtuX-0000000078j-2tAF

for root@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 22:03:03 -0700

Received: from zimbra.dmz.dalalu.fr (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPS id 380F41A437CD1

for ; Mon, 18 Nov 2024 06:00:27 +0100 (CET)

Received: from localhost (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTP id 924971ACC41FA

for ; Mon, 18 Nov 2024 05:57:48 +0100 (CET)

Received: from zimbra.dmz.dalalu.fr ([127.0.0.1])

by localhost (zimbra.dmz.dalalu.fr [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id wRsuI5pJE484 for ;

Mon, 18 Nov 2024 05:57:48 +0100 (CET)

Received: from DESKTOP-K3DIC07 (unknown [102.129.145.151])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPSA id 430E11ACC2E28

for ; Mon, 18 Nov 2024 05:57:46 +0100 (CET)

From: "Mr. Antoine"

Subject: Bitcoin Payment

To:

Content-Type: multipart/alternative; boundary="BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU"

MIME-Version: 1.0

Date: Mon, 18 Nov 2024 05:57:47 +0100

Message-Id: <20241811055745A27EEA3888-D1C89F8C12@reseau.dalalu.fr>

X-Spam_score: 17.5

X-Spam_score_int: 175

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Mark Hoffman, We have deposited the 32 BTC which amount

to ($2,870,904.00 USD) as you requested into your bitcoin portfolio at https://pushkoin.com





Content analysis details: (17.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: pushkoin.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: pushkoin.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: pushkoin.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 HK_NAME_MR_MRS No description available.

1.9 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} Bitcoin Payment



This is a multi-part message in MIME format



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable





Hi Mark Hoffman,=20



We have deposited the 32 BTC which amount to ($2,870,904.00 USD) as yo=

u requested into your bitcoin portfolio at=20



https://pushkoin.com



Customer Id: 15971673

Password: Qm67Bz2



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable








8">


=3D1"> =<br /><br /> Bitcoin Payment



Hi Ma=

rk Hoffman,

We have deposited the 32 BTC which amount to ($2,87=

0,904.00 USD) as you requested into your bitcoin portfolio at
"https://pushkoin.com">https://pushkoin.com

Customer Id: 159=

71673
Password: Qm67Bz2







--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU--



Bitcoin phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Nov 2024 22:28:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuHy-000000008fq-2ZDJ

for dave@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 22:27:06 -0700

Resent-From: The Doctor

Resent-Date: Sun, 17 Nov 2024 22:27:06 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zimbra.reseau.dalalu.fr ([195.101.66.48]:52058 helo=zimbra.dmz.dalalu.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCtuX-0000000078m-2t7f

for root@mail.nl2k.ab.ca;

Sun, 17 Nov 2024 22:03:03 -0700

Received: from zimbra.dmz.dalalu.fr (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPS id 38F301ACC2548

for ; Mon, 18 Nov 2024 06:00:27 +0100 (CET)

Received: from localhost (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTP id D1C381ACC29B7

for ; Mon, 18 Nov 2024 05:57:48 +0100 (CET)

Received: from zimbra.dmz.dalalu.fr ([127.0.0.1])

by localhost (zimbra.dmz.dalalu.fr [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id Oc8sy0Zq18dM for ;

Mon, 18 Nov 2024 05:57:48 +0100 (CET)

Received: from DESKTOP-K3DIC07 (unknown [102.129.145.151])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPSA id 7C3181ACC336C

for ; Mon, 18 Nov 2024 05:57:47 +0100 (CET)

From: "Mr. Antoine"

Subject: Bitcoin Payment

To:

Content-Type: multipart/alternative; boundary="BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU"

MIME-Version: 1.0

Date: Mon, 18 Nov 2024 05:57:47 +0100

Message-Id: <20241811055746E476B3B75B$4DA0665319@reseau.dalalu.fr>

X-Spam_score: 17.5

X-Spam_score_int: 175

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Mark Hoffman, We have deposited the 32 BTC which amount

to ($2,870,904.00 USD) as you requested into your bitcoin portfolio at https://pushkoin.com





Content analysis details: (17.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: pushkoin.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: pushkoin.com]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: pushkoin.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 HK_NAME_MR_MRS No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

1.9 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} Bitcoin Payment



This is a multi-part message in MIME format



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable





Hi Mark Hoffman,=20



We have deposited the 32 BTC which amount to ($2,870,904.00 USD) as yo=

u requested into your bitcoin portfolio at=20



https://pushkoin.com



Customer Id: 15971673

Password: Qm67Bz2



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable








8">


=3D1"> =<br /><br /> Bitcoin Payment



Hi Ma=

rk Hoffman,

We have deposited the 32 BTC which amount to ($2,87=

0,904.00 USD) as you requested into your bitcoin portfolio at
"https://pushkoin.com">https://pushkoin.com

Customer Id: 159=

71673
Password: Qm67Bz2







--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU--



Bitcoin phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Nov 2024 22:28:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuI7-000000008h0-0tvl

for dave@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 22:27:15 -0700

Resent-From: The Doctor

Resent-Date: Sun, 17 Nov 2024 22:27:15 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zimbra.reseau.dalalu.fr ([195.101.66.48]:52024 helo=zimbra.dmz.dalalu.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCtuX-0000000078k-2tCm

for root@nl2k.ca;

Sun, 17 Nov 2024 22:03:03 -0700

Received: from zimbra.dmz.dalalu.fr (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPS id 399771ACC255A

for ; Mon, 18 Nov 2024 06:00:27 +0100 (CET)

Received: from localhost (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTP id F27EB1ACC336C

for ; Mon, 18 Nov 2024 05:57:48 +0100 (CET)

Received: from zimbra.dmz.dalalu.fr ([127.0.0.1])

by localhost (zimbra.dmz.dalalu.fr [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id G--YVGM5qSq6 for ;

Mon, 18 Nov 2024 05:57:48 +0100 (CET)

Received: from DESKTOP-K3DIC07 (unknown [102.129.145.151])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPSA id 9C9051ACC339E

for ; Mon, 18 Nov 2024 05:57:47 +0100 (CET)

From: "Mr. Antoine"

Subject: Bitcoin Payment

To:

Content-Type: multipart/alternative; boundary="BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU"

MIME-Version: 1.0

Date: Mon, 18 Nov 2024 05:57:47 +0100

Message-Id: <18462024115705C9573C8B89-30CE2AC959@reseau.dalalu.fr>

X-Spam_score: 17.5

X-Spam_score_int: 175

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Mark Hoffman, We have deposited the 32 BTC which amount

to ($2,870,904.00 USD) as you requested into your bitcoin portfolio at https://pushkoin.com





Content analysis details: (17.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: pushkoin.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: pushkoin.com]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: pushkoin.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_NAME_MR_MRS No description available.

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

1.9 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} Bitcoin Payment



This is a multi-part message in MIME format



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable





Hi Mark Hoffman,=20



We have deposited the 32 BTC which amount to ($2,870,904.00 USD) as yo=

u requested into your bitcoin portfolio at=20



https://pushkoin.com



Customer Id: 15971673

Password: Qm67Bz2



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable








8">


=3D1"> =<br /><br /> Bitcoin Payment



Hi Ma=

rk Hoffman,

We have deposited the 32 BTC which amount to ($2,87=

0,904.00 USD) as you requested into your bitcoin portfolio at
"https://pushkoin.com">https://pushkoin.com

Customer Id: 159=

71673
Password: Qm67Bz2







--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU--



Bitcoin phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Nov 2024 22:27:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuHZ-000000008cy-2CF7

for dave@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 22:26:41 -0700

Resent-From: The Doctor

Resent-Date: Sun, 17 Nov 2024 22:26:41 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zimbra.reseau.dalalu.fr ([195.101.66.48]:51728 helo=zimbra.dmz.dalalu.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCtNY-000000004Kb-2KNP

for www@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 21:29:00 -0700

Received: from zimbra.dmz.dalalu.fr (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPS id 8E63B1ACC4C2B

for ; Mon, 18 Nov 2024 05:25:53 +0100 (CET)

Received: from localhost (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTP id B08A51ACC46BE

for ; Mon, 18 Nov 2024 05:24:33 +0100 (CET)

Received: from zimbra.dmz.dalalu.fr ([127.0.0.1])

by localhost (zimbra.dmz.dalalu.fr [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id B7I072pP6Eii for ;

Mon, 18 Nov 2024 05:24:33 +0100 (CET)

Received: from DESKTOP-K3DIC07 (unknown [102.129.145.151])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPSA id 5D5081ACC46B3

for ; Mon, 18 Nov 2024 05:24:31 +0100 (CET)

From: "Mr. Antoine"

Subject: Bitcoin Payment

To:

Content-Type: multipart/alternative; boundary="BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU"

MIME-Version: 1.0

Date: Mon, 18 Nov 2024 05:24:32 +0100

Message-Id: <2024181105243092DE1475CF-7689B3C7C9@reseau.dalalu.fr>

X-Spam_score: 17.5

X-Spam_score_int: 175

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Mark Hoffman, We have deposited the 32 BTC which amount

to ($2,870,904.00 USD) as you requested into your bitcoin portfolio at https://pushkoin.com





Content analysis details: (17.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: pushkoin.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: pushkoin.com]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: pushkoin.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 HK_NAME_MR_MRS No description available.

1.9 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} Bitcoin Payment



This is a multi-part message in MIME format



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable





Hi Mark Hoffman,=20



We have deposited the 32 BTC which amount to ($2,870,904.00 USD) as yo=

u requested into your bitcoin portfolio at=20



https://pushkoin.com



Customer Id: 15971673

Password: Qm67Bz2



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable








8">


=3D1"> =<br /><br /> Bitcoin Payment



Hi Ma=

rk Hoffman,

We have deposited the 32 BTC which amount to ($2,87=

0,904.00 USD) as you requested into your bitcoin portfolio at
"https://pushkoin.com">https://pushkoin.com

Customer Id: 159=

71673
Password: Qm67Bz2







--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU--



Bitcoin phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Nov 2024 22:27:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuHZ-000000008cy-2CF7

for dave@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 22:26:41 -0700

Resent-From: The Doctor

Resent-Date: Sun, 17 Nov 2024 22:26:41 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zimbra.reseau.dalalu.fr ([195.101.66.48]:51728 helo=zimbra.dmz.dalalu.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCtNY-000000004Kb-2KNP

for www@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 21:29:00 -0700

Received: from zimbra.dmz.dalalu.fr (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPS id 8E63B1ACC4C2B

for ; Mon, 18 Nov 2024 05:25:53 +0100 (CET)

Received: from localhost (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTP id B08A51ACC46BE

for ; Mon, 18 Nov 2024 05:24:33 +0100 (CET)

Received: from zimbra.dmz.dalalu.fr ([127.0.0.1])

by localhost (zimbra.dmz.dalalu.fr [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id B7I072pP6Eii for ;

Mon, 18 Nov 2024 05:24:33 +0100 (CET)

Received: from DESKTOP-K3DIC07 (unknown [102.129.145.151])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPSA id 5D5081ACC46B3

for ; Mon, 18 Nov 2024 05:24:31 +0100 (CET)

From: "Mr. Antoine"

Subject: Bitcoin Payment

To:

Content-Type: multipart/alternative; boundary="BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU"

MIME-Version: 1.0

Date: Mon, 18 Nov 2024 05:24:32 +0100

Message-Id: <2024181105243092DE1475CF-7689B3C7C9@reseau.dalalu.fr>

X-Spam_score: 17.5

X-Spam_score_int: 175

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Mark Hoffman, We have deposited the 32 BTC which amount

to ($2,870,904.00 USD) as you requested into your bitcoin portfolio at https://pushkoin.com





Content analysis details: (17.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: pushkoin.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: pushkoin.com]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: pushkoin.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 HK_NAME_MR_MRS No description available.

1.9 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} Bitcoin Payment



This is a multi-part message in MIME format



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable





Hi Mark Hoffman,=20



We have deposited the 32 BTC which amount to ($2,870,904.00 USD) as yo=

u requested into your bitcoin portfolio at=20



https://pushkoin.com



Customer Id: 15971673

Password: Qm67Bz2



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable








8">


=3D1"> =<br /><br /> Bitcoin Payment



Hi Ma=

rk Hoffman,

We have deposited the 32 BTC which amount to ($2,87=

0,904.00 USD) as you requested into your bitcoin portfolio at
"https://pushkoin.com">https://pushkoin.com

Customer Id: 159=

71673
Password: Qm67Bz2







--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU--



Bitcoin phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Nov 2024 22:27:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuHE-000000008b6-2HTU

for dave@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 22:26:20 -0700

Resent-From: The Doctor

Resent-Date: Sun, 17 Nov 2024 22:26:20 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zimbra.reseau.dalalu.fr ([195.101.66.48]:54402 helo=zimbra.dmz.dalalu.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCs5h-00000000PGa-14ix

for games@nl2k.ab.ca;

Sun, 17 Nov 2024 20:06:23 -0700

Received: from zimbra.dmz.dalalu.fr (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPS id B90EA1AC57752

for ; Mon, 18 Nov 2024 04:04:02 +0100 (CET)

Received: from localhost (localhost [127.0.0.1])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTP id 14B401AC5C86B

for ; Mon, 18 Nov 2024 04:02:14 +0100 (CET)

Received: from zimbra.dmz.dalalu.fr ([127.0.0.1])

by localhost (zimbra.dmz.dalalu.fr [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id J30XYv7z33oJ for ;

Mon, 18 Nov 2024 04:02:14 +0100 (CET)

Received: from DESKTOP-K3DIC07 (unknown [102.129.145.151])

by zimbra.dmz.dalalu.fr (Postfix) with ESMTPSA id BB7991AC5C3EE

for ; Mon, 18 Nov 2024 04:02:12 +0100 (CET)

From: "Mr. Antoine"

Subject: Bitcoin Payment

To:

Content-Type: multipart/alternative; boundary="BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU"

MIME-Version: 1.0

Date: Mon, 18 Nov 2024 04:02:12 +0100

Message-Id: <181120241102047BCB83442E-DBE1948EF4@reseau.dalalu.fr>

X-Spam_score: 17.5

X-Spam_score_int: 175

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Mark Hoffman, We have deposited the 32 BTC which amount

to ($2,870,904.00 USD) as you requested into your bitcoin portfolio at https://pushkoin.com





Content analysis details: (17.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[102.129.145.151 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

[195.101.66.48 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[102.129.145.151 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[102.129.145.151 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

[195.101.66.48 listed in will-spam-for-food.eu.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: pushkoin.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: pushkoin.com]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: pushkoin.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 HK_NAME_MR_MRS No description available.

1.9 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} Bitcoin Payment



This is a multi-part message in MIME format



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable





Hi Mark Hoffman,=20



We have deposited the 32 BTC which amount to ($2,870,904.00 USD) as yo=

u requested into your bitcoin portfolio at=20



https://pushkoin.com



Customer Id: 15971673

Password: Qm67Bz2



--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable








8">


=3D1"> =<br /><br /> Bitcoin Payment



Hi Ma=

rk Hoffman,

We have deposited the 32 BTC which amount to ($2,87=

0,904.00 USD) as you requested into your bitcoin portfolio at
"https://pushkoin.com">https://pushkoin.com

Customer Id: 159=

71673
Password: Qm67Bz2







--BgGyXd8EiFjUnKU=_Kt8y8jaG4LQBVcNmU--



French language CAA phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Nov 2024 22:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuGL-000000008Ve-2xHf

for dave@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 22:25:25 -0700

Resent-From: The Doctor

Resent-Date: Sun, 17 Nov 2024 22:25:25 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from comp2.prod.digitaltransformationco.xyz ([78.135.110.204]:55831 helo=intelligentmindsedu.edu)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tCs8c-00000000PTB-16hA

for doctor@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 20:09:22 -0700

Authentication-Results: gmx.net; dkim=pass header.i=caa.client@mail.com

Received: from mout-xforward.gmx.com ([82.165.159.131]) by mx-ha.gmx.net

(mxgmx009 [212.227.15.10]) with ESMTPS (Nemesis) id 1MSJVS-1tJVMI1J4i-00L8EB

for ; Mon, 18 Nov 2024 03:31:14 +0100

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mail.com;

s=s1089575; t=1731897073; x=1732501873; i=caa.client@mail.com;

bh=HdroSb5T3h2yx5t6yTSwL5ErnQavz2G1bYfuEOD5t20=;

h=X-UI-Sender-Class:MIME-Version:Message-ID:From:Subject:

Content-Type:Date:cc:content-transfer-encoding:content-type:date:

from:message-id:mime-version:reply-to:subject:to;

b=XSjAXPZTO/GZE0cr12+9+pqMnIJ5Jmx7GN4CIIpFF2lwFOfqK3AneSm01vJX8chT

3usmnhNavs1gWoIOG7k89R53qRkrMHBa7VGICEH2A8ckga/DGvaUkwNJ3IjGFJJuC

RKwZ8Xb0qoWDjPACNmsEGtiMULNOrGFmkPE/1j2hkkDw4Mstj8GU16mkPUj/I+Upe

R7ua5qmCV9mFiYmqklJzH6jkcjoq1txIrGuaOaww5Cndy4euvBm6M1BYkn6V87qJB

0KG3MuyJ9PI1J2B/HnzDCeoqtpuLqMatnR6gBJtGSsKhUwhbe1bTHVwAceudY2pQM

aSFaH4MuoVG/YjwcBA==

X-UI-Sender-Class: f2cb72be-343f-493d-8ec3-b1efb8d6185a

Received: from [] ([]) by web-mail.mail.com

(3c-app-mailcom-lxa05.server.lan [10.76.45.6]) (via HTTP); Mon, 18 Nov 2024

03:31:12 +0100

MIME-Version: 1.0

Message-ID:

From: CAA

Subject: =?UTF-8?Q?Offre_sp=C3=A9ciale_=3A_votre_kit_d=27?=

=?UTF-8?Q?urgence_voiture_vous_attend_!?=

Content-Type: text/html; charset=UTF-8

Date: Mon, 18 Nov 2024 03:31:12 +0100

Importance: normal

Sensitivity: Normal

X-Priority: 3

X-Provags-ID: V03:K1:p54ANrkAHe8NqMvZxaw5uS0BHPja5qV154fyniS/YBhOdVWds2kaGSISe0v28aO0DArpg

jZZBemzVbJ26Eo3hr+daiNcpkDGXK1Avb6aib+T66KUW7F6hnBBsJR+L6DqFCd4pUuEGZUVCSfjB

Y2emExSqtxRmdvoHCCIzLCzBU7A2r75fQgy7yxHM9V0QJVhW7Sie+LX+gSynma34ARgMk5y8kzyC

NOcoS4qN5yHc8p5w4AKu6GmFAT4ePiT96R1n07K/BLmxYos31gqSpDgJvYyKpwkL6RKyznADLTm3

Rw=

X-Spam-Flag: YES

UI-OutboundReport: junk:10;M01:P0:ZACsvEN6UYA=;aEc6BcIHjTaiJUnMJ5jwBrfbveiDZ

Ph+Iv4if48Km/13g9lK3K0XKMSkxx4fn/W1QYoqi3svY03ahKqqETxbGb0ijI2xTsM3vROcyt

VyTd5EJOa1Na9te981AjsNULMLrl7ZS4BKlWf8yn7fzAZly21VJOu41VhAxp1iOdh2H1/a7ZB

6pdGAOIss/IeToZSWyJI/SvXPSUGQJiwJNfmW+DKQCKqHg7r8L+1wO2TWH7YwpfwkP42LxIza

bVuFKYLuywI5uNpRsenJKCx/fo95UFfk8SIzbAPh8ZnpXitCUY3crB4g15i5uOIdT+yFrCnlJ

caJfDL1rqZ4WTWBfWrNbeRZvI8Lcausjby6w4a4Vcih8wVUBCKGpKncRimJDfIhRrUvM6DLBy

fjTEs4ihDyHq9M/xE69OaZVZp/Ecssd6wWJCVpTSzF2ZNFevlj/3pf0pA6+mSPLMbubKo9X21

BPdzuaHh+vlaFTc4e+FpQ+tfHXbFOr3HdiERDNptB9lTwtg2AArLoUNE6zNk7fsj5XutZPQP0

3qAijKVg2RqX3IC94ywIbkwSoRxypHv8/TdAd6MFVB/58e8I/nW4qed02wgAXDTGytN/s5aOc

9oBAhnzOLCVp27Gg4C/cGhteMh1v6iqwYvXNJFnJp2oMgY0Va+nIOeEiM4KSn6MvODTKkscLO

aUXbuL8UXJSBrjyhpi+VIW2mkG1qW5fzGGHjFMPhbeVdBJbNuy1SoyIMfXvz8N+uP1uocUFzc

2awuIfzKvFDl25p16Y9//HYu8oFYi0xFrheW5+C9gEpGDAWSr2Ak=

X-GMX-Antispam: 5 (eXpurgate); Detail=V3;

X-Spam-Flag: YES

UI-InboundReport: junk:10;M01:P0:olJWUaRC7F4=;1Fyiah1qzAYMRqKvJKkpeECCWI0s1R

eiRNCZIm46IFzIwDxqn2Qhb4JVXp9yE6rGZuPghxRcE2sFTYIHZpwW25Fh6RtKodPjad0i+Dw

Euk9Tgvw5pDeSwlOnBmYeYHxdTSCjbjgDhbL/XzeglD+t3lQGHzPr90ORbvrFqFR7yDp9dwNX

yAQNeZGSNsmVy9ofR3Ur3cLWfq86thZtkPxHwqr7/JYsgVXQIZdaahy4MLgqYx2EN0M3W+spU

yJi2X70m1800zUExpAi0JBN/GfFQSFvJIfnWVMderSiOerTuesa7X8oijCzYDlDIQo26itMZJ

VVg+aBWeeogr+VOBifYIxdQ/W83khWDCYwLUINPyWna/1Rg2/+4w/Pqmxwzwq3GAXQ+DDHFJS

eTZC4IqPqv1qopnsV5OLZ1LzwX/fEeRLOPkxILfqSVeLyUe3rNPGvnvILKHGaBWRQUig9yGgt

L1py/BAFi46sslxwCWh2oF/lXIhUlslrZe0nyc8GZ18855aZIyFeh2GYvk8XDkZGxUPfHB4d6

cZCgmDGPf2kyDOMPe8qg+v4OWoVLgq629dxDFBOb5Ac8+g37oyqH7egLCn6AiJS2/tu+1CSg4

oYzH9EPGM0iJHdFvZ4ydPuwtw/u+/FSAMJ2ho8QUacDlG9F+Etx6wTXB3GKfYFsInIvCmNlpF

b8QgSuZKBf2zgyqN6vjN7THcrmzwPRIeePaMF9lp5aRdMd+8SLfwCuSDWKGuk/GBmYNXU/FI6

moP4SwJKVPjqRVCzY8bPE7IZJcPzysw4Zfkes6m8ZQd6ugGpN5CP8SMm8kJG38aEnwi5K5KIw

KQBHklN5YG1sfzq0PvXQPdnEhcwMYr0gM7pvdE53gfT3JjtQMI71SQIEClcWa1lrDigfoz/0N

lponD/1HIpn7C0xduJFVGgzY7F503r2iAaXSR3xbE5noxxbsIlP2NAtXaPx4ys5yDB0KUx/KQ

vI6rPSp7csKEbEYB/B4l6gS3fGrOwkzSmKTm740cCKanKPc4MtyOLbyUGpJaDH0PL2Mz3qnkA

a+BNP5xCA7FzvSgiImUPAJ2J/E3pHR9fhmwXSEPjYSq4hhkJdHTPw9ZmS09qvCfFvbBCfDoZX

ahGsfxNCZc6z5Cw/TU44vixDWMy8Efzl4FaV7HK6LO40F/Wd2wdiMeROuMvjWYJRDHVxUcaRF

Jo3XctfTOVGOGdf7JMfRborEUmZVKs35cCMeUfnpsosRF7ovIuW0DM9nzpfDVRE67oY/hnTZB

0gDTXs15r+NG97xw1/SvAqlZakdekgikus/mR3qIJ8me7XOGx3DzN4p4uVVFSA4ghEiDrknoJ

N0C17dvh2tBfPckM96oOoJrSrfxUtfzMFwwaEUamCAvgp+YJA+rJoe8BvC0XBfF7QH06M2oT6

Gz1yq8D22qNzCbwHvhZrUm5NwooPjBGPwSQ3pKcheZ7yGuSafBDYU2lErq+q09fCk/RO7SH/z

iDey6NhKRLLD/iz1npFI3HN/LsYRjO0tjSqfZb3J/bIr3MdOxkA4c/Ksl2VYw5V01d4IdSvZp

h9uLHFh+JHb7NuY7wiIrs4YtO5NNmj0OWjJJtlcXJ+XSo1ZK2325pn93HoOoLn2X4EtLubTgb

zldhinmcDppWbCB0mh6CFBTHlzXN2prW09gy2gTYwsfCPC0TtB+3MftWfPzrDCgr3lfLEY3wy

omSHM5rfvagNvfHIB+CnkY/zZRyHkVXiEMlIr/ZaPJFlKGpcPQ1j/jxYcCXQALQ1Oe35gh6wM

ierVwhmoGqjhgyC6Cu4nzbM2EHTzpZIh8NkCeGjYbCPlfFAXRcztUy7Zo669ABdBwgVtPKWtN

9BweMWxXvF4n1RhUqQ1gx7isLlj9KRjcs/HwPywJ00kqwRWfgk/uiD6vubgA3HK57y3DRoq3j

mVW4+bB/UgU5Ov/VXO/lEEfWcQNcou9IRGr/f1PNqk5nJjvonc2fhGzIKsFXsdZ2zO2kjOhZF

MgxN31O7+1rVl62WybPPqe8N3nHwk3oYCh1Wqhz/lLrqhVheW5bqdF97llNOu1OCyX/zXyo3b

ZR71kO1dXq2ixxjD1ZGH9gZOOzj060WFJCt9AzdF19afjToqdNMFgw6aem7BQjktcByjkxJik

sHEdPUpE4LyeCGXaz/JdAcWPkj6dWZ1B1+hU8HFIxRbiUUYjk5pC+lpHD0yoFooIn7o8vvX2c

6nZmMHxxygUrPEV0EU8ZMw3jUJt3xwwxwvMkizNdXhCB1CG2cGC5zNe407yRM+wuYrNmX8yI3

PtOJkVPbfm29nLuzJwlWCzGx+vQwEq4/7IfPvXFWnIHLA0soF/qV1mNWTQxdFiPJKDKuqztTm

p+a71w7z6+75Sflzl6H62q+DrglKL/2aJ0G+1FieRmkq3wmOsw+th1gqfxwC9ClxK9aWLE1DW

QoCaRSn0nfGZ2QayQ5wPOSnYNmlqDr9xa91pu+bqKNIO5j6p7B38P+HccrMfxceuw7vADQ1UN

MHxxvb/JeGsWJTka0YtDf52fu8eBFMlGkF5Jx3eVzgVy6XC6SGMs8fVHchTzSR4gVRX8jatSS

Kq9ETUrylcgHllbuSyu/L6oST6TeaapvhfD/g1zDvUCYg7URMyFx5N9m/s+2W1+5AHp8OoK17

d8TWZl2CySU1Usg1ohXQ59We+TGGMzvD4P9AbHOSpwunG5fu1Bq3ZOTgMPgRe/pAk3RlXOTsu

eJEAptkkNafxi0kQx7Wqqs5IVoAVC9n2nO7TYthNrXHhlauYiqQaw0p0LKEj9eXsGGGUNy8kb

MMzZ/lUurEArycQ0t5RwAaIakid6oedTd71uTq2Wob0sFW7Q+MzwojFsF6MFy5iYmmd9I54Bq

o2Dc2Y0GJDJobe0wBfd5T/bWa7T1EkYr98wpeQS6UVzIoWEgBZ5PB9/wwsPfq78VdOujB/SES

SDPBZ1qdM2g90vtmKnXQEKG4Y0DQPbAiCDsjs9TkP4RVo2QaL3+kbZnsb+NHcZG6RXmG3HOyZ

wSshWk63X84cQuj7lC+pLuvyEB98v/i4RkMQMjqfmR7CECIuz9acDPvAJn6xGD1hX2ER+ni6P

3OLQUIgIaOwYMKUMR/u4bu8Wt40Vz5NyH0965SAOH/NS8QtNXGE6Nzf8ROv0NRRPoaDqAawK/

hKNXg7C+u77xm4S1+GEgwmbUPRCPZP+dwF8E7b5/vn7MwRnlTlEjIq12ZmB5Q1MjonF4UR7Rw

QuHQNhAgReSbJpMcWGIKRN9w9gx9yBGyElbtY1B3OLe1najNAKIqSbi+FeRUcUOd9dxcU5ALl

Y+sVB1fKoSsavJNgf4A8WWDtHq3MQBZ5ktnd1AVVDfePl1IbgHUWa0/X4FZvSCOrJozfIn8Lz

09sPoyATl30xFJ2VmSVF2SWMHZo8P2SXIP+GizR6U67t/EQDmnLlpa83KSRsHEZ9xQ6wK/CFp

oLi610nUMphN66ivNBL//6Lrzr9MEEMsw3vykaDzEZ3U7ISn+HeoNE84eNVThT5pbNjx31N6n

9SeDesdtCmiiFnB2dySdlEX4IcZL7ZdcKkbaSHoPfwR2vzEb2vISQQPQ31NunwfcGX7MzWy5i

DrIg2uV8IoicJcVUwGGbRilRLX4f+caFzGaKYiEuA4FV1NhJTJteNp2Ag8AHA6AQQSSYxNyYi

rT/7sB7NaqZUnSoCg2+fl8xnXs4FOqFmeJ0rAj7NEEyGyhlSCgx9zm64xkRxek0TLOL76xUbQ

hc4sqrASGsQ0AQA53ccMuGvh223xBkyBf8dcWm2FyW/MBt32uqQzwQBfszmTtChAiB0UD6eDh

RR5wNdMjUpN76uFqPahUxRMwRYItx1eMAnVUTdhnyFxNm/Qz3nX2TL6gb1XDMc6clCZzi69ow

MbGTbEzxUIBdO0oQE3++JymJZT3YGezOSDwXEO9MtPPOoE0MiW9ixx2GAVWw/w4+SaGiNnKOO

Aq0rH3Lu2O6SWrBQLthRtdHFc77eGIadXMa83xqhvSffuN7URrlrFQllZtn8kR1GtpcAFqmSJ

FiZV6oXQ81r7UG6gfqwsCOqSbMgVJyILDGQwtBBhf/aULA5GiKKXMdmWIePr7NMo4DGqLqbZC

DL69ooSYGaeyADTlribI1Js6wv0a2BHTR4JC2TRR9W04m/3hu63Wr667Y7Sf7MC1WeELXsCSe

CqIA4CZmVtLwkcgoUcYsct1J+bTY5v0GMMPSjW7iE9jRUK1l/VSJWyBhjhshKWFMtKzSrdq7Q

Zyi/oCXXtAKOV0ezyp46yzZHpUbuTE4a7+YZd9W8CcoIrWsEsBVudd4o5x8KcNm04AGk7y8h+

o4SiaRUgwcBp1azdlVJBuCmqiHsGNFZoQiXf9yDqFQI8/joYSJ6hc2OjotEfmhCx38pDBZ3dy

sy4AxIZ515L4Qr+Aw6Wm1EsGSwKOawS/i6lzP4lDRRjDXfA2R7RWISfRXB0GZBUTO8QoyOUrd

Po2M4Q3bFmj+j7TTcJZsQL/ZMzjRIVstcqziD0wifbBEPvWM5KwTVTOepy5W3LTibvvEAsveb

jK32vwrbkOGpVaa+6V4nGWdzDIbevAKy8ALyCjWSvsJYFU8JTVNdFzDQnK26geE3vzADV+qow

uME2SC2HOgfe/91MP0PX1nL7irCsGiE6FekreVA2WbBfGsXeit4qgKB8kAUW/BdyM6iyUfcXY

Pfck+KQdwY7tGrOAfed9YLEw5NZxLpgxDVoJChtgrn3+5BWCHOZvU2Y4PpZ8eg+HwfpuBCXL5

IGDU/a6GtnrjjVrbHfNh6VuHJ/MYE6JFiHhxZCBOQfURiC9EqtyeGsMhvL2tpmRjENETjYri7

fVIamIb7+zEG4CBrpILcg7wsgTNqOLovndcrZeCNOJhdyahI+UHSumB8hJJJMmQZLHzgX/XQ2

Rdz5VZTgrEuSYLBKpKZgpGrZoPQxu5w0HIn9xY9tQygtJZZzICKFGu/tyAXFTYDwgGzXScbjr

TcucY1JSTh6t76DpDKaE65PkFqZ8cvtJgbb9TFsINsa6KYdpn7J5T76HYpqORSFUFwgqvdpun

gI0dlA59TYddQFYx13qzNNX9pZGaQ/+HegS76MWnNRKM9JVMJhZVlyLm8xOSQAd0zR4KVu8DD

DmBlGFhCpwLlqAxz/I/gdAJd5kPIV68eFS/Yhd4KvuRwYpYo7HZz2ic6fcCp/fTc8bxHpssrl

CDMnnGCrYbsYmTEuPMEoyDDsVuBJE+tApwz5mPuaDOqhhvm/AwYk2xZIOY2O4rb8WzuG5rwzV

2eWKoj7NrnesSpOcHz7XW4VvKK+3sI0rOiyIKT/h20NTK1yaknv51Nzxq2QGRHlLohCeEAjq5

mys1AvfJHsOIKoarev1uiXuaqfJ02JRlrrCM/H24SPSPqSCSPhB7sO4f7BLcxGBhxKKUpiJqs

x9d7Qr/RtlqRhSEBl2EBNVfmAHBQpGazwkcwxg++47k2lcNqhOexUSQ2xewGWYR9W7srM5t6k

p9mm13KIQz5Dh0toLU2ASsryJouJnCbLFE8LuLR9RMfWGjTiMXFIl+8FTTbBuulBE83pCuSgq

CU4b1zjEagNE7svSeCXFG3mZsN17DUucgAoo1MEuQSD5iYzYjCJoARrhcPG+jFbMJ9NBSVDTv

ebVYZQKRYzTcw34LRY3W+sYfMtJpL66BXzgvQ4VPBMkPlKKDvJNHAka3IP7/78Tt2INPq/Ahv

Yf6Q1d+hxM0OjTwLH9dznV113iLEmzHebdWSLjLPII5eMMJC4+O3+vWrerWiLt7PXiy2QFdqi

P4N6dC+NN5ynvE7r1JzQA5j8JFwLRPFoflDHXtgzYucy1DaUaVhW4R1npxkSfUuO1q/uBI9VS

T0/NBAxC59mwnfoQXLn7DweTW+za09XHqqSt8n92my+X2bZTv3yGOswy/DCABWdImXk0zsl+S

u/KJ6V7ikrB6cf2Nt9JFqQRfZbgrSyvFXQLFKSUrEcEELjp4SkKb92D8gPhHGYMhiugfg2i/X

Z/9FBgG48ECJUFWY14F72n4aBhQKT29XR+f/2ZlNKOye1mvrrZGsVf9ff2XUx7zUwd0JJcUn3

ENOMxvvZUI7MzJ62jObm42Gxk9wvVeH5ChPuNQMhrAARj6Txr6n99gflgnAB3616tqL2IPsd3

+BywVs7/1PzPHeiba9yKj0Sp4b/KOHTZXW1Ys8zXJCMpyp7JdL/y174KMaePU6fb9JmGppNTY

H5rqsWZ/pO8etveqtEuY0UY6uBO4Ai+LiXrBkWt2Zfd5/cK67HyefWY3FufzZxICXXlhao6bU

/AXyqMp+h3M1ay/3R2D8po0NU8kb

X-Spam_score: 23.7

X-Spam_score_int: 237

X-Spam_bar: +++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Sécurité et tranquillité d'esprit – grâce à CAA



Content analysis details: (23.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

[82.165.159.131 listed in dnsbl.ahbl.org]

[82.165.159.131 listed in dnsbl.ahbl.org]

[82.165.159.131 listed in dnsbl.ahbl.org]

[78.135.110.204 listed in dnsbl.ahbl.org]

[78.135.110.204 listed in dnsbl.ahbl.org]

[78.135.110.204 listed in dnsbl.ahbl.org]

[78.135.110.204 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[78.135.110.204 listed in sbl-xbl.spamhaus.org]

[82.165.159.131 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[78.135.110.204 listed in will-spam-for-food.eu.org]

[78.135.110.204 listed in will-spam-for-food.eu.org]

[78.135.110.204 listed in will-spam-for-food.eu.org]

[78.135.110.204 listed in will-spam-for-food.eu.org]

[78.135.110.204 listed in will-spam-for-food.eu.org]

[78.135.110.204 listed in will-spam-for-food.eu.org]

[78.135.110.204 listed in will-spam-for-food.eu.org]

[78.135.110.204 listed in will-spam-for-food.eu.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[82.165.159.131 listed in zen.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[78.135.110.204 listed in zen.spamhaus.org]

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[caa.client(at)mail.com]

1.2 MISSING_HEADERS Missing To: header

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image

2.9 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

1.0 XPRIO Has X-Priority header

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?Offre_sp=C3=A9ciale_=3A_votre_kit_d=27?=

=?UTF-8?Q?urgence_voiture_vous_attend_!?=









French language CAA phsh

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Nov 2024 22:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuGI-000000008VI-0tAq

for dave@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 22:25:22 -0700

Resent-From: The Doctor

Resent-Date: Sun, 17 Nov 2024 22:25:22 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from comp1.prod.digitaltransformationco.xyz ([78.135.110.84]:41038 helo=scholarsuccesspath.edu)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tCs76-00000000PPF-0SaT

for root@nk.ca;

Sun, 17 Nov 2024 20:07:47 -0700

Authentication-Results: gmx.net; dkim=pass header.i=caa.client@mail.com

Received: from mout-xforward.gmx.com ([82.165.159.131]) by mx-ha.gmx.net

(mxgmx009 [212.227.15.10]) with ESMTPS (Nemesis) id 1MSJVS-1tJVMI1J4i-00L8EB

for ; Mon, 18 Nov 2024 03:31:14 +0100

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mail.com;

s=s1089575; t=1731897073; x=1732501873; i=caa.client@mail.com;

bh=HdroSb5T3h2yx5t6yTSwL5ErnQavz2G1bYfuEOD5t20=;

h=X-UI-Sender-Class:MIME-Version:Message-ID:From:Subject:

Content-Type:Date:cc:content-transfer-encoding:content-type:date:

from:message-id:mime-version:reply-to:subject:to;

b=XSjAXPZTO/GZE0cr12+9+pqMnIJ5Jmx7GN4CIIpFF2lwFOfqK3AneSm01vJX8chT

3usmnhNavs1gWoIOG7k89R53qRkrMHBa7VGICEH2A8ckga/DGvaUkwNJ3IjGFJJuC

RKwZ8Xb0qoWDjPACNmsEGtiMULNOrGFmkPE/1j2hkkDw4Mstj8GU16mkPUj/I+Upe

R7ua5qmCV9mFiYmqklJzH6jkcjoq1txIrGuaOaww5Cndy4euvBm6M1BYkn6V87qJB

0KG3MuyJ9PI1J2B/HnzDCeoqtpuLqMatnR6gBJtGSsKhUwhbe1bTHVwAceudY2pQM

aSFaH4MuoVG/YjwcBA==

X-UI-Sender-Class: f2cb72be-343f-493d-8ec3-b1efb8d6185a

Received: from [] ([]) by web-mail.mail.com

(3c-app-mailcom-lxa05.server.lan [10.76.45.6]) (via HTTP); Mon, 18 Nov 2024

03:31:12 +0100

MIME-Version: 1.0

Message-ID:

From: CAA

Subject: =?UTF-8?Q?Offre_sp=C3=A9ciale_=3A_votre_kit_d=27?=

=?UTF-8?Q?urgence_voiture_vous_attend_!?=

Content-Type: text/html; charset=UTF-8

Date: Mon, 18 Nov 2024 03:31:12 +0100

Importance: normal

Sensitivity: Normal

X-Priority: 3

X-Provags-ID: V03:K1:p54ANrkAHe8NqMvZxaw5uS0BHPja5qV154fyniS/YBhOdVWds2kaGSISe0v28aO0DArpg

jZZBemzVbJ26Eo3hr+daiNcpkDGXK1Avb6aib+T66KUW7F6hnBBsJR+L6DqFCd4pUuEGZUVCSfjB

Y2emExSqtxRmdvoHCCIzLCzBU7A2r75fQgy7yxHM9V0QJVhW7Sie+LX+gSynma34ARgMk5y8kzyC

NOcoS4qN5yHc8p5w4AKu6GmFAT4ePiT96R1n07K/BLmxYos31gqSpDgJvYyKpwkL6RKyznADLTm3

Rw=

X-Spam-Flag: YES

UI-OutboundReport: junk:10;M01:P0:ZACsvEN6UYA=;aEc6BcIHjTaiJUnMJ5jwBrfbveiDZ

Ph+Iv4if48Km/13g9lK3K0XKMSkxx4fn/W1QYoqi3svY03ahKqqETxbGb0ijI2xTsM3vROcyt

VyTd5EJOa1Na9te981AjsNULMLrl7ZS4BKlWf8yn7fzAZly21VJOu41VhAxp1iOdh2H1/a7ZB

6pdGAOIss/IeToZSWyJI/SvXPSUGQJiwJNfmW+DKQCKqHg7r8L+1wO2TWH7YwpfwkP42LxIza

bVuFKYLuywI5uNpRsenJKCx/fo95UFfk8SIzbAPh8ZnpXitCUY3crB4g15i5uOIdT+yFrCnlJ

caJfDL1rqZ4WTWBfWrNbeRZvI8Lcausjby6w4a4Vcih8wVUBCKGpKncRimJDfIhRrUvM6DLBy

fjTEs4ihDyHq9M/xE69OaZVZp/Ecssd6wWJCVpTSzF2ZNFevlj/3pf0pA6+mSPLMbubKo9X21

BPdzuaHh+vlaFTc4e+FpQ+tfHXbFOr3HdiERDNptB9lTwtg2AArLoUNE6zNk7fsj5XutZPQP0

3qAijKVg2RqX3IC94ywIbkwSoRxypHv8/TdAd6MFVB/58e8I/nW4qed02wgAXDTGytN/s5aOc

9oBAhnzOLCVp27Gg4C/cGhteMh1v6iqwYvXNJFnJp2oMgY0Va+nIOeEiM4KSn6MvODTKkscLO

aUXbuL8UXJSBrjyhpi+VIW2mkG1qW5fzGGHjFMPhbeVdBJbNuy1SoyIMfXvz8N+uP1uocUFzc

2awuIfzKvFDl25p16Y9//HYu8oFYi0xFrheW5+C9gEpGDAWSr2Ak=

X-GMX-Antispam: 5 (eXpurgate); Detail=V3;

X-Spam-Flag: YES

UI-InboundReport: junk:10;M01:P0:olJWUaRC7F4=;1Fyiah1qzAYMRqKvJKkpeECCWI0s1R

eiRNCZIm46IFzIwDxqn2Qhb4JVXp9yE6rGZuPghxRcE2sFTYIHZpwW25Fh6RtKodPjad0i+Dw

Euk9Tgvw5pDeSwlOnBmYeYHxdTSCjbjgDhbL/XzeglD+t3lQGHzPr90ORbvrFqFR7yDp9dwNX

yAQNeZGSNsmVy9ofR3Ur3cLWfq86thZtkPxHwqr7/JYsgVXQIZdaahy4MLgqYx2EN0M3W+spU

yJi2X70m1800zUExpAi0JBN/GfFQSFvJIfnWVMderSiOerTuesa7X8oijCzYDlDIQo26itMZJ

VVg+aBWeeogr+VOBifYIxdQ/W83khWDCYwLUINPyWna/1Rg2/+4w/Pqmxwzwq3GAXQ+DDHFJS

eTZC4IqPqv1qopnsV5OLZ1LzwX/fEeRLOPkxILfqSVeLyUe3rNPGvnvILKHGaBWRQUig9yGgt

L1py/BAFi46sslxwCWh2oF/lXIhUlslrZe0nyc8GZ18855aZIyFeh2GYvk8XDkZGxUPfHB4d6

cZCgmDGPf2kyDOMPe8qg+v4OWoVLgq629dxDFBOb5Ac8+g37oyqH7egLCn6AiJS2/tu+1CSg4

oYzH9EPGM0iJHdFvZ4ydPuwtw/u+/FSAMJ2ho8QUacDlG9F+Etx6wTXB3GKfYFsInIvCmNlpF

b8QgSuZKBf2zgyqN6vjN7THcrmzwPRIeePaMF9lp5aRdMd+8SLfwCuSDWKGuk/GBmYNXU/FI6

moP4SwJKVPjqRVCzY8bPE7IZJcPzysw4Zfkes6m8ZQd6ugGpN5CP8SMm8kJG38aEnwi5K5KIw

KQBHklN5YG1sfzq0PvXQPdnEhcwMYr0gM7pvdE53gfT3JjtQMI71SQIEClcWa1lrDigfoz/0N

lponD/1HIpn7C0xduJFVGgzY7F503r2iAaXSR3xbE5noxxbsIlP2NAtXaPx4ys5yDB0KUx/KQ

vI6rPSp7csKEbEYB/B4l6gS3fGrOwkzSmKTm740cCKanKPc4MtyOLbyUGpJaDH0PL2Mz3qnkA

a+BNP5xCA7FzvSgiImUPAJ2J/E3pHR9fhmwXSEPjYSq4hhkJdHTPw9ZmS09qvCfFvbBCfDoZX

ahGsfxNCZc6z5Cw/TU44vixDWMy8Efzl4FaV7HK6LO40F/Wd2wdiMeROuMvjWYJRDHVxUcaRF

Jo3XctfTOVGOGdf7JMfRborEUmZVKs35cCMeUfnpsosRF7ovIuW0DM9nzpfDVRE67oY/hnTZB

0gDTXs15r+NG97xw1/SvAqlZakdekgikus/mR3qIJ8me7XOGx3DzN4p4uVVFSA4ghEiDrknoJ

N0C17dvh2tBfPckM96oOoJrSrfxUtfzMFwwaEUamCAvgp+YJA+rJoe8BvC0XBfF7QH06M2oT6

Gz1yq8D22qNzCbwHvhZrUm5NwooPjBGPwSQ3pKcheZ7yGuSafBDYU2lErq+q09fCk/RO7SH/z

iDey6NhKRLLD/iz1npFI3HN/LsYRjO0tjSqfZb3J/bIr3MdOxkA4c/Ksl2VYw5V01d4IdSvZp

h9uLHFh+JHb7NuY7wiIrs4YtO5NNmj0OWjJJtlcXJ+XSo1ZK2325pn93HoOoLn2X4EtLubTgb

zldhinmcDppWbCB0mh6CFBTHlzXN2prW09gy2gTYwsfCPC0TtB+3MftWfPzrDCgr3lfLEY3wy

omSHM5rfvagNvfHIB+CnkY/zZRyHkVXiEMlIr/ZaPJFlKGpcPQ1j/jxYcCXQALQ1Oe35gh6wM

ierVwhmoGqjhgyC6Cu4nzbM2EHTzpZIh8NkCeGjYbCPlfFAXRcztUy7Zo669ABdBwgVtPKWtN

9BweMWxXvF4n1RhUqQ1gx7isLlj9KRjcs/HwPywJ00kqwRWfgk/uiD6vubgA3HK57y3DRoq3j

mVW4+bB/UgU5Ov/VXO/lEEfWcQNcou9IRGr/f1PNqk5nJjvonc2fhGzIKsFXsdZ2zO2kjOhZF

MgxN31O7+1rVl62WybPPqe8N3nHwk3oYCh1Wqhz/lLrqhVheW5bqdF97llNOu1OCyX/zXyo3b

ZR71kO1dXq2ixxjD1ZGH9gZOOzj060WFJCt9AzdF19afjToqdNMFgw6aem7BQjktcByjkxJik

sHEdPUpE4LyeCGXaz/JdAcWPkj6dWZ1B1+hU8HFIxRbiUUYjk5pC+lpHD0yoFooIn7o8vvX2c

6nZmMHxxygUrPEV0EU8ZMw3jUJt3xwwxwvMkizNdXhCB1CG2cGC5zNe407yRM+wuYrNmX8yI3

PtOJkVPbfm29nLuzJwlWCzGx+vQwEq4/7IfPvXFWnIHLA0soF/qV1mNWTQxdFiPJKDKuqztTm

p+a71w7z6+75Sflzl6H62q+DrglKL/2aJ0G+1FieRmkq3wmOsw+th1gqfxwC9ClxK9aWLE1DW

QoCaRSn0nfGZ2QayQ5wPOSnYNmlqDr9xa91pu+bqKNIO5j6p7B38P+HccrMfxceuw7vADQ1UN

MHxxvb/JeGsWJTka0YtDf52fu8eBFMlGkF5Jx3eVzgVy6XC6SGMs8fVHchTzSR4gVRX8jatSS

Kq9ETUrylcgHllbuSyu/L6oST6TeaapvhfD/g1zDvUCYg7URMyFx5N9m/s+2W1+5AHp8OoK17

d8TWZl2CySU1Usg1ohXQ59We+TGGMzvD4P9AbHOSpwunG5fu1Bq3ZOTgMPgRe/pAk3RlXOTsu

eJEAptkkNafxi0kQx7Wqqs5IVoAVC9n2nO7TYthNrXHhlauYiqQaw0p0LKEj9eXsGGGUNy8kb

MMzZ/lUurEArycQ0t5RwAaIakid6oedTd71uTq2Wob0sFW7Q+MzwojFsF6MFy5iYmmd9I54Bq

o2Dc2Y0GJDJobe0wBfd5T/bWa7T1EkYr98wpeQS6UVzIoWEgBZ5PB9/wwsPfq78VdOujB/SES

SDPBZ1qdM2g90vtmKnXQEKG4Y0DQPbAiCDsjs9TkP4RVo2QaL3+kbZnsb+NHcZG6RXmG3HOyZ

wSshWk63X84cQuj7lC+pLuvyEB98v/i4RkMQMjqfmR7CECIuz9acDPvAJn6xGD1hX2ER+ni6P

3OLQUIgIaOwYMKUMR/u4bu8Wt40Vz5NyH0965SAOH/NS8QtNXGE6Nzf8ROv0NRRPoaDqAawK/

hKNXg7C+u77xm4S1+GEgwmbUPRCPZP+dwF8E7b5/vn7MwRnlTlEjIq12ZmB5Q1MjonF4UR7Rw

QuHQNhAgReSbJpMcWGIKRN9w9gx9yBGyElbtY1B3OLe1najNAKIqSbi+FeRUcUOd9dxcU5ALl

Y+sVB1fKoSsavJNgf4A8WWDtHq3MQBZ5ktnd1AVVDfePl1IbgHUWa0/X4FZvSCOrJozfIn8Lz

09sPoyATl30xFJ2VmSVF2SWMHZo8P2SXIP+GizR6U67t/EQDmnLlpa83KSRsHEZ9xQ6wK/CFp

oLi610nUMphN66ivNBL//6Lrzr9MEEMsw3vykaDzEZ3U7ISn+HeoNE84eNVThT5pbNjx31N6n

9SeDesdtCmiiFnB2dySdlEX4IcZL7ZdcKkbaSHoPfwR2vzEb2vISQQPQ31NunwfcGX7MzWy5i

DrIg2uV8IoicJcVUwGGbRilRLX4f+caFzGaKYiEuA4FV1NhJTJteNp2Ag8AHA6AQQSSYxNyYi

rT/7sB7NaqZUnSoCg2+fl8xnXs4FOqFmeJ0rAj7NEEyGyhlSCgx9zm64xkRxek0TLOL76xUbQ

hc4sqrASGsQ0AQA53ccMuGvh223xBkyBf8dcWm2FyW/MBt32uqQzwQBfszmTtChAiB0UD6eDh

RR5wNdMjUpN76uFqPahUxRMwRYItx1eMAnVUTdhnyFxNm/Qz3nX2TL6gb1XDMc6clCZzi69ow

MbGTbEzxUIBdO0oQE3++JymJZT3YGezOSDwXEO9MtPPOoE0MiW9ixx2GAVWw/w4+SaGiNnKOO

Aq0rH3Lu2O6SWrBQLthRtdHFc77eGIadXMa83xqhvSffuN7URrlrFQllZtn8kR1GtpcAFqmSJ

FiZV6oXQ81r7UG6gfqwsCOqSbMgVJyILDGQwtBBhf/aULA5GiKKXMdmWIePr7NMo4DGqLqbZC

DL69ooSYGaeyADTlribI1Js6wv0a2BHTR4JC2TRR9W04m/3hu63Wr667Y7Sf7MC1WeELXsCSe

CqIA4CZmVtLwkcgoUcYsct1J+bTY5v0GMMPSjW7iE9jRUK1l/VSJWyBhjhshKWFMtKzSrdq7Q

Zyi/oCXXtAKOV0ezyp46yzZHpUbuTE4a7+YZd9W8CcoIrWsEsBVudd4o5x8KcNm04AGk7y8h+

o4SiaRUgwcBp1azdlVJBuCmqiHsGNFZoQiXf9yDqFQI8/joYSJ6hc2OjotEfmhCx38pDBZ3dy

sy4AxIZ515L4Qr+Aw6Wm1EsGSwKOawS/i6lzP4lDRRjDXfA2R7RWISfRXB0GZBUTO8QoyOUrd

Po2M4Q3bFmj+j7TTcJZsQL/ZMzjRIVstcqziD0wifbBEPvWM5KwTVTOepy5W3LTibvvEAsveb

jK32vwrbkOGpVaa+6V4nGWdzDIbevAKy8ALyCjWSvsJYFU8JTVNdFzDQnK26geE3vzADV+qow

uME2SC2HOgfe/91MP0PX1nL7irCsGiE6FekreVA2WbBfGsXeit4qgKB8kAUW/BdyM6iyUfcXY

Pfck+KQdwY7tGrOAfed9YLEw5NZxLpgxDVoJChtgrn3+5BWCHOZvU2Y4PpZ8eg+HwfpuBCXL5

IGDU/a6GtnrjjVrbHfNh6VuHJ/MYE6JFiHhxZCBOQfURiC9EqtyeGsMhvL2tpmRjENETjYri7

fVIamIb7+zEG4CBrpILcg7wsgTNqOLovndcrZeCNOJhdyahI+UHSumB8hJJJMmQZLHzgX/XQ2

Rdz5VZTgrEuSYLBKpKZgpGrZoPQxu5w0HIn9xY9tQygtJZZzICKFGu/tyAXFTYDwgGzXScbjr

TcucY1JSTh6t76DpDKaE65PkFqZ8cvtJgbb9TFsINsa6KYdpn7J5T76HYpqORSFUFwgqvdpun

gI0dlA59TYddQFYx13qzNNX9pZGaQ/+HegS76MWnNRKM9JVMJhZVlyLm8xOSQAd0zR4KVu8DD

DmBlGFhCpwLlqAxz/I/gdAJd5kPIV68eFS/Yhd4KvuRwYpYo7HZz2ic6fcCp/fTc8bxHpssrl

CDMnnGCrYbsYmTEuPMEoyDDsVuBJE+tApwz5mPuaDOqhhvm/AwYk2xZIOY2O4rb8WzuG5rwzV

2eWKoj7NrnesSpOcHz7XW4VvKK+3sI0rOiyIKT/h20NTK1yaknv51Nzxq2QGRHlLohCeEAjq5

mys1AvfJHsOIKoarev1uiXuaqfJ02JRlrrCM/H24SPSPqSCSPhB7sO4f7BLcxGBhxKKUpiJqs

x9d7Qr/RtlqRhSEBl2EBNVfmAHBQpGazwkcwxg++47k2lcNqhOexUSQ2xewGWYR9W7srM5t6k

p9mm13KIQz5Dh0toLU2ASsryJouJnCbLFE8LuLR9RMfWGjTiMXFIl+8FTTbBuulBE83pCuSgq

CU4b1zjEagNE7svSeCXFG3mZsN17DUucgAoo1MEuQSD5iYzYjCJoARrhcPG+jFbMJ9NBSVDTv

ebVYZQKRYzTcw34LRY3W+sYfMtJpL66BXzgvQ4VPBMkPlKKDvJNHAka3IP7/78Tt2INPq/Ahv

Yf6Q1d+hxM0OjTwLH9dznV113iLEmzHebdWSLjLPII5eMMJC4+O3+vWrerWiLt7PXiy2QFdqi

P4N6dC+NN5ynvE7r1JzQA5j8JFwLRPFoflDHXtgzYucy1DaUaVhW4R1npxkSfUuO1q/uBI9VS

T0/NBAxC59mwnfoQXLn7DweTW+za09XHqqSt8n92my+X2bZTv3yGOswy/DCABWdImXk0zsl+S

u/KJ6V7ikrB6cf2Nt9JFqQRfZbgrSyvFXQLFKSUrEcEELjp4SkKb92D8gPhHGYMhiugfg2i/X

Z/9FBgG48ECJUFWY14F72n4aBhQKT29XR+f/2ZlNKOye1mvrrZGsVf9ff2XUx7zUwd0JJcUn3

ENOMxvvZUI7MzJ62jObm42Gxk9wvVeH5ChPuNQMhrAARj6Txr6n99gflgnAB3616tqL2IPsd3

+BywVs7/1PzPHeiba9yKj0Sp4b/KOHTZXW1Ys8zXJCMpyp7JdL/y174KMaePU6fb9JmGppNTY

H5rqsWZ/pO8etveqtEuY0UY6uBO4Ai+LiXrBkWt2Zfd5/cK67HyefWY3FufzZxICXXlhao6bU

/AXyqMp+h3M1ay/3R2D8po0NU8kb

X-Spam_score: 26.3

X-Spam_score_int: 263

X-Spam_bar: ++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Sécurité et tranquillité d'esprit – grâce à CAA



Content analysis details: (26.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

[82.165.159.131 listed in dnsbl.ahbl.org]

[82.165.159.131 listed in dnsbl.ahbl.org]

[82.165.159.131 listed in dnsbl.ahbl.org]

[78.135.110.84 listed in dnsbl.ahbl.org]

[78.135.110.84 listed in dnsbl.ahbl.org]

[78.135.110.84 listed in dnsbl.ahbl.org]

[78.135.110.84 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[82.165.159.131 listed in zen.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[78.135.110.84 listed in zen.spamhaus.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[78.135.110.84 listed in bl.score.senderscore.com]

1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,

https://senderscore.org/blocklistlookup/

[78.135.110.84 listed in bl.score.senderscore.com]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[82.165.159.131 listed in sbl-xbl.spamhaus.org]

[78.135.110.84 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[78.135.110.84 listed in will-spam-for-food.eu.org]

[78.135.110.84 listed in will-spam-for-food.eu.org]

[78.135.110.84 listed in will-spam-for-food.eu.org]

[78.135.110.84 listed in will-spam-for-food.eu.org]

[78.135.110.84 listed in will-spam-for-food.eu.org]

[78.135.110.84 listed in will-spam-for-food.eu.org]

[78.135.110.84 listed in will-spam-for-food.eu.org]

[78.135.110.84 listed in will-spam-for-food.eu.org]

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[caa.client(at)mail.com]

1.2 MISSING_HEADERS Missing To: header

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

2.9 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} =?UTF-8?Q?Offre_sp=C3=A9ciale_=3A_votre_kit_d=27?=

=?UTF-8?Q?urgence_voiture_vous_attend_!?=









French language CAA phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Nov 2024 22:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuGU-000000008WK-1hRg

for dave@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 22:25:34 -0700

Resent-From: The Doctor

Resent-Date: Sun, 17 Nov 2024 22:25:34 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ens2.lab.digitaltransformationco.xyz ([78.135.110.148]:53283 helo=progressivelearning.edu)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tCs9f-00000000PVb-3NuQ

for root@nk.ca;

Sun, 17 Nov 2024 20:10:27 -0700

Authentication-Results: gmx.net; dkim=pass header.i=caa.client@mail.com

Received: from mout-xforward.gmx.com ([82.165.159.131]) by mx-ha.gmx.net

(mxgmx009 [212.227.15.10]) with ESMTPS (Nemesis) id 1MSJVS-1tJVMI1J4i-00L8EB

for ; Mon, 18 Nov 2024 03:31:14 +0100

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mail.com;

s=s1089575; t=1731897073; x=1732501873; i=caa.client@mail.com;

bh=HdroSb5T3h2yx5t6yTSwL5ErnQavz2G1bYfuEOD5t20=;

h=X-UI-Sender-Class:MIME-Version:Message-ID:From:Subject:

Content-Type:Date:cc:content-transfer-encoding:content-type:date:

from:message-id:mime-version:reply-to:subject:to;

b=XSjAXPZTO/GZE0cr12+9+pqMnIJ5Jmx7GN4CIIpFF2lwFOfqK3AneSm01vJX8chT

3usmnhNavs1gWoIOG7k89R53qRkrMHBa7VGICEH2A8ckga/DGvaUkwNJ3IjGFJJuC

RKwZ8Xb0qoWDjPACNmsEGtiMULNOrGFmkPE/1j2hkkDw4Mstj8GU16mkPUj/I+Upe

R7ua5qmCV9mFiYmqklJzH6jkcjoq1txIrGuaOaww5Cndy4euvBm6M1BYkn6V87qJB

0KG3MuyJ9PI1J2B/HnzDCeoqtpuLqMatnR6gBJtGSsKhUwhbe1bTHVwAceudY2pQM

aSFaH4MuoVG/YjwcBA==

X-UI-Sender-Class: f2cb72be-343f-493d-8ec3-b1efb8d6185a

Received: from [] ([]) by web-mail.mail.com

(3c-app-mailcom-lxa05.server.lan [10.76.45.6]) (via HTTP); Mon, 18 Nov 2024

03:31:12 +0100

MIME-Version: 1.0

Message-ID:

From: CAA

Subject: =?UTF-8?Q?Offre_sp=C3=A9ciale_=3A_votre_kit_d=27?=

=?UTF-8?Q?urgence_voiture_vous_attend_!?=

Content-Type: text/html; charset=UTF-8

Date: Mon, 18 Nov 2024 03:31:12 +0100

Importance: normal

Sensitivity: Normal

X-Priority: 3

X-Provags-ID: V03:K1:p54ANrkAHe8NqMvZxaw5uS0BHPja5qV154fyniS/YBhOdVWds2kaGSISe0v28aO0DArpg

jZZBemzVbJ26Eo3hr+daiNcpkDGXK1Avb6aib+T66KUW7F6hnBBsJR+L6DqFCd4pUuEGZUVCSfjB

Y2emExSqtxRmdvoHCCIzLCzBU7A2r75fQgy7yxHM9V0QJVhW7Sie+LX+gSynma34ARgMk5y8kzyC

NOcoS4qN5yHc8p5w4AKu6GmFAT4ePiT96R1n07K/BLmxYos31gqSpDgJvYyKpwkL6RKyznADLTm3

Rw=

X-Spam-Flag: YES

UI-OutboundReport: junk:10;M01:P0:ZACsvEN6UYA=;aEc6BcIHjTaiJUnMJ5jwBrfbveiDZ

Ph+Iv4if48Km/13g9lK3K0XKMSkxx4fn/W1QYoqi3svY03ahKqqETxbGb0ijI2xTsM3vROcyt

VyTd5EJOa1Na9te981AjsNULMLrl7ZS4BKlWf8yn7fzAZly21VJOu41VhAxp1iOdh2H1/a7ZB

6pdGAOIss/IeToZSWyJI/SvXPSUGQJiwJNfmW+DKQCKqHg7r8L+1wO2TWH7YwpfwkP42LxIza

bVuFKYLuywI5uNpRsenJKCx/fo95UFfk8SIzbAPh8ZnpXitCUY3crB4g15i5uOIdT+yFrCnlJ

caJfDL1rqZ4WTWBfWrNbeRZvI8Lcausjby6w4a4Vcih8wVUBCKGpKncRimJDfIhRrUvM6DLBy

fjTEs4ihDyHq9M/xE69OaZVZp/Ecssd6wWJCVpTSzF2ZNFevlj/3pf0pA6+mSPLMbubKo9X21

BPdzuaHh+vlaFTc4e+FpQ+tfHXbFOr3HdiERDNptB9lTwtg2AArLoUNE6zNk7fsj5XutZPQP0

3qAijKVg2RqX3IC94ywIbkwSoRxypHv8/TdAd6MFVB/58e8I/nW4qed02wgAXDTGytN/s5aOc

9oBAhnzOLCVp27Gg4C/cGhteMh1v6iqwYvXNJFnJp2oMgY0Va+nIOeEiM4KSn6MvODTKkscLO

aUXbuL8UXJSBrjyhpi+VIW2mkG1qW5fzGGHjFMPhbeVdBJbNuy1SoyIMfXvz8N+uP1uocUFzc

2awuIfzKvFDl25p16Y9//HYu8oFYi0xFrheW5+C9gEpGDAWSr2Ak=

X-GMX-Antispam: 5 (eXpurgate); Detail=V3;

X-Spam-Flag: YES

UI-InboundReport: junk:10;M01:P0:olJWUaRC7F4=;1Fyiah1qzAYMRqKvJKkpeECCWI0s1R

eiRNCZIm46IFzIwDxqn2Qhb4JVXp9yE6rGZuPghxRcE2sFTYIHZpwW25Fh6RtKodPjad0i+Dw

Euk9Tgvw5pDeSwlOnBmYeYHxdTSCjbjgDhbL/XzeglD+t3lQGHzPr90ORbvrFqFR7yDp9dwNX

yAQNeZGSNsmVy9ofR3Ur3cLWfq86thZtkPxHwqr7/JYsgVXQIZdaahy4MLgqYx2EN0M3W+spU

yJi2X70m1800zUExpAi0JBN/GfFQSFvJIfnWVMderSiOerTuesa7X8oijCzYDlDIQo26itMZJ

VVg+aBWeeogr+VOBifYIxdQ/W83khWDCYwLUINPyWna/1Rg2/+4w/Pqmxwzwq3GAXQ+DDHFJS

eTZC4IqPqv1qopnsV5OLZ1LzwX/fEeRLOPkxILfqSVeLyUe3rNPGvnvILKHGaBWRQUig9yGgt

L1py/BAFi46sslxwCWh2oF/lXIhUlslrZe0nyc8GZ18855aZIyFeh2GYvk8XDkZGxUPfHB4d6

cZCgmDGPf2kyDOMPe8qg+v4OWoVLgq629dxDFBOb5Ac8+g37oyqH7egLCn6AiJS2/tu+1CSg4

oYzH9EPGM0iJHdFvZ4ydPuwtw/u+/FSAMJ2ho8QUacDlG9F+Etx6wTXB3GKfYFsInIvCmNlpF

b8QgSuZKBf2zgyqN6vjN7THcrmzwPRIeePaMF9lp5aRdMd+8SLfwCuSDWKGuk/GBmYNXU/FI6

moP4SwJKVPjqRVCzY8bPE7IZJcPzysw4Zfkes6m8ZQd6ugGpN5CP8SMm8kJG38aEnwi5K5KIw

KQBHklN5YG1sfzq0PvXQPdnEhcwMYr0gM7pvdE53gfT3JjtQMI71SQIEClcWa1lrDigfoz/0N

lponD/1HIpn7C0xduJFVGgzY7F503r2iAaXSR3xbE5noxxbsIlP2NAtXaPx4ys5yDB0KUx/KQ

vI6rPSp7csKEbEYB/B4l6gS3fGrOwkzSmKTm740cCKanKPc4MtyOLbyUGpJaDH0PL2Mz3qnkA

a+BNP5xCA7FzvSgiImUPAJ2J/E3pHR9fhmwXSEPjYSq4hhkJdHTPw9ZmS09qvCfFvbBCfDoZX

ahGsfxNCZc6z5Cw/TU44vixDWMy8Efzl4FaV7HK6LO40F/Wd2wdiMeROuMvjWYJRDHVxUcaRF

Jo3XctfTOVGOGdf7JMfRborEUmZVKs35cCMeUfnpsosRF7ovIuW0DM9nzpfDVRE67oY/hnTZB

0gDTXs15r+NG97xw1/SvAqlZakdekgikus/mR3qIJ8me7XOGx3DzN4p4uVVFSA4ghEiDrknoJ

N0C17dvh2tBfPckM96oOoJrSrfxUtfzMFwwaEUamCAvgp+YJA+rJoe8BvC0XBfF7QH06M2oT6

Gz1yq8D22qNzCbwHvhZrUm5NwooPjBGPwSQ3pKcheZ7yGuSafBDYU2lErq+q09fCk/RO7SH/z

iDey6NhKRLLD/iz1npFI3HN/LsYRjO0tjSqfZb3J/bIr3MdOxkA4c/Ksl2VYw5V01d4IdSvZp

h9uLHFh+JHb7NuY7wiIrs4YtO5NNmj0OWjJJtlcXJ+XSo1ZK2325pn93HoOoLn2X4EtLubTgb

zldhinmcDppWbCB0mh6CFBTHlzXN2prW09gy2gTYwsfCPC0TtB+3MftWfPzrDCgr3lfLEY3wy

omSHM5rfvagNvfHIB+CnkY/zZRyHkVXiEMlIr/ZaPJFlKGpcPQ1j/jxYcCXQALQ1Oe35gh6wM

ierVwhmoGqjhgyC6Cu4nzbM2EHTzpZIh8NkCeGjYbCPlfFAXRcztUy7Zo669ABdBwgVtPKWtN

9BweMWxXvF4n1RhUqQ1gx7isLlj9KRjcs/HwPywJ00kqwRWfgk/uiD6vubgA3HK57y3DRoq3j

mVW4+bB/UgU5Ov/VXO/lEEfWcQNcou9IRGr/f1PNqk5nJjvonc2fhGzIKsFXsdZ2zO2kjOhZF

MgxN31O7+1rVl62WybPPqe8N3nHwk3oYCh1Wqhz/lLrqhVheW5bqdF97llNOu1OCyX/zXyo3b

ZR71kO1dXq2ixxjD1ZGH9gZOOzj060WFJCt9AzdF19afjToqdNMFgw6aem7BQjktcByjkxJik

sHEdPUpE4LyeCGXaz/JdAcWPkj6dWZ1B1+hU8HFIxRbiUUYjk5pC+lpHD0yoFooIn7o8vvX2c

6nZmMHxxygUrPEV0EU8ZMw3jUJt3xwwxwvMkizNdXhCB1CG2cGC5zNe407yRM+wuYrNmX8yI3

PtOJkVPbfm29nLuzJwlWCzGx+vQwEq4/7IfPvXFWnIHLA0soF/qV1mNWTQxdFiPJKDKuqztTm

p+a71w7z6+75Sflzl6H62q+DrglKL/2aJ0G+1FieRmkq3wmOsw+th1gqfxwC9ClxK9aWLE1DW

QoCaRSn0nfGZ2QayQ5wPOSnYNmlqDr9xa91pu+bqKNIO5j6p7B38P+HccrMfxceuw7vADQ1UN

MHxxvb/JeGsWJTka0YtDf52fu8eBFMlGkF5Jx3eVzgVy6XC6SGMs8fVHchTzSR4gVRX8jatSS

Kq9ETUrylcgHllbuSyu/L6oST6TeaapvhfD/g1zDvUCYg7URMyFx5N9m/s+2W1+5AHp8OoK17

d8TWZl2CySU1Usg1ohXQ59We+TGGMzvD4P9AbHOSpwunG5fu1Bq3ZOTgMPgRe/pAk3RlXOTsu

eJEAptkkNafxi0kQx7Wqqs5IVoAVC9n2nO7TYthNrXHhlauYiqQaw0p0LKEj9eXsGGGUNy8kb

MMzZ/lUurEArycQ0t5RwAaIakid6oedTd71uTq2Wob0sFW7Q+MzwojFsF6MFy5iYmmd9I54Bq

o2Dc2Y0GJDJobe0wBfd5T/bWa7T1EkYr98wpeQS6UVzIoWEgBZ5PB9/wwsPfq78VdOujB/SES

SDPBZ1qdM2g90vtmKnXQEKG4Y0DQPbAiCDsjs9TkP4RVo2QaL3+kbZnsb+NHcZG6RXmG3HOyZ

wSshWk63X84cQuj7lC+pLuvyEB98v/i4RkMQMjqfmR7CECIuz9acDPvAJn6xGD1hX2ER+ni6P

3OLQUIgIaOwYMKUMR/u4bu8Wt40Vz5NyH0965SAOH/NS8QtNXGE6Nzf8ROv0NRRPoaDqAawK/

hKNXg7C+u77xm4S1+GEgwmbUPRCPZP+dwF8E7b5/vn7MwRnlTlEjIq12ZmB5Q1MjonF4UR7Rw

QuHQNhAgReSbJpMcWGIKRN9w9gx9yBGyElbtY1B3OLe1najNAKIqSbi+FeRUcUOd9dxcU5ALl

Y+sVB1fKoSsavJNgf4A8WWDtHq3MQBZ5ktnd1AVVDfePl1IbgHUWa0/X4FZvSCOrJozfIn8Lz

09sPoyATl30xFJ2VmSVF2SWMHZo8P2SXIP+GizR6U67t/EQDmnLlpa83KSRsHEZ9xQ6wK/CFp

oLi610nUMphN66ivNBL//6Lrzr9MEEMsw3vykaDzEZ3U7ISn+HeoNE84eNVThT5pbNjx31N6n

9SeDesdtCmiiFnB2dySdlEX4IcZL7ZdcKkbaSHoPfwR2vzEb2vISQQPQ31NunwfcGX7MzWy5i

DrIg2uV8IoicJcVUwGGbRilRLX4f+caFzGaKYiEuA4FV1NhJTJteNp2Ag8AHA6AQQSSYxNyYi

rT/7sB7NaqZUnSoCg2+fl8xnXs4FOqFmeJ0rAj7NEEyGyhlSCgx9zm64xkRxek0TLOL76xUbQ

hc4sqrASGsQ0AQA53ccMuGvh223xBkyBf8dcWm2FyW/MBt32uqQzwQBfszmTtChAiB0UD6eDh

RR5wNdMjUpN76uFqPahUxRMwRYItx1eMAnVUTdhnyFxNm/Qz3nX2TL6gb1XDMc6clCZzi69ow

MbGTbEzxUIBdO0oQE3++JymJZT3YGezOSDwXEO9MtPPOoE0MiW9ixx2GAVWw/w4+SaGiNnKOO

Aq0rH3Lu2O6SWrBQLthRtdHFc77eGIadXMa83xqhvSffuN7URrlrFQllZtn8kR1GtpcAFqmSJ

FiZV6oXQ81r7UG6gfqwsCOqSbMgVJyILDGQwtBBhf/aULA5GiKKXMdmWIePr7NMo4DGqLqbZC

DL69ooSYGaeyADTlribI1Js6wv0a2BHTR4JC2TRR9W04m/3hu63Wr667Y7Sf7MC1WeELXsCSe

CqIA4CZmVtLwkcgoUcYsct1J+bTY5v0GMMPSjW7iE9jRUK1l/VSJWyBhjhshKWFMtKzSrdq7Q

Zyi/oCXXtAKOV0ezyp46yzZHpUbuTE4a7+YZd9W8CcoIrWsEsBVudd4o5x8KcNm04AGk7y8h+

o4SiaRUgwcBp1azdlVJBuCmqiHsGNFZoQiXf9yDqFQI8/joYSJ6hc2OjotEfmhCx38pDBZ3dy

sy4AxIZ515L4Qr+Aw6Wm1EsGSwKOawS/i6lzP4lDRRjDXfA2R7RWISfRXB0GZBUTO8QoyOUrd

Po2M4Q3bFmj+j7TTcJZsQL/ZMzjRIVstcqziD0wifbBEPvWM5KwTVTOepy5W3LTibvvEAsveb

jK32vwrbkOGpVaa+6V4nGWdzDIbevAKy8ALyCjWSvsJYFU8JTVNdFzDQnK26geE3vzADV+qow

uME2SC2HOgfe/91MP0PX1nL7irCsGiE6FekreVA2WbBfGsXeit4qgKB8kAUW/BdyM6iyUfcXY

Pfck+KQdwY7tGrOAfed9YLEw5NZxLpgxDVoJChtgrn3+5BWCHOZvU2Y4PpZ8eg+HwfpuBCXL5

IGDU/a6GtnrjjVrbHfNh6VuHJ/MYE6JFiHhxZCBOQfURiC9EqtyeGsMhvL2tpmRjENETjYri7

fVIamIb7+zEG4CBrpILcg7wsgTNqOLovndcrZeCNOJhdyahI+UHSumB8hJJJMmQZLHzgX/XQ2

Rdz5VZTgrEuSYLBKpKZgpGrZoPQxu5w0HIn9xY9tQygtJZZzICKFGu/tyAXFTYDwgGzXScbjr

TcucY1JSTh6t76DpDKaE65PkFqZ8cvtJgbb9TFsINsa6KYdpn7J5T76HYpqORSFUFwgqvdpun

gI0dlA59TYddQFYx13qzNNX9pZGaQ/+HegS76MWnNRKM9JVMJhZVlyLm8xOSQAd0zR4KVu8DD

DmBlGFhCpwLlqAxz/I/gdAJd5kPIV68eFS/Yhd4KvuRwYpYo7HZz2ic6fcCp/fTc8bxHpssrl

CDMnnGCrYbsYmTEuPMEoyDDsVuBJE+tApwz5mPuaDOqhhvm/AwYk2xZIOY2O4rb8WzuG5rwzV

2eWKoj7NrnesSpOcHz7XW4VvKK+3sI0rOiyIKT/h20NTK1yaknv51Nzxq2QGRHlLohCeEAjq5

mys1AvfJHsOIKoarev1uiXuaqfJ02JRlrrCM/H24SPSPqSCSPhB7sO4f7BLcxGBhxKKUpiJqs

x9d7Qr/RtlqRhSEBl2EBNVfmAHBQpGazwkcwxg++47k2lcNqhOexUSQ2xewGWYR9W7srM5t6k

p9mm13KIQz5Dh0toLU2ASsryJouJnCbLFE8LuLR9RMfWGjTiMXFIl+8FTTbBuulBE83pCuSgq

CU4b1zjEagNE7svSeCXFG3mZsN17DUucgAoo1MEuQSD5iYzYjCJoARrhcPG+jFbMJ9NBSVDTv

ebVYZQKRYzTcw34LRY3W+sYfMtJpL66BXzgvQ4VPBMkPlKKDvJNHAka3IP7/78Tt2INPq/Ahv

Yf6Q1d+hxM0OjTwLH9dznV113iLEmzHebdWSLjLPII5eMMJC4+O3+vWrerWiLt7PXiy2QFdqi

P4N6dC+NN5ynvE7r1JzQA5j8JFwLRPFoflDHXtgzYucy1DaUaVhW4R1npxkSfUuO1q/uBI9VS

T0/NBAxC59mwnfoQXLn7DweTW+za09XHqqSt8n92my+X2bZTv3yGOswy/DCABWdImXk0zsl+S

u/KJ6V7ikrB6cf2Nt9JFqQRfZbgrSyvFXQLFKSUrEcEELjp4SkKb92D8gPhHGYMhiugfg2i/X

Z/9FBgG48ECJUFWY14F72n4aBhQKT29XR+f/2ZlNKOye1mvrrZGsVf9ff2XUx7zUwd0JJcUn3

ENOMxvvZUI7MzJ62jObm42Gxk9wvVeH5ChPuNQMhrAARj6Txr6n99gflgnAB3616tqL2IPsd3

+BywVs7/1PzPHeiba9yKj0Sp4b/KOHTZXW1Ys8zXJCMpyp7JdL/y174KMaePU6fb9JmGppNTY

H5rqsWZ/pO8etveqtEuY0UY6uBO4Ai+LiXrBkWt2Zfd5/cK67HyefWY3FufzZxICXXlhao6bU

/AXyqMp+h3M1ay/3R2D8po0NU8kb

X-Spam_score: 23.7

X-Spam_score_int: 237

X-Spam_bar: +++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Sécurité et tranquillité d'esprit – grâce à CAA



Content analysis details: (23.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

[82.165.159.131 listed in dnsbl.ahbl.org]

[82.165.159.131 listed in dnsbl.ahbl.org]

[82.165.159.131 listed in dnsbl.ahbl.org]

[78.135.110.148 listed in dnsbl.ahbl.org]

[78.135.110.148 listed in dnsbl.ahbl.org]

[78.135.110.148 listed in dnsbl.ahbl.org]

[78.135.110.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[82.165.159.131 listed in zen.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[78.135.110.148 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[82.165.159.131 listed in sbl-xbl.spamhaus.org]

[78.135.110.148 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[caa.client(at)mail.com]

1.2 MISSING_HEADERS Missing To: header

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

2.9 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} =?UTF-8?Q?Offre_sp=C3=A9ciale_=3A_votre_kit_d=27?=

=?UTF-8?Q?urgence_voiture_vous_attend_!?=









French language CAA phsh

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 17 Nov 2024 22:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tCuGQ-000000008W2-3bC3

for dave@doctor.nl2k.ab.ca;

Sun, 17 Nov 2024 22:25:30 -0700

Resent-From: The Doctor

Resent-Date: Sun, 17 Nov 2024 22:25:30 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ens2.lab.digitaltransformationco.xyz ([78.135.110.148]:53283 helo=progressivelearning.edu)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tCs9T-00000000PVb-1CZt

for doctor@nk.ca;

Sun, 17 Nov 2024 20:10:19 -0700

Authentication-Results: gmx.net; dkim=pass header.i=caa.client@mail.com

Received: from mout-xforward.gmx.com ([82.165.159.131]) by mx-ha.gmx.net

(mxgmx009 [212.227.15.10]) with ESMTPS (Nemesis) id 1MSJVS-1tJVMI1J4i-00L8EB

for ; Mon, 18 Nov 2024 03:31:14 +0100

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mail.com;

s=s1089575; t=1731897073; x=1732501873; i=caa.client@mail.com;

bh=HdroSb5T3h2yx5t6yTSwL5ErnQavz2G1bYfuEOD5t20=;

h=X-UI-Sender-Class:MIME-Version:Message-ID:From:Subject:

Content-Type:Date:cc:content-transfer-encoding:content-type:date:

from:message-id:mime-version:reply-to:subject:to;

b=XSjAXPZTO/GZE0cr12+9+pqMnIJ5Jmx7GN4CIIpFF2lwFOfqK3AneSm01vJX8chT

3usmnhNavs1gWoIOG7k89R53qRkrMHBa7VGICEH2A8ckga/DGvaUkwNJ3IjGFJJuC

RKwZ8Xb0qoWDjPACNmsEGtiMULNOrGFmkPE/1j2hkkDw4Mstj8GU16mkPUj/I+Upe

R7ua5qmCV9mFiYmqklJzH6jkcjoq1txIrGuaOaww5Cndy4euvBm6M1BYkn6V87qJB

0KG3MuyJ9PI1J2B/HnzDCeoqtpuLqMatnR6gBJtGSsKhUwhbe1bTHVwAceudY2pQM

aSFaH4MuoVG/YjwcBA==

X-UI-Sender-Class: f2cb72be-343f-493d-8ec3-b1efb8d6185a

Received: from [] ([]) by web-mail.mail.com

(3c-app-mailcom-lxa05.server.lan [10.76.45.6]) (via HTTP); Mon, 18 Nov 2024

03:31:12 +0100

MIME-Version: 1.0

Message-ID:

From: CAA

Subject: =?UTF-8?Q?Offre_sp=C3=A9ciale_=3A_votre_kit_d=27?=

=?UTF-8?Q?urgence_voiture_vous_attend_!?=

Content-Type: text/html; charset=UTF-8

Date: Mon, 18 Nov 2024 03:31:12 +0100

Importance: normal

Sensitivity: Normal

X-Priority: 3

X-Provags-ID: V03:K1:p54ANrkAHe8NqMvZxaw5uS0BHPja5qV154fyniS/YBhOdVWds2kaGSISe0v28aO0DArpg

jZZBemzVbJ26Eo3hr+daiNcpkDGXK1Avb6aib+T66KUW7F6hnBBsJR+L6DqFCd4pUuEGZUVCSfjB

Y2emExSqtxRmdvoHCCIzLCzBU7A2r75fQgy7yxHM9V0QJVhW7Sie+LX+gSynma34ARgMk5y8kzyC

NOcoS4qN5yHc8p5w4AKu6GmFAT4ePiT96R1n07K/BLmxYos31gqSpDgJvYyKpwkL6RKyznADLTm3

Rw=

X-Spam-Flag: YES

UI-OutboundReport: junk:10;M01:P0:ZACsvEN6UYA=;aEc6BcIHjTaiJUnMJ5jwBrfbveiDZ

Ph+Iv4if48Km/13g9lK3K0XKMSkxx4fn/W1QYoqi3svY03ahKqqETxbGb0ijI2xTsM3vROcyt

VyTd5EJOa1Na9te981AjsNULMLrl7ZS4BKlWf8yn7fzAZly21VJOu41VhAxp1iOdh2H1/a7ZB

6pdGAOIss/IeToZSWyJI/SvXPSUGQJiwJNfmW+DKQCKqHg7r8L+1wO2TWH7YwpfwkP42LxIza

bVuFKYLuywI5uNpRsenJKCx/fo95UFfk8SIzbAPh8ZnpXitCUY3crB4g15i5uOIdT+yFrCnlJ

caJfDL1rqZ4WTWBfWrNbeRZvI8Lcausjby6w4a4Vcih8wVUBCKGpKncRimJDfIhRrUvM6DLBy

fjTEs4ihDyHq9M/xE69OaZVZp/Ecssd6wWJCVpTSzF2ZNFevlj/3pf0pA6+mSPLMbubKo9X21

BPdzuaHh+vlaFTc4e+FpQ+tfHXbFOr3HdiERDNptB9lTwtg2AArLoUNE6zNk7fsj5XutZPQP0

3qAijKVg2RqX3IC94ywIbkwSoRxypHv8/TdAd6MFVB/58e8I/nW4qed02wgAXDTGytN/s5aOc

9oBAhnzOLCVp27Gg4C/cGhteMh1v6iqwYvXNJFnJp2oMgY0Va+nIOeEiM4KSn6MvODTKkscLO

aUXbuL8UXJSBrjyhpi+VIW2mkG1qW5fzGGHjFMPhbeVdBJbNuy1SoyIMfXvz8N+uP1uocUFzc

2awuIfzKvFDl25p16Y9//HYu8oFYi0xFrheW5+C9gEpGDAWSr2Ak=

X-GMX-Antispam: 5 (eXpurgate); Detail=V3;

X-Spam-Flag: YES

UI-InboundReport: junk:10;M01:P0:olJWUaRC7F4=;1Fyiah1qzAYMRqKvJKkpeECCWI0s1R

eiRNCZIm46IFzIwDxqn2Qhb4JVXp9yE6rGZuPghxRcE2sFTYIHZpwW25Fh6RtKodPjad0i+Dw

Euk9Tgvw5pDeSwlOnBmYeYHxdTSCjbjgDhbL/XzeglD+t3lQGHzPr90ORbvrFqFR7yDp9dwNX

yAQNeZGSNsmVy9ofR3Ur3cLWfq86thZtkPxHwqr7/JYsgVXQIZdaahy4MLgqYx2EN0M3W+spU

yJi2X70m1800zUExpAi0JBN/GfFQSFvJIfnWVMderSiOerTuesa7X8oijCzYDlDIQo26itMZJ

VVg+aBWeeogr+VOBifYIxdQ/W83khWDCYwLUINPyWna/1Rg2/+4w/Pqmxwzwq3GAXQ+DDHFJS

eTZC4IqPqv1qopnsV5OLZ1LzwX/fEeRLOPkxILfqSVeLyUe3rNPGvnvILKHGaBWRQUig9yGgt

L1py/BAFi46sslxwCWh2oF/lXIhUlslrZe0nyc8GZ18855aZIyFeh2GYvk8XDkZGxUPfHB4d6

cZCgmDGPf2kyDOMPe8qg+v4OWoVLgq629dxDFBOb5Ac8+g37oyqH7egLCn6AiJS2/tu+1CSg4

oYzH9EPGM0iJHdFvZ4ydPuwtw/u+/FSAMJ2ho8QUacDlG9F+Etx6wTXB3GKfYFsInIvCmNlpF

b8QgSuZKBf2zgyqN6vjN7THcrmzwPRIeePaMF9lp5aRdMd+8SLfwCuSDWKGuk/GBmYNXU/FI6

moP4SwJKVPjqRVCzY8bPE7IZJcPzysw4Zfkes6m8ZQd6ugGpN5CP8SMm8kJG38aEnwi5K5KIw

KQBHklN5YG1sfzq0PvXQPdnEhcwMYr0gM7pvdE53gfT3JjtQMI71SQIEClcWa1lrDigfoz/0N

lponD/1HIpn7C0xduJFVGgzY7F503r2iAaXSR3xbE5noxxbsIlP2NAtXaPx4ys5yDB0KUx/KQ

vI6rPSp7csKEbEYB/B4l6gS3fGrOwkzSmKTm740cCKanKPc4MtyOLbyUGpJaDH0PL2Mz3qnkA

a+BNP5xCA7FzvSgiImUPAJ2J/E3pHR9fhmwXSEPjYSq4hhkJdHTPw9ZmS09qvCfFvbBCfDoZX

ahGsfxNCZc6z5Cw/TU44vixDWMy8Efzl4FaV7HK6LO40F/Wd2wdiMeROuMvjWYJRDHVxUcaRF

Jo3XctfTOVGOGdf7JMfRborEUmZVKs35cCMeUfnpsosRF7ovIuW0DM9nzpfDVRE67oY/hnTZB

0gDTXs15r+NG97xw1/SvAqlZakdekgikus/mR3qIJ8me7XOGx3DzN4p4uVVFSA4ghEiDrknoJ

N0C17dvh2tBfPckM96oOoJrSrfxUtfzMFwwaEUamCAvgp+YJA+rJoe8BvC0XBfF7QH06M2oT6

Gz1yq8D22qNzCbwHvhZrUm5NwooPjBGPwSQ3pKcheZ7yGuSafBDYU2lErq+q09fCk/RO7SH/z

iDey6NhKRLLD/iz1npFI3HN/LsYRjO0tjSqfZb3J/bIr3MdOxkA4c/Ksl2VYw5V01d4IdSvZp

h9uLHFh+JHb7NuY7wiIrs4YtO5NNmj0OWjJJtlcXJ+XSo1ZK2325pn93HoOoLn2X4EtLubTgb

zldhinmcDppWbCB0mh6CFBTHlzXN2prW09gy2gTYwsfCPC0TtB+3MftWfPzrDCgr3lfLEY3wy

omSHM5rfvagNvfHIB+CnkY/zZRyHkVXiEMlIr/ZaPJFlKGpcPQ1j/jxYcCXQALQ1Oe35gh6wM

ierVwhmoGqjhgyC6Cu4nzbM2EHTzpZIh8NkCeGjYbCPlfFAXRcztUy7Zo669ABdBwgVtPKWtN

9BweMWxXvF4n1RhUqQ1gx7isLlj9KRjcs/HwPywJ00kqwRWfgk/uiD6vubgA3HK57y3DRoq3j

mVW4+bB/UgU5Ov/VXO/lEEfWcQNcou9IRGr/f1PNqk5nJjvonc2fhGzIKsFXsdZ2zO2kjOhZF

MgxN31O7+1rVl62WybPPqe8N3nHwk3oYCh1Wqhz/lLrqhVheW5bqdF97llNOu1OCyX/zXyo3b

ZR71kO1dXq2ixxjD1ZGH9gZOOzj060WFJCt9AzdF19afjToqdNMFgw6aem7BQjktcByjkxJik

sHEdPUpE4LyeCGXaz/JdAcWPkj6dWZ1B1+hU8HFIxRbiUUYjk5pC+lpHD0yoFooIn7o8vvX2c

6nZmMHxxygUrPEV0EU8ZMw3jUJt3xwwxwvMkizNdXhCB1CG2cGC5zNe407yRM+wuYrNmX8yI3

PtOJkVPbfm29nLuzJwlWCzGx+vQwEq4/7IfPvXFWnIHLA0soF/qV1mNWTQxdFiPJKDKuqztTm

p+a71w7z6+75Sflzl6H62q+DrglKL/2aJ0G+1FieRmkq3wmOsw+th1gqfxwC9ClxK9aWLE1DW

QoCaRSn0nfGZ2QayQ5wPOSnYNmlqDr9xa91pu+bqKNIO5j6p7B38P+HccrMfxceuw7vADQ1UN

MHxxvb/JeGsWJTka0YtDf52fu8eBFMlGkF5Jx3eVzgVy6XC6SGMs8fVHchTzSR4gVRX8jatSS

Kq9ETUrylcgHllbuSyu/L6oST6TeaapvhfD/g1zDvUCYg7URMyFx5N9m/s+2W1+5AHp8OoK17

d8TWZl2CySU1Usg1ohXQ59We+TGGMzvD4P9AbHOSpwunG5fu1Bq3ZOTgMPgRe/pAk3RlXOTsu

eJEAptkkNafxi0kQx7Wqqs5IVoAVC9n2nO7TYthNrXHhlauYiqQaw0p0LKEj9eXsGGGUNy8kb

MMzZ/lUurEArycQ0t5RwAaIakid6oedTd71uTq2Wob0sFW7Q+MzwojFsF6MFy5iYmmd9I54Bq

o2Dc2Y0GJDJobe0wBfd5T/bWa7T1EkYr98wpeQS6UVzIoWEgBZ5PB9/wwsPfq78VdOujB/SES

SDPBZ1qdM2g90vtmKnXQEKG4Y0DQPbAiCDsjs9TkP4RVo2QaL3+kbZnsb+NHcZG6RXmG3HOyZ

wSshWk63X84cQuj7lC+pLuvyEB98v/i4RkMQMjqfmR7CECIuz9acDPvAJn6xGD1hX2ER+ni6P

3OLQUIgIaOwYMKUMR/u4bu8Wt40Vz5NyH0965SAOH/NS8QtNXGE6Nzf8ROv0NRRPoaDqAawK/

hKNXg7C+u77xm4S1+GEgwmbUPRCPZP+dwF8E7b5/vn7MwRnlTlEjIq12ZmB5Q1MjonF4UR7Rw

QuHQNhAgReSbJpMcWGIKRN9w9gx9yBGyElbtY1B3OLe1najNAKIqSbi+FeRUcUOd9dxcU5ALl

Y+sVB1fKoSsavJNgf4A8WWDtHq3MQBZ5ktnd1AVVDfePl1IbgHUWa0/X4FZvSCOrJozfIn8Lz

09sPoyATl30xFJ2VmSVF2SWMHZo8P2SXIP+GizR6U67t/EQDmnLlpa83KSRsHEZ9xQ6wK/CFp

oLi610nUMphN66ivNBL//6Lrzr9MEEMsw3vykaDzEZ3U7ISn+HeoNE84eNVThT5pbNjx31N6n

9SeDesdtCmiiFnB2dySdlEX4IcZL7ZdcKkbaSHoPfwR2vzEb2vISQQPQ31NunwfcGX7MzWy5i

DrIg2uV8IoicJcVUwGGbRilRLX4f+caFzGaKYiEuA4FV1NhJTJteNp2Ag8AHA6AQQSSYxNyYi

rT/7sB7NaqZUnSoCg2+fl8xnXs4FOqFmeJ0rAj7NEEyGyhlSCgx9zm64xkRxek0TLOL76xUbQ

hc4sqrASGsQ0AQA53ccMuGvh223xBkyBf8dcWm2FyW/MBt32uqQzwQBfszmTtChAiB0UD6eDh

RR5wNdMjUpN76uFqPahUxRMwRYItx1eMAnVUTdhnyFxNm/Qz3nX2TL6gb1XDMc6clCZzi69ow

MbGTbEzxUIBdO0oQE3++JymJZT3YGezOSDwXEO9MtPPOoE0MiW9ixx2GAVWw/w4+SaGiNnKOO

Aq0rH3Lu2O6SWrBQLthRtdHFc77eGIadXMa83xqhvSffuN7URrlrFQllZtn8kR1GtpcAFqmSJ

FiZV6oXQ81r7UG6gfqwsCOqSbMgVJyILDGQwtBBhf/aULA5GiKKXMdmWIePr7NMo4DGqLqbZC

DL69ooSYGaeyADTlribI1Js6wv0a2BHTR4JC2TRR9W04m/3hu63Wr667Y7Sf7MC1WeELXsCSe

CqIA4CZmVtLwkcgoUcYsct1J+bTY5v0GMMPSjW7iE9jRUK1l/VSJWyBhjhshKWFMtKzSrdq7Q

Zyi/oCXXtAKOV0ezyp46yzZHpUbuTE4a7+YZd9W8CcoIrWsEsBVudd4o5x8KcNm04AGk7y8h+

o4SiaRUgwcBp1azdlVJBuCmqiHsGNFZoQiXf9yDqFQI8/joYSJ6hc2OjotEfmhCx38pDBZ3dy

sy4AxIZ515L4Qr+Aw6Wm1EsGSwKOawS/i6lzP4lDRRjDXfA2R7RWISfRXB0GZBUTO8QoyOUrd

Po2M4Q3bFmj+j7TTcJZsQL/ZMzjRIVstcqziD0wifbBEPvWM5KwTVTOepy5W3LTibvvEAsveb

jK32vwrbkOGpVaa+6V4nGWdzDIbevAKy8ALyCjWSvsJYFU8JTVNdFzDQnK26geE3vzADV+qow

uME2SC2HOgfe/91MP0PX1nL7irCsGiE6FekreVA2WbBfGsXeit4qgKB8kAUW/BdyM6iyUfcXY

Pfck+KQdwY7tGrOAfed9YLEw5NZxLpgxDVoJChtgrn3+5BWCHOZvU2Y4PpZ8eg+HwfpuBCXL5

IGDU/a6GtnrjjVrbHfNh6VuHJ/MYE6JFiHhxZCBOQfURiC9EqtyeGsMhvL2tpmRjENETjYri7

fVIamIb7+zEG4CBrpILcg7wsgTNqOLovndcrZeCNOJhdyahI+UHSumB8hJJJMmQZLHzgX/XQ2

Rdz5VZTgrEuSYLBKpKZgpGrZoPQxu5w0HIn9xY9tQygtJZZzICKFGu/tyAXFTYDwgGzXScbjr

TcucY1JSTh6t76DpDKaE65PkFqZ8cvtJgbb9TFsINsa6KYdpn7J5T76HYpqORSFUFwgqvdpun

gI0dlA59TYddQFYx13qzNNX9pZGaQ/+HegS76MWnNRKM9JVMJhZVlyLm8xOSQAd0zR4KVu8DD

DmBlGFhCpwLlqAxz/I/gdAJd5kPIV68eFS/Yhd4KvuRwYpYo7HZz2ic6fcCp/fTc8bxHpssrl

CDMnnGCrYbsYmTEuPMEoyDDsVuBJE+tApwz5mPuaDOqhhvm/AwYk2xZIOY2O4rb8WzuG5rwzV

2eWKoj7NrnesSpOcHz7XW4VvKK+3sI0rOiyIKT/h20NTK1yaknv51Nzxq2QGRHlLohCeEAjq5

mys1AvfJHsOIKoarev1uiXuaqfJ02JRlrrCM/H24SPSPqSCSPhB7sO4f7BLcxGBhxKKUpiJqs

x9d7Qr/RtlqRhSEBl2EBNVfmAHBQpGazwkcwxg++47k2lcNqhOexUSQ2xewGWYR9W7srM5t6k

p9mm13KIQz5Dh0toLU2ASsryJouJnCbLFE8LuLR9RMfWGjTiMXFIl+8FTTbBuulBE83pCuSgq

CU4b1zjEagNE7svSeCXFG3mZsN17DUucgAoo1MEuQSD5iYzYjCJoARrhcPG+jFbMJ9NBSVDTv

ebVYZQKRYzTcw34LRY3W+sYfMtJpL66BXzgvQ4VPBMkPlKKDvJNHAka3IP7/78Tt2INPq/Ahv

Yf6Q1d+hxM0OjTwLH9dznV113iLEmzHebdWSLjLPII5eMMJC4+O3+vWrerWiLt7PXiy2QFdqi

P4N6dC+NN5ynvE7r1JzQA5j8JFwLRPFoflDHXtgzYucy1DaUaVhW4R1npxkSfUuO1q/uBI9VS

T0/NBAxC59mwnfoQXLn7DweTW+za09XHqqSt8n92my+X2bZTv3yGOswy/DCABWdImXk0zsl+S

u/KJ6V7ikrB6cf2Nt9JFqQRfZbgrSyvFXQLFKSUrEcEELjp4SkKb92D8gPhHGYMhiugfg2i/X

Z/9FBgG48ECJUFWY14F72n4aBhQKT29XR+f/2ZlNKOye1mvrrZGsVf9ff2XUx7zUwd0JJcUn3

ENOMxvvZUI7MzJ62jObm42Gxk9wvVeH5ChPuNQMhrAARj6Txr6n99gflgnAB3616tqL2IPsd3

+BywVs7/1PzPHeiba9yKj0Sp4b/KOHTZXW1Ys8zXJCMpyp7JdL/y174KMaePU6fb9JmGppNTY

H5rqsWZ/pO8etveqtEuY0UY6uBO4Ai+LiXrBkWt2Zfd5/cK67HyefWY3FufzZxICXXlhao6bU

/AXyqMp+h3M1ay/3R2D8po0NU8kb

X-Spam_score: 23.7

X-Spam_score_int: 237

X-Spam_bar: +++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Sécurité et tranquillité d'esprit – grâce à CAA



Content analysis details: (23.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

[82.165.159.131 listed in dnsbl.ahbl.org]

[82.165.159.131 listed in dnsbl.ahbl.org]

[82.165.159.131 listed in dnsbl.ahbl.org]

[78.135.110.148 listed in dnsbl.ahbl.org]

[78.135.110.148 listed in dnsbl.ahbl.org]

[78.135.110.148 listed in dnsbl.ahbl.org]

[78.135.110.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[82.165.159.131 listed in dnsbl.ahbl.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[82.165.159.131 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[82.165.159.131 listed in sbl-xbl.spamhaus.org]

[78.135.110.148 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[82.165.159.131 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

[78.135.110.148 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[78.135.110.148 listed in zen.spamhaus.org]

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[caa.client(at)mail.com]

1.2 MISSING_HEADERS Missing To: header

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

2.9 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image

0.0 T_REMOTE_IMAGE Message contains an external image

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} =?UTF-8?Q?Offre_sp=C3=A9ciale_=3A_votre_kit_d=27?=

=?UTF-8?Q?urgence_voiture_vous_attend_!?=