Web / SEO / App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 09:18:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHQA0-00000000KWh-3NDW

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 09:17:32 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 09:17:32 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-mw2nam12olkn2095.outbound.protection.outlook.com ([40.92.23.95]:64174 helo=NAM12-MW2-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHPkG-000000009iF-0baf

for sales@nk.ca;

Sat, 30 Nov 2024 08:51:00 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=br6EaUGh0sg0CAkHVuURo8CBgSzjZFPtUV+DcXCqLTciyv3gKiX8aNAU3aiDDLm3VaTYBk2fgm8JJhFuDUELh7V7s/odm5XjxckbPA5BXyNalIEBJafZ8UnoziOxw/JizcRKMolmXg/5ZhzDTw5SxrY419MXKBlopI411L5asYGUw/0O7eML+uroFw66qHMAnz7dlygbzaexifXWEyfLqwtYDVLmcGUJ7LBZ9llEg6g7DVQ0Go7TW1+ON8fePUMw4cWa+0FcECWArNKwb5+a0e0PVEMAnOg9ictqocsN1sMNr9D7c9glo6xv+WXeWz81VDYF4yHuhcqIZBBofuAH5Q==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=NNjyhMWGbwInuuTNqECOUT3++zbAx2CDEtxFNXQIQ2g=;

b=JhCiiwYBX0XKT6zFdyLko8vuhmTWxmae31zCrXRlmT+RXqIdQ6IszteM7QIGKt3qZ1w/xstwsTrpmq8WyGkbC7rACFlVtL+aw3LjYhwKdEI+q149dLqwxNECivZ68HkvDFGIldL27omU4EQDtcT2d5OMfeE5Lrd0iHNI3FIp2ZnBuvABDczLABcXpo7KMrjoZ7MUdseY8hicTVdOK+ggsW+bCR4f0QPx8rtV3r62jc1al2izbW7JQzWIFhORgFlewVAK7c+e6lt7k/RotvG1A2zjjpMIX1Nq94qVr9vTXLaDunWQqsab6OMeD8FTjKdiYCQlP5aoNChkX51QNSy9Bw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=NNjyhMWGbwInuuTNqECOUT3++zbAx2CDEtxFNXQIQ2g=;

b=mfCvxfo3LDR/cj3v7uPzj9e5Yq8ij4nRGNzek+V+9A8DjO25JYDOEpx5/zRK7WNZHRugmq+feA/n1nRvnKXdA2OQMPXNtChBsTPRVsuvJeYVxlY0nAZzrjIq4pzQ7u/3iZx7x0CaQ0uT0pLXHYUopu+a7vBHFQpakERRXHiIe1YlD++lCCDepUfl3FUiTDGa1IKLpEmSgvMxvYkVAnFszYtwoRk+gli/9Y+FJ6flA12t4QzBVLt1Dg5r45uw6Fq+O5gJKKrrvI90vhIByyssdkc5/GgPFFBD072WBXmVpAHsd5g+6ujNXHnSbQA5wJQjpm1wIB4XzRvw6jrPg8wjMQ==

Received: from SJ0PR84MB1797.NAMPRD84.PROD.OUTLOOK.COM (2603:10b6:a03:433::8)

by LV3PR84MB3377.NAMPRD84.PROD.OUTLOOK.COM (2603:10b6:408:1d1::14) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8207.16; Sat, 30 Nov

2024 15:48:50 +0000

Received: from SJ0PR84MB1797.NAMPRD84.PROD.OUTLOOK.COM

([fe80::bbe5:ae78:f55b:c67b]) by SJ0PR84MB1797.NAMPRD84.PROD.OUTLOOK.COM

([fe80::bbe5:ae78:f55b:c67b%3]) with mapi id 15.20.8207.014; Sat, 30 Nov 2024

15:48:50 +0000

From: Pooja Sharma

Subject: //// those errors? ////

Thread-Topic: //// those errors? ////

Thread-Index: AQHbQz9EvBrf4w9FQEqs8eshHEaJPA==

Date: Sat, 30 Nov 2024 15:48:49 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SJ0PR84MB1797:EE_|LV3PR84MB3377:EE_

x-ms-office365-filtering-correlation-id: 09b8d412-c62f-44f2-8f81-08dd11567bc9

x-microsoft-antispam:

BCL:0;ARA:14566002|461199028|8060799006|15080799006|19110799003|15030799003|8062599003|3412199025|440099028|102099032;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?VfGgvaePs9MLAKIBbi2nk3XF0HcYumy60zQuWB5qQoBcgwKAXtc+GiHT?=

=?Windows-1252?Q?xd+FdyJrpJm9Nj7u5nA/0xchS50PC4C5iKeYzSdY/cWDrBMNZtOj4p8g?=

=?Windows-1252?Q?Lc8U21+9LbNNwLV1ljTEoIeMNZH82LrdcnRPujIM93I5K1Hdz/KfY7Fc?=

=?Windows-1252?Q?hDdwR8lWUjmei2PbofEY4p0y7NbsDoGFqSNvN9o446kCJrZKN9urjdY/?=

=?Windows-1252?Q?RXujca5Gh2KXMhxi6uwpZTszxNn13VYnlnDtnccALTbWbTq8f7tSFwq9?=

=?Windows-1252?Q?DMyxUwgFH5WUtJcDqSHeGdxnnRnJ+P9R8IXWvgMmFpnPy/2euRSHOxa3?=

=?Windows-1252?Q?vd7TPyk7jYOG2DqMETPPMdBZIzSGinu2U9at+i2H1paua2QUfmoKPeU3?=

=?Windows-1252?Q?gXDV2UjpBjKEicCPYu2CKHFaHHi3VPUilO4unPbS2zvB6z65LiIuDSm2?=

=?Windows-1252?Q?kBcb+NcikMY0w4QjsJQNphADdpBLLPWEkWUr48arAy3rbGvungwqT28y?=

=?Windows-1252?Q?I/rlXk5pSk0PomzzaC3cF95Vx4FY3C41w1xk7dT6wJzn9DhP/8iuV5oR?=

=?Windows-1252?Q?VZd1Uy4shbAhUge0x+HzIGWuGvwlkT4IOD0gHrO/DeKXK4GyQnIQr2n8?=

=?Windows-1252?Q?Foe8Q5bq9JSEaHy1lq2/LSFxDA6PC9UcF147aOg4lIfIpVVTu5L3kp8B?=

=?Windows-1252?Q?BkUloPYXMzrSLTaAPNiDz+mEa8802MYdYCnoL+WS0kFjklPjSQ/NSdGK?=

=?Windows-1252?Q?ZeawoI7NPKzGQR4NhIPwN+sR8ANhEAVEweLApph7dK+nuDfUforC5Q1U?=

=?Windows-1252?Q?K+KnvRx8MbSvWxCfsERcZzFn7TSzxBYMwLRYO9b/uHZ5y7WKkfoWDtjv?=

=?Windows-1252?Q?fTIyB/Jp+TVPoyqXRcwS2l7P53cBH3lwSzx5QHAbY8rp6fsaIzaRfmlK?=

=?Windows-1252?Q?jNcXZ9tZ6Ud1XFKS0vYFTM0jEL37Z50CfKkhPR3rjUhzkha9LpundXmg?=

=?Windows-1252?Q?1f6zC4reR02x0wXHAvT8tJ1btJU/9Qo2hzr8eDh+zMQ3KhADlH8px0he?=

=?Windows-1252?Q?gnuZyF5hchNKv8VNC7DjeddRYXE8+KTyiuy71L++cs+DTZj4WVJ9z8bE?=

=?Windows-1252?Q?tl4=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?wSkIp0fAC21lRl9YodSTNY6kDXMRPQV77a3DWxVqkOoxOyIrJXO6A8SM?=

=?Windows-1252?Q?XbhQ72r6tIwGGTH6SHCBYB+CJRWxRHSh82uKV7ciGAKYmnAvdYNcmBy1?=

=?Windows-1252?Q?V5fwgh8ltiy4T1nt49jAQaAxhS3MKsrSB7o1K5tGTgjRbV/2TvaKMYF4?=

=?Windows-1252?Q?VrD2qfjQZW8kjHanfLprWyrlY1eSteFtCCUvAG1d6og8NHP1j3BXLbQg?=

=?Windows-1252?Q?1uFfIHXD9K1DlZpQl9gJj6mvXxEjsKl41zphOdmTT2hKmhl7mkbjnrje?=

=?Windows-1252?Q?vpgssYeXYYycyeSBpKknpoVtUOH82rx6lH+ItqhzH8z8i9wOni7XYjon?=

=?Windows-1252?Q?Ex1wWXYEUSitk7d3G4igPu6gGFmjWzzFT8SOvirvBcqpR6DFn8sWnytF?=

=?Windows-1252?Q?fLWspsEtBbBiepDH4KTrd2Os4F0xH1VqGNKr3/QK2jCBgl4gFProotyQ?=

=?Windows-1252?Q?jDnp5wZzWyfK5WdI34zWthd5FSJuR8ONmvcSUipd1m9kkrKmIM80Fzyk?=

=?Windows-1252?Q?vcuEfvGcj3756jjY/YCH2cwvk+GQq2/RIrKbVY6UJ/8ZsLPFTErs8Rhb?=

=?Windows-1252?Q?0zw34sBA+M2gtjwkbYwfQg09br0peMrvJ2TXJrZArC+6ygB0KhA4sm8w?=

=?Windows-1252?Q?ISxmsewwqHgq8emP1V84j07OZ4Fj73UAvun/QTbFtJSpZGGsc9Zbmukm?=

=?Windows-1252?Q?g59XhP0j0zZezkTemn9EBP9qu6Sq8icubseAFjRHoyg77I+4t1pqOXKM?=

=?Windows-1252?Q?Svu4A7SKIfsINgpR9eTMGSh0n1UoDFPOeAJZqu0ZYhV/Tr7HSixXKKo/?=

=?Windows-1252?Q?u9LAIfkh28OLeRN58xpMC98R7FDyEcPr76vS4zFGLkno48JiJEE3Avpm?=

=?Windows-1252?Q?x5pgN6O1BVJs+U+bEr/Lbgyy5ffHemETl9ZNISZFhU8IARif3bysUEzv?=

=?Windows-1252?Q?1p9EqEUJceHFIBi+MRzD89Q09RMTjYpQcrPJsTj1cU4wmlmrnGYbnKbf?=

=?Windows-1252?Q?W0Xg4jCBQgvhQ1OMDVItchZV1pZYdFW742+Bv5bTkVrvoRmDQaNaSztE?=

=?Windows-1252?Q?Zn3UiDL5OMdfr0UK2R7IVDWlw2IBdcxjS6JMfpT2t5S9FQkDT+uC2ag7?=

=?Windows-1252?Q?Eqmh1ZncMYwvNLZgfJ4+e9vha64zK55JtNOB3KiGPxRFRQReHodJIkqf?=

=?Windows-1252?Q?PHUyI5SymNJQwmi1H+/BxZ13q17ttW0LqQ11cLWAW1KJg/IHzrbPZ4Ur?=

=?Windows-1252?Q?yVsmoUrtDlWbErZRWZ+0jxXW0i/8s/zWgGnhpLVLaT854EBQ93WWMTQF?=

=?Windows-1252?Q?E+n8NMDZd7hMsuBbHsOc5iKoSGCWz/8AmlOrHTohzNsnQUd9NBrOoNxy?=

=?Windows-1252?Q?uC5yUYMDyTgRXIMC9qeI3lqee2UdjABeADk=3D?=

Content-Type: multipart/alternative;

boundary="_000_SJ0PR84MB179791A6C84A18B1D2A69E29952B2SJ0PR84MB1797NAMP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SJ0PR84MB1797.NAMPRD84.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 09b8d412-c62f-44f2-8f81-08dd11567bc9

X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Nov 2024 15:48:49.7681

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV3PR84MB3377

X-Spam_score: 7.5

X-Spam_score_int: 75

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Sir/ Ma'am I found problem on your website that are affecting

your online presence and Google ranking. I’d like to send a no-obligation

report outlining these problems?



Content analysis details: (7.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

[40.92.23.95 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.92.23.95 listed in dnsbl.ahbl.org]

[40.92.23.95 listed in dnsbl.ahbl.org]

[40.92.23.95 listed in dnsbl.ahbl.org]

[40.92.23.95 listed in dnsbl.ahbl.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:433:0:0:0:8 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.92.23.95 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.92.23.95 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.92.23.95 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.92.23.95 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.92.23.95 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.23.95 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_SIGNED Message has a ARC signature

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[poojasharma006(at)outlook.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[poojasharma006(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

Subject: {SPAM?} //// those errors? ////



--_000_SJ0PR84MB179791A6C84A18B1D2A69E29952B2SJ0PR84MB1797NAMP_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi, Sir/ Ma'am



I found problem on your website that are affecting your online

presence and Google ranking.



I=92d like to send a no-obligation report outlining these problems?



Would you like me to send over of those errors?



Regards ahead of time.



Best Regards



Deepak Dhawan



Note: May I send you a quote/ Package/ Proposal?





--_000_SJ0PR84MB179791A6C84A18B1D2A69E29952B2SJ0PR84MB1797NAMP_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=

alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hi, Sir/ Ma'am



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

I found problem on your website that are affecting your online



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

presence and Google ranking.



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

I=92d like to send a no-obligation report outlining these problems?



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=

alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Would you like me to se=

nd over of those errors?



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Regards ahead of time.



margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=

alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Best Regards



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Deepak Dhawan



Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">







Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=

erif; font-size: 12pt; color: rgb(0, 0, 0);">

Note: May I send you =

a quote/ Package/ Proposal?



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">












--_000_SJ0PR84MB179791A6C84A18B1D2A69E29952B2SJ0PR84MB1797NAMP_--

Intelcom phish from hostafrica.com

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 09:18:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHQ9a-00000000KVi-1cth

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 09:17:06 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 09:17:06 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [102.218.215.216] (port=55860 helo=positiveesolutions.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHPVV-000000009Ag-2iVt

for games@nl2k.ab.ca;

Sat, 30 Nov 2024 08:35:46 -0700

Received: by positiveesolutions.com (Postfix, from userid 33)

id BD3B2FDE53; Sat, 30 Nov 2024 17:14:38 +0200 (SAST)

To: games@nl2k.ab.ca

Subject: DragonFly - Please review your missed shipment!

Date: Sat, 30 Nov 2024 17:10:01 +0200

From: Intelcom Express

Reply-To: noreply@dragonflyshipping.ca

Message-ID: <742345008dfe2f378d27ef02db8ede9c@dragonflyshipping.ca>

List-Unsubscribe: mailto:bounce930-D52MRtsutv0iIVW@dragonflyshipping.ca?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1dab32d60da24c6a0c0c9c8682fcadcb0"

Content-Transfer-Encoding: 8bit

X-Spam_score: 18.9

X-Spam_score_int: 189

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Apologies, but we need to inform you that our delivery attempts

was unsuccessful as we couldn't reach you. Your package is awaiting delivery,

and for a nominal fee of CAD 2.11, you can reschedule it t [...]



Content analysis details: (18.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

[102.218.215.216 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

[102.218.215.216 listed in dnsbl.ahbl.org]

[102.218.215.216 listed in dnsbl.ahbl.org]

[102.218.215.216 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[102.218.215.216 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[102.218.215.216 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[102.218.215.216 listed in zen.spamhaus.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ltc8h.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[102.218.215.216 listed in wl.mailspike.net]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

Subject: {SPAM?} DragonFly - Please review your missed shipment!



This is a multi-part message in MIME format.



--1dab32d60da24c6a0c0c9c8682fcadcb0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



















Â



Apologies, but we need to inform you that our delivery attempts was unsuccessful as we couldn't reach you. Your package is awaiting delivery, and for a nominal fee of CAD 2.11, you can reschedule it to a time that suits you best.



To proceed with rescheduling your delivery, kindly click on the button provided below:



Reschedule Delivery



Thank you for choosing Intelcom.



Â









This email was sent from an automated system. Please do not reply.



© 2024 Intelcom. All rights reserved.









--1dab32d60da24c6a0c0c9c8682fcadcb0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit



















Â





Apologies, but we need to inform you that our delivery attempts was unsuccessful as we couldn't reach you. Your package is awaiting delivery, and for a nominal fee of CAD 2.11, you can reschedule it to a time that suits you best.





To proceed with rescheduling your delivery, kindly click on the button provided below:





Reschedule Delivery





Thank you for choosing Intelcom.





Â











This email was sent from an automated system. Please do not reply.





© 2024 Intelcom. All rights reserved.















--1dab32d60da24c6a0c0c9c8682fcadcb0--



nk.ca credential phishing from google.com

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 07:45:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHOhd-0000000078F-3aDb

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 07:44:09 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 07:44:09 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 219.177.199.35.bc.googleusercontent.com ([35.199.177.219]:33344 helo=[10.88.0.5])

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tHKTG-00000000Mdt-46ON

for root@nk.ca;

Sat, 30 Nov 2024 03:13:10 -0700

Content-Type: multipart/related; boundary="===============9147796936855588233=="

MIME-Version: 1.0

From: "Nagindas Khandwala College ."

To: root@nk.ca

Subject: =?utf-8?q?MailBox_Requesting_Authentication!_For_root=40nk=2Eca_=3A?=

X-Priority: 2

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Root , You have an important mailbox update, please

click below to mailbox update complete. Update Mailbox You have 24 hours to

complete the update to avoid being logged out of your mailbox. Dis [...]



Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.199.177.219 listed in sbl-xbl.spamhaus.org]

[35.199.177.219 listed in sbl-xbl.spamhaus.org]

0.7 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL

[35.199.177.219 listed in zen.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.199.177.219 listed in zen.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

[35.199.177.219 listed in dnsbl.ahbl.org]

[35.199.177.219 listed in dnsbl.ahbl.org]

[35.199.177.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: ipfs.io/209.94.90.1]

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

3.2 URI_IPFSIO References Interplanetary File System PtP content via

ipfs.io, likely phishing

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.1 TO_IN_SUBJ To address is in Subject

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.2 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

1.0 XPRIO Has X-Priority header

0.0 URI_IPFS References Interplanetary File System PtP content, probable

phishing

Subject: {SPAM?} =?utf-8?q?MailBox_Requesting_Authentication!_For_root=40nk=2Eca_=3A?=



--===============9147796936855588233==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PEhUTUw+PEhFQUQ+DQo8TUVUQSBuYW1lPUdFTkVSQVRPUiBjb250ZW50PSJNU0hUTUwgMTEuMDAu

OTYwMC4xOTU5NyI+PC9IRUFEPg0KPEJPRFk+DQo8VEFCTEUgc3R5bGU9IkZPTlQtU0laRTogMTRw

eDsgRk9OVC1GQU1JTFk6IGFyaWFsOyBCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlOyBDT0xPUjog

cmdiKDQ0LDU0LDU4KSIgY2VsbFNwYWNpbmc9MCBjZWxsUGFkZGluZz0wIHdpZHRoPSIxMDAlIiBh

bGlnbj1jZW50ZXIgYmdDb2xvcj0jZjVmN2Y4IGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gt

U0laSU5HOiBib3JkZXItYm94Ij4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+

DQo8VEQgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giIGhlaWdodD0zMCB2QWxpZ249dG9w

IGFsaWduPWNlbnRlcj4mbmJzcDs8L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJv

cmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiB2QWxpZ249dG9w

IHdpZHRoPTYwMCBhbGlnbj1jZW50ZXI+DQo8VEFCTEUgc3R5bGU9Ik1BWC1XSURUSDogNjAwcHg7

IEJPUkRFUi1UT1A6IHJnYigyNDAsMjQxLDI0NikgMXB4IHNvbGlkOyBCT1JERVItUklHSFQ6IHJn

YigyNDAsMjQxLDI0NikgMXB4IHNvbGlkOyBCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlOyBCT1JE

RVItQk9UVE9NOiByZ2IoMjQwLDI0MSwyNDYpIDFweCBzb2xpZDsgQk9SREVSLUxFRlQ6IHJnYigy

NDAsMjQxLDI0NikgMXB4IHNvbGlkIiBjZWxsU3BhY2luZz0wIGNlbGxQYWRkaW5nPTAgYWxpZ249

Y2VudGVyIGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4N

CjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJPWC1TSVpJ

Tkc6IGJvcmRlci1ib3g7IE1BWC1XSURUSDogNjAwcHgiIGJnQ29sb3I9I2ZmZmZmZiB2QWxpZ249

dG9wIHdpZHRoPTYwMCBhbGlnbj1jZW50ZXI+DQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xMQVBT

RTogY29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCB3aWR0aD0iMTAwJSIgYWxp

Z249Y2VudGVyIGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94

Ij4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJPWC1T

SVpJTkc6IGJvcmRlci1ib3giIHZBbGlnbj10b3AgYWxpZ249Y2VudGVyPg0KPFRBQkxFIHN0eWxl

PSJCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlIiBjZWxsU3BhY2luZz0wIGNlbGxQYWRkaW5nPTAg

d2lkdGg9IjkyJSIgYWxpZ249Y2VudGVyIGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gtU0la

SU5HOiBib3JkZXItYm94Ij4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8

VEQgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giIHZBbGlnbj10b3AgYWxpZ249Y2VudGVy

Pg0KPFRBQkxFIHN0eWxlPSJCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlIiBjZWxsU3BhY2luZz0w

IGNlbGxQYWRkaW5nPTAgd2lkdGg9IjEwMCUiIGFsaWduPWNlbnRlcj4NCjxUQk9EWSBzdHlsZT0i

Qk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1i

b3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWlnaHQ9MzA+Jm5ic3A7

PC9URD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHls

ZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCIgaGVpZ2h0PTMyPiZuYnNwOzwvVEQ+PC9UUj4NCjxU

UiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJPWC1TSVpJTkc6

IGJvcmRlci1ib3giIHZBbGlnbj10b3A+DQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xMQVBTRTog

Y29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCB3aWR0aD0iOTAlIj4NCjxUQk9E

WSBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6

IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94OyBGT05ULVNJ

WkU6IDEycHg7IEZPTlQtRkFNSUxZOiBSb2JvdG8sIEFyaWFsOyBDT0xPUjogcmdiKDUxLDUxLDUx

KTsgTElORS1IRUlHSFQ6IDE4cHgiIHZBbGlnbj10b3A+PFNQQU4gc3R5bGU9IkJPWC1TSVpJTkc6

IGJvcmRlci1ib3g7IEZPTlQtV0VJR0hUOiBib2xkZXIiPkRlYXIgUm9vdCAsPC9TUEFOPjwvVEQ+

PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9URD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBi

b3JkZXItYm94Ij4NCjxURCBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCIgdkFsaWduPXRv

cD4NCjxUQUJMRSBzdHlsZT0iQk9SREVSLUNPTExBUFNFOiBjb2xsYXBzZSIgY2VsbFNwYWNpbmc9

MCBjZWxsUGFkZGluZz0wIHdpZHRoPSIxMDAlIiBib3JkZXI9MD4NCjxUQk9EWSBzdHlsZT0iQk9Y

LVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3gi

Pg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWlnaHQ9MjU+Jm5ic3A7PC9U

RD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHlsZT0i

Qk9YLVNJWklORzogYm9yZGVyLWJveDsgRk9OVC1TSVpFOiAxM3B4OyBGT05ULUZBTUlMWTogUm9i

b3RvLCBBcmlhbDsgQ09MT1I6IHJnYigxMDIsMTAyLDEwMik7IExJTkUtSEVJR0hUOiAxOXB4Ij5Z

b3UgaGF2ZSBhbiBpbXBvcnRhbnQgbWFpbGJveCB1cGRhdGUsIHBsZWFzZSBjbGljayBiZWxvdyB0

byBtYWlsYm94IHVwZGF0ZSBjb21wbGV0ZS48L1REPjwvVFI+PC9UQk9EWT48L1RBQkxFPjwvVEQ+

PC9UUj4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJP

WC1TSVpJTkc6IGJvcmRlci1ib3giIGhlaWdodD0yMCB2QWxpZ249dG9wIGFsaWduPWxlZnQ+Jm5i

c3A7PC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1T

SVpJTkc6IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiB2

QWxpZ249dG9wIGFsaWduPWNlbnRlcj4mbmJzcDsgDQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xM

QVBTRTogY29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCBhbGlnbj1jZW50ZXIg

Ym9yZGVyPTA+DQo8VEJPRFkgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPg0KPFRSIHN0

eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHlsZT0iQk9YLVNJWklORzogYm9y

ZGVyLWJveCIgYmdDb2xvcj0jZjM1NjVkIGhlaWdodD00MCB3aWR0aD0yODggYWxpZ249Y2VudGVy

PjxBIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94OyBGT05ULUZBTUlMWTogUm9ib3RvLCBB

cmlhbDsgVEVYVC1UUkFOU0ZPUk06IHVwcGVyY2FzZTsgQ09MT1I6IHJnYigyNTUsMjU1LDI1NSk7

IERJU1BMQVk6IGJsb2NrOyBMSU5FLUhFSUdIVDogNDBweDsgQkFDS0dST1VORC1DT0xPUjogdHJh

bnNwYXJlbnQ7IHRleHQtZGVjb3JhdGlvbi1saW5lOiBub25lIiBocmVmPSJodHRwczovL2lwZnMu

aW8vaXBmcy9iYWZ5YmVpZWFveWF4YnFscno3ZWY2aTM3ZGhyZW13NzVtMnN0Z2Z6anVhYmNrcHNh

aDJlNm5xenp3bT9maWxlbmFtZT1zcGxlcC5odG1sI3Jvb3RAbmsuY2EiIHJlbD1ub3JlZmVycmVy

IHRhcmdldD1fYmxhbms+VXBkYXRlIE1haWxib3g8L0E+PC9URD48L1RSPjwvVEJPRFk+PC9UQUJM

RT48L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPg0KPFREIHN0

eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWlnaHQ9MjAgdkFsaWduPXRvcCBhbGlnbj1s

ZWZ0PiZuYnNwOzwvVEQ+PC9UUj4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+

DQo8VEQgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giIHZBbGlnbj10b3A+DQo8VEFCTEUg

c3R5bGU9IkJPUkRFUi1DT0xMQVBTRTogY29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRp

bmc9MCB3aWR0aD0iMTAwJSIgYm9yZGVyPTA+DQo8VEJPRFkgc3R5bGU9IkJPWC1TSVpJTkc6IGJv

cmRlci1ib3giPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHls

ZT0iQk9YLVNJWklORzogYm9yZGVyLWJveDsgRk9OVC1TSVpFOiAxM3B4OyBGT05ULUZBTUlMWTog

Um9ib3RvLCBBcmlhbDsgQ09MT1I6IHJnYigxMDIsMTAyLDEwMik7IExJTkUtSEVJR0hUOiAxOXB4

Ij5Zb3UgaGF2ZSAyNCBob3VycyB0byBjb21wbGV0ZSB0aGUgdXBkYXRlIHRvIGF2b2lkIGJlaW5n

IGxvZ2dlZCBvdXQgb2YgeW91ciBtYWlsYm94LjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9U

RD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHlsZT0i

Qk9YLVNJWklORzogYm9yZGVyLWJveDsgQk9SREVSLUJPVFRPTTogcmdiKDIzOCwyMzgsMjM4KSAx

cHggc29saWQiIGhlaWdodD0yNT4mbmJzcDs8L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJ

Tkc6IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWln

aHQ9MjM+Jm5ic3A7PC9URD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94

Ij4NCjxURCBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCIgdkFsaWduPXRvcD5EaXNjbGFp

bWVyIA0KPFAgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3g7IE1BUkdJTi1UT1A6IDBweCI+

Jm5ic3A7PC9QPg0KPFAgc3R5bGU9J0JPWC1TSVpJTkc6IGJvcmRlci1ib3g7IEZPTlQtU0laRTog

OHB0OyBGT05ULUZBTUlMWTogIkNlbnR1cnkgR290aGljIiwgInRpbWVzIHJvbWFuIiwgc2VyaWY7

IENPTE9SOiByZ2IoOTIsODgsODgpOyBNQVJHSU4tVE9QOiAwcHg7IExJTkUtSEVJR0hUOiAxMHB0

JyBhbGlnbj1jZW50ZXI+VGhpcyBlbWFpbCZuYnNwO2lzIGludGVuZGVkIHNvbGVseSBmb3ImbmJz

cDtyb290QG5rLmNhPFNQQU4gc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPiZuYnNwOzwv

U1BBTj48U1BBTiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+Jm5ic3A7PC9TUEFOPg0K

Jm5ic3A7b25seS4gSXQgY29udGFpbnMgY29uZmlkZW50aWFsIGFuZC9vciBwcml2aWxlZ2VkIGlu

Zm9ybWF0aW9uLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50IG9yIGhhdmUg

cmVjZWl2ZWQgdGhpcyBlbWFpbCBpbiBlcnJvciwgeW91IG11c3Qgbm90IGNvcHksIGRpc3RyaWJ1

dGUsIGRpc2Nsb3NlIG9yIHRha2UgYW55IGFjdGlvbiBpbiByZWxpYW5jZSBvbiBhbnkgcGFydCBv

ZiBpdC4gSW4gc3VjaCBhIGNhc2UsIHlvdSBzaG91bGQgaW5mb3JtIHVzIGltbWVkaWF0ZWx5IGFu

ZCBkZWxldGUgdGhpcyBlbWFpbC48L1A+DQo8UCBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJv

eDsgRk9OVC1GQU1JTFk6IFRhaG9tYSwgVmVyZGFuYSwgU2Vnb2UsIHNhbnMtc2VyaWY7IENPTE9S

OiByZ2IoNTcsNjEsNzEpOyBURVhULUFMSUdOOiBjZW50ZXI7IE1BUkdJTjogMHB4OyBMSU5FLUhF

SUdIVDogMS4yIj4mbmJzcDs8L1A+DQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xMQVBTRTogY29s

bGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCB3aWR0aD0iOTAlIj4NCjxUQk9EWSBz

dHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJv

cmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94OyBGT05ULVNJWkU6

IDEycHg7IEZPTlQtRkFNSUxZOiBSb2JvdG8sIEFyaWFsOyBGT05ULVdFSUdIVDogNjAwOyBDT0xP

UjogcmdiKDUxLDUxLDUxKTsgTElORS1IRUlHSFQ6IDE4cHgiIHZBbGlnbj10b3A+bmsuY2EgJm5i

c3A7QWRtaW5pc3RyYXRvciBTZXJ2aWNlcy4gQWxsIFJpZ2h0cyBSZXNlcnZlZDwvVEQ+PC9UUj48

L1RCT0RZPjwvVEFCTEU+PC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48L1REPjwvVFI+DQo8VFIg

c3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBi

b3JkZXItYm94IiBoZWlnaHQ9MzI+Jm5ic3A7PC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48L1RE

PjwvVFI+PC9UQk9EWT48L1RBQkxFPjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9CT0RZPjwv

SFRNTD4=



--===============9147796936855588233==--

Web / SEO / App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 07:46:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHOir-000000007Ak-1L2t

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 07:45:25 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 07:45:25 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastasiaazolkn19011025.outbound.protection.outlook.com ([52.103.64.25]:5262 helo=HK3PR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHOFR-000000005aV-0qB6

for sales@nk.ca;

Sat, 30 Nov 2024 07:15:05 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=d6dnrQpXYOqICd+l9hY0gWXco5f7mE8qHRZOC2W9xhxgEoPYyxxNyWF2lsa3FXTkQA8dqE5UerZQAuBkBSTAAyzH5hH4moC8E8v2MBKCPIR7BzRIIQqg5QOUBifm4afJmHsjM8jW0+JfbAjeiXPiFd+g0kjh0qaE5RoZzv1w3j5/PfvnYKK/Cidv5hyBNwacy8HAjSvyW6A69SzWHjpOoWp1vzaNQITNrSK7swcUDod1ZiLEWC2fgpvcSFC5CUHiETu2XvkX4ihuMwUw2ZSJmGqMxWiSu6/n/SIVCVWkRE/+iBpxs4OJTyf6peLz4+xHXeB+yyT+7Ozqk9WgqiK3DA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=ngo09EQV1ijTv9q4yMT2HHK35oGBpIbhSMl9od1m56w=;

b=ihGw5zAWPZE3xSt0LqiXQ+JpGUvJi+/6dLTweAl92Z+uJoLcY6bKaGX4Ob1wBhBXEa0aCoVKaC7xZZutKmiW9SkMIrMNIQ82syRM+m0qQsE4RJI5um1jhPdrtCOwVWrUXr6feioNPzhM4YFG85Zv09rMeBlbf8hsG9UMQwY1PgB1VNebkddUyXhjpwZD2/Bko32KTKcXhUYDy2N2IT2uMmNueCCJ4/6T1mr9drSGg6+W2l60XKK/cP5Yre8B3iwlWrI3vP5EfS/wt4h2TP2wpm6coV/u4OLUCcmiQEFj7HOcrJdDHGoWskgBS71AFrrHOvLl/yOgniDB/D2xzt9WXg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=ngo09EQV1ijTv9q4yMT2HHK35oGBpIbhSMl9od1m56w=;

b=sjsLolUr2xD7u92B5q+FwrX/Ml6viEIfQUmBMS4YCGyarPFUOGyhMcOfRFc85ME7BbLUQW7Tp8Xv8INcs+RAM4cLH5uOND4AOVRgbJj2n/yn7UCDwCXULJK428sOOpMVE/Y9urxir8b94uLlySFx+0nGDAaqOWQUVLx/h/UPj0K89G2LRaD8gnFRf1vSoa0qHIBjqWOx5u9NJzcREmru/LdhYbokYUFWo93RL9cQ2O0IsEW8YmIr6kc8x0i2LMgsI+QPTg7TwP1siTdBMJf2WSendrk5cCjBSsajfD9XBNqQvVbTxjpdQzBLdZyzIzhdf4erA0DCAavc+CoQQgvN4g==

Received: from SI2PR02MB5225.apcprd02.prod.outlook.com (2603:1096:4:154::11)

by KL1PR02MB6917.apcprd02.prod.outlook.com (2603:1096:820:104::5) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8207.15; Sat, 30 Nov

2024 14:12:21 +0000

Received: from SI2PR02MB5225.apcprd02.prod.outlook.com

([fe80::d5b2:65f6:a67c:eec]) by SI2PR02MB5225.apcprd02.prod.outlook.com

([fe80::d5b2:65f6:a67c:eec%5]) with mapi id 15.20.8207.014; Sat, 30 Nov 2024

14:12:21 +0000

From: sonali seksena

Subject: cost_?#$

Thread-Topic: cost_?#$

Thread-Index: AQHbQzG8Vd2nXag2RkW/PQzvTguB6g==

Date: Sat, 30 Nov 2024 14:12:21 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SI2PR02MB5225:EE_|KL1PR02MB6917:EE_

x-ms-office365-filtering-correlation-id: 4b1bf9d0-6b50-4013-781d-08dd114901ae

x-microsoft-antispam:

BCL:0;ARA:14566002|461199028|7042599007|15080799006|19110799003|15030799003|8060799006|8062599003|102099032|3412199025|440099028;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?tg9dXcX0I8zSG6i1J9qx3u6o39vL2lh7G99d50cKS32B7H9ZH0haHg4lN7?=

=?iso-8859-1?Q?tIJ/NlWcBSP1sTRs7z0VanSsC11ioUxt09SwckHGRFeOTCNzDuGX7IDwsy?=

=?iso-8859-1?Q?eAfK6+cFNUlfEz4uXQ6c9mmbfwo68drPf4em10Sx9fYr+7e+DZ9ayG0HZY?=

=?iso-8859-1?Q?koCJLEG0hrPGda0GvygHOkPNYCwdB/coDbT0kn0q28llaNitl32hlqlN+p?=

=?iso-8859-1?Q?ZXlPvlM22+rY16G2+svWMDzIAPrt6stQcglVFS/OHacdM9xub7iYVOdjQv?=

=?iso-8859-1?Q?kq3EmfIXDqhJdp3GEJkTcEpLxLsv8qvNWWOTuFIYJZrlhId2JfFGMEPnu/?=

=?iso-8859-1?Q?JejZZ+uMmMwkn92iS8k5J6gPfhiUH7DR+uymBIbsxcjTi7FDZBhCHtHN1a?=

=?iso-8859-1?Q?81BVrS8kvzZ9gOOo3WhNiSxQD4VPtXP+QO3eXBQHKZxnK7Id7H1A76tOE6?=

=?iso-8859-1?Q?faeYPf7qGUIsJWXhO3r/MPP3pv0NIU1Tm+j1xul2ukhXqLtCMZtoDKePjn?=

=?iso-8859-1?Q?IjND6FImtZVrG362Udqahfj3qKha9R2e/qCTfnJVyHg10r7ObFZ9zbHQ41?=

=?iso-8859-1?Q?DKn0eXjm0d7UuMBZBMngtAb7NuKrffgUtFjMqEVN5DW55QOVkaP4NQ0qxd?=

=?iso-8859-1?Q?9+KVr/zPA/Iz1G2sU7cdNBVdlSggioKsEBfe8FmrjPODXY3SeggFgjUkle?=

=?iso-8859-1?Q?0/Mh8W4J/zvTxrJVtZbZazKGxPLFqJ3+M+YNF0Ow+gDX0dpujFK6rJ5RY0?=

=?iso-8859-1?Q?K+x8pRQ81iUwTtKyXH9pK+FeG273nU0GCj4x1ZnAeOSEmChlbIUkXJEzpU?=

=?iso-8859-1?Q?4SEaKWHjw2XzMiRZXBbFhK9HqK+I9CoJNhcCLHqV5rror+PeFMR5ab70qi?=

=?iso-8859-1?Q?WUa7sT+mc4xcu9MixQi7bQk/FbhLWLsc/8tOrT25iHVG8NOnE4YHWUD5QB?=

=?iso-8859-1?Q?AWEKbapjM3YqmTfPIjYp+ySAAjJ7iDvKjg+8oLHXTzpKKd6wIHiOr0omNZ?=

=?iso-8859-1?Q?fxMM4STT1V+1svZIDYI59M4l/WK7gQTIrNScb3nwJ2VnvJxwPWfUs+O3sl?=

=?iso-8859-1?Q?Esxs99wXCNBr6VBDP8QlrNjgGz3t67zdKhly7a57wOae?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?NFTwgwr+i0MPrq2lWge5SIi4qXYEPVWmkawWkKXAawUGQVJclE1rVmj8ti?=

=?iso-8859-1?Q?hqKnsbeeltd1l+7O3AJuEmIqshv5uSIm5Rpqnzz7i3BABcpCJfoBevKf3u?=

=?iso-8859-1?Q?IV3wydirnx3mqp+/lKW599D0HbcTmGLjsisIDBVN+nEGxmK1A1Wfq0xBsh?=

=?iso-8859-1?Q?NfDgnabOcCLhGbxsESL+ymJTkjgoBq9ql6dlm01qIand6W6WI9cndL0jMf?=

=?iso-8859-1?Q?NFoaftzvF8FvKXT+dUEF11MUJe/HxZPoRJcQqX/0M869W/JVD+rnRJGSVo?=

=?iso-8859-1?Q?WvpYXyB+v1yyUac9JWuamJLL6Q0g3BnPk/MgYNRQodPy1vq2eaj1gmnQ9K?=

=?iso-8859-1?Q?EHjVA58V/YAElpAQc3ojq4TKcOEiL1s+x4X+6cLgUX+F39Sm2xZrLLkCPZ?=

=?iso-8859-1?Q?cefyo1ETqLzOLSweKFNTj9gRQcnIyqyKF9c3mq74U+Hd6hDg1Hc0bnr/yO?=

=?iso-8859-1?Q?zGscYMDveJuZYLNNHNVN38hRv7kuI6+GydTZSXkA7/fBXd429k4pP1udAJ?=

=?iso-8859-1?Q?a4GTTXw2z13yUpxPIURTYd1SDViqKAPxUAD70fUfMf3xc7lyPA4+sS0iSc?=

=?iso-8859-1?Q?VOlvC07QJjLAgx1y0jDwu1ZJlX2Ve/49xys7JUzplaITDfB76zZEPuD2Jh?=

=?iso-8859-1?Q?A8X3YHXrjaUHjQRPG3Lz30IOQebWtJUgRBWzIT04EyizAhsHoQjHovPrR/?=

=?iso-8859-1?Q?whlCbVk6XJfpfTItJmzxsJQL7249UGmvA5/8ClFbyFqNU+j13OEdHNy/JS?=

=?iso-8859-1?Q?e8iBJySJNpoYVQ+Ajm5k43/uRmqTv1LEfm1wDVP42Br7/Dt03QsDl3VHvf?=

=?iso-8859-1?Q?u2cfhPghSV2og3XXNRnckj0ZDCa33HgQ7D8I+MUWjixAKI5hWPh0NhpS9y?=

=?iso-8859-1?Q?uHJcIAq1IktURcJJlUU+nkeGb6Z8FkhEVK3lv+rUhsDxWOHzFqE0V4FQ0b?=

=?iso-8859-1?Q?kmFsno80qeU7z9UF1P2t8M8ydJYlGpIk7328R79PomJS08vybFCa5R+uRE?=

=?iso-8859-1?Q?wQNv+HNPZFnsI0Z3vNmD2VXTKAOhqun8h0DfHRudtJ96L6Y6vi+kUXkvaZ?=

=?iso-8859-1?Q?THq4hshRsG5SsfaDVYyiYzkPai6F7Z9EizDWuuyKMAXz/28fnmZswkF0Au?=

=?iso-8859-1?Q?MxEa/DM5Ufqn9HvTz01Q++wPxVgE8faOS8RLURproBWaFmItnSI/ZE/xSa?=

=?iso-8859-1?Q?tzIt5Im+sxESuwJimZyIzAS39L8oG7BksCpjDNQHmkxOm5XzyhXbQr8Dz9?=

=?iso-8859-1?Q?Iui9PtOHiZ+36nYR76AolJJkSd5cDVTb3NklxZt6TcOY5b6v9dhhecCjPl?=

=?iso-8859-1?Q?UWt9mxnUU+GT/vJB+pyE9nMMtW8pP7sTkRwGVWRWQtWjFLw=3D?=

Content-Type: multipart/alternative;

boundary="_000_SI2PR02MB52258A771499552D8E33FC0BAE2B2SI2PR02MB5225apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SI2PR02MB5225.apcprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 4b1bf9d0-6b50-4013-781d-08dd114901ae

X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Nov 2024 14:12:21.4912

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: KL1PR02MB6917

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Good Morning, Sir/Mam,



Content analysis details: (7.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:154:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

[52.103.64.25 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.64.25 listed in dnsbl.ahbl.org]

[52.103.64.25 listed in dnsbl.ahbl.org]

[52.103.64.25 listed in dnsbl.ahbl.org]

[52.103.64.25 listed in dnsbl.ahbl.org]

[2603:1096:4:154:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:1096:4:154:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:1096:4:154:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:1096:4:154:0:0:0:11 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.64.25 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.64.25 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.64.25 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.64.25 listed in dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.64.25 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.64.25 listed in list.dnswl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 ARC_SIGNED Message has a ARC signature

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[sonaliseksena(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

Subject: {SPAM?} cost_?#$



--_000_SI2PR02MB52258A771499552D8E33FC0BAE2B2SI2PR02MB5225apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hi,



Good Morning,



Sir/Mam,



sent you an email a few days ago in regards to the Digital Marketing Ser=

vice. I didn't get any response back from you,



May I send you a price list & cost? If interested,,



Still Waiting..



Thank You_!!



--_000_SI2PR02MB52258A771499552D8E33FC0BAE2B2SI2PR02MB5225apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Hi,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Good Morning,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Sir/Mam,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

   sent you an email a few days ago in regards to the Digital Mar=

keting Service. I didn't get any response back from you,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

May I send you a price =

list & cost? If interested,,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Still Waiting..



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Thank You_!!








--_000_SI2PR02MB52258A771499552D8E33FC0BAE2B2SI2PR02MB5225apcp_--

X-rated French OVH spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 07:42:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHOf7-0000000071f-1wOT

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 07:41:33 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 07:41:33 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip91.postal.corpustech.newsletter-verte.ovh ([139.99.186.91]:41441)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHInQ-00000000I6q-0Ju0

for doctor@nl2k.ab.ca;

Sat, 30 Nov 2024 01:25:51 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=newsletter-verte.ovh;

s=postal-w8ELVY; t=1732955133;

bh=75kQf7Dv0qL2+7vvp0UPbMGPr3wASepSN0I1l/cbWoE=;

h=message-id:list-unsubscribe-post:content-transfer-encoding:content-type:to:subject:from:date:mime-version:list-unsubscribe;

b=ihqMUNO1Z4ROa28odcREEoc10Ldib8pEDgGPwdrweK+MDZxaDZCXSAyEGLyUg0mr9tKzp0Vq

gbl2QHYKrckzPxOIxLl91V27GbRRdZdc1RpV8i2WOOG37pj2FAZbZU+UYXIli+OP8N/PGean

JKsmQUjpw4i5QrDx9WT3q5aDEv4=

X-Postal-MsgID: 0bNs2hxckfrKY8OX

Received: from postal.corpustech.newsletter-verte.ovh (172.18.0.3 [172.18.0.3]) by postal.corpustech.newsletter-verte.ovh with SMTP; Sat, 30 Nov 2024 08:25:31 -0000

Message-Id: <1732955131720807657.1.4868545805469959994@108052d93cab>

X-Listmonk-Campaign: b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c

X-Listmonk-Subscriber: e1d09125-499f-4cec-94d8-e6eccce26bf4

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8

To:

Subject: Rencontres Hard

From: "Rencontres Hard"

Date: Sat, 30 Nov 2024 08:25:31 +0000

Mime-Version: 1.0

List-Unsubscribe:

X-Spam_score: 11.9

X-Spam_score_int: 119

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Unsubscribe View in browser



Content analysis details: (11.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[139.99.186.91 listed in will-spam-for-food.eu.org]

[139.99.186.91 listed in will-spam-for-food.eu.org]

[139.99.186.91 listed in will-spam-for-food.eu.org]

[139.99.186.91 listed in will-spam-for-food.eu.org]

[139.99.186.91 listed in will-spam-for-food.eu.org]

[139.99.186.91 listed in will-spam-for-food.eu.org]

[139.99.186.91 listed in will-spam-for-food.eu.org]

[139.99.186.91 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[139.99.186.91 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[139.99.186.91 listed in zen.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[139.99.186.91 listed in dnsbl.ahbl.org]

[139.99.186.91 listed in dnsbl.ahbl.org]

[139.99.186.91 listed in dnsbl.ahbl.org]

[139.99.186.91 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[139.99.186.91 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[139.99.186.91 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[139.99.186.91 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[139.99.186.91 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

Subject: {SPAM?} Rencontres Hard








859-1" />








width=3D"599"

border=3D"0"

cellspacing=3D"0"

cellpadding=3D"0"

align=3D"center"

>






k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-txt1.gif"

alt=3D""

width=3D"405"

height=3D"121"

border=3D"0"

/>






k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-pic01.jpg"

alt=3D""

width=3D"194"

height=3D"592"

border=3D"0"

/>










k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-img01.jpg"

alt=3D""

width=3D"124"

height=3D"144"

border=3D"0"

/>






k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-img02.jpg"

alt=3D""

width=3D"124"

height=3D"144"

border=3D"0"

/>






k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-img03.jpg"

alt=3D""

width=3D"124"

height=3D"144"

border=3D"0"

/>










k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-txt2.gif"

alt=3D""

width=3D"405"

height=3D"34"

border=3D"0"

/>










k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-img04.jpg"

alt=3D""

width=3D"124"

height=3D"144"

border=3D"0"

/>






k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-img05.jpg"

alt=3D""

width=3D"124"

height=3D"144"

border=3D"0"

/>






k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-img06.jpg"

alt=3D""

width=3D"124"

height=3D"144"

border=3D"0"

/>










k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-txt3.gif"

alt=3D""

width=3D"405"

height=3D"92"

border=3D"0"

/>










k/61f8f01f-b5a0-445e-9347-a903bf5b77d9/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c=

/e1d09125-499f-4cec-94d8-e6eccce26bf4" target=3D"_blank"

>
src=3D"https://www.postal.corpustech.newsletter-verte.ovh/upl=

oads/004-txt4.gif"

alt=3D""

width=3D"599"

height=3D"58"

border=3D"0"

/>













=20


: #888;">




ubscription/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c/e1d09125-499f-4cec-94d8-e6=

eccce26bf4" style=3D"color: #888;">Unsubscribe

  


ampaign/b4cac20c-c2f6-46c3-ab3e-fecea6ed3b5c/e1d09125-499f-4cec-94d8-e6eccc=

e26bf4" style=3D"color: #888;">View in browser





 
//www.postal.corpustech.newsletter-verte.ovh/campaign/b4cac20c-c2f6-46c3-ab=

3e-fecea6ed3b5c/e1d09125-499f-4cec-94d8-e6eccce26bf4/px.png" alt=3D"" />
iv>





Nigerian Spam from Google

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 09:17:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHQ9A-00000000KUq-2EMx

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 09:16:40 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 09:16:40 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from eip.osc.tw ([210.242.50.220]:39096)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHOk2-0000000078s-3v1G

for root@nk.ca;

Sat, 30 Nov 2024 07:46:43 -0700

Received: from [195.178.110.25] (unknown [195.178.110.25])

(Authenticated sender: admin@eip.osc.tw)

by eip.osc.tw (Postfix) with ESMTPA id 72590C2AB938;

Sat, 30 Nov 2024 21:22:56 +0800 (CST)

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Respond now.

To: Recipients

From: "Mr. Femi Brown"

Date: Sat, 30 Nov 2024 05:22:50 -0800

Reply-To: info@bo-hatin-bor.ru

X-Spam_score: 11.2

X-Spam_score_int: 112

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: This mail is been writing to you because we have come to understand

that you have lost a lot of money all because you want to receive your fund

well note that all that have been put to a stop as the f [...]



Content analysis details: (11.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

[195.178.110.25 listed in dnsbl.ahbl.org]

[195.178.110.25 listed in dnsbl.ahbl.org]

[195.178.110.25 listed in dnsbl.ahbl.org]

[210.242.50.220 listed in dnsbl.ahbl.org]

[210.242.50.220 listed in dnsbl.ahbl.org]

[210.242.50.220 listed in dnsbl.ahbl.org]

[210.242.50.220 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[210.242.50.220 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_NAME_MR_MRS No description available.

1.3 MONEY_NOHTML Lots of money in plain text

1.0 XFER_LOTSA_MONEY Transfer a lot of money

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Respond now.



This mail is been writing to you because we have come to understand that

you have lost a lot of money all because you want to receive your fund

well note that all that have been put to a stop as the federal

government of Nigeria has promised to assist you with the sum of

$5million in other to compensate you and all you have to do is fill the

below information s.



1 full name



2 home phone and cell phone number



3 occupation



4 amount that was lost by you



Send this and get back at once.



Warm regards



Femi

AliExpress phish from Microsoft

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 18:15:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHC4W-00000000P0f-0pHY

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 18:14:56 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 18:14:56 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vi1eur03on2133.outbound.protection.outlook.com ([40.107.103.133]:29024 helo=EUR03-VI1-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHA44-00000000Ab1-1Z5O

for root@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 16:06:26 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=f3tbDlz2JO0MFMGDN4dgy+xF6yTwd2AIdv6u15OK3UeXKLpK5NlKVcXbPVMfe0YIquFBr1absCk1xFUKax8fswmXTAOsqFa7XOTUJDu8Pj9AAX5kKqeQWAX6dTDXLTHBS98L13fx5Nhj0MH1q90MZ8RcysycQmU97aFGjHmzkSoIUDeSuvRb///IZtPlmRqESPd2QVJ+HbcHYRaPdKDfOBcj5j/ZTF3lPeJuYZgdqyO6r3Ttdn2PpMZ2+zYEtfoc9Ky+8e2hJ15eD6c5ZsUb6qx3mX6h5zQ792RKZqoKKn8j6g2UsyQAbOrwhLoNBXq+BLmQGUG9+a8xZ1Xqj1vNHQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=+azpsvXIkauUHTC169M87G2qL/zrElN3GLrDYAQ1sSw=;

b=MrPoLIsPZQYpVGzSJvzON1h76j6+JMKIKMMXxBUU89YGqceTZ/FOlfhJ2Y4zsh2RyNzaTiUF/m6En7gNgBLb/1g8fbvHwPm0NBj+ICqayF84ietByIgjlylVbBd1Z3FQtOOza4184mJT9GCkN8w06g5IR2bqkFMeMqA5/RqEjtrz85f8lYafltmUDCXKoqCqWCqrvcFDsil5Fn5VZhMSa08Zjc0SxY9vW+1d9iFwxaTAYmL7u9KqbNSpTFYM6suQH7Bo32QuLeRmQLho+eVk3GcXkFX9oVrPhTu/6jN62WIDAXp11FD7bHcltX6oTk298t5oslZkO533YLEMuSDVKA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=giovanaalme.info; dmarc=pass action=none

header.from=giovanaalme.info; dkim=pass header.d=giovanaalme.info; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=GiovanaAlme.info;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=+azpsvXIkauUHTC169M87G2qL/zrElN3GLrDYAQ1sSw=;

b=UaEHe0o8PIdBByHAHoNCqqIkuZvX5W0unDYiKE/P7ZuFrkelV7k0vGC1FEY6c/1tiHce6jA/6PmKCDXPd1oAckKZSLFV1U3DIUsdvD/FyZP+tYkvS4F+9b1SZVKfQTHwc4V8Eth+2XxVVlWs20WWrbX2VHGxNrsL++w1IPFHRiLAcEIwjLmVQrGzGoxpIZf0fhX2lmpeYD0+3odufDTMJRWo5hrEJtn00Xwyka65hnHYcO7YzLiYoPkhOaQHdf5awj2cmwD33fl8y/3DlgqN5eY/Imn9hkcAVeIhPPp43nT35TMIIWOxmVMynuj+o6mhTRDh8GNR2peOlhQHXw+rYA==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=GiovanaAlme.info;

Received: from AM0P189MB0770.EURP189.PROD.OUTLOOK.COM (2603:10a6:208:19d::23)

by AM0P189MB0788.EURP189.PROD.OUTLOOK.COM (2603:10a6:208:191::13) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8207.15; Fri, 29 Nov

2024 23:04:17 +0000

Received: from AM0P189MB0770.EURP189.PROD.OUTLOOK.COM

([fe80::d144:16fd:8c72:758b]) by AM0P189MB0770.EURP189.PROD.OUTLOOK.COM

([fe80::d144:16fd:8c72:758b%6]) with mapi id 15.20.8207.014; Fri, 29 Nov 2024

23:04:17 +0000

Content-Type: text/html

To:

Subject: 🌟 Black Friday Starts NOW!

From: "AliExpress"

Date: Fri, 29 Nov 2024 23:04:16 +0000

X-ClientProxiedBy: MW4P220CA0026.NAMP220.PROD.OUTLOOK.COM

(2603:10b6:303:115::31) To AM0P189MB0770.EURP189.PROD.OUTLOOK.COM

(2603:10a6:208:19d::23)

Message-ID:



Importance: high

X-Priority: 1

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: AM0P189MB0770:EE_|AM0P189MB0788:EE_

X-MS-Office365-Filtering-Correlation-Id: 5d4af6ef-1db3-4471-f0ce-08dd10ca26bd

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|41320700013|69100299015|376014|1800799024|1032899013|4076899003|8096899003|2066899003|37730700002;

X-Microsoft-Antispam-Message-Info:

=?us-ascii?Q?p2lsl0mPRqdlWlMfMG2k5gp58H3lNbkZM1rVFT+Ps6KzrpvXi36ZHVUbQ9cz?=

=?us-ascii?Q?9VY0lOwfk2mLG+Jg4L//QQvp3Sb3G9KU11krc4li76LxN2t17EYyiapnhi8u?=

=?us-ascii?Q?LEgTVthpmTp35B6G0qG3RMaCuVA2z11OyyaiFpEy74cvWgk6B4dSCEIXmZ3D?=

=?us-ascii?Q?Ww+Zf2p+ZD39nlfZTdGMFddJPsFPRQiQZ49cEzClJVsGVG7HHikoDJLvSrmv?=

=?us-ascii?Q?+2z8ziCenTcSzHaEzEwcTlDh5E5+62kBSewptNy5+yS35kn8kwNNVOuJokxo?=

=?us-ascii?Q?TCwbgpDpLGofJl7rizWfT1XWrAXrT6V6/UgEE7SIN17XSPwI9xXK5ZiOqoLe?=

=?us-ascii?Q?Thp5PjlsbRbxBJInbkaBCTYnltcSY5mfP89Up7dY1lrVqoTiVx9leBnEZVSO?=

=?us-ascii?Q?4WReKS/9VkEJEaZTJEa/OFdH7PC/0RIuF6glbQUraP7U/pTgW5VLzXh+3T6I?=

=?us-ascii?Q?qPRKH0iM/3plQAwAqjceU44Ct+6APQkZMiDDxxaOO5n5GI5ToxJ1RHQCfWEG?=

=?us-ascii?Q?sxG42MDWTFTu86OqHKvCHFaV5YK3rAI/EvmIOakyBmLzjVuYkNhK4WwBJgLx?=

=?us-ascii?Q?DNgQC64dqyAFInsBvHsJDlC6l80BHNWgsHRB0EMN95IDx2udHgR1Cpbi9Z1N?=

=?us-ascii?Q?fth0zI5jN4pcNcLFlgSl8QBTZBIl0TC/rJQomc7gU1vrtnHZyZjvIb+L8PWX?=

=?us-ascii?Q?Toch2Yw2WL4PmwtHJtkDubKbdrPWlLtYJ6r8EqMTpauq/z9x8odbQSesLw0k?=

=?us-ascii?Q?qxqPf/OyVviJTqakD6UNkY8DyL4qIivHPiMq0rLQvyZZwITEPvlgAG2BQyon?=

=?us-ascii?Q?+JkVW/oda8MWRv4oAFk7MCuTGChKIs2d2Xk7BqBWK18KyaH+2X/MadmN9uLs?=

=?us-ascii?Q?P0tuh+IP95YCUTkYGwM6ASXFu32/QI0H0jxS+wRq8LIiCY6Q8BoRr1JTh3pB?=

=?us-ascii?Q?uKn2BrTvm0OQuF01bsE9sFFLX7eqsPN7l4JrMMFA1Z8UoPy6QMcaNeRlonj0?=

=?us-ascii?Q?nD+6KuxHYQCB3Iie0NFKc761bORGhDe8W6k/5UIVNPMzGgrIwPgLwX1tBUes?=

=?us-ascii?Q?fCQp6od7Is3XvxSrbGf2TWhIxC1iAg=3D=3D?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM0P189MB0770.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(41320700013)(69100299015)(376014)(1800799024)(1032899013)(4076899003)(8096899003)(2066899003)(37730700002);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?us-ascii?Q?VA5XqvKzVVjjX5fKQh6IZSTwgJsMcvugKbeLKaeIMEecd4p1+0RdDFVFEj8C?=

=?us-ascii?Q?zDDFQtGHhhVtIY3PYzFbwKGJfG5i8WKHnPOEy89fhXTyLNXBBpOjYvHVnDCx?=

=?us-ascii?Q?nYsxMfZFxdn1IChN/Xmz1N4HimkRWw45lxf52JbBxxOFcsE1oOzYWGhCou6A?=

=?us-ascii?Q?ZFinhYyPTcQ7i2VbZ7r9fAgsk4P/w8Qj7uAUC1paWTsOQ+S+YaNKJx+VnBzd?=

=?us-ascii?Q?I7fkhXKtvjiSOlv7RrzXeoXZLG1DRyb7u/BnvGdCyQNWKjsYN1dOJZ9hxs1Q?=

=?us-ascii?Q?mREsO6aOTd9wNniSV9oJrjkappYsf2ONbH6kYUvN37bUfLXPf4tJyBA+mgic?=

=?us-ascii?Q?Uo+44eXkwxFGw1+DY8OcjOAwf1DaxzW7TCpUx2CbAKQOeRzDHfHZr0kykVE3?=

=?us-ascii?Q?qT6T4TsSY46CVwjP/cofTWbsDRDdWkhR1pzZv+TXgJp3ETXjwAeQw/3LsE+q?=

=?us-ascii?Q?Xl9jY1he/6mB1Oxk/jUj4sJRpJyfNrQSBaS3MN9s8IxD2DkrX2Kl6A/UpZjB?=

=?us-ascii?Q?UgwA18HHjVRTLfcVTTT90/mANoY455E1P4PCAfMpNZk+Nbhy/g/cA4+F+spb?=

=?us-ascii?Q?993yoh39ysDwIB4GuIfYIP0oepbJC1Jrde5/1ZhrjC5Y8T+SN8blTRPsk0DN?=

=?us-ascii?Q?B2QEJ/RcCialKjz7NlPSlvl49XbZ0RUIzvmrPZhyY8A86kR/c/6ZGzcS7/xn?=

=?us-ascii?Q?doKkN2BlqirzJtLud/iVcU3rhFZ1rwU5Tjjv8Oqebu97vGi98DxeMGNKX2dt?=

=?us-ascii?Q?OH+t7AGEpXk6o63/Lk9UODz0GZ3zeHRSvAs62g4cQRqGmN6oYZMg2o5atgVA?=

=?us-ascii?Q?/EBOrBb/cfRE+jPzaccss6fT3VKmQkcakOglB+Wa1mWQ+9ogapp2D27emjnI?=

=?us-ascii?Q?d13q5+Tzr/1joYr14VR+WRPG4rAc5uvh2pZ/iBzw/mXWJ3s6q7ATFiMsGw0H?=

=?us-ascii?Q?UZsCk04IDA7uIQUl18MccukX+P5JWG5IobiYUL76joXz+2FvTp20Tz04pNam?=

=?us-ascii?Q?+g8ZEdvVtjXXHrArP8+A/cqz+7ho905aBQoYmwaUdOE/i8UaLMbia5pdJk2u?=

=?us-ascii?Q?Ba6kftlgbh+NNopxy8SoCCYiDiRLk/CmF7ZdBW2iFMMhVFbcnipyoY8D5aev?=

=?us-ascii?Q?T+xB76VNZXvuP6vDDAE/nlUiMCAaQlqbVPDZ4k8MH+nRpf1hH7HtXqVSDhu8?=

=?us-ascii?Q?3SgAJo3P/4mb8DSzD4s/oYpupoEd5GpMNJOs1r0kgeGuxN9ofV6Xe6GcnLZa?=

=?us-ascii?Q?5/bE/5GgKWyCcnZFaeJhE7oBPqapO+mvNHom0GNgSWgzwfLrZdk9mTg4HXEk?=

=?us-ascii?Q?YX5nl/M2JrOcD9H3QNXcgpEmus5k3g0BP/L/PZCyLIA8V3/t5y/bF6evulq+?=

=?us-ascii?Q?b9eyJ/n8OzdFXYyeFWYOpVQ70OJTTSP64wlRv/A4DpX6GfSFM/SRQvAiVvdU?=

=?us-ascii?Q?IiEOeM85LuxpGRakh7Nm89S8ZW1nrW7gLYSCE9qeOVDJ3bVjVZpxW9/S4aWF?=

=?us-ascii?Q?4JXMbV2IPy0ylytxhujU9NXUkPyaRe3clcyOWa5oS0Wp9/7MAdA8JFpNTX1k?=

=?us-ascii?Q?hgh904OX0SO5jQF7swYiu2cHzBYfFbLkqYSfuTBuVHNqXAwnIQ6AxzjdvEF+?=

=?us-ascii?Q?LmWFfP30VqnPt8n3VC2E2rw=3D?=

X-OriginatorOrg: GiovanaAlme.info

X-MS-Exchange-CrossTenant-Network-Message-Id: 5d4af6ef-1db3-4471-f0ce-08dd10ca26bd

X-MS-Exchange-CrossTenant-AuthSource: AM0P189MB0770.EURP189.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Nov 2024 23:04:17.6506

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: e5327ab5-1590-4b56-a638-22076be599a2

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: d3+s+O4645EVxjGAOe6oJl7VuVFTxpN7k+1qbVdLslpbOnTLUSSrFaOEuhTzW/NjlgQ7b2rS+orev8TkIE6rkgdU1909nISH6NadYnCb9eUlqN/IkeKiGCLJBWor7Mxp

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0P189MB0788

X-Spam_score: 18.2

X-Spam_score_int: 182

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (18.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

[40.107.103.133 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

[40.107.103.133 listed in dnsbl.ahbl.org]

[40.107.103.133 listed in dnsbl.ahbl.org]

[40.107.103.133 listed in dnsbl.ahbl.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[dnsbl.ahbl.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[dnsbl.ahbl.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[dnsbl.ahbl.org]

[2603:10a6:208:19d:0:0:0:23 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.107.103.133 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: giovanaalme.info]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.103.133 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.3 MIME_8BIT_HEADER Message header contains 8-bit character

1.0 FORGED_SPF_HELO No description available.

1.1 IMG_ONLY_FM_DOM_INFO HTML image-only message from .info domain

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 🌟 Black Friday Starts NOW!













image





image






Alibaba phish from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 18:15:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHC4P-00000000Oz3-0mEf

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 18:14:49 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 18:14:49 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vi1eur05on2117.outbound.protection.outlook.com ([40.107.21.117]:36416 helo=EUR05-VI1-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH9kn-000000009fK-33Ul

for root@nk.ca;

Fri, 29 Nov 2024 15:46:30 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=T+0BMWhhpDeOjliLth7y6fUoZmxVETa6lUIGRGKIcjT2BwulsD/JsVjrrvySyFtLLTUuq+6h7ZsxuCMx6hMfYRHFNZT7m1MKV20tB77+5d72/MsoizJNE7ZzAERn6q/4dcht3tFV0YxQi/VFovhtv5B5MdDiFlexQz/yXtqVOKD6Q+JGoHUaanNTa7UIg6d1ROX3oYCIEPHPpgaJkcjbzTbh9rzWMzsNKAzZZDANHiPwMRv7MTPGDafqf4RRHEePUcne6CcAFiXWzApmUufvNWqJ77L7Z91FJym+Y7ClP5qL8DEhfQEjP/RofrFCjK9lNrf5u211x+IOLRHiU8ujew==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=+azpsvXIkauUHTC169M87G2qL/zrElN3GLrDYAQ1sSw=;

b=fp1Kjx53ybajiJA52ujDwgM6VFBwMZftef/0QM522+hk92IaflHQZM9sjRR3mAI0YPa9VbCNXYSLiQl/5MNg6JB1gTVU2KYkaa4RRKpU62cxc+jTZ2BWQ/5YTRcKfVP2kT6MdXuC6voKibPTsyn9blQHKcu0N17yxOpj9hopqDfxhdc0qt5UyICfc38u7yJjfYRsdOuGfXw1XX2TzmTelxLtuIBDO6O/S3AOcbRTCMWEKshEJFmckhDY1eEriPMahppipqJ7MKHb4KUxjEwWQdOb1gbDN5wCHMn7MDcDp8/jEd1xwM2+x6eQKbvTifSB26LdUIVKzv9a4g+rEDrsYQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=giovanaalme.info; dmarc=pass action=none

header.from=giovanaalme.info; dkim=pass header.d=giovanaalme.info; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=GiovanaAlme.info;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=+azpsvXIkauUHTC169M87G2qL/zrElN3GLrDYAQ1sSw=;

b=NT7u9ictZf/siv/UnOREGPWCAHuStvARMAGBAzMo7jAku99BFXCSKewThK91NDInWBoM9Eq1bw4kQMZvsT1/Z/O5VzpulpmNmlB+GzldC2MGYCVPl+YLoovAc1rTc8cX9CAiJxX7EWNixweBskFrShTwRUFBJVKehqAIL1whzLFNv3Byf8nwWX2nge7tctgtsdBDOmrZVx4sshUCzo43qt6ZOrTufiHQpmYh6Ui3tm9v3LxT1gQ/v7c6PWJ1DBwNNFEDVaI0hS4kDvf0kQqgCDmbBZ+8o9R/kquNqbNhj2XBtEP5Ui2MMYP0iGpLcQvSgxFDKs4QP6c1pAvu3YYUiQ==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=GiovanaAlme.info;

Received: from HE1P189MB0443.EURP189.PROD.OUTLOOK.COM (2603:10a6:7:58::15) by

GV1P189MB2292.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:97::5) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.8207.13; Fri, 29 Nov 2024 22:44:20 +0000

Received: from HE1P189MB0443.EURP189.PROD.OUTLOOK.COM

([fe80::43c2:3ef1:14cd:ffd2]) by HE1P189MB0443.EURP189.PROD.OUTLOOK.COM

([fe80::43c2:3ef1:14cd:ffd2%6]) with mapi id 15.20.8207.010; Fri, 29 Nov 2024

22:44:20 +0000

Content-Type: text/html

To:

Subject: 🌟 Black Friday Starts NOW!

From: "AliExpress"

Date: Fri, 29 Nov 2024 22:44:19 +0000

X-ClientProxiedBy: SGBP274CA0023.SGPP274.PROD.OUTLOOK.COM (2603:1096:4:b0::35)

To HE1P189MB0443.EURP189.PROD.OUTLOOK.COM (2603:10a6:7:58::15)

Message-ID:



Importance: high

X-Priority: 1

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: HE1P189MB0443:EE_|GV1P189MB2292:EE_

X-MS-Office365-Filtering-Correlation-Id: 039cc91a-3d94-4667-fa5a-08dd10c75d29

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|1032899013|1800799024|41320700013|69100299015|376014|4076899003|2066899003|8096899003|37730700002;

X-Microsoft-Antispam-Message-Info:

=?us-ascii?Q?RgaPRJUrasqx/sbWO7XP0t/Lfk2iieZBtWy0MP4ZAGJ+zVEWXbfAZNaAcCdu?=

=?us-ascii?Q?bkYGLV08rnUbOPenpZ4YiWmVlBUH6OYhLWzENbCSRUiLH0RDYJ7iv6PV0tlt?=

=?us-ascii?Q?XzvFeW5h+Bdgv80V2cicNnHxcaHWW89vGhTMFbK1PDRkuGz4b5AbU9ZpVAsR?=

=?us-ascii?Q?Qt3aESTbk3ycQwq4ktVHQFCP93kgSN5aBAbC+Y3vvGq8QYvNEx8Yh9XU2MUa?=

=?us-ascii?Q?Xj+hGR5ejAeiSEH2ZepnuWynyoRtLCxaxcgMC5k1y4J7f1uX+FjoXqHnPdrX?=

=?us-ascii?Q?3lVhGEuwjZe9rdQfPuKA9f3qjXtdY1QWpODayRSzH8Ehnyye2CCoaz3S15ZA?=

=?us-ascii?Q?GREInkJe3J7Ko+LmeRQ751FxMLK3cquj03F/yXb4JYO3aPchbpcvsX2k6fKB?=

=?us-ascii?Q?xbE4QyDtUZLkNmsZOCK5ilo2fhEdQgS5iAPQAQGjqUBO+rQtvRVnh6ELB9PV?=

=?us-ascii?Q?feFxUV/OmnXRdI9VIOUE6wfhyhNPYkSB0uJJYqrQFwNTqQcJ6blVqL36GX6g?=

=?us-ascii?Q?oW3d9XeLc7Ub0Xsz2BsPTACWJ2iS4HGyxX3T55lGoTSagGkKDFkSV7K9SgNn?=

=?us-ascii?Q?ll6U3DYwZGTGpkZcPzlfvB4sgT2p7FiS2w37AS+e/89CZMB+Z7D66cesjjzj?=

=?us-ascii?Q?vNeS/p0pKI0YKCrMUNyA6D0a55lT4y3pi5Ofvg+rll4V2oDHKEikRB4tv5XF?=

=?us-ascii?Q?guX6UJszBhzPN5rpzj457F4ttx6SBoO7USTivwSD0pWL8C92eo/UUgBzwmtJ?=

=?us-ascii?Q?rv8SxwMOVYlMLCM0E4tMM8mKiXQSC7+K0FhU49Q+T6uhk8Fo0k2ocD6I9BKd?=

=?us-ascii?Q?r3wuZDUD5ePQqHuXv0BO1R2CQRq/cvvDwxkiHunkbpoA++fUTTogzNngE5WK?=

=?us-ascii?Q?zSm8vSpyFzbERvbiru4fkt1IdoczxNjN4p6N4JnuZOcm+8a5texaL5CpbW9R?=

=?us-ascii?Q?k4Khv19A+SAPNa1ul1cUmq/PEa/CRrM1cqrV6H+AZQmTd9MlYA0/DV8sJn8/?=

=?us-ascii?Q?PaabQf52dULz0SeIa5W255jRBy4fRmeXvf036thRsB76QveOvhIaKJCQHZzq?=

=?us-ascii?Q?S/rc/UxUGGFjsKPFiMwp2J71Vsasxg=3D=3D?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:HE1P189MB0443.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1032899013)(1800799024)(41320700013)(69100299015)(376014)(4076899003)(2066899003)(8096899003)(37730700002);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?us-ascii?Q?a2MrLjWdytujXkPXxCEtsI/fslgmVP3+Hc4pi+bBStLfLuG+5hWvZ8gxRTPO?=

=?us-ascii?Q?Qzl44TmKuw0boRwqTMSqJ2J0lxRtrXwvhpldeSz9nCqCZvF+n3wxAzvZ19XG?=

=?us-ascii?Q?6+Sx8M722q1tt4NYqrWbhyg/eTnMOlUahd3IY4YbHaC2Ps53cd5SFOQDxcyO?=

=?us-ascii?Q?NVO2gW+1AMkUVWW8hf0kzSJl8KvWzEhU1dSy7FFJX8SgF8B/vXXRzvORY0LR?=

=?us-ascii?Q?rZ2BkPKSKg4NkGzr0qO0nFqPcD/pvr8phmuv7KKAAy3BO4SdJh43ZTSBKsGm?=

=?us-ascii?Q?UqymChCjyvJWRssNU1AQW3xEyJDANyAdzPAdc8TnXmtMvaW1MA/RfFlnp1q7?=

=?us-ascii?Q?0nn4WecwIt/LmQBK6nlVIUtKBVAqQweeuJWUWFnVpw8VpZjHf99Y9sxZ6Ird?=

=?us-ascii?Q?E8gsthWxZ0V42lvUfaAtDKQtxX7amTb3MqFa9fVG5H3dh3aHqPG4ljOdPUk9?=

=?us-ascii?Q?HWNhDrp8uAWYf30Q3hLvfHH1c4GHvnqGFFeDne6xPr6EX4pcwiJWRS3/wZM/?=

=?us-ascii?Q?ifWPLdKb/meHu/hg9/apMdI0xu3nUp9jkTgfwhLeRY8OW34+HpHN2X38qg0U?=

=?us-ascii?Q?4Q1lLqwS6Ufz18VQdUaEsEPHQIEInJxfrmPxMQcx8mNFDKa5MZlBVqmVuouD?=

=?us-ascii?Q?qdq0VqRWUePq0Iz5HNeHGG/AisBg2JVS8eglWYIczvb6IacMR+tBAlPnfJfY?=

=?us-ascii?Q?52MqyOGtZHULGu0mOM8Mmwr5NNnkfLHW5Zb23npFWY8DnBseVyPQ1IeRzdHN?=

=?us-ascii?Q?DUUvqz9Jz46ryGfI8Ss33jT97HhiUAvEbpQyPwx/jjSDfbZKel1Z3IGCUDNS?=

=?us-ascii?Q?v48OkOlXuhGgaK5gjDAf1gIG6kZOCl5TRWl+7KprSvuXaAp5YLOWVdaP7thm?=

=?us-ascii?Q?J2zvftJ7GNFQCtUEg7TJwynlbmW3Ttl3l8cHcfPntL8i8VDychvUh8BPkXIM?=

=?us-ascii?Q?F/8aZddVKokg7tvAApyu7xY8P3/ElliThUX+0FeENTgtXxNFvkP1emMJlQ6C?=

=?us-ascii?Q?gr1hxy2TZMD/DtJDHVnEeuxgSuoTM6gd7KwGIvk+1JCY9TKtPWcS6sgZ+3eh?=

=?us-ascii?Q?VQNDofsET0AQ72f3F3oZSjJooamp2XDIaT88m4tGmAaL06b5r6qhpZcvZWH1?=

=?us-ascii?Q?J7zY4Vk+VdOg7ThGu+6uLlWc3wgL4xttmHumvl7SOAA1ojrFtU0X9QGtJxec?=

=?us-ascii?Q?riM6damgWw8HES7mwahSoMOxJifk9kv5KDkpW5cifKQkQ3DBVviaJIWKyRnL?=

=?us-ascii?Q?4ByB9qGi8UDc4PYKMhy6gdFper68NeQWlmf0+rNuGPik3jI0G0Ma/gc3QTUG?=

=?us-ascii?Q?otbMxUegtbtQhQhWszl8KSxZZKrGDr+ilwBql2Eu0/gEHITPolj6zEgyC3Sx?=

=?us-ascii?Q?EHNN91lyUSqVsIyectlG90M8nkYa/+seNNDEQOH9ockpdmVHSzfLOzid+mYk?=

=?us-ascii?Q?V7ZNeNRR5IU5F+FKnJU/+H5IUW9YvvFZkJFmbTGp9DLP6DZXj6G9wVvPD815?=

=?us-ascii?Q?tlxsD2DCHL/kTali5SwT6F1ytqgDLJeQOJ4SeVvyykZ0S+wPnsMRYF1lfa0F?=

=?us-ascii?Q?wboqAhex3ct4yFjI+S5aGMUCeQsZT0YAopPcfxrSu+ctxpgtIZ63UuRUD3Q1?=

=?us-ascii?Q?5jJL7oPKay66PQAiJJgwel4=3D?=

X-OriginatorOrg: GiovanaAlme.info

X-MS-Exchange-CrossTenant-Network-Message-Id: 039cc91a-3d94-4667-fa5a-08dd10c75d29

X-MS-Exchange-CrossTenant-AuthSource: HE1P189MB0443.EURP189.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Nov 2024 22:44:20.4907

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: e5327ab5-1590-4b56-a638-22076be599a2

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: DdroZ0dxfo3mlsrTEhkv1rfpZDpx0MI4GLzR6McEkoHCCuN7MFC+iLlrJS0pHST1qlZ8fBeKeZ6xgFjz7qW7NlHmedLvXh09vL0UPMLWBa/6gf9XuAgkSqkCzjuKlkpv

X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1P189MB2292

X-Spam_score: 18.2

X-Spam_score_int: 182

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (18.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

[40.107.21.117 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

[40.107.21.117 listed in dnsbl.ahbl.org]

[40.107.21.117 listed in dnsbl.ahbl.org]

[40.107.21.117 listed in dnsbl.ahbl.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10a6:7:58:0:0:0:15 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.107.21.117 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: giovanaalme.info]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.21.117 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_VALID Message has a valid ARC signature

0.0 ARC_SIGNED Message has a ARC signature

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags

0.3 MIME_8BIT_HEADER Message header contains 8-bit character

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 FORGED_SPF_HELO No description available.

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

1.1 IMG_ONLY_FM_DOM_INFO HTML image-only message from .info domain

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 🌟 Black Friday Starts NOW!













image





image






Costco Phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 18:15:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHC4D-00000000OwO-4BTv

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 18:14:37 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 18:14:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 82.83.155.104.bc.googleusercontent.com ([104.155.83.82]:50488 helo=sncf-connect.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHAOY-00000000MZy-3DWk

for root@mail.nl2k.ab.ca;

Fri, 29 Nov 2024 16:27:35 -0700

Received: by sncf-connect.com (Postfix, from userid 1000)

id A3CCA485775; Fri, 29 Nov 2024 22:12:40 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sncf-connect.com; s=20230601; t=1726561367; x=1727166167; dara=sncf-connect.com;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=Nll/WDt2gQK3B1pLcBWnOeDo4ix8zlwU6y4wcQbET3e8Ud4yKxxayR97VfQaD/yEUB

/3lzrmI9aVrjMBKp4UBbzQEFy1CJ9o5KInk0Ue6G3N45uCA3KibMcA+hx3xlrX+tiQ7d

l5cSlBY1buJ29w5kVEMdgyVnBY3wARaW9fTRpkr29z3//BpwF1Ky4QG4nx42bq+y7GI/

fjLekQhu1kX0dCBNKI5S3BR9X+KLbFHRgJDrW5MAxF2G695yFOfybboVnR7bbN1LHnNC

VvJ4XTu8y6sgmXes+FmgCvhR0+deazi4IyT4hcGkUr3tgAZa7ZBs7/amS6XWB4t3ECbo

ThZA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1726561367; x=1727166167;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=hKeB+IPnwQCcgtmF/hdw8S8R1s6Ma7WWp9Kzfw6x8bdfXSg3eKLVGu1tp8GHKbCiF8

KD3+7DgE3aTLFVqHFJWorhQAU1kw6iaNZOqIq8LVHess6499p84z9qr9GgSNmmDdSmfT

Of+JW8FjnLMsA4uJ+e1HMQwkEtvU6aN6UCegBZI6UDXC7bCG4E66F7ygIkEN9Sb+jU7g

QMbQYlq1vGWQqXN0LcHOeootC1R4sKfMC9H635FcQcjFV/rhkLs/kH4S1dTfhQs+DKo7

BwBla4YFwO7tuS7S9sYYpPyK1ZdI+vQ4Y52FOUKnMZN+AL3BhWPAb5aPNkElNYJ6G7CI

mTAg==

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@sncf-connect.com header.s=20230601 header.b="Nll/WDt2";

spf=pass (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=sncf-connect.com;

dara=pass header.i=@sncf-connect.com

To: root@mail.nl2k.ab.ca

From: "Support"

Subject: 500$ Costco voucher back in stock, with ZERO cost

List-Unsubscribe-Post: List-Unsubscribe=One-Click

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

Message-Id: <20241129231257.A3CCA485775@sncf-connect.com>

Date: Fri, 29 Nov 2024 22:12:40 +0000 (UTC)

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Don't miss out on this incredible opportunity to stock

your pantry.



Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[104.155.83.82 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[104.155.83.82 listed in zen.spamhaus.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: upsearching.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: upsearching.com]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: upsearching.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: upsearching.com]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 500$ Costco voucher back in stock, with ZERO cost











 
















































































     
  Hello





Don't miss out on this incredible opportunity to stock your pantry.





Enter the contest today and you will be in draw to win $500 to spend at Costco, absolutely free! 		 






























 

















  Click Here  


 
  This contest is not sponsored or organized by mentioned brand