nk.ca credential phishing from google.com

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 07:45:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHOhd-0000000078F-3aDb

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 07:44:09 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 07:44:09 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 219.177.199.35.bc.googleusercontent.com ([35.199.177.219]:33344 helo=[10.88.0.5])

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tHKTG-00000000Mdt-46ON

for root@nk.ca;

Sat, 30 Nov 2024 03:13:10 -0700

Content-Type: multipart/related; boundary="===============9147796936855588233=="

MIME-Version: 1.0

From: "Nagindas Khandwala College ."

To: root@nk.ca

Subject: =?utf-8?q?MailBox_Requesting_Authentication!_For_root=40nk=2Eca_=3A?=

X-Priority: 2

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Root , You have an important mailbox update, please

click below to mailbox update complete. Update Mailbox You have 24 hours to

complete the update to avoid being logged out of your mailbox. Dis [...]



Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

[35.199.177.219 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.199.177.219 listed in sbl-xbl.spamhaus.org]

[35.199.177.219 listed in sbl-xbl.spamhaus.org]

0.7 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL

[35.199.177.219 listed in zen.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.199.177.219 listed in zen.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

[35.199.177.219 listed in dnsbl.ahbl.org]

[35.199.177.219 listed in dnsbl.ahbl.org]

[35.199.177.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.199.177.219 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: ipfs.io/209.94.90.1]

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

3.2 URI_IPFSIO References Interplanetary File System PtP content via

ipfs.io, likely phishing

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.1 TO_IN_SUBJ To address is in Subject

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.2 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

1.0 XPRIO Has X-Priority header

0.0 URI_IPFS References Interplanetary File System PtP content, probable

phishing

Subject: {SPAM?} =?utf-8?q?MailBox_Requesting_Authentication!_For_root=40nk=2Eca_=3A?=



--===============9147796936855588233==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PEhUTUw+PEhFQUQ+DQo8TUVUQSBuYW1lPUdFTkVSQVRPUiBjb250ZW50PSJNU0hUTUwgMTEuMDAu

OTYwMC4xOTU5NyI+PC9IRUFEPg0KPEJPRFk+DQo8VEFCTEUgc3R5bGU9IkZPTlQtU0laRTogMTRw

eDsgRk9OVC1GQU1JTFk6IGFyaWFsOyBCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlOyBDT0xPUjog

cmdiKDQ0LDU0LDU4KSIgY2VsbFNwYWNpbmc9MCBjZWxsUGFkZGluZz0wIHdpZHRoPSIxMDAlIiBh

bGlnbj1jZW50ZXIgYmdDb2xvcj0jZjVmN2Y4IGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gt

U0laSU5HOiBib3JkZXItYm94Ij4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+

DQo8VEQgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giIGhlaWdodD0zMCB2QWxpZ249dG9w

IGFsaWduPWNlbnRlcj4mbmJzcDs8L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJv

cmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiB2QWxpZ249dG9w

IHdpZHRoPTYwMCBhbGlnbj1jZW50ZXI+DQo8VEFCTEUgc3R5bGU9Ik1BWC1XSURUSDogNjAwcHg7

IEJPUkRFUi1UT1A6IHJnYigyNDAsMjQxLDI0NikgMXB4IHNvbGlkOyBCT1JERVItUklHSFQ6IHJn

YigyNDAsMjQxLDI0NikgMXB4IHNvbGlkOyBCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlOyBCT1JE

RVItQk9UVE9NOiByZ2IoMjQwLDI0MSwyNDYpIDFweCBzb2xpZDsgQk9SREVSLUxFRlQ6IHJnYigy

NDAsMjQxLDI0NikgMXB4IHNvbGlkIiBjZWxsU3BhY2luZz0wIGNlbGxQYWRkaW5nPTAgYWxpZ249

Y2VudGVyIGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4N

CjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJPWC1TSVpJ

Tkc6IGJvcmRlci1ib3g7IE1BWC1XSURUSDogNjAwcHgiIGJnQ29sb3I9I2ZmZmZmZiB2QWxpZ249

dG9wIHdpZHRoPTYwMCBhbGlnbj1jZW50ZXI+DQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xMQVBT

RTogY29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCB3aWR0aD0iMTAwJSIgYWxp

Z249Y2VudGVyIGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94

Ij4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJPWC1T

SVpJTkc6IGJvcmRlci1ib3giIHZBbGlnbj10b3AgYWxpZ249Y2VudGVyPg0KPFRBQkxFIHN0eWxl

PSJCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlIiBjZWxsU3BhY2luZz0wIGNlbGxQYWRkaW5nPTAg

d2lkdGg9IjkyJSIgYWxpZ249Y2VudGVyIGJvcmRlcj0wPg0KPFRCT0RZIHN0eWxlPSJCT1gtU0la

SU5HOiBib3JkZXItYm94Ij4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8

VEQgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giIHZBbGlnbj10b3AgYWxpZ249Y2VudGVy

Pg0KPFRBQkxFIHN0eWxlPSJCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlIiBjZWxsU3BhY2luZz0w

IGNlbGxQYWRkaW5nPTAgd2lkdGg9IjEwMCUiIGFsaWduPWNlbnRlcj4NCjxUQk9EWSBzdHlsZT0i

Qk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1i

b3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWlnaHQ9MzA+Jm5ic3A7

PC9URD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHls

ZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCIgaGVpZ2h0PTMyPiZuYnNwOzwvVEQ+PC9UUj4NCjxU

UiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJPWC1TSVpJTkc6

IGJvcmRlci1ib3giIHZBbGlnbj10b3A+DQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xMQVBTRTog

Y29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCB3aWR0aD0iOTAlIj4NCjxUQk9E

WSBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6

IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94OyBGT05ULVNJ

WkU6IDEycHg7IEZPTlQtRkFNSUxZOiBSb2JvdG8sIEFyaWFsOyBDT0xPUjogcmdiKDUxLDUxLDUx

KTsgTElORS1IRUlHSFQ6IDE4cHgiIHZBbGlnbj10b3A+PFNQQU4gc3R5bGU9IkJPWC1TSVpJTkc6

IGJvcmRlci1ib3g7IEZPTlQtV0VJR0hUOiBib2xkZXIiPkRlYXIgUm9vdCAsPC9TUEFOPjwvVEQ+

PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9URD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBi

b3JkZXItYm94Ij4NCjxURCBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCIgdkFsaWduPXRv

cD4NCjxUQUJMRSBzdHlsZT0iQk9SREVSLUNPTExBUFNFOiBjb2xsYXBzZSIgY2VsbFNwYWNpbmc9

MCBjZWxsUGFkZGluZz0wIHdpZHRoPSIxMDAlIiBib3JkZXI9MD4NCjxUQk9EWSBzdHlsZT0iQk9Y

LVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3gi

Pg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWlnaHQ9MjU+Jm5ic3A7PC9U

RD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHlsZT0i

Qk9YLVNJWklORzogYm9yZGVyLWJveDsgRk9OVC1TSVpFOiAxM3B4OyBGT05ULUZBTUlMWTogUm9i

b3RvLCBBcmlhbDsgQ09MT1I6IHJnYigxMDIsMTAyLDEwMik7IExJTkUtSEVJR0hUOiAxOXB4Ij5Z

b3UgaGF2ZSBhbiBpbXBvcnRhbnQgbWFpbGJveCB1cGRhdGUsIHBsZWFzZSBjbGljayBiZWxvdyB0

byBtYWlsYm94IHVwZGF0ZSBjb21wbGV0ZS48L1REPjwvVFI+PC9UQk9EWT48L1RBQkxFPjwvVEQ+

PC9UUj4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VEQgc3R5bGU9IkJP

WC1TSVpJTkc6IGJvcmRlci1ib3giIGhlaWdodD0yMCB2QWxpZ249dG9wIGFsaWduPWxlZnQ+Jm5i

c3A7PC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1T

SVpJTkc6IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiB2

QWxpZ249dG9wIGFsaWduPWNlbnRlcj4mbmJzcDsgDQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xM

QVBTRTogY29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCBhbGlnbj1jZW50ZXIg

Ym9yZGVyPTA+DQo8VEJPRFkgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPg0KPFRSIHN0

eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHlsZT0iQk9YLVNJWklORzogYm9y

ZGVyLWJveCIgYmdDb2xvcj0jZjM1NjVkIGhlaWdodD00MCB3aWR0aD0yODggYWxpZ249Y2VudGVy

PjxBIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94OyBGT05ULUZBTUlMWTogUm9ib3RvLCBB

cmlhbDsgVEVYVC1UUkFOU0ZPUk06IHVwcGVyY2FzZTsgQ09MT1I6IHJnYigyNTUsMjU1LDI1NSk7

IERJU1BMQVk6IGJsb2NrOyBMSU5FLUhFSUdIVDogNDBweDsgQkFDS0dST1VORC1DT0xPUjogdHJh

bnNwYXJlbnQ7IHRleHQtZGVjb3JhdGlvbi1saW5lOiBub25lIiBocmVmPSJodHRwczovL2lwZnMu

aW8vaXBmcy9iYWZ5YmVpZWFveWF4YnFscno3ZWY2aTM3ZGhyZW13NzVtMnN0Z2Z6anVhYmNrcHNh

aDJlNm5xenp3bT9maWxlbmFtZT1zcGxlcC5odG1sI3Jvb3RAbmsuY2EiIHJlbD1ub3JlZmVycmVy

IHRhcmdldD1fYmxhbms+VXBkYXRlIE1haWxib3g8L0E+PC9URD48L1RSPjwvVEJPRFk+PC9UQUJM

RT48L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPg0KPFREIHN0

eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWlnaHQ9MjAgdkFsaWduPXRvcCBhbGlnbj1s

ZWZ0PiZuYnNwOzwvVEQ+PC9UUj4NCjxUUiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+

DQo8VEQgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giIHZBbGlnbj10b3A+DQo8VEFCTEUg

c3R5bGU9IkJPUkRFUi1DT0xMQVBTRTogY29sbGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRp

bmc9MCB3aWR0aD0iMTAwJSIgYm9yZGVyPTA+DQo8VEJPRFkgc3R5bGU9IkJPWC1TSVpJTkc6IGJv

cmRlci1ib3giPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHls

ZT0iQk9YLVNJWklORzogYm9yZGVyLWJveDsgRk9OVC1TSVpFOiAxM3B4OyBGT05ULUZBTUlMWTog

Um9ib3RvLCBBcmlhbDsgQ09MT1I6IHJnYigxMDIsMTAyLDEwMik7IExJTkUtSEVJR0hUOiAxOXB4

Ij5Zb3UgaGF2ZSAyNCBob3VycyB0byBjb21wbGV0ZSB0aGUgdXBkYXRlIHRvIGF2b2lkIGJlaW5n

IGxvZ2dlZCBvdXQgb2YgeW91ciBtYWlsYm94LjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9U

RD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94Ij4NCjxURCBzdHlsZT0i

Qk9YLVNJWklORzogYm9yZGVyLWJveDsgQk9SREVSLUJPVFRPTTogcmdiKDIzOCwyMzgsMjM4KSAx

cHggc29saWQiIGhlaWdodD0yNT4mbmJzcDs8L1REPjwvVFI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJ

Tkc6IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94IiBoZWln

aHQ9MjM+Jm5ic3A7PC9URD48L1RSPg0KPFRSIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94

Ij4NCjxURCBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCIgdkFsaWduPXRvcD5EaXNjbGFp

bWVyIA0KPFAgc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3g7IE1BUkdJTi1UT1A6IDBweCI+

Jm5ic3A7PC9QPg0KPFAgc3R5bGU9J0JPWC1TSVpJTkc6IGJvcmRlci1ib3g7IEZPTlQtU0laRTog

OHB0OyBGT05ULUZBTUlMWTogIkNlbnR1cnkgR290aGljIiwgInRpbWVzIHJvbWFuIiwgc2VyaWY7

IENPTE9SOiByZ2IoOTIsODgsODgpOyBNQVJHSU4tVE9QOiAwcHg7IExJTkUtSEVJR0hUOiAxMHB0

JyBhbGlnbj1jZW50ZXI+VGhpcyBlbWFpbCZuYnNwO2lzIGludGVuZGVkIHNvbGVseSBmb3ImbmJz

cDtyb290QG5rLmNhPFNQQU4gc3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPiZuYnNwOzwv

U1BBTj48U1BBTiBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+Jm5ic3A7PC9TUEFOPg0K

Jm5ic3A7b25seS4gSXQgY29udGFpbnMgY29uZmlkZW50aWFsIGFuZC9vciBwcml2aWxlZ2VkIGlu

Zm9ybWF0aW9uLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50IG9yIGhhdmUg

cmVjZWl2ZWQgdGhpcyBlbWFpbCBpbiBlcnJvciwgeW91IG11c3Qgbm90IGNvcHksIGRpc3RyaWJ1

dGUsIGRpc2Nsb3NlIG9yIHRha2UgYW55IGFjdGlvbiBpbiByZWxpYW5jZSBvbiBhbnkgcGFydCBv

ZiBpdC4gSW4gc3VjaCBhIGNhc2UsIHlvdSBzaG91bGQgaW5mb3JtIHVzIGltbWVkaWF0ZWx5IGFu

ZCBkZWxldGUgdGhpcyBlbWFpbC48L1A+DQo8UCBzdHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJv

eDsgRk9OVC1GQU1JTFk6IFRhaG9tYSwgVmVyZGFuYSwgU2Vnb2UsIHNhbnMtc2VyaWY7IENPTE9S

OiByZ2IoNTcsNjEsNzEpOyBURVhULUFMSUdOOiBjZW50ZXI7IE1BUkdJTjogMHB4OyBMSU5FLUhF

SUdIVDogMS4yIj4mbmJzcDs8L1A+DQo8VEFCTEUgc3R5bGU9IkJPUkRFUi1DT0xMQVBTRTogY29s

bGFwc2UiIGNlbGxTcGFjaW5nPTAgY2VsbFBhZGRpbmc9MCB3aWR0aD0iOTAlIj4NCjxUQk9EWSBz

dHlsZT0iQk9YLVNJWklORzogYm9yZGVyLWJveCI+DQo8VFIgc3R5bGU9IkJPWC1TSVpJTkc6IGJv

cmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBib3JkZXItYm94OyBGT05ULVNJWkU6

IDEycHg7IEZPTlQtRkFNSUxZOiBSb2JvdG8sIEFyaWFsOyBGT05ULVdFSUdIVDogNjAwOyBDT0xP

UjogcmdiKDUxLDUxLDUxKTsgTElORS1IRUlHSFQ6IDE4cHgiIHZBbGlnbj10b3A+bmsuY2EgJm5i

c3A7QWRtaW5pc3RyYXRvciBTZXJ2aWNlcy4gQWxsIFJpZ2h0cyBSZXNlcnZlZDwvVEQ+PC9UUj48

L1RCT0RZPjwvVEFCTEU+PC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48L1REPjwvVFI+DQo8VFIg

c3R5bGU9IkJPWC1TSVpJTkc6IGJvcmRlci1ib3giPg0KPFREIHN0eWxlPSJCT1gtU0laSU5HOiBi

b3JkZXItYm94IiBoZWlnaHQ9MzI+Jm5ic3A7PC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48L1RE

PjwvVFI+PC9UQk9EWT48L1RBQkxFPjwvVEQ+PC9UUj48L1RCT0RZPjwvVEFCTEU+PC9CT0RZPjwv

SFRNTD4=



--===============9147796936855588233==--

Nigerian Spam from Google

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 30 Nov 2024 09:17:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHQ9A-00000000KUq-2EMx

for dave@doctor.nl2k.ab.ca;

Sat, 30 Nov 2024 09:16:40 -0700

Resent-From: The Doctor

Resent-Date: Sat, 30 Nov 2024 09:16:40 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from eip.osc.tw ([210.242.50.220]:39096)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHOk2-0000000078s-3v1G

for root@nk.ca;

Sat, 30 Nov 2024 07:46:43 -0700

Received: from [195.178.110.25] (unknown [195.178.110.25])

(Authenticated sender: admin@eip.osc.tw)

by eip.osc.tw (Postfix) with ESMTPA id 72590C2AB938;

Sat, 30 Nov 2024 21:22:56 +0800 (CST)

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Respond now.

To: Recipients

From: "Mr. Femi Brown"

Date: Sat, 30 Nov 2024 05:22:50 -0800

Reply-To: info@bo-hatin-bor.ru

X-Spam_score: 11.2

X-Spam_score_int: 112

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: This mail is been writing to you because we have come to understand

that you have lost a lot of money all because you want to receive your fund

well note that all that have been put to a stop as the f [...]



Content analysis details: (11.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[195.178.110.25 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

[210.242.50.220 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

[195.178.110.25 listed in dnsbl.ahbl.org]

[195.178.110.25 listed in dnsbl.ahbl.org]

[195.178.110.25 listed in dnsbl.ahbl.org]

[210.242.50.220 listed in dnsbl.ahbl.org]

[210.242.50.220 listed in dnsbl.ahbl.org]

[210.242.50.220 listed in dnsbl.ahbl.org]

[210.242.50.220 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[195.178.110.25 listed in dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[210.242.50.220 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_NAME_MR_MRS No description available.

1.3 MONEY_NOHTML Lots of money in plain text

1.0 XFER_LOTSA_MONEY Transfer a lot of money

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Respond now.



This mail is been writing to you because we have come to understand that

you have lost a lot of money all because you want to receive your fund

well note that all that have been put to a stop as the federal

government of Nigeria has promised to assist you with the sum of

$5million in other to compensate you and all you have to do is fill the

below information s.



1 full name



2 home phone and cell phone number



3 occupation



4 amount that was lost by you



Send this and get back at once.



Warm regards



Femi

Costco Phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 18:15:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHC4D-00000000OwO-4BTv

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 18:14:37 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 18:14:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 82.83.155.104.bc.googleusercontent.com ([104.155.83.82]:50488 helo=sncf-connect.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tHAOY-00000000MZy-3DWk

for root@mail.nl2k.ab.ca;

Fri, 29 Nov 2024 16:27:35 -0700

Received: by sncf-connect.com (Postfix, from userid 1000)

id A3CCA485775; Fri, 29 Nov 2024 22:12:40 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sncf-connect.com; s=20230601; t=1726561367; x=1727166167; dara=sncf-connect.com;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=Nll/WDt2gQK3B1pLcBWnOeDo4ix8zlwU6y4wcQbET3e8Ud4yKxxayR97VfQaD/yEUB

/3lzrmI9aVrjMBKp4UBbzQEFy1CJ9o5KInk0Ue6G3N45uCA3KibMcA+hx3xlrX+tiQ7d

l5cSlBY1buJ29w5kVEMdgyVnBY3wARaW9fTRpkr29z3//BpwF1Ky4QG4nx42bq+y7GI/

fjLekQhu1kX0dCBNKI5S3BR9X+KLbFHRgJDrW5MAxF2G695yFOfybboVnR7bbN1LHnNC

VvJ4XTu8y6sgmXes+FmgCvhR0+deazi4IyT4hcGkUr3tgAZa7ZBs7/amS6XWB4t3ECbo

ThZA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1726561367; x=1727166167;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=hKeB+IPnwQCcgtmF/hdw8S8R1s6Ma7WWp9Kzfw6x8bdfXSg3eKLVGu1tp8GHKbCiF8

KD3+7DgE3aTLFVqHFJWorhQAU1kw6iaNZOqIq8LVHess6499p84z9qr9GgSNmmDdSmfT

Of+JW8FjnLMsA4uJ+e1HMQwkEtvU6aN6UCegBZI6UDXC7bCG4E66F7ygIkEN9Sb+jU7g

QMbQYlq1vGWQqXN0LcHOeootC1R4sKfMC9H635FcQcjFV/rhkLs/kH4S1dTfhQs+DKo7

BwBla4YFwO7tuS7S9sYYpPyK1ZdI+vQ4Y52FOUKnMZN+AL3BhWPAb5aPNkElNYJ6G7CI

mTAg==

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@sncf-connect.com header.s=20230601 header.b="Nll/WDt2";

spf=pass (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=sncf-connect.com;

dara=pass header.i=@sncf-connect.com

To: root@mail.nl2k.ab.ca

From: "Support"

Subject: 500$ Costco voucher back in stock, with ZERO cost

List-Unsubscribe-Post: List-Unsubscribe=One-Click

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

Message-Id: <20241129231257.A3CCA485775@sncf-connect.com>

Date: Fri, 29 Nov 2024 22:12:40 +0000 (UTC)

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Don't miss out on this incredible opportunity to stock

your pantry.



Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[104.155.83.82 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[104.155.83.82 listed in zen.spamhaus.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: upsearching.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: upsearching.com]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: upsearching.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: upsearching.com]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 500$ Costco voucher back in stock, with ZERO cost











 
















































































     
  Hello





Don't miss out on this incredible opportunity to stock your pantry.





Enter the contest today and you will be in draw to win $500 to spend at Costco, absolutely free!
 






























 

















  Click Here  


 
  This contest is not sponsored or organized by mentioned brand  










Costco Phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 14:06:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH8Af-0000000064D-2Txs

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 14:05:01 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 14:05:01 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 82.83.155.104.bc.googleusercontent.com ([104.155.83.82]:40000 helo=sncf-connect.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH86h-000000005sQ-3Tny

for root@nl2k.ab.ca;

Fri, 29 Nov 2024 14:01:00 -0700

Received: by sncf-connect.com (Postfix, from userid 1000)

id BF2B422ADEC; Fri, 29 Nov 2024 20:34:42 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sncf-connect.com; s=20230601; t=1726561367; x=1727166167; dara=sncf-connect.com;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=Nll/WDt2gQK3B1pLcBWnOeDo4ix8zlwU6y4wcQbET3e8Ud4yKxxayR97VfQaD/yEUB

/3lzrmI9aVrjMBKp4UBbzQEFy1CJ9o5KInk0Ue6G3N45uCA3KibMcA+hx3xlrX+tiQ7d

l5cSlBY1buJ29w5kVEMdgyVnBY3wARaW9fTRpkr29z3//BpwF1Ky4QG4nx42bq+y7GI/

fjLekQhu1kX0dCBNKI5S3BR9X+KLbFHRgJDrW5MAxF2G695yFOfybboVnR7bbN1LHnNC

VvJ4XTu8y6sgmXes+FmgCvhR0+deazi4IyT4hcGkUr3tgAZa7ZBs7/amS6XWB4t3ECbo

ThZA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1726561367; x=1727166167;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=hKeB+IPnwQCcgtmF/hdw8S8R1s6Ma7WWp9Kzfw6x8bdfXSg3eKLVGu1tp8GHKbCiF8

KD3+7DgE3aTLFVqHFJWorhQAU1kw6iaNZOqIq8LVHess6499p84z9qr9GgSNmmDdSmfT

Of+JW8FjnLMsA4uJ+e1HMQwkEtvU6aN6UCegBZI6UDXC7bCG4E66F7ygIkEN9Sb+jU7g

QMbQYlq1vGWQqXN0LcHOeootC1R4sKfMC9H635FcQcjFV/rhkLs/kH4S1dTfhQs+DKo7

BwBla4YFwO7tuS7S9sYYpPyK1ZdI+vQ4Y52FOUKnMZN+AL3BhWPAb5aPNkElNYJ6G7CI

mTAg==

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@sncf-connect.com header.s=20230601 header.b="Nll/WDt2";

spf=pass (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=sncf-connect.com;

dara=pass header.i=@sncf-connect.com

To: root@nl2k.ab.ca

From: "Support"

Subject: 500$ Costco voucher back in stock, with ZERO cost

List-Unsubscribe-Post: List-Unsubscribe=One-Click

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

Message-Id: <20241129204515.BF2B422ADEC@sncf-connect.com>

Date: Fri, 29 Nov 2024 20:34:42 +0000 (UTC)

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Don't miss out on this incredible opportunity to stock

your pantry.



Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[104.155.83.82 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[104.155.83.82 listed in zen.spamhaus.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: upsearching.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: upsearching.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: upsearching.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: upsearching.com]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 500$ Costco voucher back in stock, with ZERO cost











 
















































































     
  Hello





Don't miss out on this incredible opportunity to stock your pantry.





Enter the contest today and you will be in draw to win $500 to spend at Costco, absolutely free!
 






























 

















  Click Here  


 
  This contest is not sponsored or organized by mentioned brand  










Costco Phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 14:05:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH8AY-0000000063R-1m6g

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 14:04:54 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 14:04:54 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 82.83.155.104.bc.googleusercontent.com ([104.155.83.82]:58984 helo=sncf-connect.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH83M-000000005lK-1a8D

for doctor@nl2k.ab.ca;

Fri, 29 Nov 2024 13:57:32 -0700

Received: by sncf-connect.com (Postfix, from userid 1000)

id 02B55216D37; Fri, 29 Nov 2024 20:24:41 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sncf-connect.com; s=20230601; t=1726561367; x=1727166167; dara=sncf-connect.com;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=Nll/WDt2gQK3B1pLcBWnOeDo4ix8zlwU6y4wcQbET3e8Ud4yKxxayR97VfQaD/yEUB

/3lzrmI9aVrjMBKp4UBbzQEFy1CJ9o5KInk0Ue6G3N45uCA3KibMcA+hx3xlrX+tiQ7d

l5cSlBY1buJ29w5kVEMdgyVnBY3wARaW9fTRpkr29z3//BpwF1Ky4QG4nx42bq+y7GI/

fjLekQhu1kX0dCBNKI5S3BR9X+KLbFHRgJDrW5MAxF2G695yFOfybboVnR7bbN1LHnNC

VvJ4XTu8y6sgmXes+FmgCvhR0+deazi4IyT4hcGkUr3tgAZa7ZBs7/amS6XWB4t3ECbo

ThZA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1726561367; x=1727166167;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=hKeB+IPnwQCcgtmF/hdw8S8R1s6Ma7WWp9Kzfw6x8bdfXSg3eKLVGu1tp8GHKbCiF8

KD3+7DgE3aTLFVqHFJWorhQAU1kw6iaNZOqIq8LVHess6499p84z9qr9GgSNmmDdSmfT

Of+JW8FjnLMsA4uJ+e1HMQwkEtvU6aN6UCegBZI6UDXC7bCG4E66F7ygIkEN9Sb+jU7g

QMbQYlq1vGWQqXN0LcHOeootC1R4sKfMC9H635FcQcjFV/rhkLs/kH4S1dTfhQs+DKo7

BwBla4YFwO7tuS7S9sYYpPyK1ZdI+vQ4Y52FOUKnMZN+AL3BhWPAb5aPNkElNYJ6G7CI

mTAg==

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@sncf-connect.com header.s=20230601 header.b="Nll/WDt2";

spf=pass (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=sncf-connect.com;

dara=pass header.i=@sncf-connect.com

To: doctor@nl2k.ab.ca

From: "Support"

Subject: 500$ Costco voucher back in stock, with ZERO cost

List-Unsubscribe-Post: List-Unsubscribe=One-Click

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

Message-Id: <20241129204255.02B55216D37@sncf-connect.com>

Date: Fri, 29 Nov 2024 20:24:41 +0000 (UTC)

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Don't miss out on this incredible opportunity to stock

your pantry.



Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

[104.155.83.82 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

[104.155.83.82 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[104.155.83.82 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[104.155.83.82 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[104.155.83.82 listed in zen.spamhaus.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: upsearching.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: upsearching.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: upsearching.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: upsearching.com]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 500$ Costco voucher back in stock, with ZERO cost











 
















































































     
  Hello





Don't miss out on this incredible opportunity to stock your pantry.





Enter the contest today and you will be in draw to win $500 to spend at Costco, absolutely free!
 






























 

















  Click Here  


 
  This contest is not sponsored or organized by mentioned brand  










Instagram followers spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 14:05:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH8AF-00000000632-3xUP

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 14:04:35 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 14:04:35 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-il1-f197.google.com ([209.85.166.197]:58472)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH6hQ-000000001jz-3NJh

for sales@nk.ca;

Fri, 29 Nov 2024 12:30:48 -0700

Received: by mail-il1-f197.google.com with SMTP id e9e14a558f8ab-3a7e1527971so2402475ab.0

for ; Fri, 29 Nov 2024 11:28:54 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1732908528; x=1733513328; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=1lq+Kkx9n4m7WcFSg/0zVm8p5ejfcHq2ERtcV30BRtg=;

b=dSBviVXIxtqV3+5Dv59jelSb+komDYHiM11OCs1MCGJeX868oVVfIAAOyYvcSqA+Xn

QpE5sQjuFxfxaMCo4qStdVkWB8zb3xHcVS0IzZqpRrxRZJWDYrMWd4HnZPv0yCE81rjd

DfnZ+HQ1iY/oX7fditglvOIHuf1y5q/pE5gH7unuSauqe+GhqB6tip6iq+jL0fz0uKkC

hnyj/PqIYzvIRdzOAtnYYf6L9irwLoOjdQ4kzg0302FMTHPKpwVRFiIwar7jSYdnlY1I

yvkVEZvg0tNhih7sAefr027rboNpAHWkTZCafCWq/2mAMZ6rBrEaGqbsxfF+HAAAPtpo

zQtw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732908528; x=1733513328;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=1lq+Kkx9n4m7WcFSg/0zVm8p5ejfcHq2ERtcV30BRtg=;

b=JG2Bqhto/LGoI7PG5BdsEMmfWs9OarZK5ipv5ID9SD8xhHgVky1FauNAllvvs8/H+F

EautMcNH4C4pvcFB0RI1lKFBY0VoceOKwxSJiwqR5pjJs00J1uZt0dzTieVO8xFTl7z8

+SuusdfmN+GXOM2iiGHOymDZe6TPhl+cbQlrjLABY+Oom/4mJkLVTryEvwQ3LfXuU+1e

Rx3crwFyHfFy8gUgvBz+mUaoWGI1eJ1dY+EUU51mPhTi4ed5oXJf9PKSJxqI2yQBZcT7

JqdAqQ5kzN7+rUWEz7QK+j9ubCCdkGSUSnpyI3DBl5Cp5NSijuFJPDsr58J7lO8qbMQP

28aw==

X-Gm-Message-State: AOJu0Yybhf7EyuuJwDbcxFaO0nyAuuPRsUtkM5OGXAn1AGiBIifn09C2

TthCn/rWmb7DcCSQD/lAHlUFxxfS/HF+fMNnPhBXr/GfVdHQsd+p/tIPqNmrLlwxMNVLelN4wxo

=

X-Google-Smtp-Source: AGHT+IFxdpR0nvzVcbuIc2/TPaRxlS8I2PnmaA5IVdiYglWe8MFXki0gscCT84M78dO0ey+RzVgslJlZoA==

MIME-Version: 1.0

X-Received: by 2002:a05:6e02:2143:b0:3a7:2204:c83e with SMTP id

e9e14a558f8ab-3a7c5562588mr136221795ab.10.1732908528003; Fri, 29 Nov 2024

11:28:48 -0800 (PST)

Message-ID:

Date: Fri, 29 Nov 2024 19:28:48 +0000

Subject: daveyadallee, Get 1,000 More Instagram Followers and 1,000 TIktok

Followers here

From: supattrasangboon@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi daveyadallee, We are from Instasocial. We found your Email

address on your Instagram page @daveyadallee. We Offers Instagram Followers,

Likes and Views services.



Content analysis details: (9.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.166.197 listed in will-spam-for-food.eu.org]

[209.85.166.197 listed in will-spam-for-food.eu.org]

[209.85.166.197 listed in will-spam-for-food.eu.org]

[209.85.166.197 listed in will-spam-for-food.eu.org]

[209.85.166.197 listed in will-spam-for-food.eu.org]

[209.85.166.197 listed in will-spam-for-food.eu.org]

[209.85.166.197 listed in will-spam-for-food.eu.org]

[209.85.166.197 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.166.197 listed in dnsbl.ahbl.org]

[209.85.166.197 listed in dnsbl.ahbl.org]

[209.85.166.197 listed in dnsbl.ahbl.org]

[209.85.166.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.166.197 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.166.197 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.166.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.166.197 listed in dnsbl.ahbl.org]

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[209.85.166.197 listed in psbl.surriel.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.166.197 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[supattrasangboon(at)gmail.com]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} daveyadallee, Get 1,000 More Instagram Followers and 1,000 TIktok

Followers here



Hi daveyadallee,



We are from Instasocial. We found your Email address on your Instagram page

@daveyadallee.



We Offers Instagram Followers, Likes and Views services.



The price is:



-$29 USD for 1,000 Instagram Followers and

- $9 USD For Instagram Post Likes.

- $7 USD For Instagram Video Views



Now you have 1708 Followers, maybe you are Interested?



Aspiring actors, musicians, and performers may seek a substantial following

to attract attention from industry professionals.

It can serve as a digital portfolio showcasing their talent..



You can See all packages here :



https://bestsocialnet.store/



If you have any questions, feel free to ask them here.

I apologize if this message bothers you,





Also, We have Youtube, Tiktok and Twitter services too, Please check it now.

Thank you,

Regards,

Desperation spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 14:05:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH89g-0000000061g-2oPj

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 14:04:00 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 14:04:00 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qt1-f180.google.com ([209.85.160.180]:57683)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH5A7-00000000D4B-1Nud

for root@nk.ca;

Fri, 29 Nov 2024 10:52:20 -0700

Received: by mail-qt1-f180.google.com with SMTP id d75a77b69052e-46679337c24so14999021cf.3

for ; Fri, 29 Nov 2024 09:50:23 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=fp-unila-ac-id.20230601.gappssmtp.com; s=20230601; t=1732902617; x=1733507417; darn=nk.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=i/yBwplXlfd6YYH8gBbvWxsfGHeL8nANiQPMHb7ULBw=;

b=ZjBrHfxzt6p3ysu1L4VrVfdpLDkocxtvgW6iMUKWZE6gr2V6ZfMVvquyouZCe0WPrj

ITz7orA+NfIMHKZojqiONCFrxTeDQgErgvf7A/ouUlsfJtBA26ysf6RoYZCsVQq2RG1n

8azNOHxkruLu6yCa1BIgVCkGEQtT4jyEC9nlFj5pvcWCUjIxXQbhQR8dZv5lJ9bU/Pkh

X8hrCaGskD/C/9n0aL8lbCWjVf0YyeqGixsFbKPeX6HaDWWZXGfR5nCHamUS741zuVKn

fsVQTRfQzMy/UzySxBx28++5OfLFMBmtG7GB1nnHxykU1G35b9mq67OPeV5qq5HMSODz

knNw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732902617; x=1733507417;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=i/yBwplXlfd6YYH8gBbvWxsfGHeL8nANiQPMHb7ULBw=;

b=PPRcXvVhk4q+RvIfd2qV8ysCRCw3a0P97dstF8Wo/G0aX8YczXsvZadsdLm9T9Lv/G

CX4nx85d0IK6ujvOocUWWpRwfLzmHEr4yN6fmdOFYVBY6w8W7/fAQe2xgx8EAhU77upf

h/8Z/vy/piuYdUCr43Sp5Sjb+6l+ZVdltvb4FphPX8vfZY22lgD3eWjxxO8C1myW0gkx

YGo3bw/u1M5TpuHnELVRnrHTy8eVpw/xkQ7+t5Z2lEr1+vZtsU+O7XgG2KHNDo0XBoH7

SvSM0vonxGrzYUHLK+R3I5ay/MJh1ogPQz5vqpGLsfNFwSFXKeT/i74SqVtSK8blvsEl

twWA==

X-Forwarded-Encrypted: i=1; AJvYcCUzxaAzVlQgainJM3XQiUw5d6tI96PYS27E5JNJ9zVF1bT5BWLV48znwiiYCKZ3RnTqenVE@nk.ca

X-Gm-Message-State: AOJu0Yxr/idIUxQMoLB5mTEaXU1TWKdLgQANWoktOwAMZfg61D0vYrdM

Q54M8JxI1ktXAAGEQeeTo2Ven9MIUasrifIGJ3QVxw/wH47RiQBmkzd9aEisvwmVzaJ9t63CG1w

k/NYjxfv5HbmoEfQnnlqRFPa+foWVqHZ/sxgHyg==

X-Gm-Gg: ASbGncv7V+XqOHf8oif3Ns/n7e4bZH6jVNExUPsXKIZ1q6q86byC/lkU/YzwD+4WOSI

25zQc67gyMHkBIv9MThJjQ3k5WLBt6Q==

X-Google-Smtp-Source: AGHT+IFuLGLgPqS1Bqt0+la9t6+eFYvXiUD9yPcpkTETIJhuhJ6fElmGXdVXk0UmjQJJOKpL2Bt4tQ23OKbNoc+lOc0=

X-Received: by 2002:a05:622a:588d:b0:466:84a8:687e with SMTP id

d75a77b69052e-466b3516909mr200067691cf.19.1732902616580; Fri, 29 Nov 2024

09:50:16 -0800 (PST)

MIME-Version: 1.0

Reply-To: konnia4loveth@gmail.com

From: Muhammad Reza

Date: Fri, 29 Nov 2024 17:50:03 +0000

Message-ID:

Subject: hii

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000e45d68062810d45c"

Bcc: root@nk.ca

X-Spam_score: 9.5

X-Spam_score_int: 95

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ¿Recibiste mi correo anterior? Por favor, espero leer tu

correo pronto. Did you receive my previous mail please i wait to read your

mail soon ¿Recibiste mi correo anterior? Por favor, espero leer tu correo

pronto. Did you receive my previous mail please i wait to read your mail

soon



Content analysis details: (9.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.160.180 listed in will-spam-for-food.eu.org]

[209.85.160.180 listed in will-spam-for-food.eu.org]

[209.85.160.180 listed in will-spam-for-food.eu.org]

[209.85.160.180 listed in will-spam-for-food.eu.org]

[209.85.160.180 listed in will-spam-for-food.eu.org]

[209.85.160.180 listed in will-spam-for-food.eu.org]

[209.85.160.180 listed in will-spam-for-food.eu.org]

[209.85.160.180 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.180 listed in dnsbl.ahbl.org]

[209.85.160.180 listed in dnsbl.ahbl.org]

[209.85.160.180 listed in dnsbl.ahbl.org]

[209.85.160.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.180 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.180 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.180 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.180 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.180 listed in wl.mailspike.net]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.5 ONE_WORD_SUBJECT Subject with only one lower-case word

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 HTML_MESSAGE BODY: HTML included in message

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} hii



--000000000000e45d68062810d45c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=C2=BFRecibiste mi correo anterior? Por favor, espero leer tu correo pronto=

.

..................................

Did you receive my previous mail please i wait to read your mail soon



--000000000000e45d68062810d45c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=C2=BFRecibiste mi correo anterior? Por favor, espero leer=

tu correo pronto.
..................................
Did you receive=

my previous mail please i wait to read your mail soon




--000000000000e45d68062810d45c--

Desparation spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 10:53:00 -0700

Received: from mail-qt1-f175.google.com ([209.85.160.175]:57354)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH5A9-00000000D4A-3lKa

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 10:52:21 -0700

Received: by mail-qt1-f175.google.com with SMTP id d75a77b69052e-46689dba2fbso15324551cf.2

for ; Fri, 29 Nov 2024 09:50:23 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=fp-unila-ac-id.20230601.gappssmtp.com; s=20230601; t=1732902617; x=1733507417; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=i/yBwplXlfd6YYH8gBbvWxsfGHeL8nANiQPMHb7ULBw=;

b=rXS5cbJnJsW6WUrExGQ36HaRApI6sOyiFDGkMxxKFoxkxc401DhUQVqV6uZerdI8/G

5V+jXtS/2ph4C/Mv5sOLvrZGYeXZtxuUv2R4Ci48OvEn8d8BIbS4QeLydS/xMxulJN04

YgFP8YoTs+JDVxLHw2qcUyU3ujnlk6R6LHUDZKFWE9KqCYUiOYbhgjIwA18HCYWz9DNM

yQTBGR9WZ1U3Xv9ZB29RNIN3ckoPal6+fJLqZSN9CObr+t6DEXA648xhGzr3Dj5LJW6P

h98Vfs8akCZxIfn4dBlJzVqZj1XGTW59ddWOsLW4dobdYVmQnV1plIU5haKN/Eot2g3h

b8rw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732902617; x=1733507417;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=i/yBwplXlfd6YYH8gBbvWxsfGHeL8nANiQPMHb7ULBw=;

b=UX3wjqBC1QGVTm6iRDuRgaiwEOJXYBT15kvseLEzCeJtPatKZ1WcvKXWXgeKPoMhCC

Py73PAK6gB/0v3jlkADMlp2BGC7cXjlL/CMvVpYu2tBiR4ufxkAdKLHmjdl9ERo94BOl

t+cjc8TwSnL7bz2WG+KuDVLDNlbzln5bJHJaNYJSl5v7aVZdg9zyeA6dd/2Uq+UFa2Cc

1r7JIa4UejuHJPYafdMSFYEad/sP3puenOJ5g3nwG1Km/5u147RDC7UKqomOHSprL1I+

4sI9fMoH6jY2Y8YlX2rZ7I1mZUtI4pyAsnSwZiFp+pi18aDSlUgbke3obnsp5kkq3Ox4

WrEw==

X-Forwarded-Encrypted: i=1; AJvYcCVHXhkcVWoRJnYKNhVila/tnhkSnpxEhtOuhMA++nEzIc6cCj3OogcgY7WyGatbOQGY9JyB@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Yw8XpJyyZAC0x2iSKy+EDRyctsbUyvOHCGcx+eewtg6vyUByvZz

2wf8oJSsjN11HMyQSzY1dpTd7QjJPwQK9ATYn9mFeT6sBjaVP5eSHgH/2bs7NakV8YJDFChcbI0

sPF3eItwPTJGhxhGXeFMs4mara4ap67YgaWXFqQ==

X-Gm-Gg: ASbGnctd9tvLpaFHzhbU69O8wxI99eFJpRrciHuVMo3sR8C3k/vAS2305YutcmBfViH

3Qf1B5ShJMjPprhhg8b87XAj8gIcBTg==

X-Google-Smtp-Source: AGHT+IFuLGLgPqS1Bqt0+la9t6+eFYvXiUD9yPcpkTETIJhuhJ6fElmGXdVXk0UmjQJJOKpL2Bt4tQ23OKbNoc+lOc0=

X-Received: by 2002:a05:622a:588d:b0:466:84a8:687e with SMTP id

d75a77b69052e-466b3516909mr200067691cf.19.1732902616580; Fri, 29 Nov 2024

09:50:16 -0800 (PST)

MIME-Version: 1.0

Reply-To: konnia4loveth@gmail.com

From: Muhammad Reza

Date: Fri, 29 Nov 2024 17:50:03 +0000

Message-ID:

Subject: hii

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000e45d68062810d45c"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ¿Recibiste mi correo anterior? Por favor, espero leer tu

correo pronto. Did you receive my previous mail please i wait to read your

mail soon ¿Recibiste mi correo anterior? Por favor, espero leer tu correo

pronto. Did you receive my previous mail please i wait to read your mail

soon



Content analysis details: (9.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.160.175 listed in will-spam-for-food.eu.org]

[209.85.160.175 listed in will-spam-for-food.eu.org]

[209.85.160.175 listed in will-spam-for-food.eu.org]

[209.85.160.175 listed in will-spam-for-food.eu.org]

[209.85.160.175 listed in will-spam-for-food.eu.org]

[209.85.160.175 listed in will-spam-for-food.eu.org]

[209.85.160.175 listed in will-spam-for-food.eu.org]

[209.85.160.175 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.175 listed in dnsbl.ahbl.org]

[209.85.160.175 listed in dnsbl.ahbl.org]

[209.85.160.175 listed in dnsbl.ahbl.org]

[209.85.160.175 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.175 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.175 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.175 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.175 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.175 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.160.175 listed in wl.mailspike.net]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.5 ONE_WORD_SUBJECT Subject with only one lower-case word

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 HTML_MESSAGE BODY: HTML included in message

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} hii



--000000000000e45d68062810d45c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=C2=BFRecibiste mi correo anterior? Por favor, espero leer tu correo pronto=

.

..................................

Did you receive my previous mail please i wait to read your mail soon



--000000000000e45d68062810d45c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=C2=BFRecibiste mi correo anterior? Por favor, espero leer=

tu correo pronto.
..................................
Did you receive=

my previous mail please i wait to read your mail soon




--000000000000e45d68062810d45c--

Burnout executive spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 14:04:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH89U-0000000060r-3mbd

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 14:03:48 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 14:03:48 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f51.google.com ([209.85.219.51]:60844)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH4ZP-00000000Ba6-3V6C

for root@nk.ca;

Fri, 29 Nov 2024 10:14:24 -0700

Received: by mail-qv1-f51.google.com with SMTP id 6a1803df08f44-6d87fffeb13so10004516d6.1

for ; Fri, 29 Nov 2024 09:12:25 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=themodernzen-co.20230601.gappssmtp.com; s=20230601; t=1732900338; x=1733505138; darn=nk.ca;

h=mime-version:date:subject:to:from:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=g8k8ZbtWGn1wwQqtcAIIFHwilBvO1iW/SFsGrPUwuFc=;

b=jVZzVeHGNQCvIy+cAJGFbYv10iuBZTXQX0hdRUu0ud5HGBSIHN8zLeG8sScrNmKzJA

N9UITUUdvPXNClMPioLZkmiLMVJ2zxMWE2IcwSg7tXt+sul46Gb5FZG8pUyGWxLnTr3R

WRmavcpejgJ6yZxYr3LQYiroljB9Zh3UTOYmvxM5IbXh5mUF/NK0vNNd09OMSA0BJ5Ox

YpBYF8ZdUCZwe2CFyeEhAY1xgtrZ5CH7iEyD1RPlwB8P2mSCJl13Y3D+42zlesGMnuEG

RQ3A0m1qEN2KwhwjEiJyc4EiJlxyJOMXw3UMhDj5GB89fHd7vpOqeFK5euNeRItvfDYn

ojlg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732900338; x=1733505138;

h=mime-version:date:subject:to:from:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=g8k8ZbtWGn1wwQqtcAIIFHwilBvO1iW/SFsGrPUwuFc=;

b=BuXFwlljX47mwnQkZf6YhvhjIfBHU5LKrDifVxeU5GT9+AbK4MRCbnJdOXFmdi7ZS4

kJ1DwA7Wxi7zFZ11chXdSLWPFxto8oXQTjYFSnaD0tr2RFFZPecfZGde0arQELsNSzOJ

v4aREBoBX0P7PSuX1Aq61aNovUfzvklZL+423AmdBKKfx/NkKJz/zfBezB+Ki9Rw4Rj9

EwKYsfh1xVhSKVKD7PS8SHOfP5TBz6BByDPlE+IeJwn0hfQls8Gh0sKcYquS+Nhb3CQy

F0qhbIf+hNMTJspb7rerKksgHl7gPjnwgUaWmn6+S/bQqPi3BsyPXoOl7U6XRB6js554

r9sw==

X-Gm-Message-State: AOJu0Yxi49sVC6f9ZLSmBkUyTWJbrE8/Gsnjx8vt7ebiebQ6aYZyKKWx

41ub2BcFsIk2iIS1IL7KcBCUluIGCBkWQ5ZDL2VZZ3QCRKzRFDR7uWRoA8+MR+hpH8x3oycVjrt

kRi0=

X-Gm-Gg: ASbGnctqt3VDF3+0W+wYFGhNzfXXdKXcXkzpdgm2+dCw4nrxeo/n9lSIssse5FI7tJg

IiU1JJGAkKKMCQxpes+Z/LgnwamMbmy1TidhnZGjNVKvVIcvBLXpn2t0ad7Q3PWK/3ytowdUMQs

BDOVMPHoCJvAGLOHMMWsS/ojwkkyYdUQriZbxc5nZlrtHiUHvPV0WruQDRjPLX4vydc+8yQ28gs

y0Crh0Uba8u4IGVQ/0Oj23vVpIdUqV4Z5EhBUgVCgmrK5gSs5rW5KQ7y5ODm/dWX1/5X+kSAJrq

AaGjsLhsmBFW4DYlImLAPGdveFsX0QAu0gHkKIqEZZHioQptyZ5/MthT/SYKmqE0C5BQZErk

X-Google-Smtp-Source: AGHT+IGQGsN/RqN4yn19l7IqRrDeTe7Kh3lwK63xz3PvTiOZdpY3kqubAILdt1CRKVRqJY/tKdsOwQ==

X-Received: by 2002:a05:6214:21e1:b0:6d4:1b2b:c836 with SMTP id 6a1803df08f44-6d864df756bmr172630816d6.47.1732900337664;

Fri, 29 Nov 2024 09:12:17 -0800 (PST)

Received: from f344c6ab-e364-4549-a321-809d3f26063c.local (ec2-98-81-119-116.compute-1.amazonaws.com. [98.81.119.116])

by smtp.gmail.com with ESMTPSA id 6a1803df08f44-6d881c4d3fcsm10862206d6.28.2024.11.29.09.12.15

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 29 Nov 2024 09:12:16 -0800 (PST)

Content-Type: multipart/alternative;

boundary="--_NmP-94b1e6a3046721da-Part_1"

Message-ID:

From: Ajanta

To: root@nk.ca

Subject: =?UTF-8?Q?Please_Tell_Me_=E2=80=9CNo!=22?=

Date: Fri, 29 Nov 2024 17:12:15 +0000

MIME-Version: 1.0

X-Spam_score: 8.6

X-Spam_score_int: 86

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Dave, I want you to tell me, “No, I don’t need help!”

I love hearing when professionals are thriving and have their stress under

control. But if you’re experiencing burnout, stress, or just feeling [...]





Content analysis details: (8.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[98.81.119.116 listed in will-spam-for-food.eu.org]

[98.81.119.116 listed in will-spam-for-food.eu.org]

[98.81.119.116 listed in will-spam-for-food.eu.org]

[98.81.119.116 listed in will-spam-for-food.eu.org]

[98.81.119.116 listed in will-spam-for-food.eu.org]

[98.81.119.116 listed in will-spam-for-food.eu.org]

[98.81.119.116 listed in will-spam-for-food.eu.org]

[98.81.119.116 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

[209.85.219.51 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.219.51 listed in dnsbl.ahbl.org]

[209.85.219.51 listed in dnsbl.ahbl.org]

[209.85.219.51 listed in dnsbl.ahbl.org]

[209.85.219.51 listed in dnsbl.ahbl.org]

[98.81.119.116 listed in dnsbl.ahbl.org]

[98.81.119.116 listed in dnsbl.ahbl.org]

[98.81.119.116 listed in dnsbl.ahbl.org]

[98.81.119.116 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.219.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.219.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.219.51 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.219.51 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.219.51 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.51 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} =?UTF-8?Q?Please_Tell_Me_=E2=80=9CNo!=22?=



----_NmP-94b1e6a3046721da-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Hi Dave,



I want you to tell me, =E2=80=9CNo, I don=E2=80=99t need help!=

=E2=80=9D I love hearing when professionals are thriving and have their =

stress under control. But if you=E2=80=99re experiencing burnout, stress, =

or just feeling stuck in your career, let=E2=80=99s have a chat.=C2=A0



I=E2=80=99ve helped corporate professionals boost their productivity by up =

to 80%, regain their energy, and rebuild career confidence in just 90 days.=

=C2=A0



If that sounds like something you=E2=80=99d like, say =

=E2=80=9CYes=E2=80=9D and book a free Stress DNA consultation. I promise =

this call will be a turning point.



Book your consultation:=C2=A0https://th=

emodernzen.com/booking https://chainparthenprox.com/lt/1125899960363531/9sY=

gZWsBTKw_YTYYBbJfC





Ajanta

Founder "The Modern Zen"

peaceful progress possible.



--

----_NmP-94b1e6a3046721da-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Hi Dave,

I want you to tell me, “No, I don’t need =

help!” I love hearing when professionals are thriving and have their =

stress under control. But if you’re experiencing burnout, stress, or =

just feeling stuck in your career, let’s have a chat.=

 

I’ve helped corporate professionals boost their =

productivity by up to 80%, regain their energy, and rebuild career =

confidence in just 90 days. 

If that sounds like something =

you’d like, say “Yes” and book a free Stress DNA =

consultation. I promise this call will be a turning point.

Book your=

consultation: 
com/lt/1125899960363531/9sYgZWsBTKw_YTYYBbJfC" target=3D"_blank">https://th=

emodernzen.com/booking


Ajanta
Founder "The=

Modern Zen"
peaceful progress possible.



bJfC.png' alt=3D'line'>

----_NmP-94b1e6a3046721da-Part_1--

Web / SEO / App spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 29 Nov 2024 06:47:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH1K7-000000000yO-0Qtb

for dave@doctor.nl2k.ab.ca;

Fri, 29 Nov 2024 06:46:19 -0700

Resent-From: The Doctor

Resent-Date: Fri, 29 Nov 2024 06:46:19 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pg1-f177.google.com ([209.85.215.177]:58383)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tH0gR-00000000Oxi-1DQb

for sales@nk.ca;

Fri, 29 Nov 2024 06:05:25 -0700

Received: by mail-pg1-f177.google.com with SMTP id 41be03b00d2f7-7e9e38dd5f1so1387352a12.0

for ; Fri, 29 Nov 2024 05:03:25 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=oxigensoft.com; s=google; t=1732885399; x=1733490199; darn=nk.ca;

h=thread-index:content-language:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=lQCVEkF5WWFqmnbH7fcwriXsIWd6y8J1Irlx61VvLhk=;

b=c6yuex0MxjubjVtSeQ2sBTwk1MkFLYJfJoV7xg0KWJ1yTNtRtigDyQ09S8swv8ffjM

L6leTD/bxB76Tgv2WYUiIBAyaW3fHlQ7i/ElRLKSCuI0/J2aal9afr/7gpaZ6DeSysoH

knSrptDYo6zExe6t4n+F4An4JdpswUY1U2N6I=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732885399; x=1733490199;

h=thread-index:content-language:mime-version:message-id:date:subject

:to:from:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=lQCVEkF5WWFqmnbH7fcwriXsIWd6y8J1Irlx61VvLhk=;

b=F36b728O++N496i2dbRwicyyrTJBn4KSpD4lD9IuKClyn+p6TT++iw0ltrLG5IVAH8

Ah0fYuw62wfYrgCTvEofv9WUlcsTL9S4x6p+du6/dpDypXOzR056XkEABPK4BpbBhbpb

DT+15LSfWJYz3IJOIS4qmZhnmUbhB4UsfztCKj6MbgnBf6hjqC/X079++lSm3wHnsvlB

zipB+VCukoF0HzHkrs0XUeN7do9Fsbqv9TQ2df+ASQfpA3kWBNjL6zyIiVETkXBtec1e

g9WGmeseyuDCDXJ4zMtOM2pwY9BlVLyYUtUB6jtnxXK1R+w9CLJslaB4juPysTTlMHxO

ppFw==

X-Gm-Message-State: AOJu0YycMBaMXY2tL6hoHeWBip/irrWkg4FijHCM9hTdy2f763//S6JC

muTYhfhyUgPL4KXsu+dz61vOtUeA78zzYYurXUkpYtXhoNi6oFVCNkBdrKwIGq+MdIOdlDSb1Vv

l

X-Gm-Gg: ASbGncsnKieu/8eqmbC+L+G7ULDkAWnLnsdT2Nb8MJ0+RhJUCo2bufVSwjUHWbnYEvu

FVsV7tGBYF8NCd8gCxQuomNI81g3X3pvFS5Ze7qx+nBSYq2GXjLGA3BFLkYVanJ9/8JmIr7X2ye

Y7cwfNQgPkB09EBd11pp7S+a0TqRu8g0TXMx8ZVmnqy4r0jEoYbJUMsYBbMUD/h+GTduyf3PNXm

RqG8yhhHwidYS+UOrVs07Cjr9Q=

X-Google-Smtp-Source: AGHT+IECSuEtljFOZxr3javornJqKHTKqxzDaBP3J2o6Dzskw+ODeSisU+e42lfyVlmFDb+h3Mlxwg==

X-Received: by 2002:a05:6a20:6f8f:b0:1e0:be48:1797 with SMTP id adf61e73a8af0-1e0e0ab4b2emr16370470637.3.1732885399457;

Fri, 29 Nov 2024 05:03:19 -0800 (PST)

Received: from vicPC ([103.46.201.14])

by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-7fc9c2e6e79sm2976384a12.25.2024.11.29.05.03.17

for

(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);

Fri, 29 Nov 2024 05:03:19 -0800 (PST)

From: "Neelam"

To:

Subject: Let's Discuss- SEO

Date: Fri, 29 Nov 2024 17:57:21 +0530

Message-ID: <122a501db425e$f152b510$d3f81f30$@com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_122A6_01DB428D.0B0AF110"

X-Mailer: Microsoft Office Outlook 12.0

Content-Language: en-us

Thread-Index: AdtCOPB6097BLDpTTvqrJq/0YXELDA==

X-Spam_score: 9.2

X-Spam_score_int: 92

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I found your website I would like to discuss SEO, I can

help your website to get on the first page of Google and increase the number

of leads and sales you are getting from your website.



Content analysis details: (9.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.46.201.14 listed in will-spam-for-food.eu.org]

[103.46.201.14 listed in will-spam-for-food.eu.org]

[103.46.201.14 listed in will-spam-for-food.eu.org]

[103.46.201.14 listed in will-spam-for-food.eu.org]

[103.46.201.14 listed in will-spam-for-food.eu.org]

[103.46.201.14 listed in will-spam-for-food.eu.org]

[103.46.201.14 listed in will-spam-for-food.eu.org]

[103.46.201.14 listed in will-spam-for-food.eu.org]

[209.85.215.177 listed in will-spam-for-food.eu.org]

[209.85.215.177 listed in will-spam-for-food.eu.org]

[209.85.215.177 listed in will-spam-for-food.eu.org]

[209.85.215.177 listed in will-spam-for-food.eu.org]

[209.85.215.177 listed in will-spam-for-food.eu.org]

[209.85.215.177 listed in will-spam-for-food.eu.org]

[209.85.215.177 listed in will-spam-for-food.eu.org]

[209.85.215.177 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.215.177 listed in dnsbl.ahbl.org]

[209.85.215.177 listed in dnsbl.ahbl.org]

[209.85.215.177 listed in dnsbl.ahbl.org]

[209.85.215.177 listed in dnsbl.ahbl.org]

[103.46.201.14 listed in dnsbl.ahbl.org]

[103.46.201.14 listed in dnsbl.ahbl.org]

[103.46.201.14 listed in dnsbl.ahbl.org]

[103.46.201.14 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.215.177 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.215.177 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.215.177 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.215.177 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.215.177 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.46.201.14 listed in sbl-xbl.spamhaus.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.215.177 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Let's Discuss- SEO



This is a multipart message in MIME format.



------=_NextPart_000_122A6_01DB428D.0B0AF110

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,



I found your website I would like to discuss SEO,



I can help your website to get on the first page of Google and increase the

number of leads and sales you are getting from your website.



Please email us back. I can send you our Portfolio/Packages (low Cost)/more

info.



Best Regards,

Neelam,







































PS- If you no longer wish to receive emails from us, kindly reply to this

email with the subject line "REMOVE" or "UNSUBSCRIBE," and we will promptly

remove your email address from our mailing list. Please allow up to 48 hours

for the changes to take effect.









------=_NextPart_000_122A6_01DB428D.0B0AF110

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">






charset=3Dus-ascii">




















style=3D'font-size:11.5pt;

font-family:"Cambria","serif";color:#244061;background:white'>Hi,
<=

span

style=3D'color:#222222'>






style=3D'font-size:11.5pt;

font-family:"Cambria","serif";color:#244061;background:white'>I found =

your

website I would like to discuss SEO,

style=3D'color:#222222'>






style=3D'font-size:11.5pt;

font-family:"Cambria","serif";color:#244061;background:white'>I can help =

your

website to get on the first page of Google and increase the number of =

leads and

sales you are getting from your website.

style=3D'color:#222222'>






style=3D'font-size:11.5pt;

font-family:"Cambria","serif";color:#244061;background:white'>Please =

email us

back. I can send you our Portfolio/Packages (low Cost)/more =

info.

style=3D'color:#222222'>






style=3D'font-size:11.5pt;

font-family:"Verdana","sans-serif";color:#244061;background:white'>Best

Regards,



color:#244061;background:white'>Neelam

style=3D'font-size:11.5pt;font-family:"Verdana","sans-serif";color:#24406=

1;

background:white'>,

style=3D'color:#222222'>






style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";

color:#222222'> 

style=3D'color:#222222'>






style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";

color:#222222'> 

style=3D'color:#222222'>






style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";

color:#222222'> 

style=3D'color:#222222'>






style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";

color:#222222'> 

style=3D'color:#222222'>






style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";

color:#222222'> 

style=3D'color:#222222'>






style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";

color:#222222'> 

style=3D'color:#222222'>






style=3D'font-size:11.5pt;font-family:"Verdana","sans-serif";

color:#222222'> 

style=3D'color:#222222'>






style=3D'font-size:11.5pt;font-family:"Verdana","sans-serif";

color:#222222'> 






style=3D'font-size:11.5pt;font-family:"Verdana","sans-serif";

color:#222222'>






style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";

color:#222222'>PS- If you no longer wish to receive emails from us, =

kindly

reply to this email with the subject line 

style=3D'font-size:

11.5pt;font-family:"Calibri","sans-serif";color:red'>"REMOVE" =

or

"UNSUBSCRIBE,"

style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";

color:#222222'> and we will promptly remove your email address from =

our

mailing list. Please allow up to 48 hours for the changes to take =

effect.

style=3D'color:#222222'>






style=3D'line-height:107%'> 

















------=_NextPart_000_122A6_01DB428D.0B0AF110--



RBC PHish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 28 Nov 2024 13:58:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGlZm-00000000EaW-2d2X

for dave@doctor.nl2k.ab.ca;

Thu, 28 Nov 2024 13:57:26 -0700

Resent-From: The Doctor

Resent-Date: Thu, 28 Nov 2024 13:57:26 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f48.google.com ([209.85.218.48]:53393)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGiiD-00000000Nhv-134D

for root@nl2k.ab.ca;

Thu, 28 Nov 2024 10:54:01 -0700

Received: by mail-ej1-f48.google.com with SMTP id a640c23a62f3a-aa532dcb470so61649866b.2

for ; Thu, 28 Nov 2024 09:52:10 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1732816322; x=1733421122; darn=nl2k.ab.ca;

h=date:to:from:subject:mime-version:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=HEf44/l6PiFzRURH3Fp3+O+bIFugP/f77rgIjBnVuPI=;

b=KpYNHh8sxL9Y4ET1SIDnRZWUMyc+lj8sQf6DDxfcDbRJrdrjb8COYRg7DB3UoHH/Eo

uHsO//3uZNtvFUvq718/7yaCt+X+CSbeK5iKa6/yePgefMF4SGw6HhyNZG4pC6PPMDTN

SU5sbsoW7q74IACYErk3jZSllZUR+9a1cg6+/KiLxSb2nB9ChHx5EIu8luhTRuaD9rMc

J1DVEOPsHx0x7qozN18NIUhaQZu5BhLiGj+s6UMseTy4wXPx3qMksyJFaTGn9LhAl+Og

M9oJgxnV8yorcoPh8DbZ/5zBdCydtknM+4CT+lyXKTL+WY5EM1NqKEmhxJCUVUmeOW5M

braw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732816322; x=1733421122;

h=date:to:from:subject:mime-version:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=HEf44/l6PiFzRURH3Fp3+O+bIFugP/f77rgIjBnVuPI=;

b=FeAd7uOpgZAeyIMQH6C6XYkcbOE+ZJWfcRlCa6MMz/NQLCvJbMMm3xIl+XLf3Zyfid

f08wWSJDnCRYoftjFlUAF4F43sajhP73n3zuOk1/gm5v/Xxa7PLdIT8AeJbMnjpFAbTm

4Y6nQ0yMgTNtlUQ7kZsAq2PNbV26hG42oMbSqWrcpitYKjJClKekR5lsnsWnMkuhloMi

+klaITLzkZBayLAF+ZdUpsOF9WLFPjAtfhA4a46wz3TZ9gU8EzZITA7+LXSgHJEggMHC

Z4LrVtTUkbTkVKYoszBw2zh5OntMKzvhtoIFIYNP5C9rmyuo7BM1n5STl3QQu4SWwbCR

pe3w==

X-Gm-Message-State: AOJu0YwOQP3pGbsBjzz5M5V5lktF91F7IwOQamC/f0PpV99hDnKcapX/

Z0Fk0mX4oWMJ52KiUW/NGknvE6VsV+Zoy0WGgTq+nuWEb0DiIoQCTWZXEw==

X-Gm-Gg: ASbGnctet45gT8oQIK03gxUDFAWV4DLFl17vG13hh9+6Jf/tCCObZuLxYUiekYaGXeI

s1R+JbzJ3v5Kf0l1GWD09I+ybUhvV84inWbv9ZHcIj0eFb0DvXLj1t+TM0zlqc+gxKdwoIWHqm8

BTOjVqdAZVRGr6fKVH8lmXoAAAHvLGN1KF2+qp1Yu6KnLePu5c7S14Vs8e/TTK5GMz8A9X1JxqV

LL8Tcn/O65rrynoAEU1BKYZx3Aurjohqse6T/UoUcSGBVB38is=

X-Google-Smtp-Source: AGHT+IHoIufc/ESdi0KrMs9ZwjYjQm4IQTliI6C+4MB3yoHM4a3eJ0FS1YUboPoxjeOQY2aCLJLekQ==

X-Received: by 2002:a05:6402:402a:b0:5d0:9054:b119 with SMTP id 4fb4d7f45d1cf-5d09054b1d4mr6902738a12.21.1732816322438;

Thu, 28 Nov 2024 09:52:02 -0800 (PST)

Received: from rbc-pc ([2a03:94e3:231b:4b15:876a:f240:e65a:d254])

by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-5d097dd690dsm970935a12.46.2024.11.28.09.52.01

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 28 Nov 2024 09:52:02 -0800 (PST)

Message-ID: <6748adc2.500a0220.e739c.4396@mx.google.com>

Content-Type: multipart/mixed; boundary="===============6015699579118558816=="

MIME-Version: 1.0

Subject: Time to verify your email address

From: RBC Royal Bank

To: root@nl2k.ab.ca

Date: Thu, 28 Nov 2024 09:52:00 -0800

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear RBC Bank Client, The following RBC Bank e-Alert(s) is(are)

available: Confirm your email address to finalize your verification



Content analysis details: (7.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

[209.85.218.48 listed in dnsbl.ahbl.org]

[209.85.218.48 listed in dnsbl.ahbl.org]

[209.85.218.48 listed in dnsbl.ahbl.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in dnsbl.ahbl.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in dnsbl.ahbl.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in dnsbl.ahbl.org]

[2a03:94e3:231b:4b15:876a:f240:e65a:d254 listed]

[in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.48 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.218.48 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[dahiruyauba5(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[dahiruyauba5(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

Subject: {SPAM?} Time to verify your email address



--===============6015699579118558816==

Content-Type: multipart/related; boundary="===============4290740746946701581=="

MIME-Version: 1.0



--===============4290740746946701581==

Content-Type: multipart/alternative; boundary="===============2630340500869453248=="

MIME-Version: 1.0



--===============2630340500869453248==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBXMyBIVE1MLy9FTiI+PGh0bWw+Cjxo

ZWFkPgo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsg

Y2hhcnNldD1pc28tODg1OS0xIj48L2hlYWQ+Cjxib2R5PgoJCglEZWFyIFJCQyBCYW5rIENsaWVu

dCw8YnI+PGJyPgoKVGhlIGZvbGxvd2luZyBSQkMgQmFuayBlLUFsZXJ0KHMpIGlzKGFyZSkgYXZh

aWxhYmxlOjxicj4KCTxicj4KQ29uZmlybSB5b3VyIGVtYWlsIGFkZHJlc3MgdG8gZmluYWxpemUg

eW91ciB2ZXJpZmljYXRpb248YnI+Cgk8YnI+ClRvIGVuc3VyZSB1bmludGVycnVwdGVkIHNlcnZp

Y2UsIGNvbmZpcm0geW91ciBlbWFpbCBhZGRyZXNzIGZvbGxvd2luZyBvdXIgcmVjZW50IHNlY3Vy

aXR5IHVwZGF0ZS48YnI+Cgk8YnI+ClRvIGZpbmFsaXplIHRoZSB2ZXJpZmljYXRpb24gcHJvY2Vz

cywgbG9nIGluIHRvIFJCQyBPbmxpbmUgQmFua2luZyB0aHJvdWdoIHRoZSBsaW5rIGJlbG93OgoJ

PGJyPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly90YXVucWtwZi5ibG9nc3BvdC5jb20vIj5WYWxpZGF0

ZSBhbmQgY29uZmlybSB5b3VyIGVtYWlsPC9hPjxicj4KCgk8YnI+UGVyc29uYWxpemUgeW91ciBl

bWFpbCBub3RpZmljYXRpb24gb3B0aW9ucyBpbiBSQkMgT25saW5lIEJhbmtpbmcsIHNlbGVjdCAm

cXVvdDtQcm9maWxlIGFuZCBQcmVmZXJlbmNlcyZxdW90OyB3aXRoaW4gdGhlIEJhbmtpbmcgc2Vj

dGlvbiB1bmRlciBNeSBBY2NvdW50cy48YnI+PGJyPgoKCURvIG5vdCBzZW5kIHByaXZhdGUgaW5m

b3JtYXRpb24gdGhyb3VnaCByZWd1bGFyIGVtYWlsLCBhcyBpdCBpcyBub3Qgc2VjdXJlLiBVc2Ug

dGhlIHNlY3VyZSBSQkMgUm95YWwgQmFuayBPbmxpbmUgQmFua2luZyBtZXNzYWdlIGNlbnRlciB0

byBzYWZlbHkgY29tbXVuaWNhdGUgd2l0aCB1cywgb3IgY29udGFjdCB1cyBieSA8YSBocmVmPSIj

Ij5waG9uZTwvYT4uPGJyPjxicj4KCglPdXRzaWRlIENhbmFkYSBhbmQgdGhlIFUuUy46ICBDYWxs

IHVzIHVzaW5nIG91ciA8YSBocmVmPSIjIj5JbnRlcm5hdGlvbmFsIFRvbGwtRnJlZSBTZXJ2aWNl

czwvYT4KCglUaGlzIGlzIGFuIGF1dG9tYXRlZCBtZXNzYWdlIHNlbnQgZnJvbSBhbiB1bm1vbml0

b3JlZCBlbWFpbCBhZGRyZXNzLiBSZXBsaWVzIHdpbGwgbm90IGJlIHJlYWQuPGJyPjxicj4KCgle

UkJDIEJhbmsgaXMgb2ZmZXJlZCBieSBSb3lhbCBCYW5rIG9mIENhbmFkYS4KCgk8L2JvZHk+Cjwv

aHRtbD4=



--===============2630340500869453248==--



--===============4290740746946701581==--



--===============6015699579118558816==--

Work stress from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 28 Nov 2024 13:58:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGlZO-00000000EZt-0Aou

for dave@doctor.nl2k.ab.ca;

Thu, 28 Nov 2024 13:57:02 -0700

Resent-From: The Doctor

Resent-Date: Thu, 28 Nov 2024 13:57:02 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f174.google.com ([209.85.222.174]:52669)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGhsY-00000000LoR-20DS

for root@nk.ca;

Thu, 28 Nov 2024 10:00:39 -0700

Received: by mail-qk1-f174.google.com with SMTP id af79cd13be357-7b150dc7bc0so78713285a.1

for ; Thu, 28 Nov 2024 08:58:39 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=themodernzen-co.20230601.gappssmtp.com; s=20230601; t=1732813113; x=1733417913; darn=nk.ca;

h=mime-version:date:subject:to:from:references:in-reply-to:message-id

:from:to:cc:subject:date:message-id:reply-to;

bh=BUVAAlnjNHvULMe7/KyH4f2FsiD6leUWfUJKK8bg5bw=;

b=1BSib4nIl+ShvEgvnKV6W2g9nBD7m1jLweaw2MpvbXZTAJ+G0cHnByt8nJwYtGmdv8

I8MHfRA6D7RYLj+/seGLWXDbsZZGfd8wHvdGkWMwVy7nfC/cv0/i3OZYzPyYxVly57py

2bXbywYCUgFaSARglItYx7YNavf/YGTCXBm8C5vp5nwXHY31aIKvfhBpj6x2GI5pUeZp

5LzMNZotpF7U9QQnLROZNlQRdaiPeBNBHcxlrlA5hXlTYAzwJN7vcGIItAp/6Xjo1ssT

UhmB7aadlU27yMKMGF7VYlddaZiEjQK/w1GPL+dRAXsnX0jhTBPI+snzVnAEOVB0lL6e

lyAQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732813113; x=1733417913;

h=mime-version:date:subject:to:from:references:in-reply-to:message-id

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=BUVAAlnjNHvULMe7/KyH4f2FsiD6leUWfUJKK8bg5bw=;

b=dF15RUMsxgp5kE4FBYNtvtpvXhXtMTdIMwnsA9MZiNYvLoyfa7yp+O0zMM2gyCJPzg

FjlF7u09oTtLjUlIYQ3xIoZwr46Vb7l27S0pNYk1ZIISE4e8OEdc1bfJexWoRNKeh/sz

7Ya1R2PLLouJFreMu3aMW5uaWOUliXeoMlYstWP7WSSWr80MTCd+cxhK4n1wgC5FiCC8

qCgA08CVzuHct0dSB54F/M1UdUUm7+ez2ShUYSJ0x1lM/YUO9mduFkYVQln7A6CJy5yY

7JkXl6Oj24tiQG52HcwwfLv1U+4kG82odEffuq4iiSl1gebodS/WmRrLa1KvtvfDwGjW

Jo5A==

X-Gm-Message-State: AOJu0YyF6R+JOVe4DfyMnhIQFC4Xy0G2Sh7OksSHuQSXGT1sD5lTxI2X

T/cSxfls5S5mx8IuWdtF8p+2byR5ofd4jvFYL+zKgvV/C3AavdMtQ5Ae9LFtNNhqUC4l11CWCti

OeMc=

X-Gm-Gg: ASbGncsylIsLQEPuYW5Icq9gKtdLllSJoNwhDasZgdc1MoVvQjs1sWrGKzRH/E8zXP1

2P/0MJ+dCW2e8YEFNYHHwLUokVXc4bkJ5fNyOVhA8MIE19uM1H09UO8D8ZDbUkOTeI3rIh26mC2

x7qNf+ES5hDIU5uJeLFnlmoDJO2C/8/z6mEomfAcYxDZCMAgn4IQpGQy803AK6Kg21TnrosD2Q9

uTqGRGw8J9JrZATY95jH7Aic4AHc6Hy07fPMwbPDQSD8hrzgrXcMU7KNH1upbZVdUJG2FUl0DfZ

dAyNFwrjSZbLnkr+YmGvcGtpV9mi1CoX0BXxSkcnb/X94QPVRPSHK0Uhzr7n8po2wvYASjL+63w

=

X-Google-Smtp-Source: AGHT+IHLtsHm2AB7FVGcgVk7n/7JeZ+8S2gKQxD+1a7cEO30DtPVX3FgG9IAEgxTk5E474blDNPVng==

X-Received: by 2002:a05:620a:4492:b0:7b6:6c33:994e with SMTP id af79cd13be357-7b67c25054emr1081346885a.6.1732813112764;

Thu, 28 Nov 2024 08:58:32 -0800 (PST)

Received: from 64aa8fc9-fcca-453f-8c75-e24a9dbfc1cf.local (ec2-18-213-150-180.compute-1.amazonaws.com. [18.213.150.180])

by smtp.gmail.com with ESMTPSA id af79cd13be357-7b6849aabbfsm71518485a.82.2024.11.28.08.58.32

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 28 Nov 2024 08:58:32 -0800 (PST)

Content-Type: multipart/alternative;

boundary="--_NmP-41cce5cc4799b9aa-Part_1"

Message-ID: <64aa8fc9-fcca-453f-8c75-e24a9dbfc1cf@themodernzen.co>

In-Reply-To:

References:

From: Ajanta

To: root@nk.ca

Subject: Re: Feeling Stuck at Work?

Date: Thu, 28 Nov 2024 16:58:31 +0000

MIME-Version: 1.0

X-Spam_score: 10.8

X-Spam_score_int: 108

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Dave, Have you ever felt that despite working long hours,

your productivity still isn’t where it should be? The consequences of low

productivity can ripple through every area of your life: from missed promotions

and opportunities to constant stress and overwhelm.



Content analysis details: (10.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[18.213.150.180 listed in will-spam-for-food.eu.org]

[18.213.150.180 listed in will-spam-for-food.eu.org]

[18.213.150.180 listed in will-spam-for-food.eu.org]

[18.213.150.180 listed in will-spam-for-food.eu.org]

[18.213.150.180 listed in will-spam-for-food.eu.org]

[18.213.150.180 listed in will-spam-for-food.eu.org]

[18.213.150.180 listed in will-spam-for-food.eu.org]

[18.213.150.180 listed in will-spam-for-food.eu.org]

[209.85.222.174 listed in will-spam-for-food.eu.org]

[209.85.222.174 listed in will-spam-for-food.eu.org]

[209.85.222.174 listed in will-spam-for-food.eu.org]

[209.85.222.174 listed in will-spam-for-food.eu.org]

[209.85.222.174 listed in will-spam-for-food.eu.org]

[209.85.222.174 listed in will-spam-for-food.eu.org]

[209.85.222.174 listed in will-spam-for-food.eu.org]

[209.85.222.174 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.174 listed in dnsbl.ahbl.org]

[209.85.222.174 listed in dnsbl.ahbl.org]

[209.85.222.174 listed in dnsbl.ahbl.org]

[209.85.222.174 listed in dnsbl.ahbl.org]

[18.213.150.180 listed in dnsbl.ahbl.org]

[18.213.150.180 listed in dnsbl.ahbl.org]

[18.213.150.180 listed in dnsbl.ahbl.org]

[18.213.150.180 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.174 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.174 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.174 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.174 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.174 listed in list.dnswl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[18.213.150.180 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.174 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

1.0 OPT_OUT BODY: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Re: Feeling Stuck at Work?



----_NmP-41cce5cc4799b9aa-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Hi Dave,





Have you ever felt that despite working long hours, your =

productivity still isn=E2=80=99t where it should be?=C2=A0



The consequences of low productivity can ripple through every area of your =

life: from missed promotions and opportunities to constant stress and =

overwhelm.



Many of my clients felt stuck overwhelmed by their workload, =

suffering from burnout, and struggling to advance in their careers. But =

within just 90days, they increased their productivity by up to 80%, =

allowing them to take back control of their careers, regain balance, and =

finally start seeing the results they=E2=80=99ve been working for.



One of my clients, Rob, was able to overcome procrastination and self-doubt=

, which not only boosted his productivity but also led to faster =

decision-making and job security.



If you=E2=80=99re ready to stop feeling =

stuck and start performing at your highest level, I=E2=80=99d love to offer=

you a free Stress DNA Consultation where we can explore how to increase =

your productivity and reduce burnout so you can start thriving both in your=

personal and professional life.



Book your consultation:=C2=A0https://them=

odernzen.com/booking https://proxsclimmed.com/lt/1125899960363531/EaUi0WALI=

gpzaWwzIsn7h





Ajanta

Founder "The Modern Zen"

peaceful progress possible.





Reply "STOP" to OPT-OUT!







On Wed, November 27, 2024 6:01 PM, Ajanta =



[ajanta@themodernzen.co]> wrote:



> Hi Dave,

>=20

> Are you feeling stuck, overwhelmed, or burnt out at work? Stress and =

anxiety can significantly impact your career performance, and it=E2=80=99s =

easy to lose control over your workload.=C2=A0

>=20

> I help corporate professionals like you not only overcome burnout but =

also improve productivity by up to 80%.=C2=A0

>=20

> Imagine being able to =

regain focus, reduce anxiety, and enjoy your work again. If that sounds =

like something you=E2=80=99re looking for, I=E2=80=99d love to offer you a =

free consultation to explore how we can make that happen.=C2=A0

>=20

> Ajanta

> Founder "The Modern Zen"

> peaceful progress possible.

>=20

> Don't want any more emails? https://proxvestralheard.=

com/unsub/1/2aa48120-fa3a-482d-8487-4f3f6c798daa

>=20

>=20

>=20

>=20

>=20

>=20

>



--

----_NmP-41cce5cc4799b9aa-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Hi Dave,

Have you ever felt that despite working =

long hours, your productivity still isn’t where it should be?=

 

The consequences of low productivity can =

ripple through every area of your life: from missed promotions and =

opportunities to constant stress and overwhelm.

Ma=

ny of my clients felt stuck overwhelmed by their workload, suffering from =

burnout, and struggling to advance in their careers. But within just 90days=

, they increased their productivity by up to 80%, allowing them to take =

back control of their careers, regain balance, and finally start seeing the=

results they’ve been working for.

One of my=

clients, Rob, was able to overcome procrastination and self-doubt, which =

not only boosted his productivity but also led to faster decision-making =

and job security.

If you’re ready to stop =

feeling stuck and start performing at your highest level, I’d love to=

offer you a free Stress DNA Consultation where we can explore how to =

increase your productivity and reduce burnout so you can start thriving =

both in your personal and professional life.
Ajanta
Founder "The Modern =

Zen"
peaceful progress possible.


Reply=

"STOP" to OPT-OUT!




com/signature/images/EaUi0WALIgpzaWwzIsn7h.png' alt=3D'line'>



On Wed, November 27, 2024 6:01 PM, Ajanta =

<
target=3D"_blank">ajanta@themodernzen.co
>
wrote:



8ex;border-left:1px #ccc solid;padding-left:1ex">



Hi Dave,

Are you =

feeling stuck, overwhelmed, or burnt out at work? Stress and anxiety can =

significantly impact your career performance, and it’s easy to lose =

control over your workload. 

I help corporate professionals =

like you not only overcome burnout but also improve productivity by up to =

80%. 

Imagine being able to regain focus, reduce anxiety, and =

enjoy your work again. If that sounds like something you’re looking =

for, I’d love to offer you a free consultation to explore how we can =

make that happen. 

Ajanta
Founder "The Modern =

Zen"
peaceful progress possible.













----_NmP-41cce5cc4799b9aa-Part_1--

Canadian Who's Who spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 28 Nov 2024 13:57:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGlYz-00000000EYB-1YP4

for dave@doctor.nl2k.ab.ca;

Thu, 28 Nov 2024 13:56:37 -0700

Resent-From: The Doctor

Resent-Date: Thu, 28 Nov 2024 13:56:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yb1-f206.google.com ([209.85.219.206]:41151)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGhGU-00000000KTu-10Xv

for sales@nk.ca;

Thu, 28 Nov 2024 09:21:18 -0700

Received: by mail-yb1-f206.google.com with SMTP id 3f1490d57ef6-e396de93fd2so184561276.0

for ; Thu, 28 Nov 2024 08:19:19 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=wcbrb.com; s=google; t=1732810753; x=1733415553; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=cynhIlOMvdPn14UwFAeiaHk74y44eQXVdW6YyoD96Yg=;

b=XwGF6HJc0AeMCl7zB2CNrYpdVFnDKPqpZmF5+ZVd8wbLXUeCP8X/r5oXRQ/XQz6L4i

f1nw47v5vxG+na/8mtPH0sOdTHh4Iq6os5tR4nUXd19iRq6v98N4syFUSmJiOMl5Pq0/

YfNJ3gcUQ6P2ukfkz4e0Pf6rS+B+u1A5CHscK6CnXrnfSUeJWhEtU7QbIg7Y01/bUR91

egKDRcYv64MqUH5P/TCCF60l3Nm5XSbdeWZbOkeFXLaJvU6lEbxm3BpbGqMBtR/VvgCO

/8QNEdhxjThi1P+rq/WQc5u/mbBtkUrhBibvJINrIRarqz0/RUieiEpshePoubT/msrz

xFZg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732810753; x=1733415553;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=cynhIlOMvdPn14UwFAeiaHk74y44eQXVdW6YyoD96Yg=;

b=bzeRpxeeaMQiL1S0GSYQA6x4ou5LOkDKy1Dzvk6wwPpuc5GnwkOijDcljdJGoq/bBM

dTtvuVmQANbMUisCLvzW4uBAIpuUJOVt40rxHBPodKjRzkKZz9C1/PYLPyY5TQhqDM1i

ELxA144jbr9WM57wBAHMdI6LwKU30zLgkIhWu69D6mlH9WZox6P0OwPgCgI8RBzfrRSr

MAH4vCWXulD9oUrx77dgKVWeyLZtDO0KauINxOUq8sMBMp3tf1tXU1x/QVHOcY/AXHyb

IfU6Nxaxz15zsn0me1D6HqH41AkzDUbhhHAB/NsEXnh+rMGKni/8Bq/URanU4xYKJUch

J5cw==

X-Gm-Message-State: AOJu0YzbvZ3nT1WLkdKkhoUmTXR4oZRFo15DDIobfevxvrIKLBmMBJ7t

qIJJ2AYdiIe/uw0EM8DZLaAaXMr6oFR97MtQ4bNG/AVfWubhNkkQ9OOXytMLDcX6yteoXM4h0ll

ZNkGcRajVw8/td6/23UVi

X-Google-Smtp-Source: AGHT+IEDBosIxiDo/PLFLR+6ja4VGqVDBBORk4x9bBhsyNQEqCf4ZYo4074hLHN1FRu5gWnC1q6adHA9Tw==

MIME-Version: 1.0

X-Received: by 2002:a05:690c:470b:b0:6e7:32a5:6566 with SMTP id

00721157ae682-6ef372106b3mr22344447b3.4.1732810753426; Thu, 28 Nov 2024

08:19:13 -0800 (PST)

Message-ID:

Date: Thu, 28 Nov 2024 16:19:13 +0000

Subject: Synergy selected for CBRB Best Businesses In Canada 2024

From: canadareview@wcbrb.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 7.1

X-Spam_score_int: 71

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Congratulations on being selected and approved for

the CBRB Best Businesses In Canada 2024. CBRB Canadian Business Review Board

assesses and evaluates all the businesses in Canada and verifies only the

top businesses for meeting the CBRB Canadian Business Review Standards.



Content analysis details: (7.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.219.206 listed in will-spam-for-food.eu.org]

[209.85.219.206 listed in will-spam-for-food.eu.org]

[209.85.219.206 listed in will-spam-for-food.eu.org]

[209.85.219.206 listed in will-spam-for-food.eu.org]

[209.85.219.206 listed in will-spam-for-food.eu.org]

[209.85.219.206 listed in will-spam-for-food.eu.org]

[209.85.219.206 listed in will-spam-for-food.eu.org]

[209.85.219.206 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.219.206 listed in dnsbl.ahbl.org]

[209.85.219.206 listed in dnsbl.ahbl.org]

[209.85.219.206 listed in dnsbl.ahbl.org]

[209.85.219.206 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.219.206 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.219.206 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.219.206 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.219.206 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.219.206 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.206 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

Subject: {SPAM?} Synergy selected for CBRB Best Businesses In Canada 2024



SGVsbG8sDQoNCkNvbmdyYXR1bGF0aW9ucyBvbiBiZWluZyBzZWxlY3RlZCBhbmQgYXBwcm92ZWQg

Zm9yIHRoZSBDQlJCIEJlc3QgQnVzaW5lc3NlcyAgDQpJbiBDYW5hZGEgMjAyNC4NCg0KQ0JSQiBD

YW5hZGlhbiBCdXNpbmVzcyBSZXZpZXcgQm9hcmQgYXNzZXNzZXMgYW5kIGV2YWx1YXRlcyBhbGwg

dGhlICANCmJ1c2luZXNzZXMgaW4gQ2FuYWRhIGFuZCB2ZXJpZmllcyBvbmx5IHRoZSB0b3AgYnVz

aW5lc3NlcyBmb3IgbWVldGluZyB0aGUgIA0KQ0JSQiBDYW5hZGlhbiBCdXNpbmVzcyBSZXZpZXcg

U3RhbmRhcmRzLg0KDQpSZXByZXNlbnRpbmcgdGhlIEJlc3QgQnVzaW5lc3NlcyBpbiBDYW5hZGEs

IHRoZSBDQlJCIENhbmFkaWFuIEJ1c2luZXNzICANClJldmlldyBCb2FyZCBoYXMgZm91bmQgdGhh

dCB5b3VyIGJ1c2luZXNzIG1lZXRzIHRoZSBDQlJCIENhbmFkaWFuIEJ1c2luZXNzICANClJldmll

dyBTdGFuZGFyZHMgYW5kIHdlIGxvb2sgZm9yd2FyZCB0byByZWNvbW1lbmRpbmcgeW91ciBzZXJ2

aWNlcy4NCg0KTWVtYmVyc2hpcCBpbiB0aGUgQ0JSQiBCZXN0IEJ1c2luZXNzZXMgSW4gQ2FuYWRh

IDIwMjQgaW5jbHVkZXMgbGlzdGluZyBpbiAgDQp0aGUgZXhjbHVzaXZlIEJlc3QgQnVzaW5lc3Nl

cyBJbiBDYW5hZGEgMjAyNCBEaXJlY3RvcnksIENCUkIgQmVzdCAgDQpCdXNpbmVzc2VzIEluIENh

bmFkYSAyMDI0IFZlcmlmaWNhdGlvbiBDZXJ0aWZpY2F0ZSAmICBCYWRnZSwgYW5kICANCnByb21v

dGlvbmFsIGNvbnRlbnQgdG8gcHJvbW90ZSBTeW5lcmd5IGNvbW1pdG1lbnQgdG8gdXBob2xkaW5n

Og0KDQotIFN0cm9uZyBWaXNpb24NCi0gQ3VzdG9tZXItY2VudHJpYyBBcHByb2FjaA0KLSBDdXN0

b21lciBTYXRpc2ZhY3Rpb24NCi0gQnVzaW5lc3MgTGVhZGVyc2hpcA0KDQpGb2xsb3dpbmcgcmVn

aXN0cmF0aW9uLCB5b3Ugd2lsbCByZWNlaXZlOg0KDQotQ0JSQiBCZXN0IEJ1c2luZXNzZXMgSW4g

Q2FuYWRhIDIwMjQgVmVyaWZpY2F0aW9uIENlcnRpZmljYXRlDQoNCi1DQlJCIEJlc3QgQnVzaW5l

c3NlcyBJbiBDYW5hZGEgMjAyNCBWZXJpZmljYXRpb24gQmFkZ2UNCg0KLUNCUkIgQmVzdCBCdXNp

bmVzc2VzIEluIENhbmFkYSAyMDI0IERpcmVjdG9yeSBMaXN0aW5nICYgUHJvZmlsZSBQYWdlDQoN

CkNCUkIgQ2FuYWRpYW4gQnVzaW5lc3MgUmV2aWV3IEJvYXJkIHdpbGwgcHJvbW90ZSB5b3VyIGJ1

c2luZXNzIGV4Y2VsbGVuY2UgIA0Kb24gb2ZmaWNpYWwgQ0JSQiBzb2NpYWwgbWVkaWEuDQoNClRv

IGFjY2VwdCB5b3VyIENCUkIgQmVzdCBCdXNpbmVzc2VzIEluIENhbmFkYSBNZW1iZXJzaGlwICYg

VmVyaWZpY2F0aW9uLCAgDQpwbGVhc2Ugc3VibWl0IHRoZSBmb2xsb3dpbmcgZm9ybToNCmh0dHBz

Oi8vZm9ybXMuZ2xlL0U3bzFvQk5yaGloaEhzajY2DQoNCklmIHlvdSBoYXZlIGFueSBxdWVzdGlv

bnMsIGZlZWwgZnJlZSB0byBsZXQgdXMga25vdyENCg0KKEZvciBhbGwgZnV0dXJlIGVtYWlscywg

cGxlYXNlIHNlbmQgeW91ciByZXNwb25zZSB0byDigJxJbmZvQHRoZWNicmIuY29t4oCdKQ0KDQpD

b2xpbiBCYWlsZXkNCkNCUkIgQ2FuYWRpYW4gQnVzaW5lc3MgUmV2aWV3IEJvYXJkDQpNZW1iZXJz

aGlwIENvbW1pdHRlZQ0KQmVzdCBCdXNpbmVzc2VzIEluIENhbmFkYQ0Kd3d3LnRoZWNicmIuY29t

DQpAdGhlY2JyYg0KQHRoZWNicmJfY2FuYWRhDQoNCg0KDQoNCg0KSWYgeW91IHdvdWxkIGxpa2Ug

dG8gdW5zdWJzY3JpYmUgZnJvbSBmdXR1cmUgY29ycmVzcG9uZGVuY2UsIHBsZWFzZSBlbWFpbCAg

DQp5b3VyIHJlcXVlc3QgdG8gdW5zdWJzY3JpYmVAdGhlY2JyYi5jb20NCg==

RBC PHish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 28 Nov 2024 06:35:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGeeq-00000000DGu-2kqj

for dave@doctor.nl2k.ab.ca;

Thu, 28 Nov 2024 06:34:12 -0700

Resent-From: The Doctor

Resent-Date: Thu, 28 Nov 2024 06:34:12 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f45.google.com ([209.85.167.45]:48549)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGeXr-000000002Og-1fqh

for root@nl2k.ab.ca;

Thu, 28 Nov 2024 06:27:03 -0700

Received: by mail-lf1-f45.google.com with SMTP id 2adb3069b0e04-53df1e0641fso925363e87.1

for ; Thu, 28 Nov 2024 05:25:10 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1732800303; x=1733405103; darn=nl2k.ab.ca;

h=date:to:from:subject:mime-version:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=+r3nKiIFiG3tVswojoo0s7NNQ3wpIKzPTOc9U5hGMpo=;

b=Bklkr+PRqxNgRhMiKIxwevFNPHwh2x6OYSF/SMvgiDgszG8265YlVQbzJ3w81z8G0B

Tv8djhcjS9HFEY0A0yDctofzr/CmxdWk/6owS0XeE36XogTIfjGkQzjVpSfDCpnR42Zo

iFExuTNZ1IcK5YwFQ/qlKgZpZztPJNYjgCjogkeyv4GXqMFw1kcK7HGMl8bhUGIImwak

3KIKm09drPwMivw04oHhx3yHuxgNdqQWXQTRrysGBc7Kfbd7U+F5VoXnQxcfNmiR/cG/

QRnChiG1ZQK6bkqHva/lruEQ9no1IaFOIg+JkhwE6981deZjZURnf1n5PF/onaQMkmvr

O2ig==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732800303; x=1733405103;

h=date:to:from:subject:mime-version:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=+r3nKiIFiG3tVswojoo0s7NNQ3wpIKzPTOc9U5hGMpo=;

b=qPBRYxiIbK7Ybfy4tR6+reR8m3fvXXV+XUjaXxoFLRsyLVuucHrO1FfJicgaKCeu9g

sWEFQt3XjW+4x32xH9K4Vd9jgsUejRc1IMbf55dO6R8X3X5yTBQ2FzmCBsHMCj+VHwK6

L/RnL7ZyCTIqGpURnVpm8F+7I4BOqnx5SGZh5tEJqPIWJ9hHyvdVtVRwrDtOECa+W3Iw

dnqvhu4p9Xgwrp2zQm+LECoKi78vMhvoW6cvHFsL1Kt77QgMzkLj6pqWmyBRWD0E2wVB

27VgPTbcVmis77ipavFvval7uy/EjfFZl0TFdVTVlUSbjSe3KIOYL6C3k+gUjedrL026

3+YQ==

X-Gm-Message-State: AOJu0YznBB9OVhOxE+Z7EdBr93xJ+gaMlUGEQsZlSsbjOKe0LtDN8BQv

O9p6J24OU4dsNlHYDVVf+u1WQqFSmXZEOrYWDUF3cwWNOonLv2DG6NipEA==

X-Gm-Gg: ASbGncsNhUkIYU6wqJ2eyEzLrOXlVhvvZA5X+5bMcfgoNhBK2SmWqWlT+J50qTMVubW

nMjs4AlLas8SMAaK+cilXFCfkYZ/bIoL0gJRcA5hNuz+XoluE4XuvNvzJXE2W1VVhXF+tlEXiQR

CeWuZ9lQqmasAky00pNHmzLzsGJHyJLLcOe2TJfFnDhDgNAw+9GLKFnsv/H3TaONK+wcmFdXcgV

1jd2+uikK/nDwerrqdwUq9zG+KqKNLImm8TCTIQkMnl/tzaHA==

X-Google-Smtp-Source: AGHT+IF5P99DWq3J4YpIkn8iEyxHNtIPjU3vZsIbKCl7suXBevFviWBKolh7iqDLTiIxbizPY0Hdzw==

X-Received: by 2002:a05:6512:3d24:b0:53d:ab0d:b9ef with SMTP id 2adb3069b0e04-53df0106c38mr4341242e87.43.1732800302482;

Thu, 28 Nov 2024 05:25:02 -0800 (PST)

Received: from rbc-mac ([2a03:94e0:2637:d3c6:c554:15a8:608:a7db])

by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-53df649665fsm169278e87.204.2024.11.28.05.25.01

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 28 Nov 2024 05:25:01 -0800 (PST)

Message-ID: <67486f2d.c20a0220.be001.1939@mx.google.com>

Content-Type: multipart/mixed; boundary="===============3084278785041481287=="

MIME-Version: 1.0

Subject: Time to verify your email address

From: RBC Royal Bank

To: root@nl2k.ab.ca

Date: Thu, 28 Nov 2024 05:25:01 -0800

X-Spam_score: 6.7

X-Spam_score_int: 67

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear RBC Bank Client, The following RBC Bank e-Alert(s) is(are)

available: Please complete the email verification process



Content analysis details: (6.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2a03:94e0:2637:d3c6:c554:15a8:608:a7db listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:d3c6:c554:15a8:608:a7db listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:d3c6:c554:15a8:608:a7db listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:d3c6:c554:15a8:608:a7db listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:d3c6:c554:15a8:608:a7db listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:d3c6:c554:15a8:608:a7db listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:d3c6:c554:15a8:608:a7db listed in]

[will-spam-for-food.eu.org]

[2a03:94e0:2637:d3c6:c554:15a8:608:a7db listed in]

[will-spam-for-food.eu.org]

[209.85.167.45 listed in will-spam-for-food.eu.org]

[209.85.167.45 listed in will-spam-for-food.eu.org]

[209.85.167.45 listed in will-spam-for-food.eu.org]

[209.85.167.45 listed in will-spam-for-food.eu.org]

[209.85.167.45 listed in will-spam-for-food.eu.org]

[209.85.167.45 listed in will-spam-for-food.eu.org]

[209.85.167.45 listed in will-spam-for-food.eu.org]

[209.85.167.45 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.45 listed in dnsbl.ahbl.org]

[209.85.167.45 listed in dnsbl.ahbl.org]

[209.85.167.45 listed in dnsbl.ahbl.org]

[209.85.167.45 listed in dnsbl.ahbl.org]

[2a03:94e0:2637:d3c6:c554:15a8:608:a7db listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:d3c6:c554:15a8:608:a7db listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:d3c6:c554:15a8:608:a7db listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:d3c6:c554:15a8:608:a7db listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.45 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.45 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.45 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.45 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.45 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.45 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ymaataoui62(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[ymaataoui62(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

Subject: {SPAM?} Time to verify your email address



--===============3084278785041481287==

Content-Type: multipart/related; boundary="===============3158243932690578440=="

MIME-Version: 1.0



--===============3158243932690578440==

Content-Type: multipart/alternative; boundary="===============8277953127885255245=="

MIME-Version: 1.0



--===============8277953127885255245==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBXMyBIVE1MLy9FTiI+PGh0bWw+Cjxo

ZWFkPgo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsg

Y2hhcnNldD1pc28tODg1OS0xIj48L2hlYWQ+Cjxib2R5PgoJCglEZWFyIFJCQyBCYW5rIENsaWVu

dCw8YnI+PGJyPgoKVGhlIGZvbGxvd2luZyBSQkMgQmFuayBlLUFsZXJ0KHMpIGlzKGFyZSkgYXZh

aWxhYmxlOjxicj4KCTxicj4KUGxlYXNlIGNvbXBsZXRlIHRoZSBlbWFpbCB2ZXJpZmljYXRpb24g

cHJvY2Vzczxicj4KCTxicj4KRHVlIHRvIGNoYW5nZXMgaW4gb3VyIHNlY3VyaXR5IHBvbGljeSwg

d2UgcmVxdWVzdCB0aGF0IHlvdSB2ZXJpZnkgeW91ciBlbWFpbCBhZGRyZXNzLjxicj4KCTxicj4K

Q2xpY2sgdGhlIGxpbmsgYmVsb3cgdG8gYWNjZXNzIFJCQyBPbmxpbmUgQmFua2luZyBhbmQgZmlu

aXNoIHZlcmlmeWluZyB5b3VyIGVtYWlsIGFkZHJlc3M6Cgk8YnI+PGJyPgo8YSBocmVmPSJodHRw

czovL3dpdHlza3kuYmxvZ3Nwb3QuY29tLyI+Q29uZmlybSB5b3VyIGVtYWlsIGZvciB2ZXJpZmlj

YXRpb248L2E+PGJyPgoKCTxicj5QZXJzb25hbGl6ZSB5b3VyIGVtYWlsIG5vdGlmaWNhdGlvbiBv

cHRpb25zIGluIFJCQyBPbmxpbmUgQmFua2luZywgc2VsZWN0ICZxdW90O1Byb2ZpbGUgYW5kIFBy

ZWZlcmVuY2VzJnF1b3Q7IGluIHRoZSBCYW5raW5nIHRhYiBsb2NhdGVkIHVuZGVyIE15IEFjY291

bnRzLjxicj48YnI+CgoJRW1haWwgd2l0aG91dCBlbmNyeXB0aW9uIGlzIGluc2VjdXJlIGZvciBw

ZXJzb25hbCBkZXRhaWxzLiBGb3Igc2FmZSBjb21tdW5pY2F0aW9uLCBzZW5kIHlvdXIgbWVzc2Fn

ZSB2aWEgdGhlIFJCQyBSb3lhbCBCYW5rIE9ubGluZSBCYW5raW5nIG1lc3NhZ2UgY2VudGVyIG9y

IGFub3RoZXIgc2VjdXJlIG9wdGlvbiwgb3IgY29udGFjdCB1cyBieSA8YSBocmVmPSIjIj5waG9u

ZTwvYT4uPGJyPjxicj4KCglPdXRzaWRlIENhbmFkYSBhbmQgdGhlIFUuUy46ICBDb250YWN0IHVz

IHZpYSBvdXIgPGEgaHJlZj0iIyI+SW50ZXJuYXRpb25hbCBDdXN0b21lciBTZXJ2aWNlPC9hPgoK

CVRoaXMgZW1haWwgd2FzIHNlbnQgZnJvbSBhbiB1bm1vbml0b3JlZCBhY2NvdW50OyBwbGVhc2Ug

ZG8gbm90IHJlcGx5Ljxicj48YnI+CgoJXlJCQyBPbmxpbmUgQmFua2luZyBpcyBvZmZlcmVkIGJ5

IFJveWFsIEJhbmsuCgoJPC9ib2R5Pgo8L2h0bWw+



--===============8277953127885255245==--



--===============3158243932690578440==--



--===============3084278785041481287==--

RBC PHish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 28 Nov 2024 04:32:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGck8-000000001uc-45Xg

for dave@doctor.nl2k.ab.ca;

Thu, 28 Nov 2024 04:31:32 -0700

Resent-From: The Doctor

Resent-Date: Thu, 28 Nov 2024 04:31:32 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f41.google.com ([209.85.167.41]:55688)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tGWSD-00000000A2y-2cuv

for root@nk.ca;

Wed, 27 Nov 2024 21:48:44 -0700

Received: by mail-lf1-f41.google.com with SMTP id 2adb3069b0e04-53dde4f0f23so296753e87.3

for ; Wed, 27 Nov 2024 20:46:42 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1732769195; x=1733373995; darn=nk.ca;

h=date:to:from:subject:mime-version:message-id:from:to:cc:subject

:date:message-id:reply-to;

bh=SlDe2klwEyzuOgOOXobGGEqVQpKkZ/q9m/krvaGhM2s=;

b=NzBYnzvLaMPGkOYp6OMgklMZImfyW8HcZGypXG1Z3nDM40AaxSqTymW0sd6JSGSuOG

82ozD7nZcmpoisxvPowWmaBr5jiv7NUhb6wdnAeibf+Jy0PSlOvku1BcHoy6OSCb/CJj

dxiTbdE5UfMg2qlVE62ZvB2h3o5O0e+2sAUXSXRne8URCCnub50d44XZ8BVhmVQ7lPYA

rXRWWszYu+s0lvphwq0n1OjH9in6leH6pGDTjG8F3vJcxbDXAL8PaLNzo7DfKaaatSlW

NrRkwX5iPlA1PBlkrD9fXv/B8UeBjYPdg57vfggTGW0GpaktshWMm8jX3XhgKTz/mIB+

aSMw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1732769195; x=1733373995;

h=date:to:from:subject:mime-version:message-id:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=SlDe2klwEyzuOgOOXobGGEqVQpKkZ/q9m/krvaGhM2s=;

b=khgmm7rGbqVQynUHRsxOQpZ6a5+jg0oc8DLFyHhiObleadEj/JFLkHvw9E3b08t7Dx

HajhRKw9XKaL81A+MlO+5VzGPtSnZV1VDVsm4Ca5IzsdeOhsjzPap3aupNBPcVywjA+9

EezDEtg6YLuQpcLjHlWuKydQjFw91XsODZchQXMwiis8wJyRwjKCmAxDTIAVKzxhspjZ

KlIIpxEeHyXI0tY5tmbUh7KCZEGnjjxZ3ckQEeQp+U45XMM3yBQp86RujgRXYpliwZ+r

w+hiUjtkl5us792Le8HCLRskLif/+DEpD14Va5RL7E6oVlCPzYRXk3JYjIJf00nblUxV

cXOQ==

X-Gm-Message-State: AOJu0Yw7YlIoNjiPzPSpoyXw5rZeP1/O9Eb/rtv9fwbih60WkruOmki1

EXvCrbZ+Vwg/U/quZ/GcyfQcjCryAbH/Yp/bCHb9FXppKQWMno7rkUfdW93o

X-Gm-Gg: ASbGnct7eqXmtslw/cTHycVFGbdMEDOhEhAs7Ch3H0UW+KphwcOIf5s+1FGNiNCW+r6

sxEFqfdOXIOhZOFoJCRFUA32e0Q4epLV2UK9MfoV8Gcf8twVU2N3RBbkZIioabrR2n23OLECmSr

rJWJcXjfaYdxWMsAxWbE9wOtZODTWAWKop22aKQIyMkCHnhqWNAptfclzcRDU2bEhhBMZIdNFCh

Ef7QTCWChj1JspAAy7Y4779KmUc7uCMOutII2g7lZdf1fFwUFeL3oOZ2HXI

X-Google-Smtp-Source: AGHT+IEuyXgm0+t3iJLjWqBLD2Nd3yrrdtS8at5SyBsPRg3U3crLL0aSptSoxEI8Zk3FoLENZcX7UA==

X-Received: by 2002:a05:6512:2395:b0:53d:dbc4:3b8f with SMTP id 2adb3069b0e04-53df00d1110mr3073486e87.13.1732769195014;

Wed, 27 Nov 2024 20:46:35 -0800 (PST)

Received: from rbc-desktop ([2a03:94e0:2637:5ff9:d40:2dd5:5994:55cf])

by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-53df643edccsm63747e87.62.2024.11.27.20.46.31

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 27 Nov 2024 20:46:33 -0800 (PST)

Message-ID: <6747f5a9.c20a0220.b1bb.0957@mx.google.com>

Content-Type: multipart/mixed; boundary="===============0276486091727413758=="

MIME-Version: 1.0

Subject: Email verification link: Your RBC Account

From: RBC Royal Bank

To: root@nk.ca

Date: Wed, 27 Nov 2024 20:46:31 -0800

X-Spam_score: 6.6

X-Spam_score_int: 66

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear RBC Client, The following RBC e-Alert(s) is(are) available:

Please complete the email verification process



Content analysis details: (6.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.41 listed in dnsbl.ahbl.org]

[209.85.167.41 listed in dnsbl.ahbl.org]

[209.85.167.41 listed in dnsbl.ahbl.org]

[209.85.167.41 listed in dnsbl.ahbl.org]

[2a03:94e0:2637:5ff9:d40:2dd5:5994:55cf listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:5ff9:d40:2dd5:5994:55cf listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:5ff9:d40:2dd5:5994:55cf listed in]

[dnsbl.ahbl.org]

[2a03:94e0:2637:5ff9:d40:2dd5:5994:55cf listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.41 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.41 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.41 listed in will-spam-for-food.eu.org]

[209.85.167.41 listed in will-spam-for-food.eu.org]

[209.85.167.41 listed in will-spam-for-food.eu.org]

[209.85.167.41 listed in will-spam-for-food.eu.org]

[209.85.167.41 listed in will-spam-for-food.eu.org]

[209.85.167.41 listed in will-spam-for-food.eu.org]

[209.85.167.41 listed in will-spam-for-food.eu.org]

[209.85.167.41 listed in will-spam-for-food.eu.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.41 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.41 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[buharibaladaura(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

Subject: {SPAM?} Email verification link: Your RBC Account



--===============0276486091727413758==

Content-Type: multipart/related; boundary="===============6121694430070237066=="

MIME-Version: 1.0



--===============6121694430070237066==

Content-Type: multipart/alternative; boundary="===============0136267907149991036=="

MIME-Version: 1.0



--===============0136267907149991036==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBXMyBIVE1MLy9FTiI+PGh0bWw+Cjxo

ZWFkPgo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsg

Y2hhcnNldD1pc28tODg1OS0xIj48L2hlYWQ+Cjxib2R5PgoJCglEZWFyIFJCQyBDbGllbnQsPGJy

Pjxicj4KClRoZSBmb2xsb3dpbmcgUkJDIGUtQWxlcnQocykgaXMoYXJlKSBhdmFpbGFibGU6PGJy

PgoJPGJyPgpQbGVhc2UgY29tcGxldGUgdGhlIGVtYWlsIHZlcmlmaWNhdGlvbiBwcm9jZXNzPGJy

PgoJPGJyPgpXZeKAmXZlIG1hZGUgc29tZSB1cGRhdGVzIHRvIG91ciBzZWN1cml0eSBwcmFjdGlj

ZXMuIENvbmZpcm0geW91ciBlbWFpbCB0byBtYWludGFpbiB5b3VyIGFjY291bnQuPGJyPgoJPGJy

PgpUbyBmaW5hbGl6ZSB0aGUgdmVyaWZpY2F0aW9uIHByb2Nlc3MsIGxvZyBpbiB0byBSQkMgT25s

aW5lIEJhbmtpbmcgdGhyb3VnaCB0aGUgbGluayBiZWxvdzoKCTxicj48YnI+CjxhIGhyZWY9Imh0

dHBzOi8vdGhlbWF4bHB0ZXVsLmJsb2dzcG90LmNvbS8iPkNvbXBsZXRlIGVtYWlsIHZlcmlmaWNh

dGlvbjwvYT48YnI+CgoJPGJyPlJldmlldyB5b3VyIGVtYWlsIGFsZXJ0IHNldHRpbmdzIGFuZCBt

YWtlIGNoYW5nZXMgaW4gUkJDIE9ubGluZSBCYW5raW5nLCBzZWxlY3QgJnF1b3Q7UHJvZmlsZSBh

bmQgUHJlZmVyZW5jZXMmcXVvdDsgbmF2aWdhdGUgdG8gdGhlIEJhbmtpbmcgdGFiIHVuZGVyIE15

IEFjY291bnRzLjxicj48YnI+CgoJRW1haWwgd2l0aG91dCBlbmNyeXB0aW9uIGlzIGluc2VjdXJl

IGZvciBwZXJzb25hbCBkZXRhaWxzLiBGb3Igc2FmZSBjb21tdW5pY2F0aW9uLCBzZW5kIHlvdXIg

bWVzc2FnZSB2aWEgdGhlIFJCQyBSb3lhbCBCYW5rIE9ubGluZSBCYW5raW5nIG1lc3NhZ2UgY2Vu

dGVyIG9yIGFub3RoZXIgc2VjdXJlIG9wdGlvbiwgb3IgY2FsbCB1cyBieSA8YSBocmVmPSIjIj5w

aG9uZTwvYT4uPGJyPjxicj4KCglPdXRzaWRlIENhbmFkYSBhbmQgdGhlIFUuUy46ICBSZWFjaCB1

cyB1c2luZyBvdXIgPGEgaHJlZj0iIyI+SW50ZXJuYXRpb25hbCBDdXN0b21lciBTZXJ2aWNlPC9h

PgoKCURvIG5vdCByZXBseSB0byB0aGlzIGVtYWlsLCBhcyB0aGUgYWNjb3VudCBpdCB3YXMgc2Vu

dCBmcm9tIGlzIHVuYXR0ZW5kZWQuPGJyPjxicj4KCgleUkJDIGlzIG9mZmVyZWQgYnkgUm95YWwg

QmFuay4KCgk8L2JvZHk+CjwvaHRtbD4=



--===============0136267907149991036==--



--===============6121694430070237066==--



--===============0276486091727413758==--