Royal Bank of Canada Phish from djaweb.dz

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 05 Dec 2024 06:41:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tJC6C-00000000FG0-0yIE

for dave@doctor.nl2k.ab.ca;

Thu, 05 Dec 2024 06:40:56 -0700

Resent-From: The Doctor

Resent-Date: Thu, 5 Dec 2024 06:40:56 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smartgamma.dev ([188.166.33.130]:42564 helo=mail.smartgamma.dev)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tJAwl-00000000JC3-3uZ6

for sales@nk.ca;

Thu, 05 Dec 2024 05:27:14 -0700

Received: from localhost (localhost.localdomain [127.0.0.1])

by mail.smartgamma.dev (Postfix) with ESMTP id 51C61334CE5

for ; Thu, 5 Dec 2024 14:25:08 +0200 (EET)

Received: from mail.smartgamma.dev ([127.0.0.1])

by localhost (mail.smartgamma.dev [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id fE9Gv8_7UTPM for ;

Thu, 5 Dec 2024 14:25:08 +0200 (EET)

Received: from localhost (localhost.localdomain [127.0.0.1])

by mail.smartgamma.dev (Postfix) with ESMTP id E18D0334CE4

for ; Thu, 5 Dec 2024 14:25:07 +0200 (EET)

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.smartgamma.dev E18D0334CE4

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smartgamma.dev;

s=FB38C640-C4C5-11ED-A988-1A1FB4B3D8AD; t=1733401507;

bh=LjiZRUWEUr9Mg0tIDhb+hx0B/82/46BbBEuLup5t7X8=;

h=MIME-Version:From:To:Date:Message-Id;

b=wk92ltpSOHc1VNU6P3++39e+98nxiI/sIz9R8StR5QcwCMGDXwfUfzQ4VdCnp8GoL

Hcpmt0o3Exu6xNcrdymUJRZZY/r1I1xW/SkufonPGVwBt83h2PShXALJz0SPzekFRE

WWGK5nvEvStEi0YL+DK8JSCsE2MvEqJOuZ5OkQpS03sGkggFlbrsl1d9bRY+WJKvOC

h47cz/9uX3oZkgSwgtODcEuNwsBC/OJO2+0s+xloU1BX5eSqcTJh5e5GME2AWJHBQN

v9ujGVbMQhlKohUiwrg4QsfQKami7kXdkhFAx69Ws+MdsAyMJNqwZDcsKta4dZReXD

j1IWwpJCF0N8g==

X-Virus-Scanned: amavisd-new at smartgamma.dev

Received: from mail.smartgamma.dev ([127.0.0.1])

by localhost (mail.smartgamma.dev [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id asyieRox7AJa for ;

Thu, 5 Dec 2024 14:25:07 +0200 (EET)

Received: from fayz (unknown [41.104.195.245])

by mail.smartgamma.dev (Postfix) with ESMTPSA id 7D74E334CE2

for ; Thu, 5 Dec 2024 14:25:07 +0200 (EET)

MIME-Version: 1.0

From: "Royal Bank of Canada (RBC) Security Team"

To: sales@nk.ca

Date: 5 Dec 2024 13:25:06 +0100

Subject: Identity Verification Needed: Prevent Account Lock

Content-Type: text/html; charset=us-ascii

Content-Transfer-Encoding: quoted-printable

Message-Id: <20241205122507.7D74E334CE2@mail.smartgamma.dev>

X-Spam_score: 6.9

X-Spam_score_int: 69

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ROYAL BANK OF CANADA Important Security Alert Dear Valued

Customer,



Content analysis details: (6.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[188.166.33.130 listed in dnsbl.ahbl.org]

[188.166.33.130 listed in dnsbl.ahbl.org]

[188.166.33.130 listed in dnsbl.ahbl.org]

[188.166.33.130 listed in dnsbl.ahbl.org]

[41.104.195.245 listed in dnsbl.ahbl.org]

[41.104.195.245 listed in dnsbl.ahbl.org]

[41.104.195.245 listed in dnsbl.ahbl.org]

[41.104.195.245 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[188.166.33.130 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[188.166.33.130 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[188.166.33.130 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[188.166.33.130 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[41.104.195.245 listed in will-spam-for-food.eu.org]

[41.104.195.245 listed in will-spam-for-food.eu.org]

[41.104.195.245 listed in will-spam-for-food.eu.org]

[41.104.195.245 listed in will-spam-for-food.eu.org]

[41.104.195.245 listed in will-spam-for-food.eu.org]

[41.104.195.245 listed in will-spam-for-food.eu.org]

[41.104.195.245 listed in will-spam-for-food.eu.org]

[41.104.195.245 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[188.166.33.130 listed in sa-trusted.bondedsender.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[188.166.33.130 listed in sa-accredit.habeas.com]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[188.166.33.130 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[188.166.33.130 listed in bl.score.senderscore.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

1.0 ACCT_PHISHING Possible phishing for account information

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} Identity Verification Needed: Prevent Account Lock




l, sans-serif; BACKGROUND: rgb(0,32,91); WHITE-SPACE: normal; WOR=

D-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rg=

b(255,255,255); PADDING-BOTTOM: 20px; FONT-STYLE: normal; TEXT-AL=

IGN: center; PADDING-TOP: 20px; PADDING-LEFT: 20px; ORPHANS: 2; W=

IDOWS: 2; LETTER-SPACING: normal; PADDING-RIGHT: 20px; TEXT-INDEN=

T: 0px; font-variant-ligatures: normal; font-variant-caps: normal=

; -webkit-text-stroke-width: 0px; text-decoration-thickness: init=

ial; text-decoration-style: initial; text-decoration-color: initi=

al">3D"R=<br
oyal Bank of Canada Logo" src=3D"https://www.rbcroyalbank.com/dvl=

/v1.0/assets/images/logos/rbc-logo-shield.svg">=0D=0A


"FONT-SIZE: 24px; FONT-WEIGHT: 600; MARGIN: 0px">ROYAL BANK OF CA=

NADA

=0D=0A

; FONT-FAMILY: Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACI=

NG: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(51,51=

,51); PADDING-BOTTOM: 20px; FONT-STYLE: normal; PADDING-TOP: 20px=

; PADDING-LEFT: 20px; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: norm=

al; PADDING-RIGHT: 20px; TEXT-INDENT: 0px; font-variant-ligatures=

: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0=

px; text-decoration-thickness: initial; text-decoration-style: in=

itial; text-decoration-color: initial">=0D=0A


ZE: 20px; MARGIN-BOTTOM: 10px">Important Security Alert

=0D=0A=

=

Dear Valued Customer,

=0D=0A


N: 10px 0px; LINE-HEIGHT: 1.5">Your account may be locked due to =

new security measures. To ensure uninterrupted access, we require=

you to verify your identity.

=0D=0A


x; MARGIN: 10px 0px; LINE-HEIGHT: 1.5">Please log in and update y=

our account details as soon as possible to prevent any inconvenie=

nce.


RATION: none; MAX-WIDTH: 200px; BACKGROUND: rgb(0,113,206); FONT-=

WEIGHT: bold; COLOR: rgb(255,255,255); PADDING-BOTTOM: 12px; TEXT=

-ALIGN: center; PADDING-TOP: 12px; PADDING-LEFT: 20px; MARGIN: 20=

px auto 0px; DISPLAY: block; PADDING-RIGHT: 20px; border-radius: =

5px" href=3D"https://declarateenquiebra.cl/rolo.php">Verify Your =

Account
=0D=0A

px; FONT-FAMILY: Arial, sans-serif; BACKGROUND: rgb(249,249,249);=

WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FO=

NT-WEIGHT: 400; COLOR: rgb(119,119,119); PADDING-BOTTOM: 15px; FO=

NT-STYLE: normal; TEXT-ALIGN: center; PADDING-TOP: 15px; PADDING-=

LEFT: 15px; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; PADDIN=

G-RIGHT: 15px; TEXT-INDENT: 0px; font-variant-ligatures: normal; =

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-d=

ecoration-thickness: initial; text-decoration-style: initial; tex=

t-decoration-color: initial">=0D=0A

This email was sent by Roya=

l Bank of Canada. Please do not reply to this email.

=0D=0A

=

For more information, visit our 
T-DECORATION: none; COLOR: rgb(0,113,206)" href=3D"https://declar=

ateenquiebra.cl/rolo.php">official website.

=0D=0A
> 





Web / SEO / App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 05 Dec 2024 05:03:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tJAYT-00000000GO5-1gHO

for dave@doctor.nl2k.ab.ca;

Thu, 05 Dec 2024 05:02:01 -0700

Resent-From: The Doctor

Resent-Date: Thu, 5 Dec 2024 05:02:01 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreacentralazolkn19013075.outbound.protection.outlook.com ([52.103.74.75]:12605 helo=SEYPR02CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tJ9w9-00000000EQR-1RzN

for sales@nk.ca;

Thu, 05 Dec 2024 04:22:30 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=N2O3kXYiFQnLWalMGbqiWR9Rl+L0JWE4O16ukrodKvSgn1vf/5uJn+GSaXnnoQszt4Xh/ZVjJYN+YSPjv7ItMMRUwwmN9D5dVzZscDCddW2jO0Prwaui9nyUzVihs9SFnyjjbGqfHnDxcx4iKkmimVUbbfSgn/ufaKSvCuhEw8Qv++/hSeyLfj2W+KpwPLTjU8g1oykNiyTsD1MJltHjWSKMuqKQHUBFccVStx6+GWRqujbYVqmZk6VCvpK2g0+9ZVV3OgBYyhr5K8FD1crYhHm35WnUYL6e+1vfJAZzQ26kJuJQ4b76rO+/7UBJ+wMpLKs1H+Rkv8+cH5t1J5Yy5w==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=XH1o5mXYMNX3jl1pE5LhQaL+kRfHxhuuP7sI221gyoM=;

b=mhLauiv9Z3hj3z3si2MnoAQk56EDEd2LbyWqAfk56ZhDUf4ft5YFOK6CJ8yNh90leKBEP2xErbIrilciBVSR6AJcEleXnDy4wGoE9bGIS2zEmGJYAKxpDi/4DNTBxv7IvuZr7JDK7eo+1JsyMvfT45aErPY2PHzpydDBJWc6merHzCG2lcAaLNnRrLPKLh6frWdggOyAbqVupq9EdJEny5Exdv2BbLaW/8oFq4Aya/gNnIv52hhWBWTwI4fFKwVVM9ct2dFLQGBwXB+Jq88NeF0p8NOWcYBIlGzMFXqHgxmq09iC522A+qHPlBJyGC4gZOG0ipuZfidJw0om13uWkw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=XH1o5mXYMNX3jl1pE5LhQaL+kRfHxhuuP7sI221gyoM=;

b=S/1N4a0OyLU39hDXu2xxVjV0YvV95dbgzBd7Rd0n7EwRKDjoqmsxrbil7uAaoNBqV6Bh/5R3M8ntyqU5Im68lYgEnZGjFntSgTAF0FbLGYw3v07M1Ycatq3zNvI1/egRSO6JtkjkTXblTV1r5gUGQvh4CQkTEXm6Q8x1YChp765XsP0tGhSALFCGsNyd3mXbnTyB1AH3hTyIwWelJF4xTnvJmyuYqKzVLRow5k6D1Z5k1yrElfkKsdnLzD2yrovq+9eCGA0kDq9WUUcmvrIJ1EWk3E2CjBLYvPZup/T85RisycrXqJqPqy848+djcx51eSH0LyoUIGwgnKJRGCnrpQ==

Received: from JH0PR01MB6805.apcprd01.prod.exchangelabs.com

(2603:1096:990:87::12) by SEL0PFEA909E648.apcprd01.prod.exchangelabs.com

(2603:1096:108:1::5d7) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8230.12; Thu, 5 Dec

2024 11:19:39 +0000

Received: from JH0PR01MB6805.apcprd01.prod.exchangelabs.com

([fe80::9bf3:77c2:33c4:b116]) by JH0PR01MB6805.apcprd01.prod.exchangelabs.com

([fe80::9bf3:77c2:33c4:b116%7]) with mapi id 15.20.8207.017; Thu, 5 Dec 2024

11:19:39 +0000

From: Clint Suritafa

Subject: SEO Expert

Thread-Topic: SEO Expert

Thread-Index: AQHbRweQ0PL2xieHuUupnd6sbOHsbg==

Date: Thu, 5 Dec 2024 11:19:38 +0000

Message-ID:



Accept-Language: en-IN, en-US

Content-Language: en-IN

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: JH0PR01MB6805:EE_|SEL0PFEA909E648:EE_

x-ms-office365-filtering-correlation-id: 034a1fca-8945-4536-cf79-08dd151eb524

x-microsoft-antispam:

BCL:0;ARA:14566002|19110799003|15080799006|37102599003|7071999006|15030799003|8060799006|461199028|8062599003|56899033|3412199025|440099028|102099032;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?ZSQW6ZwSCgdV+vKVhMoEUMDpr6w6irylXx7Rq/N14WVBnWjuj4ljRKZNoF?=

=?iso-8859-1?Q?ESdWl6A79ZIw5HM8klYvaLstHWiwfCBBaz/Y3QKmfujVgfwKRz5+MTCe+p?=

=?iso-8859-1?Q?/SUEiTFMw01X3E+z6sJiUYs5tbJLjHvwvrThmuA8voagAxrxtZuAsfbmc3?=

=?iso-8859-1?Q?zlJanhtzlqjj5D26DFskVTPzX43OjrPhgUW5uiIe+CCHuiV5WWjpUCmeoG?=

=?iso-8859-1?Q?o4ry4CYUc/nhGewPnFI/nMKZolC+6CHaJqmaKz1xNZS98CngrSZUOW0QwA?=

=?iso-8859-1?Q?vmXaU2K9WEJB5oj9ggZP30+3okslxHQNqRPiKtN2d+EGAnqSLdOI2p+VIF?=

=?iso-8859-1?Q?/IlEMRFAtqs6L/7Neu1rk8YR2bdy14dnK/8+nJ4G7mjuRHOs1CR1ZJmQbi?=

=?iso-8859-1?Q?agHh+aG3lZ7Vum78ismz+lQqCG+gReIVoSJiCy0a6dvtJivQxKnugD5XzX?=

=?iso-8859-1?Q?DH9io/ZJ4eo0/qh5K0ofEmPS9PnkLAKXlTiKHjIlPgXUBEf1nPRYzlsVtx?=

=?iso-8859-1?Q?ZipdJVdWBRhj0xRby6GMNHuOQIWImCO69AyjZ9kYOe4ZZovTA6oWoNVTPM?=

=?iso-8859-1?Q?U1lZJMDF4kDmZvFsCYIVYfLwVaUUdKW3lu8wxpD7WZJ7rm7U5IoB+3Mwvb?=

=?iso-8859-1?Q?HG4vLo1PosHeNtDSyJmzq0k+D9TW1Zk0FkYrjOAX4sQY/nngohqZsyNKUE?=

=?iso-8859-1?Q?rcKF1G2j2o6TLK5/KSvtRs+XwxHBh9EoAiIEjqi+VRRTZdoHUThZccPUdf?=

=?iso-8859-1?Q?B51/TZjHVMIWVbw/mY7oLjn6G2DysId3mkGqxFqL1S6bXkMvrI59lNaRwf?=

=?iso-8859-1?Q?2tiboTes+4GEXtsz8QtjyLCJbZMfJeR7pt+Bdw40/gVQpHshOBRQNJkqXr?=

=?iso-8859-1?Q?VzBBs1i2CXvAe0QWpu6Tx+WR1apsO4rDxWEeMv3QHvcnSbkj0Ey2Csa9Ak?=

=?iso-8859-1?Q?meTajC7YRf2FSAUQhfn4UdAZGkMuvZmUUhrCK/bLD+tjQLcBxS0NAG6w8u?=

=?iso-8859-1?Q?saGEaAatTvxgLG5tuQNQAQBH+rnrfXuiNe4Law7ZYu1JILFvEadju8S/eh?=

=?iso-8859-1?Q?7AjfXD6YzdLZFm+bvZt4fBgtsT9+ghT+3nOShaFxfauFpTSgcIzFs1s9qT?=

=?iso-8859-1?Q?4fOexyVgfn3PhS6SHsTdJSIaJbXbc=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?UqfrRXee9RWct+s9fyxI6rXdJzvNA046In8xdfdNJJ4PJfoGWKILBZt0Kq?=

=?iso-8859-1?Q?qShp6GGZQL/rRzjp/vK+RisPch3UZv4gSEvFdREm/hI+AdLnQWBYUwVJha?=

=?iso-8859-1?Q?qZrXNhoPe7NK/kU+7B2+cBsxzY4NI21Nk7e5bPKp/HCebarIMdvbooCGJ4?=

=?iso-8859-1?Q?xZrsPECWAmvwU6t11N/zhwYQpPZR+PwfjSVqsyCVTo4INlxBXyJ3WltkRg?=

=?iso-8859-1?Q?FDGoZuZhVbDS/W9npes8JrQ78oc+lUyzIwMxzm9MBKDjgpavah23d1MbYb?=

=?iso-8859-1?Q?PgnlI5dFezZDZ+RjdSlwFyjzRn8xHIg3KVglFp+yRI5R8l0DZpDXd067NQ?=

=?iso-8859-1?Q?pThAM4aaY1kATnU7S9CZNtj5ao2wg9snD63js6qeDNCYCvE4zupr5C242j?=

=?iso-8859-1?Q?ob/ye+iP0ob7oxknXOfxgd4gcV/k8nuPM6OMcSoyTLWUzkpx7SunhN2veV?=

=?iso-8859-1?Q?475+TJKRFwj4Znfu6kuEjb1BZENMnTiPGt3vTlFkIHdTvTHGX4DDWNB6YD?=

=?iso-8859-1?Q?ff81Of4pyadbngo3Uu+D6xqN9pN7lF5cIf+C0kfp7vq7PAzvYJOj21i7XM?=

=?iso-8859-1?Q?rcKd/7pZDZmKryxbAm3mB8DgYNOGg/H7S2IKhHQUU1pqfc4bDebQco6a9t?=

=?iso-8859-1?Q?Ps3Ui2Pbi2oWsjZvuA627xtrPvWa4djsb3hPmM1om+bpKrv0ltdkdRpS66?=

=?iso-8859-1?Q?Ywg8zgY1Kf0A/kvBnFmk84fabSTPBQ1aGp7Gff/QYOxVRxMoAzxws2qudS?=

=?iso-8859-1?Q?e0Q4nO/2Aw5P5nLRY5tFMGY/L9YOvCnyJUYnkeL2w7ES2prHwHrPaxJqr7?=

=?iso-8859-1?Q?CfhKKlRRio8e60xWYAT1s985e/+7JFSYCp0PnbulL3dU0dTCfQ+nsQv7+y?=

=?iso-8859-1?Q?pYwPA+02QNid3RIl86TdmnsHhXpCJP0PdWpli5UvPsuCJ8KFlILR1JH1sd?=

=?iso-8859-1?Q?yoSrPbHMvNeOez7zU2MWnzmrrzI+kQ4N04VC7cDlv/nLlBa3+oRtpfUNLu?=

=?iso-8859-1?Q?GxVwIz3TtNzsiG+9sgiKVNlgESPObTljemiSzoLxYCXOvic6vpRJ6p++HN?=

=?iso-8859-1?Q?lTjxr17klwscPHYxVLzNkD14Ft08hLkFl+kD3GclllW6bvAPiqzsWbaypJ?=

=?iso-8859-1?Q?1rYROmmNS1UR+3CARL31Wa60jD6pYXEMDbnGVdge/xNirTDQCSWgeWv4Mr?=

=?iso-8859-1?Q?xX0lalZX0WDROFRYlMvwAi+yxmKaTwQ6yfqFFd80+KlMQzp8K3NJq0EDsP?=

=?iso-8859-1?Q?82ezEsYF461R10AimFcHSDn5YpxqIRDv9qCe9o+M2mBUdIYcs6V0f+bbJZ?=

=?iso-8859-1?Q?2f8HmfRwskhQe2gVIzpORJywzPxi8vxjx1nYKLoCyLnQO1Q1PP/1ZO9AKR?=

=?iso-8859-1?Q?emsn4LE+md?=

Content-Type: multipart/alternative;

boundary="_000_JH0PR01MB6805553344E78BC1D2B922ED9D302JH0PR01MB6805apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: JH0PR01MB6805.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 034a1fca-8945-4536-cf79-08dd151eb524

X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Dec 2024 11:19:38.8397

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEL0PFEA909E648



--_000_JH0PR01MB6805553344E78BC1D2B922ED9D302JH0PR01MB6805apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hi,



I hope you are doing well.







I visited your website and was impressed with its design. However, it's not=

ranking well on Google.







As an experienced SEO Expert, I can help improve your rankings. I offer com=

petitive and affordable rates for my services.







Interested in a proposal?







Many Thanks!!

Clint





--_000_JH0PR01MB6805553344E78BC1D2B922ED9D302JH0PR01MB6805apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








=3D"font-family: Cambria, "serif"; font-size: 11pt; color: rgb(23=

, 54, 93);">Hi,





I hope you are doing well.




"serif"; font-size: 11pt; color: rgb(23, 54, 93);"> =




"serif"; font-size: 11pt; color: rgb(23, 54, 93);">I visited you=

r website and was impressed with its design. However, it's not ranking well=

on Google.




"serif"; font-size: 11pt; color: rgb(23, 54, 93);"> =




"serif"; font-size: 11pt; color: rgb(23, 54, 93);">As an experie=

nced SEO Expert, I can help improve your rankings. I offer competitive and =

affordable rates for my services.




"serif"; font-size: 11pt; color: rgb(23, 54, 93);"> =




"serif"; font-size: 11pt; color: rgb(23, 54, 93);">Interested in=

a proposal?




"serif"; font-size: 11pt; color: rgb(23, 54, 93);"> =




"serif"; font-size: 11pt; color: rgb(23, 54, 93);">Many Thanks!!=




Clint




nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">












--_000_JH0PR01MB6805553344E78BC1D2B922ED9D302JH0PR01MB6805apcp_--

Royal Bank of Canada Phish from djaweb.dz

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 05 Dec 2024 04:21:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tJ9ue-00000000ERp-3fR4

for dave@doctor.nl2k.ab.ca;

Thu, 05 Dec 2024 04:20:52 -0700

Resent-From: The Doctor

Resent-Date: Thu, 5 Dec 2024 04:20:52 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smartgamma.dev ([188.166.33.130]:52702 helo=mail.smartgamma.dev)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tJ4hO-00000000MZm-34A7

for sales@nk.ca;

Wed, 04 Dec 2024 22:46:58 -0700

Received: from localhost (localhost.localdomain [127.0.0.1])

by mail.smartgamma.dev (Postfix) with ESMTP id 2E2A4333AD9

for ; Thu, 5 Dec 2024 07:44:55 +0200 (EET)

Received: from mail.smartgamma.dev ([127.0.0.1])

by localhost (mail.smartgamma.dev [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id nYsV5TXCHj6A for ;

Thu, 5 Dec 2024 07:44:54 +0200 (EET)

Received: from localhost (localhost.localdomain [127.0.0.1])

by mail.smartgamma.dev (Postfix) with ESMTP id E479C333ADA

for ; Thu, 5 Dec 2024 07:44:54 +0200 (EET)

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.smartgamma.dev E479C333ADA

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smartgamma.dev;

s=FB38C640-C4C5-11ED-A988-1A1FB4B3D8AD; t=1733377494;

bh=LjiZRUWEUr9Mg0tIDhb+hx0B/82/46BbBEuLup5t7X8=;

h=MIME-Version:From:To:Date:Message-Id;

b=X5j9qn/+0isHhRWSUdKPvQrEQZbG32rwfn1+MkSm+NuDoxRvdwZTuhR2lDfG4H2yL

FeJpTx6kos+uDV0LMGQdCZZjYFyIxFqpC2xx5ZJleOdNmhOis5YE7aXHSJNLAKBoNG

puK/9yrr2M5eiRHyUKoSLha56zmSd95FF4ZSQIxosgFU3+Jg6ZNONIV6bjRb9MXEZ+

KUGG1xeehEGu1S2wpUeS8+v+ulyyKzg9ENika0VVXLwJ2nOEWGgMdm7jR+stt5kT6s

7cOsgkHUrouH41tKKanNRQOPohIfWqszdXHFoz6jyqW+zeF3OFVlJLRWMDKatBoUD7

idLJHacfylY7Q==

X-Virus-Scanned: amavisd-new at smartgamma.dev

Received: from mail.smartgamma.dev ([127.0.0.1])

by localhost (mail.smartgamma.dev [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id V5KTxKxJQ98t for ;

Thu, 5 Dec 2024 07:44:54 +0200 (EET)

Received: from fayz (unknown [154.249.153.182])

by mail.smartgamma.dev (Postfix) with ESMTPSA id 9830C333AD9

for ; Thu, 5 Dec 2024 07:44:54 +0200 (EET)

MIME-Version: 1.0

From: "Royal Bank of Canada (RBC) Security Team"

To: sales@nk.ca

Date: 5 Dec 2024 06:44:54 +0100

Subject: Identity Verification Needed: Prevent Account Lock

Content-Type: text/html; charset=us-ascii

Content-Transfer-Encoding: quoted-printable

Message-Id: <20241205054454.9830C333AD9@mail.smartgamma.dev>

X-Spam_score: 13.5

X-Spam_score_int: 135

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ROYAL BANK OF CANADA Important Security Alert Dear Valued

Customer,



Content analysis details: (13.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[188.166.33.130 listed in dnsbl.ahbl.org]

[188.166.33.130 listed in dnsbl.ahbl.org]

[188.166.33.130 listed in dnsbl.ahbl.org]

[188.166.33.130 listed in dnsbl.ahbl.org]

[154.249.153.182 listed in dnsbl.ahbl.org]

[154.249.153.182 listed in dnsbl.ahbl.org]

[154.249.153.182 listed in dnsbl.ahbl.org]

[154.249.153.182 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[188.166.33.130 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[188.166.33.130 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[188.166.33.130 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[188.166.33.130 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[154.249.153.182 listed in will-spam-for-food.eu.org]

[154.249.153.182 listed in will-spam-for-food.eu.org]

[154.249.153.182 listed in will-spam-for-food.eu.org]

[154.249.153.182 listed in will-spam-for-food.eu.org]

[154.249.153.182 listed in will-spam-for-food.eu.org]

[154.249.153.182 listed in will-spam-for-food.eu.org]

[154.249.153.182 listed in will-spam-for-food.eu.org]

[154.249.153.182 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

[188.166.33.130 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[154.249.153.182 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.0 ACCT_PHISHING Possible phishing for account information

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} Identity Verification Needed: Prevent Account Lock




l, sans-serif; BACKGROUND: rgb(0,32,91); WHITE-SPACE: normal; WOR=

D-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rg=

b(255,255,255); PADDING-BOTTOM: 20px; FONT-STYLE: normal; TEXT-AL=

IGN: center; PADDING-TOP: 20px; PADDING-LEFT: 20px; ORPHANS: 2; W=

IDOWS: 2; LETTER-SPACING: normal; PADDING-RIGHT: 20px; TEXT-INDEN=

T: 0px; font-variant-ligatures: normal; font-variant-caps: normal=

; -webkit-text-stroke-width: 0px; text-decoration-thickness: init=

ial; text-decoration-style: initial; text-decoration-color: initi=

al">3D"R=<br
oyal Bank of Canada Logo" src=3D"https://www.rbcroyalbank.com/dvl=

/v1.0/assets/images/logos/rbc-logo-shield.svg">=0D=0A


"FONT-SIZE: 24px; FONT-WEIGHT: 600; MARGIN: 0px">ROYAL BANK OF CA=

NADA

=0D=0A

; FONT-FAMILY: Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACI=

NG: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(51,51=

,51); PADDING-BOTTOM: 20px; FONT-STYLE: normal; PADDING-TOP: 20px=

; PADDING-LEFT: 20px; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: norm=

al; PADDING-RIGHT: 20px; TEXT-INDENT: 0px; font-variant-ligatures=

: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0=

px; text-decoration-thickness: initial; text-decoration-style: in=

itial; text-decoration-color: initial">=0D=0A


ZE: 20px; MARGIN-BOTTOM: 10px">Important Security Alert

=0D=0A=

=

Dear Valued Customer,

=0D=0A


N: 10px 0px; LINE-HEIGHT: 1.5">Your account may be locked due to =

new security measures. To ensure uninterrupted access, we require=

you to verify your identity.

=0D=0A


x; MARGIN: 10px 0px; LINE-HEIGHT: 1.5">Please log in and update y=

our account details as soon as possible to prevent any inconvenie=

nce.


RATION: none; MAX-WIDTH: 200px; BACKGROUND: rgb(0,113,206); FONT-=

WEIGHT: bold; COLOR: rgb(255,255,255); PADDING-BOTTOM: 12px; TEXT=

-ALIGN: center; PADDING-TOP: 12px; PADDING-LEFT: 20px; MARGIN: 20=

px auto 0px; DISPLAY: block; PADDING-RIGHT: 20px; border-radius: =

5px" href=3D"https://declarateenquiebra.cl/rolo.php">Verify Your =

Account
=0D=0A

px; FONT-FAMILY: Arial, sans-serif; BACKGROUND: rgb(249,249,249);=

WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FO=

NT-WEIGHT: 400; COLOR: rgb(119,119,119); PADDING-BOTTOM: 15px; FO=

NT-STYLE: normal; TEXT-ALIGN: center; PADDING-TOP: 15px; PADDING-=

LEFT: 15px; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; PADDIN=

G-RIGHT: 15px; TEXT-INDENT: 0px; font-variant-ligatures: normal; =

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-d=

ecoration-thickness: initial; text-decoration-style: initial; tex=

t-decoration-color: initial">=0D=0A

This email was sent by Roya=

l Bank of Canada. Please do not reply to this email.

=0D=0A

=

For more information, visit our 
T-DECORATION: none; COLOR: rgb(0,113,206)" href=3D"https://declar=

ateenquiebra.cl/rolo.php">official website.

=0D=0A
> 





Nigerian Spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 04 Dec 2024 20:45:00 -0700

Received: from mail-vs1-f50.google.com ([209.85.217.50]:50239)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tJ2mq-000000003Ve-2Tur

for dave@doctor.nl2k.ab.ca;

Wed, 04 Dec 2024 20:44:23 -0700

Received: by mail-vs1-f50.google.com with SMTP id ada2fe7eead31-4afbf632c82so29725137.0

for ; Wed, 04 Dec 2024 19:42:29 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1733370144; x=1733974944; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=fJKhUw/RmNA6IA01Y5eiEOKMaFJEkaJA6fYGkM7syHs=;

b=lldFy3kBUHMHFnBDW+m5VKnRcwWilUz0/G3cKOA+jwqv9NdgMx+Eg/bcWBIJ1Q+4mm

wysOOCCidjNHJWJo059j33G+QuEiA1hXNV8+cUmgspxTtjxjoxTArRZ+2TlFR2qxHD8D

MFTbyGkh1mAcT/+fZuwkMZXug0yUUMF392MJneh/4abni5YWgKSn9pY/PlAq4y2g3daE

oL0HmQ3Ja+KjMGtnAuNNW2rnCDkPZaiLu3xH2Zg9D5qpm7A9VpiKQkMpwJwP+7biyPhi

AgALJ3QV35Xb/r17eQHGFmsLxqnnxbdxmd6kiRvbOkzPLWJlZ7FeIvVJ8DSMsozivCZS

MLkA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1733370144; x=1733974944;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=fJKhUw/RmNA6IA01Y5eiEOKMaFJEkaJA6fYGkM7syHs=;

b=YRK5QoJ5y1p6MTmv0GhMkXH1m1hcJ5b+HUeV3+cexSP+v9UtIVbSdVTLkM4jrfEWD/

XpTIlg9emGLUM4ShUYnXERsljDLkvAVeDI3WwMCAWYyi5zisCaEGXCitjF+iikAgf/5T

+cEmgXDY9aK7cCd+yQgTCGqN+KNflur0skTMo2iqKPiRd1d5iPxvsiMK+0iOCPvXrDfg

2dVJiSdfX+4jzIGswE9FxNEhid7xzJpjIf49voDBACPIriMJTYWJM9EY1Ui/3RldM6OD

FOKYA0mY9Q7M/miE6SdeXRllmPLLCrp8nqqJAzMZX9rtK5g5PZMN5W/LeJxZrM59ujU6

iZuQ==

X-Forwarded-Encrypted: i=1; AJvYcCVmVMtprBOqj5DJ05speb9kaaSu9PUCiHfqT5qbOW75UqEvxot1X2oBdj0x1oYqtliJ/PRk@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YxBljnIvYsgxpHxxxyKfdrxrBHi2kQvS5UNDZ6v54h8CwOQL4Dd

/mYf5sBGRkJSnwziFsr2zmfG5qer/j0hwnpMqomAxvJvGnvPPvk3WQC9E69hEGaKUrFp/6CHLza

kNGi/jBD/dNEPQ6YISiAZ6awbpDs=

X-Gm-Gg: ASbGncuIKZZxQByAKIsEMqd8cGYQovwjXXG5CtxtMj0VTdAyC3wcpnMzRZz5Zb9LCfS

rTSf2PBisYABWkv7kmzxHDbs9D2GxqN87KwhdZrniRLxIOxd61U1DeILVHJFtJDAE

X-Google-Smtp-Source: AGHT+IF188743orJ6ZPmZSiPPtZnSGncKoPEp/yQYQiPmVO1oedx99M70BSP8A8NWrxP+G+VlyFHWJ8Os0DTt41tWBk=

X-Received: by 2002:a05:6102:50ab:b0:4af:ba61:fba with SMTP id

ada2fe7eead31-4afba610fedmr1745861137.22.1733370143709; Wed, 04 Dec 2024

19:42:23 -0800 (PST)

MIME-Version: 1.0

From: "Mr.Muhammad Musa"

Date: Thu, 5 Dec 2024 03:42:09 +0000

Message-ID:

Subject: ATTENTION PLEASE

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000ae220706287daf8e"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 18.7

X-Spam_score_int: 187

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear friend, My name is Mr. Muhammad Musa, I am a staff working

with the Bank of Africa here in Ouagadougou,Burkina Faso. I want you to help

me in receiving the sum of Twenty Seven Million Two Hundred thousand Dollars

($27,200,000) into your Bank Account. This fund was deposited in the bank

here by a foreign customer who [...]



Content analysis details: (18.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.217.50 listed in dnsbl.ahbl.org]

[209.85.217.50 listed in dnsbl.ahbl.org]

[209.85.217.50 listed in dnsbl.ahbl.org]

[209.85.217.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.217.50 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.217.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.217.50 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.217.50 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.217.50 listed in will-spam-for-food.eu.org]

[209.85.217.50 listed in will-spam-for-food.eu.org]

[209.85.217.50 listed in will-spam-for-food.eu.org]

[209.85.217.50 listed in will-spam-for-food.eu.org]

[209.85.217.50 listed in will-spam-for-food.eu.org]

[209.85.217.50 listed in will-spam-for-food.eu.org]

[209.85.217.50 listed in will-spam-for-food.eu.org]

[209.85.217.50 listed in will-spam-for-food.eu.org]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.217.50 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.217.50 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.217.50 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.50 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.217.50 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.217.50 listed in bl.score.senderscore.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[mrmuhammadmusa75(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[mazinwilliamsjean33(at)gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!

0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 HK_NAME_FM_MR_MRS No description available.

0.5 SUBJ_ATTENTION ATTENTION in Subject

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLY From and body contain different freemails

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

1.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} ATTENTION PLEASE



--000000000000ae220706287daf8e

Content-Type: text/plain; charset="UTF-8"



Dear friend,



My name is Mr. Muhammad Musa, I am a staff working with the Bank of Africa

here in Ouagadougou,Burkina Faso.



I want you to help me in receiving the sum of Twenty Seven Million Two

Hundred thousand Dollars ($27,200,000) into your Bank Account. This fund

was deposited in the bank here by a foreign customer who died accidentally

alongside with his entire family members many years ago.



Nobody had asked for this fund till now please contact me through my

private email address: (mmusa848@yahoo.com) for more details.



Mr. Muhammad Musa.



--000000000000ae220706287daf8e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear friend,

My name is Mr. Muhammad Musa, I am a s=

taff working with the Bank of Africa here in Ouagadougou,Burkina Faso.
<=

br>I want you to help me in receiving the sum of Twenty Seven Million Two H=

undred thousand Dollars ($27,200,000) into your Bank Account. This fund was=

deposited in the bank here by a foreign customer who died accidentally alo=

ngside with his entire family members many years ago.

Nobody had ask=

ed for this fund till now please contact me through my private email addres=

s: (mmusa848@yahoo.com) for more =

details.

Mr. Muhammad Musa.




--000000000000ae220706287daf8e--

German language spam from OVH

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 04 Dec 2024 17:01:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tIzHs-00000000NoO-0vkf

for dave@doctor.nl2k.ab.ca;

Wed, 04 Dec 2024 17:00:08 -0700

Resent-From: The Doctor

Resent-Date: Wed, 4 Dec 2024 17:00:08 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp.ico-media-consult.com ([198.50.158.35]:36127)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tIy2j-00000000FL8-2Okq

for root@nl2k.ab.ca;

Wed, 04 Dec 2024 15:40:30 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=ico-media-consult.com; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:Reply-To:From:Date:Subject:To:Sender:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=Q5coHeO5LGT3cNY06h4/9SLSt41bTu31JhgAuRZiIcQ=; b=0v0fvP9zrNF8rrVx7kVxWN5VUB

iLi10eEEIfN/L5GbPb+95bDn9uizJ8VNL9370OmBWaVzgXqa5FjRywwWpfmktgak/VODsgiASBtkH

tUAmwsgCpURTffcpizLKxtbEj0ATsCe5h2vBgVOQ90WUg8I7BFL0FxrpifswrFPAPGd0brXro79Jj

gsT3xohOOMHzM5XV9GdxWReJx3KCXRGJKi8rka8zWdI7VqTOAKhJ1qxSee/mpwOnRLWJjIBzRwxOS

ceYYIO5DHgCD9LI2CiWBP54OqZBLt4+DZxGgYGyKWnpCBipnMOKHZJeB7rBN++BkK35Zo8HGESv/q

1ksXrLqw==;

Received: from icomedia by server.jambovt.com.br with local (Exim 4.98)

(envelope-from )

id 1tIy2V-0000000BsvQ-2gHD

for root@nl2k.ab.ca;

Wed, 04 Dec 2024 19:40:11 -0300

To: root@nl2k.ab.ca

Subject: =?UTF-8?Q?=E2=80=9CTake_advantage_of_the_opportunity:_pre-IP?=

=?UTF-8?Q?O_investments_in_sustainable_energy_with_a_500%_re?=

=?UTF-8?Q?turn!=E2=80=9D?=

X-PHP-Originating-Script: 1245:PHPMailer.php

Date: Wed, 4 Dec 2024 19:40:11 -0300

From: Media Consult

Reply-To: Media Consult

Message-ID:

X-Priority: 3

X-Mailer: PHPMailer 6.8.1 (https://github.com/PHPMailer/PHPMailer)

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1=_ieeC8lS4Jb2P0zWfllii3UvCgFKNycuCDSlch4cWY"

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server.jambovt.com.br

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [1245 976] / [47 12]

X-AntiAbuse: Sender Address Domain - ico-media-consult.com

X-Get-Message-Sender-Via: server.jambovt.com.br: authenticated_id: icomedia/from_h

X-Authenticated-Sender: server.jambovt.com.br: contato@ico-media-consult.com

X-Source:

X-Source-Args: /opt/cpanel/ea-php80/root/usr/bin/php-cgi /home/icomedia/public_html/artisan schedule:run

X-Source-Dir: ico-media-consult.com:/public_html

X-Spam_score: 19.0

X-Spam_score_int: 190

X-Spam_bar: +++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your email client cannot read this message. To view it online,

please visit this link: http://ico-media-consult.com/newsletters/web/show/5/526475

To stop receiving our content visit the link: http://ico-media-consult.com/contacts/unsubscribe/526475/6/5


width=" [...]



Content analysis details: (19.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[198.50.158.35 listed in dnsbl.ahbl.org]

[198.50.158.35 listed in dnsbl.ahbl.org]

[198.50.158.35 listed in dnsbl.ahbl.org]

[198.50.158.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[198.50.158.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[198.50.158.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[198.50.158.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[198.50.158.35 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[198.50.158.35 listed in will-spam-for-food.eu.org]

[198.50.158.35 listed in will-spam-for-food.eu.org]

[198.50.158.35 listed in will-spam-for-food.eu.org]

[198.50.158.35 listed in will-spam-for-food.eu.org]

[198.50.158.35 listed in will-spam-for-food.eu.org]

[198.50.158.35 listed in will-spam-for-food.eu.org]

[198.50.158.35 listed in will-spam-for-food.eu.org]

[198.50.158.35 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[198.50.158.35 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[198.50.158.35 listed in zen.spamhaus.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: ico-media-consult.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[198.50.158.35 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[198.50.158.35 listed in bl.score.senderscore.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ico-media-consult.com]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[198.50.158.35 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[198.50.158.35 listed in sa-accredit.habeas.com]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: ico-media-consult.com/198.50.158.35]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: ico-media-consult.com/198.50.158.35]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

1.0 FROM_FMBLA_NEWDOM14 From domain was registered in last 7-14 days

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

2.0 US_8BIT US-ASCII isn't an eight bit charset

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

Subject: {SPAM?} =?UTF-8?Q?=E2=80=9CTake_advantage_of_the_opportunity:_pre-IP?=

=?UTF-8?Q?O_investments_in_sustainable_energy_with_a_500%_re?=

=?UTF-8?Q?turn!=E2=80=9D?=



--b1=_ieeC8lS4Jb2P0zWfllii3UvCgFKNycuCDSlch4cWY

Content-Type: text/plain; charset=us-ascii



Your email client cannot read this message.



To view it online, please visit this link: http://ico-media-consult.com/newsletters/web/show/5/526475



To stop receiving our content visit the link: http://ico-media-consult.com/contacts/unsubscribe/526475/6/5

Imagem



--b1=_ieeC8lS4Jb2P0zWfllii3UvCgFKNycuCDSlch4cWY

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable




inherit;">
align: inherit;">
rtical-align: inherit;">
e=3D"vertical-align: inherit;">=F0=9F=92=A1 Entdecken Sie eine Welt voller =

Innovation =F0=9F=92=A1
ont>





=


erit;">
gn: inherit;">
cal-align: inherit;">Wir stellen d=

en Luessen Token vor, den weltweit ersten Energie-Token, der durch echte Pr=

ojekte in den erneuerbaren Bereichen Energien und Nanotechnologie unterst&u=

uml;tzt wird. =F0=9F=8C=8D=E2=9A=A1=EF=B8=8F
ont>





=


erit;">
gn: inherit;">
cal-align: inherit;">Die Luessen T=

echnology Group ist mit großen Projekten im Bereich erneuerbare Energ=

ien geleitet in der Nanotechnologie und bei Energielösungen. Indem Sie=

in Luessen Token investieren, unterstützen Sie nicht nur nachhaltige =

Energie, sondern erhalten auch Zugang zu Spitzentechnologien, die die Zukun=

ft prägen werden. =F0=9F=9A=80
t>





=


erit;">
gn: inherit;">
cal-align: inherit;">Profitiere vo=

m aktuell verfügbaren 50% Rabatt auf den eigentlichen Token-Wert von 0=

,1 EUR und investiere noch heute in deine nachhaltige Zukunft! =F0=9F=8C=

=B1





=


erit;">
gn: inherit;">
cal-align: inherit;">Jetzt investi=

eren =E2=9E=A1=EF=B8=8F [ =


get=3D"_blank">
ical-align: inherit;">
=3D"vertical-align: inherit;">
t style=3D"vertical-align: inherit;">
;">Link zum Investieren
nt>
ign: inherit;">
ical-align: inherit;">
=3D"vertical-align: inherit;">
t style=3D"vertical-align: inherit;">
;"> ]



r>
sb-type=3D"unsubscribelink" style=3D"font-family:Arial, Helvetica, sans-ser=

if;color:#333333;font-size:11px;">Clique aqui para cancelar a assinatura
>

/open/526475/5/he/image.png" width=3D"1" height=3D"1" alt=3D"Imagem" />



--b1=_ieeC8lS4Jb2P0zWfllii3UvCgFKNycuCDSlch4cWY--

Power charger phone from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 04 Dec 2024 17:00:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tIzHg-00000000N4V-0L0T

for dave@doctor.nl2k.ab.ca;

Wed, 04 Dec 2024 16:59:56 -0700

Resent-From: The Doctor

Resent-Date: Wed, 4 Dec 2024 16:59:56 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 110.15.205.35.bc.googleusercontent.com ([35.205.15.110]:46190 helo=localhost)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tIy2j-00000000FLC-3Pkv

for root@nl2k.ab.ca;

Wed, 04 Dec 2024 15:40:30 -0700

Received: by localhost (Postfix, from userid 1000)

id 6C08343C15D; Wed, 4 Dec 2024 22:23:59 +0000 (UTC)

To: root@nl2k.ab.ca

From: Swift Power Hub

Subject: Small but fast! Pick up your Swift Power Hub charger ASAP

MIME-Version: 1.0

Content-Type: text/html

Message-Id: <20241204223038.6C08343C15D@localhost>

Date: Wed, 4 Dec 2024 22:23:59 +0000 (UTC)

X-Spam_score: 24.0

X-Spam_score_int: 240

X-Spam_bar: ++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Unsubscribe 7652 Sawmill Rd; STE 213, Dublin, OH 43016



Content analysis details: (24.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.205.15.110 listed in dnsbl.ahbl.org]

[35.205.15.110 listed in dnsbl.ahbl.org]

[35.205.15.110 listed in dnsbl.ahbl.org]

[35.205.15.110 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.205.15.110 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.205.15.110 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.205.15.110 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.205.15.110 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.205.15.110 listed in will-spam-for-food.eu.org]

[35.205.15.110 listed in will-spam-for-food.eu.org]

[35.205.15.110 listed in will-spam-for-food.eu.org]

[35.205.15.110 listed in will-spam-for-food.eu.org]

[35.205.15.110 listed in will-spam-for-food.eu.org]

[35.205.15.110 listed in will-spam-for-food.eu.org]

[35.205.15.110 listed in will-spam-for-food.eu.org]

[35.205.15.110 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.205.15.110 listed in sbl-xbl.spamhaus.org]

[35.205.15.110 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.205.15.110 listed in zen.spamhaus.org]

0.7 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL

[35.205.15.110 listed in zen.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[35.205.15.110 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[35.205.15.110 listed in sa-trusted.bondedsender.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.205.15.110 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[35.205.15.110 listed in bl.score.senderscore.com]

0.0 FSL_HELO_NON_FQDN_1 No description available.

3.6 HELO_LOCALHOST No description available.

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

2.0 URI_ONLY_MSGID_MALF URI only + malformed message ID

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 DYN_RDNS_SHORT_HELO_HTML Sent by dynamic rDNS, short HELO, and HTML

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

3.7 DYNAMIC_IMGUR dynamic IP + hosted image

0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for

an image

Subject: {SPAM?} Small but fast! Pick up your Swift Power Hub charger ASAP






Unsubscribe
7652 Sawmill Rd; STE 213, Dublin, OH 43016

Power charger phone from Google

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 04 Dec 2024 17:00:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tIzHP-00000000LQE-3CMB

for dave@doctor.nl2k.ab.ca;

Wed, 04 Dec 2024 16:59:39 -0700

Resent-From: The Doctor

Resent-Date: Wed, 4 Dec 2024 16:59:39 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 110.15.205.35.bc.googleusercontent.com ([35.205.15.110]:51626 helo=localhost)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tIxfS-000000005NX-333C

for root@nk.ca;

Wed, 04 Dec 2024 15:16:26 -0700

Received: by localhost (Postfix, from userid 1000)

id 3EC322A8F37; Wed, 4 Dec 2024 21:59:47 +0000 (UTC)

To: root@nk.ca

From: Swift Power Hub

Subject: Small but fast! Pick up your Swift Power Hub charger ASAP

MIME-Version: 1.0

Content-Type: text/html

Message-Id: <20241204220442.3EC322A8F37@localhost>

Date: Wed, 4 Dec 2024 21:59:47 +0000 (UTC)

X-Spam_score: 24.0

X-Spam_score_int: 240

X-Spam_bar: ++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Unsubscribe 7652 Sawmill Rd; STE 213, Dublin, OH 43016



Content analysis details: (24.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.205.15.110 listed in dnsbl.ahbl.org]

[35.205.15.110 listed in dnsbl.ahbl.org]

[35.205.15.110 listed in dnsbl.ahbl.org]

[35.205.15.110 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.205.15.110 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.205.15.110 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.205.15.110 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.205.15.110 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.205.15.110 listed in will-spam-for-food.eu.org]

[35.205.15.110 listed in will-spam-for-food.eu.org]

[35.205.15.110 listed in will-spam-for-food.eu.org]

[35.205.15.110 listed in will-spam-for-food.eu.org]

[35.205.15.110 listed in will-spam-for-food.eu.org]

[35.205.15.110 listed in will-spam-for-food.eu.org]

[35.205.15.110 listed in will-spam-for-food.eu.org]

[35.205.15.110 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.205.15.110 listed in sbl-xbl.spamhaus.org]

[35.205.15.110 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.205.15.110 listed in zen.spamhaus.org]

0.7 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL

[35.205.15.110 listed in zen.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[35.205.15.110 listed in sa-trusted.bondedsender.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[35.205.15.110 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.205.15.110 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[35.205.15.110 listed in bl.score.senderscore.com]

0.0 FSL_HELO_NON_FQDN_1 No description available.

3.6 HELO_LOCALHOST No description available.

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 DYN_RDNS_SHORT_HELO_HTML Sent by dynamic rDNS, short HELO, and HTML

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for

an image

3.7 DYNAMIC_IMGUR dynamic IP + hosted image

2.0 URI_ONLY_MSGID_MALF URI only + malformed message ID

Subject: {SPAM?} Small but fast! Pick up your Swift Power Hub charger ASAP






Unsubscribe
7652 Sawmill Rd; STE 213, Dublin, OH 43016