IPTV spam from Google Apps

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Dec 2024 14:19:23 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKl7n-000000004U1-3aoX

for dave@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 14:17:03 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Dec 2024 14:17:03 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 181.124.187.35.bc.googleusercontent.com ([35.187.124.181]:49076 helo=cs-553906499997-default.europe-west1-b.c.m76c8cac3f3880018-tp.internal)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKkMU-00000000KRe-1luT

for sales@nk.ca;

Mon, 09 Dec 2024 13:28:14 -0700

Received: from cs-553906499997-default (localhost [127.0.0.1])

by cs-553906499997-default.europe-west1-b.c.m76c8cac3f3880018-tp.internal (Postfix) with ESMTP id 4430F2578E7

for ; Mon, 9 Dec 2024 20:13:13 +0000 (UTC)

Date: Mon, 9 Dec 2024 20:13:13 +0000

To: sales@nk.ca

From: N o T i F i C A T i o N S -I P tv-

Subject: Watch Champions League, Premier League, La Liga & More Live Now! -I P tv- 4K FHD, SD & HD Quality

Message-ID:

X-Mailer: PHPMailer 6.9.3 (https://github.com/PHPMailer/PHPMailer)

MIME-Version: 1.0

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: 8bit

X-Spam_score: 13.2

X-Spam_score_int: 132

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Exclusive IPTV Offer Unlimited IPTV Channels & On-demand

Movies



Content analysis details: (13.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.187.124.181 listed in dnsbl.ahbl.org]

[35.187.124.181 listed in dnsbl.ahbl.org]

[35.187.124.181 listed in dnsbl.ahbl.org]

[35.187.124.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.187.124.181 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.187.124.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.187.124.181 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.187.124.181 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.187.124.181 listed in will-spam-for-food.eu.org]

[35.187.124.181 listed in will-spam-for-food.eu.org]

[35.187.124.181 listed in will-spam-for-food.eu.org]

[35.187.124.181 listed in will-spam-for-food.eu.org]

[35.187.124.181 listed in will-spam-for-food.eu.org]

[35.187.124.181 listed in will-spam-for-food.eu.org]

[35.187.124.181 listed in will-spam-for-food.eu.org]

[35.187.124.181 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.187.124.181 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.187.124.181 listed in zen.spamhaus.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[35.187.124.181 listed in wl.mailspike.net]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.3 OFFER BODY: Offers you Something

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} Watch Champions League, Premier League, La Liga & More Live Now! -I P tv- 4K FHD, SD & HD Quality













Exclusive IPTV Offer













Company Logo

Unlimited IPTV
Channels & On-demand Movies











🔥 Black Friday Special: 24-Month IPTV Subscription! 🔥









Affordable Plans: Choose the Best Option for You









Discover Premium Entertainment Through Our IPTV Service!





  • Icon Access over 22,000 channels


  • Icon 12,000+ On-demand Movies


  • Icon 4K, FHD, SD & HD Quality


  • Icon Compatible with all devices


  • Icon Xtream IPTV codes


  • Icon IPTV M3U playlist


  • Icon Includes UEFA Champions League




Get Started Now









If you need help, contact us on WhatsApp

or email us at .

















IPTV spam from Google Apps

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Dec 2024 14:19:23 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKl7b-000000004SE-2DHe

for dave@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 14:16:51 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Dec 2024 14:16:51 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 181.124.187.35.bc.googleusercontent.com ([35.187.124.181]:43368 helo=cs-553906499997-default.europe-west1-b.c.m76c8cac3f3880018-tp.internal)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKkJM-00000000KCs-40v8

for root@nk.ca;

Mon, 09 Dec 2024 13:25:01 -0700

Received: from cs-553906499997-default (localhost [127.0.0.1])

by cs-553906499997-default.europe-west1-b.c.m76c8cac3f3880018-tp.internal (Postfix) with ESMTP id 56C2624CE2F

for ; Mon, 9 Dec 2024 20:09:16 +0000 (UTC)

Date: Mon, 9 Dec 2024 20:09:16 +0000

To: root@nk.ca

From: N o T i F i C A T i o N S -I P tv-

Subject: Watch Champions League, Premier League, La Liga & More Live Now! -I P tv- 4K FHD, SD & HD Quality

Message-ID:

X-Mailer: PHPMailer 6.9.3 (https://github.com/PHPMailer/PHPMailer)

MIME-Version: 1.0

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: 8bit

X-Spam_score: 9.5

X-Spam_score_int: 95

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Exclusive IPTV Offer Unlimited IPTV Channels & On-demand

Movies



Content analysis details: (9.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.187.124.181 listed in dnsbl.ahbl.org]

[35.187.124.181 listed in dnsbl.ahbl.org]

[35.187.124.181 listed in dnsbl.ahbl.org]

[35.187.124.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.187.124.181 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.187.124.181 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.187.124.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.187.124.181 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.187.124.181 listed in will-spam-for-food.eu.org]

[35.187.124.181 listed in will-spam-for-food.eu.org]

[35.187.124.181 listed in will-spam-for-food.eu.org]

[35.187.124.181 listed in will-spam-for-food.eu.org]

[35.187.124.181 listed in will-spam-for-food.eu.org]

[35.187.124.181 listed in will-spam-for-food.eu.org]

[35.187.124.181 listed in will-spam-for-food.eu.org]

[35.187.124.181 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.187.124.181 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.187.124.181 listed in zen.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[35.187.124.181 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[35.187.124.181 listed in sa-trusted.bondedsender.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[35.187.124.181 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.187.124.181 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[35.187.124.181 listed in bl.score.senderscore.com]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.3 OFFER BODY: Offers you Something

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} Watch Champions League, Premier League, La Liga & More Live Now! -I P tv- 4K FHD, SD & HD Quality













Exclusive IPTV Offer













Company Logo

Unlimited IPTV
Channels & On-demand Movies











🔥 Black Friday Special: 24-Month IPTV Subscription! 🔥









Affordable Plans: Choose the Best Option for You









Discover Premium Entertainment Through Our IPTV Service!





  • Icon Access over 22,000 channels


  • Icon 12,000+ On-demand Movies


  • Icon 4K, FHD, SD & HD Quality


  • Icon Compatible with all devices


  • Icon Xtream IPTV codes


  • Icon IPTV M3U playlist


  • Icon Includes UEFA Champions League




Get Started Now









If you need help, contact us on WhatsApp

or email us at .

















Nigerian Spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Dec 2024 10:59:00 -0700

Received: from mail-pl1-f181.google.com ([209.85.214.181]:42312)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKi1v-00000000DHW-3ZOj

for dave@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 10:58:51 -0700

Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2167141dfa1so142735ad.1

for ; Mon, 09 Dec 2024 09:56:53 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1733767007; x=1734371807; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=KOhZ4++GbDrd+zdX+/J/nll/nGZKX21tJysw9ltMFDo=;

b=eXAVPDBNgFik4DadKcjF0lDl1+vOMEVX8844Miu1eRzZPRQsOPrUd4jhm7gZhQ2HCp

k7emeCDf7Zue982Kb0ZcfKUwgSLadx4QRdAzYrRSI06AKb1oNs1Nx3+n466iN4G9Iy2p

m0KRMKIWowwma6vk/myGIZ4sVzNhRkgE1RbVeNrjlZMaCKN9K+CDbvyQ0TaIpmrbsH8f

2p/pjpGGYzTeWoojOgWIyyazv0qWpt8r7J4suvANY3vvNK+SbRlBA49J8VFggDecvo6N

mEfanwmGI52Yl16mzNE8wUEvcr5lfKtHIdu/5H/ToGQNTMiP0+VQMGftxd8muVjs1vYX

buNg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1733767007; x=1734371807;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=KOhZ4++GbDrd+zdX+/J/nll/nGZKX21tJysw9ltMFDo=;

b=ndPlFZGbt7/cFjqC4AtegPSq0EI5JE3Iwq18SabEveYwgrq8TE5ti9/+MltJebiP9u

Dc3oN6hDlBNrSnDZjwdkhKUOUOnTS7bc+X3+Rm3eVWAqXonJVvk1vEDlVYS3HtML7u44

E6iFarl8uHY0J8CVllsOa5p0twnlbXFKu+jlBcsauPxb6gNtClbG+ohgCmnvqrut/e8j

QKmIf5U9INLc3WvNptO2z4qdnFsWDYUSoFDiS0TqmhQwitOhYtIxZ3SrFUFGcq73hRnl

ogWVtAGUYKnzyIOyCV3buT/qvEPKGzOiP2p9f1/AB+2/lb+MsEIk0bap1FBFEOHP6CIw

vZJw==

X-Forwarded-Encrypted: i=1; AJvYcCXJsnYVu5wzFklDj3TL2ZvTIsNaf+Xe3mhId4S/VxE6h92IWTV8LHtQnuynVwsBZmjEnH9c@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Yz4Jy8dFO4LGCkft6Nm/Y1VZzhN6SGagmqgJ5YjSH5AIPPGDH23

j0zCtrfbVn/3DxJF8D/Mud3H1S8s1Tymr8wfEwLq7x8uEWOGNR9rOtMQLtTHkVyYM22CkNHcbuP

8sUBjKjLS+yQqn3Ij0mPFAHSUaCw=

X-Gm-Gg: ASbGncvuYAO7b5VJ+qgiU5rVPj9O76CtQCetE+l22msjLCxnt/vKZG0RIKsO18HMUfu

8PWpKDqGmr8468jfSL2LyaSlIRNcHabwH4TVjrnUMbxYq7pQeVPMRCgw1Y8gpKOu3NRm8

X-Google-Smtp-Source: AGHT+IFUI1YJ/hphe5rn13ccTESOkbKYQX4zzDih+DEVk8/elA3By9hxzHSfZUvMlj3pPIpzNqJt5gQdQqo3EdZWC9I=

X-Received: by 2002:a17:902:d2c7:b0:215:58be:334e with SMTP id

d9443c01a7336-21670a06c6fmr3467175ad.10.1733767007266; Mon, 09 Dec 2024

09:56:47 -0800 (PST)

MIME-Version: 1.0

Reply-To: mrsaishaalgaddafi26@gmail.com

From: "mrs."

Date: Mon, 9 Dec 2024 09:56:42 -0800

Message-ID:

Subject: Dear Friend,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000009772a70628da167a"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 24.3

X-Spam_score_int: 243

X-Spam_bar: ++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Friend, I came across your e-mail contact prior to a

private search while in need of your assistance. My name is Aisha Al-Gaddafi,

a single Mother and a Widow with four Children. I am the only biological

Daughter of my late father, Late (Colonel Muammar Muhammad Abu Minyar al-Gaddafi)

was a Libyan revolutionary, who ruled Libya from 1969 until his assassination

by rebel forces [...]



Content analysis details: (24.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.181 listed in dnsbl.ahbl.org]

[209.85.214.181 listed in dnsbl.ahbl.org]

[209.85.214.181 listed in dnsbl.ahbl.org]

[209.85.214.181 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.181 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.181 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.214.181 listed in will-spam-for-food.eu.org]

[209.85.214.181 listed in will-spam-for-food.eu.org]

[209.85.214.181 listed in will-spam-for-food.eu.org]

[209.85.214.181 listed in will-spam-for-food.eu.org]

[209.85.214.181 listed in will-spam-for-food.eu.org]

[209.85.214.181 listed in will-spam-for-food.eu.org]

[209.85.214.181 listed in will-spam-for-food.eu.org]

[209.85.214.181 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.181 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.181 listed in wl.mailspike.net]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[mrsaishaalgaddafi26(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[fannaliygropp(at)gmail.com]

2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!

0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

2.5 MILLION_USD BODY: Talks about millions of dollars

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.9 URG_BIZ BODY: Contains urgent matter

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.5 HK_NAME_FM_MR_MRS No description available.

1.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

1.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Dear Friend,



--0000000000009772a70628da167a

Content-Type: text/plain; charset="UTF-8"



Dear Friend,

I came across your e-mail contact prior to a private search while in need

of your assistance. My name is Aisha Al-Gaddafi, a single Mother and a

Widow with four Children.



I am the only biological Daughter of my late father, Late (Colonel

Muammar Muhammad Abu Minyar al-Gaddafi) was a Libyan revolutionary, who

ruled Libya from 1969 until his assassination by rebel forces on 20 October

2011). I have investment funds worth Twenty Seven Million Five Hundred

Thousand United State Dollar ($27.500.000.00) and i need a trusted

investment Manager/Partner because of my current refugee status, however,



I am interested in you for investment project assistance in your country,

may be from there, we can build business relationship in the nearest future.



Your Urgent Reply Will Be Appreciated if really this transaction interests

you. Contact me at this my private email address for further explanation

about the funds.



Best Regards



Mrs. Aisha Al-Gaddafi



--0000000000009772a70628da167a

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear Friend,=C2=A0=C2=A0=C2=A0
I came across your e-mai=

l contact prior to a private search while in need of your assistance. My na=

me is Aisha =C2=A0Al-Gaddafi, a single Mother and a Widow with four Childre=

n.
=C2=A0
I am the only biological Daughter of my late father, Late =

=C2=A0(Colonel =C2=A0Muammar Muhammad Abu Minyar al-Gaddafi) was a Libyan r=

evolutionary, who ruled Libya from 1969 until his assassination by rebel fo=

rces on 20 October 2011). I have investment funds worth Twenty Seven Millio=

n Five Hundred Thousand United State Dollar ($27.500.000.00) and i need a t=

rusted investment Manager/Partner because of my current refugee status, how=

ever,
=C2=A0
I am interested in you for investment project assistance=

in your country, may be from there, we can build business relationship in =

the nearest future.

Your Urgent Reply Will Be Appreciated if really =

this transaction interests you. Contact me at this my private email address=

for further explanation about the funds.
=C2=A0
Best Regards

=

Mrs. Aisha Al-Gaddafi





--0000000000009772a70628da167a--

Canada post phish from Google

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Dec 2024 10:15:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKhKu-00000000BBo-2Sqy

for dave@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 10:14:20 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Dec 2024 10:14:20 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 169.134.251.23.bc.googleusercontent.com ([23.251.134.169]:48010 helo=sncf-connect.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKhKP-00000000B8B-3a1g

for root@mail.nl2k.ab.ca;

Mon, 09 Dec 2024 10:13:53 -0700

Received: by sncf-connect.com (Postfix, from userid 1000)

id 9B86924A133; Mon, 9 Dec 2024 17:04:24 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sncf-connect.com; s=20230601; t=1726561367; x=1727166167; dara=sncf-connect.com;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=Nll/WDt2gQK3B1pLcBWnOeDo4ix8zlwU6y4wcQbET3e8Ud4yKxxayR97VfQaD/yEUB

/3lzrmI9aVrjMBKp4UBbzQEFy1CJ9o5KInk0Ue6G3N45uCA3KibMcA+hx3xlrX+tiQ7d

l5cSlBY1buJ29w5kVEMdgyVnBY3wARaW9fTRpkr29z3//BpwF1Ky4QG4nx42bq+y7GI/

fjLekQhu1kX0dCBNKI5S3BR9X+KLbFHRgJDrW5MAxF2G695yFOfybboVnR7bbN1LHnNC

VvJ4XTu8y6sgmXes+FmgCvhR0+deazi4IyT4hcGkUr3tgAZa7ZBs7/amS6XWB4t3ECbo

ThZA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1726561367; x=1727166167;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=hKeB+IPnwQCcgtmF/hdw8S8R1s6Ma7WWp9Kzfw6x8bdfXSg3eKLVGu1tp8GHKbCiF8

KD3+7DgE3aTLFVqHFJWorhQAU1kw6iaNZOqIq8LVHess6499p84z9qr9GgSNmmDdSmfT

Of+JW8FjnLMsA4uJ+e1HMQwkEtvU6aN6UCegBZI6UDXC7bCG4E66F7ygIkEN9Sb+jU7g

QMbQYlq1vGWQqXN0LcHOeootC1R4sKfMC9H635FcQcjFV/rhkLs/kH4S1dTfhQs+DKo7

BwBla4YFwO7tuS7S9sYYpPyK1ZdI+vQ4Y52FOUKnMZN+AL3BhWPAb5aPNkElNYJ6G7CI

mTAg==

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@sncf-connect.com header.s=20230601 header.b="Nll/WDt2";

spf=pass (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=sncf-connect.com;

dara=pass header.i=@sncf-connect.com

To: root@mail.nl2k.ab.ca

From: "Canada Post / Postes Canada"

Subject: Your Shipment is Awaiting Your Confirmation

List-Unsubscribe-Post: List-Unsubscribe=One-Click

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

Message-Id: <20241209170424.9B86924A133@sncf-connect.com>

Date: Mon, 9 Dec 2024 17:04:24 +0000 (UTC)

X-Spam_score: 14.1

X-Spam_score_int: 141

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Click here to pay



Content analysis details: (14.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

[23.251.134.169 listed in dnsbl.ahbl.org]

[23.251.134.169 listed in dnsbl.ahbl.org]

[23.251.134.169 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[23.251.134.169 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[23.251.134.169 listed in zen.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[23.251.134.169 listed in sa-trusted.bondedsender.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[23.251.134.169 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[23.251.134.169 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[23.251.134.169 listed in bl.score.senderscore.com]

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.3 HTML_FONT_FACE_BAD BODY: HTML font face is not a word

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for

an image

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} Your Shipment is Awaiting Your Confirmation





















Canada post phish from Google

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Dec 2024 10:15:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKhKl-00000000BAt-3L6n

for dave@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 10:14:11 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Dec 2024 10:14:11 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 169.134.251.23.bc.googleusercontent.com ([23.251.134.169]:42460 helo=sncf-connect.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKhBd-00000000AN6-3RoJ

for root@nl2k.ab.ca;

Mon, 09 Dec 2024 10:04:49 -0700

Received: by sncf-connect.com (Postfix, from userid 1000)

id A027D24A210; Mon, 9 Dec 2024 17:00:26 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sncf-connect.com; s=20230601; t=1726561367; x=1727166167; dara=sncf-connect.com;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=Nll/WDt2gQK3B1pLcBWnOeDo4ix8zlwU6y4wcQbET3e8Ud4yKxxayR97VfQaD/yEUB

/3lzrmI9aVrjMBKp4UBbzQEFy1CJ9o5KInk0Ue6G3N45uCA3KibMcA+hx3xlrX+tiQ7d

l5cSlBY1buJ29w5kVEMdgyVnBY3wARaW9fTRpkr29z3//BpwF1Ky4QG4nx42bq+y7GI/

fjLekQhu1kX0dCBNKI5S3BR9X+KLbFHRgJDrW5MAxF2G695yFOfybboVnR7bbN1LHnNC

VvJ4XTu8y6sgmXes+FmgCvhR0+deazi4IyT4hcGkUr3tgAZa7ZBs7/amS6XWB4t3ECbo

ThZA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1726561367; x=1727166167;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=hKeB+IPnwQCcgtmF/hdw8S8R1s6Ma7WWp9Kzfw6x8bdfXSg3eKLVGu1tp8GHKbCiF8

KD3+7DgE3aTLFVqHFJWorhQAU1kw6iaNZOqIq8LVHess6499p84z9qr9GgSNmmDdSmfT

Of+JW8FjnLMsA4uJ+e1HMQwkEtvU6aN6UCegBZI6UDXC7bCG4E66F7ygIkEN9Sb+jU7g

QMbQYlq1vGWQqXN0LcHOeootC1R4sKfMC9H635FcQcjFV/rhkLs/kH4S1dTfhQs+DKo7

BwBla4YFwO7tuS7S9sYYpPyK1ZdI+vQ4Y52FOUKnMZN+AL3BhWPAb5aPNkElNYJ6G7CI

mTAg==

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@sncf-connect.com header.s=20230601 header.b="Nll/WDt2";

spf=pass (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=sncf-connect.com;

dara=pass header.i=@sncf-connect.com

To: root@nl2k.ab.ca

From: "Canada Post / Postes Canada"

Subject: Your Shipment is Awaiting Your Confirmation

List-Unsubscribe-Post: List-Unsubscribe=One-Click

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

Message-Id: <20241209170026.A027D24A210@sncf-connect.com>

Date: Mon, 9 Dec 2024 17:00:26 +0000 (UTC)

X-Spam_score: 17.8

X-Spam_score_int: 178

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Click here to pay



Content analysis details: (17.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

[23.251.134.169 listed in dnsbl.ahbl.org]

[23.251.134.169 listed in dnsbl.ahbl.org]

[23.251.134.169 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[23.251.134.169 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[23.251.134.169 listed in sbl-xbl.spamhaus.org]

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.3 HTML_FONT_FACE_BAD BODY: HTML font face is not a word

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for

an image

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} Your Shipment is Awaiting Your Confirmation





















Canada post phish from Google

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Dec 2024 08:01:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKfFF-000000004FU-36o4

for dave@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 08:00:21 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Dec 2024 08:00:21 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pg1-f195.google.com ([209.85.215.195]:60834)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKeyd-000000003So-19BL

for root@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 07:43:14 -0700

Received: by mail-pg1-f195.google.com with SMTP id 41be03b00d2f7-7fd455ed70eso1095521a12.1

for ; Mon, 09 Dec 2024 06:41:22 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1733755276; x=1734360076; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=WJTD11dHchbGXBGKJOvldBhVV+b2dHGKvhTNZbNQVuc=;

b=bCGvj1Bz7ukmrRKSN7Lr1o4XJkeNu7RblG4SnvaoN+h/3dUSCfjwx/gWWRn8lFF+iA

H0B90TvMEZL7di0mssRVf/unDJ3SvgOSIJGms3JbMXCQXzxay5l23ka4JTunU5mlMsqP

IwqW0l8RReFEXLRRStyvyQ+n018xCrDERi8GIg+lkDV6LrHXbH0j7OBzrEWMWxoYsE90

Rm6dsb5YAQLKveexf+r4MTLEUr5uwq3igLcs8XOcjcAVx73Z4J3DhFHVBX869s6XSy9x

UW/pr20Nb/1ZHH1Ext7qHe8xGpvgsWpLV3TyGQ2LP1zAOl314ljvbLlgKMrerK+gA2ol

hguw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1733755276; x=1734360076;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=WJTD11dHchbGXBGKJOvldBhVV+b2dHGKvhTNZbNQVuc=;

b=ImEnJnm8ibFsWwtea0/0FvdfuS+GnoGQjqYcowKk9sDcr1yheX7ocjgfBWr7Pn54q7

7z1TcxcrVBOZ8oZg/Y/8pKFOyEf06IUuefn3kZwiRuRDysPQqPy1+3fHwwdWrLobegw1

jmEjNLyuTm+MTXQuyv4yBJHmzPkRStXOqK4B7EJMxM5cl4zG4XVIf0v+FV5KdASLRcTc

Mz5WyIzZIRf8sJtjWm42gU/bDZGicLkV3GfkngFQT7cfhZkujGUvihFEgb32yQD7Lzx5

X3pOKYepTQxP7Io4R9tQzbWQRJdBsZsxIxpViwnf6F4GC8+b+inoi8/Ace7uiDwqnixA

7AFQ==

X-Forwarded-Encrypted: i=1; AJvYcCWZ8jPt+u1Z+1pZBKUW9uvgxASRSildNz2fm8QDxw0+1wzu51vOzCpW2Mwb5N9wAeXtzW1j@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YzqFZW9Uc15KvqO9N95GajL4zW7bYSDNPXv0n0ykxeUGiYgE9eh

CPneAZsj8rUTeGyfClCkoKj47abfBEmujeN0KhjHBG69SI92TKo7BYq/vDbFj4u/ZEhmzqdQUJq

hgILJvEjX/59ZUVnlmV58dyazl4w=

X-Gm-Gg: ASbGnctDBezsTRMYsc6Eh+tyU9y41H9PDTS2UbrNAC4UPVPfA+f+8PWYXQAC/l+JHIW

xhPF3cWZw5G1IAeyO3c+pvgjH4NL5vPc=

X-Google-Smtp-Source: AGHT+IFkYgQMZ/AS7tQhwepCK8OBiZC+GGhpd/WrSQJJFPXczz7YnXvEmfWxTaVtU+onhzwIsYPpSuPF3Kb6hh2oPHg=

X-Received: by 2002:a05:6a21:9212:b0:1e1:a8b7:b45d with SMTP id

adf61e73a8af0-1e1a8b7b75dmr6305063637.4.1733755276085; Mon, 09 Dec 2024

06:41:16 -0800 (PST)

MIME-Version: 1.0

Reply-To: benmarie824@gmail.com

From: "Mrs.Mary Benjamin"

Date: Mon, 9 Dec 2024 15:41:05 +0100

Message-ID:

Subject: Mrs. Mary,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000005bd4130628d75b84"

Bcc: root@doctor.nl2k.ab.ca

X-Spam_score: 13.3

X-Spam_score_int: 133

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Kindly read and reply fast. I will need your help to accomplish

the wishes of my late husband. I want to donate toward education and the

less privilege ones and churches; I will need your service to h [...]



Content analysis details: (13.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.215.195 listed in dnsbl.ahbl.org]

[209.85.215.195 listed in dnsbl.ahbl.org]

[209.85.215.195 listed in dnsbl.ahbl.org]

[209.85.215.195 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.215.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.215.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.215.195 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.215.195 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.215.195 listed in will-spam-for-food.eu.org]

[209.85.215.195 listed in will-spam-for-food.eu.org]

[209.85.215.195 listed in will-spam-for-food.eu.org]

[209.85.215.195 listed in will-spam-for-food.eu.org]

[209.85.215.195 listed in will-spam-for-food.eu.org]

[209.85.215.195 listed in will-spam-for-food.eu.org]

[209.85.215.195 listed in will-spam-for-food.eu.org]

[209.85.215.195 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.215.195 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.215.195 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[benmarie824(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[simonnguessan53(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[simonnguessan53(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 HK_NAME_FM_MR_MRS No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Mrs. Mary,



--0000000000005bd4130628d75b84

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Kindly read and reply fast.

I will need your help to accomplish the wishes of my late husband. I want

to donate toward education and the less privilege ones and churches; I will

need your service to handle this project=E2=80=99s. I will give you more de=

tails

once you accept this offer.

Sincerely

Mrs. Mary Benjam=C3=ADn,



--0000000000005bd4130628d75b84

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Kindly read and reply fast.
I will need your help to ac=

complish the wishes of my late husband. I want to donate toward education a=

nd the less privilege ones and churches; I will need your service to handle=

this project=E2=80=99s. I will give you more details once you accept this =

offer.
Sincerely
Mrs. Mary Benjam=C3=ADn,




--0000000000005bd4130628d75b84--

Canada post phish from Google

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Dec 2024 10:14:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKhKW-00000000B97-1fDt

for dave@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 10:13:56 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Dec 2024 10:13:56 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 169.134.251.23.bc.googleusercontent.com ([23.251.134.169]:37312 helo=sncf-connect.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKhBa-00000000AMc-3jTd

for doctor@nl2k.ab.ca;

Mon, 09 Dec 2024 10:04:47 -0700

Received: by sncf-connect.com (Postfix, from userid 1000)

id 4456524A199; Mon, 9 Dec 2024 17:00:22 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sncf-connect.com; s=20230601; t=1726561367; x=1727166167; dara=sncf-connect.com;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=Nll/WDt2gQK3B1pLcBWnOeDo4ix8zlwU6y4wcQbET3e8Ud4yKxxayR97VfQaD/yEUB

/3lzrmI9aVrjMBKp4UBbzQEFy1CJ9o5KInk0Ue6G3N45uCA3KibMcA+hx3xlrX+tiQ7d

l5cSlBY1buJ29w5kVEMdgyVnBY3wARaW9fTRpkr29z3//BpwF1Ky4QG4nx42bq+y7GI/

fjLekQhu1kX0dCBNKI5S3BR9X+KLbFHRgJDrW5MAxF2G695yFOfybboVnR7bbN1LHnNC

VvJ4XTu8y6sgmXes+FmgCvhR0+deazi4IyT4hcGkUr3tgAZa7ZBs7/amS6XWB4t3ECbo

ThZA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1726561367; x=1727166167;

h=in-reply-to:references:subject:from:date:message-id:auto-submitted

:to:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=wtoDS2/ZYmP6JTJR7Mo9X0oVUcuHiuU4XKK7bOHJOeQ=;

b=hKeB+IPnwQCcgtmF/hdw8S8R1s6Ma7WWp9Kzfw6x8bdfXSg3eKLVGu1tp8GHKbCiF8

KD3+7DgE3aTLFVqHFJWorhQAU1kw6iaNZOqIq8LVHess6499p84z9qr9GgSNmmDdSmfT

Of+JW8FjnLMsA4uJ+e1HMQwkEtvU6aN6UCegBZI6UDXC7bCG4E66F7ygIkEN9Sb+jU7g

QMbQYlq1vGWQqXN0LcHOeootC1R4sKfMC9H635FcQcjFV/rhkLs/kH4S1dTfhQs+DKo7

BwBla4YFwO7tuS7S9sYYpPyK1ZdI+vQ4Y52FOUKnMZN+AL3BhWPAb5aPNkElNYJ6G7CI

mTAg==

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@sncf-connect.com header.s=20230601 header.b="Nll/WDt2";

spf=pass (google.com: mail-sor-f69.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=sncf-connect.com;

dara=pass header.i=@sncf-connect.com

To: doctor@nl2k.ab.ca

From: "Canada Post / Postes Canada"

Subject: Your Shipment is Awaiting Your Confirmation

List-Unsubscribe-Post: List-Unsubscribe=One-Click

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 7bit

Message-Id: <20241209170022.4456524A199@sncf-connect.com>

Date: Mon, 9 Dec 2024 17:00:22 +0000 (UTC)

X-Spam_score: 14.1

X-Spam_score_int: 141

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Click here to pay



Content analysis details: (14.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

[23.251.134.169 listed in dnsbl.ahbl.org]

[23.251.134.169 listed in dnsbl.ahbl.org]

[23.251.134.169 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[23.251.134.169 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

[23.251.134.169 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[23.251.134.169 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[23.251.134.169 listed in zen.spamhaus.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[23.251.134.169 listed in sa-accredit.habeas.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[23.251.134.169 listed in sa-trusted.bondedsender.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[23.251.134.169 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[23.251.134.169 listed in bl.score.senderscore.com]

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.3 HTML_FONT_FACE_BAD BODY: HTML font face is not a word

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for

an image

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Your Shipment is Awaiting Your Confirmation





















Nigerian Spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Dec 2024 08:01:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKfFF-000000004FU-36o4

for dave@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 08:00:21 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Dec 2024 08:00:21 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pg1-f195.google.com ([209.85.215.195]:60834)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKeyd-000000003So-19BL

for root@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 07:43:14 -0700

Received: by mail-pg1-f195.google.com with SMTP id 41be03b00d2f7-7fd455ed70eso1095521a12.1

for ; Mon, 09 Dec 2024 06:41:22 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1733755276; x=1734360076; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=WJTD11dHchbGXBGKJOvldBhVV+b2dHGKvhTNZbNQVuc=;

b=bCGvj1Bz7ukmrRKSN7Lr1o4XJkeNu7RblG4SnvaoN+h/3dUSCfjwx/gWWRn8lFF+iA

H0B90TvMEZL7di0mssRVf/unDJ3SvgOSIJGms3JbMXCQXzxay5l23ka4JTunU5mlMsqP

IwqW0l8RReFEXLRRStyvyQ+n018xCrDERi8GIg+lkDV6LrHXbH0j7OBzrEWMWxoYsE90

Rm6dsb5YAQLKveexf+r4MTLEUr5uwq3igLcs8XOcjcAVx73Z4J3DhFHVBX869s6XSy9x

UW/pr20Nb/1ZHH1Ext7qHe8xGpvgsWpLV3TyGQ2LP1zAOl314ljvbLlgKMrerK+gA2ol

hguw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1733755276; x=1734360076;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=WJTD11dHchbGXBGKJOvldBhVV+b2dHGKvhTNZbNQVuc=;

b=ImEnJnm8ibFsWwtea0/0FvdfuS+GnoGQjqYcowKk9sDcr1yheX7ocjgfBWr7Pn54q7

7z1TcxcrVBOZ8oZg/Y/8pKFOyEf06IUuefn3kZwiRuRDysPQqPy1+3fHwwdWrLobegw1

jmEjNLyuTm+MTXQuyv4yBJHmzPkRStXOqK4B7EJMxM5cl4zG4XVIf0v+FV5KdASLRcTc

Mz5WyIzZIRf8sJtjWm42gU/bDZGicLkV3GfkngFQT7cfhZkujGUvihFEgb32yQD7Lzx5

X3pOKYepTQxP7Io4R9tQzbWQRJdBsZsxIxpViwnf6F4GC8+b+inoi8/Ace7uiDwqnixA

7AFQ==

X-Forwarded-Encrypted: i=1; AJvYcCWZ8jPt+u1Z+1pZBKUW9uvgxASRSildNz2fm8QDxw0+1wzu51vOzCpW2Mwb5N9wAeXtzW1j@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YzqFZW9Uc15KvqO9N95GajL4zW7bYSDNPXv0n0ykxeUGiYgE9eh

CPneAZsj8rUTeGyfClCkoKj47abfBEmujeN0KhjHBG69SI92TKo7BYq/vDbFj4u/ZEhmzqdQUJq

hgILJvEjX/59ZUVnlmV58dyazl4w=

X-Gm-Gg: ASbGnctDBezsTRMYsc6Eh+tyU9y41H9PDTS2UbrNAC4UPVPfA+f+8PWYXQAC/l+JHIW

xhPF3cWZw5G1IAeyO3c+pvgjH4NL5vPc=

X-Google-Smtp-Source: AGHT+IFkYgQMZ/AS7tQhwepCK8OBiZC+GGhpd/WrSQJJFPXczz7YnXvEmfWxTaVtU+onhzwIsYPpSuPF3Kb6hh2oPHg=

X-Received: by 2002:a05:6a21:9212:b0:1e1:a8b7:b45d with SMTP id

adf61e73a8af0-1e1a8b7b75dmr6305063637.4.1733755276085; Mon, 09 Dec 2024

06:41:16 -0800 (PST)

MIME-Version: 1.0

Reply-To: benmarie824@gmail.com

From: "Mrs.Mary Benjamin"

Date: Mon, 9 Dec 2024 15:41:05 +0100

Message-ID:

Subject: Mrs. Mary,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000005bd4130628d75b84"

Bcc: root@doctor.nl2k.ab.ca

X-Spam_score: 13.3

X-Spam_score_int: 133

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Kindly read and reply fast. I will need your help to accomplish

the wishes of my late husband. I want to donate toward education and the

less privilege ones and churches; I will need your service to h [...]



Content analysis details: (13.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.215.195 listed in dnsbl.ahbl.org]

[209.85.215.195 listed in dnsbl.ahbl.org]

[209.85.215.195 listed in dnsbl.ahbl.org]

[209.85.215.195 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.215.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.215.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.215.195 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.215.195 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.215.195 listed in will-spam-for-food.eu.org]

[209.85.215.195 listed in will-spam-for-food.eu.org]

[209.85.215.195 listed in will-spam-for-food.eu.org]

[209.85.215.195 listed in will-spam-for-food.eu.org]

[209.85.215.195 listed in will-spam-for-food.eu.org]

[209.85.215.195 listed in will-spam-for-food.eu.org]

[209.85.215.195 listed in will-spam-for-food.eu.org]

[209.85.215.195 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.215.195 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.215.195 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[benmarie824(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[simonnguessan53(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[simonnguessan53(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 HK_NAME_FM_MR_MRS No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Mrs. Mary,



--0000000000005bd4130628d75b84

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Kindly read and reply fast.

I will need your help to accomplish the wishes of my late husband. I want

to donate toward education and the less privilege ones and churches; I will

need your service to handle this project=E2=80=99s. I will give you more de=

tails

once you accept this offer.

Sincerely

Mrs. Mary Benjam=C3=ADn,



--0000000000005bd4130628d75b84

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Kindly read and reply fast.
I will need your help to ac=

complish the wishes of my late husband. I want to donate toward education a=

nd the less privilege ones and churches; I will need your service to handle=

this project=E2=80=99s. I will give you more details once you accept this =

offer.
Sincerely
Mrs. Mary Benjam=C3=ADn,




--0000000000005bd4130628d75b84--

Finnish language spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Dec 2024 07:11:00 -0700

Received: from mail-qk1-f180.google.com ([209.85.222.180]:53386)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKeSb-0000000024W-0WpD

for dave@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 07:10:08 -0700

Received: by mail-qk1-f180.google.com with SMTP id af79cd13be357-7b1601e853eso324365985a.2

for ; Mon, 09 Dec 2024 06:08:13 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1733753287; x=1734358087; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=UEL9i59JhHviueZwwNn+9v510b4YWZdf9+kl3rKM0uo=;

b=GGPG6cKW+KqMrXC3w9PmeJpptmQ3EqRotvUULX8MP+RCt6eXxCo2ewIMb9syLEkIzD

wtM6ftcaC88Pet2qCeJooR2R7otz+47B2Tz+NtqpkhrGjoBRRV334CVhf6tKPBuMwCL/

PLwaotOvEFmfC11eCHal/jvDjn8GZ4pydDLrDYsd31x8SNRY144tyWdlE9KCc9de+6qd

ZDb62S9ZxxAiY0au60OhqfeOQrK0Af8y+6kFGleCD1xvbZK9TwblYSkwVzAeMwQLfRkQ

p0RlG7bO/XITVmUmFlp7gkl9AccY6yaOz8N3x+lIloZ1fScA8tXWoutMIQmRcFPWlKr2

HmUA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1733753287; x=1734358087;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=UEL9i59JhHviueZwwNn+9v510b4YWZdf9+kl3rKM0uo=;

b=kIrgzg06MQ8R7nT7IEMS3u4DcYuy1O0iWLJ2jX2Uws19euh1R9S5bDjnN2SdLuo6lx

2VFfGKgEEuGeQ4jSlgn9DydI5+CN195AEyqL2Mdg79ONt8dP5mV1yyTMIsAHZ95zJTql

ilzWB8UDVI4FsHJjFTIqo1CJnV3wJdAE0hpj3RYqGrP7p2zd+IwQCD+yjHDLZ/j///ZE

dQFRfH/NRxFKFjyKlRr+jWpac3o24/905SKlmy0z9LASz+o7BFfgqvHIzERJFsOAJHrd

CvAskQwbqJ0UIdbKHv4ESNiMd7o9u34zRZBxIIzr+0XfghLYwB4spGwW5IUYSEUFlbij

Rrqg==

X-Forwarded-Encrypted: i=1; AJvYcCXOSAkOF8fW9cGqAC9CNwbWLyGM+4bCGUXXhuiwKeompIEG7TM4V+gkeSR2U/tvriY9fb2P@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Yyszh5nMqjNT0tyyIKQsCGRdmWzOC7RaMPwZ9yXapYxQtOe51EJ

HE+tOzjdBvJn6qhP9h+tSJq2K/dnfzBGasFcrYKLta3FleTRvoAkk7BtT5uQlaenxCJHH+515Sb

1TdloB8x51zeMx1/Qvbqjrw4QuD8=

X-Gm-Gg: ASbGncvJReQpYx0R01getle1WYFxEfxWHP3rn4DiNL8oC+fDcxv1n5oGOBGeM3p+2+u

dsj4lo6Y5AbMzw6SOULTe72ABCRd4QT3k/40wpQOi8691yJzggk72DK910EiyXiBU

X-Google-Smtp-Source: AGHT+IFtd/DqlWFErOdkhNhkXF7mIn5D5yeVez/YTOhRFbo//0fWe6EyqsWqzviyKpoSM0JMnVqTnMVGite26XFaCi0=

X-Received: by 2002:a05:620a:2981:b0:7b6:64ad:827a with SMTP id

af79cd13be357-7b6dceaa56emr85748185a.57.1733753287317; Mon, 09 Dec 2024

06:08:07 -0800 (PST)

MIME-Version: 1.0

Reply-To: heritagebankceo@gmail.com

From: "heritagebankceo@gmail.com"

Date: Mon, 9 Dec 2024 15:07:55 +0100

Message-ID:

Subject: =?UTF-8?Q?HEAD_P=C3=84EVA?=

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000d1a0f40628d6e4c3"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 12.5

X-Spam_score_int: 125

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Tähelepanu kallis Anname teile teada, et teie sularahaautomaadi

KAART vabastati pärast meie tihedat kohtumist tolli- ja piirivalveametiga.

Ãœritasime eile kell 15.20 teie pakki kohale toimetada, kuid kohaletoimetamine

[...]



Content analysis details: (12.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

[209.85.222.180 listed in dnsbl.ahbl.org]

[209.85.222.180 listed in dnsbl.ahbl.org]

[209.85.222.180 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.180 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.180 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[nonsonwamakihd(at)gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.7 PDS_FROM_2_EMAILS No description available.

0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address

2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to

Subject: {SPAM?} =?UTF-8?Q?HEAD_P=C3=84EVA?=



--000000000000d1a0f40628d6e4c3

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



T=C3=A4helepanu kallis







Anname teile teada, et teie sularahaautomaadi KAART vabastati p=C3=A4rast m=

eie

tihedat kohtumist tolli- ja piirivalveametiga. =C3=9Critasime eile kell 15.=

20

teie pakki kohale toimetada, kuid kohaletoimetamine eba=C3=B5nnestus eba=C3=

=B5ige

tarneaadressi t=C3=B5ttu. paki kiireks kohaletoimetamiseks soovitame teil

kinnitada oma praegune aadress.









Lugupidamisega"







Proua Elena J.

TNT Express!



--000000000000d1a0f40628d6e4c3

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




eight:115%;font-size:11pt;font-family:Calibri,"sans-serif"">T=C3=

=A4helepanu kallis






ize:11pt;font-family:Calibri,"sans-serif"">=C2=A0






ize:11pt;font-family:Calibri,"sans-serif"">Anname teile teada, et=

teie sularahaautomaadi KAART

vabastati p=C3=A4rast meie tihedat kohtumist tolli- ja piirivalveametiga. =

=C3=9Critasime

eile kell 15.20 teie pakki kohale toimetada, kuid kohaletoimetamine eba=C3=

=B5nnestus

eba=C3=B5ige tarneaadressi t=C3=B5ttu. paki kiireks kohaletoimetamiseks soo=

vitame teil

kinnitada oma praegune aadress.






ize:11pt;font-family:Calibri,"sans-serif"">=C2=A0






nt-size:14pt;font-family:Cambria,"serif";color:rgb(54,95,145)">=

=C2=A0






ize:11pt;font-family:Calibri,"sans-serif"">Lugupidamisega"
p>




ize:11pt;font-family:Calibri,"sans-serif"">=C2=A0






ize:11pt;font-family:Calibri,"sans-serif"">Proua Elena J.






nt-size:14pt;font-family:Cambria,"serif";color:rgb(54,95,145)">=

=C2=A0






nt-size:14pt;font-family:Cambria,"serif";color:rgb(54,95,145)">TN=

T Express!





--000000000000d1a0f40628d6e4c3--

Injection Mould spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Dec 2024 08:00:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKfEh-000000004Co-29Z7

for dave@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 07:59:47 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Dec 2024 07:59:47 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f195.google.com ([209.85.214.195]:58423)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKdWh-000000000GJ-3FVC

for root@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 06:10:21 -0700

Received: by mail-pl1-f195.google.com with SMTP id d9443c01a7336-21145812538so36394525ad.0

for ; Mon, 09 Dec 2024 05:08:21 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=goodbomold.com; s=google; t=1733749695; x=1734354495; darn=doctor.nl2k.ab.ca;

h=disposition-notification-to:mime-version:date:subject:to:message-id

:reply-to:from:from:to:cc:subject:date:message-id:reply-to;

bh=VnYrlM89/Hw6Mn980XvGYmEJJdzHsLBuTeSk5Egs/s0=;

b=co+DQPDqvH5pqsAItSCf0XTNPE3wUTqmfpKOiCQb+tVqRHOjHjEMzcok2iJNrU95yo

KrYpUZvQQnlJFcoziQ0WDeepEq/7bEDUbmcxpJv79b9BfHAP+c5eopzFlNiWJv1s8rvu

ZEM9vCPbV7E+VhP1ElXL+4eICJnCedJaHe3oQ=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1733749695; x=1734354495;

h=disposition-notification-to:mime-version:date:subject:to:message-id

:reply-to:from:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=VnYrlM89/Hw6Mn980XvGYmEJJdzHsLBuTeSk5Egs/s0=;

b=pAEaa+lwa7OTPC60s8HJJRb3ugUhSOBoDtf56GWQKw0aitT4KKRwzi+B2ttMjY/QVH

aocrhNfxggdAPaAf+VvWA8u723SYSfVEoudQQofHD7w/v/ciCbuAOHoG4g+MtE5q62Yz

H8HeS00Y1jUugeUgJrSJW6p4m7RBsCKHX00U1jOztqKZQa6DJ/oQouegdyFdODkiC1cX

UhbNOi/9Gxx6EZBc5mYsBefrPjwbTj6nrewG4sHedAz4tiS+O9tzhkkGMklToRVliDfF

sYogVUO4UPf0PQ4u/pWaAYxBicvYlFimpYlGD4lM2nl7NXSDGfc1Lkow2X9dKGnKMGvA

Nhuw==

X-Gm-Message-State: AOJu0Yz0OZDdQYOA8LvbJp3GgxEAqDi040rNlIr10pXzzaJFL96nsxVZ

WcB/uY3kiE0FDJPPpx47aTdHoLTIP34wDDGKm9IjxSWh/WqeFSuVtq471aW6Rs92AIAtSPpFz1G

o9hA=

X-Gm-Gg: ASbGncur6sGjDkFLU1WMKvGNlg8jeFtcgYDiRx8NzzK9f7tIjOX/xGLzy+owdjkrmDQ

ZlTmnYux3N4+2ATeQ/w4ow7XYCS9mh7fqLrhHSRdmwqBk5ivYBCEdynZereYiYtThnBQ2usVDNI

ZT+BPh0Wf/tJNZ0I1v7lGbczXfHfp6Wwz6yJpWu8Eocnmmp3u8Y3w4/XGZCYDTQ/07/GnivDKkW

dzPQbaIAuamdTgBx9bzvAinf7pLhGwQVLI5Spf+L6X6QgrCZsHHMVORTzPsJzEUtuc=

X-Google-Smtp-Source: AGHT+IGo4EAJ9bZcFeY2Lo3I3+dx5HTMrVNgKITzM7tFEQKHddE/YboPJ3ttEeNlqXO1v646QUzKlA==

X-Received: by 2002:a17:902:f68a:b0:216:3633:36e7 with SMTP id d9443c01a7336-216363337d8mr108280025ad.26.1733749695162;

Mon, 09 Dec 2024 05:08:15 -0800 (PST)

Received: from hwydgw ([161.81.65.245])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-21649ad2bb0sm20036525ad.254.2024.12.09.05.08.13

for

(version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128);

Mon, 09 Dec 2024 05:08:14 -0800 (PST)

From: "grace@runtooprecision.com"

X-Google-Original-From: "grace@runtooprecision.com"

Reply-To:

Message-ID: <88FE9D3536BF14849A7D4407543C0C40@hwydgw>

To:

Subject: Preferred supplier for injection molds and injection molding parts

Date: Mon, 9 Dec 2024 21:08:07 +0800

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_00A6_01A8F069.1EBB7BD0"

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2900.5512

Disposition-Notification-To: grace@runtooprecision.com

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512

X-Spam_score: 10.6

X-Spam_score_int: 106

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Dear Manager, How is everything going? This is Grace

from Runtoo Precision Technology Co., Ltd., located in Shenzhen, China. It

will be a great honor if we can establish a relationship with you in the

future. Runtoo Precision found in 2013 [...]



Content analysis details: (10.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

[209.85.214.195 listed in dnsbl.ahbl.org]

[209.85.214.195 listed in dnsbl.ahbl.org]

[209.85.214.195 listed in dnsbl.ahbl.org]

[161.81.65.245 listed in dnsbl.ahbl.org]

[161.81.65.245 listed in dnsbl.ahbl.org]

[161.81.65.245 listed in dnsbl.ahbl.org]

[161.81.65.245 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[161.81.65.245 listed in will-spam-for-food.eu.org]

[161.81.65.245 listed in will-spam-for-food.eu.org]

[161.81.65.245 listed in will-spam-for-food.eu.org]

[161.81.65.245 listed in will-spam-for-food.eu.org]

[161.81.65.245 listed in will-spam-for-food.eu.org]

[161.81.65.245 listed in will-spam-for-food.eu.org]

[161.81.65.245 listed in will-spam-for-food.eu.org]

[161.81.65.245 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.195 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.195 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

1.0 HK_RANDOM_FROM From username looks random

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

1.0 ZMIde_OutlookExpress Outlook Express should not be used anymore

2.0 MIXED_HREF_CASE Has href in mixed case

0.7 PDS_FROM_2_EMAILS No description available.

Subject: {SPAM?} Preferred supplier for injection molds and injection molding parts



This is a multi-part message in MIME format.



------=_NextPart_000_00A6_01A8F069.1EBB7BD0

Content-Type: text/plain;

charset="gb2312"

Content-Transfer-Encoding: base64



SGVsbG8gRGVhciBNYW5hZ2VyLA0KDQpIb3cgaXMgZXZlcnl0aGluZyBnb2luZz8NCg0KVGhpcyBp

cyBHcmFjZSBmcm9tIFJ1bnRvbyBQcmVjaXNpb24gVGVjaG5vbG9neSBDby4sIEx0ZC4sIGxvY2F0

ZWQgaW4gU2hlbnpoZW4sIENoaW5hLg0KSXQgd2lsbCBiZSBhIGdyZWF0IGhvbm9yIGlmIHdlIGNh

biBlc3RhYmxpc2ggYSByZWxhdGlvbnNoaXAgd2l0aCB5b3UgaW4gdGhlIGZ1dHVyZS4gUnVudG9v

IFByZWNpc2lvbiBmb3VuZCBpbiAyMDEzLCBtYWpvcnMgaW4gbW9sZCBkZXNpZ24gYW5kIGluamVj

dGlvbiBzZXJ2aWNlIGZvciBvdmVyIDEwIHllYXJzLiBPdXIgcHJvZHVjdHMgZW5qb3kgZ3JlYXQg

cG9wdWxhcml0eSBhbW9uZyBFdXJvcGVhbiBhbmQgQW1lcmljYW4gbWFya2V0cy4NCldlIGNhbiBv

ZmZlciB5b3UgdGhlIGZvbGxvd2luZyBzZXJ2aWNlIGZvciB5b3UuDQouIE1vbGQgZGVzaWduIGFu

ZCBtb2xkIHByb2R1Y3Rpb24uDQouIEluamVjdGlvbiBzZXJ2aWNlLCBhc3NlbWJseSwgcHJpbnRp

bmcsIGFuZCBwYWNraW5nIHNlcnZpY2UuDQouIFJhcGlkIHByb3RvdHlwaW5nIG9yIDNEIHByaW50

aW5nIHNlcnZpY2UuDQouIEhhcmR3YXJlIHBhcnRzDQoNCklmIHlvdSBoYXZlIGFueSBwbGFzdGlj

IHBhcnQgbmVlZCB0byBjdXN0b21pemVkLCBjb3VsZCB5b3Ugb2ZmZXIgdXMgdGhlIDNEIGZpbGVz

IG9yIHNhbXBsZXMgeW91IGhhdmU/IFBsZWFzZSBkb24ndCBoZXNpdGF0ZSB0byBjb250YWN0IHVz

Lg0KTG9va2luZyBmb3J3YXJkIHRvIHlvdXIgZWFybHkgcmVwbHkgd2hpY2ggd2lsbCBiZSBoaWdo

bHkgYXBwcmVjaWF0ZWQuDQoNCg0KQmVzdCBSZWdhcmRzLA0KR3JhY2UNClNhbGVzIE1hbmFnZXIN

Cg0KDQpSdW50b28gUHJlY2lzaW9uIFRlY2hub2xvZ3kgQ28uLCBMdGQuICAgICAgICAgICAgICAg

ICAgICANCk1vYmlsZTogODYtMTM2MDMwMzc0NjkNClRlbDogICAgKzg2LTA3NTUtMjMxOTYxNjYN

CkVtYWlsOiBncmFjZUBydW50b29wcmVjaXNpb24uY29tICAgICAgICAgICAgICAgICAgICAgICAg

ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICANCldlYjogIGh0dHA6Ly93d3cucnVu

dG9vcHJlY2lzaW9uLmNvbS8g



------=_NextPart_000_00A6_01A8F069.1EBB7BD0

Content-Type: text/html;

charset="gb2312"

Content-Transfer-Encoding: base64



PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMCBUcmFuc2l0aW9uYWwv

L0VOIj4NCjxIVE1MPjxIRUFEPg0KPE1FVEEgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PWdi

MjMxMiIgaHR0cC1lcXVpdj1Db250ZW50LVR5cGU+DQo8TUVUQSBuYW1lPUdFTkVSQVRPUiBjb250

ZW50PSJNU0hUTUwgMTEuMDAuMTA1NzAuMTAwMSI+PC9IRUFEPg0KPEJPRFk+DQo8RElWIA0Kc3R5

bGU9J0ZPTlQtU0laRTogMTRweDsgRk9OVC1GQU1JTFk6ICJNaWNyb3NvZnQgWWFIZWkgVUkiOyBX

SElURS1TUEFDRTogbm9ybWFsOyBXT1JELVNQQUNJTkc6IDBweDsgVEVYVC1UUkFOU0ZPUk06IG5v

bmU7IEZPTlQtV0VJR0hUOiA0MDA7IENPTE9SOiByZ2IoMCwwLDApOyBGT05ULVNUWUxFOiBub3Jt

YWw7IE9SUEhBTlM6IDI7IFdJRE9XUzogMjsgTEVUVEVSLVNQQUNJTkc6IG5vcm1hbDsgQkFDS0dS

T1VORC1DT0xPUjogcmdiKDI1NSwyNTUsMjU1KTsgVEVYVC1JTkRFTlQ6IDBweDsgZm9udC12YXJp

YW50LWxpZ2F0dXJlczogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyAtd2Via2l0

LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQtZGVjb3JhdGlvbi1zdHlsZTogaW5pdGlhbDsg

dGV4dC1kZWNvcmF0aW9uLWNvbG9yOiBpbml0aWFsOyB0ZXh0LWRlY29yYXRpb24tdGhpY2tuZXNz

OiBpbml0aWFsJz48U1BBTiANCnN0eWxlPSJGT05ULVNJWkU6IDE2cHgiPg0KPERJViANCnN0eWxl

PSJGT05ULVNJWkU6IDE0cHg7IEZPTlQtRkFNSUxZOiBBcmlhbDsgQ09MT1I6ICMwMDAwMDA7IExJ

TkUtSEVJR0hUOiAxLjciPg0KPFAgc3R5bGU9Ik1BUkdJTjogMHB4Ij48Rk9OVCBzaXplPTMgZmFj

ZT0iTWljcm9zb2Z0IFlhSGVpIFVJIj5IZWxsbyBEZWFyIA0KTWFuYWdlciw8L0ZPTlQ+PC9QPg0K

PFAgc3R5bGU9Ik1BUkdJTjogMHB4Ij48Rk9OVCBzaXplPTMgZmFjZT0iTWljcm9zb2Z0IFlhSGVp

IFVJIj48L0ZPTlQ+Jm5ic3A7PC9QPg0KPFAgc3R5bGU9Ik1BUkdJTjogMHB4Ij48Rk9OVCBzaXpl

PTMgZmFjZT0iTWljcm9zb2Z0IFlhSGVpIFVJIj5Ib3cgaXMgZXZlcnl0aGluZyANCmdvaW5nPzwv

Rk9OVD48L1A+DQo8UCBzdHlsZT0iTUFSR0lOOiAwcHgiPjxGT05UIHNpemU9MyBmYWNlPSJNaWNy

b3NvZnQgWWFIZWkgVUkiPjwvRk9OVD4mbmJzcDs8L1A+DQo8UCBzdHlsZT0iTUFSR0lOOiAwcHgi

PjxGT05UIHNpemU9MyBmYWNlPSJNaWNyb3NvZnQgWWFIZWkgVUkiPlRoaXMgaXMgR3JhY2UgZnJv

bSANClJ1bnRvbyBQcmVjaXNpb24gVGVjaG5vbG9neSBDby4sIEx0ZC4sIGxvY2F0ZWQgaW4gU2hl

bnpoZW4sIENoaW5hLjwvRk9OVD48L1A+DQo8UCBzdHlsZT0iTUFSR0lOOiAwcHgiPjxGT05UIHNp

emU9MyBmYWNlPSJNaWNyb3NvZnQgWWFIZWkgVUkiPkl0IHdpbGwgYmUgYSBncmVhdCANCmhvbm9y

IGlmIHdlIGNhbiBlc3RhYmxpc2ggYSByZWxhdGlvbnNoaXAgd2l0aCB5b3UgaW4gdGhlIGZ1dHVy

ZS4gUnVudG9vIA0KUHJlY2lzaW9uIGZvdW5kIGluIDIwMTMsIG1ham9ycyBpbiBtb2xkIGRlc2ln

biBhbmQgaW5qZWN0aW9uIHNlcnZpY2UgZm9yIG92ZXIgMTAgDQp5ZWFycy4gT3VyIHByb2R1Y3Rz

IGVuam95IGdyZWF0IHBvcHVsYXJpdHkgYW1vbmcgRXVyb3BlYW4gYW5kIEFtZXJpY2FuIA0KbWFy

a2V0cy48L0ZPTlQ+PC9QPg0KPFAgc3R5bGU9Ik1BUkdJTjogMHB4Ij48Rk9OVCBzaXplPTMgZmFj

ZT0iTWljcm9zb2Z0IFlhSGVpIFVJIj5XZSBjYW4gb2ZmZXIgeW91IA0KdGhlIGZvbGxvd2luZyBz

ZXJ2aWNlIGZvciB5b3UuPC9GT05UPjwvUD4NCjxQIHN0eWxlPSJNQVJHSU46IDBweCI+PEZPTlQg

c2l6ZT0zIGZhY2U9Ik1pY3Jvc29mdCBZYUhlaSBVSSI+LiZuYnNwO01vbGQgZGVzaWduIA0KYW5k

IG1vbGQgcHJvZHVjdGlvbi48L0ZPTlQ+PC9QPg0KPFAgc3R5bGU9Ik1BUkdJTjogMHB4Ij48Rk9O

VCBzaXplPTMgZmFjZT0iTWljcm9zb2Z0IFlhSGVpIFVJIj4uJm5ic3A7SW5qZWN0aW9uIA0Kc2Vy

dmljZSwgYXNzZW1ibHksIHByaW50aW5nLCBhbmQgcGFja2luZyBzZXJ2aWNlLjwvRk9OVD48L1A+

DQo8UCBzdHlsZT0iTUFSR0lOOiAwcHgiPjxGT05UIHNpemU9MyBmYWNlPSJNaWNyb3NvZnQgWWFI

ZWkgVUkiPi4mbmJzcDtSYXBpZCANCnByb3RvdHlwaW5nIG9yIDNEIHByaW50aW5nIHNlcnZpY2Uu

PC9GT05UPjwvUD4NCjxQIHN0eWxlPSJNQVJHSU46IDBweCI+PEZPTlQgc2l6ZT0zIGZhY2U9Ik1p

Y3Jvc29mdCBZYUhlaSBVSSI+LiZuYnNwO0hhcmR3YXJlIA0KcGFydHM8L0ZPTlQ+PC9QPg0KPFAg

c3R5bGU9Ik1BUkdJTjogMHB4Ij48Rk9OVCBzaXplPTMgZmFjZT0iTWljcm9zb2Z0IFlhSGVpIFVJ

Ij48L0ZPTlQ+Jm5ic3A7PC9QPg0KPFAgc3R5bGU9Ik1BUkdJTjogMHB4Ij48Rk9OVCBzaXplPTMg

ZmFjZT0iTWljcm9zb2Z0IFlhSGVpIFVJIj5JZiB5b3UgaGF2ZSBhbnkgDQpwbGFzdGljIHBhcnQg

bmVlZCB0byBjdXN0b21pemVkLCBjb3VsZCB5b3Ugb2ZmZXIgdXMgdGhlIDNEIGZpbGVzIG9yIHNh

bXBsZXMgeW91IA0KaGF2ZT8gUGxlYXNlIGRvbid0IGhlc2l0YXRlIHRvIGNvbnRhY3QgdXMuPC9G

T05UPjwvUD4NCjxQIHN0eWxlPSJNQVJHSU46IDBweCI+PEZPTlQgc2l6ZT0zIGZhY2U9Ik1pY3Jv

c29mdCBZYUhlaSBVSSI+TG9va2luZyBmb3J3YXJkIHRvIA0KeW91ciBlYXJseSByZXBseSB3aGlj

aCB3aWxsIGJlIGhpZ2hseSBhcHByZWNpYXRlZC48L0ZPTlQ+PC9QPg0KPFAgc3R5bGU9Ik1BUkdJ

TjogMHB4Ij48Rk9OVCBmYWNlPSJNaWNyb3NvZnQgWWFIZWkgVUkiPjxCUj48Rk9OVCANCnNpemU9

Mz48L0ZPTlQ+PC9GT05UPjwvUD4NCjxQIHN0eWxlPSJNQVJHSU46IDBweCI+PEZPTlQgc2l6ZT0z

IGZhY2U9Ik1pY3Jvc29mdCBZYUhlaSBVSSI+QmVzdCANClJlZ2FyZHMsPC9GT05UPjwvUD4NCjxQ

IHN0eWxlPSJNQVJHSU46IDBweCI+PEZPTlQgc2l6ZT0zIGZhY2U9Ik1pY3Jvc29mdCBZYUhlaSBV

SSI+R3JhY2U8L0ZPTlQ+PC9QPg0KPFAgc3R5bGU9Ik1BUkdJTjogMHB4Ij48Rk9OVCBzaXplPTMg

ZmFjZT0iTWljcm9zb2Z0IFlhSGVpIFVJIj5TYWxlcyANCk1hbmFnZXI8L0ZPTlQ+PC9QPg0KPFAg

c3R5bGU9Ik1BUkdJTjogMHB4Ij48Rk9OVCBmYWNlPSJNaWNyb3NvZnQgWWFIZWkgVUkiPjxCUj48

Rk9OVCANCnNpemU9Mz48L0ZPTlQ+PC9GT05UPjwvUD4NCjxQIHN0eWxlPSJNQVJHSU46IDBweCI+

PEZPTlQgc2l6ZT0zIGZhY2U9Ik1pY3Jvc29mdCBZYUhlaSBVSSI+UnVudG9vIFByZWNpc2lvbiAN

ClRlY2hub2xvZ3kgQ28uLCBMdGQuJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm

bmJzcDsgJm5ic3A7ICZuYnNwOyANCiZuYnNwOyAmbmJzcDsmbmJzcDs8L0ZPTlQ+PC9QPg0KPFAg

c3R5bGU9Ik1BUkdJTjogMHB4Ij48Rk9OVCBzaXplPTMgZmFjZT0iTWljcm9zb2Z0IFlhSGVpIFVJ

Ij5Nb2JpbGU6IA0KODYtMTM2MDMwMzc0Njk8L0ZPTlQ+PC9QPg0KPFAgc3R5bGU9Ik1BUkdJTjog

MHB4Ij48Rk9OVCBzaXplPTMgZmFjZT0iTWljcm9zb2Z0IFlhSGVpIFVJIj5UZWw6Jm5ic3A7ICZu

YnNwOyANCis4Ni0wNzU1LTIzMTk2MTY2PC9GT05UPjwvUD4NCjxQIHN0eWxlPSJNQVJHSU46IDBw

eCI+PEZPTlQgc2l6ZT0zIGZhY2U9Ik1pY3Jvc29mdCBZYUhlaSBVSSI+RW1haWw6IA0KZ3JhY2VA

cnVudG9vcHJlY2lzaW9uLmNvbSZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i

c3A7ICZuYnNwOyAmbmJzcDsgDQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu

YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IA0KJm5ic3A7ICZuYnNwOyAm

bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IA0K

Jm5ic3A7PC9GT05UPjwvUD4NCjxQIHN0eWxlPSJNQVJHSU46IDBweCI+PEZPTlQgc2l6ZT0zIGZh

Y2U9Ik1pY3Jvc29mdCBZYUhlaSBVSSI+V2ViOiZuYnNwOyANCjwvRk9OVD48QSBocmVmPSJodHRw

Oi8vd3d3LnJ1bnRvb3ByZWNpc2lvbi5jb20vIiANCl9zcmM9Imh0dHA6Ly93d3cucnVudG9vcHJl

Y2lzaW9uLmNvbS8iPjxGT05UIHNpemU9MyANCmZhY2U9Ik1pY3Jvc29mdCBZYUhlaSBVSSI+aHR0

cDovL3d3dy5ydW50b29wcmVjaXNpb24uY29tLzwvRk9OVD48L0E+PEZPTlQgDQpmYWNlPSJNaWNy

b3NvZnQgWWFIZWkgVUkiPiA8L0ZPTlQ+PC9QPjwvRElWPjwvU1BBTj48L0RJVj48L0JPRFk+PC9I

VE1MPg0K



------=_NextPart_000_00A6_01A8F069.1EBB7BD0--



Finnish language spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Dec 2024 08:01:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKfEy-000000004Ee-2euW

for dave@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 08:00:04 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Dec 2024 08:00:04 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f43.google.com ([209.85.222.43]:56325)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKeGd-000000001gQ-1dWV

for root@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 06:57:46 -0700

Received: by mail-ua1-f43.google.com with SMTP id a1e0cc1a2514c-85bad7be09dso1195046241.0

for ; Mon, 09 Dec 2024 05:55:53 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1733752547; x=1734357347; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=dJXLvZgr24Si03NdbTkPi2VPrLNRiibWgXXPWQZW4uc=;

b=eiNCZxhStvcnMMcbN9xzg8hu1yuuy0wX8B0ogvVA05zK4r37Wt52Z8voAyGTp8DYU8

ffdrSPNmOnyb0k5F5CkL8GVsqvmVFSrSJ3uUGVmHFKD3ehYX6iubwndz9SUHgeysrtef

gJpM0Ff6ogFKohzPERIdg0RjvP5J0mr74O7Xf1KY1R9dA7J72qcJYg4kTVS1UfygnCdo

Vb6udu9Zh8c46fRiQFIVbgIzkDNwtaNBgvb9zILNPX2RwiX/Qwm/twDJN4fV16NTltFz

iGDRNyYPhMMd9+4CUsepiXM4Ji02P52tE2WBQKGlPGqZb3zqGP5AKM4fwooohtemLfWG

fMIw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1733752547; x=1734357347;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=dJXLvZgr24Si03NdbTkPi2VPrLNRiibWgXXPWQZW4uc=;

b=ZCD+TqWBjFfs+TgimHmCPgWdhNEtR75TWqsq5kd4jQHjNub/S+N2VSz9cCxvXDWViJ

nKnlAwtHpgKXCSnH5aFIAUo8LE+38u9TBKTyFK5P3iQojucSJWGLnHF/1GmQ7Y51g5uZ

X/iOwzuW0vzhghPSBl8x8IGBurSptA1ccXihhIWMpy6YIUSorUtsaTEmtYQmKC362CrB

+W2mfyFViQIHqHuIwCjNQHeQYl3UZg1vNnsjuGi8m6C704WwnGT6/sItn6mcCqd/9qMx

t+lnifC3H51O0zZlGM1Lw/Jqc+gpwjI7sXg0YWg2ViUCnLGm33L+w0sd+DKmM9Jkj2eX

P5jg==

X-Forwarded-Encrypted: i=1; AJvYcCVYy9+aLioUhFtRCQBvpm8eCi+TGOuN+JLBIBt/hchNXWrwdSSc0wbKxZNy1QdL2yGTv2O9@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YxmW2omV138L1Wh13Oo6/dglUte7KGgNMoauEybml1u/vW4UtHv

Zw2jCZYiDu++B5A4zo2Qgfbl5A5Q9GSjxr/W64OXpGakPO3/7Ll+x/N1DTrlpUUCTRt9YhEcXfB

L5Q433xfU+iroZ4r8yIqdmbh79Qc=

X-Gm-Gg: ASbGncvFkMxIV+XMpXCpcxoZH75xiCdHTlQW+gWdYjIx1UK2SwPMTtjKx2gQgRuQpSP

342DabVkstRLXih2JirZYwRUvstr++n87l9DBFlaKnO2eXqFLNJ7ZwTF0daRV1R1l

X-Google-Smtp-Source: AGHT+IF+z9P4vvVxS1YsyMMWwmnsUtl+OnZMAm5SIHkyvN3ToLLYS9gE6w8eVe0+lIe/DMWdrgtjlrGrDJxkKZR2i5k=

X-Received: by 2002:a05:6102:32c9:b0:4b0:49ba:8276 with SMTP id

ada2fe7eead31-4b049ba8380mr2646385137.26.1733752547264; Mon, 09 Dec 2024

05:55:47 -0800 (PST)

MIME-Version: 1.0

Reply-To: heritagebankceo@gmail.com

From: "heritagebankceo@gmail.com"

Date: Mon, 9 Dec 2024 14:55:36 +0100

Message-ID:

Subject: =?UTF-8?Q?HEAD_P=C3=84EVA?=

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000b551960628d6b87a"

Bcc: root@doctor.nl2k.ab.ca

X-Spam_score: 12.7

X-Spam_score_int: 127

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Tähelepanu kallis Anname teile teada, et teie sularahaautomaadi

KAART vabastati pärast meie tihedat kohtumist tolli- ja piirivalveametiga.

Ãœritasime eile kell 15.20 teie pakki kohale toimetada, kuid kohaletoimetamine

[...]



Content analysis details: (12.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.43 listed in dnsbl.ahbl.org]

[209.85.222.43 listed in dnsbl.ahbl.org]

[209.85.222.43 listed in dnsbl.ahbl.org]

[209.85.222.43 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.43 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.43 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.43 listed in will-spam-for-food.eu.org]

[209.85.222.43 listed in will-spam-for-food.eu.org]

[209.85.222.43 listed in will-spam-for-food.eu.org]

[209.85.222.43 listed in will-spam-for-food.eu.org]

[209.85.222.43 listed in will-spam-for-food.eu.org]

[209.85.222.43 listed in will-spam-for-food.eu.org]

[209.85.222.43 listed in will-spam-for-food.eu.org]

[209.85.222.43 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.43 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.43 listed in list.dnswl.org]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[bobwilliam23513(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[bobwilliam23513(at)gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.0 HTML_MESSAGE BODY: HTML included in message

0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.7 PDS_FROM_2_EMAILS No description available.

2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to

Subject: {SPAM?} =?UTF-8?Q?HEAD_P=C3=84EVA?=



--000000000000b551960628d6b87a

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



T=C3=A4helepanu kallis







Anname teile teada, et teie sularahaautomaadi KAART vabastati p=C3=A4rast m=

eie

tihedat kohtumist tolli- ja piirivalveametiga. =C3=9Critasime eile kell 15.=

20

teie pakki kohale toimetada, kuid kohaletoimetamine eba=C3=B5nnestus eba=C3=

=B5ige

tarneaadressi t=C3=B5ttu. paki kiireks kohaletoimetamiseks soovitame teil

kinnitada oma praegune aadress.









Lugupidamisega"







Proua Elena J.

TNT Express!



--000000000000b551960628d6b87a

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




eight:115%;font-size:11pt;font-family:Calibri,"sans-serif"">T=C3=

=A4helepanu kallis






ize:11pt;font-family:Calibri,"sans-serif"">=C2=A0






ize:11pt;font-family:Calibri,"sans-serif"">Anname teile teada, et=

teie sularahaautomaadi KAART

vabastati p=C3=A4rast meie tihedat kohtumist tolli- ja piirivalveametiga. =

=C3=9Critasime

eile kell 15.20 teie pakki kohale toimetada, kuid kohaletoimetamine eba=C3=

=B5nnestus

eba=C3=B5ige tarneaadressi t=C3=B5ttu. paki kiireks kohaletoimetamiseks soo=

vitame teil

kinnitada oma praegune aadress.






ize:11pt;font-family:Calibri,"sans-serif"">=C2=A0






nt-size:14pt;font-family:Cambria,"serif";color:rgb(54,95,145)">=

=C2=A0






ize:11pt;font-family:Calibri,"sans-serif"">Lugupidamisega"
p>




ize:11pt;font-family:Calibri,"sans-serif"">=C2=A0






ize:11pt;font-family:Calibri,"sans-serif"">Proua Elena J.






nt-size:14pt;font-family:Cambria,"serif";color:rgb(54,95,145)">=

=C2=A0






nt-size:14pt;font-family:Cambria,"serif";color:rgb(54,95,145)">TN=

T Express!





--000000000000b551960628d6b87a--

Digital Marketing Service spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Dec 2024 06:09:00 -0700

Received: from mail-wr1-f43.google.com ([209.85.221.43]:42122)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKdV3-000000000A7-1Hs2

for dave@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 06:08:36 -0700

Received: by mail-wr1-f43.google.com with SMTP id ffacd0b85a97d-3862d16b4f5so1680190f8f.0

for ; Mon, 09 Dec 2024 05:06:44 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1733749598; x=1734354398; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=i2Xp8hTipfrTTLI57CLm262ge4FJfhTu5JPJ8N4bomY=;

b=ORJbARZ5e2FAOl/zoTTupaCKHvvjiozpzb1fTpYiRrwU0RwKzdpAUAmA1RRXZs3g/0

AD6xOAUfLlZMsRZC4SuwYY2D4HH6DMrlB5AUKKPglKhHE8MTmd5RJXtdFFMI9TeH7Y8b

/MpehTWYxqWUvNt4ssbDmRtAFg2SKE7Rcu9/1nzwTWWMoEgVjzXWsK1UOPF4jYGjsWeK

B07z8rzFHZWUu57RFbfCUma8UTLYtpB8Bbo2BeVTo2n+Fw+iU9qyCdr5TxWf7EF4h2IS

uwyLS+qBTYLfUjzYTu9sEKuJab1G+RkVdYpOcmFstz6kuwlWgptw0CqMmEV/l7vDZ6L3

yhDA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1733749598; x=1734354398;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=i2Xp8hTipfrTTLI57CLm262ge4FJfhTu5JPJ8N4bomY=;

b=PyWebuQzle2xM/j2H3+QgDuKLlkM1Zi+rcvdPR4e5dUT1eaQHLURiiIQJU9wp1OGuS

QSqs51kuv/DiPvZL8yYBFcXdROacP7P8/EqNZTvkFXCTusg/RnvMfeiw0CAaQR0tL4CE

ao0YfAqMgtwWAZBRgdP383newb4aV8g66Ff5/3ynL29iCBaCpn9qeE4iRMDpRzr/ntZ4

c4+SOGgi8zNd5qSsg1hK3QVZ5FhE9joK29CzGBWLVO3FmOqlYEBclE/QVFGP8Nk+0dta

c0iLkbkTZ0Y9/BT4ScPLr7NweeUXLWoxYoOzyfwxVp/DZ4NjdNOUhxbI7xsvEWXy23s1

d6SQ==

X-Gm-Message-State: AOJu0YzktzKcNj3RYA1k/HNeCO3nShuCSF8DpgJcWe7zXclqeXSBpahS

cbcYi3HqgyDNdQS54eoyJWCxrvf4d5gPjZGyPikSDxqPMDKYs2CqcXRIE+kuDAEAWJp1/5BDXIA

W2tAk2d/neTthosZ3b3SZFHnQOYhkDQ==

X-Gm-Gg: ASbGncvpfiTCD/JMcmXxTkNgSiVsuRgxOLfIE2MlEhXwmDdS7ytlVid5CiDoYC/9C0m

bq8S360pA5PnAjjfxVSI59QXxhgmP2h+ZYThq8oDdghI=

X-Google-Smtp-Source: AGHT+IFmPviepSElvrOq9tXKeB0+DAbH2ClAu1F0NKr4Z+LuWZ8iBscl17vVgW5Mfel1dsPs/m0Wd2ZJab3BdUyPX/w=

X-Received: by 2002:a05:6000:4802:b0:385:faf5:ebc8 with SMTP id

ffacd0b85a97d-3861bf73783mr13332883f8f.21.1733749597500; Mon, 09 Dec 2024

05:06:37 -0800 (PST)

Received: from 1008170693301 named unknown by gmailapi.google.com with

HTTPREST; Mon, 9 Dec 2024 13:06:37 +0000

MIME-Version: 1.0

From: yashu yashu

Date: Mon, 9 Dec 2024 13:06:37 +0000

Message-ID:

Subject: Outsource Proposal

To: dave@doctor.nl2k.ab.ca

Content-Type: multipart/alternative; boundary="000000000000e37c940628d60806"



--000000000000e37c940628d60806

Content-Type: text/plain; charset="UTF-8"



Hello,







I trust everything is fine at your side.







I'm offering 30% off on all of my Digital Marketing Strategies. With my

services, your website will be on the top Google page in less time.



Benefits of SEO Outsourcing Solutions:



Digital Marketing (SEO, SMO)







10 Keywords - ( $170 - 30% ) $120 USD per month



20 Keywords - ( $340 - 30% ) $240 USD per month



30 Keywords - ( $510 - 30% ) $360 USD per month







Let's join hands and start work. Looking forward to hearing from your side.



I would love to discuss your project and send you more details on the

packages/action/portfolio/past work details.







Best Regards,



Yashu



--000000000000e37c940628d60806

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable









=

Hello,





=

=C2=A0





=

I

trust everything is fine at your side.





=

=C2=A0





=

I'm

offering 30% off on all of my Digital Marketing Strategies. With my service=

s,

your website will be on the top Google page in less time.





=

Benefits

of SEO Outsourcing Solutions:






t;color:#333333">Digital Marketing (SEO, SMO)





=

=C2=A0






t;color:#333333">10 Keywords - ( $170 - 30% ) $120 USD per month=C2=A0






t;color:#333333">20 Keywords - ( $340 - 30% ) $240 USD per month=C2=A0





=

30 Keywords - ( $510 - 30% ) $360 USD per =

month
=C2=A0





=

=C2=A0





=

Let's

join hands and start work. Looking forward to hearing from your side.





=

I

would love to discuss your project and send you more details on the

packages/action/portfolio/past work details.





=

=C2=A0





=

Best

Regards,





=

Yashu





=C2=A0





=C2=A0











--000000000000e37c940628d60806--

Nigerian Spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Dec 2024 03:39:00 -0700

Received: from mail-ej1-f66.google.com ([209.85.218.66]:59668)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tKb9z-00000000Lcq-224h

for dave@doctor.nl2k.ab.ca;

Mon, 09 Dec 2024 03:38:42 -0700

Received: by mail-ej1-f66.google.com with SMTP id a640c23a62f3a-a9a68480164so560390966b.3

for ; Mon, 09 Dec 2024 02:36:44 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1733740598; x=1734345398; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=EpsqdiTX3H8bf2DsJ7UgNKjvIjdqswkZTaPjFkafi7Q=;

b=Q4uSSjpq1FMO7QTxip2SvP5uXZVg/p2nNppTFNMyuzchp41qjWuhTROwAHeZSv+Edn

w1YII7uyrMgBj4WKm38ZkkDNkOU0mz7Z1cDOpLqI7PAqnD9FZ+vImwhZOpBhiBmz8HUm

ZYacDh2TEbszvpCNyiz47nZAGv1e0dbbMH6SVR354ga2Pj5wsnaQcQ+kFVlH8PFRI2aZ

sZlzD3F5YxylplDyW3VtECG01aVuGVLgGRj33H0eysNWOHop1xlcCmfyp8eB0Hasw+Xr

BIR1k0RVF+9RskSFn606LEJAVql5iNplntDCG5Q1bDef7/TcOzKz/BmhYSg2rf9rkM+L

EI4g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1733740598; x=1734345398;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=EpsqdiTX3H8bf2DsJ7UgNKjvIjdqswkZTaPjFkafi7Q=;

b=Ej/4yJFyb0Zfu3MYDMJ6hSP7hcoPSivoUEFuhqnfvhZKuPHTDxihNZ7FF4JsnE/SSS

zlj15rLtLNEj4Bl4ctraIDrD0lzplc3x29dZGNECVChHM96HeeBvzm5GNmqCEuqCeimL

kd99XszoyYp0H7tuv8HNX1RxkDatVRjOAe9QPaQIiAV4MmFBA7nHl+c7RDAO+/9d75j4

d9NVXX8btYC7SvAA0TzQo2tTNZHgf8lIea8oyICb+ed8tXQNLQ9js0OQgLBxCTDFeAJf

x70ngkxyeHBdLQcHjrT5ZIEqY9WOKLUt1RSM5iiEoH2Sa1N77TAqO+hFQPbuIgEVJLOs

5+YA==

X-Forwarded-Encrypted: i=1; AJvYcCVb/quC0P0VdRgznfvlArMWApvrtKnlihwl3CMSfFG8lmM74AFHfL5m8xOCWT3tJHbNIuLj@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YwsJ67A9m+EZqHujIXlYiMlkr+rASthX9YSEV/cIkPfMrHkbCDx

CprQ08m69rePY1QmhKxWc3oam+z7PSbnkIWspA42bdKKFQvqlv0J/qA+UcvRFIw1GuVrdPLV8u9

XaST0hwuaztjXGQwsdVolZ81VXzbkVY5CLbKwmg==

X-Gm-Gg: ASbGncstMM2YNPycZJmfUvCj0JF6nhce70R6DjbbXphqK+M3nH4iFl8Q+Mle27C2fSb

FAyr8Es/pT5CefZJDpdcA4XlqC4OZDCQ=

X-Google-Smtp-Source: AGHT+IHSqIMR6gffY2mgJxejyoPrlkUKcqBOSX8mblWnKcpYKlI238iLvQ5Llk2G+Zj4dtGCd0YDE5TQtduHRk0E3o4=

X-Received: by 2002:a05:6402:2791:b0:5cf:a1c1:5289 with SMTP id

4fb4d7f45d1cf-5d3be6fb887mr10666889a12.21.1733738785806; Mon, 09 Dec 2024

02:06:25 -0800 (PST)

MIME-Version: 1.0

Reply-To: benmarie824@gmail.com

From: "Mrs.Mary Benjamin"

Date: Mon, 9 Dec 2024 11:06:11 +0100

Message-ID:

Subject: =?UTF-8?B?TXJzLiBNYXJ5IEJlbmphbcOtbiw=?=

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000007622550628d3842b"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 13.3

X-Spam_score_int: 133

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Kindly read and reply fast. I will need your help to accomplish

the wishes of my late husband. I want to donate toward education and the

less privilege ones and churches; I will need your service to h [...]



Content analysis details: (13.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.218.66 listed in dnsbl.ahbl.org]

[209.85.218.66 listed in dnsbl.ahbl.org]

[209.85.218.66 listed in dnsbl.ahbl.org]

[209.85.218.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.218.66 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.218.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.218.66 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.218.66 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.218.66 listed in will-spam-for-food.eu.org]

[209.85.218.66 listed in will-spam-for-food.eu.org]

[209.85.218.66 listed in will-spam-for-food.eu.org]

[209.85.218.66 listed in will-spam-for-food.eu.org]

[209.85.218.66 listed in will-spam-for-food.eu.org]

[209.85.218.66 listed in will-spam-for-food.eu.org]

[209.85.218.66 listed in will-spam-for-food.eu.org]

[209.85.218.66 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.66 listed in list.dnswl.org]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.66 listed in wl.mailspike.net]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[benmarie824(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ben870266(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[ben870266(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 HK_NAME_FM_MR_MRS No description available.

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.7 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} =?UTF-8?B?TXJzLiBNYXJ5IEJlbmphbcOtbiw=?=



--0000000000007622550628d3842b

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Kindly read and reply fast.

I will need your help to accomplish the wishes of my late husband. I want

to donate toward education and the less privilege ones and churches; I will

need your service to handle this project=E2=80=99s. I will give you more de=

tails

once you accept this offer.

Sincerely

Mrs. Mary Benjam=C3=ADn,



--0000000000007622550628d3842b

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Kindly read and reply fast.
I will need your help to ac=

complish the wishes of my late husband. I want to donate toward education a=

nd the less privilege ones and churches; I will need your service to handle=

this project=E2=80=99s. I will give you more details once you accept this =

offer.
Sincerely
Mrs. Mary Benjam=C3=ADn,




--0000000000007622550628d3842b--