CAA Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jan 2025 01:16:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tV4kg-00000000K8s-3TWY

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jan 2025 01:15:50 -0700

Resent-From: The Doctor

Resent-Date: Tue, 7 Jan 2025 01:15:50 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.172.205.168] (port=41891 helo=mercadolibre.com.ve)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tUzwJ-00000000LKz-2MjP

for sales@nk.ca;

Mon, 06 Jan 2025 20:07:37 -0700

Date: Mon, 06 Jan 2025 21:44:43 -0500

From: =?UTF-8?B?Q29uc3VtZXItc3VydmV5?=

Reply-To: =?UTF-8?B?Q29uc3VtZXItc3VydmV5?=

To: sales@nk.ca

Message-ID:

Subject: =?UTF-8?B?V2UncmUgbG9va2luZy1mb3IgbmV3LWN1c3RvbWVycw==?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.zHeE2GpAQMm0rdYmSdSzpBj62H67gzB8.localhost.sales>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 31.1

X-Spam_score_int: 311

X-Spam_bar: +++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (31.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[103.172.205.168 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.172.205.168 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.172.205.168 listed in dnsbl.ahbl.org]

[103.172.205.168 listed in dnsbl.ahbl.org]

[103.172.205.168 listed in dnsbl.ahbl.org]

[103.172.205.168 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.172.205.168 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.172.205.168 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.172.205.168 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.172.205.168 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.172.205.168 listed in will-spam-for-food.eu.org]

[103.172.205.168 listed in will-spam-for-food.eu.org]

[103.172.205.168 listed in will-spam-for-food.eu.org]

[103.172.205.168 listed in will-spam-for-food.eu.org]

[103.172.205.168 listed in will-spam-for-food.eu.org]

[103.172.205.168 listed in will-spam-for-food.eu.org]

[103.172.205.168 listed in will-spam-for-food.eu.org]

[103.172.205.168 listed in will-spam-for-food.eu.org]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UncmUgbG9va2luZy1mb3IgbmV3LWN1c3RvbWVycw==?=

















CAA



























CAA Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jan 2025 01:16:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tV4kk-00000000K95-34Yi

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jan 2025 01:15:54 -0700

Resent-From: The Doctor

Resent-Date: Tue, 7 Jan 2025 01:15:54 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.176.79.118] (port=59029 helo=mama.cn)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tUztJ-00000000Ktv-2Rpy

for doctor@nl2k.ca;

Mon, 06 Jan 2025 20:04:33 -0700

Date: Mon, 06 Jan 2025 21:45:00 -0500

From: =?UTF-8?B?Q29uc3VtZXItc3VydmV5?=

Reply-To: =?UTF-8?B?Q29uc3VtZXItc3VydmV5?=

To: doctor@nl2k.ca

Message-ID:

Subject: =?UTF-8?B?V2UncmUgbG9va2luZy1mb3IgbmV3LWN1c3RvbWVycw==?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.5GrI2f6KvfBTh26VUKeslcgL7EgEHPk8.localhost.doctor>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 31.1

X-Spam_score_int: 311

X-Spam_bar: +++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (31.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[103.176.79.118 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.176.79.118 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.176.79.118 listed in dnsbl.ahbl.org]

[103.176.79.118 listed in dnsbl.ahbl.org]

[103.176.79.118 listed in dnsbl.ahbl.org]

[103.176.79.118 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.176.79.118 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.176.79.118 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.176.79.118 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.176.79.118 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.176.79.118 listed in will-spam-for-food.eu.org]

[103.176.79.118 listed in will-spam-for-food.eu.org]

[103.176.79.118 listed in will-spam-for-food.eu.org]

[103.176.79.118 listed in will-spam-for-food.eu.org]

[103.176.79.118 listed in will-spam-for-food.eu.org]

[103.176.79.118 listed in will-spam-for-food.eu.org]

[103.176.79.118 listed in will-spam-for-food.eu.org]

[103.176.79.118 listed in will-spam-for-food.eu.org]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UncmUgbG9va2luZy1mb3IgbmV3LWN1c3RvbWVycw==?=

















CAA



























CAA Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jan 2025 01:16:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tV4ko-00000000K9G-1ECk

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jan 2025 01:15:58 -0700

Resent-From: The Doctor

Resent-Date: Tue, 7 Jan 2025 01:15:58 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.174.115.212] (port=45765 helo=xda-developers.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tUzod-00000000Jsg-2Sec

for doctor@doctor.nl2k.ab.ca;

Mon, 06 Jan 2025 19:59:43 -0700

Date: Mon, 06 Jan 2025 21:45:22 -0500

From: =?UTF-8?B?Q29uc3VtZXItc3VydmV5?=

Reply-To: =?UTF-8?B?Q29uc3VtZXItc3VydmV5?=

To: doctor@doctor.nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?V2UncmUgbG9va2luZy1mb3IgbmV3LWN1c3RvbWVycw==?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.WUfZx1J1uG42J9tISLUy18hz7JbKmGp0.localhost.doctor>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 31.1

X-Spam_score_int: 311

X-Spam_bar: +++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (31.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.174.115.212 listed in dnsbl.ahbl.org]

[103.174.115.212 listed in dnsbl.ahbl.org]

[103.174.115.212 listed in dnsbl.ahbl.org]

[103.174.115.212 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.174.115.212 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.174.115.212 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.174.115.212 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.174.115.212 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.174.115.212 listed in will-spam-for-food.eu.org]

[103.174.115.212 listed in will-spam-for-food.eu.org]

[103.174.115.212 listed in will-spam-for-food.eu.org]

[103.174.115.212 listed in will-spam-for-food.eu.org]

[103.174.115.212 listed in will-spam-for-food.eu.org]

[103.174.115.212 listed in will-spam-for-food.eu.org]

[103.174.115.212 listed in will-spam-for-food.eu.org]

[103.174.115.212 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[103.174.115.212 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.174.115.212 listed in sbl-xbl.spamhaus.org]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UncmUgbG9va2luZy1mb3IgbmV3LWN1c3RvbWVycw==?=

















CAA



























Web / SEO/ App spam from Microsoft Outlook

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jan 2025 01:17:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tV4lc-00000000KFj-0pvo

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jan 2025 01:16:48 -0700

Resent-From: The Doctor

Resent-Date: Tue, 7 Jan 2025 01:16:48 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-psaapc01olkn2066.outbound.protection.outlook.com ([40.92.52.66]:6945 helo=APC01-PSA-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tV28o-00000000GIT-1zHp

for root@nk.ca;

Mon, 06 Jan 2025 22:28:38 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=kGmKeuT8CYKH7/OZw3NZsDaTpaBqy7XcB1pf8e5rKmigGk7pZ2O/T5BKWlnrS/Gc1edMR58ErVdYhfMg3BIZkTQn+s9X+2go5DBa55Vw47/vzaXruTJ6OAPX7ev+lz0yQyafodY+aSf/WLirSseFHedN4eFSiRQ2gULeBhhevbqar89hna8ZaJdq+g9Diw05jaWFup/fYzeZrn0dks8XAUG3dwGAUnWANuJCxwk5zRSkX/tT7ffvFd15sx2xbQd2pwBSYBHI/1UA3OELJ266nrbdy05jRBNSZs+QkyJULyVdvowBv83ye52no9aibzeno6QoraLTR7BEOmfxB2kQAQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=rEFNW9GLyCtYDYl5ueNli8PsWZsuujl3yDCFofo6/RI=;

b=Ac/Qi454fekDEO9Fe0et8TqASyxnUjnM2ZzZ6YsUYh5RmkSe8bGdH8VupBrR/4oN8OiZISBdaE3F1DZX1P9lv1QfQlYD+/pjjSjmY/VZljoKXviiNrbtHtAwTjEgF2TJi9DPdYI2VYEF/UKvfpc34YmM8xnF+mo9tAmr4QoEMYMJ5JWtQyoIsDAUtOQDR8NyYuRM+aq/7OUr+8NZ6LQ7FPPHoPZbjLp0Io6nLSyQWlhEVs81zfSVj1Ra+u7e26FoCn6C/P8RpqfSB8LVod4+r7qWKF2bJvw9UA2j1n6TDX1Uzmj8e6uHQBMsO9MjD/DShPwavk/NS34dfHpR4LW1fw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=rEFNW9GLyCtYDYl5ueNli8PsWZsuujl3yDCFofo6/RI=;

b=OaCXpjiyI6AYkptzJJv3NP7UuSWqgQm4ZcEuK/KV4xLigrweqOA4RtJ4SjCOLbMjE/FTjxSkkspA17+NcB1ZzNlvDmFulfK/GQVQXPQohG7mwM4MEXTYpM13A3ptQTqwxQKRawmK/B9zJZbzTMCefZKMgbcwLqORuDVU3YCGMkKIToVCXFGOldtUv+BlsYdmgPBEib6VgEquPtbDVdtNijcdyK1APddcuSO/QohFjZYkqGNY3FxDZ0xhvl7bImFYQhB5UQsKo9PDqa9HroxXuCSUGRaQXp4KnfvVl2TQZeCw7xuToazf3Yi0PFizGy5MZ2v9nIOaW1kzNwDsUG3RwA==

Received: from TYZPR04MB7886.apcprd04.prod.outlook.com (2603:1096:405:b4::9)

by TYZPR04MB6150.apcprd04.prod.outlook.com (2603:1096:400:25c::12) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8314.17; Tue, 7 Jan

2025 05:25:49 +0000

Received: from TYZPR04MB7886.apcprd04.prod.outlook.com

([fe80::518:e395:fb25:ae89]) by TYZPR04MB7886.apcprd04.prod.outlook.com

([fe80::518:e395:fb25:ae89%4]) with mapi id 15.20.8314.015; Tue, 7 Jan 2025

05:25:49 +0000

From: "Meera ."

To: "Meera ."

Subject: Re: SEO inquiry :-

Thread-Topic: SEO inquiry :-

Thread-Index: AdqbmnsOkjEF1CNNRQqmW7dH9eHu5zFKgt+5AAAEbNs=

Date: Tue, 7 Jan 2025 05:25:49 +0000

Message-ID:



References:





In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TYZPR04MB7886:EE_|TYZPR04MB6150:EE_

x-ms-office365-filtering-correlation-id: 523383f3-2529-469f-8f16-08dd2edbbeef

x-microsoft-antispam:

BCL:0;ARA:14566002|8062599003|15030799003|19110799003|7071999006|461199028|8060799006|15080799006|56899033|102099032|440099028|3412199025|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?mD1Szj4D/VvIa7yFgngdHhUwRoJxJLkvQuLuYCkYuPf9JNwQMtv5TJGXzQ?=

=?iso-8859-1?Q?BzJJ+7k4tAz9gk6Rhkn2T73VpZxOJHjtUB2EAjkBthOJbK34kpdrPqUp7d?=

=?iso-8859-1?Q?272MaWwrQuD2RGItpwJp84cpPGdJP+b+jgUr2MWzTboWjA1WtrlueJu2+p?=

=?iso-8859-1?Q?C/zGoNM3MAzyADnDS3D9X2NySt2ThjjUXWT1SkxZoJgdsN3wfMLal5/PW3?=

=?iso-8859-1?Q?lXQ9P74WErMsmlrbgoYjfY+yEYb+LtZLZGNAVnmDKd9l8Zhbl4PRCx2bRW?=

=?iso-8859-1?Q?URZ8zIBX9UOUVw6ab2/Fm6gElVWMLG+VrTC6dJQgq+ijPpZlDNHqtNJwDm?=

=?iso-8859-1?Q?UA5fkzKkc4bfzCjO3jJ3ADRoXM3wi5Uk0h8rtcBwflkB7mhGLgeUy9nDBA?=

=?iso-8859-1?Q?gE3Jwgl6z/KZWGSs+FPGHiBOgO6RXCKZWCqtPmmxOOdffrrRNVK6BFxcjT?=

=?iso-8859-1?Q?3UwZKmC1CEokB02vdPUtl9O1HReLGnYACn9YlfKjYD0DMCsKzWl7Zau7zN?=

=?iso-8859-1?Q?aVx3c2oearWFrdgOTYfbos7EbbakwNDMh3+HNQ74FV5U1tOKy9naiHBXXV?=

=?iso-8859-1?Q?mArSNvuJzNq7aDzs5kGOvtOvj/4RobkBnnOik81cQQDuxHFn57pq4dyC7y?=

=?iso-8859-1?Q?JtYt7BDleuMqldLN8mKzqzrgwnuuy7H9LdRKbBeQ+q6wApkPMSQOQiwcDu?=

=?iso-8859-1?Q?BNc9Lf5e+vD9+5mhlaX71qhCcd7AsvMnuh08W4JZ594QQ2eSRgyVQ+pMlD?=

=?iso-8859-1?Q?0/QRrCOQxJH4lGyIYG7+4dI9tbjl1CZePbbILb6OtYlnJ+Vu7vg/JnEO1A?=

=?iso-8859-1?Q?50vZCmNUULtISf+/exbIdMclFdmvzbvzDZFUJgO6bbh0Fkui8VIdm6oO7r?=

=?iso-8859-1?Q?b5YFyM2AeKBOUt/QmB6/MGK0OO8xILRYt4EKElzbjK5T8aUTXQ51/L3z2D?=

=?iso-8859-1?Q?p1bMk43+Jt5SJn9zL2ml2aV7dK2HzGLc/yLUcV74yGOVbgJIxBG2+xdIA3?=

=?iso-8859-1?Q?E2StHnTFtymRzYd+vZqcyKBovXp6S+gVSclP4ktNwBtiDu6DSGpnqA8vJo?=

=?iso-8859-1?Q?lhPtyg/yCe/Z9vDc+Eusuc28EjQgaH6ihjSohvtsedfQEGs8E2Xg40LbSR?=

=?iso-8859-1?Q?XwXwEtn6OXOu0FxXHvyeKnNx/oxbk+pxhaIKFgC1RyNx5ehuhQ?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?A7nh3m4L641canlB1zSa/STNlqx3JWbjni6dtXYyA0PM4xKvk/Jds79rZs?=

=?iso-8859-1?Q?wQssiMXrbxkdGmsZSVdA5ieiWHCGoowjJlMQoB7cFPvJuEeAxEPHbz2+gE?=

=?iso-8859-1?Q?S8obCC6ITbEyXbIXqmJi1n2UDOZWas/+EzD30UvBMOyD91g9ij4kDbul+R?=

=?iso-8859-1?Q?AJyARnpG8Ua7eu+ljwGe5yWND3qoSCBEWiVdLm0+GLZvG72ZhWRIPiAweO?=

=?iso-8859-1?Q?5T4Zkc2zXkbiAH6BUDlwJhV/np4dQyCFDFKxDoFHP6IdJ65QfgmWmxq+yp?=

=?iso-8859-1?Q?YbCrxiNvYQYwgjNDALKs8p5b6SiVOutyWajwboKnYb2eGRmVfrwHuynihO?=

=?iso-8859-1?Q?qjj8K+S2I9kuKkKt4O0qkxndZStWxKJVeIc0qQnh5o5Ibr46232Kam+snx?=

=?iso-8859-1?Q?VqvKHYPf8/3QL+CBaX1/iZbUlWJDOrOHkAtVybPFkW7WCqSdjQ1TIKdmrB?=

=?iso-8859-1?Q?tNYI9wg4DaL5r/0sDil2lfw7i1RxlU2gWWCvmSQL6UmrGhLQDtvmBcvW5C?=

=?iso-8859-1?Q?11KaU5N64Es5GCkoOjqZMUiHDBzow7b75VceZJO8Ld+Uev8hQ0r8Fa1CtZ?=

=?iso-8859-1?Q?VXEfmfvrtJyBIw4lGvU2QNU+LWTVtzQAJBsE/5vv/Hy/SKOWdzSMAExk/y?=

=?iso-8859-1?Q?h0IjhYUfPJI/mT1uDt/LVM0KpnwTwqrJPp60zcvstBPAVvgDYU9JT6VXOx?=

=?iso-8859-1?Q?UN7SknT6qj/D4KVZObiJLPMUSTIET/MbTA7hkqaaB4+6Af4f75fiamLRFh?=

=?iso-8859-1?Q?uYDIhTDd2qXWWnFP+O7xsrr7ysIscz9jGV8EiWPdJuYK0IpK4cQuopdObR?=

=?iso-8859-1?Q?d24vlYhSY1hS6VohKLs+zS2eYOHoBdMbO2uHDCSOwB4eYa5ScPKBG4oxAQ?=

=?iso-8859-1?Q?J08W1CroSn6LJijgOiHZfo1lDJeK9eSWdH8VEfOrPQ0l0ZtsRNHux5qrW0?=

=?iso-8859-1?Q?5lyCtclONi6CCbaoSChyl0BOXYeAC7wGsOWHckS326vcVGsX+Ws/2aXWNb?=

=?iso-8859-1?Q?vccnPfCPlO5dCE5Kuu3E+0HI74z2xgL0vKbJoNh/wUKMwWOwlyrwSBdp7I?=

=?iso-8859-1?Q?hHWC7GPEYoora2uZrftcmCi1jKlUgkobx8vOCPoP3jZjCd1P/HFXAHDdUI?=

=?iso-8859-1?Q?HVs3MxPLQfIID0OjY+tipz4SE5XQT2KJfx53QkxZFzKu/VI7wu/eXWfQAx?=

=?iso-8859-1?Q?xEmpphNeIbYiXBEiyvnuVtmiLq3V5s243Na3NxYtudO5AsXjB89PON/FAu?=

=?iso-8859-1?Q?YHgVNaQtqJeP2r/Zy/sSkfP+qfzeP2Og4krVLE1EE=3D?=

Content-Type: multipart/alternative;

boundary="_000_TYZPR04MB7886F9BE5121F4DB644854D79B112TYZPR04MB7886apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYZPR04MB7886.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 523383f3-2529-469f-8f16-08dd2edbbeef

X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Jan 2025 05:25:49.2334

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYZPR04MB6150



--_000_TYZPR04MB7886F9BE5121F4DB644854D79B112TYZPR04MB7886apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable





Hello,

We focus on getting websites ranked on Google's first page and boosting org=

anic traffic. Let me know if you'd like a quote.

Best regards,

P.S. If you'd prefer not to receive future messages, reply with "Unsubscrib=

e."





--_000_TYZPR04MB7886F9BE5121F4DB644854D79B112TYZPR04MB7886apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">











-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica=

, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hello,


We focus on getting websites ranked on Google's first page and boosting org=

anic traffic. Let me know if you'd like a quote.


Best regards,


P.S. If you'd prefer not to receive future messages, reply with "Unsub=

scribe."



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">
















--_000_TYZPR04MB7886F9BE5121F4DB644854D79B112TYZPR04MB7886apcp_--

CAA Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jan 2025 01:17:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tV4l4-00000000KBC-2Heo

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jan 2025 01:16:14 -0700

Resent-From: The Doctor

Resent-Date: Tue, 7 Jan 2025 01:16:14 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.172.205.180] (port=38119 helo=independent.co.uk)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tUzri-00000000Kbh-39V5

for games@nl2k.ab.ca;

Mon, 06 Jan 2025 20:02:52 -0700

Date: Mon, 06 Jan 2025 21:48:56 -0500

From: =?UTF-8?B?Q29uc3VtZXItc3VydmV5?=

Reply-To: =?UTF-8?B?Q29uc3VtZXItc3VydmV5?=

To: games@nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?V2UncmUgbG9va2luZy1mb3IgbmV3LWN1c3RvbWVycw==?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.UogfEGixlp8a46eKXcBXfNIangOQNRT6.localhost.games>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 30.3

X-Spam_score_int: 303

X-Spam_bar: ++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (30.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[103.172.205.180 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.172.205.180 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.172.205.180 listed in dnsbl.ahbl.org]

[103.172.205.180 listed in dnsbl.ahbl.org]

[103.172.205.180 listed in dnsbl.ahbl.org]

[103.172.205.180 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.172.205.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.172.205.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.172.205.180 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.172.205.180 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.172.205.180 listed in will-spam-for-food.eu.org]

[103.172.205.180 listed in will-spam-for-food.eu.org]

[103.172.205.180 listed in will-spam-for-food.eu.org]

[103.172.205.180 listed in will-spam-for-food.eu.org]

[103.172.205.180 listed in will-spam-for-food.eu.org]

[103.172.205.180 listed in will-spam-for-food.eu.org]

[103.172.205.180 listed in will-spam-for-food.eu.org]

[103.172.205.180 listed in will-spam-for-food.eu.org]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=independent.co.uk;ip=103.172.205.180;r=doctor.nl2k.ab.ca]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UncmUgbG9va2luZy1mb3IgbmV3LWN1c3RvbWVycw==?=

















CAA



























CAA Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jan 2025 01:17:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tV4kr-00000000KA8-3ic2

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jan 2025 01:16:01 -0700

Resent-From: The Doctor

Resent-Date: Tue, 7 Jan 2025 01:16:01 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.172.205.168] (port=56225 helo=mercadolibre.com.ve)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tUznI-00000000Jwl-1Dzi

for root@doctor.nl2k.ab.ca;

Mon, 06 Jan 2025 19:58:20 -0700

Date: Mon, 06 Jan 2025 21:45:29 -0500

From: =?UTF-8?B?Q29uc3VtZXItc3VydmV5?=

Reply-To: =?UTF-8?B?Q29uc3VtZXItc3VydmV5?=

To: root@doctor.nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?V2UncmUgbG9va2luZy1mb3IgbmV3LWN1c3RvbWVycw==?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.5hfuhY8Ju9lAXhO9bM3sQIbNcx82M89a.localhost.root>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 27.4

X-Spam_score_int: 274

X-Spam_bar: +++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (27.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.172.205.168 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.172.205.168 listed in will-spam-for-food.eu.org]

[103.172.205.168 listed in will-spam-for-food.eu.org]

[103.172.205.168 listed in will-spam-for-food.eu.org]

[103.172.205.168 listed in will-spam-for-food.eu.org]

[103.172.205.168 listed in will-spam-for-food.eu.org]

[103.172.205.168 listed in will-spam-for-food.eu.org]

[103.172.205.168 listed in will-spam-for-food.eu.org]

[103.172.205.168 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[103.172.205.168 listed in zen.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.172.205.168 listed in dnsbl.ahbl.org]

[103.172.205.168 listed in dnsbl.ahbl.org]

[103.172.205.168 listed in dnsbl.ahbl.org]

[103.172.205.168 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.172.205.168 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.172.205.168 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.172.205.168 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.172.205.168 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[103.172.205.168 listed in sa-trusted.bondedsender.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[103.172.205.168 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[103.172.205.168 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.172.205.168 listed in bl.score.senderscore.com]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UncmUgbG9va2luZy1mb3IgbmV3LWN1c3RvbWVycw==?=

















CAA