Metamask phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 11 Jan 2025 08:30:01 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWawk-00000000Cbz-1NJf

for dave@doctor.nl2k.ab.ca;

Sat, 11 Jan 2025 05:50:34 -0700

Resent-From: The Doctor

Resent-Date: Sat, 11 Jan 2025 05:50:33 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cloudhost-5007469.us-west-1.nxcli.net ([173.249.147.92]:42802)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWTdw-00000000McY-2dh2

for root@nk.ca;

Fri, 10 Jan 2025 22:03:05 -0700

Received: (qmail 14134 invoked by uid 10131); 11 Jan 2025 05:02:28 +0000

Date: 11 Jan 2025 05:02:28 +0000

Message-ID: <20250111050228.14133.qmail@cloudhost-5007469.us-west-1.nxcli.net>

To: root@nk.ca

Subject: Welcome to Our Services

X-PHP-Originating-Script: 10131:mail.php

From: Service Updates

Reply-To: psuz6stm@support.notices.org

Content-Type: text/html; charset=UTF-8

MIME-Version: 1.0

X-Spam_score: 12.2

X-Spam_score_int: 122

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: MetaMask Security Secure Your Wallet Now !



Content analysis details: (12.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[173.249.147.92 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[173.249.147.92 listed in will-spam-for-food.eu.org]

[173.249.147.92 listed in will-spam-for-food.eu.org]

[173.249.147.92 listed in will-spam-for-food.eu.org]

[173.249.147.92 listed in will-spam-for-food.eu.org]

[173.249.147.92 listed in will-spam-for-food.eu.org]

[173.249.147.92 listed in will-spam-for-food.eu.org]

[173.249.147.92 listed in will-spam-for-food.eu.org]

[173.249.147.92 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[173.249.147.92 listed in dnsbl.ahbl.org]

[173.249.147.92 listed in dnsbl.ahbl.org]

[173.249.147.92 listed in dnsbl.ahbl.org]

[173.249.147.92 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[173.249.147.92 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[173.249.147.92 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[173.249.147.92 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[173.249.147.92 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[173.249.147.92 listed in zen.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[173.249.147.92 listed in sa-trusted.bondedsender.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[173.249.147.92 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[173.249.147.92 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[173.249.147.92 listed in bl.score.senderscore.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

Subject: {SPAM?} Welcome to Our Services

















MetaMask Security

















































MetaMask Logo



Secure Your Wallet Now !



Dear Valued User,



Your wallet's security is our top priority. Two-Factor Authentication (2FA) protects your assets. Please enable 2FA for uninterrupted access.





Enable 2FA Now



If you have already taken action, please disregard this message.



Thank you for being a valued MetaMask user. Stay secure .









get news from multiple source from Microsoft Outlook

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 11 Jan 2025 07:41:42 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWayA-00000000Cg7-3Dzn

for dave@doctor.nl2k.ab.ca;

Sat, 11 Jan 2025 05:52:02 -0700

Resent-From: The Doctor

Resent-Date: Sat, 11 Jan 2025 05:52:02 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastasiaazolkn19011027.outbound.protection.outlook.com ([52.103.64.27]:60504 helo=HK3PR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWacP-00000000Ba8-3kaM

for sales@nk.ca;

Sat, 11 Jan 2025 05:29:48 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=MMnvLgX+X3GPB30RMz9Ym1fxoxPBaBX92bg+BLsKr+vIDliTDgPtTUrASITKPqC8fAIG14bVKu5x3X2bIfbjuoUk6NFRERvLNQXX2KY9vW+jRnWZmdGdvrP5RnAU/Ny/1DSAojwF1mM5hr3KXE7FDugEvTJR3M59s7UGj0MAb6H0XOEHBqh2Vk/L/Cw7QUoUqIgbBTwOVRWZqkYeWZzagiq0XZcKFkPqe+ENBZ9ZvxnC4rSBezDKKE+aU1DGSIt/PXK7YznDbT0WH1wDe29458tUTh8AegaWVMbFw2h3+XopsQ9Jj9nNfkpt46Dr1TFGUAmxYQfnborv/JeX5n7nGQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=wAuXeojpA/0rikLrqsFqgPErJB7AojW+RltVrr0Z0Us=;

b=Wu82bsN8U9efI3xntMh4BRGy+qczWViOcacMxUv0S3TpI5vjYmZVHf1YsI5JSoCf7ZS+X4SmchEos+W6Nu6TiHba7VYpfYJ7PZAVH2RkXgs2gA6m8aeDUbPc5w/3ebxiehzyXZW0OeE7BBhyuREsmRDwek+Mg8xp5JIsJwFyXUk0j2FKhHwnIkysrO5xfJkflNcZcWhrj6KhqoUVPVFVwN/WnmWSG+RxRrKXMQjZwKSHQvEOBIUrYHtqedlL9pMRnCN1LOQF0FTSX2N6mKRHycH0rrEnOdcyUI581mdlqf6FF9e+0vEq2XcwDhjiIMVvtIJd8XJIxncgNwckmSHgxg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=wAuXeojpA/0rikLrqsFqgPErJB7AojW+RltVrr0Z0Us=;

b=A8dzX60rfKIcyJBZbc3ezuGha+Ru5qflDKGZX9c9aJBxF/C90twACgST1qiMU7guHsXvnCWtS/8R+hVSRCVZG3n0MFWwDXQpo0ZFsLIfwSI14jACa8IW2cdQENFU7iIoDaONIQ/vuKjSPbt1Nl3SbSLX8Yrg0mR2EqpAtYicc8YUeX0F+tQxFMPptE31Ce5gToe1enGGJUjFUv+laajbdaUigNf0nRemni0EZULf/vV+svL5UEvhpdYv5CKaXvZrTr7Qpy3tYjFE1W7MJtSEHD5ghXNRkd9NlAYFhZ8WtPVUND6IzU/Dwzue04eYvv20OX1knp5wMsn4ZAI5TYI1pg==

Received: from SEZPR01MB4374.apcprd01.prod.exchangelabs.com

(2603:1096:101:39::8) by TY1PPFD0984D342.apcprd01.prod.exchangelabs.com

(2603:1096:408::352) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8314.17; Sat, 11 Jan

2025 12:27:15 +0000

Received: from SEZPR01MB4374.apcprd01.prod.exchangelabs.com

([fe80::d4e6:d6ce:5d78:15c9]) by SEZPR01MB4374.apcprd01.prod.exchangelabs.com

([fe80::d4e6:d6ce:5d78:15c9%3]) with mapi id 15.20.8335.014; Sat, 11 Jan 2025

12:27:15 +0000

From: Shivi Saxena

Subject: Re: Get Your News on 400+ Media Outlets, Including CBS and Fox!

Thread-Topic: Get Your News on 400+ Media Outlets, Including CBS and Fox!

Thread-Index: AQHbZCQlZvUXEMyqZEWBXtqDL+0h9g==

Date: Sat, 11 Jan 2025 12:27:14 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SEZPR01MB4374:EE_|TY1PPFD0984D342:EE_

x-ms-office365-filtering-correlation-id: 4a0c163e-43cf-44a0-db8a-08dd323b4802

x-microsoft-antispam:

BCL:0;ARA:14566002|8062599003|7092599003|8060799006|7071999006|19110799003|461199028|15080799006|15030799003|440099028|3412199025|102099032;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?vcX3Vsi0sfBEjsTn9Ym6pNV+jjqn73upanRFounwyGZk52rB+l09oXHz?=

=?Windows-1252?Q?g2maHzttK4X4yeeoCvGORSe1JHJ/yGqDoxz2bZUfVjq+2XH7vKTPdgif?=

=?Windows-1252?Q?x4d27PWo0vhIrBQ0/wkAMaB9wbiL+4o5pxQyTAVvlR50hKkvVvsw6oq2?=

=?Windows-1252?Q?NaO1jMwYWA5YvNMJLli/1HWRteHllw1Up43+mNiQg1igiyHLZgXiFjyT?=

=?Windows-1252?Q?ZTfgcKk3sRYv8rkaQOOFRQNohMtjhK0QecadW6vU+v9n0VRAK9mPwUoE?=

=?Windows-1252?Q?4TfXZetWkicl4HlnD+/gE/7/oL/Al5zaqpK0XNWuSn49MKFW4kQSNJDh?=

=?Windows-1252?Q?6w2/XOUOKvL6UiXbRJaJfO4IvVUUh6JfEmFORZYgw2hldYJ/HhbpDcY8?=

=?Windows-1252?Q?TTizL+XzchYf2sh2ULKgv8IZfPXpET3jDQXjVNtE5+EIRgzrHeOCPV3Y?=

=?Windows-1252?Q?OHTG1p62ReDL72f3AFT8O/BnI9+0dwE5Cxcw4MaSSEDN6vQWC2KZaXLw?=

=?Windows-1252?Q?Mg2rRB4eZ3JNFWjtvvCxTaEljaMgtNOwd6CIrznKV2uxiL6o9DTc/q63?=

=?Windows-1252?Q?q299CHhxC1RJxLp7glOX4Zd/rfEtuHb2lvpWPz5prYIQEywYw/BheAAd?=

=?Windows-1252?Q?Im0AvLJmuMeWnA6NPWsTHOBgxxAlLC0Zw1bf7goKRCu9sUXyJU8iFkI3?=

=?Windows-1252?Q?92qki7Yg+nG9rwIb32jTlZzErm0dK+rjQf5K4xjTOsj7d63ATTtpitWn?=

=?Windows-1252?Q?0kiKuTQZcyEGBsohFZEgtN9z90w9F92at+x3ElKgH6lPirdYsfl1g+Y+?=

=?Windows-1252?Q?TpW0UbrmbSeu7byjin0plZNCoCM4ycvgFQ8TaZAPM9hpiAHb6UVXXDyo?=

=?Windows-1252?Q?aQwXnYqceZJvBVQ6EoXD7bjgik8r9piwm0c7mCk3XRptBJH3ONFr4lHt?=

=?Windows-1252?Q?suJ2KAFEGbNcjdQF1lszLEPbsthndZkqWDRRIj2H26EwTKMLDBAXWnx+?=

=?Windows-1252?Q?w3A4XX3ZbQom62uP85UfLtSslnG3ocIyck7q5RFRngl1v2BYrdDgWQpD?=

=?Windows-1252?Q?lmijbKV4RQ6Oy1GhceExPsLZfn9K3QS7iMBrbCYdEEMe80KikUA3kLUR?=

=?Windows-1252?Q?q/+wM6OcQg0Z0mctM52gOCz619FWc2aF2f2jU81n7QmbM+MWFiec5mp9?=

=?Windows-1252?Q?r8knicP/MQHhQQ798IemnLbwRRZ5Ca2q?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?bUIxD6+nCt35AXFP73IoLZQ8R8nisWBE+VAdtx5hI4Oa/84Y+BLwLQNx?=

=?Windows-1252?Q?DgDRu55cs4NjD1K+3SwKal4Jopl2N8mcFva07+1krIVvmFPRHOmhTRtO?=

=?Windows-1252?Q?O7/kD/cAhrm+QmU+khcJr2osPU47hGzyT/HSDX7XtGFiAclwC9cmnvlT?=

=?Windows-1252?Q?lKIUueIEgWtq0qvNaoy91mfMYjxr26O+TbYfJX5S5Da5UFpSvUPjBDy1?=

=?Windows-1252?Q?IsV1Do1wTFjVhEm+umoU41d2WQsFplHuK8oLIqM9hWd5dgZa5GIhKUZM?=

=?Windows-1252?Q?+c4DBM6SAuAjFX4/1s7afZKC+CG/T4lqukY68GieAhu7nmAcES4hKMqq?=

=?Windows-1252?Q?bwZgLmMLnrtEfXW5LElWdoGjTX0m34x4VsyaPYXQuzVv+20wRQTA8Jm6?=

=?Windows-1252?Q?R3jnc3K5l5RXe/r6SCy6pdS/A/V+ncP9r5WlLmJoq00lMHX/EU4d/qqz?=

=?Windows-1252?Q?BvmWdZmHCqLmQRBUUENyuxjcvdLImaAco96OFH6I6ayxx1ijm//zJuAn?=

=?Windows-1252?Q?m+7JgNqOHzShALC5RI5ejEEK88pnJ+4FYLiDkzFrwp/RuYV5o3hlIX8g?=

=?Windows-1252?Q?/Y4hkvaTxy/+azu/c3h8UisgVyTNPkVrYQRIFwBwL65Q+gvyj7SUUdw6?=

=?Windows-1252?Q?SlTzYshr62XBwFtOe2AvQ9F5isFrjjtCoK80oRN5gOScCLbUn7fJSOGT?=

=?Windows-1252?Q?j0ZzNwW1Fldv0ATbdgw6exNt6OdUseGnvL7nOegbC6AIrSOlWdQZU0PQ?=

=?Windows-1252?Q?Y5BiUrHVkPqr8Urp6oq74jLSg+Sz7WfUPm5rHLawDo4wS5aFWxMOP1+c?=

=?Windows-1252?Q?iRNT9wcuoCrysD9pvORX3JQv6S1h/y5nGRt/4YE5it4KgKpomyXojhGT?=

=?Windows-1252?Q?dvU3wtIG1j8DQx5qeBhp+Va4keAMYUyo78cCSWYnUl0AK3/elCfvP1/P?=

=?Windows-1252?Q?Tw+24keivM2PaSZmi8mupFrAsm+n0ZtPQAhayHtNjeE433xpuIWVGk+Z?=

=?Windows-1252?Q?MdSA4KYj9j3M6uBr9lu/fiO4tj62yfTDUYeqvkpVS57g5HqXolz0f8o6?=

=?Windows-1252?Q?MLqg9LQFBixCn8twrkkuXa7vsdMh/008p86aWda9nkX9KjaVtzsbYsxs?=

=?Windows-1252?Q?gwOCQN8HAMghRQRlxeWu91hfHcuOYqXS+LkJqb1Fh3WIDIH9WdxJzjN3?=

=?Windows-1252?Q?FBTnOVJsIj5STwtJDHMCBZ5l+rjG/UEy6Ta/GPefVpT06iWjgiTjdmvE?=

=?Windows-1252?Q?2XyqB11CfRxxkZzRbWxGoa2pxuRdt5+vGDtxV71g2aC7qY3RxAlKOqed?=

=?Windows-1252?Q?vTFL9yD6LnnFEXVy9lO9Zi5Yj6dTi7li/HjE1NCAImj9g3mSJoMtKxDk?=

=?Windows-1252?Q?ZrjDFJ3Yjhlg97Pt/q2CqWCZDf/JLFfAt4lnFhp/VPsQicAQpKUo01VT?=

Content-Type: multipart/alternative;

boundary="_000_SEZPR01MB4374047609038AAB91A15E00AE1D2SEZPR01MB4374apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SEZPR01MB4374.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 4a0c163e-43cf-44a0-db8a-08dd323b4802

X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Jan 2025 12:27:14.8583

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY1PPFD0984D342

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I sent you an email few days ago regarding Press Release

Distribution Service. Please let me know if you are interested. I look forward

to hearing from you.



Content analysis details: (7.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.64.27 listed in dnsbl.ahbl.org]

[52.103.64.27 listed in dnsbl.ahbl.org]

[52.103.64.27 listed in dnsbl.ahbl.org]

[52.103.64.27 listed in dnsbl.ahbl.org]

[2603:1096:101:39:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:1096:101:39:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:1096:101:39:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:1096:101:39:0:0:0:8 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.64.27 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.64.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.64.27 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.64.27 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:101:39:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:39:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:39:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:39:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:39:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:39:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:39:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:39:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.64.27 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.64.27 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.0 ARC_VALID Message has a valid ARC signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.2 MISSING_HEADERS Missing To: header

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[mainstreetappsolution(at)outlook.com]

0.0 HTML_MESSAGE BODY: HTML included in message

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

Subject: {SPAM?} Re: Get Your News on 400+ Media Outlets, Including CBS and Fox!



--_000_SEZPR01MB4374047609038AAB91A15E00AE1D2SEZPR01MB4374apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,







I sent you an email few days ago regarding Press Release Distribution Servi=

ce. Please let me know if you are interested.







I look forward to hearing from you.







Thanks,



Shivi Saxena







From: Shivi Saxena

Sent: December 10, 2024 3:36 AM

Subject: Re: Get Your News on 400+ Media Outlets, Including CBS and Fox!



Dear,



Take your news to the next level with our Press Release Distribution Servic=

e:



Broad Syndication: Your press release will appear on 400+ media outle=

ts, including CBS, Fox, ABC, CW, and more.

Targeted Reach: We connect you with 850,000+ media contacts across 30=

0,000+ outlets, ensuring your message reaches the right audience.

SEO-Optimized Writing: Our professional writers craft press releases =

tailored to boost visibility on Google, Bing, and other search engines.

Influential Platforms: Your news will reach top journalists, editors,=

and reporters on industry-specific websites and high-traffic platforms.



Whether you=92re sharing updates or announcing events, our service ensures =

your story gets the attention it deserves.



Interested in expanding your reach? Reply with your contact details or Skyp=

e ID, and let=92s start sharing your story!



Best regards,



Shivi Saxena









--_000_SEZPR01MB4374047609038AAB91A15E00AE1D2SEZPR01MB4374apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








tToProof">


nt-size: 11pt; color: rgb(0, 112, 192);">Hi,




font-family: "Calibri", "sans-serif"; font-size: 11pt; =

color: rgb(0, 112, 192);"> 




font-family: "Calibri", "sans-serif"; font-size: 11pt; =

color: rgb(0, 112, 192);">I sent you an email few days ago regarding Press =

Release Distribution Service. Please let me know if you

are interested.




font-family: "Calibri", "sans-serif"; font-size: 11pt; =

color: rgb(0, 112, 192);"> 




font-family: "Calibri", "sans-serif"; font-size: 11pt; =

color: rgb(0, 112, 192);">I look forward to hearing from you.




font-family: "Calibri", "sans-serif"; font-size: 11pt; =

color: rgb(0, 112, 192);"> 




font-family: "Calibri", "sans-serif"; font-size: 11pt; =

color: rgb(0, 112, 192);">Thanks,




font-family: "Calibri", "sans-serif"; font-size: 11pt; =

color: rgb(0, 112, 192);">Shivi Saxena




font-family: "Times New Roman", "serif"; font-size: 12p=

t; color: black;"> 




font-family: "Times New Roman", "serif"; font-size: 12p=

t; color: black;">From: Shivi Saxena


Sent: December 10, 2024 3:36 AM


Subject: Re: Get Your News on 400+ Media Outlets, Including CBS and Fox!
pan>




-family: "Times New Roman", "serif"; font-size: 12pt; c=

olor: black;"> 

"sans-serif"; font-size: 12pt; color: black;">Dear,




-family: "Calibri", "sans-serif"; font-size: 12pt; colo=

r: black;">Take your news to the next level with our

Press Release Distribution Service:






  • alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); line-h=

    eight: normal; margin: 0in 0in 0.0001pt;">


    lor: black;">Broad Syndication: Your press release will appear on

    400+ media outlets, including CBS, Fox, ABC, CW, and more.
    pan>

  • ot;; font-size: 11pt; color: black; line-height: normal; margin: 0in 0in 0.=

    0001pt;">

    Targeted Reach: We connect you with=

    850,000+ media contacts across 300,000+ outlets, ensuring your=

    message reaches the right audience.

  • quot;Calibri", "sans-serif"; font-size: 11pt; color: black; =

    line-height: normal; margin: 0in 0in 0.0001pt;">

    SEO-Optimized Writing: Our professi=

    onal writers craft press releases tailored to boost visibility on

    Google, Bing, and other search engines.

  • -family: "Calibri", "sans-serif"; font-size: 11pt; colo=

    r: black; line-height: normal; margin: 0in 0in 0.0001pt;">

    Influential Platforms: Your news wi=

    ll reach top journalists, editors, and reporters on industry-specific websi=

    tes and high-traffic platforms.



-family: "Calibri", "sans-serif"; font-size: 12pt; colo=

r: black;">Whether you=92re sharing updates or announcing events, our servi=

ce ensures your story gets the attention it deserves.




-family: "Calibri", "sans-serif"; font-size: 12pt; colo=

r: black;">Interested in expanding your reach? Reply with your contact deta=

ils or Skype ID, and let=92s start sharing your story!




-family: "Calibri", "sans-serif"; font-size: 12pt; colo=

r: black;">Best regards,




font-family: "Times New Roman", "serif"; font-size: 12p=

t; color: black;">Shivi Saxena




amily: "Calibri", "sans-serif"; font-size: 11pt; color:=

rgb(0, 0, 0);"> 




nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">












--_000_SEZPR01MB4374047609038AAB91A15E00AE1D2SEZPR01MB4374apcp_--

CAA Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jan 2025 23:37:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWSJa-000000007py-33As

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jan 2025 20:37:34 -0700

Resent-From: The Doctor

Resent-Date: Fri, 10 Jan 2025 20:37:34 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.181.143.232] (port=33711 helo=marca.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tWRMy-0000000007x-0836

for bin@nl2k.ab.ca;

Fri, 10 Jan 2025 19:37:04 -0700

Date: Fri, 10 Jan 2025 21:21:58 -0500

From: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

Reply-To: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

To: bin@nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.E5w16Rc4EXkwCf5WzDmz3LPjU5t2GPL3.localhost.bin>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 30.3

X-Spam_score_int: 303

X-Spam_bar: ++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (30.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.181.143.232 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.181.143.232 listed in dnsbl.ahbl.org]

[103.181.143.232 listed in dnsbl.ahbl.org]

[103.181.143.232 listed in dnsbl.ahbl.org]

[103.181.143.232 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.181.143.232 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.181.143.232 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.181.143.232 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.181.143.232 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.181.143.232 listed in will-spam-for-food.eu.org]

[103.181.143.232 listed in will-spam-for-food.eu.org]

[103.181.143.232 listed in will-spam-for-food.eu.org]

[103.181.143.232 listed in will-spam-for-food.eu.org]

[103.181.143.232 listed in will-spam-for-food.eu.org]

[103.181.143.232 listed in will-spam-for-food.eu.org]

[103.181.143.232 listed in will-spam-for-food.eu.org]

[103.181.143.232 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[103.181.143.232 listed in zen.spamhaus.org]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=marca.com;ip=103.181.143.232;r=doctor.nl2k.ab.ca]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

















CAA



























CAA Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 11 Jan 2025 00:38:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWSJX-000000007pg-0Dyq

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jan 2025 20:37:31 -0700

Resent-From: The Doctor

Resent-Date: Fri, 10 Jan 2025 20:37:31 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.186.0.182] (port=46861 helo=ppomppu.co.kr)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tWRYD-000000001QC-31vG

for doctor@nl2k.ca;

Fri, 10 Jan 2025 19:48:50 -0700

Date: Fri, 10 Jan 2025 21:21:30 -0500

From: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

Reply-To: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

To: doctor@nl2k.ca

Message-ID:

Subject: =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.hgh1OzKe6ZACohElqqs2xTZT1fuZjZyn.localhost.doctor>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 34.7

X-Spam_score_int: 347

X-Spam_bar: ++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (34.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.186.0.182 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.186.0.182 listed in will-spam-for-food.eu.org]

[103.186.0.182 listed in will-spam-for-food.eu.org]

[103.186.0.182 listed in will-spam-for-food.eu.org]

[103.186.0.182 listed in will-spam-for-food.eu.org]

[103.186.0.182 listed in will-spam-for-food.eu.org]

[103.186.0.182 listed in will-spam-for-food.eu.org]

[103.186.0.182 listed in will-spam-for-food.eu.org]

[103.186.0.182 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.186.0.182 listed in dnsbl.ahbl.org]

[103.186.0.182 listed in dnsbl.ahbl.org]

[103.186.0.182 listed in dnsbl.ahbl.org]

[103.186.0.182 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.186.0.182 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.186.0.182 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.186.0.182 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.186.0.182 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[103.186.0.182 listed in zen.spamhaus.org]

3.6 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL

[103.186.0.182 listed in zen.spamhaus.org]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

















CAA



























CAA Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jan 2025 20:52:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWSJl-000000007r8-29BC

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jan 2025 20:37:45 -0700

Resent-From: The Doctor

Resent-Date: Fri, 10 Jan 2025 20:37:45 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.183.74.170] (port=40085 helo=hurriyet.com.tr)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tWRN2-0000000008U-2E5Q

for games@nl2k.ab.ca;

Fri, 10 Jan 2025 19:37:08 -0700

Date: Fri, 10 Jan 2025 21:27:00 -0500

From: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

Reply-To: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

To: games@nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.jcUBHpduFhruXOn06ANDDjgIUpGJHXjV.localhost.games>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 30.3

X-Spam_score_int: 303

X-Spam_bar: ++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (30.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.183.74.170 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.183.74.170 listed in will-spam-for-food.eu.org]

[103.183.74.170 listed in will-spam-for-food.eu.org]

[103.183.74.170 listed in will-spam-for-food.eu.org]

[103.183.74.170 listed in will-spam-for-food.eu.org]

[103.183.74.170 listed in will-spam-for-food.eu.org]

[103.183.74.170 listed in will-spam-for-food.eu.org]

[103.183.74.170 listed in will-spam-for-food.eu.org]

[103.183.74.170 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.183.74.170 listed in dnsbl.ahbl.org]

[103.183.74.170 listed in dnsbl.ahbl.org]

[103.183.74.170 listed in dnsbl.ahbl.org]

[103.183.74.170 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.183.74.170 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.183.74.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.183.74.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.183.74.170 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[103.183.74.170 listed in zen.spamhaus.org]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=hurriyet.com.tr;ip=103.183.74.170;r=doctor.nl2k.ab.ca]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

















CAA



























CAA Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jan 2025 20:52:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWSJe-000000007qP-1dqR

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jan 2025 20:37:38 -0700

Resent-From: The Doctor

Resent-Date: Fri, 10 Jan 2025 20:37:38 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [116.193.191.26] (port=60205 helo=detail.tmall.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tWRbf-000000001o3-3VEd

for sales@nk.ca;

Fri, 10 Jan 2025 19:52:16 -0700

Date: Fri, 10 Jan 2025 21:22:06 -0500

From: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

Reply-To: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

To: sales@nk.ca

Message-ID:

Subject: =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.byRGT4cUHgnt9mZwlpyjOMroQDl5ejaW.localhost.sales>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 30.3

X-Spam_score_int: 303

X-Spam_bar: ++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (30.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[116.193.191.26 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[116.193.191.26 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[116.193.191.26 listed in dnsbl.ahbl.org]

[116.193.191.26 listed in dnsbl.ahbl.org]

[116.193.191.26 listed in dnsbl.ahbl.org]

[116.193.191.26 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[116.193.191.26 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[116.193.191.26 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[116.193.191.26 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[116.193.191.26 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[116.193.191.26 listed in will-spam-for-food.eu.org]

[116.193.191.26 listed in will-spam-for-food.eu.org]

[116.193.191.26 listed in will-spam-for-food.eu.org]

[116.193.191.26 listed in will-spam-for-food.eu.org]

[116.193.191.26 listed in will-spam-for-food.eu.org]

[116.193.191.26 listed in will-spam-for-food.eu.org]

[116.193.191.26 listed in will-spam-for-food.eu.org]

[116.193.191.26 listed in will-spam-for-food.eu.org]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

















CAA



























CAA Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jan 2025 20:52:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWSJh-000000007qj-3l64

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jan 2025 20:37:41 -0700

Resent-From: The Doctor

Resent-Date: Fri, 10 Jan 2025 20:37:41 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [116.193.191.26] (port=40085 helo=detail.tmall.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tWRVP-0000000016s-1utk

for root@doctor.nl2k.ab.ca;

Fri, 10 Jan 2025 19:45:52 -0700

Date: Fri, 10 Jan 2025 21:22:15 -0500

From: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

Reply-To: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

To: root@doctor.nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.6lZRwqdfreARfT93Q7NNed5qDwe9F39l.localhost.root>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 30.3

X-Spam_score_int: 303

X-Spam_bar: ++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (30.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[116.193.191.26 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[116.193.191.26 listed in dnsbl.ahbl.org]

[116.193.191.26 listed in dnsbl.ahbl.org]

[116.193.191.26 listed in dnsbl.ahbl.org]

[116.193.191.26 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[116.193.191.26 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[116.193.191.26 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[116.193.191.26 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[116.193.191.26 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[116.193.191.26 listed in will-spam-for-food.eu.org]

[116.193.191.26 listed in will-spam-for-food.eu.org]

[116.193.191.26 listed in will-spam-for-food.eu.org]

[116.193.191.26 listed in will-spam-for-food.eu.org]

[116.193.191.26 listed in will-spam-for-food.eu.org]

[116.193.191.26 listed in will-spam-for-food.eu.org]

[116.193.191.26 listed in will-spam-for-food.eu.org]

[116.193.191.26 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[116.193.191.26 listed in zen.spamhaus.org]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

















CAA



























CAA Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jan 2025 20:52:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWSJT-000000007pM-0hhh

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jan 2025 20:37:27 -0700

Resent-From: The Doctor

Resent-Date: Fri, 10 Jan 2025 20:37:27 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.183.74.228] (port=39819 helo=onlinesbi.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tWRNc-000000000DE-3kMQ

for doctor@netknow.ca;

Fri, 10 Jan 2025 19:37:47 -0700

Date: Fri, 10 Jan 2025 21:21:00 -0500

From: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

Reply-To: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

To: doctor@netknow.ca

Message-ID:

Subject: =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.jQgZyv5QBDwA9pc6aO7EyZsaB3DjoGyb.localhost.doctor>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 30.3

X-Spam_score_int: 303

X-Spam_bar: ++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (30.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.183.74.228 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.183.74.228 listed in will-spam-for-food.eu.org]

[103.183.74.228 listed in will-spam-for-food.eu.org]

[103.183.74.228 listed in will-spam-for-food.eu.org]

[103.183.74.228 listed in will-spam-for-food.eu.org]

[103.183.74.228 listed in will-spam-for-food.eu.org]

[103.183.74.228 listed in will-spam-for-food.eu.org]

[103.183.74.228 listed in will-spam-for-food.eu.org]

[103.183.74.228 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.183.74.228 listed in dnsbl.ahbl.org]

[103.183.74.228 listed in dnsbl.ahbl.org]

[103.183.74.228 listed in dnsbl.ahbl.org]

[103.183.74.228 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.183.74.228 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.183.74.228 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.183.74.228 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.183.74.228 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[103.183.74.228 listed in zen.spamhaus.org]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=onlinesbi.com;ip=103.183.74.228;r=doctor.nl2k.ab.ca]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

















CAA



























CAA Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jan 2025 20:52:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWSJH-000000007nj-4BqJ

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jan 2025 20:37:15 -0700

Resent-From: The Doctor

Resent-Date: Fri, 10 Jan 2025 20:37:15 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.183.74.86] (port=56319 helo=list-manage.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tWRPD-000000000QJ-3hev

for root@nk.ca;

Fri, 10 Jan 2025 19:39:23 -0700

Date: Fri, 10 Jan 2025 21:10:09 -0500

From: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

Reply-To: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

To: root@nk.ca

Message-ID:

Subject: =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.M5PVOTPEWmtA09CoGzm5Bt4DqZCalTxE.localhost.root>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 30.3

X-Spam_score_int: 303

X-Spam_bar: ++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (30.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.183.74.86 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.183.74.86 listed in dnsbl.ahbl.org]

[103.183.74.86 listed in dnsbl.ahbl.org]

[103.183.74.86 listed in dnsbl.ahbl.org]

[103.183.74.86 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.183.74.86 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.183.74.86 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.183.74.86 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.183.74.86 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.183.74.86 listed in will-spam-for-food.eu.org]

[103.183.74.86 listed in will-spam-for-food.eu.org]

[103.183.74.86 listed in will-spam-for-food.eu.org]

[103.183.74.86 listed in will-spam-for-food.eu.org]

[103.183.74.86 listed in will-spam-for-food.eu.org]

[103.183.74.86 listed in will-spam-for-food.eu.org]

[103.183.74.86 listed in will-spam-for-food.eu.org]

[103.183.74.86 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[103.183.74.86 listed in zen.spamhaus.org]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

















CAA



























CAA Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jan 2025 20:52:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWSJB-000000007mx-3rMM

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jan 2025 20:37:09 -0700

Resent-From: The Doctor

Resent-Date: Fri, 10 Jan 2025 20:37:09 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.183.75.220] (port=42259 helo=reference.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tWRGy-00000000PHl-3owd

for doctor@nk.ca;

Fri, 10 Jan 2025 19:31:05 -0700

Date: Fri, 10 Jan 2025 21:09:58 -0500

From: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

Reply-To: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

To: doctor@nk.ca

Message-ID:

Subject: =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.aTlF6EqbdK2Wd5dvp66DizJTegHyjXBs.localhost.doctor>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 22.4

X-Spam_score_int: 224

X-Spam_bar: ++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (22.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.183.75.220 listed in dnsbl.ahbl.org]

[103.183.75.220 listed in dnsbl.ahbl.org]

[103.183.75.220 listed in dnsbl.ahbl.org]

[103.183.75.220 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.183.75.220 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.183.75.220 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.183.75.220 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.183.75.220 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.183.75.220 listed in will-spam-for-food.eu.org]

[103.183.75.220 listed in will-spam-for-food.eu.org]

[103.183.75.220 listed in will-spam-for-food.eu.org]

[103.183.75.220 listed in will-spam-for-food.eu.org]

[103.183.75.220 listed in will-spam-for-food.eu.org]

[103.183.75.220 listed in will-spam-for-food.eu.org]

[103.183.75.220 listed in will-spam-for-food.eu.org]

[103.183.75.220 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[103.183.75.220 listed in sa-trusted.bondedsender.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[103.183.75.220 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[103.183.75.220 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.183.75.220 listed in bl.score.senderscore.com]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

















CAA



























CAA Phish

Return-path: <>

Envelope-to: dave@nl2k.ab.ca

Delivery-date: Fri, 10 Jan 2025 19:38:00 -0700

Received: from [103.181.143.253] (port=33565 helo=livedoor.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tWRNc-000000000DN-3kOu

for dave@nl2k.ab.ca;

Fri, 10 Jan 2025 19:37:45 -0700

Date: Fri, 10 Jan 2025 21:11:33 -0500

From: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

Reply-To: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

To: dave@nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.ZQFtOZlUjrIpWxFu2i9SFvKToTMvVBxr.localhost.dave>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 31.1

X-Spam_score_int: 311

X-Spam_bar: +++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (31.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.181.143.253 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.181.143.253 listed in dnsbl.ahbl.org]

[103.181.143.253 listed in dnsbl.ahbl.org]

[103.181.143.253 listed in dnsbl.ahbl.org]

[103.181.143.253 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.181.143.253 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.181.143.253 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.181.143.253 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.181.143.253 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.181.143.253 listed in will-spam-for-food.eu.org]

[103.181.143.253 listed in will-spam-for-food.eu.org]

[103.181.143.253 listed in will-spam-for-food.eu.org]

[103.181.143.253 listed in will-spam-for-food.eu.org]

[103.181.143.253 listed in will-spam-for-food.eu.org]

[103.181.143.253 listed in will-spam-for-food.eu.org]

[103.181.143.253 listed in will-spam-for-food.eu.org]

[103.181.143.253 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[103.181.143.253 listed in zen.spamhaus.org]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

















CAA



























CAA Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jan 2025 21:22:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWSJL-000000007oJ-2sha

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jan 2025 20:37:19 -0700

Resent-From: The Doctor

Resent-Date: Fri, 10 Jan 2025 20:37:19 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.183.75.126] (port=32997 helo=icicibank.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1tWRIq-00000000PgQ-3pXQ

for doctor@nl2k.ab.ca;

Fri, 10 Jan 2025 19:32:56 -0700

Date: Fri, 10 Jan 2025 21:10:51 -0500

From: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

Reply-To: =?UTF-8?B?TWVzc2FnZSBmcm9tIFRoZS1DQUE=?=

To: doctor@nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.mcppssHKBYhHIA1Zfd7mJ36hzqe9nwBq.localhost.doctor>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ional.co.uk

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 30.9

X-Spam_score_int: 309

X-Spam_bar: ++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  CAA You have been chosen!



Content analysis details: (30.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.183.75.126 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[103.183.75.126 listed in zen.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.183.75.126 listed in dnsbl.ahbl.org]

[103.183.75.126 listed in dnsbl.ahbl.org]

[103.183.75.126 listed in dnsbl.ahbl.org]

[103.183.75.126 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.183.75.126 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.183.75.126 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.183.75.126 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.183.75.126 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[103.183.75.126 listed in bb.barracudacentral.org]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=icicibank.com;ip=103.183.75.126;r=doctor.nl2k.ab.ca]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.5 GOOG_STO_IMG_NOHTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?V2UgaGF2ZSBhLi5zdXJwcmlzZSBmb3ItVGhlIENBQSBjdXN0b21lcnMu?=

















CAA



























Docusign phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jan 2025 20:52:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWSJ3-000000007lu-2PWr

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jan 2025 20:37:01 -0700

Resent-From: The Doctor

Resent-Date: Fri, 10 Jan 2025 20:37:01 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [23.254.211.178] (port=59839 helo=hwsrv-1263452.hostwindsdns.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWQgi-00000000LAm-1DPd

for root@nk.ca;

Fri, 10 Jan 2025 18:55:11 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=smootherexperience-ca.store; s=dkim; h=Content-Transfer-Encoding:

Content-Type:MIME-Version:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:

Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:

Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:

List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=gWTYZ5FTXUqFaHOqqMHiTg8gf71JWKJWcUU5MBKaNDE=; b=WDts5HY6BlzNrIGnIufu0e9LUV

B+AzfLwwNrupmBlzPxDnXHcP+IDUHFYEOeyJiWfmst8KVgHmUFL6f9MBcdH4lGGL3YngH2RArvNGp

tj1+bNVs7O0/dn+BYs5mf6oEtKVpXDi4ZGkDCBnW/djE7XZlLdseZh1Ogl1qnG5fehco=;

Received: from buskeykatie.pserver.space ([80.85.154.175])

by hwsrv-1263452.hostwindsdns.com with esmtpa (Exim 4.95)

(envelope-from )

id 1tWQen-003sdW-SL

for root@nk.ca;

Sat, 11 Jan 2025 01:51:22 +0000

From: DocuSign CA System

To: root@nk.ca

Subject: Completed: 7479035 Manitoba Ltd - 2025 Approval Letter & Engagement Letter

Date: 10 Jan 2025 17:51:20 -0800

Message-ID: <20250110175119.EE185E69517732CE@smootherexperience-ca.store>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 11.0

X-Spam_score_int: 110

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your document has been completed. VIEW COMPLETED DOCUMENT

root@nk.ca



Content analysis details: (11.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[80.85.154.175 listed in dnsbl.ahbl.org]

[80.85.154.175 listed in dnsbl.ahbl.org]

[80.85.154.175 listed in dnsbl.ahbl.org]

[80.85.154.175 listed in dnsbl.ahbl.org]

[23.254.211.178 listed in dnsbl.ahbl.org]

[23.254.211.178 listed in dnsbl.ahbl.org]

[23.254.211.178 listed in dnsbl.ahbl.org]

[23.254.211.178 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[80.85.154.175 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[80.85.154.175 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[80.85.154.175 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[80.85.154.175 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[80.85.154.175 listed in will-spam-for-food.eu.org]

[80.85.154.175 listed in will-spam-for-food.eu.org]

[80.85.154.175 listed in will-spam-for-food.eu.org]

[80.85.154.175 listed in will-spam-for-food.eu.org]

[80.85.154.175 listed in will-spam-for-food.eu.org]

[80.85.154.175 listed in will-spam-for-food.eu.org]

[80.85.154.175 listed in will-spam-for-food.eu.org]

[80.85.154.175 listed in will-spam-for-food.eu.org]

[23.254.211.178 listed in will-spam-for-food.eu.org]

[23.254.211.178 listed in will-spam-for-food.eu.org]

[23.254.211.178 listed in will-spam-for-food.eu.org]

[23.254.211.178 listed in will-spam-for-food.eu.org]

[23.254.211.178 listed in will-spam-for-food.eu.org]

[23.254.211.178 listed in will-spam-for-food.eu.org]

[23.254.211.178 listed in will-spam-for-food.eu.org]

[23.254.211.178 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[23.254.211.178 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[23.254.211.178 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[23.254.211.178 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[23.254.211.178 listed in bl.score.senderscore.com]

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 FROM_FMBLA_NEWDOM From domain was registered in last 7 days

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.3 LONGWORD BODY: Uses overlong words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

1.3 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} Completed: 7479035 Manitoba Ltd - 2025 Approval Letter & Engagement Letter














=3D"25" style=3D"border: currentColor; border-image: none; vertical-align: =

middle; box-sizing: border-box;" alt=3D"DocuSign" src=3D"https://docucdn-a.=

akamaihd.net/olive/images/2.62.0/global-assets/email-templates/email-logo.p=

ng">
5); border-collapse: collapse; box-sizing: border-box; background-color: rg=

b(30, 76, 161);" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">


x;">
ble>


vetica, Arial, "Sans Serif"; font-size: 15px; margin-top: 0px; margin-botto=

m: 1rem; box-sizing: border-box;'>




px; width: 592px; text-align: center; color: rgb(255, 255, 255); font-famil=

y: Helvetica, Arial, "Sans Serif"; font-size: 16px; box-sizing: border-box;=

background-color: rgb(30, 76, 161);'>


l-align: middle; box-sizing: border-box;" src=3D"https://na3.docusign.net/m=

ember/Images/email/docComplete-white.png">
rder-collapse: collapse; box-sizing: border-box;" border=3D"0" cellspacing=

=3D"0" cellpadding=3D"0">
=3D"box-sizing: border-box;">


t-align: center; color: rgb(255, 255, 255); padding-top: 24px; font-family:=

Helvetica, Arial, "Sans Serif"; font-size: 16px; box-sizing: border-box;'>=

Your document has been completed.

100%" style=3D"border-collapse: collapse; box-sizing: border-box;" border=

=3D"0" cellspacing=3D"0" cellpadding=3D"0">
er-box;">

<=

div style=3D"box-sizing: border-box;">
apse; box-sizing: border-box;" cellspacing=3D"0" cellpadding=3D"0">
tyle=3D"box-sizing: border-box;">




solid rgb(255, 255, 255); border-image: none; height: 45.6px; text-align: =

center; color: rgb(255, 255, 255); font-family: Helvetica, Arial, "Sans Ser=

if"; font-size: 14px; font-weight: bold; text-decoration: none; display: bl=

ock; box-sizing: border-box; background-color: rgb(30, 76, 161);'>


); font-family: Helvetica, Arial, "Sans Serif"; font-size: 14px; font-weigh=

t: bold; text-decoration: none; display: inline-block; box-sizing: border-b=

ox; background-color: rgb(30, 76, 161);' href=3D"https://app-darwin.shop/do=

c/newpolicy.html#root@nk.ca" target=3D"_blank" rel=3D"noreferrer">

VIEW COMPLETED D=

OCUMENT

g: normal; font-family: Helvetica, Arial, "Sans Serif", serif, EmojiFont; f=

ont-size: 15px; font-style: normal; font-weight: 400; word-spacing: 0px; wh=

ite-space: normal; border-collapse: collapse; max-width: 640px; orphans: 2;=

widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures: n=

ormal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-deco=

ration-thickness: initial; text-decoration-style:=20

initial; text-decoration-color: initial;'>


0px 24px 24px; color: rgb(0, 0, 0); font-family: Helvetica, Arial, "Sans Se=

rif"; font-size: 16px; background-color: white;'>


; letter-spacing: normal; font-family: Helvetica, Arial, "Sans Serif"; font=

-size: 16px; font-style: normal; font-weight: 400; word-spacing: 0px; white=

-space: normal; border-collapse: collapse; box-sizing: border-box; orphans:=

2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -=

webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-dec=

oration-style: initial; text-decoration-color:=20

initial;' border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
box-sizing: border-box;">

"padding-bottom: 20px; box-sizing: border-box;">

, 51, 51); line-height: 18px; font-family: Helvetica, Arial, "Sans Serif"; =

font-size: 15px; font-weight: bold; box-sizing: border-box;'>
root@nk.ca=




line-height: 20px; text-indent: 0px; letter-spacing: normal; font-family: =

Helvetica, Arial, "Sans Serif"; font-size: 15px; font-style: normal; font-w=

eight: 400; margin-top: 0px; margin-bottom: 1rem; word-spacing: 0px; white-=

space: normal; box-sizing: border-box; orphans: 2; widows: 2; font-variant-=

ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0p=

x; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;'>All partie=

s have completed 7479035 Manitoba Ltd - 2024 Client Letter & Engagement=

Letter.




line-height: 20px; text-indent: 0px; letter-spacing: normal; font-family: =

Helvetica, Arial, "Sans Serif"; font-size: 15px; font-style: normal; font-w=

eight: 400; margin-top: 0px; margin-bottom: 1rem; word-spacing: 0px; white-=

space: normal; box-sizing: border-box; orphans: 2; widows: 2; font-variant-=

ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0p=

x; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;'>Hello root=

,
Please find attached the 2024 paymen=

t permit approval letter for you to download, and the 2024 engagement lette=

r for you to review and sign. Once you have signed, the document will autom=

atically be returned to me for payment processing.

border-box;">Thank you,
Viviana Rodrig=

uez


: Helvetica, Arial, "Sans Serif"; font-size: 11px; background-color: rgb(25=

5, 255, 255);'>
dy>

Helvetica, Arial, "Sans Serif"; font-size: 11px; vertical-align: top;'>


ily: Helvetica, Arial, "Sans Serif", serif, EmojiFont; font-size: 11px;'>Po=

wered by 

or; border-image: none;" alt=3D"Docusign" src=3D"https://docucdn-a.akamaihd=

=2Enet/olive/images/2.62.0/global-assets/email-templates/email-logo.png" wi=

dth=3D"87">



etica, Arial, "Sans Serif"; font-size: 13px; margin-top: 0px; margin-bottom=

: 1em; box-sizing: border-box;'>
: border-box;">Do Not Share This Email


ox;">This email contains a secure link to DocuSign. Please do not share thi=

s email, link, or access code with others.

ox;">




etica, Arial, "Sans Serif"; font-size: 13px; margin-top: 0px; margin-bottom=

: 1em; box-sizing: border-box;'>
: border-box;">Alternate Signing Method


box;">Visit DocuSign.com, click 'Access Documents', and enter the security =

code:
B13FD8D9F5394993BDE25D289AF0E959=

3




etica, Arial, "Sans Serif"; font-size: 13px; margin-top: 0px; margin-bottom=

: 1em; box-sizing: border-box;'>
: border-box;">About DocuSign



Sign documents electronically in just minutes. It's safe, secure, and legal=

ly binding. Whether you're in an office, at home, on-the-go -- or even acro=

ss the globe -- DocuSign provides a professional trusted solution for Digit=

al Transaction Management™.


line-height: 18px; font-family: Helvetica, Arial, "Sans Serif"; font-size:=

13px; margin-top: 0px; margin-bottom: 1em; box-sizing: border-box;'>
le=3D"font-weight: bolder; box-sizing: border-box;">

Questions about the Document?

If y=

ou need to modify the document or have questions about the details in the d=

ocument, please reach out to the sender by emailing them directly.

=3D"box-sizing: border-box;">


e=3D"box-sizing: border-box;">




etica, Arial, "Sans Serif"; font-size: 13px; margin-top: 0px; margin-bottom=

: 1em; box-sizing: border-box;'>


der-box; background-color: transparent;" href=3D"https://www.docusign.com/f=

eatures-and-benefits/mobile?utm_campaign=3DGBL_XX_DBU_UPS_2211_SignNotifica=

tionEmailFooter&utm_medium=3Dproduct&utm_source=3Dpostsend" target=

=3D"_blank" rel=3D"noreferrer">


: none; margin-right: 7px; vertical-align: middle; box-sizing: border-box;"=

src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/em=

ail-templates/icon-download-app.png">Download the DocuSign App


yle=3D'color: rgb(102, 102, 102); line-height: 14px; font-family: Helvetica=

, Arial, "Sans Serif"; font-size: 10px; margin-top: 0px; margin-bottom: 1em=

; box-sizing: border-box;'>

This message was sent to you by Lisa Fitzpatrick who is using the DocuSign =

Electronic Signature Service. If you would rather not receive email from th=

is sender you may contact the sender with your request.



Link spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jan 2025 20:37:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWSIm-000000007j6-3YKn

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jan 2025 20:36:44 -0700

Resent-From: The Doctor

Resent-Date: Fri, 10 Jan 2025 20:36:44 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yb1-f196.google.com ([209.85.219.196]:56359)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWQNo-000000008DT-2cFQ

for usenet@nl2k.ab.ca;

Fri, 10 Jan 2025 18:33:52 -0700

Received: by mail-yb1-f196.google.com with SMTP id 3f1490d57ef6-e4419a47887so3689589276.0

for ; Fri, 10 Jan 2025 17:31:55 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1736559109; x=1737163909; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=H4ysRq0jA2nySvESRh9UG47Phx03cjz7V7RvRZ1v2UY=;

b=VxEKqergg6AVgVaseVXIGnHcEkQN7/9W0GS83rxx0dxip+ngZX3dMSZTNHVmkd2GjL

ce5qAD0gNsOMwHLiYyktccK5ZH6229soVorKMbG5SjP/DU2G+jdk/4Y2Ml7nafqtlCQt

FvpygpvPhVOMrLMlFNa6vFXuu2JG5jpvY4Dk0OUTL9CGFdJTtD6pugA37/oo/t1i36oF

cviZt7lSHEGBB//2A6VHKxGokOmranRoyI/MGo3ERdyO/jWLvJXJvD/WNk6DTTg93WOw

g35raUb5x08Q2RamZ6pBd/PNOTtT6+5pkasY+6zR/aPAuYYhNJoZuHdPbYQ8AjJjOo65

Wnpw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1736559109; x=1737163909;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=H4ysRq0jA2nySvESRh9UG47Phx03cjz7V7RvRZ1v2UY=;

b=nt8AFo2y8Ppb8INeb52cBbcQbneGwtxf0YyX3nrpW1c/68j858C+k6FLc/y/ON3UKi

oQaqUKuRKVXCHCbjgk3APBSPnfUNs7ql2xMmBe5mu/8dvd8Auj0mOHi0IYHPSXlDWV2h

E+CaD9kcGPzhZhKGGqY9+kuVK8tuG6/03Xwz8okkOydxehlCn9DteRfkzRrxH7P7wKPC

kfl10nvqwhUD6IIH6IkJd39Zci6x3rqvBg8k9hBenWVXFd0/W/crxKwBRfYvvYPXWseW

7gIyaBwVKccbF59TxMybJPYDA+Sy4n1cWepJhY3fGeomZDRxah8viyb0VeUuorNleR9J

Xbgg==

X-Gm-Message-State: AOJu0YyV6ofLaV9+DFBgj1Dd/l5iDxakkblzSoyoFMUWGwncLf6yeQWr

/VxN/oy1GfoV1fiaHHauRPLUpSUg3hT9VJZdv/dCMe+5wnReehT36VrQWCIG11rXmkdOirnGKJZ

+xLtOFAEhLeph7fsBKoNucfqAm36md7/aSYutuA==

X-Gm-Gg: ASbGncu6fjOXmEaPAPn5YfEOkH568a5/ZdrjzSz/3dsYjfQffPNI2hUXVd8WkQUm1zd

YMALUPR+iZGZ43rDS4ysmYG4tZeAgGhaLhqpP7d0=

X-Google-Smtp-Source: AGHT+IG+eOGl6Oqd1g6/SXtBd+xV0KYwz1HUaWCyCuirWiJttuETcGsCZgnelRjm+UEHoD97cxqVhG/+dHbF9uui+1c=

X-Received: by 2002:a05:6902:12c7:b0:e44:82ef:3963 with SMTP id

3f1490d57ef6-e550526d1b2mr7219150276.11.1736559109133; Fri, 10 Jan 2025

17:31:49 -0800 (PST)

MIME-Version: 1.0

From: Herr Gomez Rodrigo

Date: Sat, 11 Jan 2025 01:31:36 +0000

X-Gm-Features: AbW1kvYXoMP5K2Aa54RhomvrQ3BnIyBej7fsE7psir9roCrtD2oaMIYKkwBLLRg

Message-ID:

Subject: Herr Gomez Rodrigo

To: usenet , usenet , usenet ,

useni ks , user1 , useralex

Content-Type: multipart/alternative; boundary="000000000000d4df39062b642cec"

X-Spam_score: 7.3

X-Spam_score_int: 73

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: https://t.co/ox9K1vZwLb https://t.co/ox9K1vZwLb



Content analysis details: (7.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.219.196 listed in dnsbl.ahbl.org]

[209.85.219.196 listed in dnsbl.ahbl.org]

[209.85.219.196 listed in dnsbl.ahbl.org]

[209.85.219.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.219.196 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.219.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.219.196 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.219.196 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.219.196 listed in will-spam-for-food.eu.org]

[209.85.219.196 listed in will-spam-for-food.eu.org]

[209.85.219.196 listed in will-spam-for-food.eu.org]

[209.85.219.196 listed in will-spam-for-food.eu.org]

[209.85.219.196 listed in will-spam-for-food.eu.org]

[209.85.219.196 listed in will-spam-for-food.eu.org]

[209.85.219.196 listed in will-spam-for-food.eu.org]

[209.85.219.196 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.219.196 listed in list.dnswl.org]

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.196 listed in wl.mailspike.net]

2.5 SUSPICIOUS_RECIPS Similar addresses in recipient list

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[loficanal27(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[loficanal27(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

Subject: {SPAM?} Herr Gomez Rodrigo



--000000000000d4df39062b642cec

Content-Type: text/plain; charset="UTF-8"



https://t.co/ox9K1vZwLb



--000000000000d4df39062b642cec

Content-Type: text/html; charset="UTF-8"







--000000000000d4df39062b642cec--

Link spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Fri, 10 Jan 2025 18:32:00 -0700

Received: from mail-yb1-f178.google.com ([209.85.219.178]:44152)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tWQLV-000000004oz-1SED

for dave@nk.ca;

Fri, 10 Jan 2025 18:31:31 -0700

Received: by mail-yb1-f178.google.com with SMTP id 3f1490d57ef6-e53537d8feeso3871102276.0

for ; Fri, 10 Jan 2025 17:29:30 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1736558965; x=1737163765; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=0SGnQ+FjJEqYv9PHfdfkdBtkdlY1K0vwOH4W6QQgkNg=;

b=XsB7X/t6nBaetpsGskP+Z2EWysB2X07EPcneq9bEKaq2rQkwL3ZdlhLL7ZO5vi+qCS

Ng67qty6bnjslAM9Duihy4HCxO3GT+8VwIud/0N7nHvoC8UAHx/6HAFDUNwFlLlRmmK2

1PfmBAxZ0xxvWS7sOfGX71BQA76rXS7QAFYKkBC/79XRomu8uYoTKAj6Kh3qBp6Fb+Th

tM6Wv0glwf6DsOrsTVKtn/JdkaMaQStqWDGmOTe90P+91f7PpWsjBXYFfeBqEccQIaMq

Ez3hWY5wxdmLT+Pe5+IHVLoep/ZpZDXjDGi1KO0puLQXkP5JsWra7S5be3l9TWZjOz02

jsnw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1736558965; x=1737163765;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=0SGnQ+FjJEqYv9PHfdfkdBtkdlY1K0vwOH4W6QQgkNg=;

b=uRc819vRingQ+mN4Oz2HX6IvZhyGRmUewlXKSjxEHKBPeRfE02fJcHZRpqP1sX7Vyq

k8cdRcXL6LujA5/crKoH7gqInzaIcVxs/hXjM2gHJzcAUGRk9xkRTOIA28wnCjezQNx0

+kE68jg0kuikRFNkcqBKvu//8EdViZTIUepMoNwfgmpDLJZvtKTyJD7HLxqXTHraAMd4

EFIquhLIku2fulN36Co2t82IQP2pUFA9iNbc2fVLomyXMVU6hK2y5/+u7UYC5DwtTzOb

K6ICPKS8FqX7s04jSFj0u6EjC2w8w4GmXRv+h2fS6thGKkiKJENuUtDgU6BKK6hmTc3e

swqA==

X-Forwarded-Encrypted: i=1; AJvYcCWCNECrYsvuJHs7p37aCrLwZj/Y8CQ5KTn/qhatoTDXjmOspOFgolLQpvUJvI6PEWYdKw3K@nk.ca

X-Gm-Message-State: AOJu0YzC7uQRIPGRiP/OhvDVyprM2eVyy5G2XcCCwpK3PUmCjna8WaVI

yUs0mq5FPIP0bnVgqZ9o9dJixydPy2fQO4zUsJ9hY+x49voe8m0lRxNCdwMYrDV+kkN7+q1xsHI

pHY42RcN89+BUg/ga/o7Ua1TKqyo=

X-Gm-Gg: ASbGncu9FyCqYX+ekfy1Us0Odg7/3flf5DMUI5jrAPNcWv1B9INjN9qvAziyTDr1pCC

GrZoeT+2LFI0h304vmBhmk0YbMziwCyoNidXFEQ==

X-Google-Smtp-Source: AGHT+IFyYn7dCsBzgtyP0t10DxmN3TTO2cA4C18HanO+WGtYT7d0uWOLm3lfWs/SVf2xNo0MSXkpXaQDy8XCi232tyk=

X-Received: by 2002:a05:690c:4d81:b0:6ef:7f34:fe08 with SMTP id

00721157ae682-6f531224a36mr111657737b3.18.1736558964788; Fri, 10 Jan 2025

17:29:24 -0800 (PST)

MIME-Version: 1.0

From: Herr Gomez Rodrigo

Date: Sat, 11 Jan 2025 01:29:11 +0000

X-Gm-Features: AbW1kvYmFeBng2OjPva9pr0fvB-_hZFsMqg1vxaqa2uoGFy4G3Bde6ryjQD8MoY

Message-ID:

Subject: Herr Gomez Rodrigo

To: dave , dave , dave ,

daverden , DaveRobson ,

davesocrates830 ,

davewillchambers

Content-Type: multipart/alternative; boundary="0000000000003a580c062b6424b7"

X-Spam_score: 7.3

X-Spam_score_int: 73

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: https://t.co/KXTrLQhm4Q https://t.co/KXTrLQhm4Q



Content analysis details: (7.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.219.178 listed in dnsbl.ahbl.org]

[209.85.219.178 listed in dnsbl.ahbl.org]

[209.85.219.178 listed in dnsbl.ahbl.org]

[209.85.219.178 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.219.178 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.219.178 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.219.178 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.219.178 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.219.178 listed in will-spam-for-food.eu.org]

[209.85.219.178 listed in will-spam-for-food.eu.org]

[209.85.219.178 listed in will-spam-for-food.eu.org]

[209.85.219.178 listed in will-spam-for-food.eu.org]

[209.85.219.178 listed in will-spam-for-food.eu.org]

[209.85.219.178 listed in will-spam-for-food.eu.org]

[209.85.219.178 listed in will-spam-for-food.eu.org]

[209.85.219.178 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.219.178 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.178 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

2.5 SUSPICIOUS_RECIPS Similar addresses in recipient list

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[mecatronic1005(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[mecatronic1005(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

Subject: {SPAM?} Herr Gomez Rodrigo



--0000000000003a580c062b6424b7

Content-Type: text/plain; charset="UTF-8"



https://t.co/KXTrLQhm4Q



--0000000000003a580c062b6424b7

Content-Type: text/html; charset="UTF-8"







--0000000000003a580c062b6424b7--