wEb/SEo/App spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 03 Feb 2025 06:45:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tewkO-000000009wg-0Kgo

for dave@doctor.nl2k.ab.ca;

Mon, 03 Feb 2025 06:44:20 -0700

Resent-From: The Doctor

Resent-Date: Mon, 3 Feb 2025 06:44:20 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f65.google.com ([209.85.216.65]:55512)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tesL9-00000000MHx-1Ozy

for root@nk.ca;

Mon, 03 Feb 2025 02:02:05 -0700

Received: by mail-pj1-f65.google.com with SMTP id 98e67ed59e1d1-2ee397a82f6so6937174a91.2

for ; Mon, 03 Feb 2025 01:00:12 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=websitesingh-com.20230601.gappssmtp.com; s=20230601; t=1738573207; x=1739178007; darn=nk.ca;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=8hfJV0dkxBNbLOWH95a+JA9fZNnANvQoKDnN8zY91YI=;

b=mv/9sZ8i7VCCBPTo1jS/qhppn1IfIR6+OcpAE20oHXOC40r8Jfi+Th8eiiqlEgj48s

oWYAWP7L+9ljXpQLBdnj9MDtL1aigHklGHUJxOT75FgAmaRaF4NYrfumATtalo4HpD/T

MieP/Je8CpA0hIFsQ7mgZGUyZ77gIiLFt+g9o8F/r1qptRW4Y78eOy/SS7zVgW52AhvD

pspcKp1y1fDDExU9GvXKUU+BhBDWwljJBKfR3eMHAOYAAghVU6qgEIQTjFaHOq/Zku+M

SWo9BeN6rdupXZ59T7WCXn2KdrxpUAjMGx/xwkPmpaQIZUyyCWDNZuNOBnNO3dYUQZkz

Bw0Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1738573207; x=1739178007;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=8hfJV0dkxBNbLOWH95a+JA9fZNnANvQoKDnN8zY91YI=;

b=dTxSFACvsTBkmK6jPm9D6qRWFkdPftcnip3Yn43TadVnqyQ1DfSZ8M91wewrUkZbm4

ux7cuGGof5uqpXJSfJx5a43twxZg3WShW/5Ocg/KjWBdytM5eCQrjedtVRAQRguVJ4fs

KZ/WYDUbjqj8Fyo9WDv/1fh9fj/Wk1MRunnx4wdYXKSpWqrDzMi9WCzhHTyqpjPQNJco

hl5QyPnMJFPsPnFFBd2okDYv5Z+scDyuV2HoUhKjZk9tYhe7XYMnkgJiPpGNi0CP/PyE

FkWwtgRTHewPkLVJsG9BmXvy1aLVX5WHBX564LEpJlnnAgJfqH/k/0IKxOVLWDkmaig1

eStQ==

X-Gm-Message-State: AOJu0Yzv34DRtBara7Vg4nkvUfEyZtXypl9DPRFXjGmgsIX0iUhCDtyl

p+iW8lZ2nZOx9GW9rGcouzoEKoSO7rkJ8HHb9tT2QdjqOPJx3WrpYtERWNoVmM0aDcUFwnbQT32

ibzI=

X-Gm-Gg: ASbGncvLKUyyIdCaYzmX1vmmm7Xy9C0A5QQhox6fiPwcPIYBBAxjFd4+pp31toqc0ii

rYMjdzkrNMTeQjcs32kE0L0P6gzNWw4EGknLx8YRAu8IsPtygmjgfXHOAw75aer/mhdYIswJw56

UsGOa4ZwigL/jtbeO4n4KFmWaW+PjEeKOQqIvWtgDZjEK/ps93nERkhSalHdRrK1s9UWRnfd7wF

A7tDLBU8g/h5N/wrDnkAWGVSSFWY+RCcYXyefzqoH+50PhS6JIK0Nlpo66U/1FV2i7cDC/SB12T

LIpwAj1bgshlH1Qo4vir/6pieo7AlCFx

X-Google-Smtp-Source: AGHT+IE7E1IaiwuFTJ0NGKpSce9mgIs2R0cxuTdmADrOB0h8Pjuh7bkDVRoKBi0JhFoMsE0Rww/gug==

X-Received: by 2002:a17:90b:4d0c:b0:2ee:db1a:2e3c with SMTP id 98e67ed59e1d1-2f83abab598mr29293491a91.1.1738573206724;

Mon, 03 Feb 2025 01:00:06 -0800 (PST)

Received: from om ([2401:4900:1c64:d875:8161:fb55:bebd:330b])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-21de3323e5bsm70782885ad.223.2025.02.03.01.00.05

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Mon, 03 Feb 2025 01:00:06 -0800 (PST)

From: "Jagat"

To:

Subject: web development offers

Date: Mon, 3 Feb 2025 14:19:43 +0530

Message-ID: <1845201db761a$04edc440$0ec94cc0$@com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_18453_01DB7648.1EA60040"

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: Adt2C6LfMvqDgoDKQVWulsQ4E4cNOA==

Content-Language: en-us



This is a multi-part message in MIME format.



------=_NextPart_000_18453_01DB7648.1EA60040

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,







I'm web developer who builds amazing looking websites for your businesses.

I'd like to have the chance to show you how I can improve for your business.







I'm an expert in the Word Press website platform and many other platforms

and shopping carts.







I can upgrade your existing website or build you a new one completely that

has all of the modern features and functionality.







If you are interested, please let know.







Thanks,







Jagat





------=_NextPart_000_18453_01DB7648.1EA60040

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">

class=3DWordSection1>

Hi,


class=3DMsoNoSpacing> 


class=3DMsoNoSpacing>I’m web developer who builds amazing looking =

websites for your businesses. I’d like to have the chance to show =

you how I can improve for your business.


class=3DMsoNoSpacing> 


class=3DMsoNoSpacing>I’m an expert in the Word Press website =

platform and many other platforms and shopping carts.


class=3DMsoNoSpacing> 

I can =

upgrade your existing website or build you a new one completely that has =

all of the modern features and functionality.


class=3DMsoNoSpacing> 

If you =

are interested, please let know.


class=3DMsoNoSpacing> 


class=3DMsoNoSpacing>Thanks,


class=3DMsoNoSpacing> 


class=3DMsoNoSpacing>Jagat



------=_NextPart_000_18453_01DB7648.1EA60040--



WEb/SEo/App spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 03 Feb 2025 06:44:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tewjm-000000009v9-24uW

for dave@doctor.nl2k.ab.ca;

Mon, 03 Feb 2025 06:43:42 -0700

Resent-From: The Doctor

Resent-Date: Mon, 3 Feb 2025 06:43:42 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f66.google.com ([209.85.167.66]:50606)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tepwu-00000000DDy-2yy9

for sales@nk.ca;

Sun, 02 Feb 2025 23:28:54 -0700

Received: by mail-lf1-f66.google.com with SMTP id 2adb3069b0e04-543cc81ddebso4712408e87.1

for ; Sun, 02 Feb 2025 22:26:55 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=websolutionai.com; s=google; t=1738564008; x=1739168808; darn=nk.ca;

h=to:subject:message-id:date:from:sender:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=HyrQs1wC20AQlIq4n5tPjZCZrG2mwbYtfPbNlKBVIn4=;

b=C/G/pLukP0EJMAkeFbC8z6a0QrS+Xo7l584GwtBJdushXv5UsAg+E3Ac/5eRwE9W4x

XnJMqoCcDTvY2OLL+wduJ6ELYrtG7l0PN89Sm3C01+QU2MHojHJ31Kko3uylRQMvagmq

YauwVVqxPSperlEejHKIQX+0rsLVS1d5TPEATsacF63mHhBL6psK8jlyNj6b5yaRY8J2

2LCQxtCPMxTO8faDA27kM+AY3IRjKrMYdt6sfZo6yjL7+0FTNFI+mlS56lSemCM6/3Z5

w/YOTDJBDqvmlTC0ieQS1rEdPwU11tcxyj3t09p01sCXWUvS2YaJl0FHw1CstIsg+ZRs

6B8A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1738564008; x=1739168808;

h=to:subject:message-id:date:from:sender:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=HyrQs1wC20AQlIq4n5tPjZCZrG2mwbYtfPbNlKBVIn4=;

b=UXjhBP02QRT0ehe6Lx6wIgTI04Bik9A2w0qwywqiLT4mXmSOWBPQSibATkBSsRfChv

jq7hzaMzqeATjHk8wCAk1l/x7M/552ETffl0tI/am3e5bAU/tb/2Y+UIi+jNRbPGBy7H

KGs9Et/VKUfNBKZt9quNlxHrojkj7bWzrFMS61uimk4Yjc/VzOSyTtarnAudPGpbNfI0

zQJajrBvivs7Y5ptMzLOFQ4MC7oss0g4QEUGlNn3IS5l9QN+JPGwiPjKavZcGewxCBWI

P3wr47AwJvOwj+f4yTtqQ+9EZwmNxAKngmnb1HMwEZaXD0Mx82c/1OGvl4JImyXwPsWx

esPQ==

X-Gm-Message-State: AOJu0Ywf0JwF6ShBPyjHTMsLlD89z1HeFCkzEAjlxrhJqzcNw4gijxIm

R/bCIaOsE4Ww3Nb5k6pW/JI9N+w5JimxIQmTu5/GZAGsttgzovId2HksGgK0ScNf/MjJbUEuU22

Se5IjDhLKqoCUFXX6bTgcCMhFVSI5wmINr5gfoJVJIvUTKTMINlqmUA==

X-Gm-Gg: ASbGncspQ7XrplhyiTTz5P2byBSmkWm9VOv+R0F7rNv1G13bAmIr8gdLLz71e8CvqV2

EwTM6L7qtU43zJ9yC15WyAcAqw3GXY7EYzozObQBu6w9Oie4SzCT+IKi6oDNNdPPO+X+IU5/r68

0=

X-Google-Smtp-Source: AGHT+IHndI9B62HZ0hGG9Gg83L01lEitdY9hyfRLtVCpz+Rh8IPILZDM67HLzWbxzA0sZUC88oDa8hN1fr51Qd95O6E=

X-Received: by 2002:a05:6512:3b26:b0:53e:389d:8ce4 with SMTP id

2adb3069b0e04-543e4c32c69mr6165124e87.34.1738564007673; Sun, 02 Feb 2025

22:26:47 -0800 (PST)

Received: from 52669349336 named unknown by gmailapi.google.com with HTTPREST;

Sun, 2 Feb 2025 22:26:47 -0800

Received: from 52669349336 named unknown by gmailapi.google.com with HTTPREST;

Mon, 3 Feb 2025 00:26:46 -0600

MIME-Version: 1.0

Sender: Edna Roberts

From: Edna Roberts

Date: Sun, 2 Feb 2025 22:26:47 -0800

X-Google-Sender-Auth: cY16RJZU0GjU27r3QcCmbcFMnIM

X-Gm-Features: AWEUYZnMCR7d6mcmdYJcmeCZwm6Dreg0psO4WiayUoh19-nTOpY0lhBqungGIes

Message-ID:

Subject: Re : nk.ca "Send me Issue Report & quote"

To: Sales

Content-Type: multipart/alternative; boundary="00000000000018d334062d36faee"



--00000000000018d334062d36faee

Content-Type: text/plain; charset="UTF-8"



Dear nk.ca



,







I wanted to bring to your attention some concerning issues regarding

your *nk.ca

*,

website.

It appears that your website has numerous technical errors and lacks proper

optimization for google.



I would be happy to send you errors and the solutions that would help to

improve your *nk.ca



*website

performance and traffic.



I guarantee, you will see a drastic change in your Google search ranking

once these are fixed.





If yes please allow me to send you "Estimated timeline to reach first page

and price list "




Stay safe!



Kind Regards



Edna Roberts





Digital Marketing Expert*------------------------------

-----------------------------------

PS1: -If you are
interested* please email me asking "Send me Issue

Report & quote".




Click here



to unsubscribe

[image: beacon]



--00000000000018d334062d36faee

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




dth=3D"386" style=3D"width:289.2pt;background-image:initial;background-posi=

tion:initial;background-size:initial;background-repeat:initial;background-o=

rigin:initial;background-clip:initial;border-collapse:collapse">
style=3D"height:13.1pt">

289.2pt;padding:0.75pt 0.75pt 0cm;height:13.1pt">


le=3D"margin:0cm;line-height:normal">
an style=3D"color:black">Dear=C2=A0
href=3D"https://websolutionai-dot-yamm-track.appspot.com/2_TAIWN5XMCzqiBLK=

U1uU1dJ8Ll3N6DhBjXcINfuhyNAxbX3KlAEatUFz6dIX6510WcTHgm8TyMotGcj9OEB-wizO4ug=

gFu_gxnnfPH2emsswNInj2nIcGjnp3U5V6HH3QVUbfUWOuh4JoowdD0avnaeACHTkKGm8u7Fol6=

gL" rel=3D"nofollow">nk.ca
,
n>


>=C2=A0
t>


in:0cm 0cm 10pt;line-height:12.65pt;background-image:initial;background-pos=

ition:initial;background-size:initial;background-repeat:initial;background-=

origin:initial;background-clip:initial">=

I wanted to bring to your attention some concer=

ning issues regarding your=C2=A0

ef=3D"https://websolutionai-dot-yamm-track.appspot.com/2zGLFZt9lscYIBtE0QHo=

3dkgfbnmGiUEITtIsLMUcsFQ0bX3KlAFwV634btPgBiO2A6lrlFlhVdxbXsX6WxGzOyNkQCA3kZ=

wlLXg-p6eYvZqHPjMhDdVeRad7YDBYKqOXRHyfsQOnKXXwoMXTXFTvz5SJ1H-iRFvrkoosbq1Y"=

rel=3D"nofollow">nk.ca
,=C2=A0we=

bsite. It appears that your website has numerous technical errors and lacks=

proper optimization for google.


yle=3D"margin:0cm 0cm 10pt;line-height:15pt;background-image:initial;backgr=

ound-position:initial;background-size:initial;background-repeat:initial;bac=

kground-origin:initial;background-clip:initial">
>I would be happy to=C2=A0
=3D"background:lime">send you errors and the solutions
=C2=A0that=

would help to improve your=C2=A0
mm-track.appspot.com/24x7vJxX7oqYhyx9a4ICMqLRokcGIU8Iey0Iuc0-kNbE3bX3KlAGbV=

jORHxzXu_l69OfYuYk65TXhKN_68rOSFIpNE0HGVAHrNW7CmsAkJpjru_-Qq46RPJnUl1VyJ-Y0=

WRb178H5ozUvnwwBba85ggz-ZG0dO4buGsuM-bvD" rel=3D"nofollow">nk.ca
=C2=A0<=

/b>website performance and traffic.


style=3D"margin:0cm 0cm 10pt;line-height:15pt;background-image:initial;bac=

kground-position:initial;background-size:initial;background-repeat:initial;=

background-origin:initial;background-clip:initial">
ck">I guarantee, you will see a drastic =

change in your Google search ranking once these are fixed.

>


round-image:initial;background-position:initial;background-size:initial;bac=

kground-repeat:initial;background-origin:initial;background-clip:initial"><=

b>
If yes=

please allow me to send you=C2=A0"Est=

imated timeline to reach first page and price list "
=C2=A0
t>


eight:15pt;background-image:initial;background-position:initial;background-=

size:initial;background-repeat:initial;background-origin:initial;background=

-clip:initial">
k">Stay safe!


in:0cm 0cm 0.0001pt;line-height:normal">=

Kind Regards=


ght:normal">
font-weight:700">Edna Roberts


gin:0cm 0cm 8pt;line-height:14.95px">
:black">Digital Marketing Expert<=

font face=3D"Times New Roman, serif">

pan>
------=

------------------------

f">-----------------------------------

s-serif" style=3D"color:black">PS1:=C2=A0-If you are=C2=A0interes=

ted
=C2=A0please email me asking=C2=A0

ont face=3D"verdana, sans-serif">"Send me=C2=A0Issue Report & quot=

e".


line-height:15pt;background-image:initial;background-position:initial;backg=

round-size:initial;background-repeat:initial;background-origin:initial;back=

ground-clip:initial">
nt-family:verdana,sans-serif">Click=C2=A0

ionai-dot-yamm-track.appspot.com/2C941LW3Eh_dOvtd170MfGQA-GwGlIIS0PVPziQGKO=

nA6bX3KlAGqA0iAuzu8LmeAq6_cvuWHghX7uli5dYgSPeBGE7yznRZPhS_beL0IkRVrEoyUj6EU=

YGpiGQLG0Vh81LngT0PC1gne3injYBlpMTrHMRKbgDklXpOKxnN1VADM" rel=3D"nofollow" =

target=3D"_blank" style=3D"font-size:x-small;font-family:verdana,sans-serif=

">here

ly:verdana,sans-serif">=C2=A0

(0,0,255);font-family:verdana,sans-serif">to unsubscribe

=3D"verdana, sans-serif" style=3D"font-size:x-small">=

=C2=A0

lor:black">=C2=A0




QIsAuEc2R1YhsDm4f2TUkRtlkal5PcrbX3KlAHMaa_vGMfqZE6hp9Jv7y0ZxW_egJxOE37JsD78=

c0cF8u43qVnuKZLumMEwpmT-ECotSs265r6-EnE-7IYY_vrE3vWNzkkfezZkLBQ3LALegfGQ" w=

idth=3D"1" height=3D"1" alt=3D"beacon" style=3D"display:none; display:none!=

important;">



--00000000000018d334062d36faee--

NetKnow now in Netcraft's Top 2050

All data is from Netcraft Toolbar .

Looks as if there are major changes to the Netcraft algorithm after some years! Why did Avast clasify the extension as URL:Phishing?

This is not the Alexa Tool Bar!



NetKnow







Netknow now 2034 at Netcraft
and pfs compliant



A significant decrease! We must do
  1. security audits regularly
  2. check on illegitimate traffic hitting the web server
  3. and
  4. keep design current!




How do we compare with other providers in

Edmonton
, Alberta, Canada?



Netknow again





We at Netknow are 2034 from 1672 since late December 2024.



Telus and reviews



Next we have Telus.com

ranked by Netcraft at 6745 from 6613 .

Sometimes their Web Hosting is done by
title="Internet Names for Business">Internet Names for Business


is ranked by Netcraft at >2000000 from >2000000 .



Rogers





Rogers Business Solutions

which rank 9383 from 9349 and are hosted in Europe.



Is Telus's ADSL network susceptible to Code Red Attacks and Attackers?

Reviews of Telus are available :





Government of Alberta



The Government of Alberta Website

ranks 13597 from 13593 by Netcraft and seems to hosted on Cloudfare.



University of Alberta







The University of Alberta
ranks 42918 from 42513 hosted by Amazon Techonologies.



Shaw Cable





Next,

members.shaw.ca

ranks >2000000 from >2000000 and retired and

Shaw Cable

is next at Netcraft rank 56459 from 56104 . Hosted now by Akamei .

Their Network Hosting Arm,

Big Pipe is at

Netcraft rank 261696 from 266668 and hosted by Akamai in Europe .



Reviews of Shaw are available :





City of Edmonton







The City of Edmonton
ranks 58181 from 57607 by Netcraft and hosted by Google.



Juno and NetZero





We have Juno Internet ranked on top

at 114821 from 116383 who are the owners of

US Based Netzero
at Netcraft Rank 79060 from 74251 .



NAIT / Northern Alberta Institute of Technology



NAIT ranks 88400 from 95145 hosted by Microsoft .



TekSavvy



TekSavvy ranks 187098 from 189473 and are hosted by Microsoft



Internet Centre / CCINet



Internet Centre

rank 277069 from 277048 . Their partner Rack Nine ranks > 2000000.



Grant MacEwen University





MacEwan ranks 352089 from 376399 .



Primus



Primus

ranks 443647 from 425751 and now points to BLACKIRON_DataCentres ranked >2000000 from >2000000.



Distributel / 3Web / CIA



Cybersurf

is ranked 561106 from 560989 and seems to be hosted in USA by DigitalOcean.



Xplornet



xplornet

ranks >2000000 from >2000000 and are listed with

Cirrus9 and are joining up with Shaw.

Their new domain xplore.ca ranks 588305 from 588029 .

According to an article in the Sherwood Park Independent, they are also getting an Alberta Government subsidy.



Radiant Communications / goco.ca





Radiant Communications

are ranked by Netcraft >2000000 and part of goco.ca

which ranks >2000000 .



Tera Byte Edmonton and reviews





Next is Tera-Byte

at Netcraft Rank >2000000 with

Tera-Byte.ca

ranking >2000000 from >2000000 and their wireless arm Tera-Byte Wireless

sold to Xplornet.

One of Tera-Byte's acquisitions

Edmonton Community Networks

ranks at >2000000 from >2000000 and

Go Edmonton ranks >2000000 from >2000000.

Alberta political blogger Daveberta ranks >2000000 from >2000000; interesting!!!

Reviews of Tera-byte is available at

here

and another here

and check Google for more reviews; just search tera byte.



MCSnet





MCSNET ranks >2000000 from >2000000 and are hosted by Microsoft .



Nucleus Internet Services





After that we have

Nucleus Information Services
which can be found at Netcraft Rank >2000000 from >2000000 .





4Web





4web ranks >2000000 from >2000000 .



Alentus / Wolfpaw





Alentus

rank by Netcraft >2000000 from >2000000 and I note they are hosted in the USA .

wolfpaw.net

which ranks at >2000000 from >2000000



Yellowpencil





Yellowpencil Ranks >2000000 from >2000000



WSI Corporation





Next is WSI - We Simply The Internet of Toronto

at Netcraft Position >2000000 from >2000000 and are being hosted on Amazon.



Uniserve / Interbaun





Next, Uniserve

ranks on Netcraft >2000000 from >2000000

One of their acquisitions

interbaun

ranks with Netcraft ?????? from ?????? due to merging of sites.

One customer just came over from this organization in Nov 2006.



Clearwave Broadband





Clearwave Broadband ranks

at >2000000 from >2000000



Platinum Communications





Platinum Communications Corp.

bought out by Xplornet .



Wild Rose Internet





Wild Rose Internet

ranks >2000000 from >2000000 and I wonder if this is another wireless branch of Tera-Byte and bought out by Xplornet





TIC Internet





TIC Internet

ranks >2000000 from >2000000 ( I do remember you).







Nisa Custom Internet Solutions





Nisa Custom Internet Solutions

ranks >2000000 from >2000000 by Netcraft



MediaShaker





Media Shakers of Edmonton

ranks >2000000 from >2000000





Koi Media





Koi Media

rank >2000000 from >2000000



WebFire





Webfire.ca

ranks >2000000 from >2000000 and seems to be connected with Shaw.



Core Network Solutions Inc.





Core Network Solutions Inc.

ranks at >2000000 from >2000000 .



The Network Centre





The Network Centre

ranks >2000000 from >2000000 and are linked with Telus high Speed.





Open Concept Internet, Inc.





Open Concept Internet, Inc.

rank > 2000000 from > 2000000





Techalta





Interspots of Edmonton

acquired by Techalta ;



Yegtel





Yegtel rank > 2000000 .



Internet Crossroads





Internet Crossroads Ltd of North Edmonton

rank nothing from nothing by Netcraft and seems to merged with Tera-Byte/ecn.ab.ca .



If I remember anymore, I will add to this entry, before Netcraft changes our ranking. Please watch this space and please feel free to peruse

our services. X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 01 Feb 2025 15:22:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1teLrP-00000000C0z-0i0G

for dave@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 15:21:07 -0700

Resent-From: The Doctor

Resent-Date: Sat, 1 Feb 2025 15:21:07 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [185.75.241.131] (port=42015 helo=betliusder.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1teLOT-000000004KC-0BAn

for sales@netknow.ca;

Sat, 01 Feb 2025 14:51:31 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=netknow.ca;

h=MIME-Version:To:From:Subject:Content-Type:Content-Transfer-Encoding; i=sales@netknow.ca;

bh=y1oO98/Rj+dxbCwdWWIcDEMU4xY=;

b=iQ1T6m82Np60Vqpq8HPoMPaUjEfmJDczve2/BvxVpidQyfOlkGKtkxhy+WoPBNWiuRXZgH9loNtL

dFCIpcbllu5wsayT3P8joibXjbOOTS8v1ElTO2stWNIo/QUv3L1ZtMXYXJKTkdXLwcAw5m5H3AP2

/Ok2lP0l9w7+zWZjGso=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=netknow.ca;

b=NjI4pcqKBxVXhqY1bc0g97KjYGjgt9O7yb9/eoXEXtNAdHxwTls89jh4xYk5XaAedim3QG4vq9ly

A23fA267ttn/7tdJIzS5Z9JPBV6uatxeHKtDuP9OeaaI/zZzAh63bmxe3/08R+faCNqnV5mLjcmD

OshicR5nDR/WAFECl+4=;

MIME-Version: 1.0

To: sales@netknow.ca

From: Sam's Club

Subject: Your Sam's Club Membership has Expired

Content-Type: text/html

Content-Transfer-Encoding: base64

X-Spam_score: 15.3

X-Spam_score_int: 153

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Congrats sales! If you no longer wish to receive these emails,

you may unsubscribe by clicking Here or by writing to 115 E 23rd St New York,

NY, US 10010



Content analysis details: (15.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.75.241.131 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in sa-accredit.habeas.com]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: wee.so]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 BASE64_LENGTH_79_INF BODY: base64 encoded email part uses line length

greater than 79 characters

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} Your Sam's Club Membership has Expired



Cgo8aHRtbD48c3R5bGU+MTAwNzYtMzI3PC9zdHlsZT4KPGJvZHk+CjxjZW50ZXI+Cgo8YSBocmVmPSJodHRwczovL3dlZS5zby9vM3VkciI+PGNlbnRlcj48aDIgc3R5bGU9ImNvbG9yOmJsYWNrIj5Db25ncmF0cyBzYWxlcyE8L2gyPjwvY2VudGVyPgo8aW1nIGJvcmRlcj0iMCIgc3JjPSJodHRwczovL3Bicy50d2ltZy5jb20vbWVkaWEvR09CSl9TU1dNQUV3dWJTP2Zvcm1hdD1wbmcmbmFtZT05MDB4OTAwIj48L2E+Cjxicj4KPGJyPgoKPGZvbnQgc2l6ZT0iMiI+Cjxicj5JZiB5b3Ugbm8gbG9uZ2VyIHdpc2ggdG8gcmVjZWl2ZSB0aGVzZSBlbWFpbHMsIHlvdSBtYXkgdW5zdWJzY3JpYmUgYnkgY2xpY2tpbmcgCjxhIGhyZWY9Imh0dHBzOi8vd2VlLnNvL3VjMDd2IiBzdHlsZT0iY29sb3I6IzAwMDBmZiI+PHU+SGVyZSA8L3U+PC9hPiBvciBieSB3cml0aW5nIHRvIDExNSBFIDIzcmQgU3QgTmV3IFlvcmssIE5ZLCBVUyAxMDAxMAo8L2ZvbnQ+Cgo8L2NlbnRlcj4KPC9ib2R5Pgo8L2h0bWw+Cgo=

NetKnow now in Netcraft's Top 2050

All data is from Netcraft Toolbar .

Looks as if there are major changes to the Netcraft algorithm after some years! Why did Avast clasify the extension as URL:Phishing?

This is not the Alexa Tool Bar!



NetKnow







Netknow now 2034 at Netcraft
and pfs compliant



A significant decrease! We must do
  1. security audits regularly
  2. check on illegitimate traffic hitting the web server
  3. and
  4. keep design current!




How do we compare with other providers in

Edmonton
, Alberta, Canada?



Netknow again





We at Netknow are 2034 from 1672 since late December 2024.



Telus and reviews



Next we have Telus.com

ranked by Netcraft at 6745 from 6613 .

Sometimes their Web Hosting is done by
title="Internet Names for Business">Internet Names for Business


is ranked by Netcraft at >2000000 from >2000000 .



Rogers





Rogers Business Solutions

which rank 9383 from 9349 and are hosted in Europe.



Is Telus's ADSL network susceptible to Code Red Attacks and Attackers?

Reviews of Telus are available :





Government of Alberta



The Government of Alberta Website

ranks 13597 from 13593 by Netcraft and seems to hosted on Cloudfare.



University of Alberta







The University of Alberta
ranks 42918 from 42513 hosted by Amazon Techonologies.



Shaw Cable





Next,

members.shaw.ca

ranks >2000000 from >2000000 and retired and

Shaw Cable

is next at Netcraft rank 56459 from 56104 . Hosted now by Akamei .

Their Network Hosting Arm,

Big Pipe is at

Netcraft rank 261696 from 266668 and hosted by Akamai in Europe .



Reviews of Shaw are available :





City of Edmonton







The City of Edmonton
ranks 58181 from 57607 by Netcraft and hosted by Google.



Juno and NetZero





We have Juno Internet ranked on top

at 114821 from 116383 who are the owners of

US Based Netzero
at Netcraft Rank 79060 from 74251 .



NAIT / Northern Alberta Institute of Technology



NAIT ranks 88400 from 95145 hosted by Microsoft .



TekSavvy



TekSavvy ranks 187098 from 189473 and are hosted by Microsoft



Internet Centre / CCINet



Internet Centre

rank 277069 from 277048 . Their partner Rack Nine ranks > 2000000.



Grant MacEwen University





MacEwan ranks 352089 from 376399 .



Primus



Primus

ranks 443647 from 425751 and now points to BLACKIRON_DataCentres ranked >2000000 from >2000000.



Distributel / 3Web / CIA



Cybersurf

is ranked 561106 from 560989 and seems to be hosted in USA by DigitalOcean.



Xplornet



xplornet

ranks >2000000 from >2000000 and are listed with

Cirrus9 and are joining up with Shaw.

Their new domain xplore.ca ranks 588305 from 588029 .

According to an article in the Sherwood Park Independent, they are also getting an Alberta Government subsidy.



Radiant Communications / goco.ca





Radiant Communications

are ranked by Netcraft >2000000 and part of goco.ca

which ranks >2000000 .



Tera Byte Edmonton and reviews





Next is Tera-Byte

at Netcraft Rank >2000000 with

Tera-Byte.ca

ranking >2000000 from >2000000 and their wireless arm Tera-Byte Wireless

sold to Xplornet.

One of Tera-Byte's acquisitions

Edmonton Community Networks

ranks at >2000000 from >2000000 and

Go Edmonton ranks >2000000 from >2000000.

Alberta political blogger Daveberta ranks >2000000 from >2000000; interesting!!!

Reviews of Tera-byte is available at

here

and another here

and check Google for more reviews; just search tera byte.



MCSnet





MCSNET ranks >2000000 from >2000000 and are hosted by Microsoft .



Nucleus Internet Services





After that we have

Nucleus Information Services
which can be found at Netcraft Rank >2000000 from >2000000 .





4Web





4web ranks >2000000 from >2000000 .



Alentus / Wolfpaw





Alentus

rank by Netcraft >2000000 from >2000000 and I note they are hosted in the USA .

wolfpaw.net

which ranks at >2000000 from >2000000



Yellowpencil





Yellowpencil Ranks >2000000 from >2000000



WSI Corporation





Next is WSI - We Simply The Internet of Toronto

at Netcraft Position >2000000 from >2000000 and are being hosted on Amazon.



Uniserve / Interbaun





Next, Uniserve

ranks on Netcraft >2000000 from >2000000

One of their acquisitions

interbaun

ranks with Netcraft ?????? from ?????? due to merging of sites.

One customer just came over from this organization in Nov 2006.



Clearwave Broadband





Clearwave Broadband ranks

at >2000000 from >2000000



Platinum Communications





Platinum Communications Corp.

bought out by Xplornet .



Wild Rose Internet





Wild Rose Internet

ranks >2000000 from >2000000 and I wonder if this is another wireless branch of Tera-Byte and bought out by Xplornet





TIC Internet





TIC Internet

ranks >2000000 from >2000000 ( I do remember you).







Nisa Custom Internet Solutions





Nisa Custom Internet Solutions

ranks >2000000 from >2000000 by Netcraft



MediaShaker





Media Shakers of Edmonton

ranks >2000000 from >2000000





Koi Media





Koi Media

rank >2000000 from >2000000



WebFire





Webfire.ca

ranks >2000000 from >2000000 and seems to be connected with Shaw.



Core Network Solutions Inc.





Core Network Solutions Inc.

ranks at >2000000 from >2000000 .



The Network Centre





The Network Centre

ranks >2000000 from >2000000 and are linked with Telus high Speed.





Open Concept Internet, Inc.





Open Concept Internet, Inc.

rank > 2000000 from > 2000000





Techalta





Interspots of Edmonton

acquired by Techalta ;



Yegtel





Yegtel rank > 2000000 .



Internet Crossroads





Internet Crossroads Ltd of North Edmonton

rank nothing from nothing by Netcraft and seems to merged with Tera-Byte/ecn.ab.ca .



If I remember anymore, I will add to this entry, before Netcraft changes our ranking. Please watch this space and please feel free to peruse

our services.

Nigerian spam from Google Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 02 Feb 2025 12:30:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tefep-000000003Yi-0vxq

for dave@doctor.nl2k.ab.ca;

Sun, 02 Feb 2025 12:29:27 -0700

Resent-From: The Doctor

Resent-Date: Sun, 2 Feb 2025 12:29:27 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-il1-f181.google.com ([209.85.166.181]:59393)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1teeMf-00000000Nrr-3xBc

for doctor@doctor.nl2k.ab.ca;

Sun, 02 Feb 2025 11:06:41 -0700

Received: by mail-il1-f181.google.com with SMTP id e9e14a558f8ab-3d0062fb20bso31770005ab.2

for ; Sun, 02 Feb 2025 10:04:47 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1738519481; x=1739124281; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=O5JZkMt3qWtPid1u0x6N+qVquXV3e5rtJQt/UwK43BE=;

b=fkqrskoy+5Bl6ZGaeR5Bj60Fq6tjaV52CukndeSjkarGZvKk8/O3vl6IiiSb3NNpwU

HkW6Or2LBTWZL4O3i0OOJXpBKsIviH1f6elKL5108kFCCX6j7eZOn4e/9pt+QtyS2hgi

2t2zfOn2gISK2XVYDpFEGuGYF48dkIC3bBQHfN/nu7MQYuy5t8ecSASDqTTgd+ozGHt8

uEo+MMj9Ko1dDcW4cNvw8BVxlo/scXd0NwUR8rewLIEARIR6F8uYcyd5CFbE1WhUCZfZ

xMTAPwQsY356/vEs/XIQnxhwh4kvmatmd2bIxEsV07VAulol0I6YA2yjzHusHqDgAXYF

o+Iw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1738519481; x=1739124281;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=O5JZkMt3qWtPid1u0x6N+qVquXV3e5rtJQt/UwK43BE=;

b=i3yIhTU4PDP5A+eHrDv/oXjAOit9g7sbjCECO4acdhhrOWzgq+VQcY150F8p2w7Df7

wGnVUZ2b/GbGG+soKWP8DCHvojhFPkJb/HyCWtNQGIZQ8li8jXISazIsG5Vxlzmzk+8C

U5/guAFBdjyvYSnP6oMJ8tM89yL8GOzklvRxZ/Xqw7T9qzLrA7y+SylWco5eAlOCqFKa

NoURQs37TSPtlxJO8s3xcKD8PG35Beryq/ktzz7bqsYVwcJ/fyDzn4bha8oky4KrqbEs

s9/17O89Oes9JORYoSCFgPiATGorQ9YhUSPZcc/xbf1dCXwJxu5+oMo+KhkKtKI4Z9Kj

4HdQ==

X-Forwarded-Encrypted: i=1; AJvYcCUzwIBE9yIKK9BZTgX2IZGhCohgAG3hD3IR4H64jkFz/h9V4Q8xgiXIIbEAlFWmMaU5EwmN/38=@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Ywz81ICvecIQ9Qm2vM2aozFT5upOBd9d2HcdOwwfA2kIQlVh0Q1

+lHrXiqB9Y8eshA6wM/SnKn89Fzcmz934xBz5DtqxgxxV5HxFZHLIUI/Kvh4xdSLFtEfcfbZfpD

WEDMQgmF+vx3cznN+0eVV+TWQC2Y=

X-Gm-Gg: ASbGnct8suj189AGxk+OFR+OfyRlQ2lAXB3UShNHoPUSfTh2PDeETeMyE/xZ4BZ4KNk

Rr0u0CQUUM1gAJIc3+U2QQVDRn6IWAAdhB3y50Xrzqnf0AX0Q4NtLBlU1pTA+PacyGUV6qg==

X-Google-Smtp-Source: AGHT+IELzx4J1LD6/WQxTW2sV4tQycFULxg+4JSMeGJuE8PTIgm1MDW96W7eGfwYcKAaPP5sx+Z4mwbrJ7W4svG1B3E=

X-Received: by 2002:a92:c241:0:b0:3d0:137a:8ca2 with SMTP id

e9e14a558f8ab-3d0137a8dd0mr123348225ab.22.1738519481173; Sun, 02 Feb 2025

10:04:41 -0800 (PST)

MIME-Version: 1.0

Reply-To: umezgilbert@yahoo.com

From: Umez Gilbert

Date: Sun, 2 Feb 2025 19:04:29 +0100

X-Gm-Features: AWEUYZmvakYgO7WabX-mBqC_2RzGQVWih8YnYSetzZYsrH1dcZ7n0SQb1h5PAH0

Message-ID:

Subject: PARTNER WITH ME.

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000001c5273062d2c9c8d"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 19.2

X-Spam_score_int: 192

X-Spam_bar: +++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear, My name is Mr.Gilbert Umeze and I am Director of Finance

of the Kenya Airport Authority {KAA} I am in search of an agent to assist

in the transfer of EIGHT MILLION, FIVE HUNDRED THOUSAND UNITED STATES [...]





Content analysis details: (19.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.166.181 listed in will-spam-for-food.eu.org]

[209.85.166.181 listed in will-spam-for-food.eu.org]

[209.85.166.181 listed in will-spam-for-food.eu.org]

[209.85.166.181 listed in will-spam-for-food.eu.org]

[209.85.166.181 listed in will-spam-for-food.eu.org]

[209.85.166.181 listed in will-spam-for-food.eu.org]

[209.85.166.181 listed in will-spam-for-food.eu.org]

[209.85.166.181 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.166.181 listed in dnsbl.ahbl.org]

[209.85.166.181 listed in dnsbl.ahbl.org]

[209.85.166.181 listed in dnsbl.ahbl.org]

[209.85.166.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.166.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.166.181 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.166.181 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.166.181 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.166.181 listed in list.dnswl.org]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.166.181 listed in wl.mailspike.net]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[umezegilbert1(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[umezegilbert1(at)gmail.com]

2.5 MILLION_USD BODY: Talks about millions of dollars

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.8 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 T_MONEY_PERCENT X% of a lot of money for you

2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

2.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} PARTNER WITH ME.



--0000000000001c5273062d2c9c8d

Content-Type: text/plain; charset="UTF-8"



Dear,



My name is Mr.Gilbert Umeze and I am Director of Finance of the Kenya

Airport Authority {KAA} I am in search of an agent to assist in the

transfer of EIGHT MILLION, FIVE HUNDRED THOUSAND UNITED STATES DOLLARS. And

subsequent investment in properties in your country. You will be required

to:



(1) Assist in the transfer of the said sum into your account

(2) Advise on lucrative areas for investment

(3) Assist us in purchase of properties.



If you decide to render your service to us in this regard, 35% of the total

sum will be offered to you as your share /commission. If you are

interested, please, quickly indicate by emailing me back.



Faithfully Yours,

Mr.Gilbert Umeze



--0000000000001c5273062d2c9c8d

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear,

My name is Mr.Gilbert Umeze and I am Director=

of Finance of the Kenya Airport Authority {KAA} I am in search of an agent=

to assist in the transfer of EIGHT MILLION, FIVE HUNDRED THOUSAND UNITED S=

TATES DOLLARS. And subsequent investment in properties in your country. You=

will be required to:

(1) Assist in the transfer of the said sum int=

o your account
(2) Advise on lucrative areas for investment
(3) Assis=

t us in purchase of properties.

If you decide to render your service=

to us in this regard, 35% of the total sum will be offered to you as your =

share /commission. If you are interested, please, quickly indicate by email=

ing me back.

Faithfully Yours,
Mr.Gilbert Umeze






--0000000000001c5273062d2c9c8d--

Google Ads Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 01 Feb 2025 18:45:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1teP1p-00000000F4j-2wR7

for dave@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 18:44:05 -0700

Resent-From: The Doctor

Resent-Date: Sat, 1 Feb 2025 18:44:05 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from static.109.42.78.5.clients.your-server.de ([5.78.42.109]:55692)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1teMym-00000000A73-1kFw

for doctor@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 16:32:56 -0700

Received: by static.109.42.78.5.clients.your-server.de (Postfix, from userid 0)

id BDBD250A3D; Sat, 1 Feb 2025 23:28:38 +0000 (UTC)

To: doctor@doctor.nl2k.ab.ca

Subject: Your Google Ads account has been canceled (49851133)

X-Mailer: Outlook/91.8.0

From: Google Ads

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="084113242950dcb30aa90264a9d40eac"

Content-Transfer-Encoding: 7bit

Message-Id: <20250201232838.BDBD250A3D@static.109.42.78.5.clients.your-server.de>

Date: Sat, 1 Feb 2025 23:28:38 +0000 (UTC)

X-Spam_score: 22.4

X-Spam_score_int: 224

X-Spam_bar: ++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your Customer ID: 376571377 Log in Your Google Ads account

has been canceled



Content analysis details: (22.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[5.78.42.109 listed in will-spam-for-food.eu.org]

[5.78.42.109 listed in will-spam-for-food.eu.org]

[5.78.42.109 listed in will-spam-for-food.eu.org]

[5.78.42.109 listed in will-spam-for-food.eu.org]

[5.78.42.109 listed in will-spam-for-food.eu.org]

[5.78.42.109 listed in will-spam-for-food.eu.org]

[5.78.42.109 listed in will-spam-for-food.eu.org]

[5.78.42.109 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[5.78.42.109 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[5.78.42.109 listed in dnsbl.ahbl.org]

[5.78.42.109 listed in dnsbl.ahbl.org]

[5.78.42.109 listed in dnsbl.ahbl.org]

[5.78.42.109 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[5.78.42.109 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[5.78.42.109 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[5.78.42.109 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[5.78.42.109 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[5.78.42.109 listed in zen.spamhaus.org]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[5.78.42.109 listed in sa-trusted.bondedsender.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: 94.36.109.208.host.secureserver.net]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[5.78.42.109 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[5.78.42.109 listed in bb.barracudacentral.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[5.78.42.109 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[5.78.42.109 listed in bl.score.senderscore.com]

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or

Generic rPTR

4.0 GR_DOMAIN_YOUSER1 Received contains spam friendly ISP (youser)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 WEIRD_PORT URI: Uses non-standard port number for HTTP

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

2.8 MANY_SUBDOM Lots and lots of subdomain parts in a URI

3.2 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr

1)

Subject: {SPAM?} Your Google Ads account has been canceled (49851133)



This is a MIME encoded message.

X-Priority: 1



--084113242950dcb30aa90264a9d40eac

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 8bit



































































































































































































































Your Customer ID: 376571377








































































































































































































































































































































































































































Your Google Ads account has been canceled

















Hello advertiser,















Your Google Ads account, ‏37657137, was canceled on January 20, 2025.






















Ads will stop serving within 24 hours of canceling your account. It is

important to highlight that you will need to pay for accumulated costs

that are still outstanding. If there are refundable credits on the

canceled account, you will receive them within 4 weeks. Learn more

about managing billing after canceling your Google Ads account.

















If you have not requested cancellation, we recommend that you check whether the cancellation was authorized.

















To

reactivate the canceled account and advertise again, as an

administrative user, you can click on the "Reactivate account" button

below and follow the steps indicated on the page.













































































REACTIVATE ACCOUNT




























































































































Find out more about how to reactivate canceled accounts.















After canceling your Google Ads account, you can still log in on it, but the ads are no longer served.















Cancellation is only valid for the mentioned Google Ads account. If you

use the same email address to sign in to other Google Ads accounts (or

other Google products like AdSense, YouTube, and Gmail), they are not

affected.

















Until later,

















Google Ads Team











































































































































































































This email contains updates about your Google Ads account.









© 2025 Google LLC








1600 Amphitheatre Parkway,








Mountain View, CA 94043












































Google Ads Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 01 Feb 2025 18:45:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1teP21-00000000FC5-19i5

for dave@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 18:44:17 -0700

Resent-From: The Doctor

Resent-Date: Sat, 1 Feb 2025 18:44:17 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from static.179.128.78.5.clients.your-server.de ([5.78.128.179]:57516)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1teNUn-00000000Bls-2W0D

for root@nl2k.ab.ca;

Sat, 01 Feb 2025 17:05:58 -0700

Received: by static.179.128.78.5.clients.your-server.de (Postfix, from userid 0)

id 06C6B7E64C; Sat, 1 Feb 2025 23:35:42 +0000 (UTC)

To: root@nl2k.ab.ca

Subject: Your Google Ads account has been canceled (19646473)

X-Mailer: Outlook/91.8.0

From: Google Ads

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="886df6e8924bf80015481f8f153c67d0"

Content-Transfer-Encoding: 7bit

Message-Id: <20250201234339.06C6B7E64C@static.179.128.78.5.clients.your-server.de>

Date: Sat, 1 Feb 2025 23:35:42 +0000 (UTC)

X-Spam_score: 25.9

X-Spam_score_int: 259

X-Spam_bar: +++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your Customer ID: 504955787 Log in Your Google Ads account

has been canceled



Content analysis details: (25.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[5.78.128.179 listed in will-spam-for-food.eu.org]

[5.78.128.179 listed in will-spam-for-food.eu.org]

[5.78.128.179 listed in will-spam-for-food.eu.org]

[5.78.128.179 listed in will-spam-for-food.eu.org]

[5.78.128.179 listed in will-spam-for-food.eu.org]

[5.78.128.179 listed in will-spam-for-food.eu.org]

[5.78.128.179 listed in will-spam-for-food.eu.org]

[5.78.128.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[5.78.128.179 listed in dnsbl.ahbl.org]

[5.78.128.179 listed in dnsbl.ahbl.org]

[5.78.128.179 listed in dnsbl.ahbl.org]

[5.78.128.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[5.78.128.179 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[5.78.128.179 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[5.78.128.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[5.78.128.179 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[5.78.128.179 listed in sbl-xbl.spamhaus.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: 94.36.109.208.host.secureserver.net]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[5.78.128.179 listed in zen.spamhaus.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[5.78.128.179 listed in bb.barracudacentral.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[5.78.128.179 listed in wl.mailspike.net]

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or

Generic rPTR

4.0 GR_DOMAIN_YOUSER1 Received contains spam friendly ISP (youser)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 WEIRD_PORT URI: Uses non-standard port number for HTTP

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

2.8 MANY_SUBDOM Lots and lots of subdomain parts in a URI

3.2 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr

1)

Subject: {SPAM?} Your Google Ads account has been canceled (19646473)



This is a MIME encoded message.

X-Priority: 1



--886df6e8924bf80015481f8f153c67d0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 8bit



































































































































































































































Your Customer ID: 504955787








































































































































































































































































































































































































































Your Google Ads account has been canceled

















Hello advertiser,















Your Google Ads account, ‏50495578, was canceled on January 20, 2025.






















Ads will stop serving within 24 hours of canceling your account. It is

important to highlight that you will need to pay for accumulated costs

that are still outstanding. If there are refundable credits on the

canceled account, you will receive them within 4 weeks. Learn more

about managing billing after canceling your Google Ads account.

















If you have not requested cancellation, we recommend that you check whether the cancellation was authorized.

















To

reactivate the canceled account and advertise again, as an

administrative user, you can click on the "Reactivate account" button

below and follow the steps indicated on the page.













































































REACTIVATE ACCOUNT




























































































































Find out more about how to reactivate canceled accounts.















After canceling your Google Ads account, you can still log in on it, but the ads are no longer served.















Cancellation is only valid for the mentioned Google Ads account. If you

use the same email address to sign in to other Google Ads accounts (or

other Google products like AdSense, YouTube, and Gmail), they are not

affected.

















Until later,

















Google Ads Team











































































































































































































This email contains updates about your Google Ads account.









© 2025 Google LLC








1600 Amphitheatre Parkway,








Mountain View, CA 94043












































Google Ads Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 01 Feb 2025 18:45:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1teP25-00000000FF0-0Q6G

for dave@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 18:44:21 -0700

Resent-From: The Doctor

Resent-Date: Sat, 1 Feb 2025 18:44:21 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from static.167.76.78.5.clients.your-server.de ([5.78.76.167]:35380)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1teNSP-00000000BfN-3GDS

for root@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 17:03:34 -0700

Received: by static.167.76.78.5.clients.your-server.de (Postfix, from userid 0)

id F2B5F7F22B; Sat, 1 Feb 2025 23:37:26 +0000 (UTC)

To: root@doctor.nl2k.ab.ca

Subject: Your Google Ads account has been canceled (37828278)

X-Mailer: Outlook/91.8.0

From: Google Ads

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="75463b379416b7c260ff0c78ace075c9"

Content-Transfer-Encoding: 7bit

Message-Id: <20250201233937.F2B5F7F22B@static.167.76.78.5.clients.your-server.de>

Date: Sat, 1 Feb 2025 23:37:26 +0000 (UTC)

X-Spam_score: 22.4

X-Spam_score_int: 224

X-Spam_bar: ++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your Customer ID: 400997477 Log in Your Google Ads account

has been canceled



Content analysis details: (22.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[5.78.76.167 listed in will-spam-for-food.eu.org]

[5.78.76.167 listed in will-spam-for-food.eu.org]

[5.78.76.167 listed in will-spam-for-food.eu.org]

[5.78.76.167 listed in will-spam-for-food.eu.org]

[5.78.76.167 listed in will-spam-for-food.eu.org]

[5.78.76.167 listed in will-spam-for-food.eu.org]

[5.78.76.167 listed in will-spam-for-food.eu.org]

[5.78.76.167 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[5.78.76.167 listed in dnsbl.ahbl.org]

[5.78.76.167 listed in dnsbl.ahbl.org]

[5.78.76.167 listed in dnsbl.ahbl.org]

[5.78.76.167 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[5.78.76.167 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[5.78.76.167 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[5.78.76.167 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[5.78.76.167 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[5.78.76.167 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[5.78.76.167 listed in zen.spamhaus.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[5.78.76.167 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[5.78.76.167 listed in sa-accredit.habeas.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: 94.36.109.208.host.secureserver.net]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[5.78.76.167 listed in sa-trusted.bondedsender.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[5.78.76.167 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[5.78.76.167 listed in bl.score.senderscore.com]

0.8 DKIM_ADSP_NXDOMAIN No valid author signature and domain not in DNS

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or

Generic rPTR

4.0 GR_DOMAIN_YOUSER1 Received contains spam friendly ISP (youser)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 WEIRD_PORT URI: Uses non-standard port number for HTTP

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

2.8 MANY_SUBDOM Lots and lots of subdomain parts in a URI

3.2 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr

1)

Subject: {SPAM?} Your Google Ads account has been canceled (37828278)



This is a MIME encoded message.

X-Priority: 1



--75463b379416b7c260ff0c78ace075c9

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: 8bit



































































































































































































































Your Customer ID: 400997477








































































































































































































































































































































































































































Your Google Ads account has been canceled

















Hello advertiser,















Your Google Ads account, ‏40099747, was canceled on January 20, 2025.






















Ads will stop serving within 24 hours of canceling your account. It is

important to highlight that you will need to pay for accumulated costs

that are still outstanding. If there are refundable credits on the

canceled account, you will receive them within 4 weeks. Learn more

about managing billing after canceling your Google Ads account.

















If you have not requested cancellation, we recommend that you check whether the cancellation was authorized.

















To

reactivate the canceled account and advertise again, as an

administrative user, you can click on the "Reactivate account" button

below and follow the steps indicated on the page.













































































REACTIVATE ACCOUNT




























































































































Find out more about how to reactivate canceled accounts.















After canceling your Google Ads account, you can still log in on it, but the ads are no longer served.















Cancellation is only valid for the mentioned Google Ads account. If you

use the same email address to sign in to other Google Ads accounts (or

other Google products like AdSense, YouTube, and Gmail), they are not

affected.

















Until later,

















Google Ads Team











































































































































































































This email contains updates about your Google Ads account.









© 2025 Google LLC








1600 Amphitheatre Parkway,








Mountain View, CA 94043












































Sam's Club Phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 01 Feb 2025 15:22:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1teLrP-00000000C0z-0i0G

for dave@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 15:21:07 -0700

Resent-From: The Doctor

Resent-Date: Sat, 1 Feb 2025 15:21:07 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [185.75.241.131] (port=42015 helo=betliusder.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1teLOT-000000004KC-0BAn

for sales@netknow.ca;

Sat, 01 Feb 2025 14:51:31 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=netknow.ca;

h=MIME-Version:To:From:Subject:Content-Type:Content-Transfer-Encoding; i=sales@netknow.ca;

bh=y1oO98/Rj+dxbCwdWWIcDEMU4xY=;

b=iQ1T6m82Np60Vqpq8HPoMPaUjEfmJDczve2/BvxVpidQyfOlkGKtkxhy+WoPBNWiuRXZgH9loNtL

dFCIpcbllu5wsayT3P8joibXjbOOTS8v1ElTO2stWNIo/QUv3L1ZtMXYXJKTkdXLwcAw5m5H3AP2

/Ok2lP0l9w7+zWZjGso=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=netknow.ca;

b=NjI4pcqKBxVXhqY1bc0g97KjYGjgt9O7yb9/eoXEXtNAdHxwTls89jh4xYk5XaAedim3QG4vq9ly

A23fA267ttn/7tdJIzS5Z9JPBV6uatxeHKtDuP9OeaaI/zZzAh63bmxe3/08R+faCNqnV5mLjcmD

OshicR5nDR/WAFECl+4=;

MIME-Version: 1.0

To: sales@netknow.ca

From: Sam's Club

Subject: Your Sam's Club Membership has Expired

Content-Type: text/html

Content-Transfer-Encoding: base64

X-Spam_score: 15.3

X-Spam_score_int: 153

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Congrats sales! If you no longer wish to receive these emails,

you may unsubscribe by clicking Here or by writing to 115 E 23rd St New York,

NY, US 10010



Content analysis details: (15.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.75.241.131 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in sa-accredit.habeas.com]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: wee.so]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 BASE64_LENGTH_79_INF BODY: base64 encoded email part uses line length

greater than 79 characters

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} Your Sam's Club Membership has Expired



Cgo8aHRtbD48c3R5bGU+MTAwNzYtMzI3PC9zdHlsZT4KPGJvZHk+CjxjZW50ZXI+Cgo8YSBocmVmPSJodHRwczovL3dlZS5zby9vM3VkciI+PGNlbnRlcj48aDIgc3R5bGU9ImNvbG9yOmJsYWNrIj5Db25ncmF0cyBzYWxlcyE8L2gyPjwvY2VudGVyPgo8aW1nIGJvcmRlcj0iMCIgc3JjPSJodHRwczovL3Bicy50d2ltZy5jb20vbWVkaWEvR09CSl9TU1dNQUV3dWJTP2Zvcm1hdD1wbmcmbmFtZT05MDB4OTAwIj48L2E+Cjxicj4KPGJyPgoKPGZvbnQgc2l6ZT0iMiI+Cjxicj5JZiB5b3Ugbm8gbG9uZ2VyIHdpc2ggdG8gcmVjZWl2ZSB0aGVzZSBlbWFpbHMsIHlvdSBtYXkgdW5zdWJzY3JpYmUgYnkgY2xpY2tpbmcgCjxhIGhyZWY9Imh0dHBzOi8vd2VlLnNvL3VjMDd2IiBzdHlsZT0iY29sb3I6IzAwMDBmZiI+PHU+SGVyZSA8L3U+PC9hPiBvciBieSB3cml0aW5nIHRvIDExNSBFIDIzcmQgU3QgTmV3IFlvcmssIE5ZLCBVUyAxMDAxMAo8L2ZvbnQ+Cgo8L2NlbnRlcj4KPC9ib2R5Pgo8L2h0bWw+Cgo=

Sam's Club Phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 01 Feb 2025 15:22:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1teLrP-00000000C0z-0i0G

for dave@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 15:21:07 -0700

Resent-From: The Doctor

Resent-Date: Sat, 1 Feb 2025 15:21:07 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [185.75.241.131] (port=42015 helo=betliusder.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1teLOT-000000004KC-0BAn

for sales@netknow.ca;

Sat, 01 Feb 2025 14:51:31 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=netknow.ca;

h=MIME-Version:To:From:Subject:Content-Type:Content-Transfer-Encoding; i=sales@netknow.ca;

bh=y1oO98/Rj+dxbCwdWWIcDEMU4xY=;

b=iQ1T6m82Np60Vqpq8HPoMPaUjEfmJDczve2/BvxVpidQyfOlkGKtkxhy+WoPBNWiuRXZgH9loNtL

dFCIpcbllu5wsayT3P8joibXjbOOTS8v1ElTO2stWNIo/QUv3L1ZtMXYXJKTkdXLwcAw5m5H3AP2

/Ok2lP0l9w7+zWZjGso=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=netknow.ca;

b=NjI4pcqKBxVXhqY1bc0g97KjYGjgt9O7yb9/eoXEXtNAdHxwTls89jh4xYk5XaAedim3QG4vq9ly

A23fA267ttn/7tdJIzS5Z9JPBV6uatxeHKtDuP9OeaaI/zZzAh63bmxe3/08R+faCNqnV5mLjcmD

OshicR5nDR/WAFECl+4=;

MIME-Version: 1.0

To: sales@netknow.ca

From: Sam's Club

Subject: Your Sam's Club Membership has Expired

Content-Type: text/html

Content-Transfer-Encoding: base64

X-Spam_score: 15.3

X-Spam_score_int: 153

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Congrats sales! If you no longer wish to receive these emails,

you may unsubscribe by clicking Here or by writing to 115 E 23rd St New York,

NY, US 10010



Content analysis details: (15.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.75.241.131 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in sa-accredit.habeas.com]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: wee.so]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 BASE64_LENGTH_79_INF BODY: base64 encoded email part uses line length

greater than 79 characters

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} Your Sam's Club Membership has Expired



Cgo8aHRtbD48c3R5bGU+MTAwNzYtMzI3PC9zdHlsZT4KPGJvZHk+CjxjZW50ZXI+Cgo8YSBocmVmPSJodHRwczovL3dlZS5zby9vM3VkciI+PGNlbnRlcj48aDIgc3R5bGU9ImNvbG9yOmJsYWNrIj5Db25ncmF0cyBzYWxlcyE8L2gyPjwvY2VudGVyPgo8aW1nIGJvcmRlcj0iMCIgc3JjPSJodHRwczovL3Bicy50d2ltZy5jb20vbWVkaWEvR09CSl9TU1dNQUV3dWJTP2Zvcm1hdD1wbmcmbmFtZT05MDB4OTAwIj48L2E+Cjxicj4KPGJyPgoKPGZvbnQgc2l6ZT0iMiI+Cjxicj5JZiB5b3Ugbm8gbG9uZ2VyIHdpc2ggdG8gcmVjZWl2ZSB0aGVzZSBlbWFpbHMsIHlvdSBtYXkgdW5zdWJzY3JpYmUgYnkgY2xpY2tpbmcgCjxhIGhyZWY9Imh0dHBzOi8vd2VlLnNvL3VjMDd2IiBzdHlsZT0iY29sb3I6IzAwMDBmZiI+PHU+SGVyZSA8L3U+PC9hPiBvciBieSB3cml0aW5nIHRvIDExNSBFIDIzcmQgU3QgTmV3IFlvcmssIE5ZLCBVUyAxMDAxMAo8L2ZvbnQ+Cgo8L2NlbnRlcj4KPC9ib2R5Pgo8L2h0bWw+Cgo=

Sam's Club Phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 01 Feb 2025 15:22:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1teLrP-00000000C0z-0i0G

for dave@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 15:21:07 -0700

Resent-From: The Doctor

Resent-Date: Sat, 1 Feb 2025 15:21:07 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [185.75.241.131] (port=42015 helo=betliusder.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1teLOT-000000004KC-0BAn

for sales@netknow.ca;

Sat, 01 Feb 2025 14:51:31 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=netknow.ca;

h=MIME-Version:To:From:Subject:Content-Type:Content-Transfer-Encoding; i=sales@netknow.ca;

bh=y1oO98/Rj+dxbCwdWWIcDEMU4xY=;

b=iQ1T6m82Np60Vqpq8HPoMPaUjEfmJDczve2/BvxVpidQyfOlkGKtkxhy+WoPBNWiuRXZgH9loNtL

dFCIpcbllu5wsayT3P8joibXjbOOTS8v1ElTO2stWNIo/QUv3L1ZtMXYXJKTkdXLwcAw5m5H3AP2

/Ok2lP0l9w7+zWZjGso=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=netknow.ca;

b=NjI4pcqKBxVXhqY1bc0g97KjYGjgt9O7yb9/eoXEXtNAdHxwTls89jh4xYk5XaAedim3QG4vq9ly

A23fA267ttn/7tdJIzS5Z9JPBV6uatxeHKtDuP9OeaaI/zZzAh63bmxe3/08R+faCNqnV5mLjcmD

OshicR5nDR/WAFECl+4=;

MIME-Version: 1.0

To: sales@netknow.ca

From: Sam's Club

Subject: Your Sam's Club Membership has Expired

Content-Type: text/html

Content-Transfer-Encoding: base64

X-Spam_score: 15.3

X-Spam_score_int: 153

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Congrats sales! If you no longer wish to receive these emails,

you may unsubscribe by clicking Here or by writing to 115 E 23rd St New York,

NY, US 10010



Content analysis details: (15.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.75.241.131 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in sa-accredit.habeas.com]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: wee.so]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 BASE64_LENGTH_79_INF BODY: base64 encoded email part uses line length

greater than 79 characters

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} Your Sam's Club Membership has Expired



Cgo8aHRtbD48c3R5bGU+MTAwNzYtMzI3PC9zdHlsZT4KPGJvZHk+CjxjZW50ZXI+Cgo8YSBocmVmPSJodHRwczovL3dlZS5zby9vM3VkciI+PGNlbnRlcj48aDIgc3R5bGU9ImNvbG9yOmJsYWNrIj5Db25ncmF0cyBzYWxlcyE8L2gyPjwvY2VudGVyPgo8aW1nIGJvcmRlcj0iMCIgc3JjPSJodHRwczovL3Bicy50d2ltZy5jb20vbWVkaWEvR09CSl9TU1dNQUV3dWJTP2Zvcm1hdD1wbmcmbmFtZT05MDB4OTAwIj48L2E+Cjxicj4KPGJyPgoKPGZvbnQgc2l6ZT0iMiI+Cjxicj5JZiB5b3Ugbm8gbG9uZ2VyIHdpc2ggdG8gcmVjZWl2ZSB0aGVzZSBlbWFpbHMsIHlvdSBtYXkgdW5zdWJzY3JpYmUgYnkgY2xpY2tpbmcgCjxhIGhyZWY9Imh0dHBzOi8vd2VlLnNvL3VjMDd2IiBzdHlsZT0iY29sb3I6IzAwMDBmZiI+PHU+SGVyZSA8L3U+PC9hPiBvciBieSB3cml0aW5nIHRvIDExNSBFIDIzcmQgU3QgTmV3IFlvcmssIE5ZLCBVUyAxMDAxMAo8L2ZvbnQ+Cgo8L2NlbnRlcj4KPC9ib2R5Pgo8L2h0bWw+Cgo=

Sam's Club Phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 01 Feb 2025 15:22:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1teLrT-00000000C1E-2O6A

for dave@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 15:21:11 -0700

Resent-From: The Doctor

Resent-Date: Sat, 1 Feb 2025 15:21:11 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [185.75.241.131] (port=36515 helo=betliusder.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1teLOT-000000004KB-0BHo

for doctor@nl2k.ab.ca;

Sat, 01 Feb 2025 14:51:31 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nl2k.ab.ca;

h=MIME-Version:To:From:Subject:Content-Type:Content-Transfer-Encoding; i=doctor@nl2k.ab.ca;

bh=5CmXfuSPRZs3w9on9/O67qhLrGg=;

b=J7OhDPuVSEKM3rydOy2m2nBItJfuUMireoaJRHZ9uY1R1qBSAg08XDiUr5lrcwdev9zo7IqXPr9Z

vdLxpqzYO2NpQN4xificZylbzaplWNYl+cVADMaD9xm6vmT/0ONrz/I7mh8/Gk2ACLfBJU77Rr0e

EAWAglwxB21n9Q69cgs=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nl2k.ab.ca;

b=ntCJ3W5DyPioxyZ25cw7rNEqFmdBdLx2EhZU+UUROEkYEIg+dXDMuFEAQyddrVVFEQjZ3vqRHD+H

UrvNU4BY5zzb7x0quMW0pdyZJZ+2mG7H5E+QpZeW+t33PJx4sn1ZRSA1qqlJbIkArF5rtAp87Yyy

LiCDHjyrXAKeuVtqW34=;

MIME-Version: 1.0

To: doctor@nl2k.ab.ca

From: Sam's Club

Subject: Your Sam's Club Membership has Expired

Content-Type: text/html

Content-Transfer-Encoding: base64

X-Spam_score: 14.5

X-Spam_score_int: 145

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Congrats doctor! If you no longer wish to receive these emails,

you may unsubscribe by clicking Here or by writing to 115 E 23rd St New York,

NY, US 10010



Content analysis details: (14.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in sa-accredit.habeas.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in sa-trusted.bondedsender.org]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: wee.so]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.75.241.131 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.75.241.131 listed in bl.score.senderscore.com]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 BASE64_LENGTH_79_INF BODY: base64 encoded email part uses line length

greater than 79 characters

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} Your Sam's Club Membership has Expired



Cgo8aHRtbD48c3R5bGU+MTAwNzYtMjk3PC9zdHlsZT4KPGJvZHk+CjxjZW50ZXI+Cgo8YSBocmVmPSJodHRwczovL3dlZS5zby9vM3VkciI+PGNlbnRlcj48aDIgc3R5bGU9ImNvbG9yOmJsYWNrIj5Db25ncmF0cyBkb2N0b3IhPC9oMj48L2NlbnRlcj4KPGltZyBib3JkZXI9IjAiIHNyYz0iaHR0cHM6Ly9wYnMudHdpbWcuY29tL21lZGlhL0dPQkpfU1NXTUFFd3ViUz9mb3JtYXQ9cG5nJm5hbWU9OTAweDkwMCI+PC9hPgo8YnI+Cjxicj4KCjxmb250IHNpemU9IjIiPgo8YnI+SWYgeW91IG5vIGxvbmdlciB3aXNoIHRvIHJlY2VpdmUgdGhlc2UgZW1haWxzLCB5b3UgbWF5IHVuc3Vic2NyaWJlIGJ5IGNsaWNraW5nIAo8YSBocmVmPSJodHRwczovL3dlZS5zby91YzA3diIgc3R5bGU9ImNvbG9yOiMwMDAwZmYiPjx1PkhlcmUgPC91PjwvYT4gb3IgYnkgd3JpdGluZyB0byAxMTUgRSAyM3JkIFN0IE5ldyBZb3JrLCBOWSwgVVMgMTAwMTAKPC9mb250PgoKPC9jZW50ZXI+CjwvYm9keT4KPC9odG1sPgoK

Sam's Phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 01 Feb 2025 15:22:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1teLrL-00000000C0h-0tzT

for dave@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 15:21:03 -0700

Resent-From: The Doctor

Resent-Date: Sat, 1 Feb 2025 15:21:03 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [185.75.241.131] (port=44381 helo=betliusder.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1teLOk-000000004Kp-0b5E

for root@nk.ca;

Sat, 01 Feb 2025 14:51:34 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nk.ca;

h=MIME-Version:To:From:Subject:Content-Type:Content-Transfer-Encoding; i=root@nk.ca;

bh=FhJT3bRLjqupPuqvv2lnbLmjik4=;

b=imrHI7vV12r3nXIooL7Rlwlt0/KvlUJK0NiTXACaojY1OVlaLkwxAhLX4GsY/4hHY0+Uf8fQ7VIX

6xRnfueALWL6uIjZvjtlpspmTsMyjov1Q7+nYrYFeIdIMXfeRR6aUgcvQaL3yzSfbfTUOVhU9xZL

jS9ymu3TCsyKKRQXYsM=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nk.ca;

b=IHuf5yQrmVT9oWjXER284EjscMa7EPATXPmHeX3hQVM6r27LDPmaAskOuEaGVAy1ywyyCvloFALF

TC8ZYvxRUxKEwS/8SYZWLSfgu+ZhfiLELeSNDxgHR8zrSrO1Km2EdR0cbWJTUwunDGgHRkBm4oOi

GPr8cfnL0uVHS5PigRk=;

MIME-Version: 1.0

To: root@nk.ca

From: Sam's Club

Subject: Your Sam's Club Membership has Expired

Content-Type: text/html

Content-Transfer-Encoding: base64

X-Spam_score: 18.3

X-Spam_score_int: 183

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Congrats root! If you no longer wish to receive these emails,

you may unsubscribe by clicking Here or by writing to 115 E 23rd St New York,

NY, US 10010



Content analysis details: (18.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: wee.so]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 BASE64_LENGTH_79_INF BODY: base64 encoded email part uses line length

greater than 79 characters

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} Your Sam's Club Membership has Expired



Cgo8aHRtbD48c3R5bGU+MTAwODUtMTM5Mzwvc3R5bGU+Cjxib2R5Pgo8Y2VudGVyPgoKPGEgaHJlZj0iaHR0cHM6Ly93ZWUuc28vbzN1ZHIiPjxjZW50ZXI+PGgyIHN0eWxlPSJjb2xvcjpibGFjayI+Q29uZ3JhdHMgcm9vdCE8L2gyPjwvY2VudGVyPgo8aW1nIGJvcmRlcj0iMCIgc3JjPSJodHRwczovL3Bicy50d2ltZy5jb20vbWVkaWEvR09CSl9TU1dNQUV3dWJTP2Zvcm1hdD1wbmcmbmFtZT05MDB4OTAwIj48L2E+Cjxicj4KPGJyPgoKPGZvbnQgc2l6ZT0iMiI+Cjxicj5JZiB5b3Ugbm8gbG9uZ2VyIHdpc2ggdG8gcmVjZWl2ZSB0aGVzZSBlbWFpbHMsIHlvdSBtYXkgdW5zdWJzY3JpYmUgYnkgY2xpY2tpbmcgCjxhIGhyZWY9Imh0dHBzOi8vd2VlLnNvL3VjMDd2IiBzdHlsZT0iY29sb3I6IzAwMDBmZiI+PHU+SGVyZSA8L3U+PC9hPiBvciBieSB3cml0aW5nIHRvIDExNSBFIDIzcmQgU3QgTmV3IFlvcmssIE5ZLCBVUyAxMDAxMAo8L2ZvbnQ+Cgo8L2NlbnRlcj4KPC9ib2R5Pgo8L2h0bWw+Cgo=

Sam's Club Phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 01 Feb 2025 15:22:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1teLrX-00000000C1P-1Jjd

for dave@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 15:21:15 -0700

Resent-From: The Doctor

Resent-Date: Sat, 1 Feb 2025 15:21:15 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [185.75.241.131] (port=59275 helo=betliusder.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1teLOq-000000004Kq-0vNK

for doctor@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 14:51:39 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=doctor.nl2k.ab.ca;

h=MIME-Version:To:From:Subject:Content-Type:Content-Transfer-Encoding; i=doctor@doctor.nl2k.ab.ca;

bh=9oi2UCTSIaOIwtuwOIK2V2uv0a8=;

b=JmNcEnMrgie9TOGR+oDe9cZZWQfhhtEPN/j7d8Gu6xbkzzcGHTa4uPjuWh3wrUQznyZtT7p+USpA

BseiVOGqpkOD9QQhR+rDPWFDWPhZ8Zgn+q/72xjE0DiKz6cI7MTU3OuJ/pkRHitooRpP5M3vzSHj

wGAFi2o48073e1ZWa90=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=doctor.nl2k.ab.ca;

b=ZycB4sq2I+wE4KnvhaHH8tQ0tGN5LLTQiImv12BCeQJ46RyUX0eGyg4XWZ0JXWqSXKkRM0iIAYv5

tcTF/VzUthTN+hYM7xlFq4+54n/wHK5hluZcHWUbaZq8t1DjH5sOkjca4YKc/WEVtbfPfV2eNyIG

fnVR0ku1U9Ot3GCNqN4=;

MIME-Version: 1.0

To: doctor@doctor.nl2k.ab.ca

From: Sam's Club

Subject: Your Sam's Club Membership has Expired

Content-Type: text/html

Content-Transfer-Encoding: base64

X-Spam_score: 18.3

X-Spam_score_int: 183

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Congrats doctor! If you no longer wish to receive these emails,

you may unsubscribe by clicking Here or by writing to 115 E 23rd St New York,

NY, US 10010



Content analysis details: (18.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: wee.so]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 BASE64_LENGTH_79_INF BODY: base64 encoded email part uses line length

greater than 79 characters

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} Your Sam's Club Membership has Expired



Cgo8aHRtbD48c3R5bGU+MTAwODUtMTQ2Mzwvc3R5bGU+Cjxib2R5Pgo8Y2VudGVyPgoKPGEgaHJlZj0iaHR0cHM6Ly93ZWUuc28vbzN1ZHIiPjxjZW50ZXI+PGgyIHN0eWxlPSJjb2xvcjpibGFjayI+Q29uZ3JhdHMgZG9jdG9yITwvaDI+PC9jZW50ZXI+CjxpbWcgYm9yZGVyPSIwIiBzcmM9Imh0dHBzOi8vcGJzLnR3aW1nLmNvbS9tZWRpYS9HT0JKX1NTV01BRXd1YlM/Zm9ybWF0PXBuZyZuYW1lPTkwMHg5MDAiPjwvYT4KPGJyPgo8YnI+Cgo8Zm9udCBzaXplPSIyIj4KPGJyPklmIHlvdSBubyBsb25nZXIgd2lzaCB0byByZWNlaXZlIHRoZXNlIGVtYWlscywgeW91IG1heSB1bnN1YnNjcmliZSBieSBjbGlja2luZyAKPGEgaHJlZj0iaHR0cHM6Ly93ZWUuc28vdWMwN3YiIHN0eWxlPSJjb2xvcjojMDAwMGZmIj48dT5IZXJlIDwvdT48L2E+IG9yIGJ5IHdyaXRpbmcgdG8gMTE1IEUgMjNyZCBTdCBOZXcgWW9yaywgTlksIFVTIDEwMDEwCjwvZm9udD4KCjwvY2VudGVyPgo8L2JvZHk+CjwvaHRtbD4KCg==

Sam's Club phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 01 Feb 2025 15:21:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1teLrH-00000000BzF-0Sqh

for dave@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 15:20:59 -0700

Resent-From: The Doctor

Resent-Date: Sat, 1 Feb 2025 15:20:59 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [185.75.241.131] (port=59275 helo=betliusder.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

id 1teLOk-000000004Kq-0b7W

for root@doctor.nl2k.ab.ca;

Sat, 01 Feb 2025 14:51:35 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=doctor.nl2k.ab.ca;

h=MIME-Version:To:From:Subject:Content-Type:Content-Transfer-Encoding; i=root@doctor.nl2k.ab.ca;

bh=rGNJqImXx1pwl3ENo7WGTgl8GZg=;

b=UNpb4wuwM3ZbQutIgN62TVMTO3A9uKrlTMvoNDkrvDaX/DhPBAsYSBBWfnsm0Q/Iwv8huGuD6QGd

JcqrZZv+q/4deZ/R20i1U9EvW+p9zNEIJOqByQJ7DuVkEJRPSthm0//haMsQ0AWkxAuNLiax0nZE

jxz8Ry+MfblC2n4PzL4=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=doctor.nl2k.ab.ca;

b=b+1eNSNdriy3JKawCHmaoJr1ZAKqxa5KKnVTcN8Wqd9ceYNgq9d1IUcTKZ8F79wUgh8caLSzkPTz

tfkrAxIYz+ygh7YzQVKFlyfK5rcEdMQm/Tadl+hvto5IaXY/3KnneGJjoKkSrClYbmqe6tsBD/fd

DHZ0dnFsvC9CbA3CHcU=;

MIME-Version: 1.0

To: root@doctor.nl2k.ab.ca

From: Sam's Club

Subject: Your Sam's Club Membership has Expired

Content-Type: text/html

Content-Transfer-Encoding: base64

X-Spam_score: 18.3

X-Spam_score_int: 183

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Congrats root! If you no longer wish to receive these emails,

you may unsubscribe by clicking Here or by writing to 115 E 23rd St New York,

NY, US 10010



Content analysis details: (18.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.4 MISSING_DATE Missing Date: header

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

[185.75.241.131 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.241.131 listed in dnsbl.ahbl.org]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: wee.so]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 BASE64_LENGTH_79_INF BODY: base64 encoded email part uses line length

greater than 79 characters

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} Your Sam's Club Membership has Expired



Cgo8aHRtbD48c3R5bGU+MTAwODUtMTM5NDwvc3R5bGU+Cjxib2R5Pgo8Y2VudGVyPgoKPGEgaHJlZj0iaHR0cHM6Ly93ZWUuc28vbzN1ZHIiPjxjZW50ZXI+PGgyIHN0eWxlPSJjb2xvcjpibGFjayI+Q29uZ3JhdHMgcm9vdCE8L2gyPjwvY2VudGVyPgo8aW1nIGJvcmRlcj0iMCIgc3JjPSJodHRwczovL3Bicy50d2ltZy5jb20vbWVkaWEvR09CSl9TU1dNQUV3dWJTP2Zvcm1hdD1wbmcmbmFtZT05MDB4OTAwIj48L2E+Cjxicj4KPGJyPgoKPGZvbnQgc2l6ZT0iMiI+Cjxicj5JZiB5b3Ugbm8gbG9uZ2VyIHdpc2ggdG8gcmVjZWl2ZSB0aGVzZSBlbWFpbHMsIHlvdSBtYXkgdW5zdWJzY3JpYmUgYnkgY2xpY2tpbmcgCjxhIGhyZWY9Imh0dHBzOi8vd2VlLnNvL3VjMDd2IiBzdHlsZT0iY29sb3I6IzAwMDBmZiI+PHU+SGVyZSA8L3U+PC9hPiBvciBieSB3cml0aW5nIHRvIDExNSBFIDIzcmQgU3QgTmV3IFlvcmssIE5ZLCBVUyAxMDAxMAo8L2ZvbnQ+Cgo8L2NlbnRlcj4KPC9ib2R5Pgo8L2h0bWw+Cgo=