Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 05 Mar 2026 09:57:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyBzl-00000000K3j-1NPL

for dave@doctor.nl2k.ab.ca;

Thu, 05 Mar 2026 09:56:17 -0700

Resent-From: The Doctor

Resent-Date: Thu, 5 Mar 2026 09:56:17 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [160.124.75.112] (port=51145 helo=mta75-112.mmglsmd.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vy9nK-00000000E2P-1xKv

for root@nk.ca;

Thu, 05 Mar 2026 07:35:25 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;

d=hn.threeway-pipe.com; i=@hn.threeway-pipe.com;

q=dns/txt; s=umail; t=1772721269; h=content-type :

mime-version : message-id : reply-to : subject : from :

to : date : subject : from : date;

bh=raIBl8/cH5GC2toQWVpi5z0nl1vCpVZ2VT+aj+5nX5o=;

b=J0KSqG59Raa9mGG+QTn86lZNmcq8TA4d//YX+pJh4j4djYsSAE8Jfme8

Q2TB8xtvg7EiaszVjVfnNAHhWtnSBiYNJCHtIoBSOs1C+cYFjYPbo9lAEt

XofHgeMBwQeXSGP1jl4Of0ZNDaMwq0bFs7XKAOXCBg8wzDft6QqlpaPrs=

Received: from helo (unknown [127.0.0.1])

by smtp.hn.threeway-pipe.com (Postfix) with ESMTP id paeOMgkyloXZ

for ; Thu, 05 Mar 2026 22:34:29 +0800

Content-Type: multipart/mixed; boundary="===============4047959231052551953=="

MIME-Version: 1.0

Message-Id: <20260305223429.41582-{13453:20260305222328-13453-14}-0023012@hn.threeway-pipe.com>

Reply-to: sophia@threewaysteel.com

Subject: =?utf-8?b?U2VhbWxlc3PCoHN0ZWVswqBwaXBlwqBpbsKgc3RvY2s7?=

From: Sophia-Threeway steel

To: "www.nk.ca"

Date: Thu, 05 Mar 2026 22:34:29 +0800

Mail-ID: 69a9921ce1382308b494bae4

X-Spam_score: 11.4

X-Spam_score_int: 114

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Purchasing Manager, Glad to contact with u, this is

Sophia from Threeway Steel Co., Ltd. THREEWAY STEEL PIPE CO,. LTD. is one

of the leading steel pipe manufacturer and exporter from China for more than

33years. Our products have been exported to more than 40 countries, including

Middle e [...]



Content analysis details: (11.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[160.124.75.112 listed in will-spam-for-food.eu.org]

[160.124.75.112 listed in will-spam-for-food.eu.org]

[160.124.75.112 listed in will-spam-for-food.eu.org]

[160.124.75.112 listed in will-spam-for-food.eu.org]

[160.124.75.112 listed in will-spam-for-food.eu.org]

[160.124.75.112 listed in will-spam-for-food.eu.org]

[160.124.75.112 listed in will-spam-for-food.eu.org]

[160.124.75.112 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[160.124.75.112 listed in dnsbl.ahbl.org]

[160.124.75.112 listed in dnsbl.ahbl.org]

[160.124.75.112 listed in dnsbl.ahbl.org]

[160.124.75.112 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[160.124.75.112 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[160.124.75.112 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[160.124.75.112 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[160.124.75.112 listed in dnsbl.ahbl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: ns17.xincache.com/112.80.181.45]

[URI: ns18.xincache.com/112.80.181.111]

-0.0 SPF_PASS SPF: sender matches SPF record

3.4 RATWARE_RCVD_PF Bulk email fingerprint (Received PF) found

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} =?utf-8?b?U2VhbWxlc3PCoHN0ZWVswqBwaXBlwqBpbsKgc3RvY2s7?=



Dear Purchasing Manager,



Glad to contact with u, this is Sophia from Threeway Steel Co., Ltd.



THREEWAY STEEL PIPE CO,. LTD. is one of the leading steel pipe manufacturer and exporter from China for more than 33years. Our products have been exported to more than 40 countries, including Middle east, South Asia, Africa, and South America etc......

We can meet clients demand for different standards of API, ASTM, DIN, EN, BS, JIS standard etc . And third party inspection performed, such as: BV, SGS, LOIYD, TUV, and other party alloyed by clients.



Steel Pipe, which is used widly by different industries ,such as: water delivery, structural supporter, boiler pipe, gas/oil transportation, or drilling pipe , petroleum cracking tube.... Specification as below :



Product: SMLS / ERW/ SSAW / LSAW/ STAINLESS STEEL PIPE AND FITTINGS

Grade range: Grade A, B,C / API 5L, GR.B, X42,X46,X52,X56,X60,X65,X70,X80. PSL1 , PSL2 / EN S355 / GOST 91- ASTM A672, GR.50......

Coating: anti-rust oiling, epoxy, 3LPE, FBE, coal tar epoxy, and international well-known brand coating.



Looking forward to hear your any comments about us. Your kindly reply will be highly appreciated.





​​​​​​





Best regards,

Sophia

THREEWAY STEEL CO.,LTD



Add: Hunan steel Industrial Zone, No 9 Xiangfu Road, Hunan,Changsha, China

Tel: +86-13544036536(direct line) | Fax: +86-731-88678578

Web: www.threewaysteel.com

Email: sophia@threewaysteel.com

Skype: zeng.sophia1 | whatsapp : +86 13544036536

Nigerian spam from Google Gmail Part 2

Posted by Dave Yadallee on
Content analysis details: (31.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.67 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.216.67 listed in will-spam-for-food.eu.org]

[209.85.216.67 listed in will-spam-for-food.eu.org]

[209.85.216.67 listed in will-spam-for-food.eu.org]

[209.85.216.67 listed in will-spam-for-food.eu.org]

[209.85.216.67 listed in will-spam-for-food.eu.org]

[209.85.216.67 listed in will-spam-for-food.eu.org]

[209.85.216.67 listed in will-spam-for-food.eu.org]

[209.85.216.67 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.67 listed in wl.mailspike.net]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.67 listed in dnsbl.ahbl.org]

[209.85.216.67 listed in dnsbl.ahbl.org]

[209.85.216.67 listed in dnsbl.ahbl.org]

[209.85.216.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.67 listed in dnsbl.ahbl.org]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[oceanicactivationcard707(at)gmail.com]

0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

2.5 MILLION_USD BODY: Talks about millions of dollars

0.6 J_CHICKENPOX_27 BODY: 2alpha-pock-7alpha

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 HK_NAME_MR_MRS No description available.

2.9 YOU_INHERIT Discussing your inheritance

0.0 LOTS_OF_MONEY Huge... sums of money

2.0 FILL_THIS_FORM_LONG Fill in a form with personal information

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.5 MONEY_ATM_CARD Lots of money on an ATM card

1.0 XFER_LOTSA_MONEY Transfer a lot of money

0.0 FILL_THIS_FORM Fill in a form with personal information

1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.8 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of money

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

2.2 FILL_THIS_FORM_LOAN Answer loan question(s)

0.0 MONEY_FORM Lots of money if you fill out a form

0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)

3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} YOUR ATM CARD PAYMENT IS AVAILABLE RIGHT NOW



--00000000000037f527064c46aaa4

Content-Type: text/plain; charset="UTF-8"



Head Office RUE 84, ABAPKA MISERBO

COTONOU BENIN REPUBLIC,

MR KENNEDY UZOKA.ATM CARD PAYMENT MANAGER OF THE OCEANIC,

BANK PLC COTONOU BENIN REPUBLIC.



Attention My Dear



This is to officially inform you that your (ATM Card Number;

4278763100030014) has been accredited in your favor.Your Personal

Identification Number is 2900.Your ATM Card Value is $2.6MILLION USD.You

are here by please advice to contact the ATM card payment managing



Director Mr,Kennedy Uzoka, With Details Below: Contact Person: Mr,Kennedy

Uzoka Number:cell +234-80-229-962-306 Contact Email: (

oceanicactivationcard707@gmail.com ) Fill the form below and ask Mr,Kennedy

Uzoka to activate your ATM card on your name and send it to you without any

More delay again.



FULL NAME:...................

DELIVERY ADDRESS:....................

PHONE NUMBER:....................

COUNTRY:......................

OCCUPATION:AND POSITION..........

SEX:..........

AGE:...............



Because the Central Bank of Waste African has passed an order to release

you fund (2.6 Million) into your ATM Card Account as soon as possible right

now okay. So I hope that you are still alive to receive your inheritance

fund sum of (2.6 Million)?



Thank's

Regards,

MRS.J.ODELL



--00000000000037f527064c46aaa4

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Head Office RUE 84, ABAPKA MISERBO
COTONOU BENIN REPUBL=

IC,
MR KENNEDY UZOKA.ATM CARD PAYMENT MANAGER OF THE OCEANIC,
BANK PL=

C COTONOU BENIN REPUBLIC.

Attention My Dear

This is to offici=

ally inform you that your (ATM Card Number; 4278763100030014) has been accr=

edited in your favor.Your Personal Identification Number is 2900.Your ATM C=

ard Value is $2.6MILLION USD.You are here by please advice to contact the A=

TM card payment managing

Director Mr,Kennedy Uzoka, With Details Bel=

ow: Contact Person: Mr,Kennedy Uzoka Number:cell +234-80-229-962-306 Contac=

t Email: ( oceanicact=

ivationcard707@gmail.com ) Fill the form below and ask Mr,Kennedy Uzoka=

to activate your ATM card on your name and send it to you without any More=

delay again.

FULL NAME:...................
DELIVERY ADDRESS:....=

................
PHONE NUMBER:....................
COUNTRY:..........=

............
OCCUPATION:AND POSITION..........
SEX:..........
AGE:=

...............

Because the Central Bank of Waste African has passed=

an order to release you fund (2.6 Million) into your ATM Card Account as s=

oon as possible right now okay. So I hope that you are still alive to recei=

ve your inheritance fund sum of (2.6 Million)?

Thank's
Regard=

s,
MRS.J.ODELL









--00000000000037f527064c46aaa4--

Nigerian spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 05 Mar 2026 06:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vy95q-00000000PP6-3U71

for dave@doctor.nl2k.ab.ca;

Thu, 05 Mar 2026 06:50:22 -0700

Resent-From: The Doctor

Resent-Date: Thu, 5 Mar 2026 06:50:22 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f67.google.com ([209.85.216.67]:59443)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vy8UP-00000000Ns2-03t5

for root@mail.nl2k.ab.ca;

Thu, 05 Mar 2026 06:11:54 -0700

Received: by mail-pj1-f67.google.com with SMTP id 98e67ed59e1d1-3598b95ad7dso3336618a91.2

for ; Thu, 05 Mar 2026 05:10:54 -0800 (PST)

ARC-Seal: i=1; a=rsa-sha256; t=1772716248; cv=none;

d=google.com; s=arc-20240605;

b=Ufe9Pch+4obKNCtzyFR0D3z25yQEXdgZKOvIX5UCBIODjOxg+ibl5jRhyzRhD9c/9a

3GtNCZw+zin8WezClts7gNYoZp/QhU6YxJmfODVuSbv1vd7LLVNV5okyN3UB0l1aBUtw

KsgzsZgRLQSXnGPbCbw2oEFTaVvCxSZhIrwzafeyfiC/jAqeB5CDOKpMAMUxD17xq/nE

sLbnEfwa+N00hm4TNUH7+AM5Ql0Y0/uZMFs3HkFwoOmgRQDOoenHcwj2z9iFTtDXmayy

RAbXyoqp7EWhYTi7B9ntvGLdRY07+Mmv/eaoZ4r01KJYPaWjn2fzhep57ZLMFnHsrx1f

VIsQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=t5Mk9FQvXhd7FhN+q8ouSltWWOnQAmpWfLUiUJxZic4=;

fh=WhMq0isAex+jI/PYg5XqwYOecBiWT3JBwCtZTrHFMM8=;

b=W6LgD6jgeXd1z1qYjZTl8E03yjn6WoRM+CfbkTbQ4VfsdAw8lIbzLqMSbFcJPCsaDr

HfoziazToOii1rn5jket4UIP4zR5tyLI98RcdP7Xu5JoKB3vHu6cgokJiFlh3TnanN1E

ns+2WW9GBJydtKzeK69JOfyiwoU70ilVUY3T/FAArJrCDOf/LnTq5PQWdU/pz0gc8gOC

orCKwj2vFRasNgErxpmvqqQSbBfxgLgc0VYru3eccajz61G6iprfjbTtaqnEThARADsV

wMmhKxyguM+KikT8DvmHkgsKeO1iBRlpCwJrcwNjaNZZ+u4VEz2e/RmnsZF0wybrSLiF

w2ug==;

darn=mail.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=jkw-ac-th.20230601.gappssmtp.com; s=20230601; t=1772716248; x=1773321048; darn=mail.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=t5Mk9FQvXhd7FhN+q8ouSltWWOnQAmpWfLUiUJxZic4=;

b=WI1DrzqU6aOm6UMO2X4MOdj8QZAJYsgON2yY5hDlwBuOBoaI/M1WYqGFxQ4ZsJm4Kz

PCtxOpiyWGGbWuW2/dFPrNwFZD9HMOVL1tLCjAoxFXyc5O4gN/4Pzyx64aqdi1Mmd5ao

wGLq+NtfgXfUnCyfUiHwMy13nHNBYAvyzrlHTxo7zDbNOpowZL2+q1C+qfSj8YIxVXyg

QsGkYQScAGeULZKE4Vqy//Sm97evGXgKuWMegWU0QZ4VUVBRKLklNpTx8vaQI/WekFsy

M57B8ikP3cDTobh/XBWnDI66buxwaMnTZvDVlKhXsazb+yZVzoOBXCA3evQuO3z5PmF6

kF/w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772716248; x=1773321048;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=t5Mk9FQvXhd7FhN+q8ouSltWWOnQAmpWfLUiUJxZic4=;

b=GffjtxFgXzhPgQ8eTL5SnYPKVbfmjf/SMAfw9Y923Bs0tpKEyj5mBbMBqsmpGnJI9N

E/tHlPr8P63JIhAkkXf+gYc/YZtOyLQefcgQlP0OlXOcs6SKjn4tmPtuEJCqAMTT8jD1

LuAlps7esQGARuBcseUf2iZidfD/mot4Vu63ZMGzIMFqlrUYrBZeNQml7BD2YdRvced4

xbFMJ4uAxsmrJ0SJiySR5YhPEX31+S6BTJytqbc2a/4iT5ezhgz2OtJs/k5L/3f33jGh

TTU/2yQ1RuvpJMolJt63SKJikYLEYpSIuGCEBjhPBFDCvsz9ONZED7WJ6rPYoUf08XX0

UzPA==

X-Forwarded-Encrypted: i=1; AJvYcCWeKKZaLxjK3EfNhy3y8EKtkg0f3H4Dx24vLDKt5NXdA1+QaCR6NnKWsdPvlMZe9QC0JGx+@mail.nl2k.ab.ca

X-Gm-Message-State: AOJu0YzoLwTofMJNYCPaGW9C3VZOuGhmMW0wS5DLFFLZZPK/vy8gthjM

6FdDdd2XZBrzWD6z7w3S8GFR4K6KCpTc9GdromsCAI7vqBaovh+hstOIBSMLAx2DnfxeyzEVVez

uYqZho/EnNxE606lkk90odme/TKnVoWQZj402Biwo3Q==

X-Gm-Gg: ATEYQzyRKGH8QHSYuxSCitwXA/DdBAdnCC3eNlJ5ui/fqShHc+BOhd2iLWkt9dqxYLy

rfnhY4kVUdr9TbLWgZ5Jd0H29te8fxJkrCP5f79LaUoiAVNtkODcQCo4vEsbus/ynbuK2MBgDEr

mgwIf5SLK9TlgQ2gimoTSVN0xb7d5iwnY/jnEV3vXDn45ccsJDj4oJMLcIG39SuJ5pMWDWd76l2

12r8V7McBnHoHC+YjOHyIzA5FVNYmEaqqOqjZwumTrK9mKvFuM8yCRtjri8Gf8aviSxbcruqCzw

Joce4Mkw5g==

X-Received: by 2002:a17:90b:5109:b0:359:1130:1047 with SMTP id

98e67ed59e1d1-359a6a421b3mr6759962a91.17.1772716247471; Thu, 05 Mar 2026

05:10:47 -0800 (PST)

MIME-Version: 1.0

Reply-To: oceanicactivationcard707@gmail.com

From: "MRS.J.ODELL"

Date: Thu, 5 Mar 2026 05:10:37 -0800

X-Gm-Features: AaiRm51GRJ8agCyfbotYf-Mq2oCvkvRu0VBEP-aZd5XRdWIy1pdMV1xRt9yMCnE

Message-ID:

Subject: YOUR ATM CARD PAYMENT IS AVAILABLE RIGHT NOW

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000037f527064c46aaa4"

Bcc: root@mail.nl2k.ab.ca

X-Spam_score: 31.1

X-Spam_score_int: 311

X-Spam_bar: +++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Head Office RUE 84, ABAPKA MISERBO COTONOU BENIN REPUBLIC,

MR KENNEDY UZOKA.ATM CARD PAYMENT MANAGER OF THE OCEANIC, BANK PLC COTONOU

BENIN REPUBLIC. Attention My Dear This is to officially inform you that your

(ATM Card Number; 4278763100030014) has been accredited in your favor.Your

Personal Identification Number is 2900.Your ATM Card Value is $2.6MILLION

USD.You [...]

Online training spam from Google Gmail Part 2

Posted by Dave Yadallee on
Mailing-list: list 5mar@appsthinkers.com; contact 5mar+owners@appsthinkers.com

List-ID: <5mar.appsthinkers.com>

X-Spam-Checked-In-Group: 5mar@appsthinkers.com

X-Google-Group-Id: 732452389763

List-Post: ,

List-Help: ,



List-Archive:

List-Subscribe: ,



List-Unsubscribe: ,



X-Spam_score: 5.6

X-Spam_score_int: 56

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, We’re a tech development company offering custom solutions

across mobile, web, and enterprise platforms. From smart automation to immersive

AR/VR and scalable ERP/CRM systems, we help businesses acr [...]



Content analysis details: (5.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.208.72 listed in will-spam-for-food.eu.org]

[209.85.208.72 listed in will-spam-for-food.eu.org]

[209.85.208.72 listed in will-spam-for-food.eu.org]

[209.85.208.72 listed in will-spam-for-food.eu.org]

[209.85.208.72 listed in will-spam-for-food.eu.org]

[209.85.208.72 listed in will-spam-for-food.eu.org]

[209.85.208.72 listed in will-spam-for-food.eu.org]

[209.85.208.72 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.72 listed in dnsbl.ahbl.org]

[209.85.208.72 listed in dnsbl.ahbl.org]

[209.85.208.72 listed in dnsbl.ahbl.org]

[209.85.208.72 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.72 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.72 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.72 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.72 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.72 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[yadhavnishi8(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.72 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} AR/VR Training & Demos Solution...



--000000000000a6d88c064c46a661

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,



We=E2=80=99re a tech development company offering custom solutions across m=

obile,

web, and enterprise platforms. From smart automation to immersive AR/VR and

scalable ERP/CRM systems, we help businesses across industries digitize,

grow, and operate more efficiently through powerful, user-focused

applications.



We build apps for:



=E2=80=A2 AI & Automation

=E2=80=A2 AR/VR Training & Demos

=E2=80=A2 ERP & CRM Workflows

=E2=80=A2 Healthcare, Education, Real Estate

=E2=80=A2 Delivery, Restaurant, Retail

=E2=80=A2 Fitness, Events, Finance

=E2=80=A2 Inventory, POS, Chat, Booking



Let me know what you=E2=80=99re working on.





Thanks & Regards Nishi



--000000000000a6d88c064c46a661

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




eight:115%;font-size:11pt;font-family:Calibri,"sans-serif"">Hi,
p>




ize:11pt;font-family:Calibri,"sans-serif"">We=E2=80=99re a tech d=

evelopment company offering custom solutions

across mobile, web, and enterprise platforms. From smart automation to

immersive AR/VR and scalable ERP/CRM systems, we help businesses across

industries digitize, grow, and operate more efficiently through powerful,

user-focused applications.






ize:11pt;font-family:Calibri,"sans-serif"">We build apps for:<=

/b>





=E2=80=A2 AI & Automation


=E2=80=A2 AR/VR Training & Demos


=E2=80=A2 ERP & CRM Workflows


=E2=80=A2 Healthcare, Education, Real Estate


=E2=80=A2 Delivery, Restaurant, Retail


=E2=80=A2 Fitness, Events, Finance


=E2=80=A2 Inventory, POS, Chat, Booking






ize:11pt;font-family:Calibri,"sans-serif"">Let me know what you=

=E2=80=99re working on.






ize:11pt;font-family:Calibri,"sans-serif"">Thanks

&=C2=A0Regards


Nishi






ize:11pt;font-family:Calibri,"sans-serif"">=C2=A0





--000000000000a6d88c064c46a661--

Online training spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path: <5mar+bncBCOY3AFKVEFRBHUBU3GQMGQEY7HUL2Y@appsthinkers.com>

Envelope-to: dave@nk.ca

Delivery-date: Thu, 05 Mar 2026 06:13:40 -0700

Received: from mail-ed1-f72.google.com ([209.85.208.72]:52269)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from <5mar+bncBCOY3AFKVEFRBHUBU3GQMGQEY7HUL2Y@appsthinkers.com>)

id 1vy8VX-00000000NxE-0Xfg

for dave@nk.ca;

Thu, 05 Mar 2026 06:13:01 -0700

Received: by mail-ed1-f72.google.com with SMTP id 4fb4d7f45d1cf-660a2f72cccsf2929383a12.0

for ; Thu, 05 Mar 2026 05:12:04 -0800 (PST)

ARC-Seal: i=3; a=rsa-sha256; t=1772716317; cv=pass;

d=google.com; s=arc-20240605;

b=OXFS96j2kGvSvPY4LLtt8fgDm2aIVIA33nrjP5TDinp56hAlvBsMG0gC22+hs0zm89

+g08XIInQ7+tpBw5WGTHQiWlXhs/bVtEfW7hLiumAhJhxMki4Z4vbU75pHNdS+Xrrc4Y

nKJfdaPD5nj2WjCC7MorqOJJiFWKLF4pFQY0Zi9kc1E8EUFLCFTHPi7XL/p9Hqaa17qv

A7KxgpHAOWJhEDHrbth2+Qw4FlBE3m7OSA7Za9IixDxS19aX7H8ueCg5NffD2/UrCP3T

7ZOn12hA91ha/mQMMnD8v5hm6dLOhmGaRR1Ary2lYNLMP7PEH9pjwcCQ3E3st2SNOYtp

WYaw==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:to:subject:message-id:date:from

:mime-version:dkim-signature;

bh=w1XdZMl4Y2vQo00eThf15iUo7GEwxhedpiYae9uy5dQ=;

fh=t4cCJdl+QxiXKc10U/RaNL9H/o4AURbyN492ZUZvsrk=;

b=Z33vY3vD+Cw8RyeNOXuIXIzDNv5H2MNx0PBRdsCWbAXiunosnJQVv3ZjsE5r3X/SgI

mSrbt7KcSX4s9XzmrUoMZYXbHO0DVulaJrEqYFXRVyZvtBwzF5M1TpOCVn6+Mh8pLSGM

q/poPvCisLaPI85XQn3+bwSDKlj9ZexQoQGhKckS0/XHROBv73tqsvwaLypHTYklyyh9

qBtYiOlZHEvxchSIXupy25d2fDddC8lDFB8ZCZVdFYwDs2cN/8qLf5M6HJLY4r9gEFK0

Lrv2b/SOgFUxjd2FU0IdwXxXDMqp6IkhMLF44WSnr1cGCEoZpGFOgiQphW70FKiD0ILk

ktmg==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20230601 header.b=Erzkzs4W;

arc=pass (i=1);

spf=pass (google.com: domain of yadhavnishi8@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=yadhavnishi8@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@appsthinkers.com

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=appsthinkers-com.20230601.gappssmtp.com; s=20230601; t=1772716317; x=1773321117; darn=nk.ca;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:x-original-authentication-results

:x-original-sender:to:subject:message-id:date:from:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=w1XdZMl4Y2vQo00eThf15iUo7GEwxhedpiYae9uy5dQ=;

b=GJ+tz0iSGA1yV2RydhmIhMp4IqWMeXuJxAjS/Ln9mrKt6Q3VOOsO4zPWDawNqQFTLu

dvMxNbaxbsVC2CZnB6PYKGVMXyi7AMLetfOpXgVWkikCGB63Hllhja0jsCvbwlrA460N

/04PgL3iGy4LCIKFvdIQSXQnoTLUU9eDiAikAfcxntrW4bzNLBrF3HhJ/cct8fRZWSCw

jlaEt+wl+B/fu1OCYbbmrsZ86C2AGGzkRyjPWPjucfgSpIPyw/NXK1BndneTsXxkuJTT

ILwI45EqYCAPzn0pDMuB6OEYnXMTGF4m4QDi+tZk121S7CJVlrqPG1IPwBhVkG5sIF6W

RBlg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772716317; x=1773321117;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence

:x-original-authentication-results:x-original-sender:to:subject

:message-id:date:from:mime-version:x-gm-gg:x-beenthere

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=w1XdZMl4Y2vQo00eThf15iUo7GEwxhedpiYae9uy5dQ=;

b=veyeBivWRcF4AJT94x/jhbKbedvk09SPCyplvazDHMhT88R7nm06WcnRQ/CZIT33Zm

N70oSLucUam9UsfkUTlnTcgOha40XZ/QLQ78t4Rez17Rc8jqH4vFPA8oPtS0Sy48abuY

aAxsxIbwbo6wdnfAK+FNXFxl8pHOBVHePPzbLbEDkrtpB+n7cg9Jqg6FvqDnLiwQ61GY

II+eY7YkC4ctpD4l+w73wJd1cvMJdIqFG44k4WETJ3sCZeCgTU4YiCWqdLyBV3xNBPvH

ZXtLmI6882sUyZtmXp33Ssc6NluU58/l9pmSr8rRttJzZnWlZumYFGFhipoYrKfYVdzb

vEKg==

X-Forwarded-Encrypted: i=3; AJvYcCWbP/emVNHb2z0fmVREsZh46LPOTUFw0SaYOICVInV05SbbiUKodjiT7QqJF2TKQinAtoef@nk.ca

X-Gm-Message-State: AOJu0Yyx2WyuZkF4zrvn08jE2THrPuprMAwAbtqIb5prj28Liz6CwNKR

+0zZlwXSDmlzkFvEBKrB5H+QUWqv7tEGSbkYS4RAk5HncosZH2pBmSMoD1+NT12N1gs=

X-Received: by 2002:a05:6402:4304:b0:660:d586:c2f7 with SMTP id 4fb4d7f45d1cf-660ef786876mr3270489a12.4.1772716316857;

Thu, 05 Mar 2026 05:11:56 -0800 (PST)

X-BeenThere: 5mar@appsthinkers.com; h="AV1CL+G7BkdbOVsg+FhN1pkfKOWrxsbnsgdWiKCIEVEUEe72JA=="

Received: by 2002:a05:6402:3889:b0:65a:41f6:7002 with SMTP id

4fb4d7f45d1cf-6612fc8a89als917841a12.2.-pod-prod-05-eu; Thu, 05 Mar 2026

05:09:49 -0800 (PST)

X-Forwarded-Encrypted: i=3; AJvYcCXjjH2LmlVeQPOzTF9ahX4lrPGdJR8ejHhVHPhXFKkrrzkTxGsLNHZGY2wEDcbPcGNENU3n@appsthinkers.com

X-Received: by 2002:a17:907:5cb:b0:b8a:f225:edde with SMTP id a640c23a62f3a-b93f14101d4mr343396366b.45.1772716188678;

Thu, 05 Mar 2026 05:09:48 -0800 (PST)

ARC-Seal: i=2; a=rsa-sha256; t=1772716188; cv=pass;

d=google.com; s=arc-20240605;

b=SRpM4mi2Nvkqp5zHtdCaNmJo0TprrqrFdtvnaxBPYt/d3Un7Q8jWurCQwuxXiqvbSn

dfyHGRIfluka3G/96/TaMv8ZYUwm7oMaJZAft3WGuoHyrakwL8dJ08tUAvuns6JUAjlj

83qLMg0WGMkg4EOXiWj+4/PtlvQWQ8J/Q1x81LhbZ2kUel+bg0bE38mKxpGfoVJRwacM

iHSxJyCMlv2zyt5uU0JVmpq+S5PVya+/EaPesMJkI2kKfGNJHLpbi5po7uQkmU3ACsEh

R12GOgUOqJQlTCetpmMseDvZgLrkNwHaEdaM8WqPwW8jEQWuG7z+yehbS7atO0z6PRwp

X8ew==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=w1XdZMl4Y2vQo00eThf15iUo7GEwxhedpiYae9uy5dQ=;

fh=IJk5bYzSO5t0ULnCztC0ulYCF5VeB9hizDGiiOZ/nuo=;

b=WPDZRb391ldzSZY07Jnoej03AJg9ozDKrMXETNf6lt60kTESbH2gNKYoR+6uyrm6wP

hoRwXxgYUB0U6miPekmfP60zKrs1+EZ1VlXoTpRzfsIgPvDTG7aImsTCgsmi3N3LAk9y

m4qDG/cG/gSv6GC3yQVeJyifKSq+V7fQueDagVBskclQov8Q8VMB1x8n2AbXveIJ+YE5

jXTJrP0pA8kFSTodNL2vThkpK8xXt3ooU5tjsc+jpdGtrY/+OqAr7ZPJL61RCsf04jLw

BvYu6KqTze/IYNp3h/jpU+diT/XMc67Kg8TQvBlFUPXKcZvxfqXdAJpE0bIUD+qlmLlb

Izig==;

dara=google.com

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20230601 header.b=Erzkzs4W;

arc=pass (i=1);

spf=pass (google.com: domain of yadhavnishi8@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=yadhavnishi8@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@appsthinkers.com

Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])

by mx.google.com with SMTPS id a640c23a62f3a-b935a91f0e8sor474529666b.7.2026.03.05.05.09.48

for <5mar@appsthinkers.com>

(Google Transport Security);

Thu, 05 Mar 2026 05:09:48 -0800 (PST)

Received-SPF: pass (google.com: domain of yadhavnishi8@gmail.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;

ARC-Seal: i=1; a=rsa-sha256; t=1772716188; cv=none;

d=google.com; s=arc-20240605;

b=LTz+QfvBxvsZbuwdSYzHzjsoR0zRPbFW42DBla+jF+LfGDcql7ZU7omYndf1iUZxNI

nz15iXgyFzB+9Tb2oZPJUgu3/T6Za9U+OaiJLqG0xUDI66WfMA12HbrFYMNJ7RBxC/u8

mCt+YuH9yUhLYw5pwJJ3DTnUawtF8tmKdyd53iVfuwNPLUPPvp3spuMm6N76ZWkEiuMe

QVqoxXcCANlbcInlVPan66AGv0PAje2a4DOHyoHiYhih4NgsX924RtMN+mG3xl7brAj6

P+7fo7MpxwYHApxMvRbIn2aWKSnOABzas0W3+eW8p10CgCThbRFzM0zmR7pwwPz7/R7o

6T0Q==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=w1XdZMl4Y2vQo00eThf15iUo7GEwxhedpiYae9uy5dQ=;

fh=IJk5bYzSO5t0ULnCztC0ulYCF5VeB9hizDGiiOZ/nuo=;

b=CfsU/elniEOBr6QLFiPjwA12BY08NFxsy8Zl+wbaYtRyXlGy9wnhItPCJf1C416SUR

xZXai5cnWTuozaPxR+j8SCsltxNuPQzWB4B3AreSIr2hxX8mmlBg+02gwd9nMU/WWx9H

wkeBbMx6+p8//0UKa6LU4E+E0dOuksYtphqM6UF+IlwLIq2OfeXcMOkuRpEujO+SOfsy

wbxLVc3BKhuKmidf7uSINURxwSjYcjfUWLjF649Rojj+GdLp7W2bFtPirDPYaVpddSyw

Z2DqaVng2r7vM+xfA2AHrmSgruOlnwtlxRCRnKsUyNdvf+d5xQEQLcw0XKiXkN7pvGO/

iXFA==;

darn=appsthinkers.com

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Forwarded-Encrypted: i=1; AJvYcCWY9JMSpGjAe/YFIyXi9/zOqxSC/UEuHoF6eyIPQzn6V6NROoONqfj11/0Vd+FpM4Iqzd8s@appsthinkers.com

X-Gm-Gg: ATEYQzxWplriCDk2V+UgB7KSgKNh78eSW0HQIzD9iezlL7Vdz4waNO2f6bPikngMiQT

FlJ2skGDfZ2SR4osFZI8MHRhuJEbDL0BXQK2tgtxMtTSR3T6A7zPDjBtst1apvX7izq/Ws0cQQG

PdEAz2d9dDp6AubYlBucQRjIXnE9nBTDVfwAAFXm3fg6ncCvVMuNaeEfKFYW2QpLcMQ8ptIxmvC

3A1R61GDYEEW/4L1mQ/qFyBuTXMxM8AYVxWuTZ1r7DppxOnycWIvKcqP0u9U+FYaz3lrlqdgyg0

GvbekXfQSgLY3Mt0PUvAHKD5PWKVdMmsxxTzytw=

X-Received: by 2002:a17:907:94c2:b0:b87:2bd6:6bc3 with SMTP id

a640c23a62f3a-b93f156d7c0mr371665466b.61.1772716187636; Thu, 05 Mar 2026

05:09:47 -0800 (PST)

MIME-Version: 1.0

From: nishi yadav

Date: Thu, 5 Mar 2026 18:39:36 +0530

X-Gm-Features: AaiRm50MkKuIdF-dWdCRTrm_Mh3dhhTgw6dlFHwSfg8x3CIBkoxqnq1LH6xaJeU

Message-ID:

Subject: AR/VR Training & Demos Solution...

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000a6d88c064c46a661"

Bcc: 5mar@appsthinkers.com

X-Original-Sender: yadhavnishi8@gmail.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@gmail.com header.s=20230601 header.b=Erzkzs4W; arc=pass

(i=1); spf=pass (google.com: domain of yadhavnishi8@gmail.com

designates 209.85.220.41 as permitted sender) smtp.mailfrom=yadhavnishi8@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@appsthinkers.com

Precedence: list

Scotiabank Phish Part 2

Posted by Dave Yadallee on
--1ea0096474420215216603ae4b210a2e5

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable







=09





=C2=A0








style=3D"font-style: inherit; font-variant-ligatures: inherit; font-varian=

t-position: inherit; font-variant-caps: inherit; font-variant-numeric: inhe=

rit; font-variant-alternates: inherit; font-variant-east-asian: inherit; fo=

nt-weight: inherit; font-stretch: inherit; font-size: inherit; line-height:=

inherit; font-family: Arial, sans-serif; font-optical-sizing: inherit; -we=

bkit-font-kerning: inherit; font-feature-settings: inherit; font-variation-=

settings: inherit; margin: 40px auto; border-top-left-radius: 10px; border-=

top-right-radius: 10px; border-bottom-right-radius: 10px; border-bottom-lef=

t-radius: 10px; box-shadow: rgba(0, 0, 0, 0.1) 0px 8px 20px; overflow: hidd=

en; transform: scale(0.751667, 0.751667); transform-origin: left top; backg=

round-position: initial initial; background-repeat: initial initial;" width=

=3D"600">

=09
just: auto;">

=09=09

=09=09=09

=09=09

=09


.6;">

=09=09=09

3D""
"External" data-olk-copy-source=3D"MessageBody" src=3D"https://logos-world.=

net/wp-content/uploads/2021/03/Scotiabank-Emblem.png" style=3D"border: 0px;=

font-family: inherit; font-size: inherit; font-style: inherit; font-varian=

t-caps: inherit; font-weight: inherit; font-stretch: inherit; line-height: =

inherit; margin: 0px; padding: 0px; vertical-align: baseline; color: inheri=

t; width: 150px; height: 84px;" />





=09=09=09

=C2=A0





=09=09=09

Date:=C2=A005 =

mars=C2=A02026





=09=09=09

Reference ID:=

=C2=A0SCB-9472-SEC-2026CA





=09=09=09

Dear Customer,





=09=09=09

We would like to inform you that a secure message containing im=

portant updates regarding your account has been sent to you.





=09=09=09

For your protection, we use secure messaging to promptly notify=

you of any changes or activities related to your account security.





=09=09=09


-linkindex=3D"0" href=3D"https://www.askanadventistfriend.com/wp-includes/c=

a/a/" rel=3D"noopener noreferrer" style=3D"border: 0px; font-style: inherit=

; font-variant-ligatures: inherit; font-variant-position: inherit; font-var=

iant-caps: inherit; font-variant-numeric: inherit; font-variant-alternates:=

inherit; font-variant-east-asian: inherit; font-weight: bold; font-stretch=

: inherit; font-size: inherit; line-height: inherit; font-family: inherit; =

font-optical-sizing: inherit; -webkit-font-kerning: inherit; font-feature-s=

ettings: inherit; font-variation-settings: inherit; margin: 0px; padding: 1=

4px 35px; vertical-align: baseline; background-color: rgb(215, 25, 32); col=

or: rgb(255, 255, 255); text-decoration-line: none; border-top-left-radius:=

6px; border-top-right-radius: 6px; border-bottom-right-radius: 6px; border=

-bottom-left-radius: 6px; display: inline-block;" target=3D"_blank" title=

=3D"https://shorturl.at/pk5M1">View Secure Message





=09=09=09

This secure message contains sensitive information regarding yo=

ur banking account. Please sign in to your online banking portal to review =

the complete details.





=09=09=09

Thank you for choosing our banking =

services.





=09=09=09

=C2=A0



=09=09=09












--1ea0096474420215216603ae4b210a2e5--

Scotiabank Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 05 Mar 2026 06:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vy95f-00000000POa-1QTf

for dave@doctor.nl2k.ab.ca;

Thu, 05 Mar 2026 06:50:11 -0700

Resent-From: The Doctor

Resent-Date: Thu, 5 Mar 2026 06:50:11 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [91.212.52.120] (port=42562 helo=mybeautyshop.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vy8M5-00000000NW0-1Lj0

for sales@nk.ca;

Thu, 05 Mar 2026 06:03:13 -0700

Received: by mybeautyshop.com (Postfix, from userid 1000)

id F06538560635; Thu, 5 Mar 2026 14:00:26 +0100 (CET)

Date: Thu, 5 Mar 2026 14:00:14 +0100

To: sales@nk.ca

From: =?UTF-8?B?U2NvdGlhQmFuay4=?=

Subject: =?UTF-8?B?SW1wb3J0YW50OiBTZWN1cmUgTWVzc2FnZSBSZWdhcmRpbmcgWW91ciBBY2NvdW50ICE=?=

Message-ID: <42554eee45ec228d1ba7264757341471@mybeautyshop.com>

List-Unsubscribe: mailto:bounce851-uq8lba1iDfqT28r@mybeautyshop.com?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1ea0096474420215216603ae4b210a2e5"

Content-Transfer-Encoding: 8bit

X-Spam_score: 14.4

X-Spam_score_int: 144

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Date: 05 mars 2026 Reference ID: SCB-9472-SEC-2026CA



Content analysis details: (14.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.212.52.120 listed in will-spam-for-food.eu.org]

[91.212.52.120 listed in will-spam-for-food.eu.org]

[91.212.52.120 listed in will-spam-for-food.eu.org]

[91.212.52.120 listed in will-spam-for-food.eu.org]

[91.212.52.120 listed in will-spam-for-food.eu.org]

[91.212.52.120 listed in will-spam-for-food.eu.org]

[91.212.52.120 listed in will-spam-for-food.eu.org]

[91.212.52.120 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.212.52.120 listed in dnsbl.ahbl.org]

[91.212.52.120 listed in dnsbl.ahbl.org]

[91.212.52.120 listed in dnsbl.ahbl.org]

[91.212.52.120 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.212.52.120 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.212.52.120 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.212.52.120 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.212.52.120 listed in dnsbl.ahbl.org]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

3.0 URI_WP_DIRINDEX URI for compromised WordPress site, possible malware

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.2 TVD_PH_SUBJ_META1 Email has a Phishy looking subject line

2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware

Subject: {SPAM?} =?UTF-8?B?SW1wb3J0YW50OiBTZWN1cmUgTWVzc2FnZSBSZWdhcmRpbmcgWW91ciBBY2NvdW50ICE=?=



This is a multi-part message in MIME format.



--1ea0096474420215216603ae4b210a2e5

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit













Â

















Â



Date: 05 mars 2026



Reference ID:Â SCB-9472-SEC-2026CA



Dear Customer,



We would like to inform you that a secure message containing important updates regarding your account has been sent to you.



For your protection, we use secure messaging to promptly notify you of any changes or activities related to your account security.



View Secure Message



This secure message contains sensitive information regarding your banking account. Please sign in to your online banking portal to review the complete details.



Thank you for choosing our banking services.



Â













Teradata spam from Google Gmail Part 2

Posted by Dave Yadallee on


This is a multipart message in MIME format.



------=_NextPart_000_06B2_01DCACB4.CAD10920

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable



Hi,



=EF=BF=BD



Hope you=E2=80=99re doing well.



=EF=BF=BD



Just wanted to check and see if you have received my email and have =

update for me?



=EF=BF=BD



Awaiting for your response.



=EF=BF=BD



Regards,=20



Melissa



=EF=BF=BD



From: melissa.mertz@targetexelist.com =20

Sent: Wednesday, February 25, 2026 4:26 PM

To: 'dave@doctor.nl2k.ab.ca'

Subject: Targeted Teradata Users Info



=EF=BF=BD



Hi,



=EF=BF=BD



Are you interested in the contact information of Teradata Users across =

UK and Europe?



=EF=BF=BD



If interested, let me know your target geography: ___? so that I can get =

back to you with Counts, Pricing and more information.



=EF=BF=BD



Note: We can also provide contacts based on your specific requirements =

from any industry.



=EF=BF=BD



Look forward for your response.



=EF=BF=BD



Regards



Melissa Mertz



Database Coordinator



=EF=BF=BD



"You would prefer not to receive further emails from us, please reply =

with "Leave Out" in the subject line.





------=_NextPart_000_06B2_01DCACB4.CAD10920

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
http-equiv=3DContent-Type content=3D"text/html; charset=3Dutf-8">
name=3DGenerator content=3D"Microsoft Word 15 (filtered =

medium)">
link=3D"#0563C1" vlink=3D"#954F72">


class=3DMsoNormal>
style=3D'font-size:10.5pt'>Hi,


class=3DMsoNormal>
style=3D'font-size:10.5pt'> 


class=3DMsoNormal>Hope you=E2=80=99re =

doing well.


style=3D'font-size:10.5pt'> 


class=3DMsoNormal>Just wanted to check =

and see if you have received my email and have update for =

me?


style=3D'font-size:10.5pt'> 


class=3DMsoNormal>Awaiting for your =

response.


style=3D'font-size:10.5pt'> 


class=3DMsoNormal>Regards, =


style=3D'font-size:10.5pt'>Melissa


class=3DMsoNormal>
style=3D'font-size:11.0pt'> 


style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in =

0in 0in'>


style=3D'font-size:11.0pt;mso-ligatures:none'>From:
style=3D'font-size:11.0pt;mso-ligatures:none'> =

melissa.mertz@targetexelist.com <melissa.mertz@targetexelist.com> =


Sent: Wednesday, February 25, 2026 4:26 PM
To: =

'dave@doctor.nl2k.ab.ca' =

<dave@doctor.nl2k.ab.ca>
Subject: Targeted Teradata =

Users Info


class=3DMsoNormal> 


style=3D'font-size:10.5pt;color:#002060'>Hi,


class=3DMsoNoSpacing>
style=3D'font-size:10.5pt;color:#002060'> 


class=3DMsoNoSpacing>Are =

you interested in the contact information of Teradata Users =

across UK and Europe?


class=3DMsoNoSpacing> 


style=3D'font-size:10.5pt;color:#002060'>If interested, let me know your =

target geography: ___? so that I can get back to you with Counts, =

Pricing and more information.


class=3DMsoNoSpacing> 


class=3DMsoNoSpacing>
style=3D'font-size:10.5pt;color:#002060'>Note:
style=3D'font-size:10.5pt;color:#002060'> We can also provide contacts =

based on your specific requirements from any =

industry.


class=3DMsoNoSpacing> 


style=3D'font-size:10.5pt;color:#002060'>Look forward for your =

response.


class=3DMsoNoSpacing> 


style=3D'font-size:10.5pt;color:#002060'>Regards


class=3Dxmsonormal =

style=3D'margin:0in;margin-bottom:.0001pt;background:white'>
style=3D'font-size:10.5pt;font-family:"MV =

Boli";color:#242424;border:none windowtext 1.0pt;padding:0in'>Melissa =

Mertz
style=3D'font-size:10.5pt;font-family:"Calibri",sans-serif;color:#242424'=

>


style=3D'font-size:10.5pt;color:#ED7D31'>Database =

Coordinator


style=3D'font-size:10.5pt;color:#002060'> 


class=3DMsoNoSpacing>
style=3D'font-size:9.0pt;color:#B4C6E7'>"You would prefer not to =

receive further emails from us, please reply with "Leave Out" =

in the subject line.



------=_NextPart_000_06B2_01DCACB4.CAD10920--



Teradata spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 05 Mar 2026 03:05:00 -0700

Received: from mail-wr1-f42.google.com ([209.85.221.42]:51572)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vy5ZX-000000007Mq-1Dng

for dave@doctor.nl2k.ab.ca;

Thu, 05 Mar 2026 03:04:57 -0700

Received: by mail-wr1-f42.google.com with SMTP id ffacd0b85a97d-439bcec8613so2929364f8f.3

for ; Thu, 05 Mar 2026 02:04:00 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=targetexelist.com; s=google; t=1772705033; x=1773309833; darn=doctor.nl2k.ab.ca;

h=disposition-notification-to:content-language:thread-index

:mime-version:message-id:date:subject:in-reply-to:references:to:from

:return-receipt-to:from:to:cc:subject:date:message-id:reply-to;

bh=o1k3RHbVDp/gYKH652Fll3Sbl9zLjz6QWd8v4w15q3w=;

b=WXR4IncE6ywuXBIC5A9rIgIDuSA1fSPNLRz8rLl8xf2zw7UmZR6/WLBLA1k4DE6XOu

sBuAQXK2gsn8+6A7PoBGbcoK5bIChLYmXV2tDYlWuriMat/75kShqUkC3anJyC0F/1PD

ptk06xGSpkxAq1eATdFuLWtZLunfdnBa4ayjGotz3Z0KDRQeutAmAMs6EM3+irwBrF91

BLx4M9iqI0jEzfGXywz9oSpfm8ZRYBiyHxJBQf6jMWCgZ9+aNf+Fuynn6vkn1rpnxMld

5L8oYWxsTvXS8lG05mtyR+9LLVCU3m7PLRJBAyqxCkAbDWJGBgxASBy2zLesH79gvbhH

nZKg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772705033; x=1773309833;

h=disposition-notification-to:content-language:thread-index

:mime-version:message-id:date:subject:in-reply-to:references:to:from

:return-receipt-to:x-gm-gg:x-gm-message-state:from:to:cc:subject

:date:message-id:reply-to;

bh=o1k3RHbVDp/gYKH652Fll3Sbl9zLjz6QWd8v4w15q3w=;

b=CioWu6v8xzQqzlTExL87d5h87oa4+M1dSe0/fA/mVNoJwhhxzLg2tKsKo8J7+J2oQz

1Q4z6lCV5YcNq3O1JcgipBrV7R/cV0frc06jRGSdLDtKKH+VQWRV70cZ7VOoSiIp9il3

YlF5XEVOlhVCoMrQ+6xAb1MbPQCSyULmB22MVrPPribD7Kt7xyG754O//jOmkYWNzzkv

ZJ4ZOsEz7tSiY7Ua/lzoyfEQ4AIrOokqBJW/gFtgcF2sn4en9nOSPc9RfoG7TlwjQvBk

X31yupHhaC51caPLQGG8AZxiOQ1aEr1gwUia+i+rRL+ua65V97r2+acnUzoLLWZb4siw

W8qA==

X-Gm-Message-State: AOJu0Yz72AhKTj7dXcyW2Oh8J+g4jA47Z0D2tzfutlFdBzATVW+3RpTh

MyvUHvg1Ii932N/e7/RrVuoq9GXpL5N49Mqv/LMzeX6Mkb+5LfJmLPbt104Rp3cdEzsNf+0VcFB

ECXl1zLTU0g==

X-Gm-Gg: ATEYQzxQfu6uiRKjpenrcitpyXIY8a80LARiyofSGuFxVklB251GhOMh/pT/AVKYpa/

r7ZWHlN0cU5xcM+NF0A/nnNchEG2qcGQ+sx0E424NleV6/9VddY7PlkqDNqrRbveuwiQ4af/iSM

kzHlZW6KcWqsJjUH2p9ruCaR1YLYPJ3ILxXh317dyetlyHzWdRPbYfCvUxteYQdn3hA8C8PWhVv

jgQjrZgjVPj+pIlZZMFtg1JnKIlmELQQndXL1QUULHK8IIkquXaI8IKHhnwbP+TH/vhC3V8Pgk6

YAw2Qlgq5UytrxaePSYMZH61U06TB0Y8TCVMzuv31igzr/PWDNbkis1TQ4LWhieVn9qkbPFONTL

UUwISHxMja9AWwrByd1ap4U9rICI/dF+QpMQZEQoV9bSmo9g+L/bsIZns6073ZGEkqHbQBtgJyx

Ol+D8EmeNdMW9R9CvUXN17ngQXaGt7rbu6SNemIqIn

X-Received: by 2002:a05:6000:4383:b0:439:c2ce:1208 with SMTP id ffacd0b85a97d-439c7f93ba3mr10219233f8f.5.1772705032701;

Thu, 05 Mar 2026 02:03:52 -0800 (PST)

Received: from DESKTOPK42Q2LS ([159.26.112.85])

by smtp.googlemail.com with ESMTPSA id ffacd0b85a97d-439af926c53sm42573877f8f.8.2026.03.05.02.03.51

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Thu, 05 Mar 2026 02:03:52 -0800 (PST)

Return-Receipt-To:

From:

To:

References:

In-Reply-To:

Subject: RE: Targeted Teradata Users Info

Date: Thu, 5 Mar 2026 15:29:00 +0530

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_06B2_01DCACB4.CAD10920"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: AdymRRdBgtUkBrhBT4av6PXP7fCtbgAAAVxQAAAADcAAAADfwAAAAA3gAAAAEeAAAAANEAAAABCgAAAAEAAAAAAOMAGQY3cQ

Content-Language: en-us

Disposition-Notification-To:

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, � Hope you’re doing well.



Content analysis details: (8.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.26.112.85 listed in will-spam-for-food.eu.org]

[159.26.112.85 listed in will-spam-for-food.eu.org]

[159.26.112.85 listed in will-spam-for-food.eu.org]

[159.26.112.85 listed in will-spam-for-food.eu.org]

[159.26.112.85 listed in will-spam-for-food.eu.org]

[159.26.112.85 listed in will-spam-for-food.eu.org]

[159.26.112.85 listed in will-spam-for-food.eu.org]

[159.26.112.85 listed in will-spam-for-food.eu.org]

[209.85.221.42 listed in will-spam-for-food.eu.org]

[209.85.221.42 listed in will-spam-for-food.eu.org]

[209.85.221.42 listed in will-spam-for-food.eu.org]

[209.85.221.42 listed in will-spam-for-food.eu.org]

[209.85.221.42 listed in will-spam-for-food.eu.org]

[209.85.221.42 listed in will-spam-for-food.eu.org]

[209.85.221.42 listed in will-spam-for-food.eu.org]

[209.85.221.42 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.221.42 listed in dnsbl.ahbl.org]

[209.85.221.42 listed in dnsbl.ahbl.org]

[209.85.221.42 listed in dnsbl.ahbl.org]

[209.85.221.42 listed in dnsbl.ahbl.org]

[159.26.112.85 listed in dnsbl.ahbl.org]

[159.26.112.85 listed in dnsbl.ahbl.org]

[159.26.112.85 listed in dnsbl.ahbl.org]

[159.26.112.85 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.221.42 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.221.42 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.221.42 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.221.42 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.42 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.42 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 MR_DIFF_MID No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 END_FUTURE_EMAILS Spammy unsubscribe

1.0 REPLYTO_BOGUS In-Reply-To header seems not to be valid

0.0 T_END_FUTURE_EMAILS Spammy unsubscribe

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} RE: Targeted Teradata Users Info

Social Media spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 05 Mar 2026 04:28:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vy6rA-00000000Frf-3rSP

for dave@doctor.nl2k.ab.ca;

Thu, 05 Mar 2026 04:27:04 -0700

Resent-From: The Doctor

Resent-Date: Thu, 5 Mar 2026 04:27:04 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp.cluodme.com ([104.214.224.93]:59611)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vy4kL-000000004th-3oay

for sales@nk.ca;

Thu, 05 Mar 2026 02:12:03 -0700

dkim-signature: v=1; a=rsa-sha256; d=cluodme.com; s=dkim1;

c=relaxed/relaxed; q=dns/txt; h=From:Reply-To:Subject:Date:Message-ID:To:MIME-Version:Content-Type:Content-Transfer-Encoding;

bh=NWPTcEttPnR0IJZyBI34XbcKuFhPZHN2PvdAZ52/niY=;

b=p43naTI4WEik8q4tFHQF+VRvviulIrR90tF7hUWlhFXfgpcDufIsekZFKPLod5RgIEmxTaOXCZroJc4iB7DBhEIapTqZLraoXMP4xAu21fS0b8RuW4KsYbh6SWVSE2HxmpVGzZ8VqtbMik+3I+vx34U99tqLIQQ4DF3EER/uGOUvE7yIdzKtFIvfUkrynd9d2Z46L0YOv2gsUAVoxMx2tcAHLHmA+htRWwLxDX1gNTeJvIDybHzUFMisBF

AlWUDv1kBtd/WIQnzFrKKGQpc9Vb1totZYBa0YBKFX3xOyCI5olU87Aj6cVXIUvyzle8XC5wLo/Nn+uAnfdlZUo41+uQ==

Received: from VM-IIS (Unknown [104.45.10.112])

by smtp.cluodme.com with ESMTPSA

(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256)

; Thu, 5 Mar 2026 10:10:57 +0100

Message-ID: <41042217-917B-4A50-9458-1BD64B5CCCED@smtp.cluodme.com>

MIME-Version: 1.0

From: "Vip-Followers"

To: sales@nk.ca

Reply-To: "Vip-Followers"

Date: 5 Mar 2026 10:10:57 +0100

Subject: WELCOME Bonus Code

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: base64

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Vip-Followers Welcome, get 20% discount to test our service.

WELCOME Make your first purchase today and get 20% OFF!



Content analysis details: (9.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.45.10.112 listed in will-spam-for-food.eu.org]

[104.45.10.112 listed in will-spam-for-food.eu.org]

[104.45.10.112 listed in will-spam-for-food.eu.org]

[104.45.10.112 listed in will-spam-for-food.eu.org]

[104.45.10.112 listed in will-spam-for-food.eu.org]

[104.45.10.112 listed in will-spam-for-food.eu.org]

[104.45.10.112 listed in will-spam-for-food.eu.org]

[104.45.10.112 listed in will-spam-for-food.eu.org]

[104.214.224.93 listed in will-spam-for-food.eu.org]

[104.214.224.93 listed in will-spam-for-food.eu.org]

[104.214.224.93 listed in will-spam-for-food.eu.org]

[104.214.224.93 listed in will-spam-for-food.eu.org]

[104.214.224.93 listed in will-spam-for-food.eu.org]

[104.214.224.93 listed in will-spam-for-food.eu.org]

[104.214.224.93 listed in will-spam-for-food.eu.org]

[104.214.224.93 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[104.214.224.93 listed in dnsbl.ahbl.org]

[104.214.224.93 listed in dnsbl.ahbl.org]

[104.214.224.93 listed in dnsbl.ahbl.org]

[104.214.224.93 listed in dnsbl.ahbl.org]

[104.45.10.112 listed in dnsbl.ahbl.org]

[104.45.10.112 listed in dnsbl.ahbl.org]

[104.45.10.112 listed in dnsbl.ahbl.org]

[104.45.10.112 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[104.214.224.93 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[104.214.224.93 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[104.214.224.93 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[104.214.224.93 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[104.214.224.93 listed in wl.mailspike.net]

1.5 MR_STRANGE_QUESTION URI: No description available.

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} WELCOME Bonus Code



WELCOME

Make your first purchase today and get 20% OFF!



Thank you for visiting our website.

For you a 20% discount to test our service.

ACTIVATE DISCOUNT NOW



Use the code MYFIRSTP at the checkout.



Why use our service?



We have 10 years of experience, a stable and constantly improving service to offer you the best experience ever.

We help you defeat the Instagram algorithm. Content with the most interactions, such as likes and views, appear first in the user home page. Also there are good chances to enter the EXPLORE section.

A popular profile increases the credibility of your products and services, thus increasing your sales.

An opportunity to have a digital business, thanks to Instagram you can have new collaborations and sponsorships.



SHOP BEST IG SERVICES



PS. your personal discount is valid

for the next 48 hours only. Don't miss out!

Copyright © 2014-2023 Vip-Followers, All rights reserved.



Want to change how you receive these emails?

You can unsubscribe from this list.



Semiconductor Chinese spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Thu, 05 Mar 2026 01:59:00 -0700

Received: from out28-135.mail.aliyun.com ([115.124.28.135]:54030)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vy4Wl-000000003w3-3IFB

for dave@nk.ca;

Thu, 05 Mar 2026 01:58:04 -0700

X-Alimail-AntiSpam:AC=CONTINUE;BC=0.7793927|0.2842881;BR=01201311R211S35rulernew998_84748_2000303;CH=blue;DM=|AD|false|;DS=CONTINUE|ham_news_journal|0.748708-0.0527031-0.198589;FP=18152772308366143634|0|0|0|0|-1|-1|-1;HT=maildocker-contentspam033032023038;MF=james@vicmarketresearchreport.com;NM=1;PH=DW;RN=251;RT=1;SR=0;TI=W4_0.2.3_v5ForWebDing_212505E2_1772700999415_o7001c168u;

Received: from WS-web (james@vicmarketresearchreport.com[W4_0.2.3_v5ForWebDing_212505E2_1772700999415_o7001c168u] cluster:ay29) at Thu, 05 Mar 2026 16:56:39 +0800

Date: Thu, 05 Mar 2026 16:56:39 +0800

From: "James"

Cc: "vicresearch"

Reply-To: "James"

Message-ID:

Subject: =?UTF-8?B?U2VtaWNvbmR1Y3RvciBQcm9jZXNzIENvbnRyb2wgRXF1aXBtZW50IE1hcmtldCBHcm93dGgg?=

=?UTF-8?B?UmF0ZSBBbmFseXNpcyBSZXBvcnQ=?=

X-Mailer: [Alimail-Mailagent revision 1106][W4_0.2.3][v5ForWebDing][Chrome]

MIME-Version: 1.0

x-aliyun-im-through: {"version":"v1.0"}

x-aliyun-mail-creator: W4_0.2.3_v5ForWebDing_M3LTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0NS4wLjAuMCBTYWZhcmkvNTM3LjM2vN

Content-Type: multipart/alternative;

boundary="----=ALIBOUNDARY_2802_7f24bf3e8700_69a94547_1c34ee"

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear. We have released the latest Semiconductor Process Control

Equipment Market Growth Rate Analysis Report. Pls feel free to contact James@vicmarketresearch.com.

if you are interested in it. A sampl [...]



Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[115.124.28.135 listed in will-spam-for-food.eu.org]

[115.124.28.135 listed in will-spam-for-food.eu.org]

[115.124.28.135 listed in will-spam-for-food.eu.org]

[115.124.28.135 listed in will-spam-for-food.eu.org]

[115.124.28.135 listed in will-spam-for-food.eu.org]

[115.124.28.135 listed in will-spam-for-food.eu.org]

[115.124.28.135 listed in will-spam-for-food.eu.org]

[115.124.28.135 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[115.124.28.135 listed in dnsbl.ahbl.org]

[115.124.28.135 listed in dnsbl.ahbl.org]

[115.124.28.135 listed in dnsbl.ahbl.org]

[115.124.28.135 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[115.124.28.135 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[115.124.28.135 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[115.124.28.135 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[115.124.28.135 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[115.124.28.135 listed in list.dnswl.org]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.2 MISSING_HEADERS Missing To: header

0.1 TW_KY BODY: Odd Letter Triples with KY

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} =?UTF-8?B?U2VtaWNvbmR1Y3RvciBQcm9jZXNzIENvbnRyb2wgRXF1aXBtZW50IE1hcmtldCBHcm93dGgg?=

=?UTF-8?B?UmF0ZSBBbmFseXNpcyBSZXBvcnQ=?=



------=ALIBOUNDARY_2802_7f24bf3e8700_69a94547_1c34ee

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: base64



RGVhci4KV2UgaGF2ZSByZWxlYXNlZCB0aGUgbGF0ZXN0IFNlbWljb25kdWN0b3IgUHJvY2VzcyBD

b250cm9sIEVxdWlwbWVudCBNYXJrZXQgR3Jvd3RoIFJhdGUgQW5hbHlzaXMgUmVwb3J0LgpQbHMg

ZmVlbCBmcmVlIHRvIGNvbnRhY3QgSmFtZXNAdmljbWFya2V0cmVzZWFyY2guY29tLiBpZiB5b3Ug

YXJlIGludGVyZXN0ZWQgaW4gaXQuIEEgc2FtcGxlIHJlcG9ydCB3aWxsIGJlIHNlbnQgdG8geW91

LgpZb3UgbWF5IHByb3ZpZGUgeW91ciByZXF1aXJlbWVudHMgZm9yIHRoZSByZXBvcnQgY29udGVu

dC4KVGhlIHJlcG9ydCBjb3ZlcnMgdGhlIGZvbGxvd2luZyBwYXJ0aWNpcGFudHM6CktMQSBDb3Jw

b3JhdGlvbgpBcHBsaWVkIE1hdGVyaWFscwpIaXRhY2hpIEhpZ2gtVGVjaApBU01MCk9udG8gSW5u

b3ZhdGlvbgpMYXNlcnRlYwpTQ1JFRU4gU2VtaWNvbmR1Y3RvciBTb2x1dGlvbnMKWkVJU1MKQ2Ft

dGVrClNreXZlcnNlIFRlY2hub2xvZ3kKVG9yYXkgRW5naW5lZXJpbmcKUlNJQwpXdWhhbiBKaW5n

Y2UgRWxlY3Ryb25pYyBHcm91cApNaWNyb3Ryb25pYwpVbml0eSBTZW1pY29uZHVjdG9yIFNBUwpT

TUVFClRaVEVL77yITXVldGVj77yJCkRKRUwKTm9yZHNvbiBDb3Jwb3JhdGlvbgpCcnVrZXIKTmVh

cmZpZWxkIEluc3RydW1lbnRzIChORkkpCkNvbmZvdmlzCk11ZXRlYwpOb3ZhClRoZXJlIGFyZSBt

b3JlIGNvbXBhbmllcyBub3QgbGlzdGVkIGhlcmUuClRoaXMgbWF5IGJlIGhlbHBmdWwgdG8gdGhl

IFJlbGF0ZWQgRGVwYXJ0bWVudHMgb3IgdGhlIHBlcnNvbiBpbiBjaGFyZ2Ugb2YgeW91ciBjb21w

YW55LgpCZXN0IHJlZ2FyZHMgLyBNaXQgZnJldW5kbGljaGVuIEdyw7zDn2VuIC8g5q2k6Ie05pWs

5oSPCkphbWVzCg==

------=ALIBOUNDARY_2802_7f24bf3e8700_69a94547_1c34ee

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64



PGRpdiBjbGFzcz0iX19hbGl5dW5fZW1haWxfYm9keV9ibG9jayI+PGRpdiAgc3R5bGU9ImZvbnQt

ZmFtaWx5OiBUYWhvbWEsIEFyaWFsLCBTVEhlaXRpU0MtTGlnaHQsIFNpbVN1biI+PGRpdiAgc3R5

bGU9ImNsZWFyOiBib3RoOyBmb250LWZhbWlseTogVGFob21hLCBBcmlhbCwgU1RIZWl0aVNDLUxp

Z2h0LCBTaW1TdW47Ij48c3BhbiAgc3R5bGU9ImZvbnQtZmFtaWx5OiBUYWhvbWEsIEFyaWFsLCBT

VEhlaXRpU0MtTGlnaHQsIFNpbVN1bjsiPjxzcGFuID5EZWFyLjwvc3Bhbj48L3NwYW4+PGRpdiAg

c3R5bGU9ImNsZWFyOiBib3RoOyI+V2UgaGF2ZSByZWxlYXNlZCB0aGUgbGF0ZXN0IFNlbWljb25k

dWN0b3IgUHJvY2VzcyBDb250cm9sIEVxdWlwbWVudCBNYXJrZXQgR3Jvd3RoIFJhdGUgQW5hbHlz

aXMgUmVwb3J0LjwvZGl2PjxkaXYgIHN0eWxlPSJjbGVhcjogYm90aDsiPlBscyBmZWVsIGZyZWUg

dG8gY29udGFjdCBKYW1lc0B2aWNtYXJrZXRyZXNlYXJjaC5jb20uIGlmIHlvdSBhcmUgaW50ZXJl

c3RlZCBpbiBpdC4gQSBzYW1wbGUgcmVwb3J0IHdpbGwgYmUgc2VudCB0byB5b3UuPC9kaXY+PGRp

diAgc3R5bGU9ImNsZWFyOiBib3RoOyI+WW91IG1heSBwcm92aWRlIHlvdXIgcmVxdWlyZW1lbnRz

IGZvciB0aGUgcmVwb3J0IGNvbnRlbnQuPC9kaXY+PGRpdiAgc3R5bGU9ImNsZWFyOiBib3RoOyI+

VGhlIHJlcG9ydCBjb3ZlcnMgdGhlIGZvbGxvd2luZyBwYXJ0aWNpcGFudHM6PC9kaXY+PGRpdiAg

c3R5bGU9ImNsZWFyOiBib3RoOyI+S0xBIENvcnBvcmF0aW9uPC9kaXY+PGRpdiAgc3R5bGU9ImNs

ZWFyOiBib3RoOyI+QXBwbGllZCBNYXRlcmlhbHM8L2Rpdj48ZGl2ICBzdHlsZT0iY2xlYXI6IGJv

dGg7Ij5IaXRhY2hpIEhpZ2gtVGVjaDwvZGl2PjxkaXYgIHN0eWxlPSJjbGVhcjogYm90aDsiPkFT

TUw8L2Rpdj48ZGl2ICBzdHlsZT0iY2xlYXI6IGJvdGg7Ij5PbnRvIElubm92YXRpb248L2Rpdj48

ZGl2ICBzdHlsZT0iY2xlYXI6IGJvdGg7Ij5MYXNlcnRlYzwvZGl2PjxkaXYgIHN0eWxlPSJjbGVh

cjogYm90aDsiPlNDUkVFTiBTZW1pY29uZHVjdG9yIFNvbHV0aW9uczwvZGl2PjxkaXYgIHN0eWxl

PSJjbGVhcjogYm90aDsiPlpFSVNTPC9kaXY+PGRpdiAgc3R5bGU9ImNsZWFyOiBib3RoOyI+Q2Ft

dGVrPC9kaXY+PGRpdiAgc3R5bGU9ImNsZWFyOiBib3RoOyI+U2t5dmVyc2UgVGVjaG5vbG9neTwv

ZGl2PjxkaXYgIHN0eWxlPSJjbGVhcjogYm90aDsiPlRvcmF5IEVuZ2luZWVyaW5nPC9kaXY+PGRp

diAgc3R5bGU9ImNsZWFyOiBib3RoOyI+UlNJQzwvZGl2PjxkaXYgIHN0eWxlPSJjbGVhcjogYm90

aDsiPld1aGFuIEppbmdjZSBFbGVjdHJvbmljIEdyb3VwPC9kaXY+PGRpdiAgc3R5bGU9ImNsZWFy

OiBib3RoOyI+TWljcm90cm9uaWM8L2Rpdj48ZGl2ICBzdHlsZT0iY2xlYXI6IGJvdGg7Ij5Vbml0

eSBTZW1pY29uZHVjdG9yIFNBUzwvZGl2PjxkaXYgIHN0eWxlPSJjbGVhcjogYm90aDsiPlNNRUU8

L2Rpdj48ZGl2ICBzdHlsZT0iY2xlYXI6IGJvdGg7Ij5UWlRFS++8iE11ZXRlY++8iTwvZGl2Pjxk

aXYgIHN0eWxlPSJjbGVhcjogYm90aDsiPkRKRUw8L2Rpdj48ZGl2ICBzdHlsZT0iY2xlYXI6IGJv

dGg7Ij5Ob3Jkc29uIENvcnBvcmF0aW9uPC9kaXY+PGRpdiAgc3R5bGU9ImNsZWFyOiBib3RoOyI+

QnJ1a2VyPC9kaXY+PGRpdiAgc3R5bGU9ImNsZWFyOiBib3RoOyI+TmVhcmZpZWxkIEluc3RydW1l

bnRzIChORkkpPC9kaXY+PGRpdiAgc3R5bGU9ImNsZWFyOiBib3RoOyI+Q29uZm92aXM8L2Rpdj48

ZGl2ICBzdHlsZT0iY2xlYXI6IGJvdGg7Ij5NdWV0ZWM8L2Rpdj48ZGl2ICBzdHlsZT0iY2xlYXI6

IGJvdGg7Ij5Ob3ZhPC9kaXY+PGRpdiAgc3R5bGU9ImNsZWFyOiBib3RoOyI+VGhlcmUgYXJlIG1v

cmUgY29tcGFuaWVzIG5vdCBsaXN0ZWQgaGVyZS48L2Rpdj48ZGl2ICBzdHlsZT0iY2xlYXI6IGJv

dGg7Ij5UaGlzIG1heSBiZSBoZWxwZnVsIHRvIHRoZSBSZWxhdGVkIERlcGFydG1lbnRzIG9yIHRo

ZSBwZXJzb24gaW4gY2hhcmdlIG9mIHlvdXIgY29tcGFueS48L2Rpdj48ZGl2ICBzdHlsZT0iY2xl

YXI6IGJvdGg7Ij5CZXN0IHJlZ2FyZHMgLyBNaXQgZnJldW5kbGljaGVuIEdyw7zDn2VuIC8g5q2k

6Ie05pWs5oSPPC9kaXY+PGRpdiA+PHNwYW4gPkphbWVzPC9zcGFuPjwvZGl2PjxzcGFuICBzdHls

ZT0iZm9udC1mYW1pbHk6IFRhaG9tYSwgQXJpYWwsIFNUSGVpdGlTQy1MaWdodCwgU2ltU3VuOyI+

PGJyID48L3NwYW4+PC9kaXY+PGRpdiAgc3R5bGU9ImNsZWFyOiBib3RoOyBmb250LWZhbWlseTog

VGFob21hLCBBcmlhbCwgU1RIZWl0aVNDLUxpZ2h0LCBTaW1TdW47Ij48c3BhbiAgc3R5bGU9ImZv

bnQtZmFtaWx5OiBUYWhvbWEsIEFyaWFsLCBTVEhlaXRpU0MtTGlnaHQsIFNpbVN1bjsiPjxiciA+

PC9zcGFuPjwvZGl2PjxkaXYgIGNsYXNzPSJhbGltYWlsLXNpZ25hdHVyZSI+PC9kaXY+PC9kaXY+

PC9kaXY+

------=ALIBOUNDARY_2802_7f24bf3e8700_69a94547_1c34ee--



humanity nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 04 Mar 2026 15:41:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxuto-00000000CLm-0qAd

for dave@doctor.nl2k.ab.ca;

Wed, 04 Mar 2026 15:41:00 -0700

Resent-From: The Doctor

Resent-Date: Wed, 4 Mar 2026 15:41:00 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.kalselprov.go.id ([103.142.89.3]:45286)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxuCU-00000000AIW-1O3Y

for doctor@mail.nl2k.ab.ca;

Wed, 04 Mar 2026 14:56:24 -0700

Received: from localhost (localhost [127.0.0.1])

by mail.kalselprov.go.id (Postfix) with ESMTP id 535831C26E52;

Thu, 5 Mar 2026 05:18:00 +0800 (WITA)

Received: from mail.kalselprov.go.id ([127.0.0.1])

by localhost (mail.kalselprov.go.id [127.0.0.1]) (amavis, port 10032)

with ESMTP id ifJ49tEtsFJK; Thu, 5 Mar 2026 05:17:59 +0800 (WITA)

Received: from localhost (localhost [127.0.0.1])

by mail.kalselprov.go.id (Postfix) with ESMTP id 175831C26D43;

Thu, 5 Mar 2026 05:17:59 +0800 (WITA)

X-Virus-Scanned: amavis at mail.kalselprov.go.id

Received: from mail.kalselprov.go.id ([127.0.0.1])

by localhost (mail.kalselprov.go.id [127.0.0.1]) (amavis, port 10026)

with ESMTP id XTP2qSjU3kED; Thu, 5 Mar 2026 05:17:58 +0800 (WITA)

Received: from mail.kalselprov.go.id (localhost [127.0.0.1])

by mail.kalselprov.go.id (Postfix) with ESMTP id 96C2D1C26D32;

Thu, 5 Mar 2026 05:17:57 +0800 (WITA)

Date: Thu, 5 Mar 2026 05:17:57 +0800 (WITA)

From: MRS ANN WHITE

Reply-To: MRS ANN WHITE

Message-ID: <927917270.29249.1772659077590.JavaMail.zimbra@kalselprov.go.id>

Subject: =?utf-8?Q?=E2=80=8B=E2=80=8BATTENTION_DEAR_LOVER_OF_HUMANITY.?=

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: 7bit

X-Originating-IP: [156.59.29.248]

X-Mailer: Zimbra 9.0.0_GA_4200044 (ZimbraWebClient - GC145 (Win)/9.0.0_GA_4200044)

Thread-Index: ZOP8w7y6ass5Qb6LeVbXr2MZDSmcHw==

Thread-Topic: =?utf-8?B?4oCL4oCLQVRURU5USU9O?= DEAR LOVER OF HUMANITY.

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ATTENTION DEAR LOVER OF HUMANITY. I know it will be a great

surprise reading from me today but consider This divine intervention as a

pastor explained to my understanding today. I am Mrs. Ann White, I'm a widow

from Oklahoma, I am wri [...]



Content analysis details: (10.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[156.59.29.248 listed in will-spam-for-food.eu.org]

[156.59.29.248 listed in will-spam-for-food.eu.org]

[156.59.29.248 listed in will-spam-for-food.eu.org]

[156.59.29.248 listed in will-spam-for-food.eu.org]

[156.59.29.248 listed in will-spam-for-food.eu.org]

[156.59.29.248 listed in will-spam-for-food.eu.org]

[156.59.29.248 listed in will-spam-for-food.eu.org]

[156.59.29.248 listed in will-spam-for-food.eu.org]

[103.142.89.3 listed in will-spam-for-food.eu.org]

[103.142.89.3 listed in will-spam-for-food.eu.org]

[103.142.89.3 listed in will-spam-for-food.eu.org]

[103.142.89.3 listed in will-spam-for-food.eu.org]

[103.142.89.3 listed in will-spam-for-food.eu.org]

[103.142.89.3 listed in will-spam-for-food.eu.org]

[103.142.89.3 listed in will-spam-for-food.eu.org]

[103.142.89.3 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.142.89.3 listed in dnsbl.ahbl.org]

[103.142.89.3 listed in dnsbl.ahbl.org]

[103.142.89.3 listed in dnsbl.ahbl.org]

[103.142.89.3 listed in dnsbl.ahbl.org]

[156.59.29.248 listed in dnsbl.ahbl.org]

[156.59.29.248 listed in dnsbl.ahbl.org]

[156.59.29.248 listed in dnsbl.ahbl.org]

[156.59.29.248 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.142.89.3 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.142.89.3 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.142.89.3 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.142.89.3 listed in dnsbl.ahbl.org]

1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[103.142.89.3 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[103.142.89.3 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[103.142.89.3 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.142.89.3 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.2 MISSING_HEADERS Missing To: header

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 HK_NAME_MR_MRS No description available.

1.9 REPLYTO_WITHOUT_TO_CC No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} =?utf-8?Q?=E2=80=8B=E2=80=8BATTENTION_DEAR_LOVER_OF_HUMANITY.?=







ATTENTION DEAR LOVER OF HUMANITY.



I know it will be a great surprise reading from me today but consider

This divine intervention as a pastor explained to my understanding

today. I am Mrs. Ann White, I'm a widow from Oklahoma, I am writing you

from my sick bed because i have been fighting cancer for a while now.



I will tell you more about myself and also explain why I need your help

with my donations for confidential reasons, Please write me soon as

possible, my health is pretty bad and my Doctors say I will be moved to

the intensive care unit.



I hope I can trust you? please do pray for me, I wait for your email

feedback,



kindly email me directly via this Email Here: mrs.annwhite@hotmail.com



Thank you

from Mrs. Ann White.

Scotiabank Phish Part 2

Posted by Dave Yadallee on










--1a7b5f4b4cc6f8d3d5a4259d5714c0f2f

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable







=09





=C2=A0








style=3D"font-style: inherit; font-variant-ligatures: inherit; font-varian=

t-position: inherit; font-variant-caps: inherit; font-variant-numeric: inhe=

rit; font-variant-alternates: inherit; font-variant-east-asian: inherit; fo=

nt-weight: inherit; font-stretch: inherit; font-size: inherit; line-height:=

inherit; font-family: Arial, sans-serif; font-optical-sizing: inherit; -we=

bkit-font-kerning: inherit; font-feature-settings: inherit; font-variation-=

settings: inherit; margin: 40px auto; border-top-left-radius: 10px; border-=

top-right-radius: 10px; border-bottom-right-radius: 10px; border-bottom-lef=

t-radius: 10px; box-shadow: rgba(0, 0, 0, 0.1) 0px 8px 20px; overflow: hidd=

en; transform: scale(0.751667, 0.751667); transform-origin: left top; backg=

round-position: initial initial; background-repeat: initial initial;" width=

=3D"600">

=09
just: auto;">

=09=09

=09=09=09

=09=09

=09


.6;">

=09=09=09

3D""
"External" data-olk-copy-source=3D"MessageBody" src=3D"https://logos-world.=

net/wp-content/uploads/2021/03/Scotiabank-Emblem.png" style=3D"border: 0px;=

font-family: inherit; font-size: inherit; font-style: inherit; font-varian=

t-caps: inherit; font-weight: inherit; font-stretch: inherit; line-height: =

inherit; margin: 0px; padding: 0px; vertical-align: baseline; color: inheri=

t; width: 150px; height: 84px;" />





=09=09=09

=C2=A0





=09=09=09

Date:=C2=A004 =

mars=C2=A02026





=09=09=09

Reference ID:=

=C2=A0SCB-9472-SEC-2026CA





=09=09=09

Dear Customer,





=09=09=09

We would like to inform you that a secure message containing im=

portant updates regarding your account has been sent to you.





=09=09=09

For your protection, we use secure messaging to promptly notify=

you of any changes or activities related to your account security.





=09=09=09


-linkindex=3D"0" href=3D"https://www.askanadventistfriend.com/wp-includes/c=

a/a/" rel=3D"noopener noreferrer" style=3D"border: 0px; font-style: inherit=

; font-variant-ligatures: inherit; font-variant-position: inherit; font-var=

iant-caps: inherit; font-variant-numeric: inherit; font-variant-alternates:=

inherit; font-variant-east-asian: inherit; font-weight: bold; font-stretch=

: inherit; font-size: inherit; line-height: inherit; font-family: inherit; =

font-optical-sizing: inherit; -webkit-font-kerning: inherit; font-feature-s=

ettings: inherit; font-variation-settings: inherit; margin: 0px; padding: 1=

4px 35px; vertical-align: baseline; background-color: rgb(215, 25, 32); col=

or: rgb(255, 255, 255); text-decoration-line: none; border-top-left-radius:=

6px; border-top-right-radius: 6px; border-bottom-right-radius: 6px; border=

-bottom-left-radius: 6px; display: inline-block;" target=3D"_blank" title=

=3D"https://shorturl.at/pk5M1">View Secure Message





=09=09=09

This secure message contains sensitive information regarding yo=

ur banking account. Please sign in to your online banking portal to review =

the complete details.





=09=09=09

Thank you for choosing our banking =

services.





=09=09=09

=C2=A0



=09=09=09












--1a7b5f4b4cc6f8d3d5a4259d5714c0f2f--

Scotiabank Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 04 Mar 2026 14:49:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxu5E-000000009zb-1giA

for dave@doctor.nl2k.ab.ca;

Wed, 04 Mar 2026 14:48:44 -0700

Resent-From: The Doctor

Resent-Date: Wed, 4 Mar 2026 14:48:44 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [91.212.52.120] (port=33132 helo=mybeautyshop.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxqIP-000000009qm-1RcP

for support@nl2k.ab.ca;

Wed, 04 Mar 2026 10:46:12 -0700

Received: by mybeautyshop.com (Postfix, from userid 1000)

id 753C5858748F; Wed, 4 Mar 2026 18:40:39 +0100 (CET)

Date: Wed, 4 Mar 2026 18:40:30 +0100

To: support@nl2k.ab.ca

From: =?UTF-8?B?U2NvdGlhQmFuay4=?=

Subject: =?UTF-8?B?SW1wb3J0YW50OiBTZWN1cmUgTWVzc2FnZSBSZWdhcmRpbmcgWW91ciBBY2NvdW50ICE=?=

Message-ID: <0f406fa80c6305284dbe429568f5c8a1@mybeautyshop.com>

List-Unsubscribe: mailto:bounce114-lihB83x8wOw4e0r@mybeautyshop.com?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1a7b5f4b4cc6f8d3d5a4259d5714c0f2f"

Content-Transfer-Encoding: 8bit

X-Spam_score: 12.8

X-Spam_score_int: 128

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Date: 04 mars 2026 Reference ID: SCB-9472-SEC-2026CA



Content analysis details: (12.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.212.52.120 listed in will-spam-for-food.eu.org]

[91.212.52.120 listed in will-spam-for-food.eu.org]

[91.212.52.120 listed in will-spam-for-food.eu.org]

[91.212.52.120 listed in will-spam-for-food.eu.org]

[91.212.52.120 listed in will-spam-for-food.eu.org]

[91.212.52.120 listed in will-spam-for-food.eu.org]

[91.212.52.120 listed in will-spam-for-food.eu.org]

[91.212.52.120 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.212.52.120 listed in dnsbl.ahbl.org]

[91.212.52.120 listed in dnsbl.ahbl.org]

[91.212.52.120 listed in dnsbl.ahbl.org]

[91.212.52.120 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.212.52.120 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.212.52.120 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.212.52.120 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.212.52.120 listed in dnsbl.ahbl.org]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[91.212.52.120 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[91.212.52.120 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[91.212.52.120 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[91.212.52.120 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.2 TVD_PH_SUBJ_META1 Email has a Phishy looking subject line

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

3.0 URI_WP_DIRINDEX URI for compromised WordPress site, possible malware

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware

Subject: {SPAM?} =?UTF-8?B?SW1wb3J0YW50OiBTZWN1cmUgTWVzc2FnZSBSZWdhcmRpbmcgWW91ciBBY2NvdW50ICE=?=



This is a multi-part message in MIME format.



--1a7b5f4b4cc6f8d3d5a4259d5714c0f2f

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit













Â

















Â



Date: 04 mars 2026



Reference ID:Â SCB-9472-SEC-2026CA



Dear Customer,



We would like to inform you that a secure message containing important updates regarding your account has been sent to you.



For your protection, we use secure messaging to promptly notify you of any changes or activities related to your account security.



View Secure Message



This secure message contains sensitive information regarding your banking account. Please sign in to your online banking portal to review the complete details.



Thank you for choosing our banking services.



Â