Web/SEO/App spam from Google Gmail
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 20 May 2026 05:54:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wPfU9-000000008DT-2oh3
for dave@doctor.nl2k.ab.ca;
Wed, 20 May 2026 05:53:13 -0600
Resent-From: The Doctor
Resent-Date: Wed, 20 May 2026 05:53:13 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vs1-f70.google.com ([209.85.217.70]:55498)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wPfAy-00000000Mh1-32BP
for sales@nk.ca;
Wed, 20 May 2026 05:33:34 -0600
Received: by mail-vs1-f70.google.com with SMTP id ada2fe7eead31-6329c1a6710so2632210137.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20251104; t=1779276751; x=1779881551; darn=nk.ca;
h=to:from:subject:date:message-id:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=K2owG1hegjcQXLevD+4vb/pz4PDyFXOYdfJZqZXHCGQ=;
b=BkiC6nJgnIV3d4X21FCxnNRumFZ95jfuhu+2AXThZ9iia3SOUgHc7E9VB3hZItbLBl
hpTCBbfMqFRpbY9hrTNyXMFN1Etc/imdNiNpGyHbc6kBDnMG2T2O087PAknjREhfqO7H
/P5XfslA7WdEawCvaP0FG/vEXQVl58/JT/jN5poYEugmk4rL08H3i5JDMoxdhhtBRGSh
QWjwC4gbVgirwOUbqK7mMPLw/b2LwPO5/rwlMlq8VE97QGn5h9JZMMXoM1IZmK9fShG9
UqJM5eAF2ZtNknV4Ap75mZH1hyIR5hzROZC4bGK+aO1OrzIovf0G6JrXaZ8globEz9cs
J3yQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1779276751; x=1779881551;
h=to:from:subject:date:message-id:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=K2owG1hegjcQXLevD+4vb/pz4PDyFXOYdfJZqZXHCGQ=;
b=Z+ZS74qPc5FtQmQQLet3+kWIT88HiwPIKCfATf9O9/AzZERLclQPLiO5kt4rO+R4gQ
smbBukPaydz702merx/+aAHiujU5f82Ynh0cQm/DilbOg+O7PetFH2DPndoyGsw2cJXq
CBC8QKaYMJG4wE83TKfvOUrNmki5hj6tZBoVq85hpccyMQB+hBwmxbUc3ePfZeX5j50R
I/fquH0aOgy79gOgVkTtGycUGLRHvuwd9+qr01FtyQUw+468glI8pmQDlCuWZlnSV8R5
0phRZn72fMNcU8LlNMt330cQgGaNYdbgCxbY/ZgIdXzaTwqiIxVNLlbt+LNp9ZiJaSnv
iZ1A==
X-Gm-Message-State: AOJu0YxLBid9VTgXYBpGcTSHnxylCwCsb6LcQjutosJDhb4wTtljg4kZ
Vy7lHb2X21A0r0gHyxHrhyPUVE5zavZhUeUw+5QWVodRq57XMnxsNvi7ihvO2eLKZZFirZxMkcu
3Af4=
MIME-Version: 1.0
X-Received: by 2002:a05:6102:6046:b0:631:b834:e052 with SMTP id
ada2fe7eead31-63a3d72bf03mr10493564137.12.1779276751071; Wed, 20 May 2026
04:32:31 -0700 (PDT)
Message-ID:
Date: Wed, 20 May 2026 11:32:31 +0000
Subject: Packages at cost which is much lower
From: ksmdosbhsndksns@gmail.com
To: sales@nk.ca
Content-Type: multipart/alternative; boundary="000000000000b4715f06523e26aa"
X-Spam_score: 7.6
X-Spam_score_int: 76
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello sales@nk.ca, I am reaching out to you to provide a little
help with your website's interface. I am a professional web designer with
over 10 years of experience and I can do just about anything you can imagine,
and [...]
Content analysis details: (7.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.217.70 listed in dnsbl.ahbl.org]
[209.85.217.70 listed in dnsbl.ahbl.org]
[209.85.217.70 listed in dnsbl.ahbl.org]
[209.85.217.70 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.217.70 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.217.70 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.217.70 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.217.70 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.217.70 listed in will-spam-for-food.eu.org]
[209.85.217.70 listed in will-spam-for-food.eu.org]
[209.85.217.70 listed in will-spam-for-food.eu.org]
[209.85.217.70 listed in will-spam-for-food.eu.org]
[209.85.217.70 listed in will-spam-for-food.eu.org]
[209.85.217.70 listed in will-spam-for-food.eu.org]
[209.85.217.70 listed in will-spam-for-food.eu.org]
[209.85.217.70 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.217.70 listed in list.dnswl.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ksmdosbhsndksns(at)gmail.com]
0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.217.70 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.217.70 listed in wl.mailspike.net]
Subject: {SPAM?} Packages at cost which is much lower
--000000000000b4715f06523e26aa
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Hello sales@nk.ca,
I am reaching out to you to provide a little help with your website's
interface. I am a professional web designer with over 10 years of
experience and I can do just about anything you can imagine, and do it all
for an easily affordable price.
If you are interested in any website to Renovation, re-design and
development? I will forward you our website design (Prices/ past work
/Sample)
Thanks,
Business Development Manager
--000000000000b4715f06523e26aa
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Hello sales@nk.ca,
I am reaching out to you to provide a little hel=
p with your website's interface. I am a professional web designer with over=
10 years of experience and I can do just about anything you can imagine, a=
nd do it all for an easily affordable price.
If you are interested i=
n any website to Renovation, re-design and development? I will forward you =
our website design (Prices/ past work /Sample)
Thanks,
Business D=
evelopment Manager
--000000000000b4715f06523e26aa--