Chinese language phish
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 30 Jul 2026 07:32:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wpQrM-00000000EGC-1ZpZ
for dave@doctor.nl2k.ab.ca;
Thu, 30 Jul 2026 07:31:40 -0600
Resent-From: The Doctor
Resent-Date: Thu, 30 Jul 2026 07:31:40 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from toolrnanpro.com ([85.158.109.140]:59190 helo=inbox0.toolrnanpro.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wpMZE-00000000EGF-0SYS
for sales@nk.ca;
Thu, 30 Jul 2026 02:56:48 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=toolrnanpro.com;
h=Content-Type:MIME-Version:From:To:Subject; i=norply-8@toolrnanpro.com;
bh=4QGQrS1mPHrYNPQwfTIvhpfpe1qEeQUpGhX5QvYWQBk=;
b=tgLP+BSqtPpMUYGKkdvI0KjSeQRxV2tQ3vgbAQ3gBbql6tfB/tc9CJjBSJylLd0th8SRCdwnmpNS
qK43IQDJEDjKs9lQ3yhj/ohI2QOQvzF5UBkSDIeIcVq2wYkCj4J8zGUbXSC93YyBPKhdYFnJEV8m
D3VxHtVUcs44DcZFVl0=
Content-Type: multipart/related; boundary="===============3814120749993276993=="
MIME-Version: 1.0
From: "nk.ca"
To: sales@nk.ca
Subject: =?utf-8?b?bmsuY2EgcG9zdG1hc3RlciA6IOmHjeaWsOa/gOa0u+W4kOaItw==?=
X-Spam_score: 13.0
X-Spam_score_int: 130
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: New Message 2 Nk 消æ¯ä¸å¿ƒ
Content analysis details: (13.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.4 MISSING_DATE Missing Date: header
0.1 MISSING_MID Missing Message-Id: header
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[85.158.109.140 listed in will-spam-for-food.eu.org]
[85.158.109.140 listed in will-spam-for-food.eu.org]
[85.158.109.140 listed in will-spam-for-food.eu.org]
[85.158.109.140 listed in will-spam-for-food.eu.org]
[85.158.109.140 listed in will-spam-for-food.eu.org]
[85.158.109.140 listed in will-spam-for-food.eu.org]
[85.158.109.140 listed in will-spam-for-food.eu.org]
[85.158.109.140 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[85.158.109.140 listed in dnsbl.ahbl.org]
[85.158.109.140 listed in dnsbl.ahbl.org]
[85.158.109.140 listed in dnsbl.ahbl.org]
[85.158.109.140 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[85.158.109.140 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[85.158.109.140 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[85.158.109.140 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[85.158.109.140 listed in dnsbl.ahbl.org]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: toolrnanpro.com]
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 ADDR_OFFER From address contains OFFER
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
4.0 DOS_BODY_HIGH_NO_MID High bit body and no message ID header
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain
0.5 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[85.158.109.140 listed in bl.score.senderscore.com]
Subject: {SPAM?} =?utf-8?b?bmsuY2EgcG9zdG1hc3RlciA6IOmHjeaWsOa/gOa0u+W4kOaItw==?=
Nk 消息中心
亲爱的客户 Sales,
您的电子邮件 (Sales_@nk.ca)密码_将在48小时后过期
要继续使用下面相同的密码_点击电子邮件帐户设置。
电子邮件帐户设置
这是一条自动消息，请勿回复！
Nk 消息中心 © 2026年。保留所有权利。
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 30 Jul 2026 07:32:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wpQrM-00000000EGC-1ZpZ
for dave@doctor.nl2k.ab.ca;
Thu, 30 Jul 2026 07:31:40 -0600
Resent-From: The Doctor
Resent-Date: Thu, 30 Jul 2026 07:31:40 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from toolrnanpro.com ([85.158.109.140]:59190 helo=inbox0.toolrnanpro.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wpMZE-00000000EGF-0SYS
for sales@nk.ca;
Thu, 30 Jul 2026 02:56:48 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=toolrnanpro.com;
h=Content-Type:MIME-Version:From:To:Subject; i=norply-8@toolrnanpro.com;
bh=4QGQrS1mPHrYNPQwfTIvhpfpe1qEeQUpGhX5QvYWQBk=;
b=tgLP+BSqtPpMUYGKkdvI0KjSeQRxV2tQ3vgbAQ3gBbql6tfB/tc9CJjBSJylLd0th8SRCdwnmpNS
qK43IQDJEDjKs9lQ3yhj/ohI2QOQvzF5UBkSDIeIcVq2wYkCj4J8zGUbXSC93YyBPKhdYFnJEV8m
D3VxHtVUcs44DcZFVl0=
Content-Type: multipart/related; boundary="===============3814120749993276993=="
MIME-Version: 1.0
From: "nk.ca"
To: sales@nk.ca
Subject: =?utf-8?b?bmsuY2EgcG9zdG1hc3RlciA6IOmHjeaWsOa/gOa0u+W4kOaItw==?=
X-Spam_score: 13.0
X-Spam_score_int: 130
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: New Message 2 Nk 消æ¯ä¸å¿ƒ
Content analysis details: (13.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.4 MISSING_DATE Missing Date: header
0.1 MISSING_MID Missing Message-Id: header
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[85.158.109.140 listed in will-spam-for-food.eu.org]
[85.158.109.140 listed in will-spam-for-food.eu.org]
[85.158.109.140 listed in will-spam-for-food.eu.org]
[85.158.109.140 listed in will-spam-for-food.eu.org]
[85.158.109.140 listed in will-spam-for-food.eu.org]
[85.158.109.140 listed in will-spam-for-food.eu.org]
[85.158.109.140 listed in will-spam-for-food.eu.org]
[85.158.109.140 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[85.158.109.140 listed in dnsbl.ahbl.org]
[85.158.109.140 listed in dnsbl.ahbl.org]
[85.158.109.140 listed in dnsbl.ahbl.org]
[85.158.109.140 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[85.158.109.140 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[85.158.109.140 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[85.158.109.140 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[85.158.109.140 listed in dnsbl.ahbl.org]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: toolrnanpro.com]
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 ADDR_OFFER From address contains OFFER
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
4.0 DOS_BODY_HIGH_NO_MID High bit body and no message ID header
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.0 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain
0.5 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[85.158.109.140 listed in bl.score.senderscore.com]
Subject: {SPAM?} =?utf-8?b?bmsuY2EgcG9zdG1hc3RlciA6IOmHjeaWsOa/gOa0u+W4kOaItw==?=
Nk 消息中心
亲爱的客户 Sales,
您的电子邮件 (Sales_@nk.ca)密码_将在48小时后过期
要继续使用下面相同的密码_点击电子邮件帐户设置。
电子邮件帐户设置
这是一条自动消息，请勿回复！
Nk 消息中心 © 2026年。保留所有权利。
![](3D"https://d3v0px0pttie1i.cloudfront.net/uploads/user/av=<br)