Donation spam
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 17 Jan 2026 07:38:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vh7Qz-00000000O9l-2Hgu
for dave@doctor.nl2k.ab.ca;
Sat, 17 Jan 2026 07:37:49 -0700
Resent-From: The Doctor
Resent-Date: Sat, 17 Jan 2026 07:37:49 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from computeone.uk ([95.154.244.134]:48494)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vh3eA-00000000PMu-15Zl
for sales@nk.ca;
Sat, 17 Jan 2026 03:35:20 -0700
Received: from [108.175.8.68] (port=59106)
by smtp.computeone.uk with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.99.1)
(envelope-from)
id 1vh3dI-000000003nU-1Om5
for sales@nk.ca;
Sat, 17 Jan 2026 10:34:16 +0000
Reply-To: ironwoodfamilytrustfoundation@hotmail.com
From: Ironwood Family Trust Foundation
To: sales@nk.ca
Subject: Official Notification of Donation Approval!!!
Date: 17 Jan 2026 10:34:18 +0000
Message-ID: <20260117103418.3D500A4F166F2018@spicearoma.uk>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - smtp.computeone.uk
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - spicearoma.uk
X-Get-Message-Sender-Via: smtp.computeone.uk: authenticated_id: bills@spicearoma.uk
X-Authenticated-Sender: smtp.computeone.uk: bills@spicearoma.uk
X-Source:
X-Source-Args:
X-Source-Dir:
X-From-Rewrite: unmodified, already matched
X-Spam_score: 11.3
X-Spam_score_int: 113
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Sir/Madam, This is to confirm that a USD $1,000,000
donation from the Ironwood Family Trust Foundation has been approved. Please
respond to indicate your interest and enable us to proceed.
Content analysis details: (11.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[95.154.244.134 listed in dnsbl.ahbl.org]
[95.154.244.134 listed in dnsbl.ahbl.org]
[95.154.244.134 listed in dnsbl.ahbl.org]
[95.154.244.134 listed in dnsbl.ahbl.org]
[108.175.8.68 listed in dnsbl.ahbl.org]
[108.175.8.68 listed in dnsbl.ahbl.org]
[108.175.8.68 listed in dnsbl.ahbl.org]
[108.175.8.68 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[95.154.244.134 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[95.154.244.134 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[95.154.244.134 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[95.154.244.134 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[95.154.244.134 listed in sa-trusted.bondedsender.org]
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[95.154.244.134 listed in sa-accredit.habeas.com]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Rejected by SPF record.]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[95.154.244.134 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[95.154.244.134 listed in bl.score.senderscore.com]
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 LOTS_OF_MONEY Huge... sums of money
0.9 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 T_FROM_MISSP_DKIM From misspaced, DKIM dependable
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
Subject: {SPAM?} Official Notification of Donation Approval!!!
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sat, 17 Jan 2026 07:38:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vh7Qz-00000000O9l-2Hgu
for dave@doctor.nl2k.ab.ca;
Sat, 17 Jan 2026 07:37:49 -0700
Resent-From: The Doctor
Resent-Date: Sat, 17 Jan 2026 07:37:49 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from computeone.uk ([95.154.244.134]:48494)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vh3eA-00000000PMu-15Zl
for sales@nk.ca;
Sat, 17 Jan 2026 03:35:20 -0700
Received: from [108.175.8.68] (port=59106)
by smtp.computeone.uk with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.99.1)
(envelope-from
id 1vh3dI-000000003nU-1Om5
for sales@nk.ca;
Sat, 17 Jan 2026 10:34:16 +0000
Reply-To: ironwoodfamilytrustfoundation@hotmail.com
From: Ironwood Family Trust Foundation
To: sales@nk.ca
Subject: Official Notification of Donation Approval!!!
Date: 17 Jan 2026 10:34:18 +0000
Message-ID: <20260117103418.3D500A4F166F2018@spicearoma.uk>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - smtp.computeone.uk
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - spicearoma.uk
X-Get-Message-Sender-Via: smtp.computeone.uk: authenticated_id: bills@spicearoma.uk
X-Authenticated-Sender: smtp.computeone.uk: bills@spicearoma.uk
X-Source:
X-Source-Args:
X-Source-Dir:
X-From-Rewrite: unmodified, already matched
X-Spam_score: 11.3
X-Spam_score_int: 113
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Sir/Madam, This is to confirm that a USD $1,000,000
donation from the Ironwood Family Trust Foundation has been approved. Please
respond to indicate your interest and enable us to proceed.
Content analysis details: (11.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[95.154.244.134 listed in dnsbl.ahbl.org]
[95.154.244.134 listed in dnsbl.ahbl.org]
[95.154.244.134 listed in dnsbl.ahbl.org]
[95.154.244.134 listed in dnsbl.ahbl.org]
[108.175.8.68 listed in dnsbl.ahbl.org]
[108.175.8.68 listed in dnsbl.ahbl.org]
[108.175.8.68 listed in dnsbl.ahbl.org]
[108.175.8.68 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[95.154.244.134 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[95.154.244.134 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[95.154.244.134 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[95.154.244.134 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
[95.154.244.134 listed in will-spam-for-food.eu.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[95.154.244.134 listed in sa-trusted.bondedsender.org]
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[95.154.244.134 listed in sa-accredit.habeas.com]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Rejected by SPF record.]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[95.154.244.134 listed in bl.score.senderscore.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[95.154.244.134 listed in bl.score.senderscore.com]
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 LOTS_OF_MONEY Huge... sums of money
0.9 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
0.0 T_FROM_MISSP_DKIM From misspaced, DKIM dependable
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
Subject: {SPAM?} Official Notification of Donation Approval!!!
Dear Sir/Ma=
dam,
This is to confirm that a U=
SD $1,000,000 donation from the Ironwood Family Trust Foundation has been a=
pproved. Please respond to indicate your interest and enable us to proceed.=
Best regards,
Mr. David Guzman
Ironw=
ood Family Trust Foundation