nigerian spam from Italy

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 04 Jun 2026 04:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wV5Mo-000000006MH-1BFP

for dave@doctor.nl2k.ab.ca;

Thu, 04 Jun 2026 04:32:02 -0600

Resent-From: The Doctor

Resent-Date: Thu, 4 Jun 2026 04:32:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.aquila.infn.it ([192.84.154.21]:56294)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wV1Bu-00000000MEF-3uSJ

for sales@nk.ca;

Thu, 04 Jun 2026 00:04:41 -0600

Received: from localhost (localhost [127.0.0.1])

by mail.aquila.infn.it (Postfix) with ESMTP id 3A9849C62C239

for ; Thu, 4 Jun 2026 08:03:43 +0200 (CEST)

Received: from mail.aquila.infn.it ([127.0.0.1])

by localhost (mail.aquila.infn.it [127.0.0.1]) (amavis, port 10032)

with ESMTP id KYv4eynH-QKc for ;

Thu, 4 Jun 2026 08:03:43 +0200 (CEST)

Received: from localhost (localhost [127.0.0.1])

by mail.aquila.infn.it (Postfix) with ESMTP id 223699C62C23C

for ; Thu, 4 Jun 2026 08:03:43 +0200 (CEST)

X-Virus-Scanned: amavis at aquila.infn.it

Received: from mail.aquila.infn.it ([127.0.0.1])

by localhost (mail.aquila.infn.it [127.0.0.1]) (amavis, port 10026)

with ESMTP id rm87t60teSBi for ;

Thu, 4 Jun 2026 08:03:43 +0200 (CEST)

Received: from [14.192.212.45] (unknown [14.192.212.45])

by mail.aquila.infn.it (Postfix) with ESMTPSA id 7DD3A9C62C239

for ; Thu, 4 Jun 2026 08:03:42 +0200 (CEST)

Reply-To: angela.chow8299@abnakh.com

From: "Angela Chow"

To: sales@nk.ca

Subject: Dear Beloved, How are you today?

Date: 4 Jun 2026 01:03:39 -0500

Message-ID: <20260604010338.7B757B2864F5A7FF@aquila.infn.it>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Beloved, How are you today? I hope this email finds

you well.



Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[14.192.212.45 listed in dnsbl.ahbl.org]

[14.192.212.45 listed in dnsbl.ahbl.org]

[14.192.212.45 listed in dnsbl.ahbl.org]

[14.192.212.45 listed in dnsbl.ahbl.org]

[192.84.154.21 listed in dnsbl.ahbl.org]

[192.84.154.21 listed in dnsbl.ahbl.org]

[192.84.154.21 listed in dnsbl.ahbl.org]

[192.84.154.21 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[14.192.212.45 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[14.192.212.45 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[14.192.212.45 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[14.192.212.45 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[192.84.154.21 listed in list.dnswl.org]

2.5 MILLION_USD BODY: Talks about millions of dollars

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[192.84.154.21 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 FROM_MISSPACED From: missing whitespace

0.0 MONEY_FROM_MISSP Lots of money and misspaced From

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Dear Beloved, How are you today?










;">


=3D"font-family: Verdana;">Dear Be=

loved,

ont-family: verdana,sans-serif;">

an style=3D"font-family: verdana,sans-serif;">
erdana;">How are you today? I hope=

this email finds you well.




style=3D"font-family: Verdana;">I=



am Mrs Angela Chow, an aging widow suffering

from a long illness. I have some funds I inherited from my late=20

husband, the sum of $7.4 Million United States Dollars and I am seeking=20

for a very honest & God fearing individual that will use the fund=20

for God's work, I found=20

your email address from the internet and decided to contact you - Please

=20

if you would be able to use the funds for the God's work, kindly contact

me : angela.chow8299@abnakh.=

com

font-family: verdana,sans-serif;">

pan style=3D"font-family: verdana,sans-serif;">
Verdana;">God Bless You !=


dana,sans-serif;">


<=

span style=3D"font-family: Verdana;">Mrs A=

ngela 
rif;">
">Chow
>.
span>





style=3D"font-size: 10pt;">




Cutch Lottery Phish from Gogole User

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 04 Jun 2026 04:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wV5Ir-00000000KmV-24iE

for dave@doctor.nl2k.ab.ca;

Thu, 04 Jun 2026 04:27:57 -0600

Resent-From: The Doctor

Resent-Date: Thu, 4 Jun 2026 04:27:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 137.14.147.34.bc.googleusercontent.com ([34.147.14.137]:53818 helo=googleusercontent.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUxfU-00000000A7F-2EgK

for doctor@netknow.ca;

Wed, 03 Jun 2026 20:18:56 -0600

Received: by googleusercontent.com (Postfix, from userid 1000)

id BB30F249777; Thu, 4 Jun 2026 02:15:44 +0000 (UTC)

To: doctor@netknow.ca

From:=?UTF-8?B?UG9zdGNvZGUgQ2hlY2sgRW5lcmdpZQ==?=

Subject:=?UTF-8?B?Q2hlY2sgdXcgcG9zdGNvZGUgdm9vciDigqwxLjQwMCBiZXNwYXJpbmc=?=

MIME-Version: 1.0

Reply-To: =?UTF-8?B?cmVwbHk=?=

Content-Transfer-Encoding: base64

Content-Type: text/html; charset=utf-8

Message-Id: <20260604021732.BB30F249777@googleusercontent.com>

Date: Thu, 4 Jun 2026 02:15:44 +0000 (UTC)

X-Spam_score: 10.6

X-Spam_score_int: 106

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Thuisbatterij zonder eigen inleg — check uw postcode

Controleer of er nog een plek beschikbaar is in uw gemeente. Subsidie, BTW

en installatie volledig geregeld. €0 eigen inleg. ‌ ‌ ‌ ‌ ‌ ‌

‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ [...]



Content analysis details: (10.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.147.14.137 listed in dnsbl.ahbl.org]

[34.147.14.137 listed in dnsbl.ahbl.org]

[34.147.14.137 listed in dnsbl.ahbl.org]

[34.147.14.137 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.147.14.137 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.147.14.137 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.147.14.137 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.147.14.137 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.147.14.137 listed in will-spam-for-food.eu.org]

[34.147.14.137 listed in will-spam-for-food.eu.org]

[34.147.14.137 listed in will-spam-for-food.eu.org]

[34.147.14.137 listed in will-spam-for-food.eu.org]

[34.147.14.137 listed in will-spam-for-food.eu.org]

[34.147.14.137 listed in will-spam-for-food.eu.org]

[34.147.14.137 listed in will-spam-for-food.eu.org]

[34.147.14.137 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[34.147.14.137 listed in bb.barracudacentral.org]

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[34.147.14.137 listed in psbl.surriel.com]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 SPF_HELO_NEUTRAL SPF: HELO does not match SPF record (neutral)

0.0 TVD_RCVD_IP Message was received from an IP address

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.1 TW_JF BODY: Odd Letter Triples with JF

0.1 TW_IK BODY: Odd Letter Triples with IK

0.1 TW_JG BODY: Odd Letter Triples with JG

0.1 TW_IJ BODY: Odd Letter Triples with IJ

0.1 TW_JB BODY: Odd Letter Triples with JB

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[34.147.14.137 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 URI_FIREBASEAPP Link to hosted firebase web application, possible

phishing

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.0 HDRS_MISSP Misspaced headers

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} =?UTF-8?B?Q2hlY2sgdXcgcG9zdGNvZGUgdm9vciDigqwxLjQwMCBiZXNwYXJpbmc=?=







Verdien Duurzaam ⚡ Subsidie beperkt beschikbaar



⏰ Nog maar een beperkt aantal plekken beschikbaar in uw regio — wacht niet te lang

Thuisbatterij installatie

Uw energierekening omlaag — zonder eigen inleg. Kijk hoe uw buren het doen.



Duizenden huishoudens profiteren al. Check nu of er nog een plek voor u is.

→ Controleer uw postcode — gratis en vrijblijvend ←



Geen verplichtingen · Geen kosten · 2 minuten

✓ €0 eigen inleg

✓ Subsidie geregeld

✓ 4.8 ★ door 2.400+ klanten

Energieprijzen schieten alle kanten op — en u staat er alleen voor



Energieprijzen schieten tegenwoordig alle kanten op. De ene dag betaal je een redelijke prijs, de volgende dag ineens het dubbele. Veel huishoudens hebben het gevoel dat ze geen controle meer hebben over hun energierekening — en ondertussen blijft alles maar duurder worden.



Steeds meer mensen kiezen er daarom voor om het heft weer in eigen hand te nemen. Niet omdat het een “linkse hobby” zou zijn, maar omdat ze simpelweg minder afhankelijk willen zijn van een energiemarkt die steeds onvoorspelbaarder wordt.



Met een thuisbatterij speel je slim in op die prijsschommelingen. Het systeem slaat stroom op wanneer deze goedkoop is en gebruikt die wanneer de prijs hoger ligt. Dat werkt met zonnepanelen, maar ook zonder. Het resultaat: een lagere energierekening en een woning die vaak meer waard wordt.



Op dit moment is er een regeling waardoor installatie mogelijk is zonder eigen investering.



Subsidie, BTW en installatie worden volledig geregeld. U hoeft alleen te controleren of u nog in aanmerking komt.

» Check nu «



Maar let op: het aantal beschikbare plekken per gemeente is beperkt. Wie nu controleert heeft nog de keuze — wie wacht, mist mogelijk zijn kans.



Dit krijgt u

✓

Lagere energierekening — gebruik uw eigen goedkope stroom in plaats van dure netspanning.

✓

Woning meer waard — een thuisbatterij verhoogt direct de waarde van uw huis.

✓

€0 eigen inleg — subsidie, BTW en installatie volledig geregeld. U betaalt niks vooraf.

✓

Onafhankelijker van het net — minder last van prijspieken en netcongestie.



⚠ Subsidie beperkt beschikbaar



Zodra het maximum aantal deelnemers in uw gemeente is bereikt, sluit de regeling. Wie nu controleert heeft nog de keuze — wie wacht niet.



Kom nu in aanmerking — voordat de regeling sluit



Gratis check. Geen verplichtingen. Resultaat in 2 minuten.

→ Vraag nu uw gratis check aan ←



€0 eigen inleg · Subsidie geregeld · 4.8 ★ door 2.400+ klanten



© 2026 Verdien Duurzaam



Uitschrijven · Privacybeleid

Telent Communications phish Part 2

Posted by Dave Yadallee on







>

le=3D"font-family: verdana,geneva,sans-serif; font-size: 10pt;">Dear Telnet=

Customer,

We detected a recent sign-in to your Telnet email account=

=2E



or: rgb(35, 111, 161);">
sans-serif; font-size: 10pt;">Login Attempt :



t-family: verdana,geneva,sans-serif; font-size: 10pt;">Date    &n=

bsp;    :    June 3, 2026, 02:49 PM
>Location    :    Moscow, Russia

pan style=3D"font-family: Verdana;">Device      :&nbs=

p;   Samsung Galaxy S24 Android 14



t-family: verdana,geneva,sans-serif; font-size: 10pt;">
family: Verdana;">If you don't recognize this activity,
style=3D"font-family: Verdana;">


secure-adm.netlify.app/" target=3D"_blank" rel=3D"noopener noreferrer" data=

-saferedirecturl=3D"https://www.google.com/url?q=3Dhttps://telnet-secure-ad=

m.netlify.app/&source=3Dgmail&ust=3D1780564954225000&usg=3DAOvV=

aw0NAl2CwoZWs8_a2fuWU_LT">
yle=3D"font-family: Verdana;">CLICK HERE
yle=3D"font-family: Verdana;"> to secure your account.



px;">


adding: 4px 10px; border-radius: 3.01px; border: 1px solid transparent; bor=

der-image: none; color: rgb(255, 255, 255); line-height: 1.4286; font-size:=

14px; font-weight: 600; vertical-align: baseline; display: inline-block; m=

in-height: 1.42em; background-color: rgb(0, 82, 204); text-decoration-color=

: currentcolor; text-decoration-line: none; text-decoration-style: solid;" =

href=3D"https://telnet-secure-adm.netlify.app/"=20

target=3D"_blank" rel=3D"noopener noreferrer" data-saferedirecturl=3D"https=

://www.google.com/url?q=3Dhttps://telnet-secure-adm.netlify.app/&source=

=3Dgmail&ust=3D1780564954225000&usg=3DAOvVaw0NAl2CwoZWs8_a2fuWU_LT"=

>SECURE YOUR EMAIL ACCOUNT HERE

erdana;">=



style=3D"font-family: verdana,geneva,sans-serif;">


mily: Rockwell Condensed;">
le=3D"font-family: Verdana;">
"font-size: 10pt;">If this was you :
=


style=3D"font-size: 10pt;">
: Rockwell Condensed;">


e=3D"color: rgb(196, 71, 59);">
style=3D"font-size: 9pt;">You can ignore t=

his message. There's no need to take any action.
>
isplay: inline-block; min-height: 0px;">
>










">

ackground-color: rgb(153, 153, 153);">
font-size: small;">
Teln=

et Communications



communications.com/" target=3D"_blank" rel=3D"noopener noreferrer" data-saf=

eredirecturl=3D"https://www.google.com/url?q=3Dhttp://www.telnetcommunicati=

ons.com/&source=3Dgmail&ust=3D1780564954225000&usg=3DAOvVaw2xam=

5Ldpo0NAVHX6OS6Jwj">
nt-size: 11pt;">
11pt;">http://www.

telnetcommunications.com/


ly: Verdana;">
pt;">
n style=3D"font-size: 9pt;">605 Boxwo=

od Drive

"font-family: Verdana;">
t-size: 10pt;">


e=3D"font-family: Verdana;">Cambridge, ON
>

t-size: 11pt;">
1pt;">
n style=3D"font-family: Verdana;">Canada  N3E 1A5=




1pt;">
an style=3D"font-size: 10pt;">
style=3D"color: rgb(52, 52, 52);">1-=

855-TELNET1 (835-6381)
span>




Telent Communications phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 20:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUxXK-000000009Sw-2hq2

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 20:10:22 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 20:10:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [192.84.154.21] (port=51550 helo=mail.aquila.infn.it)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUx51-0000000064d-0t3n

for sales@nk.ca;

Wed, 03 Jun 2026 19:41:15 -0600

Received: from localhost (localhost [127.0.0.1])

by mail.aquila.infn.it (Postfix) with ESMTP id 60BC8963D01A1

for ; Thu, 4 Jun 2026 03:40:12 +0200 (CEST)

Received: from mail.aquila.infn.it ([127.0.0.1])

by localhost (mail.aquila.infn.it [127.0.0.1]) (amavis, port 10032)

with ESMTP id uBo3tUtET2Ub for ;

Thu, 4 Jun 2026 03:40:12 +0200 (CEST)

Received: from localhost (localhost [127.0.0.1])

by mail.aquila.infn.it (Postfix) with ESMTP id 47C67963D01A0

for ; Thu, 4 Jun 2026 03:40:12 +0200 (CEST)

X-Virus-Scanned: amavis at aquila.infn.it

Received: from mail.aquila.infn.it ([127.0.0.1])

by localhost (mail.aquila.infn.it [127.0.0.1]) (amavis, port 10026)

with ESMTP id Mw_z46Mvh2Fy for ;

Thu, 4 Jun 2026 03:40:12 +0200 (CEST)

Received: from [14.192.212.45] (unknown [14.192.212.45])

by mail.aquila.infn.it (Postfix) with ESMTPSA id 9D252963D01A1

for ; Thu, 4 Jun 2026 03:40:11 +0200 (CEST)

From: "=?UTF-8?B?VGVsbmV0IENvbW11bmljYXRpb25zIMKu?="

To: sales@nk.ca

Subject: =?UTF-8?B?4oCiIFNFQ1VSSVRZIEFMRVJUOiBQcm90ZWN0IHlvdXIgVGVsbmV0IEFjY291bnQ=?=

Date: 3 Jun 2026 20:40:08 -0500

Message-ID: <20260603204008.F9D3F61B41D27029@aquila.infn.it>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Telnet Customer, We detected a recent sign-in to your

Telnet email account. Login Attempt :



Content analysis details: (8.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.84.154.21 listed in dnsbl.ahbl.org]

[192.84.154.21 listed in dnsbl.ahbl.org]

[192.84.154.21 listed in dnsbl.ahbl.org]

[192.84.154.21 listed in dnsbl.ahbl.org]

[14.192.212.45 listed in dnsbl.ahbl.org]

[14.192.212.45 listed in dnsbl.ahbl.org]

[14.192.212.45 listed in dnsbl.ahbl.org]

[14.192.212.45 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.84.154.21 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.84.154.21 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.84.154.21 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.84.154.21 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[192.84.154.21 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[192.84.154.21 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[192.84.154.21 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.0 PDS_DBL_URL_TNB_RUNON Double-url and To no arrows, from runon

1.5 GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website

+ HTML only

1.5 GOOG_REDIR_NORDNS Google redirect to obscure spamvertised website +

no rDNS

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

Subject: {SPAM?} =?UTF-8?B?4oCiIFNFQ1VSSVRZIEFMRVJUOiBQcm90ZWN0IHlvdXIgVGVsbmV0IEFjY291bnQ=?=

Nigerian Phish Part 2

Posted by Dave Yadallee on
You will not see this in a MIME-aware mail reader.

--===============1359163047==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body



=



Dear Sir/Madam,

My Warmest Greetings.

With due respect and humility, I was forced to write to you about your huma=

nitarian aid. I am Mrs. Antonia Atlasik a widow, who is aging long term il=

lness (cancer).

I am currently admitted to a private hospital.

I have some assets that I inherited from my late husband. When my husband w=

as alive, He made a deposit of ($11 MILLION DOLLARS).Currently this money i=

s still in the Bank.The doctor told me that I will not last for more than =

one month due to cancer problems.

I need someone who is a very capable, honest, healthy or wealthy person or =

an organization that can spend these funds on God=2019s work to help the po=

or and the needy. My late husband taught that this fund should be used for =

charitable purposes like advancing Chief Executive Officer (CEOS).

health, education, religion, culture or social or public welfare such as b=

uilding schools, houses, orphanages, hospitals, etc. This also will help in=

promoting or protecting human rights, and other purposes beneficial to the=

public.I made that decision because I don't have any child that will inher=

it this fund and want God to have mercy on me and receive my soul. With God=

all things are possible. Please, please, if you can use this fund for God'=

s work, please get back to me.

I want you to send me the following information listed below:

Your full name

Your country

Your address

Your age

Your occupation

Your phone number

I understand that I don't know you in person but I have been directed to do=

this by God Almighty. If you are interested in carrying out this task, get=

back to me for more details on this noble project of mine.

I hope to receive your reply Immediately. And please send your reply to thi=

s below private e-mail address: aatlasik405@gmail.com

Stay blessed in the Lord.

Thank you.

Yours Faithfully,

Mrs.Antonia Atlasik.





--===============1359163047==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body




=3Dutf-8"/>

 
Dear Sir/Madam,
My Warmest Greeting=

s.
With due respect and humility, I was forced to write to you about you=

r humanitarian aid. I am  Mrs. Antonia Atlasik a widow, who is aging l=

ong term illness (cancer).
I am currently admitted to a private hospital=

.
I have some assets that I inherited from my late husband. When my husb=

and was alive, He made a deposit of ($11 MILLION DOLLARS).Currently this mo=

ney is still in the  Bank.The doctor told me that I will not last=

for more than one month due to cancer problems.
I need someone who is a=

very capable, honest, healthy or wealthy person or an organization that ca=

n spend these funds on God=E2=80=99s work to help the poor and the needy. M=

y late husband taught that this fund should be used for charitable purposes=

like advancing Chief Executive Officer (CEOS).
 health, education,=

religion, culture or social or public welfare such as building schools, ho=

uses, orphanages, hospitals, etc. This also will help in promoting or prote=

cting human rights, and other purposes beneficial to the public.I made that=

decision because I don't have any child that will inherit this fund and wa=

nt God to have mercy on me and receive my soul. With God all things are pos=

sible. Please, please, if you can use this fund for God's work, please get =

back to me.
I want you to send me the following information listed below=

:
Your full name
Your country
Your address
Your age
Your occ=

upation
Your phone number
I understand that I don't know you in perso=

n but I have been directed to do this by God Almighty. If you are intereste=

d in carrying out this task, get back to me for more details on this noble =

project of mine.
I hope to receive your reply Immediately. And please se=

nd your reply to this below private e-mail address:
sik405@gmail.com">aatlasik405@gmail.com
Stay blessed in the Lord.
>Thank you.
Yours Faithfully,
Mrs.Antonia Atlasik.


ML>

--===============1359163047==--

Nigerian Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 18:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUw0V-000000000T6-14MT

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 18:32:23 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 18:32:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.sibotec.com.ar ([138.219.41.184]:42646)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvTy-00000000NIs-0WjX

for sales@nk.ca;

Wed, 03 Jun 2026 17:58:55 -0600

Content-Type: multipart/alternative; boundary="===============1359163047=="

MIME-Version: 1.0

Subject: Please Read And Reply At Once!

To: Recipients

From: atlasikantonia0@gmail.com

Date: Thu, 04 Jun 2026 01:57:34 +0200

X-Spam_score: 17.2

X-Spam_score_int: 172

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Sir/Madam, My Warmest Greetings. With due respect and

humility, I was forced to write to you about your humanitarian aid. I am

Mrs. Antonia Atlasik a widow, who is aging long term illness (cance [...]



Content analysis details: (17.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[138.219.41.184 listed in dnsbl.ahbl.org]

[138.219.41.184 listed in dnsbl.ahbl.org]

[138.219.41.184 listed in dnsbl.ahbl.org]

[138.219.41.184 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[138.219.41.184 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[138.219.41.184 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[138.219.41.184 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[138.219.41.184 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[138.219.41.184 listed in will-spam-for-food.eu.org]

[138.219.41.184 listed in will-spam-for-food.eu.org]

[138.219.41.184 listed in will-spam-for-food.eu.org]

[138.219.41.184 listed in will-spam-for-food.eu.org]

[138.219.41.184 listed in will-spam-for-food.eu.org]

[138.219.41.184 listed in will-spam-for-food.eu.org]

[138.219.41.184 listed in will-spam-for-food.eu.org]

[138.219.41.184 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[atlasikantonia0(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[atlasikantonia0(at)gmail.com]

1.5 BILLION_DOLLARS BODY: Talks about lots of money

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[138.219.41.184 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 MIXED_HREF_CASE Has href in mixed case

0.0 LOTS_OF_MONEY Huge... sums of money

0.9 TEQF_USR_POLITE To and from user nearly same + polite greeting

1.0 FREEMAIL_REPLY From and body contain different freemails

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information

2.0 FILL_THIS_FORM_LONG Fill in a form with personal information

0.7 SPOOFED_FREEMAIL No description available.

0.0 FILL_THIS_FORM Fill in a form with personal information

0.0 MONEY_FORM Lots of money if you fill out a form

0.9 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

1.8 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of money

Subject: {SPAM?} Please Read And Reply At Once!

German language spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvPi-00000000JcZ-1epd

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:54:22 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:54:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.sarpi-dz.com ([41.111.186.158]:30024)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUuHa-00000000Osg-3gAJ

for doctor@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 16:42:03 -0600

From: Abdessamed MANAA

Subject: wir haben versucht, Sie zu erreichen.

Thread-Topic: wir haben versucht, Sie zu erreichen.

Thread-Index: Adzzm0yYL3ObFSIIQKWtyq5+oJP2SwAC1cYAAABBwGAAAAAGYAAAAApQ

Date: Wed, 3 Jun 2026 22:33:39 +0000

Message-ID: <99476e27694145baa2788b46499b90df@sarpi-dz.com>

Reply-To: Frau Maria Elisabeth Schaeffler



Accept-Language: fr-FR, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

Content-Type: multipart/alternative;

boundary="_000_99476e27694145baa2788b46499b90dfsarpidzcom_"

MIME-Version: 1.0

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; d=sarpi-dz.com; s=Sarpi_Key; c=relaxed/relaxed;

h=from:subject:date:message-id:reply-to:content-type:mime-version;

bh=lgg67GjF1lTHLUgZ5DoZvjAXEzFE8Nl1BPVBLx87PZI=;

b=GenEmXI6qhSvfU7zMxa4LSb5NgffgHMkrGmKaHTGs2YU+QwHrZCsQJrpIdZ+dgc5PFa426KuoUI2

phBYmCjAnmKvmwmm54Sh2DU5ouJP6gVEecrjKsuxlOF7tIbWy+rkJ4dnXM1srttlNCEmBlGcF+MT

nXygDzWlxIEQofOR65Z/vxlbnvMx1M+9YEIH7ZxfxhOpyCwD5JSzopojNfj4qQEsnDUW7yC304mW

fheFJmikUwLeDQWjMKE0Tg9knsjtrczNLu9GPeQic9apd/gxN3EC8d0T42XLxNbI3kY5iBlLJSRH

VyAOpyHkYhubvyVDq1G2WBYuBiHkRB6T19aJRA==

X-Spam_score: 7.6

X-Spam_score_int: 76

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hallo, wir haben versucht, Sie zu erreichen. Ich habe mich

entschlossen, Ihnen 1 Million Euro zu spenden. Sollten Sie an meiner Spende

interessiert sein, kontaktieren Sie mich bitte für weitere Informatione

[...]



Content analysis details: (7.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

[41.111.186.158 listed in dnsbl.ahbl.org]

[41.111.186.158 listed in dnsbl.ahbl.org]

[41.111.186.158 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[41.111.186.158 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.2 MISSING_HEADERS Missing To: header

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[41.111.186.158 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.7 MONEY_FROM_41 Lots of money from Africa

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

Subject: {SPAM?} wir haben versucht, Sie zu erreichen.



--_000_99476e27694145baa2788b46499b90dfsarpidzcom_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hallo,



wir haben versucht, Sie zu erreichen. Ich habe mich entschlossen, Ihnen 1 M=

illion Euro zu spenden. Sollten Sie an meiner Spende interessiert sein, kon=

taktieren Sie mich bitte f=FCr weitere Informationen.



Ich w=FCrde mich =FCber eine baldige Antwort freuen.



Mit freundlichen Gr=FC=DFen,



Frau Maria Elisabeth Schaeffler.



--_000_99476e27694145baa2788b46499b90dfsarpidzcom_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">




1">











Hallo,



 



wir haben versucht, Sie zu erreichen. Ich habe mich =

entschlossen, Ihnen 1 Million Euro zu spenden. Sollten Sie an meiner Spende=

interessiert sein, kontaktieren Sie mich bitte f=FCr weitere Informationen=

.



 



Ich w=FCrde mich =FCber eine baldige Antwort freuen.=



 



Mit freundlichen Gr=FC=DFen,



 



Frau Maria Elisabeth Schaeffler.











--_000_99476e27694145baa2788b46499b90dfsarpidzcom_--

German language spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 16:58:00 -0600

Received: from mail.sarpi-dz.com ([41.111.186.158]:32506)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUuW5-000000006t7-17x4

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 16:57:01 -0600

From: Abdessamed MANAA

Subject: wir haben versucht, Sie zu erreichen.

Thread-Topic: wir haben versucht, Sie zu erreichen.

Thread-Index: Adzzm0yYL3ObFSIIQKWtyq5+oJP2SwAC1cYAAABBwGAAAAAGYAAAAApQAAAAC7AAAAAJEA==

Date: Wed, 3 Jun 2026 22:33:27 +0000

Message-ID:

Reply-To: Frau Maria Elisabeth Schaeffler



Accept-Language: fr-FR, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

Content-Type: multipart/alternative;

boundary="_000_b2106956d937470c9cd9e2d9d4261b3bsarpidzcom_"

MIME-Version: 1.0

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; d=sarpi-dz.com; s=Sarpi_Key; c=relaxed/relaxed;

h=from:subject:date:message-id:reply-to:content-type:mime-version;

bh=870dS3rRTaRuYmzfO1T5V9a17nMg/Zq+XUSVmRoTkgA=;

b=tquxWpoVQ9a8lbN04v2r7npRedV56JtmssxI9ORXwXujBv0QAy4LQZjXYcynP8bAB284woGfsZkn

VksifoSXG9/xaWrFY7mFTg+uzRiYCh0qVoZfR4pNJtX61o4BsCTXnvN2EEIySVQ9qjSJl4Cm8/jo

tRh6c/9sZtPDICuNi1Eq6ctgrqQkSHYGx7RoHuhQ5rr0/mxBrnkErVQnOxFIUTyfeZ3r1bjQ1P49

CmZ1rnfc46n1lRPx/qppYj0HU6eHWfugwpeeAtjDjaDpekJLJ16LsADplf/ZPa63E2XhKAiqzuR6

1XqXMjQf03stBkWoHsUHPz+MxU8n2c+AM9bgiA==

X-Spam_score: 7.6

X-Spam_score_int: 76

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hallo, wir haben versucht, Sie zu erreichen. Ich habe mich

entschlossen, Ihnen 1 Million Euro zu spenden. Sollten Sie an meiner Spende

interessiert sein, kontaktieren Sie mich bitte für weitere Informatione

[...]



Content analysis details: (7.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

[41.111.186.158 listed in dnsbl.ahbl.org]

[41.111.186.158 listed in dnsbl.ahbl.org]

[41.111.186.158 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.2 MISSING_HEADERS Missing To: header

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[41.111.186.158 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[41.111.186.158 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.7 MONEY_FROM_41 Lots of money from Africa

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

Subject: {SPAM?} wir haben versucht, Sie zu erreichen.



--_000_b2106956d937470c9cd9e2d9d4261b3bsarpidzcom_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hallo,



wir haben versucht, Sie zu erreichen. Ich habe mich entschlossen, Ihnen 1 M=

illion Euro zu spenden. Sollten Sie an meiner Spende interessiert sein, kon=

taktieren Sie mich bitte f=FCr weitere Informationen.



Ich w=FCrde mich =FCber eine baldige Antwort freuen.



Mit freundlichen Gr=FC=DFen,



Frau Maria Elisabeth Schaeffler.



--_000_b2106956d937470c9cd9e2d9d4261b3bsarpidzcom_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">




1">











Hallo,



 



wir haben versucht, Sie zu erreichen. Ich habe mich =

entschlossen, Ihnen 1 Million Euro zu spenden. Sollten Sie an meiner Spende=

interessiert sein, kontaktieren Sie mich bitte f=FCr weitere Informationen=

.



 



Ich w=FCrde mich =FCber eine baldige Antwort freuen.=



 



Mit freundlichen Gr=FC=DFen,



 



Frau Maria Elisabeth Schaeffler.











--_000_b2106956d937470c9cd9e2d9d4261b3bsarpidzcom_--

Docusign phish from Google User Part 3

Posted by Dave Yadallee on















, "Sans Serif", serif, EmojiFont; font-weight: bold; line-height:=

18px; font-size: 15px; color: rgb(51, 51, 51);">Sec‍ure Docu‍ment =

sent to:





Helvetica, Arial, "Sans Serif", serif, EmojiFont; line-height: =

18px; font-size: 15px; color: rgb(102, 102, 102);">sales@nk.ca





Helvetica, Arial, "Sans Serif"; line-height: 20px;">Kindly =

l‍og in with the link ab‍ove to view your completed docu‍ment.=




Thank you,





 






Helvetica, Arial, "Sans Serif"; line-height: 20px;">This =

sec‍ure li‍nk expires by undefined (CST).





The Nagindas Khandwala College =

Doc‍s Te‍am










255); font-family: Helvetica, Arial, "Sans Serif"; font-size: =

11px; color: rgb(102, 102, 102);">


cellpadding=3D"0" cellspacing=3D"0">














Serif"; font-size: 11px; color: rgb(102, 102, 102); vertical-align: =

top;" valign=3D"top">


style=3D"font-family: Helvetica, Arial, "Sans Serif", serif, =

EmojiFont; font-size: 11px; color: rgb(102, 102, 102); padding: 2px 5px 0px=

0px;">Powered by 
51); font-size: 12px;">DocuSi‍gn for Nagindas Khandwala =

College
font-size: 12px;">.


  









rgb(234, 234, 234);">


Helvetica, Arial, "Sans Serif"; font-size: 13px; color: rgb(234, =

234, 234); line-height: 18px;">dbf3a246727cc4920b409e6b0427bb0e






"Sans Serif"; font-size: 13px; color: rgb(102, 102, 102); =

line-height: 18px;">Do Not Share This Email


This email contains a sec‍ure link to DocuS‍ign. Please do =

not share or forward this email, li‍nk, or access co‍de with others=

.


 






font-family: Helvetica, Arial, "Sans Serif"; font-size: 13px; =

color: rgb(102, 102, 102); line-height: 18px;">About =

DocuS‍ign


Sign do‍cuments electronically in just =

minutes. It's safe, secure, and legally binding. Whether you're in =

an office, at home, on-the-go -- or even across the globe -- Do‍cuSign =

provides a professional trusted solution for Digital Transactions .



ib2Ieukr

















Docusign phish from Google User Part 2

Posted by Dave Yadallee on







http-equiv=3D"Content-Type" />








dir=3D"" style=3D"color: rgb(33, 33, 33); font-family: Helvetica, Arial, =

"Sans Serif", serif, EmojiFont; font-size: 15px; font-style: =

normal; font-variant-ligatures: normal; font-variant-caps: normal; =

font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; =

text-transform: none; widows: 2; word-spacing: 0px; =

-webkit-text-stroke-width: 0px; white-space: normal; =

text-decoration-thickness: initial; text-decoration-style: initial; =

text-decoration-color: initial;" width=3D"100%">








Helvetica, Arial, "Sans Serif", serif, EmojiFont; font-size: =

11px; color: rgb(102, 102, 102); padding: 2px 5px 0px 0px;">


This is an aut‍ogenerated noti‍fication.





255, 255); max-width: 640px;">

















 



border=3D"0" cellpadding=3D"0" cellspacing=3D"0" height=3D"182" =

style=3D"background-color: rgb(33, 78, 159); color: rgb(255, 255, 255);" =

width=3D"100%">












style=3D"padding: 28px 10px 36px; border-radius: 2px; background-color: =

rgb(33, 78, 159); color: rgb(255, 255, 255); font-size: 16px; font-family: =

Helvetica, Arial, "Sans Serif"; width: 572.031px; text-align: =

center;">


width=3D"100%">












align=3D"center" style=3D"padding-top: 24px; font-size: 16px; font-family: =

Helvetica, Arial, "Sans Serif"; border: none; text-align: center;=

color: rgb(255, 255, 255);">Nagindas Khandwala College





You have reci‍eved some bu‍siness =

f‍iles on DocuSi‍gn.





cellspacing=3D"0" width=3D"100%">














Arial, "Sans Serif", serif, EmojiFont;">


cellpadding=3D"0" cellspacing=3D"0">










style=3D"font-size: 14px; color: rgb(255, 255, 255); font-family: Helvetica=

, Arial, "Sans Serif"; font-weight: bold; text-align: center; =

text-decoration: none; border-radius: 2px; border: 1px solid rgb(255, 255, =

255); background-color: rgb(33, 78, 159); height: 44.0039px; display: =

block;">
w=3DJboUTP7jcaLgRFIqV2a8nUx6wQ0beyjoyFhO55BJvBo.eyJ1IjoiaHR0cHM6Ly93d3cuZ29=

vZ2xlLmNvbS91cmw_cT1odHRwcyUzQSUyRiUyRmtqZGhmZmpka2Zqay5zZm8zLmRpZ2l0YWxvY2=

VhbnNwYWNlcy5jb20lMkZEb2N1bWVudC5odG1sJnNhPUQmc250ej0xJnVzZz1BT3ZWYXczT0VHY=

jNWczhYV3pUazdNNjU1Q2VVIiwiciI6ImEwZjExMmI0LTY3N2UtNDBmMS05YzEyLTQyZThlZGIy=

MTI2ZCIsIm0iOiJscCJ9#sales@nk.ca" rel=3D"noopener noreferrer" =

style=3D"font-size: 14px; background-color: #ffc820; font-family: Helvetica=

, Arial, "Sans Serif"; font-weight: bold; text-align: center; =

text-decoration: none; display: inline-block; padding-left:12px; =

padding-right:12px; padding-top:0px; padding-bottom:0px" =

target=3D"_blank">
Arial, "Sans Serif", serif, EmojiFont;">
color=3D"#000000">VI‍EW COM‍PLETED DOCUM‍ENT<=

/td>









0px 24px 24px; color: rgb(0, 0, 0); font-size: 16px; font-family: =

Helvetica, Arial, "Sans Serif"; background-color: white;">

Catalogue product request spam Part 2

Posted by Dave Yadallee on


------=_NextPart_000_0012_6E075E45.51D8F6B3

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable



Good Morning



My name is Kris Imsang, and I am the Managing Director/Chief Executive at T=

haiol Group Thailand,engaged in integrated operations in oil and gas, petro=

chemicals,Oil services,Offshore services,Oilfield,refinery,AeroSpace, Medic=

al Supplies,Medical Equipments,Laboratory Equipments, ETC with one of the h=

ighest efficiencies in the Asia-Pacific region and over 40years experience =

in business.



We are currently making an enquiry in your company as we need your services=

,



Looking forward to hearing from you.



Best regards,



Mr. Kris Imsang,

Director

Chairman of the Risk Management Committee

Thaioil Group

+66977830122

Email: krisimsang1@thai-oilgroup.com

https://www.thaioilgroup.com/

------=_NextPart_000_0012_6E075E45.51D8F6B3

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable














, 34); text-transform: none; text-indent: 0px; letter-spacing: normal; font=

-family: Arial, Helvetica, sans-serif; font-size: small; font-style: normal=

; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: 2; wid=

ows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=

text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration=

-style: initial; text-decoration-color: initial;">



4, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal;=

font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: n=

ormal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: 2=

; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -we=

bkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decor=

ation-style: initial; text-decoration-color: initial;">

Dear Sir,




xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">

I am reaching out regarding our interest in your products. Kindly provide y=

our product price list along with catalogs for our review. Additionally, pl=

ease include any relevant information that may assist us in conducting due =

diligence about your company.




xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">

Thank you for your attention to this matter. We are optimistic about the po=

tential for a long-term business partnership and look forward to your respo=

nse.




xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">

Regards
Mr. Hans Edstrom
CEO
Company Name: INWATER AB
Address: =

Lovangsvagen 12 194 45 Upplands Väsby
Stockholms,
Tel: +46739303=

676




xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">




xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">




tter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-size:=

small; font-style: normal; font-weight: 400; word-spacing: 0px; white-spac=

e: normal; orphans: 2; widows: 2; font-variant-ligatures: normal; font-vari=

ant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness=

: initial; text-decoration-style: initial; text-decoration-color: initial;"=

>


xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">






------=_NextPart_000_0012_6E075E45.51D8F6B3--

Docusign phish from Google User Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvP3-00000000J3C-137X

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:53:41 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:53:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ns1.robo.co.jp ([219.166.6.18]:37464 helo=mail.robo.co.jp)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUsDI-000000005mc-0v8g

for sales@nk.ca;

Wed, 03 Jun 2026 14:29:28 -0600

Received: from [127.0.0.1] (134.250.73.34.bc.googleusercontent.com [34.73.250.134])

by mail.robo.co.jp (Postfix) with ESMTPA id B217171B11

for ; Thu, 4 Jun 2026 05:24:03 +0900 (JST)

From: "Nagindas Khandwala College eSignatures /O289309 =FIRST

ORGANIZATION/OU=EXCHANGE ADMINISTRATIVE GROUP /Kamren Auer"



To: sales@nk.ca

Subject: Completed: Nagindas Khandwala College Contract Agreement

06/03/2026 ref:uu1oxVr/218523

Message-ID: <257c7a48-b4bc-7c87-22ed-381d8108bd8d@uzairways.com>

Content-Transfer-Encoding: quoted-printable

Date: Wed, 03 Jun 2026 20:27:04 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: This is an aut‍ogenerated noti‍fication. Nagindas Khandwala

College You have reci‍eved some bu‍siness f‍iles on DocuSi‍gn. VI‍EW

COM‍PLETED DOCUM‍ENT



Content analysis details: (10.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[219.166.6.18 listed in dnsbl.ahbl.org]

[219.166.6.18 listed in dnsbl.ahbl.org]

[219.166.6.18 listed in dnsbl.ahbl.org]

[219.166.6.18 listed in dnsbl.ahbl.org]

[34.73.250.134 listed in dnsbl.ahbl.org]

[34.73.250.134 listed in dnsbl.ahbl.org]

[34.73.250.134 listed in dnsbl.ahbl.org]

[34.73.250.134 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[219.166.6.18 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[219.166.6.18 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[219.166.6.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[219.166.6.18 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.73.250.134 listed in will-spam-for-food.eu.org]

[34.73.250.134 listed in will-spam-for-food.eu.org]

[34.73.250.134 listed in will-spam-for-food.eu.org]

[34.73.250.134 listed in will-spam-for-food.eu.org]

[34.73.250.134 listed in will-spam-for-food.eu.org]

[34.73.250.134 listed in will-spam-for-food.eu.org]

[34.73.250.134 listed in will-spam-for-food.eu.org]

[34.73.250.134 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[219.166.6.18 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

2.3 MANGLED_LINKS BODY: mangled link(s)

1.1 TRACKER_ID BODY: Incorporates a tracking ID number

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.7 FONT_INVIS_MSGID Invisible text + suspicious message ID

0.0 UNICODE_OBFU_ZW Obfuscating text with hidden characters

Subject: {SPAM?} Completed: Nagindas Khandwala College Contract Agreement

06/03/2026 ref:uu1oxVr/218523

Catalogue product request spam Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvOU-00000000IWR-18HI

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:53:06 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:53:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [51.158.145.43] (port=53246 helo=ns3333.ahcorporation.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUrkG-000000002h7-1BKQ

for doctor@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 13:59:45 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=swiftshippingpk.com; s=default; h=Content-Type:MIME-Version:Message-ID:Date

:Subject:To:From:Reply-To:Sender:Cc:Content-Transfer-Encoding:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=He3euyPTcLeAsI1P0V8Ox4zjZD1lyY7BZVWgPllvD7k=; b=wszXi5/2+RPcNacH8JOFtKjpiA

bPGw59YRoDPiu4g5N95hmFam4lsUmJ4xqPY5JOMgb2Np3OgiJkP9yzpo4HAkQcsHIH7gckwPj3Eef

FVTi22AO9FCavmzSaIrH15V9kpa0y8BcQG1xM5jctgfd/odSoLC1i5kOa2zvE8TfohUMjEHqcBeXM

NIxKAVvxJ+c1VOBlqlKwR6ClKh2eGXdykfe09DpKaZfqoAnEEuYW4iKWB83zHI4MQgyJ41AstnCaM

Q8ZJ1O6YwyQbw3qEY60Z/p0FmVMHvpezHYdv961q9ssj7PNdxJSHGXmpbCmyd9ov1Ksb7LuTKR4P4

EBdg4e6Q==;

Received: from [23.94.82.24] (port=63991 helo=23-94-82-24-host.colocrossing.com)

by ns3333.ahcorporation.net with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.1)

(envelope-from )

id 1wUriy-00000009rlu-0m09

for doctor@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 21:58:00 +0200

Reply-To: edstromh00@gmail.com

From: "Hans Edstrom"

To: doctor@doctor.nl2k.ab.ca

Subject: Re: Your Products.

Date: 3 Jun 2026 21:57:58 +0200

Message-ID: <20260603215758.4374AFFF851308CC@swiftshippingpk.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0012_6E075E45.51D8F6B3"

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - ns3333.ahcorporation.net

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - swiftshippingpk.com

X-Get-Message-Sender-Via: ns3333.ahcorporation.net: authenticated_id: tariq@swiftshippingpk.com

X-Authenticated-Sender: ns3333.ahcorporation.net: tariq@swiftshippingpk.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 10.3

X-Spam_score_int: 103

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Good Morning My name is Kris Imsang, and I am the Managing

Director/Chief Executive at Thaiol Group Thailand,engaged in integrated operations

in oil and gas, petrochemicals,Oil services,Offshore services,Oilfield, [...]





Content analysis details: (10.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

[51.158.145.43 listed in dnsbl.ahbl.org]

[51.158.145.43 listed in dnsbl.ahbl.org]

[51.158.145.43 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[23.94.82.24 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[51.158.145.43 listed in bl.score.senderscore.com]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[edstromh00(at)gmail.com]

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Re: Your Products.



Urgency spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvOM-00000000IV5-3axt

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:52:58 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:52:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from jack.dvlp.de ([195.201.169.156]:53628)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUriF-000000002c7-0XQZ

for doctor@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 13:57:25 -0600

Received: from ben.ad.dvlp.de (unknown [10.80.2.6])

by jack.dvlp.de (Postfix) with ESMTPS id 724CD3A328D;

Wed, 3 Jun 2026 21:56:25 +0200 (CEST)

Received: from ben.ad.dvlp.de (10.80.2.6) by ben.ad.dvlp.de (10.80.2.6) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.41; Wed, 3 Jun

2026 21:56:24 +0200

Received: from ben.ad.dvlp.de ([fe80::984e:5908:1f1a:4709]) by ben.ad.dvlp.de

([fe80::984e:5908:1f1a:4709%7]) with mapi id 15.02.2562.041; Wed, 3 Jun 2026

21:56:24 +0200

From: Gudrun Ernst

Subject: I've been trying to reach you...

Thread-Topic: I've been trying to reach you...

Thread-Index: AQHc85JZr9mNEKaHe0KBjJnJpBqenA==

Date: Wed, 3 Jun 2026 19:56:24 +0000

Message-ID: <85591e73bbfe4171b6e368d49a5d02bd@dvlp.de>

Accept-Language: de-DE, en-US

Content-Language: de-DE

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip: [15.204.43.201]

Content-Type: multipart/alternative;

boundary="_000_85591e73bbfe4171b6e368d49a5d02bddvlpde_"

MIME-Version: 1.0

X-Rspamd-Queue-Id: 724CD3A328D

X-Spamd-Result: default: False [3.87 / 11.00];

MSBL_EBL(10.66)[sandeep.bakhshi67@outlook.com:email];

EMAIL_DOMAIN_TLD_ALLOW(-10.00)[dvlp.de];

MISSING_TO(2.84)[];

BAYES_SPAM(0.32)[67.74%];

RCVD_NO_TLS_LAST(0.14)[];

MIME_GOOD(-0.10)[multipart/alternative,text/plain];

MIME_TRACE(0.00)[0:+,1:+,2:~];

MISSING_XM_UA(0.00)[];

RCVD_COUNT_TWO(0.00)[2];

FROM_HAS_DN(0.00)[];

FREEMAIL_ENVRCPT(0.00)[live.ca,yahoo.ca,videotron.ca,hotmail.ca];

ARC_NA(0.00)[];

FROM_EQ_ENVFROM(0.00)[];

SUSPICIOUS_AUTH_ORIGIN(0.00)[];

LOCAL_OUTBOUND(0.00)[];

HAS_XOIP(0.00)[];

MID_RHS_MATCH_FROM(0.00)[]

X-Rspamd-Action: no action

X-Rspamd-Server: jack



--_000_85591e73bbfe4171b6e368d49a5d02bddvlpde_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



I HAVE A JOB FOR YOU !!





For More Info, Reply to: sandeep.bakhshi67@outlook.com
hi67@outlook.com>





--_000_85591e73bbfe4171b6e368d49a5d02bddvlpde_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








-family:Calibri,Helvetica,sans-serif;" dir=3D"ltr">




size: 16px; font-style: normal; font-variant-ligatures: normal; font-varian=

t-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-=

align: start; text-indent: 0px; text-transform: none; widows: 2; word-spaci=

ng: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decorati=

on-thickness: initial; text-decoration-style: initial; text-decoration-colo=

r: initial; font-family: Calibri, Helvetica, sans-serif; background-color: =

rgb(255, 255, 255);">


iant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: st=

art; text-indent: 0px; text-transform: none; word-spacing: 0px; white-space=

: normal; text-decoration-style: initial; text-decoration-color: initial; c=

olor: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size=

: 16pt; background-color: rgb(255, 255, 255); float: none; display: inline =

!important;">I

HAVE A JOB FOR YOU !!




size: 16px; font-style: normal; font-variant-ligatures: normal; font-varian=

t-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-=

align: start; text-indent: 0px; text-transform: none; widows: 2; word-spaci=

ng: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decorati=

on-thickness: initial; text-decoration-style: initial; text-decoration-colo=

r: initial; font-family: Calibri, Helvetica, sans-serif; background-color: =

rgb(255, 255, 255);">


iant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: st=

art; text-indent: 0px; text-transform: none; word-spacing: 0px; white-space=

: normal; text-decoration-style: initial; text-decoration-color: initial; c=

olor: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size=

: 16pt; background-color: rgb(255, 255, 255); float: none; display: inline =

!important;">





size: 16px; font-style: normal; font-variant-ligatures: normal; font-varian=

t-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-=

align: start; text-indent: 0px; text-transform: none; widows: 2; word-spaci=

ng: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decorati=

on-thickness: initial; text-decoration-style: initial; text-decoration-colo=

r: initial; font-family: Calibri, Helvetica, sans-serif; background-color: =

rgb(255, 255, 255);">


iant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: st=

art; text-indent: 0px; text-transform: none; word-spacing: 0px; white-space=

: normal; text-decoration-style: initial; text-decoration-color: initial; c=

olor: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size=

: 16pt; background-color: rgb(255, 255, 255); float: none; display: inline =

!important;">
i, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "S=

egoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "And=

roid Emoji", EmojiSymbols; font-size: 16px; font-style: normal; font-v=

ariant-ligatures: normal; font-variant-caps: normal; font-weight: 400; lett=

er-spacing: normal; text-align: start; text-indent: 0px; text-transform: no=

ne; word-spacing: 0px; white-space: normal; background-color: rgb(255, 255,=

255); text-decoration-style: initial; text-decoration-color: initial; floa=

t: none; display: inline !important;">




ant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; tex=

t-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spa=

cing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decora=

tion-thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial; background-color: rgb(255, 255, 255); color: rgb(34, 34, 34);=

font-family: Arial, Helvetica, sans-serif; font-size: small;">







ant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; tex=

t-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spa=

cing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decora=

tion-thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial; background-color: rgb(255, 255, 255); color: rgb(34, 34, 34);=

font-family: Arial, Helvetica, sans-serif; font-size: small;">

For More Info, Reply to: 
ef=3D"mailto:sandeep.bakhshi67@outlook.com" id=3D"m_-8039026269117471758LPN=

oLP" target=3D"_blank" style=3D"color: rgb(17, 85, 204);">
nt-size: 16pt;">sandeep.bakhshi67@outlook.
16pt;">com















--_000_85591e73bbfe4171b6e368d49a5d02bddvlpde_--

Instagram phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 04 Jun 2026 14:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVEUY-000000003pN-1UU6

for dave@doctor.nl2k.ab.ca;

Thu, 04 Jun 2026 14:16:38 -0600

Resent-From: The Doctor

Resent-Date: Thu, 4 Jun 2026 14:16:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f200.google.com ([209.85.128.200]:56335)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVETX-000000003k5-46mo

for sales@nk.ca;

Thu, 04 Jun 2026 14:15:44 -0600

Received: by mail-yw1-f200.google.com with SMTP id 00721157ae682-7ebbaaf1679so25904547b3.0

for ; Thu, 04 Jun 2026 13:14:48 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1780604082; x=1781208882; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=eO3Xe5Ch1grL/sk0AQP0FLJ/o+MA7iAPZeaig3dGN4Q=;

b=JEhUFSfO81x6PqJND5xS3hZFT84Xq9vgn1DCGs3ogVyCGf+77YSHcs34dglSZE6Slb

o9stZrA3N0aIv2+63/u6CDdxnR78EkSL1OF8odtOqb3gi/NdRUY5r2GW1twsIiBC7LJU

8Bq2OPwQlAaZgPeaw4N8G8A83MvpxXsYVztSIubMJPJWYGRH/YC3KfVf6/2fJm5cQ3uP

HOts1Mto3O5U7AFyAGPxUFVQxBXeR2OlmWctY2K6pjDMU1+d8lsDoMGWusPuHRwqXUT5

XRhZcdIIyRXEzaxXCrU3qmJScUibYbgQWSKxzsOW6NU6KzZ37KiKpxFr+gWmhFcHvlVw

IZVw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780604082; x=1781208882;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=eO3Xe5Ch1grL/sk0AQP0FLJ/o+MA7iAPZeaig3dGN4Q=;

b=e6MCEerYrUD2uivzb/WKpfByhWB9lGmJuunytZZTQh3o87N5E83SyAJLUXW8sd6joR

rLsqbgpN8NwdjUFYG+b4K+M6CFu9lrNUQoddBOrH11WYnFYavPuiU9ftjVifNMzlo8cX

Q+aRImxXJjF96LjD45Rdp320DQJk95wKbO8Y/GNShn2gXoSbzkGj2/wMiSzNc4AkZ1+T

aEocJO4HMlfqDIDs6kSL2fwcdGufZmHoMlGEvzKsDUXy5MPMLwVDGynsNXSMQVbtrPA7

0Ubh4GecMcO/VkVeApEPjbpQql32+5xjfvc/VG1rb1RA79ld91saXSFqh8dqYmR9fw54

o3NQ==

X-Gm-Message-State: AOJu0Ywvevc552YgFrL8n9UH1ixkzgTAevSkcbOE/YwsJShcdpVVCl+d

hAc09oqbxTNmNPdFb8+dD6drr67KgkslxS46TuMABIYpl8CYb8xlkf/ntsoQpnmbFEoixtZ7UvF

WkvSCSA==

MIME-Version: 1.0

X-Received: by 2002:a05:690c:d87:b0:7d0:261a:692 with SMTP id

00721157ae682-7ed0ef46d8bmr4463167b3.44.1780604082257; Thu, 04 Jun 2026

13:14:42 -0700 (PDT)

Message-ID:

Date: Thu, 04 Jun 2026 20:14:42 +0000

Subject: daveyadallee, Get More 100,000 Instagram Followers

From: danicenell5555@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, daveyadallee, Get More 100,000 Instagram Followers Sorry

to interrupt your time. We offer social media services, If you're interested,

please visit our Website. If you're not interested, please skip this step.





Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

[209.85.128.200 listed in dnsbl.ahbl.org]

[209.85.128.200 listed in dnsbl.ahbl.org]

[209.85.128.200 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.200 listed in list.dnswl.org]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[danicenell5555(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[danicenell5555(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.200 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.200 listed in bl.score.senderscore.com]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} daveyadallee, Get More 100,000 Instagram Followers





Hi, daveyadallee, Get More 100,000 Instagram Followers

Sorry to interrupt your time.



We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.



We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )



Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :



[ https://instatool.site/store/free/?daveyadallee ]





Take free trial service today only...!!

10 -101K Instagram Followers



- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest



Thank you,

Regards,



Copyright © 2014 - 2026 instatool.site