Web/SEO/App Spam from Microsoft Outlook Part 2

Content preview: Hi there, I apologize for the cold outreach. If your team

is still spending time on cold calling, appointment setting, lead generation,

CRM updates, or admin work, we can take that off your plate immediately—with

reliable virtual assistants av [...]



Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:a01:a0:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:1096:a01:a0:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:1096:a01:a0:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:1096:a01:a0:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:1096:a01:a0:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:1096:a01:a0:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:1096:a01:a0:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:1096:a01:a0:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[52.103.67.12 listed in will-spam-for-food.eu.org]

[52.103.67.12 listed in will-spam-for-food.eu.org]

[52.103.67.12 listed in will-spam-for-food.eu.org]

[52.103.67.12 listed in will-spam-for-food.eu.org]

[52.103.67.12 listed in will-spam-for-food.eu.org]

[52.103.67.12 listed in will-spam-for-food.eu.org]

[52.103.67.12 listed in will-spam-for-food.eu.org]

[52.103.67.12 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.67.12 listed in dnsbl.ahbl.org]

[52.103.67.12 listed in dnsbl.ahbl.org]

[52.103.67.12 listed in dnsbl.ahbl.org]

[52.103.67.12 listed in dnsbl.ahbl.org]

[2603:1096:a01:a0:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:1096:a01:a0:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:1096:a01:a0:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:1096:a01:a0:0:0:0:14 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.67.12 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.67.12 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.67.12 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.67.12 listed in dnsbl.ahbl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ranjittakaur(at)hotmail.com]

1.2 MISSING_HEADERS Missing To: header

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.67.12 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} RE: Interested in our pricing/package plan? Can I share it?









Hi there,







I apologize for the cold outreach.







If your team is still spending time on cold calling, appointment setting, lead generation, CRM updates, or admin work, we can take that off your plate immediately—with reliable virtual assistants available part-time or full-time.







Interested in pricing or learning more? Let’s connect!







Best regards,



Ranjitta Kaur







From: Ranjittakaur@hotmail.com On Behalf Of Ranjittakaur@hotmail.com

Sent: Wednesday, January 14, 2026 2:52 PM

Subject: RE: VA – Part-Time or Full-Time?







Hello,







Just following up on my previous emails—any update would be appreciated.







Thank you,



Ranjitta Kaur







From: Ranjittakaur@hotmail.com On Behalf Of Ranjittakaur@hotmail.com

Sent: Monday, December 29, 2025 11:57 AM

Subject: VA – Part-Time or Full-Time?







Good morning,







Hope you are doing well.







Please, could you let me know whether you are interested in hiring a Virtual Assistant.







Available Part-Time or Full-Time at highly competitive rates.







We specialize in:







Cold Calling, Lead Generation

Appointment Setting & Documentation

Research & Administrative Support

Social Media Management

CRM Management and many more.







If you’d like to explore how we can assist you, let’s schedule a quick call at your convenience.







Looking forward to your response.







Best regards,



Ranjitta Kaur







P.S.: Not interested? Reply “no” and we won’t contact you again

Web/SEO/App Spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 05 Feb 2026 04:30:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vnxXn-00000000Ibj-3Jch

for dave@doctor.nl2k.ab.ca;

Thu, 05 Feb 2026 04:29:07 -0700

Resent-From: The Doctor

Resent-Date: Thu, 5 Feb 2026 04:29:07 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-southindiaazolkn19010012.outbound.protection.outlook.com ([52.103.67.12]:59308 helo=MA0PR01CU009.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vnxHo-000000007V5-1jnC

for root@nk.ca;

Thu, 05 Feb 2026 04:12:47 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=nHetmJbfRibRbYnBC0Gyqn+/J9YtzIOnv8ETcXs65TNGnKd9JusHCOo+BBd7bon/tiMo4Vn8eNo9puoUNlx2tMCwTGKVB6PyEHwEf6SCAfwum883xcN5tAGSf0gUfPNapdyooomMlHRgZIq1bA/MG+o7kJrufC3SW9SGj+RJBoETKoltSDRZY2B028zFQj3A127zRikKh1Op0K28/sFI4oFPEnNHd1pktMBYq/lO4aGRFRHD3XZLHtm5sZ+2VCwUxKJxoEpRohPA+BTCyISTMxyhBKbmVtkBDdM77D86jERTfgX4A6rUUYtkfqcpfLXh5DmneU6EbvKQirBcO6XRQQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=eKoYPTsa1AV23v12/KWSvXvBlwAztOxNBpBVDRtJJII=;

b=mhQCj27GU4ukO4t6uqbXmhSfZAo8im+uSeDC9X42W4pK1RPBXaWgeILAmuAcWcOKwsXSg8ERVSccPLbk8Pc00Tp5DCTgqmMvo6Dvthx3g1LTtplIE2p9KtYmXUzSpXP0sHwQYG+/mK4r4viteE4i1cnGdbCOjHn/p29FOG6R8oPn0Y/dAZhzrIIrUJtHTRzZhd1vtgC7T+05n4e/Wke3k9epIUl0/I7EftPm1zqqPs/hOKpcthz3Ow8gYYAjY93RAWyLfEYNvlHcCjZlsISa/O9nUv5Vu+RiC49K4Qo9ohi8HBpAnAJ7B5exchVLWBeFzHSCMVyCOCE/bZ7Vf2OMFg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=eKoYPTsa1AV23v12/KWSvXvBlwAztOxNBpBVDRtJJII=;

b=ohQY6asakGjgHlWkKRTz/uUlOGycX1CG0jf4Rz1I3LuypFq2mcS3x9/iqLjQK8/SeAB6CQJm3bC3O1Q1pG35CixsSgXAGoyv5xyIxcljz1zlsipzbUfjHmqPsiy9mK6vvP+ho+9TfrHs//2hgDsL7pjmgUR12hamrB4mjtiXfCKfjDXsKhl8/GVkLgWYm4ZKch1LCEuCh/PYbtHiG4XLtxETCmSqhGTW+ngQ8nyfvgY54sv43vSHyjuxwSzg7O5s79HXAWqE37khfoV8g5wKT8w39tUREkFTUVD0W7uZIBepVUASvQ0NGQ+DWHMccqYR0JnR2dlXcPuItJa/Uufifg==

Received: from MAZPR01MB8567.INDPRD01.PROD.OUTLOOK.COM (2603:1096:a01:a0::14)

by PN1PPF8C6B8F4BE.INDPRD01.PROD.OUTLOOK.COM (2603:1096:c04:1::41d) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9587.14; Thu, 5 Feb

2026 11:10:33 +0000

Received: from MAZPR01MB8567.INDPRD01.PROD.OUTLOOK.COM

([fe80::4ad5:c58a:e385:fb4a]) by MAZPR01MB8567.INDPRD01.PROD.OUTLOOK.COM

([fe80::4ad5:c58a:e385:fb4a%5]) with mapi id 15.20.9587.010; Thu, 5 Feb 2026

11:10:33 +0000

From: Ranjitta Kaur

Subject: RE: Interested in our pricing/package plan? Can I share it?

Thread-Topic: Interested in our pricing/package plan? Can I share it?

Thread-Index: AdyWbgAYAhVzMoCqSzy9s0Brq+Bbmw==

Date: Thu, 5 Feb 2026 11:10:29 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: MAZPR01MB8567:EE_|PN1PPF8C6B8F4BE:EE_

x-ms-office365-filtering-correlation-id: 0e6597ea-f13f-4e01-3fb9-08de64a72e41

x-microsoft-antispam:

BCL:0;ARA:14566002|5062599005|13091999003|461199028|31061999003|41001999006|12050799012|8022599003|19110799012|8062599012|8060799015|15080799012|440099028|3412199025|102099032|13041999003;

x-microsoft-antispam-message-info:

=?utf-8?B?dDZsc3VBeWJGMjdaUXk4MnY1NlY1RUxoSmZNNVlZRFRrUS9tK1A3OGVjVlBo?=

=?utf-8?B?Z2RTYXpZK2NCQnhlT3ZLNXBjK2FQVkdKZXptYnQyRDVubEZrTkdza1o5bjRT?=

=?utf-8?B?WFZ3WG9yOFlLdEx0TkFXd1UvSXJFZ2JYOU9XRXdHQnhCRnozTHhBMEhkVzNv?=

=?utf-8?B?RXhJUEdtVjJXTmFOTnA3NEswa0dFYmlScVZWelllY1RtcklEdWJXQzcxZG9G?=

=?utf-8?B?dDhJazhiNHFTelE2WUtiY08wZzVoNGt1aEtNQXp6T3Baa3NWdjU3MWcrRi9Q?=

=?utf-8?B?QmlMc2Y2alM1Mk1tMUlLMjJYQmF6TEczT290TGgyN3JGektISkdPQTJpZFhE?=

=?utf-8?B?K3BLcWhKOURCeEoxRFZtc09BQzJyS0xTYmFmb0RiTTBOd29BV1J2d2RiOUxR?=

=?utf-8?B?Rng1Mmpqck9ldXQ0dlBrSEpSTmlMcGdFVHR4TEU2dXltZmJrcnNlUmd3QWR0?=

=?utf-8?B?TDdzOWphY1ZKWDVxaWVXOG1aNXNwdzB3czg5em1yK052eDAxMGVOY3E0bkVW?=

=?utf-8?B?THd2Rm02cXI1SGJaZFVXOXBtZHU3ejFNL1RwdFptaVZKZUorNGtYelBzZDF2?=

=?utf-8?B?akI4UTBITXY1M0drWXQ4dk4wMXdPNlZZcmx3SDk4TWFtaVZ6ZE5HNjZRZklr?=

=?utf-8?B?MVJiM0xaeFRRTEdhdDJBWFRHYVhHeGlBU0tkR1FRSGJVNytHb2U1MzZpRnB3?=

=?utf-8?B?Z2h4aTRYVHFjRGFwU3lCNDZPcVFlQjN2UlJBT0RrdVR6WWhidmp1QXUvMGFY?=

=?utf-8?B?cXgrSVFLeXlmbGdkSjl2bFdTYUJmamJoM2hLNFFYbFlwblAwYnMxZHllY0Rh?=

=?utf-8?B?YTkxODVDMHlrK3JWRlROSS9CVXRLUWJlTlhISXl0T2hVdVJiYWpQQkdHWVQy?=

=?utf-8?B?citLUzhCM0oyV2pRNHBPWEJKRm04cG5HVVVhTEJSR2tmbThBNlhWcFdTRldY?=

=?utf-8?B?ZjlUdEcyKzJzL1FpMXBZQk9Pc04rRkdnTm9iRjZQL0c0YWpxR1V3NFpyeEJ3?=

=?utf-8?B?VEQ5UTM4b29ZaS9MYkF2Uzh6MzJEZ2wwZmZXdUNPS1VZamE1ZWZNMS9iSCtW?=

=?utf-8?B?NlVJVE8xanIvZm90bnE3SEhwU2NXSU9QOWVKYzZVbHBvTm8zUStNRGFiU1c1?=

=?utf-8?B?UzZUdE1hY25ob0RQZWJmZVF6SkFjMStGMnplc0xCSHF2MzFUaTNxdU9zQk5H?=

=?utf-8?B?TWlqSG5MY3FJWWtlUlowU0d1ZDlWQysxQU9xTllTaXFPL2c1Z09LWDM0OE5l?=

=?utf-8?B?TXd3eHVoVGN4VmJNcmNqRE9mejg2UFRkdWZtNWkvZjcrNTA0STZkZ3ErbXl2?=

=?utf-8?B?Y1ZUZFVpOGZ4YmczUFU4SDQyVDFPMkY0YzBtWjk3UzJJTiszSWIyOWlXM1NV?=

=?utf-8?B?WWNDR1hQZ1ozSU1LOXp6WFBhQ3V4eHUrMWhaZEtFeVN3RFBIZm4yNzU1Qm5E?=

=?utf-8?B?MUFwK0srVGp4QUhBZXk1b1FVUUFLNE12dzYxNXZyT0FHVUdyblJ5OFlNTUQ1?=

=?utf-8?B?SDhuOUo5WENjNjVzb3lTVFJEYi9nM2M3d1IzNzNvQTdqWDMybUdVNCtEZkFT?=

=?utf-8?B?TUZBRXg3MG1FWFBTWktOaEJvQlRoNU5kVDcvNmR1OHNYNS9ReFE5Ums0ZHNV?=

=?utf-8?B?OFFSV0tkL25lMk05Qmt2b0RzZEtUakVpMFhHNDVnVk1YUi9sQjlIcGxEMEhZ?=

=?utf-8?B?d3ZiREFPbkg5UFMwbWhLVXlJUUp4Qisxd0VSd0NjU3czelpQN3Z0Si9BUlF4?=

=?utf-8?Q?TwMfTVXWnfvqkbCWDc=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?utf-8?B?MzZoNnJzbjJXUHlXa2pLNVFWMTdSMlRYUG05ZGdtYi9SbFNsRi9Wc3ZTWS9m?=

=?utf-8?B?YXM3WGZmNmJSNklSRlBFdzRqdzJLWWk5bVMyd2oyTCtYbzlUVU5kMnc0ek1U?=

=?utf-8?B?NWpoR0JwMGR5Y0V1dk04M1c0aWtmOTQ3cmQ5WkZjVHFSY1NSSSs0dEIyNGo2?=

=?utf-8?B?eVd4Y09UTENaZS9Ebk5rNldaZmxndzNKendueElEYlNBekF4STBHdmk3Z3ZP?=

=?utf-8?B?Z29MK2xRTUt6Vnk5cFU4TWxMcTFORndOT0wyMS9sOXl6dEZrNVEybnFZbWJV?=

=?utf-8?B?V3lKc2kwNC9URGMyYU1HUDdyQ2doRWdVQkJEbDE5eEZRSkxsVHZGanY4VVpv?=

=?utf-8?B?U0IwYWFod0w3ZC9STUF6YUw3MWI4dUhGWnVrNTN1cldwTll6a2FoT0dicFJh?=

=?utf-8?B?SlZGWW5QUlhJaG14T05DK1RYSXBrSDB5M3JTTGMvbkpYWnhyQkh5QlZubDVG?=

=?utf-8?B?MkhhcnRsalFvc2hvaGEzcmR3cEhsRTREcWN0Qlc1N2lzMFB2blo4ZEpPWDJy?=

=?utf-8?B?ZXE5NmxkKzJMRndIb1k0MTk1TmNISWhLcTBXUE8vSER2TjBad1A0T1g4ckw2?=

=?utf-8?B?WXFSMkxZeG4vbmNGT3ZhRVVsTDRTV1JvZDJ4OFFqaTNKamxYSDhVSnQ2TktI?=

=?utf-8?B?aWJxSHFSQlU4dTBiZVZNTFJvbmRhZk9Qd0hrSnRSREo0K0gya0hNVnlXMEla?=

=?utf-8?B?Rklhc3h6bmZDaFk1eXE5SVZaeUg1WFM3V1E5aE92c21ra25sWWxwYlZRTk93?=

=?utf-8?B?UHhLcW90NTdrdkdXTkpvbFYvUVhDZVMwN2x0OUJjai9YZ1FIZnNWK1hKbW9R?=

=?utf-8?B?ekQ1SjVETFBGS2RONTFEd2RFdDViT1haMWQvbFBObUJocmVvZFRQTVRGZEVk?=

=?utf-8?B?WnQyNGJyb0I0T1djZUdzZWhQekJua1lzenkxL0ExQjBZZE1BelpmK0RaOUJJ?=

=?utf-8?B?eS9DV01GSU5XRUVZc0Z0SXl1MzdLVmdWK2pXVXBNS2VLNysxRnZkQXdVaHlS?=

=?utf-8?B?WmRYeDl5SWczQkovMUFRcEJrcWxOQTh4ZEVydmJENWhQV1NjcXUrQXZ6ekhm?=

=?utf-8?B?T0FWNFJYSlY2cjRIdVlFM1F5RlZLaWtJNkJoRnFPd0wxREhzY0Vlc2toemE1?=

=?utf-8?B?ZGZYejVhTXFkTzAzSVRKaEJIR1lDVmtQVHAzUGRRL2txQ3VSeDAzcnltS3RP?=

=?utf-8?B?TUtNemRWWm9MNlhOd0ZXSERoaWF6Q3pCWkVDVzRCREtzcTcxbEo3dG5uNUxp?=

=?utf-8?B?bno4LzJYNm04L3krOXl0OHRTTktBTFUyT1diRU1PM3VBdjIzQmM1L3NjNEU4?=

=?utf-8?B?T2dJNWlNY29lQnVsWndKR0c5U0M3ZkxzVDk3cmwyRGVUYm1iZDdzY05mam9u?=

=?utf-8?B?L3RaaHJwRjllckM5ZFNxL0c4OTZaUGwzUnBMMUtPcytVTW94aDAwV0o3TkRF?=

=?utf-8?B?bU5YM3o3T0N6YzIwN1JWVmVuVlBMUENkWElWZ2ltb0IvK0ZpakFQbndQZlJY?=

=?utf-8?B?QjhrTjkySWJ3ZGRwNGk5TkZwSlRESFg4Ti8xRkhWMExLeENMSTJIMGRaUG5o?=

=?utf-8?B?dUExNmRaWk4wdnhIekdrb1J2bGRJc05BbHB5c0dhTkRVcnBTSDdwWkN4NUJT?=

=?utf-8?B?b3ZFWTZVeWdaWm1RYitkMmVacGJyR1NKMlZCY2d6TUVSY3YvQlFPWS9SOTdV?=

=?utf-8?B?TFBjUlQ0NWhVVUtEMy9LR3VIOVJ1a083N0NJU1lyR25rcWZUdDJScW1jV2pZ?=

=?utf-8?B?cW93czhXRjRLWFN2a3dHcFgxUXRyb3NpbjdtVTdwWlZuVW5DL04vQ2NueXpO?=

=?utf-8?B?VG1xaUlzL0lwdDVQMVdrV2plQ0xZOUxqdmFxV05xVVVKYTRwN1I0ZHFyQkVI?=

=?utf-8?Q?Z3YHB8THTYpvc?=

Content-Type: multipart/alternative;

boundary="_000_MAZPR01MB8567303DD74A7DA49BA48DECDD99AMAZPR01MB8567INDP_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-fecfb.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: MAZPR01MB8567.INDPRD01.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 0e6597ea-f13f-4e01-3fb9-08de64a72e41

X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Feb 2026 11:10:29.7185

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PN1PPF8C6B8F4BE

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Nigerian spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 05 Feb 2026 04:28:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vnxVn-00000000B3S-1Y1k

for dave@doctor.nl2k.ab.ca;

Thu, 05 Feb 2026 04:27:03 -0700

Resent-From: The Doctor

Resent-Date: Thu, 5 Feb 2026 04:27:03 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zimbra.cotic.rn.gov.br ([177.87.96.158]:60636)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vntqo-00000000M3N-1HKy

for sales@nk.ca;

Thu, 05 Feb 2026 00:32:40 -0700

Received: from localhost (localhost [127.0.0.1])

by zimbra.cotic.rn.gov.br (Postfix) with ESMTP id 481B88D2042;

Thu, 5 Feb 2026 03:43:23 -0300 (-03)

Received: from zimbra.cotic.rn.gov.br ([127.0.0.1])

by localhost (zimbra.cotic.rn.gov.br [127.0.0.1]) (amavis, port 10032)

with ESMTP id 7cCGohhE3o0Z; Thu, 5 Feb 2026 03:43:23 -0300 (-03)

Received: from localhost (localhost [127.0.0.1])

by zimbra.cotic.rn.gov.br (Postfix) with ESMTP id 97E818D2037;

Thu, 5 Feb 2026 03:43:21 -0300 (-03)

X-Virus-Scanned: amavis at zimbra.cotic.rn.gov.br

Received: from zimbra.cotic.rn.gov.br ([127.0.0.1])

by localhost (zimbra.cotic.rn.gov.br [127.0.0.1]) (amavis, port 10026)

with ESMTP id fw_DoH3MW30v; Thu, 5 Feb 2026 03:43:21 -0300 (-03)

Received: from zimbra.cotic.rn.gov.br (zimbra.cotic.rn.gov.br [10.104.0.72])

by zimbra.cotic.rn.gov.br (Postfix) with ESMTP id 7A7488D202D;

Thu, 5 Feb 2026 03:43:18 -0300 (-03)

Date: Thu, 5 Feb 2026 03:43:18 -0300 (BRT)

From: Cheng Saephan

Reply-To: Cheng Saephan

Message-ID: <2017505002.2341740.1770273798439.JavaMail.zimbra@policiacivil.rn.gov.br>

Subject: Donation of 2.8 Dollars.

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="=_025387c4-1e01-4608-b35c-19d4afb417d0"

X-Originating-IP: [10.104.0.72]

X-Mailer: Zimbra 8.8.15_GA_4652 (zclient/8.8.15_GA_4652)

Thread-Index: 3yQnKl5B6eRIU19ZA8CKJs+y1lGcgQ==

Thread-Topic: Donation of 2.8 Dollars.

X-Spam_score: 9.2

X-Spam_score_int: 92

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:
The sum of $2.8 million Dollars has been donated to

you by Mr Cheng Saephan. You are advise to get back for more details via (chengsaephandonation24@proton.me)

FOR MORE INFORMATION.



Content analysis details: (9.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[177.87.96.158 listed in will-spam-for-food.eu.org]

[177.87.96.158 listed in will-spam-for-food.eu.org]

[177.87.96.158 listed in will-spam-for-food.eu.org]

[177.87.96.158 listed in will-spam-for-food.eu.org]

[177.87.96.158 listed in will-spam-for-food.eu.org]

[177.87.96.158 listed in will-spam-for-food.eu.org]

[177.87.96.158 listed in will-spam-for-food.eu.org]

[177.87.96.158 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[177.87.96.158 listed in dnsbl.ahbl.org]

[177.87.96.158 listed in dnsbl.ahbl.org]

[177.87.96.158 listed in dnsbl.ahbl.org]

[177.87.96.158 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[177.87.96.158 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[177.87.96.158 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[177.87.96.158 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[177.87.96.158 listed in dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[177.87.96.158 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.2 MISSING_HEADERS Missing To: header

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_FROM_12LTRDOM From a 12-letter domain

1.0 XFER_LOTSA_MONEY Transfer a lot of money

Subject: {SPAM?} Donation of 2.8 Dollars.



--=_025387c4-1e01-4608-b35c-19d4afb417d0

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: 7bit









The sum of $2.8 million Dollars has been donated to you by Mr Cheng Saephan. You are advise to get back for more details via (chengsaephandonation24@proton.me) FOR MORE INFORMATION.


--=_025387c4-1e01-4608-b35c-19d4afb417d0

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: 7bit






<div>The sum of $2.8 million Dollars has been donated to you by Mr Cheng Saephan. You are advise to get back for more details via (chengsaephandonation24&#64;proton.me) FOR MORE INFORMATION.<br /></div>


--=_025387c4-1e01-4608-b35c-19d4afb417d0--

Web/SEO/App Spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 04 Feb 2026 16:22:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vnmBL-000000005Rz-0ADX

for dave@doctor.nl2k.ab.ca;

Wed, 04 Feb 2026 16:21:11 -0700

Resent-From: The Doctor

Resent-Date: Wed, 4 Feb 2026 16:21:10 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f48.google.com ([209.85.216.48]:46174)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vnkaS-00000000Poa-30Rr

for root@nk.ca;

Wed, 04 Feb 2026 14:39:11 -0700

Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-353576abcfeso78049a91.0

for ; Wed, 04 Feb 2026 13:38:13 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1770241087; x=1770845887; darn=nk.ca;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=0lzT8Z9FmOsqhn5wAy6BtVintSc+VXKUHeKukV2lNu0=;

b=L5M89JwX+2xiSa3QrICp4Ht9rpDS6Rw3CfVRpp8vN7LBCxEuxo2R6HpIoHD6mxFnBd

GBWz2Qidz/MQVYZn8DfBnNWri4X3N5aqZFl/+2uOcoM9hRL5GqjF+42oucmjbARDcrhu

umsNkTmrhMPN6X4/QrPRr7n9w5lyip2Qwm4XipbUh+hqRPS9xrB0voL/VWdeCf9/yVTB

PGjWQuSPV65lbu8tVlW23R3fIa+kXHZuxVechxf38fxTk5aXXjedDV3zuf502FsYI3if

wLJe0TOxunEMxSiqy6Q7Ej5oHr1gSlE34k9nhibEl2XPFy41IdbGS0GH3jGzEZzb/fv3

WOpQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1770241087; x=1770845887;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to;

bh=0lzT8Z9FmOsqhn5wAy6BtVintSc+VXKUHeKukV2lNu0=;

b=NamLBci8M/I8eOTsfZ0dHq94U4DteCE9QI8srWj0gRnGjvCUR+SKX/YNuCYEFZOYDT

6N+e3jwWk+qc+TipAs0TiX6hc8AvIW/H152WkwUJ6wlsRDG7SuriZYNCXOHE+5CLD0TN

4nVN/T5/Z6/tWiLwaYXm0X7TYiNXyEC0C1ifTJC8nT6SHjxqsv3dMGlutxDmHctXqTDH

oDX0HNjoDqrNJ3EcGtrcFSEasIO8fW+35Hpzb49hqnBUh0CYP7Fy9Fbz076ne3MrVdBY

jrUjKicZHifMsZT8EhHCYlqZ0l/JNa8GX2U8Cqv3zQWK9qezVr7h2LEwqzqUEwx7wWoQ

2oBQ==

X-Gm-Message-State: AOJu0Yz8FUryqzgNgdbmRBr3kQAwzDOQksl6HzZuJMyzE74JdS2gDAGA

AKMPtlkC/+fV3vw37zGqn3YpJkabkfEjXR5UeCgH0+ApbKHelvL3oBy4+MUcyXsP

X-Gm-Gg: AZuq6aJLHIVu4+WZ6JrcDDNu7g1jcNx7h37ZQmuSy/LJfn9aW8d0s8RtSMIdVsMiyjU

qTx70WgqegCYIitWgvhSbcaHW2v5pFoRGJNFl3UMfkUVJbosz3xojHQFz6QG8mgpdfXSFuqXkvT

iftOi1AE/QFeI2tGlTp6TNkrqetguHiZQT6qr/XIsKpXFdWBWr7mfBTMwVVz8tj495ihmnXDV6g

8Dpa2nbPhRHS2aub5yuucuUZhZdA0RqUl8kOeuGZXrX4rspmdX0i8fjsUEzCLLpsn7DPVJ0+Z9W

rNUNMttwiFLgpAf+4PJwoTJQeAQbN8iYOazjJLNut5XlS6WAcbfQT2bEgDxeBmvw9EDY436MnUa

y9FR+6/9WkXv4o3NALeeyHj65bb83GOxoMgJUHiVREF4CldmdaKBkZuGXsNNHmxn6xJEcUl0Pxx

qHu9f8xrl7i871gjiGiRPd2TZQk0kA4nfkAxNx

X-Received: by 2002:a17:90b:1e0d:b0:353:f7b:6d60 with SMTP id 98e67ed59e1d1-354871f464dmr3802111a91.33.1770241087405;

Wed, 04 Feb 2026 13:38:07 -0800 (PST)

Received: from DESKTOPVFI8GCA ([2401:4900:a061:d028:2d0d:3a7c:5677:fff0])

by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3549c09df19sm277134a91.1.2026.02.04.13.38.06

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Wed, 04 Feb 2026 13:38:07 -0800 (PST)

From: Mariya

X-Google-Original-From: "Mariya"

To:

Subject: Re: Good Afternoon Affordable SEO !!

Date: Thu, 5 Feb 2026 03:07:37 +0530

Message-ID: <10ef01dc961e$8c873a10$a595ae30$@gmail.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_10F0_01DC964C.A63F7610"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: AdyWHlbsze/losArShKfzPQ4QGgO2A==

Content-Language: en-us

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Good Afternoon root@nk.ca I'm an SEO Expert, and I've

helped 250+ businesses achieve 1st-page rankings on Google through proven

SEO strategies. Would you like me to share our SEO pricing and service packages?





Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2401:4900:a061:d028:2d0d:3a7c:5677:fff0 listed]

[in will-spam-for-food.eu.org]

[2401:4900:a061:d028:2d0d:3a7c:5677:fff0 listed]

[in will-spam-for-food.eu.org]

[2401:4900:a061:d028:2d0d:3a7c:5677:fff0 listed]

[in will-spam-for-food.eu.org]

[2401:4900:a061:d028:2d0d:3a7c:5677:fff0 listed]

[in will-spam-for-food.eu.org]

[2401:4900:a061:d028:2d0d:3a7c:5677:fff0 listed]

[in will-spam-for-food.eu.org]

[2401:4900:a061:d028:2d0d:3a7c:5677:fff0 listed]

[in will-spam-for-food.eu.org]

[2401:4900:a061:d028:2d0d:3a7c:5677:fff0 listed]

[in will-spam-for-food.eu.org]

[2401:4900:a061:d028:2d0d:3a7c:5677:fff0 listed]

[in will-spam-for-food.eu.org]

[209.85.216.48 listed in will-spam-for-food.eu.org]

[209.85.216.48 listed in will-spam-for-food.eu.org]

[209.85.216.48 listed in will-spam-for-food.eu.org]

[209.85.216.48 listed in will-spam-for-food.eu.org]

[209.85.216.48 listed in will-spam-for-food.eu.org]

[209.85.216.48 listed in will-spam-for-food.eu.org]

[209.85.216.48 listed in will-spam-for-food.eu.org]

[209.85.216.48 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.48 listed in dnsbl.ahbl.org]

[209.85.216.48 listed in dnsbl.ahbl.org]

[209.85.216.48 listed in dnsbl.ahbl.org]

[209.85.216.48 listed in dnsbl.ahbl.org]

[2401:4900:a061:d028:2d0d:3a7c:5677:fff0 listed]

[in dnsbl.ahbl.org]

[2401:4900:a061:d028:2d0d:3a7c:5677:fff0 listed]

[in dnsbl.ahbl.org]

[2401:4900:a061:d028:2d0d:3a7c:5677:fff0 listed]

[in dnsbl.ahbl.org]

[2401:4900:a061:d028:2d0d:3a7c:5677:fff0 listed]

[in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.48 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.48 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.48 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.48 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.48 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[mariyawebservice11(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[mariyawebservice11(at)gmail.com]

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.48 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Re: Good Afternoon Affordable SEO !!

Web/SEO/App Spam from Google Gmail Part 2

This is a multipart message in MIME format.



------=_NextPart_000_10F0_01DC964C.A63F7610

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi, Good Afternoon root@nk.ca



I'm an SEO Expert, and I've helped 250+ businesses achieve 1st-page rankings

on Google through proven SEO strategies.



Would you like me to share our SEO pricing and service packages?



Thanks & Regards,



Mariya,









------=_NextPart_000_10F0_01DC964C.A63F7610

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">
vlink=3D"#954F72">

Hi, =

Good Afternoon root@nk.ca

I’m an SEO =

Expert, and I’ve helped 250+ businesses achieve 1st-page rankings =

on Google through proven SEO strategies.


style=3D'background:aqua;mso-highlight:aqua'>Would you like me to share =

our SEO pricing and service packages?


class=3DMsoNormal>Thanks & Regards,


class=3DMsoNormal>Mariya,


style=3D'margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;backg=

round:white'>
style=3D'font-family:"Arial",sans-serif;color:#222222;mso-ligatures:none'=

> 



------=_NextPart_000_10F0_01DC964C.A63F7610--



Instagram followers phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 04 Feb 2026 10:43:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vngta-00000000EUz-3ZzY

for dave@doctor.nl2k.ab.ca;

Wed, 04 Feb 2026 10:42:30 -0700

Resent-From: The Doctor

Resent-Date: Wed, 4 Feb 2026 10:42:30 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qt1-f198.google.com ([209.85.160.198]:55300)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from <3HG-DaQwJBVsRHB5ABKHF7SH9F3BE.5HFL3E7LGD.53@maestro.bounces.google.com>)

id 1vnfRx-00000000Nal-2v3N

for sales@nk.ca;

Wed, 04 Feb 2026 09:10:01 -0700

Received: by mail-qt1-f198.google.com with SMTP id d75a77b69052e-502a4aca949so354634251cf.2

for ; Wed, 04 Feb 2026 08:09:06 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1770221340; x=1770826140; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=Mt53FO10xmQLF8DRc2hAJVNSLHqgJoL41s/q1diNQOU=;

b=GTDrM0Fpz9naGDFwPVbDRMpK4yS3Sfm9JGLtKAUnAfDFgdqC//0/nSwu8mFtySYuSN

KdcGO75JJrTM1iY5xpfwut5cjZ2LZ3uMlF2vdE+H5j7kuw1+JDHL6qKPvG5+XEaUoKRw

FjpDbzCZUOydWpGW/ekIPG9xzfKDJUx9XYOk5yzHlnO2cJFCWlRVV05RxLyU6GYcugH+

lP+5nQj6dHNJgPjuRz1Ci9XXYM6Z/+VKXsNE6Zoc54zRBzX6oQkEivGIusvdp/XpmlnS

9mFtXghLcnBIl9hCyV2xA7f0kkNtDiS/0xn9SdQX63bkUM4gdXBlZamwQWJB5OjhZu2P

S5mA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1770221340; x=1770826140;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=Mt53FO10xmQLF8DRc2hAJVNSLHqgJoL41s/q1diNQOU=;

b=w9EQ6FOThzNzCWLLIr/H4t/amQqqq2PUd5AzWNU9C8eQSHmXVP3fSC5onp0wz5cj2C

vmcwf1nX7S+wnn9gjOh/iULlnM8ZV4jiM86J+zDk6VQFyaLE7owAjV7i1MK9uk3b6pd8

zEtSZzyYP9N5bRvSDwYiMtYtVT/4nCkNY+cQqs/wndZkj97IspU8voF+YKd1r+i/NRlY

d4TomMgsB6Rmh+x2dmiTLVpjssxB1zStSSwG7Z8Nr7itpDHGi46Bsw6NbP//bal0tdKD

MCQyKsIhP+GT5+VNMZHREFErBD5iHg11SkakobnKaIdOYR1fPhOV40T0+uprsZb2eEi+

dAoQ==

X-Gm-Message-State: AOJu0Yz3TPoWgx+9VlKU7EcyRX7WgrjI0r9M80A9URiPrJzCyf4TAW49

Qs73RvoaxUTlMhEzrCBH+D9g+XwWr0vkT0SVh3KFPGApizNHMnoEC553CqLNImWB0oLpDpR36Ls

l91Y=

MIME-Version: 1.0

X-Received: by 2002:ac8:7f09:0:b0:4ff:c5f7:ece1 with SMTP id

d75a77b69052e-5061c1b59b8mr40694191cf.68.1770221340082; Wed, 04 Feb 2026

08:09:00 -0800 (PST)

Message-ID:

Date: Wed, 04 Feb 2026 16:09:00 +0000

Subject: daveyadallee, Get More 1,000 Instagram Followers and 1,000 Facebook

Likes here

From: yoichiromezo@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, daveyadallee, Get More 1,000 Instagram Followers and 1,000

Facebook Likes here Sorry to interrupt your time. We offer social media services,

If you're interested, please visit our Website. If you're not interested,

please skip this step.



Content analysis details: (10.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

[209.85.160.198 listed in dnsbl.ahbl.org]

[209.85.160.198 listed in dnsbl.ahbl.org]

[209.85.160.198 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.198 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[yoichiromezo(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.198 listed in wl.mailspike.net]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

Subject: {SPAM?} daveyadallee, Get More 1,000 Instagram Followers and 1,000 Facebook

Likes here



Hi, daveyadallee, Get More 1,000 Instagram Followers and 1,000 Facebook Likes here

Sorry to interrupt your time.



We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.



We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )



Are you interested in a free trial ?

Special For You Bonus Extra $2 FREE SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :



[ https://instatool.site/services/?daveyadallee ]





Take free trial service today only...!!

10 -101K Instagram Followers



- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest



Thank you,

Regards,



Shopify users list spam from Google Gmail Part 2

This is a multipart message in MIME format.



------=_NextPart_000_0807_01DC9619.F26004C0

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,







I wanted to check if you are interested in acquiring Shopify Users List for

your sales and marketing initiatives?







You might be interested in following users list: WooCommerce, BigCommerce,

NetSuite, Klaviyo, Ecwid, SAP Commerce Cloud, Magento, eBay, Stripe, Wix,

Avalara, Gorgias, Weebly, FastSpring, PrestaShop, Oracle Commerce and many

more.







Please let me know your target audience and geography so that I can get back

to you with samples, counts and pricing for the same.







Appreciate your time and look forward to your response.







Best Regards,



Rose Atkins



Sr. Demand Generation







Please reply with "Not Interested" in the subject line if you would prefer

not to receive emails in the future.





------=_NextPart_000_0807_01DC9619.F26004C0

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">
style=3D'word-wrap:break-word'>


class=3DMsoNoSpacing>Hi,

 


class=3DMsoNoSpacing>I wanted to check if you are interested in =

acquiring Shopify Users List for your sales and marketing =

initiatives?

 


class=3DMsoNoSpacing>You might be interested in following users list: =

WooCommerce, BigCommerce, NetSuite, Klaviyo, Ecwid, SAP Commerce =

Cloud, Magento, eBay, Stripe, Wix, Avalara, Gorgias, Weebly, FastSpring, =

PrestaShop, Oracle Commerce and many more.


class=3DMsoNoSpacing> 

Please let =

me know your target audience and geography so that I can get back =

to you with samples, counts and pricing for the same.


class=3DMsoNoSpacing> 

Appreciate your =

time and look forward to your response.


class=3DMsoNoSpacing> 

Best =

Regards,

Rose =

Atkins


class=3DMsoNoSpacing>Sr. Demand Generation


class=3DMsoNoSpacing> 


style=3D'color:gray'>Please reply with "Not Interested" in the =

subject line if you would prefer not to receive emails in the =

future.



------=_NextPart_000_0807_01DC9619.F26004C0--

Arabic language spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 04 Feb 2026 07:38:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vne0g-00000000Kpg-0cKl

for dave@doctor.nl2k.ab.ca;

Wed, 04 Feb 2026 07:37:38 -0700

Resent-From: The Doctor

Resent-Date: Wed, 4 Feb 2026 07:37:38 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f41.google.com ([209.85.161.41]:48447)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vndDo-000000007zY-3gRb

for sales@nk.ca;

Wed, 04 Feb 2026 06:47:18 -0700

Received: by mail-oo1-f41.google.com with SMTP id 006d021491bc7-669f0b0290fso681546eaf.1

for ; Wed, 04 Feb 2026 05:46:21 -0800 (PST)

ARC-Seal: i=1; a=rsa-sha256; t=1770212775; cv=none;

d=google.com; s=arc-20240605;

b=RQht+6lUg+7HwjfJVZv+5MeKSiMiuw4LukER+H22vAk4lYD89QptNThu/JQG7SLLze

NXuwXdmY89jkFXPN+eSXdhN+9GE9hpaICqASq/olorwI52kBBD2aDzTyRzVT49pZo3ad

J3K0HScs/HXqbCLOY1d9ePTcAu8XPZJD4fX7Hon9f5RCKG/FRdgLTUIDGGwHFAE6Ylgs

XmPsfar8AFfnvCRhvS5dB2AP3dPf4zDPb4jpxj0/r6tawJZdvuw99Ljax8tOwY+E9L7K

TcZm95pPOdenfr+6/zPkIKS1I4HDtrrITrXN+l1M/HSrL80C4QU9s+oVnrmD+cWpLkip

YxKQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=kLGdaPJWstgkzWd1C8jef0IO0xj8+4CAItWWuepwjBI=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=Pyk3koLbbdGA+yJWjrxtad5PIcgCtGEbn2sTjoilcdZNMsXlLfEv3mcC4T9guYFms/

1tloPYwUtHnBdgQL65NSNIL9FcGBDOCDHVFVc30BenhIwemm/N0TChIWGExBwZa/hUHV

FdKOOBP6MSpCcG19e6zhUEcrDqRJKmHcmWvVInFh/w47UCiQbl5EhBBPYQFx6lj+juZt

B3JBvcodCqRLEZ7+x8RDZcLIV6lMOy6RMzhPPeBZn6o3PeEI42cNCdhRMlPEUgOLXHAx

6cXUvMZsJkjD8aBy/ywk1JyYyqO3LxZwmQ5W7FBD1eoHTauh8Ock1BUbk/D8LQZ78Alu

ywFQ==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1770212775; x=1770817575; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=kLGdaPJWstgkzWd1C8jef0IO0xj8+4CAItWWuepwjBI=;

b=A+y+rDkbnv+qVTFYC/KzYKwHNurPc8czjiERA1Rfijbp1qrTlGOg9B5rykQU0nulRm

tYzk99jg9VPOvXvtq/1y28Mvk6jM9kjkm+JBHkv38gkPNSl8oyJwBX0Emt/YrR2Cjt3I

9FJTtka2y4dk2cV9GbReRB8LMurHtLoe8wVL3lTNK/8lE6i1CF3F3mQTuPAxMFZwIQCE

oEfyv0iK9O0cX7LcmVHCOt5wvP6cH/Cmu8RMpR3Y+vBmTt53NHGxWg/4y3qe5trdoonf

3DmWOJQv1AIUumC8TO29G8joMGl31EKFGHtBzWVzbS+aIJZ0ov7m5sBVUhG31ZyVRsRW

Ma/w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1770212775; x=1770817575;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=kLGdaPJWstgkzWd1C8jef0IO0xj8+4CAItWWuepwjBI=;

b=ktDQXcWXhe+KOIMDMwA9tfFVhzOyClns7IOTZ3fyJFqQJG+ua5t4N+0iHHowwXp5bC

Hrsuk+PcCxz1YUBTTc6S/5DuAiuHoPMrpkWNSRLu/2ajFjD7x/lwZTdAR7CAoSdgtRHQ

9yQR/zuZY4CN248dYFFWGhOkAmrJH1N9vvB7uNY+1MBSdA2c8tjzSdC2HMO9Y2dZ22to

VT/14JCu3gNTSPw4kKAfxYITmkMnI3hGYw6B1aJ91n+jHnkNSzmLU+XpFtNHFncF1K52

VkC8LmjFXN4an9o0mf3NIOo9W0i31To+MO83HN5aCUSv/kZTcsK2BFUaUCM7NpYsjUOs

/T9A==

X-Gm-Message-State: AOJu0Ywk+h49SVbC+DVx2U01M9jVRxZgUvAjV+vSlUT50AxKEWVkLeCE

6vQdAuBeGI0T3yPLjupCaUxfI//gLZy4S4enMN9tPXo4sEkvthxnb42SslOw+e2x3/jijUeflB4

RFKD6NQDhjSCHSsFtanyZdNPhKH1PRexTfA==

X-Gm-Gg: AZuq6aKhRyuZviUpWhc3FStMldrGzZqtMA5szB6pf/HIWDSO5AC3hmeXkZECkg0Nk/P

j8VrHCVsjyQg4l7pbPn5+dfKuxMOdHNiCjsP1pTZAuYzjS55CcHRIPH91a+3vooTU7SVR0h0xuj

mWqsKF/YCKelldj2qHj/9GqLqEKiyVXwUqALnNIc+uTSJPneioaTd+5VCIRRN7ApoYFtdOAlyOv

gbDx43v4kUMS1oQt/AQrsWhcsEVTk24HEHui415HS5BNWWnQwfxim/4aDLCUPb8ey/bqA==

X-Received: by 2002:a05:6820:c81:b0:66a:142:bcec with SMTP id

006d021491bc7-66a22599e39mr1405842eaf.39.1770212774713; Wed, 04 Feb 2026

05:46:14 -0800 (PST)

MIME-Version: 1.0

From: =?UTF-8?B?2YXYrdmF2K8g2K3bjNiv2LHbjA==?=

Date: Wed, 4 Feb 2026 17:16:00 +0330

X-Gm-Features: AZwV_Qj1Y1QzRx3HQFJqiRr09iJRsmsBNui8hjALuvF-Q7hjgQEJf4W9MGidnFE

Message-ID:

Subject: =?UTF-8?B?2KjZhyDYqtmI2YXYp9mGINuM2LnZhtuMINiv2LHZh9ix2YXYp9mHINqG2YbYr9iq2YjZhQ==?=

=?UTF-8?B?2KfZhiDZhduM2LTZiNiv?=

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="0000000000009d1cd90649ffc741"

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (10.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.41 listed in will-spam-for-food.eu.org]

[209.85.161.41 listed in will-spam-for-food.eu.org]

[209.85.161.41 listed in will-spam-for-food.eu.org]

[209.85.161.41 listed in will-spam-for-food.eu.org]

[209.85.161.41 listed in will-spam-for-food.eu.org]

[209.85.161.41 listed in will-spam-for-food.eu.org]

[209.85.161.41 listed in will-spam-for-food.eu.org]

[209.85.161.41 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.41 listed in dnsbl.ahbl.org]

[209.85.161.41 listed in dnsbl.ahbl.org]

[209.85.161.41 listed in dnsbl.ahbl.org]

[209.85.161.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.41 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.41 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.41 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

1.0 HK_RANDOM_FROM From username looks random

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[mbvcxz1360(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[mbvcxz1360(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.41 listed in wl.mailspike.net]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} =?UTF-8?B?2KjZhyDYqtmI2YXYp9mGINuM2LnZhtuMINiv2LHZh9ix2YXYp9mHINqG2YbYr9iq2YjZhQ==?=

=?UTF-8?B?2KfZhiDZhduM2LTZiNiv?=



--0000000000009d1cd90649ffc741

Content-Type: text/plain; charset="UTF-8"







--0000000000009d1cd90649ffc741

Content-Type: text/html; charset="UTF-8"







--0000000000009d1cd90649ffc741--

Shopify users list spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 04 Feb 2026 08:37:00 -0700

Received: from mail-pl1-f193.google.com ([209.85.214.193]:52355)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vnevD-00000000Jnh-2aJY

for dave@doctor.nl2k.ab.ca;

Wed, 04 Feb 2026 08:36:14 -0700

Received: by mail-pl1-f193.google.com with SMTP id d9443c01a7336-29f30233d8aso44447695ad.0

for ; Wed, 04 Feb 2026 07:35:16 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=thedatabuild-com.20230601.gappssmtp.com; s=20230601; t=1770219310; x=1770824110; darn=doctor.nl2k.ab.ca;

h=disposition-notification-to:thread-index:content-language

:mime-version:message-id:date:subject:to:from:from:to:cc:subject

:date:message-id:reply-to;

bh=CF8PkCTX1WYhoLJWN4gQxzkdTDZRPBYq1jkUnNqncgM=;

b=YnnTcYzedYnFBqAaFuZtZjFh/l3oyLI5X9HUFswVT6Wq9treQ/0Jp55C4j2qlIexmj

WflgozhjwjYfnw297Q4SYAZemSQx4naaz7OPaX81eRr/0WD/AyB1PJ3ds94Xl8OuHuJr

8aFWVi7dTV7Aqic5LsFvUQ7pogomCRDyATQL8c22MgtR0D+TW+buqANxhrjA5K9qm6/9

62+CcsyTwRv/JMHp7uNBEQ0lFkndGZ14DV0sP/8lQtVNWFPUUCoNTw9HWw+PFDcCbA73

lcON9FL8NxJpQQqr3yDehF1dqvsv+K5tEA5VyxiEgL/bpj1NhcmvBgLoOc/d8Q/O7uA8

1mTg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1770219310; x=1770824110;

h=disposition-notification-to:thread-index:content-language

:mime-version:message-id:date:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=CF8PkCTX1WYhoLJWN4gQxzkdTDZRPBYq1jkUnNqncgM=;

b=E/HVBAq81iDHJA1sqwjZjpWcBYBs0E50Ws4Et7cW9Z0KImyaNUkCK/PrrdcwCwCh6r

1ItjKJ6Zr2Szj4U6+uQo1rfLgenvFnma0N7bpOEIDHla+jrMa3AKQy71it0naa7YBo83

5nP+oxR7EEfEvufvgtVJjl1VZ2zYfelIO2Y9tCsabZhH1kdPMERyeFjTi+i0v9laKfqa

S2kXQMUS1G56SHsQGkNM/g1cvijAwunBFU+0d+e4BwNPSvNnCYoXQ15Q84LnzHFO2ZW/

EsA/yaqsT3dPQPg3C3UiNKJs9Ru+Cu4BMkN8/JypCh6fekLQl39Qx2+nkXJr7MW9h7vX

AWJQ==

X-Gm-Message-State: AOJu0YxKdyc6q3MTwNgtZBrbexlse/znTSoNUe4dfAlxkrPq/vLzk26/

3ysCtibEcE/u7A7I5+g20ihxsi0+czmS34ABTrWhXK1VQxDkhYMbFX6hfw5a6Oj3Pz7rtAkGeZS

eh4i3bMs=

X-Gm-Gg: AZuq6aLq5QffKiIElO1DGhNeBpfwSEA0hV7ukrXWMcypRXRMELjrKOASNUOE3cZu8AV

PBd3hvPwhhA7xM3PZIdtnJ2CNvmFAu99dWzfoJj0ytCFzW1pNpEcN0/FGwVOibTxoVjuZk9QWnV

wPJ1smKvgGTCugbPF1gKV1Memu7t1DhD7XuUei9XNUqswp7lRyIWfQX1R7Vd8tu7b4DDIQsosYs

BiAfzPDJlKwpJfED5yrZ4DHs2GtohPGUSiv5HpubB9VgtoTF9fZ26tCJSFzSwURwGRf8QTrdoDT

qzZcWl5SVhTmc3BvYSEEFOJFEH73YJ2BwYwNDoibY6EgSg8oIkiVaEhfE9AHhcpMmkMtXyG9Xa6

hV9NbzSa2wOdSKcSfhhsMnloVzcEjFqjY12tR3pjltsA7EdkU8ktRCjMVmzs/AzD+Z12eXyb6s5

8nZunDmjriWWSOVETvOLg6+Aclf/dG1ybNXTI=

X-Received: by 2002:a17:903:3bcc:b0:297:df4e:fdd5 with SMTP id d9443c01a7336-2a933e3fba2mr36002345ad.23.1770219310375;

Wed, 04 Feb 2026 07:35:10 -0800 (PST)

Received: from DESKTOPDP4EVTG ([103.214.61.23])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2a9338a11f1sm37374155ad.38.2026.02.04.07.35.08

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Wed, 04 Feb 2026 07:35:09 -0800 (PST)

From:

To:

Subject: Shopify Users List

Date: Wed, 4 Feb 2026 21:04:20 +0530

Message-ID: <080601dc95eb$d8a7c8c0$89f75a40$@thedatabuild.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0807_01DC9619.F26004C0"

X-Mailer: Microsoft Outlook 16.0

Content-Language: en-us

Thread-Index: AdyV67XR5dTiUVW3ReWOq/atHfT79A==

Disposition-Notification-To:

X-Spam_score: 5.2

X-Spam_score_int: 52

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I wanted to check if you are interested in acquiring Shopify

Users List for your sales and marketing initiatives? You might be interested

in following users list: WooCommerce, BigCommerce, NetSuite, Klaviyo, Ecwid,

SAP Commerce Cloud, Magento, eBay, Stripe, Wix, Avalara, Gorgias, Weebly,

FastSpring, PrestaShop, O [...]



Content analysis details: (5.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.214.61.23 listed in will-spam-for-food.eu.org]

[103.214.61.23 listed in will-spam-for-food.eu.org]

[103.214.61.23 listed in will-spam-for-food.eu.org]

[103.214.61.23 listed in will-spam-for-food.eu.org]

[103.214.61.23 listed in will-spam-for-food.eu.org]

[103.214.61.23 listed in will-spam-for-food.eu.org]

[103.214.61.23 listed in will-spam-for-food.eu.org]

[103.214.61.23 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

[209.85.214.193 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.193 listed in dnsbl.ahbl.org]

[209.85.214.193 listed in dnsbl.ahbl.org]

[209.85.214.193 listed in dnsbl.ahbl.org]

[209.85.214.193 listed in dnsbl.ahbl.org]

[103.214.61.23 listed in dnsbl.ahbl.org]

[103.214.61.23 listed in dnsbl.ahbl.org]

[103.214.61.23 listed in dnsbl.ahbl.org]

[103.214.61.23 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.193 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.193 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.193 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.193 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.193 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.193 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Shopify Users List

Arabic language spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 04 Feb 2026 07:38:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vne0g-00000000Kpg-0cKl

for dave@doctor.nl2k.ab.ca;

Wed, 04 Feb 2026 07:37:38 -0700

Resent-From: The Doctor

Resent-Date: Wed, 4 Feb 2026 07:37:38 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f41.google.com ([209.85.161.41]:48447)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vndDo-000000007zY-3gRb

for sales@nk.ca;

Wed, 04 Feb 2026 06:47:18 -0700

Received: by mail-oo1-f41.google.com with SMTP id 006d021491bc7-669f0b0290fso681546eaf.1

for ; Wed, 04 Feb 2026 05:46:21 -0800 (PST)

ARC-Seal: i=1; a=rsa-sha256; t=1770212775; cv=none;

d=google.com; s=arc-20240605;

b=RQht+6lUg+7HwjfJVZv+5MeKSiMiuw4LukER+H22vAk4lYD89QptNThu/JQG7SLLze

NXuwXdmY89jkFXPN+eSXdhN+9GE9hpaICqASq/olorwI52kBBD2aDzTyRzVT49pZo3ad

J3K0HScs/HXqbCLOY1d9ePTcAu8XPZJD4fX7Hon9f5RCKG/FRdgLTUIDGGwHFAE6Ylgs

XmPsfar8AFfnvCRhvS5dB2AP3dPf4zDPb4jpxj0/r6tawJZdvuw99Ljax8tOwY+E9L7K

TcZm95pPOdenfr+6/zPkIKS1I4HDtrrITrXN+l1M/HSrL80C4QU9s+oVnrmD+cWpLkip

YxKQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=kLGdaPJWstgkzWd1C8jef0IO0xj8+4CAItWWuepwjBI=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=Pyk3koLbbdGA+yJWjrxtad5PIcgCtGEbn2sTjoilcdZNMsXlLfEv3mcC4T9guYFms/

1tloPYwUtHnBdgQL65NSNIL9FcGBDOCDHVFVc30BenhIwemm/N0TChIWGExBwZa/hUHV

FdKOOBP6MSpCcG19e6zhUEcrDqRJKmHcmWvVInFh/w47UCiQbl5EhBBPYQFx6lj+juZt

B3JBvcodCqRLEZ7+x8RDZcLIV6lMOy6RMzhPPeBZn6o3PeEI42cNCdhRMlPEUgOLXHAx

6cXUvMZsJkjD8aBy/ywk1JyYyqO3LxZwmQ5W7FBD1eoHTauh8Ock1BUbk/D8LQZ78Alu

ywFQ==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1770212775; x=1770817575; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=kLGdaPJWstgkzWd1C8jef0IO0xj8+4CAItWWuepwjBI=;

b=A+y+rDkbnv+qVTFYC/KzYKwHNurPc8czjiERA1Rfijbp1qrTlGOg9B5rykQU0nulRm

tYzk99jg9VPOvXvtq/1y28Mvk6jM9kjkm+JBHkv38gkPNSl8oyJwBX0Emt/YrR2Cjt3I

9FJTtka2y4dk2cV9GbReRB8LMurHtLoe8wVL3lTNK/8lE6i1CF3F3mQTuPAxMFZwIQCE

oEfyv0iK9O0cX7LcmVHCOt5wvP6cH/Cmu8RMpR3Y+vBmTt53NHGxWg/4y3qe5trdoonf

3DmWOJQv1AIUumC8TO29G8joMGl31EKFGHtBzWVzbS+aIJZ0ov7m5sBVUhG31ZyVRsRW

Ma/w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1770212775; x=1770817575;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=kLGdaPJWstgkzWd1C8jef0IO0xj8+4CAItWWuepwjBI=;

b=ktDQXcWXhe+KOIMDMwA9tfFVhzOyClns7IOTZ3fyJFqQJG+ua5t4N+0iHHowwXp5bC

Hrsuk+PcCxz1YUBTTc6S/5DuAiuHoPMrpkWNSRLu/2ajFjD7x/lwZTdAR7CAoSdgtRHQ

9yQR/zuZY4CN248dYFFWGhOkAmrJH1N9vvB7uNY+1MBSdA2c8tjzSdC2HMO9Y2dZ22to

VT/14JCu3gNTSPw4kKAfxYITmkMnI3hGYw6B1aJ91n+jHnkNSzmLU+XpFtNHFncF1K52

VkC8LmjFXN4an9o0mf3NIOo9W0i31To+MO83HN5aCUSv/kZTcsK2BFUaUCM7NpYsjUOs

/T9A==

X-Gm-Message-State: AOJu0Ywk+h49SVbC+DVx2U01M9jVRxZgUvAjV+vSlUT50AxKEWVkLeCE

6vQdAuBeGI0T3yPLjupCaUxfI//gLZy4S4enMN9tPXo4sEkvthxnb42SslOw+e2x3/jijUeflB4

RFKD6NQDhjSCHSsFtanyZdNPhKH1PRexTfA==

X-Gm-Gg: AZuq6aKhRyuZviUpWhc3FStMldrGzZqtMA5szB6pf/HIWDSO5AC3hmeXkZECkg0Nk/P

j8VrHCVsjyQg4l7pbPn5+dfKuxMOdHNiCjsP1pTZAuYzjS55CcHRIPH91a+3vooTU7SVR0h0xuj

mWqsKF/YCKelldj2qHj/9GqLqEKiyVXwUqALnNIc+uTSJPneioaTd+5VCIRRN7ApoYFtdOAlyOv

gbDx43v4kUMS1oQt/AQrsWhcsEVTk24HEHui415HS5BNWWnQwfxim/4aDLCUPb8ey/bqA==

X-Received: by 2002:a05:6820:c81:b0:66a:142:bcec with SMTP id

006d021491bc7-66a22599e39mr1405842eaf.39.1770212774713; Wed, 04 Feb 2026

05:46:14 -0800 (PST)

MIME-Version: 1.0

From: =?UTF-8?B?2YXYrdmF2K8g2K3bjNiv2LHbjA==?=

Date: Wed, 4 Feb 2026 17:16:00 +0330

X-Gm-Features: AZwV_Qj1Y1QzRx3HQFJqiRr09iJRsmsBNui8hjALuvF-Q7hjgQEJf4W9MGidnFE

Message-ID:

Subject: =?UTF-8?B?2KjZhyDYqtmI2YXYp9mGINuM2LnZhtuMINiv2LHZh9ix2YXYp9mHINqG2YbYr9iq2YjZhQ==?=

=?UTF-8?B?2KfZhiDZhduM2LTZiNiv?=

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="0000000000009d1cd90649ffc741"

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (10.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.41 listed in will-spam-for-food.eu.org]

[209.85.161.41 listed in will-spam-for-food.eu.org]

[209.85.161.41 listed in will-spam-for-food.eu.org]

[209.85.161.41 listed in will-spam-for-food.eu.org]

[209.85.161.41 listed in will-spam-for-food.eu.org]

[209.85.161.41 listed in will-spam-for-food.eu.org]

[209.85.161.41 listed in will-spam-for-food.eu.org]

[209.85.161.41 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.41 listed in dnsbl.ahbl.org]

[209.85.161.41 listed in dnsbl.ahbl.org]

[209.85.161.41 listed in dnsbl.ahbl.org]

[209.85.161.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.41 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.41 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.41 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

1.0 HK_RANDOM_FROM From username looks random

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[mbvcxz1360(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[mbvcxz1360(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.41 listed in wl.mailspike.net]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} =?UTF-8?B?2KjZhyDYqtmI2YXYp9mGINuM2LnZhtuMINiv2LHZh9ix2YXYp9mHINqG2YbYr9iq2YjZhQ==?=

=?UTF-8?B?2KfZhiDZhduM2LTZiNiv?=



--0000000000009d1cd90649ffc741

Content-Type: text/plain; charset="UTF-8"







--0000000000009d1cd90649ffc741

Content-Type: text/html; charset="UTF-8"







--0000000000009d1cd90649ffc741--

HR Phish from Google Gmail

Evidence at Spamcop

McAfee Phish from Google Gmail Part 3

@font-face {

font-family: 'Google Sans';

font-style: normal;

font-weight: 700;

src: url(//fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLV154t=

zCwM.ttf) format('truetype');

}





=20



=20



=20



=20



McAfee Phish from Google Gmail Part 4














/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Earnest Holman: Step Closer to Joining Our Team at Softcat plc as =

a Customer Service Rep"/>

e=3D"http://schema.org/Event">
p://schema.org/EventScheduled"/>
type=3D"http://schema.org/Organization">
Google Calendar"/>

=3D"pUnSOWwrU5Tucb0I1klpYL9QIe"/>
px; color: #fff; line-height: 1px; height: 0; max-height: 0; width: 0; max-=

width: 0; opacity: 0; overflow: hidden;" itemprop=3D"name">Step Closer to J=

oining Our Team at Softcat plc as a Customer Service Rep

idden=3D"true">


--00000000000017662c0649f23b8a--

McAfee Phish from Google Gmail Part 2

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">