donation spam
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 26 Feb 2026 10:36:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vvfHE-00000000PUL-0vCH
for dave@doctor.nl2k.ab.ca;
Thu, 26 Feb 2026 10:35:52 -0700
Resent-From: The Doctor
Resent-Date: Thu, 26 Feb 2026 10:35:52 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [162.240.174.144] (port=41998 helo=162-240-174-144.unifiedlayer.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vvc2Z-00000000LyF-3ID3
for sales@nk.ca;
Thu, 26 Feb 2026 07:08:41 -0700
Received: from [108.175.8.68] (port=55097)
by server-605330.leancarehealth.com with esmtpa (Exim 4.99.1)
(envelope-from)
id 1veVzh-0000000059c-1FUs
for sales@nk.ca;
Sat, 10 Jan 2026 03:14:53 -0700
Reply-To: IronwoodFamilyTrustFoundation@hotmail.com
From: Ironwood Family Trust Foundation
To: sales@nk.ca
Subject: Donation Notice
Date: 10 Jan 2026 10:14:52 +0000
Message-ID: <20260110101452.088F8BE246463BDE@leancarehealth.com>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server-605330.leancarehealth.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - leancarehealth.com
X-Get-Message-Sender-Via: server-605330.leancarehealth.com: authenticated_id: legal@leancarehealth.com
X-Authenticated-Sender: server-605330.leancarehealth.com: legal@leancarehealth.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 17.6
X-Spam_score_int: 176
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Season’s Greetings, I hope you are well.
Content analysis details: (17.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[108.175.8.68 listed in dnsbl.ahbl.org]
[108.175.8.68 listed in dnsbl.ahbl.org]
[108.175.8.68 listed in dnsbl.ahbl.org]
[108.175.8.68 listed in dnsbl.ahbl.org]
[162.240.174.144 listed in dnsbl.ahbl.org]
[162.240.174.144 listed in dnsbl.ahbl.org]
[162.240.174.144 listed in dnsbl.ahbl.org]
[162.240.174.144 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[108.175.8.68 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[108.175.8.68 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[108.175.8.68 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[108.175.8.68 listed in dnsbl.ahbl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.5 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname
(Split IP)
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 LOTS_OF_MONEY Huge... sums of money
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.2 HELO_MISC_IP Looking for more Dynamic IP Relays
1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[162.240.174.144 listed in will-spam-for-food.eu.org]
[162.240.174.144 listed in will-spam-for-food.eu.org]
[162.240.174.144 listed in will-spam-for-food.eu.org]
[162.240.174.144 listed in will-spam-for-food.eu.org]
[162.240.174.144 listed in will-spam-for-food.eu.org]
[162.240.174.144 listed in will-spam-for-food.eu.org]
[162.240.174.144 listed in will-spam-for-food.eu.org]
[162.240.174.144 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
Subject: {SPAM?} Donation Notice
letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =
font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=
oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =
initial; text-decoration-color: initial;">
Season’s Greetings,
letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =
font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=
oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =
initial; text-decoration-color: initial;">
I hope you are well.
letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =
font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=
oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =
initial; text-decoration-color: initial;">
We are pleased to inform you that a USD $1,000,000 donation from the Ironwo=
od Family Trust Foundation has been approved. This notification is to confi=
rm availability and next-step coordination.
letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =
font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=
oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =
initial; text-decoration-color: initial;">
Further details will be provided upon receipt of your reply confirming inte=
rest.
letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =
font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=
oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =
initial; text-decoration-color: initial;">
Kind regards,
Mr. David Guzman
Reply Here:&n=
bsp;=
IronwoodFamilyTrustFoundation@hotmail.com =
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 26 Feb 2026 10:36:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vvfHE-00000000PUL-0vCH
for dave@doctor.nl2k.ab.ca;
Thu, 26 Feb 2026 10:35:52 -0700
Resent-From: The Doctor
Resent-Date: Thu, 26 Feb 2026 10:35:52 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [162.240.174.144] (port=41998 helo=162-240-174-144.unifiedlayer.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vvc2Z-00000000LyF-3ID3
for sales@nk.ca;
Thu, 26 Feb 2026 07:08:41 -0700
Received: from [108.175.8.68] (port=55097)
by server-605330.leancarehealth.com with esmtpa (Exim 4.99.1)
(envelope-from
id 1veVzh-0000000059c-1FUs
for sales@nk.ca;
Sat, 10 Jan 2026 03:14:53 -0700
Reply-To: IronwoodFamilyTrustFoundation@hotmail.com
From: Ironwood Family Trust Foundation
To: sales@nk.ca
Subject: Donation Notice
Date: 10 Jan 2026 10:14:52 +0000
Message-ID: <20260110101452.088F8BE246463BDE@leancarehealth.com>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server-605330.leancarehealth.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - leancarehealth.com
X-Get-Message-Sender-Via: server-605330.leancarehealth.com: authenticated_id: legal@leancarehealth.com
X-Authenticated-Sender: server-605330.leancarehealth.com: legal@leancarehealth.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Spam_score: 17.6
X-Spam_score_int: 176
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Season’s Greetings, I hope you are well.
Content analysis details: (17.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[108.175.8.68 listed in dnsbl.ahbl.org]
[108.175.8.68 listed in dnsbl.ahbl.org]
[108.175.8.68 listed in dnsbl.ahbl.org]
[108.175.8.68 listed in dnsbl.ahbl.org]
[162.240.174.144 listed in dnsbl.ahbl.org]
[162.240.174.144 listed in dnsbl.ahbl.org]
[162.240.174.144 listed in dnsbl.ahbl.org]
[162.240.174.144 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[108.175.8.68 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[108.175.8.68 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[108.175.8.68 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[108.175.8.68 listed in dnsbl.ahbl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.5 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname
(Split IP)
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 LOTS_OF_MONEY Huge... sums of money
0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors
0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope
0.2 HELO_MISC_IP Looking for more Dynamic IP Relays
1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[162.240.174.144 listed in will-spam-for-food.eu.org]
[162.240.174.144 listed in will-spam-for-food.eu.org]
[162.240.174.144 listed in will-spam-for-food.eu.org]
[162.240.174.144 listed in will-spam-for-food.eu.org]
[162.240.174.144 listed in will-spam-for-food.eu.org]
[162.240.174.144 listed in will-spam-for-food.eu.org]
[162.240.174.144 listed in will-spam-for-food.eu.org]
[162.240.174.144 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
[108.175.8.68 listed in will-spam-for-food.eu.org]
Subject: {SPAM?} Donation Notice
letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =
font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=
oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =
initial; text-decoration-color: initial;">
Season’s Greetings,
letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =
font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=
oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =
initial; text-decoration-color: initial;">
I hope you are well.
letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =
font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=
oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =
initial; text-decoration-color: initial;">
We are pleased to inform you that a USD $1,000,000 donation from the Ironwo=
od Family Trust Foundation has been approved. This notification is to confi=
rm availability and next-step coordination.
letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =
font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=
oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =
initial; text-decoration-color: initial;">
Further details will be provided upon receipt of your reply confirming inte=
rest.
letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=
ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=
pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =
font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=
oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =
initial; text-decoration-color: initial;">
Kind regards,
Mr. David Guzman
Reply Here:&n=
bsp;=
IronwoodFamilyTrustFoundation@