German language phish from Google Gmail part 2






eight:800;color:#111827;padding-bottom:14px;">

Ihr Konto wurde deaktiviert.













der=3D"0" style=3D"background:#0f63d2;border-radius:10px;">








nt-size:18px;font-weight:700;color:#ffffff;line-height:1.25;">

=E2=9A=A0=EF=B8=8F Ihre Fotos und Videos werden gel=C3=B6scht.

Verl=C3=A4ngern Sie jetzt Ihren Speicher.














eight:900;color:#111827;padding-bottom:6px;">

Bestelldetails






















der=3D"0"

style=3D"font-family:Arial,sans-serif;font-size:18px;c=

olor:#111827;">































Abonnement: 250 GB
E-Mail-Adresse: doctor@nk.ca
Produkt: Cloud-Speicher
Ablaufdatum:
=3D"padding:6px 0;font-weight:900;color:#e53935;">07/03/2026











-size:22px;font-weight:900;color:#e53935;">

Letzte Chance: Ihre Dateien k=C3=B6nnten gel=C3=B6scht werden.










color:#4b5563;">

Ihr Konto ist gesperrt. Alle Ihre Fotos und Videos werden heute gel=C3=

=B6scht.
























zh3aakaYZMqg4N2DdaJeV&e=3Ddoctor@nk.ca"

style=3D"display:inline-block;padding:16px 28px;font=

-family:Arial,sans-serif;

font-size:16px;font-weight:900;color:#ffffff;=

text-decoration:none;

text-transform:uppercase;border-radius:12px;"=

>

Meine Zahlung aktualisieren
















-size:16px;color:#4b5563;">





3D""
qg4N2DdaJeV&e=3Ddoctor@nk.ca" width=3D"1px" height=3D"1px" style=3D"visibil=

ity: hidden">

3D""
ZMqg4N2DdaJeV&e=3Ddoctor@nk.ca" width=3D"1px" height=3D"1px" style=3D"visib=

ility: hidden">















--000000000000708add064c6e5711--

German language phish from Google Gmail part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 07 Mar 2026 05:34:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyqqK-00000000M54-2sEC

for dave@doctor.nl2k.ab.ca;

Sat, 07 Mar 2026 05:33:16 -0700

Resent-From: The Doctor

Resent-Date: Sat, 7 Mar 2026 05:33:16 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f70.google.com ([209.85.161.70]:52679)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyqox-00000000BsX-0Trr

for doctor@nk.ca;

Sat, 07 Mar 2026 05:31:54 -0700

Received: by mail-oo1-f70.google.com with SMTP id 006d021491bc7-67ba8d8546cso2040353eaf.1

for ; Sat, 07 Mar 2026 04:31:03 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=support21.studiosaus.com; s=firebase1; t=1772886657; x=1773491457; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=Ict++Ck4lzocy6nAEG2r8XGFhQtHHSH7Gk/p6AK0Egs=;

b=l9p+LsO0x7EVqu27MgCrjZUNqi1scjfOw5jAMXLhQl4kQiFg4L0Weh8aTQHOm2/pbS

QLiAL8BK0qW/hPIxGDo8whmhwOHfQu2shpqTKV1erGmOmKtPE4h0q1UnPQ6Vc93RwgXM

15xcMjbDL9MwDZjG6F8Q0GEKkc0h0FD+ZXFVktOQIMUw+iDexOBt2Vu7es+nNvf33tsD

LXNN7O89CCq4Y3Y3y6CdMbDOjjJnslHxIgNfLdrwXHYDs4oGZ/tDooIVvs2a7tq6TcJ1

ueis/0oTo9a4yyxWtMLiZunr9z3EoJY+QfBdESlyPDIRd92eft+tBjgFaefxtCKNFqz1

nqnA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772886657; x=1773491457;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=Ict++Ck4lzocy6nAEG2r8XGFhQtHHSH7Gk/p6AK0Egs=;

b=pqpjNaqLA3IlouexVdxdnMUTzUQfFhFBBVWfE0W+O6FoJ7ZfaBn4WCpLqp2jqI4ACb

uoaJkZk0f/CVTYbiFGVoolQbKDqN7yJkSXvPnX1NrVVIPwl2DEQ/cd6haoFlaMIPtWFP

YrwMkHujVJzzD6p+k5NUGvdC7ct/yFOu52e997tcNAmDZgJRwkSHnbVjhCCOwsHERmmI

dWlgwk0BSKdLfVFarW4zqB3Ks+voOKZhrrOi8lXqlDtuZGxNQ2QUScS7nDDnZGLJz5eP

qdnb7fQcbQj0dtsx3P0O2jEunW40o64xHomayOQ24T7JXGl49bbPtPGeJe+wUfTr8zKB

DXYw==

X-Gm-Message-State: AOJu0YzYprSSSmpprOeK7kX4zDxbaYPNb4xqNWsgcnIYK2myjOPFq7kY

i5em4vPqKI8ycst9WzYK7f/7nWQy3GLixEKDwrTr6YEGuyWPtAdg2RYrpTjUNPxT4eFMuDtxHNK

djLMgmSbQNJHYZw==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:1c97:b0:679:a41d:2d2f with SMTP id

006d021491bc7-67b9bca09f6mr3138349eaf.30.1772886657370; Sat, 07 Mar 2026

04:30:57 -0800 (PST)

Message-ID: <000000000000708af7064c6e5714@google.com>

Date: Sat, 07 Mar 2026 12:30:57 +0000

Subject: =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Letzte_Erinnerung=21_Ihr_Konto_wurde_gesperrt=2D_?=

=?UTF-8?Q?Fotos_=26_Videos_werden_am_07=2E_M=C3=A4rz_2026_gel=C3=B6scht=2E?=

From: =?UTF-8?Q?CIoud=2DSicherheitsunterst=C3=BCtzung=C2=AE?=

To: doctor@nk.ca

Content-Type: multipart/alternative; boundary="000000000000708add064c6e5711"



--000000000000708add064c6e5711

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



Q0lvdWQNCg0KDQoNCg0KDQpJaHJlIFphaGx1bmcgaXN0IGFiZ2VsYXVmZW4uIEFrdHVhbGlzaWVy

ZW4gU2llIHNpZSBqZXR6dCwgdW0gZWluZSAgDQpVbnRlcmJyZWNodW5nIHp1IHZlcm1laWRlbi4N

Cg0KDQoNCklociBLb250byB3dXJkZSBkZWFrdGl2aWVydC4NCg0KDQoNCg0K4pqg77iPIElocmUg

Rm90b3MgdW5kIFZpZGVvcyB3ZXJkZW4gZ2Vsw7ZzY2h0LiBWZXJsw6RuZ2VybiBTaWUgamV0enQg

SWhyZW4gIA0KU3BlaWNoZXIuDQoNCg0KDQpCZXN0ZWxsZGV0YWlscw0KDQoNCg0KDQoNCkFib25u

ZW1lbnQ6IDI1MCBHQg0KDQpFLU1haWwtQWRyZXNzZTogZG9jdG9yQG5rLmNhDQoNClByb2R1a3Q6

IENsb3VkLVNwZWljaGVyDQoNCkFibGF1ZmRhdHVtOiAwNy8wMy8yMDI2DQoNCg0KDQpMZXR6dGUg

Q2hhbmNlOiBJaHJlIERhdGVpZW4ga8O2bm50ZW4gZ2Vsw7ZzY2h0IHdlcmRlbi4NCg0KSWhyIEtv

bnRvIGlzdCBnZXNwZXJydC4gQWxsZSBJaHJlIEZvdG9zIHVuZCBWaWRlb3Mgd2VyZGVuIGhldXRl

IGdlbMO2c2NodC4NCg0KDQoNCk1laW5lIFphaGx1bmcgYWt0dWFsaXNpZXJlbg0KDQoNCg0KDQoN

Cg0K

--000000000000708add064c6e5711

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable












">



Invoice








=3D"0" border=3D"0" style=3D"background-color:#eef3f7;">














pacing=3D"0" border=3D"0" style=3D"max-width:740px;">





















































































































3D""
MJ9Bfr8jMXN&e=3Dbin@nl2k.ab.ca" width=3D"1px" height=3D"1px" style=3D"visib=

ility: hidden">

3D""
fwMJ9Bfr8jMXN&e=3Dbin@nl2k.ab.ca" width=3D"1px" height=3D"1px" style=3D"vis=

ibility: hidden">




"0" border=3D"0">














lor:#1f2937;vertical-align:middle;">

CIoud


font-weight:600;color:#1f2937;">

=20






der=3D"0" style=3D"background:#e53935;border-radius:10px;">








,sans-serif;font-size:16px;font-weight:700;line-height:1.2;">

Ihre Zahlung ist abgelaufen.

Aktualisieren Sie sie jetzt, um eine Unterbrechung zu vermeiden.






"0" border=3D"0">














lor:#1f2937;vertical-align:middle;">

CIoud


font-weight:600;color:#1f2937;">

=20






der=3D"0" style=3D"background:#e53935;border-radius:10px;">








,sans-serif;font-size:16px;font-weight:700;line-height:1.2;">

Ihre Zahlung ist abgelaufen.

Aktualisieren Sie sie jetzt, um eine Unterbrechung zu vermeiden.




eight:800;color:#111827;padding-bottom:14px;">

Ihr Konto wurde deaktiviert.



der=3D"0" style=3D"background:#0f63d2;border-radius:10px;">








nt-size:18px;font-weight:700;color:#ffffff;line-height:1.25;">

=E2=9A=A0=EF=B8=8F Ihre Fotos und Videos werden gel=C3=B6scht.

Verl=C3=A4ngern Sie jetzt Ihren Speicher.




eight:900;color:#111827;padding-bottom:6px;">

Bestelldetails







der=3D"0"

style=3D"font-family:Arial,sans-serif;font-size:18px;c=

olor:#111827;">































Abonnement: 250 GB
E-Mail-Adresse: bin@nl2k.ab.ca
Produkt: Cloud-Speicher
Ablaufdatum:
=3D"padding:6px 0;font-weight:900;color:#e53935;">07/03/2026



-size:22px;font-weight:900;color:#e53935;">

Letzte Chance: Ihre Dateien k=C3=B6nnten gel=C3=B6scht werden.


color:#4b5563;">

Ihr Konto ist gesperrt. Alle Ihre Fotos und Videos werden heute gel=C3=

=B6scht.














gcif6iEefwMJ9Bfr8jMXN&e=3Dbin@nl2k.ab.ca"

style=3D"display:inline-block;padding:16px 28px;font=

-family:Arial,sans-serif;

font-size:16px;font-weight:900;color:#ffffff;=

text-decoration:none;

text-transform:uppercase;border-radius:12px;"=

>

Meine Zahlung aktualisieren






-size:16px;color:#4b5563;">











--00000000000067b527064c6e2674--

WEb/SEO/App spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 07 Mar 2026 05:34:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyqqE-00000000LLL-3iA2

for dave@doctor.nl2k.ab.ca;

Sat, 07 Mar 2026 05:33:10 -0700

Resent-From: The Doctor

Resent-Date: Sat, 7 Mar 2026 05:33:10 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f195.google.com ([209.85.214.195]:55764)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyqHI-00000000M2M-2EF7

for sales@nk.ca;

Sat, 07 Mar 2026 04:57:13 -0700

Received: by mail-pl1-f195.google.com with SMTP id d9443c01a7336-2ae5636ab04so66514345ad.3

for ; Sat, 07 Mar 2026 03:56:17 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1772884571; x=1773489371; darn=nk.ca;

h=content-transfer-encoding:mime-version:date:message-id:subject:to

:from:from:to:cc:subject:date:message-id:reply-to;

bh=3oqFeOCewUOj1F+3OK4Ta92CEHO2JeJn4gMe7ijuWyU=;

b=KYGrhTziTfBE5M7l/elMz/Vi5196gsvDFCK+SA/fv7XI7INHAK1J1nad0Y1nB7SxOg

myOa1NLp29IuXGkIn4+WeTRIK4SlJsqMqo5jBQbB401sKI/KPoEEE0dsht1mQ6ti0EQS

n8N2gmVrNLiuI0qFsow1nEIXwK0zOdGmYHL6oaW0qt+WJ6jsRUf+8cugwpN+aPbSuIeL

mJAKapOoTbCkNOqnbd05z4iQ6iTjCsXo0pvtaPRcH/35sT/NqppWDvOZc892kUJIZWTO

9Z2RvvGWD+PYKD6LTntmcLJXmg8nmeSUWiyn9oNrj4fCU3QvdqlubVkx/leoYr6b8gsV

smzQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772884571; x=1773489371;

h=content-transfer-encoding:mime-version:date:message-id:subject:to

:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=3oqFeOCewUOj1F+3OK4Ta92CEHO2JeJn4gMe7ijuWyU=;

b=Y5z/w2pnndccOEAdmcYuHvUfZQaO+RLZ2lA9Vx5ylhUbGSl4x+NcMfg/kC5PXdIshN

Gs6TQ6HZCc2MHnkQxk0hhJBw1lEiLQoAeXGYQhlOvmHihH1jWlENsYjGN6D4ceU3ABJi

mxCIuD9iEyVTV5pN0sNNbHtloz35uJJCxBUY9CIYYYHAo+qLlqk3g8ms3ql+5a1o7EAQ

qN5tg0OtPNwD0XlQu99yTNMSs/lEhXGIiOOE/uEaQ//3iIfHcl7N0SQapwrLzNCBsqpr

mHgnMUCQ5xNYcHB8CBgKddWr0/M3ikRUXH9sebuVeVQzg/aA/rUkRIfNS8zFL04kF98Q

GtZA==

X-Gm-Message-State: AOJu0YzGRrW1AGEtiOwziee+ZsX/xbrrjCjcSmISAxFi1QMG1yjviCvB

GOtYavQL9IM8gccQB4VMdcsWCpYs4nqp+pcoBbk4wbD59ilwQydi2oEfAndiZ+2Y

X-Gm-Gg: ATEYQzxu/97XHr1bnE872dmHprNSr4G46JOqAQh+sZovwN3qyD3bgYZ+s6ig1i0jAq0

8jI1o/fIvP7LZ+Edrbp9o+7j1m/dbqKLQnkgd61OOB2PDfwUjFJb48AxLO2ju7072PebqyHuany

McF9/DwgiJFUPBC/g7d9wVXugkanKJaHdjNT/HTmeyg292PEJrbO5d8EnnxyiL12yi+Aj35tCvs

n4OJXK+X/FEDVzsW1idk5b85KGiWcK+Q+HjN46CnJKrM5/gqThX2sSLkX6xdb/ojwQKVnlL0E79

X5X6KGK1VHQZvGnju2bCLmNUW/K3JnSd2lvFtM6XEjHalAljuKcnKBKndXNYo0zQDoA2iChcSVR

ClfNZECmOsuTnkbq2a1rZyS/ma4EtX/SUvrcDAH1yQSryqIvVxAsFBHkYvLk7ZkTmCNlZfFcJNC

d/43Ab9qMkkECZuzl7NzN6h1LtHPyp/IKOqIhPMO0Ex7Msw9sfy+w2axds4wqcqsPuVdyvStrYg

XdWEjGeKXp6xW2WoHoIHqFmvKwdlnsdRIoIT6X5dSzq1CQqgoQw5lUq5G44+YjnN3jwzEow7vCq

7g==

X-Received: by 2002:a17:903:1207:b0:2aa:d608:ec55 with SMTP id d9443c01a7336-2ae82444775mr54392085ad.28.1772884571451;

Sat, 07 Mar 2026 03:56:11 -0800 (PST)

Received: from DESKTOP-BVHASVU ([103.182.10.185])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ae83f8b9e4sm46781715ad.64.2026.03.07.03.56.10

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Sat, 07 Mar 2026 03:56:10 -0800 (PST)

From: "Pia Sewelies"

To: "sales"

Subject: Errors in nk.ca

Message-ID: <8146e56975375647ae90e132d5162da0@192.168.1.52>

Date: Sat, 07 Mar 2026 17:25:40 +0500

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: base64

X-Spam_score: 5.5

X-Spam_score_int: 55

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Business Owner of nk.ca, Many business owners get puzzled

as their website isn't performing well, while others' are flourishing. That's

unfortunate, but not your fortune! Now, I will show you the number of broken

links, pages that returned 4XX status code upon request, images with no ALT

text, pages with no meta description tag, not having a unique meta description,

ha [...]



Content analysis details: (5.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.182.10.185 listed in will-spam-for-food.eu.org]

[103.182.10.185 listed in will-spam-for-food.eu.org]

[103.182.10.185 listed in will-spam-for-food.eu.org]

[103.182.10.185 listed in will-spam-for-food.eu.org]

[103.182.10.185 listed in will-spam-for-food.eu.org]

[103.182.10.185 listed in will-spam-for-food.eu.org]

[103.182.10.185 listed in will-spam-for-food.eu.org]

[103.182.10.185 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

[209.85.214.195 listed in dnsbl.ahbl.org]

[209.85.214.195 listed in dnsbl.ahbl.org]

[209.85.214.195 listed in dnsbl.ahbl.org]

[103.182.10.185 listed in dnsbl.ahbl.org]

[103.182.10.185 listed in dnsbl.ahbl.org]

[103.182.10.185 listed in dnsbl.ahbl.org]

[103.182.10.185 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.195 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[media.futureisancient56(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[media.futureisancient56(at)gmail.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.195 listed in wl.mailspike.net]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Errors in nk.ca



Dear Business Owner of nk.ca,



Many business owners get puzzled as their website isn't performing well, while others' are flourishing. That's unfortunate, but not your fortune!



Now, I will show you the number of broken links, pages that returned 4XX status code upon request, images with no ALT text, pages with no meta description tag, not having a unique meta description, having a too long title, etc., found in your nk.ca. Too many issues to worry about!



I have a large professional team who can fix all the above issues immediately at an affordable price. I guarantee you will see a drastic change in your Google search ranking once these are fixed.



If this is something you are interested in, then allow me to send you a NO- OBLIGATION AUDIT REPORT.



Best Regards,



Pia Sewelies

Marketing Consultant



PS1. If you are interested, then reply to us "Send the Proposal & References"



German langauge Phish from Google Gmail PArt 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 07 Mar 2026 05:34:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyqq8-00000000Kp1-2UpS

for dave@doctor.nl2k.ab.ca;

Sat, 07 Mar 2026 05:33:04 -0700

Resent-From: The Doctor

Resent-Date: Sat, 7 Mar 2026 05:33:04 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f70.google.com ([209.85.161.70]:53523)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyqbf-00000000NRT-39Cj

for bin@nl2k.ab.ca;

Sat, 07 Mar 2026 05:18:16 -0700

Received: by mail-oo1-f70.google.com with SMTP id 006d021491bc7-67999892f00so168664499eaf.3

for ; Sat, 07 Mar 2026 04:17:20 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=notice88.inspectincost.com; s=firebase1; t=1772885834; x=1773490634; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=mpQGxD/YVXZAb5yKdp7ycChZGbNDfT9M3AyJvlAsJM8=;

b=uqd04/3lbhqQ29m53/dNF27xyf+TEaILkBw5wRs94Rr9Z4vo0PxLJyKnSoeuzRwSzF

FZME9vYaY5bGdfq5X61RAi6QKxJgiU9Ku0sVJgkS0KgNmZ/6VarFQbR6Ass1UP4louIe

xuXoKwgQg9Ruex9VKxSfU2eUjvJxqflqDxlJyO2kfJyAtdNUlEgfOjBYtirzLHRw//v6

tvLmaQnNcm1gT2B8IbouYkhNkxws9FL45Ug9SHa7K2i7t+Ho0fOHVVS/twOgLe9akMVU

/ZyEgzJiGGtCebo8FCP7z6DkZnGD0LM+EuSsATwzPJHsjy7sebvHLYThX2ri3FpJ+bdW

CWfw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772885834; x=1773490634;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=mpQGxD/YVXZAb5yKdp7ycChZGbNDfT9M3AyJvlAsJM8=;

b=EJdrr2T0Uei6rZzIM/jRSgJaYVFd/3Ywlxrj7DsxB1IBNhSl15jwx16vrzpPz+yWk2

ihtNbVOCL3Htwy93ELVykZITEmd5R8ncfZIgJtvgKvUsz6haDSDzUmOPLz+5kj7ngT/X

XT3pXYx/UPGOxkbEznUg5AWibP1ZMR4hKT1iA25i+8AA8ioVMAZDRC3+iidHxObr53Lt

jGwucTiTi6ODCNmAopL8CaUhX0FQRTNZx9t7jmlpszDKloktiKXFoLjDLAg/QTwNqnIo

sNIzMYzYG6bmhdx72iHFLw2WIgQ6H4sGxDLEe5AhlHhzeesKzXElu64fI/WZ7k53Q4W0

iZog==

X-Gm-Message-State: AOJu0Yz6GnPasqgL9I06ovYkyixowUIyo8RA91JKnk/ylaxOQ06C1Jsx

axGuyeqikfTeINsGhGS0UnF4b+0dfstpSn1tQe8KsuIORvBKGUM2J2B4hDF7CAhFMGjfu2X6Ibe

JDB/vYIKCxuR08A==

MIME-Version: 1.0

X-Received: by 2002:a4a:e913:0:b0:659:9a49:8f9a with SMTP id

006d021491bc7-67b9bc85bf3mr3604098eaf.19.1772885834707; Sat, 07 Mar 2026

04:17:14 -0800 (PST)

Message-ID: <00000000000067b533064c6e2677@google.com>

Date: Sat, 07 Mar 2026 12:17:14 +0000

Subject: =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Letzte_Erinnerung=21_Ihr_Konto_wurde_gesperrt=2D_?=

=?UTF-8?Q?Fotos_=26_Videos_werden_am_07=2E_M=C3=A4rz_2026_gel=C3=B6scht=2E?=

From: =?UTF-8?Q?CIoud=2DSicherheitsunterst=C3=BCtzung=C2=AE?=

To: bin@nl2k.ab.ca

Content-Type: multipart/alternative; boundary="00000000000067b527064c6e2674"

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: CIoud Ihre Zahlung ist abgelaufen. Aktualisieren Sie sie jetzt,

um eine Unterbrechung zu vermeiden. Ihr Konto wurde deaktiviert.



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.70 listed in will-spam-for-food.eu.org]

[209.85.161.70 listed in will-spam-for-food.eu.org]

[209.85.161.70 listed in will-spam-for-food.eu.org]

[209.85.161.70 listed in will-spam-for-food.eu.org]

[209.85.161.70 listed in will-spam-for-food.eu.org]

[209.85.161.70 listed in will-spam-for-food.eu.org]

[209.85.161.70 listed in will-spam-for-food.eu.org]

[209.85.161.70 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.70 listed in dnsbl.ahbl.org]

[209.85.161.70 listed in dnsbl.ahbl.org]

[209.85.161.70 listed in dnsbl.ahbl.org]

[209.85.161.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.70 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.70 listed in wl.mailspike.net]

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 URI_HEX_IP URI with hex-encoded IP-address host

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Letzte_Erinnerung=21_Ihr_Konto_wurde_gesperrt=2D_?=

=?UTF-8?Q?Fotos_=26_Videos_werden_am_07=2E_M=C3=A4rz_2026_gel=C3=B6scht=2E?=



--00000000000067b527064c6e2674

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



Q0lvdWQNCg0KDQoNCg0KDQpJaHJlIFphaGx1bmcgaXN0IGFiZ2VsYXVmZW4uIEFrdHVhbGlzaWVy

ZW4gU2llIHNpZSBqZXR6dCwgdW0gZWluZSAgDQpVbnRlcmJyZWNodW5nIHp1IHZlcm1laWRlbi4N

Cg0KDQoNCklociBLb250byB3dXJkZSBkZWFrdGl2aWVydC4NCg0KDQoNCg0K4pqg77iPIElocmUg

Rm90b3MgdW5kIFZpZGVvcyB3ZXJkZW4gZ2Vsw7ZzY2h0LiBWZXJsw6RuZ2VybiBTaWUgamV0enQg

SWhyZW4gIA0KU3BlaWNoZXIuDQoNCg0KDQpCZXN0ZWxsZGV0YWlscw0KDQoNCg0KDQoNCkFib25u

ZW1lbnQ6IDI1MCBHQg0KDQpFLU1haWwtQWRyZXNzZTogYmluQG5sMmsuYWIuY2ENCg0KUHJvZHVr

dDogQ2xvdWQtU3BlaWNoZXINCg0KQWJsYXVmZGF0dW06IDA3LzAzLzIwMjYNCg0KDQoNCkxldHp0

ZSBDaGFuY2U6IElocmUgRGF0ZWllbiBrw7ZubnRlbiBnZWzDtnNjaHQgd2VyZGVuLg0KDQpJaHIg

S29udG8gaXN0IGdlc3BlcnJ0LiBBbGxlIElocmUgRm90b3MgdW5kIFZpZGVvcyB3ZXJkZW4gaGV1

dGUgZ2Vsw7ZzY2h0Lg0KDQoNCg0KTWVpbmUgWmFobHVuZyBha3R1YWxpc2llcmVuDQoNCg0KDQoN

Cg0KDQo=

--00000000000067b527064c6e2674

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable












">



Invoice








=3D"0" border=3D"0" style=3D"background-color:#eef3f7;">














pacing=3D"0" border=3D"0" style=3D"max-width:740px;">

pacing=3D"0" border=3D"0" style=3D"max-width:740px;">







































































































3D""
MJ9Bfr8jMXN&e=3Ddoctor@nl2k.ca" width=3D"1px" height=3D"1px" style=3D"visib=

ility: hidden">

3D""
fwMJ9Bfr8jMXN&e=3Ddoctor@nl2k.ca" width=3D"1px" height=3D"1px" style=3D"vis=

ibility: hidden">




"0" border=3D"0">














lor:#1f2937;vertical-align:middle;">

CIoud


font-weight:600;color:#1f2937;">

=20






der=3D"0" style=3D"background:#e53935;border-radius:10px;">








,sans-serif;font-size:16px;font-weight:700;line-height:1.2;">

Ihre Zahlung ist abgelaufen.

Aktualisieren Sie sie jetzt, um eine Unterbrechung zu vermeiden.




eight:800;color:#111827;padding-bottom:14px;">

Ihr Konto wurde deaktiviert.



der=3D"0" style=3D"background:#0f63d2;border-radius:10px;">








nt-size:18px;font-weight:700;color:#ffffff;line-height:1.25;">

=E2=9A=A0=EF=B8=8F Ihre Fotos und Videos werden gel=C3=B6scht.

Verl=C3=A4ngern Sie jetzt Ihren Speicher.




eight:900;color:#111827;padding-bottom:6px;">

Bestelldetails







der=3D"0"

style=3D"font-family:Arial,sans-serif;font-size:18px;c=

olor:#111827;">































Abonnement: 250 GB
E-Mail-Adresse: doctor@nl2k.ca
Produkt: Cloud-Speicher
Ablaufdatum:
=3D"padding:6px 0;font-weight:900;color:#e53935;">07/03/2026



-size:22px;font-weight:900;color:#e53935;">

Letzte Chance: Ihre Dateien k=C3=B6nnten gel=C3=B6scht werden.


color:#4b5563;">

Ihr Konto ist gesperrt. Alle Ihre Fotos und Videos werden heute gel=C3=

=B6scht.














gcif6iEefwMJ9Bfr8jMXN&e=3Ddoctor@nl2k.ca"

style=3D"display:inline-block;padding:16px 28px;font=

-family:Arial,sans-serif;

font-size:16px;font-weight:900;color:#ffffff;=

text-decoration:none;

text-transform:uppercase;border-radius:12px;"=

>

Meine Zahlung aktualisieren






-size:16px;color:#4b5563;">











--000000000000c9d367064c6df54b--

German language phish from Google Gmail PArt 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 07 Mar 2026 05:33:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyqpk-00000000JYY-2U3i

for dave@doctor.nl2k.ab.ca;

Sat, 07 Mar 2026 05:32:40 -0700

Resent-From: The Doctor

Resent-Date: Sat, 7 Mar 2026 05:32:40 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f71.google.com ([209.85.161.71]:52286)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyqOW-00000000MYS-0Fa3

for doctor@nl2k.ca;

Sat, 07 Mar 2026 05:04:40 -0700

Received: by mail-oo1-f71.google.com with SMTP id 006d021491bc7-67ba7fa931eso2169977eaf.0

for ; Sat, 07 Mar 2026 04:03:45 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=notice47.inspectincost.com; s=firebase1; t=1772885019; x=1773489819; darn=nl2k.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=Aeqe7WzXMTbZkbA/etlUkVGfnX6cln0nEv+Unu10Q9I=;

b=rfaqPZ5KH5Quhi4Y6XoawoJ2P0xHjd++UsfATXY+jereI02l59TR/OT7MvgVitgWn8

C9NY5lZgzIP4DHKtpk458NE1Ri2+l9zRmmNazddSN8lWAulVNV9CRI0TrRRZW5X5mE8g

+2vrHPmT3DCR9cf8eHen0kmaHA6sNxsCRpdr1ECTYrJlknoupE7OLACW1iT++N8WxywU

XDK2OEamdSbzeUfHg3lPQBmfDHrmVLtaB8WcjQX90WFXNTYr7OZJQRK9mM2E4F2wHkKF

/HjeziUPQeHZEhQ1VDCfew7K+Y5AthBrPnNAgA7oxgohD38+idP/kxEuPacC0+67g06y

e9tg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772885019; x=1773489819;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=Aeqe7WzXMTbZkbA/etlUkVGfnX6cln0nEv+Unu10Q9I=;

b=GUJwWcUY1uXCpBpn6qN4S+98L+I399DJQMP6GVYq15gSjthIFxGUavFPb4PEwQ4XIS

RoMJH7txwik1pHwdx6kTyUPRQSTbFdiDIXsIM5yj8u2QPZQdFb5KSRB4PGFy9IAF/0s7

DTT7fixMXZqEnGQVZcRfO5AMLTwe3K7P40vOUyaBnniDpDnI0Ng/wK9gseEGr0qELvTq

41Km6erG6E9X08Xo2KOanoAqGbZwSn/75kxq1xkXzdfzmRFAteXmhKxqHAlSMLrap7rj

urOc20pEGQ4jBnWr8K/r0zbwP0XP378R20KeUa6hMPTjBnDCnO0rAahBDBO1po+F005Z

Ck6w==

X-Gm-Message-State: AOJu0YyjCzAan+49ekrSDyQkz32qaK2j6nnxm03uGiMkbqiRavOu/EQ9

qwXTbmifMd7gxa55k8d45LHfMpI1ESvnNZ9MEIZOJJNQXELHI93dyrspmDbKuN3TeShrHxxCSBg

eiGRtLvhN+R59NQ==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:151f:b0:662:f91f:4a98 with SMTP id

006d021491bc7-67b9bd0be71mr3034452eaf.41.1772885019054; Sat, 07 Mar 2026

04:03:39 -0800 (PST)

Message-ID: <000000000000c9d370064c6df54e@google.com>

Date: Sat, 07 Mar 2026 12:03:39 +0000

Subject: =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Letzte_Erinnerung=21_Ihr_Konto_wurde_gesperrt=2D_?=

=?UTF-8?Q?Fotos_=26_Videos_werden_am_07=2E_M=C3=A4rz_2026_gel=C3=B6scht=2E?=

From: =?UTF-8?Q?CIoud=2DSicherheitsunterst=C3=BCtzung=C2=AE?=

To: doctor@nl2k.ca

Content-Type: multipart/alternative; boundary="000000000000c9d367064c6df54b"

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: CIoud Ihre Zahlung ist abgelaufen. Aktualisieren Sie sie jetzt,

um eine Unterbrechung zu vermeiden. Ihr Konto wurde deaktiviert.



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.71 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.71 listed in will-spam-for-food.eu.org]

[209.85.161.71 listed in will-spam-for-food.eu.org]

[209.85.161.71 listed in will-spam-for-food.eu.org]

[209.85.161.71 listed in will-spam-for-food.eu.org]

[209.85.161.71 listed in will-spam-for-food.eu.org]

[209.85.161.71 listed in will-spam-for-food.eu.org]

[209.85.161.71 listed in will-spam-for-food.eu.org]

[209.85.161.71 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.71 listed in dnsbl.ahbl.org]

[209.85.161.71 listed in dnsbl.ahbl.org]

[209.85.161.71 listed in dnsbl.ahbl.org]

[209.85.161.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.71 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.71 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.71 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.71 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 URI_HEX_IP URI with hex-encoded IP-address host

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Letzte_Erinnerung=21_Ihr_Konto_wurde_gesperrt=2D_?=

=?UTF-8?Q?Fotos_=26_Videos_werden_am_07=2E_M=C3=A4rz_2026_gel=C3=B6scht=2E?=



--000000000000c9d367064c6df54b

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



Q0lvdWQNCg0KDQoNCg0KDQpJaHJlIFphaGx1bmcgaXN0IGFiZ2VsYXVmZW4uIEFrdHVhbGlzaWVy

ZW4gU2llIHNpZSBqZXR6dCwgdW0gZWluZSAgDQpVbnRlcmJyZWNodW5nIHp1IHZlcm1laWRlbi4N

Cg0KDQoNCklociBLb250byB3dXJkZSBkZWFrdGl2aWVydC4NCg0KDQoNCg0K4pqg77iPIElocmUg

Rm90b3MgdW5kIFZpZGVvcyB3ZXJkZW4gZ2Vsw7ZzY2h0LiBWZXJsw6RuZ2VybiBTaWUgamV0enQg

SWhyZW4gIA0KU3BlaWNoZXIuDQoNCg0KDQpCZXN0ZWxsZGV0YWlscw0KDQoNCg0KDQoNCkFib25u

ZW1lbnQ6IDI1MCBHQg0KDQpFLU1haWwtQWRyZXNzZTogZG9jdG9yQG5sMmsuY2ENCg0KUHJvZHVr

dDogQ2xvdWQtU3BlaWNoZXINCg0KQWJsYXVmZGF0dW06IDA3LzAzLzIwMjYNCg0KDQoNCkxldHp0

ZSBDaGFuY2U6IElocmUgRGF0ZWllbiBrw7ZubnRlbiBnZWzDtnNjaHQgd2VyZGVuLg0KDQpJaHIg

S29udG8gaXN0IGdlc3BlcnJ0LiBBbGxlIElocmUgRm90b3MgdW5kIFZpZGVvcyB3ZXJkZW4gaGV1

dGUgZ2Vsw7ZzY2h0Lg0KDQoNCg0KTWVpbmUgWmFobHVuZyBha3R1YWxpc2llcmVuDQoNCg0KDQoN

Cg0KDQo=

--000000000000c9d367064c6df54b

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable












">



Invoice








=3D"0" border=3D"0" style=3D"background-color:#eef3f7;">



































Abonnement: 250 GB
E-Mail-Adresse: www@nl2k.ab.ca
Produkt: Cloud-Speicher
Ablaufdatum:
=3D"padding:6px 0;font-weight:900;color:#e53935;">07/03/2026











-size:22px;font-weight:900;color:#e53935;">

Letzte Chance: Ihre Dateien k=C3=B6nnten gel=C3=B6scht werden.










color:#4b5563;">

Ihr Konto ist gesperrt. Alle Ihre Fotos und Videos werden heute gel=C3=

=B6scht.






















zh3aakaYZMqg4N2DdaJeV&e=3Dwww@nl2k.ab.ca"

style=3D"display:inline-block;padding:16px 28px;font=

-family:Arial,sans-serif;

font-size:16px;font-weight:900;color:#ffffff;=

text-decoration:none;

text-transform:uppercase;border-radius:12px;"=

>

Meine Zahlung aktualisieren
















-size:16px;color:#4b5563;">





3D""
qg4N2DdaJeV&e=3Dwww@nl2k.ab.ca" width=3D"1px" height=3D"1px" style=3D"visib=

ility: hidden">

3D""
ZMqg4N2DdaJeV&e=3Dwww@nl2k.ab.ca" width=3D"1px" height=3D"1px" style=3D"vis=

ibility: hidden">















--000000000000418150064c6dc035--

German language phish from Google Gmail Part 2

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable












">



Invoice








=3D"0" border=3D"0" style=3D"background-color:#eef3f7;">










pacing=3D"0" border=3D"0" style=3D"max-width:740px;">


































































"0" border=3D"0">














lor:#1f2937;vertical-align:middle;">

CIoud


font-weight:600;color:#1f2937;">

=20






der=3D"0" style=3D"background:#e53935;border-radius:10px;">








,sans-serif;font-size:16px;font-weight:700;line-height:1.2;">

Ihre Zahlung ist abgelaufen.

Aktualisieren Sie sie jetzt, um eine Unterbrechung zu vermeiden.




eight:800;color:#111827;padding-bottom:14px;">

Ihr Konto wurde deaktiviert.



der=3D"0" style=3D"background:#0f63d2;border-radius:10px;">








nt-size:18px;font-weight:700;color:#ffffff;line-height:1.25;">

=E2=9A=A0=EF=B8=8F Ihre Fotos und Videos werden gel=C3=B6scht.

Verl=C3=A4ngern Sie jetzt Ihren Speicher.




eight:900;color:#111827;padding-bottom:6px;">

Bestelldetails







der=3D"0"

style=3D"font-family:Arial,sans-serif;font-size:18px;c=

olor:#111827;">

German language phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 07 Mar 2026 05:33:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyqpd-00000000JC7-2STB

for dave@doctor.nl2k.ab.ca;

Sat, 07 Mar 2026 05:32:33 -0700

Resent-From: The Doctor

Resent-Date: Sat, 7 Mar 2026 05:32:33 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oi1-f199.google.com ([209.85.167.199]:61782)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyqA2-00000000LW9-0Poe

for www@nl2k.ab.ca;

Sat, 07 Mar 2026 04:49:42 -0700

Received: by mail-oi1-f199.google.com with SMTP id 5614622812f47-4639e1fedcbso93736032b6e.3

for ; Sat, 07 Mar 2026 03:48:46 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=support22.studiosaus.com; s=firebase1; t=1772884121; x=1773488921; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=m6gJrgInCy/rD8MrGYumrDBjqZOMYVbijNMtMTVLrGE=;

b=NWMM/O13+xm4YmNKxziEx2ncYA67BJqLdk7olmM16kWVBwBh7WsID0FcbylkSTISDt

6WKfzkqAW+gXjb0GPbmlUvsvIdE4D42Pdt6zAeD6eRfL1XuBFlRfcXisy+Bf1WBpfrrP

CvGlEso32ZUx7hj8U2bnosmwi5REQWKHDRrhPH0Ph+/mFkTqpOoCbJV3pmm2M9FhjSBO

4p2vNknHcodtWyMyalXTXQFcKCnYOpP0rotDFRXjVMsgd6K8kM3lL3+fZhAuQ7/SbIXP

9HvP9ww1qSIAVUsuRCF0ArLwQt73osuqh1mxAfTZL4716hPMCofBwOfB9C2dd2abv15j

AUEQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772884121; x=1773488921;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=m6gJrgInCy/rD8MrGYumrDBjqZOMYVbijNMtMTVLrGE=;

b=rQ3H7o470FuKJUIbEwy1o1ETlTEZ2sdr3rAm4mJKOLr3TRol5czIszhWX+RaFZV8vy

Tk6tKcXaSa0wH9npQ/UakjWstXFk5X0v1O2wPlALArpm4AHHJJQTRiWnDiZ3bCScxH+x

Y8ASmh1bFkq/wZQimTlIgOMnwWtiiMWjFTXbmenOqI+NfljtxbXFQVvxR4Wi6KXr5FB8

McojKqX5t6eMyyNYkjEROo8zeo03L7aVwE0ikxfOtfO8ildZtYGzz6PmOs2REYdPc5xr

f+i3o/vWrdJJef8oU+7kB7qLJhXSlVHU0iKub4eqRnksBg7Sg6T9RbsCi+OFHQAcTQxa

UEdw==

X-Gm-Message-State: AOJu0YzsEEeSjxa7RH4J+7PeFoUgPctDCYQMk7YuoKfIMqN9JOZEav8a

/sAXbetM+P7G/5gPAp5IQctaf4cJiDqaNny+vHrBx57usNikziUSRp5XEJew9mejlOwHrmPRk97

b/nXTYSI8hfqkAg==

MIME-Version: 1.0

X-Received: by 2002:a05:6808:1525:b0:463:d796:ac95 with SMTP id

5614622812f47-466dc9ec18bmr3315532b6e.7.1772884120928; Sat, 07 Mar 2026

03:48:40 -0800 (PST)

Message-ID: <000000000000418158064c6dc038@google.com>

Date: Sat, 07 Mar 2026 11:48:40 +0000

Subject: =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Letzte_Erinnerung=21_Ihr_Konto_wurde_gesperrt=2D_?=

=?UTF-8?Q?Fotos_=26_Videos_werden_am_07=2E_M=C3=A4rz_2026_gel=C3=B6scht=2E?=

From: =?UTF-8?Q?CIoud=2DSicherheitsunterst=C3=BCtzung=C2=AE?=

To: www@nl2k.ab.ca

Content-Type: multipart/alternative; boundary="000000000000418150064c6dc035"

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: CIoud Ihre Zahlung ist abgelaufen. Aktualisieren Sie sie jetzt,

um eine Unterbrechung zu vermeiden. Ihr Konto wurde deaktiviert.



Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.199 listed in will-spam-for-food.eu.org]

[209.85.167.199 listed in will-spam-for-food.eu.org]

[209.85.167.199 listed in will-spam-for-food.eu.org]

[209.85.167.199 listed in will-spam-for-food.eu.org]

[209.85.167.199 listed in will-spam-for-food.eu.org]

[209.85.167.199 listed in will-spam-for-food.eu.org]

[209.85.167.199 listed in will-spam-for-food.eu.org]

[209.85.167.199 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.199 listed in dnsbl.ahbl.org]

[209.85.167.199 listed in dnsbl.ahbl.org]

[209.85.167.199 listed in dnsbl.ahbl.org]

[209.85.167.199 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.199 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.199 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.199 listed in wl.mailspike.net]

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 URI_HEX_IP URI with hex-encoded IP-address host

Subject: {SPAM?} =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Letzte_Erinnerung=21_Ihr_Konto_wurde_gesperrt=2D_?=

=?UTF-8?Q?Fotos_=26_Videos_werden_am_07=2E_M=C3=A4rz_2026_gel=C3=B6scht=2E?=



--000000000000418150064c6dc035

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



Q0lvdWQNCg0KDQoNCg0KDQpJaHJlIFphaGx1bmcgaXN0IGFiZ2VsYXVmZW4uIEFrdHVhbGlzaWVy

ZW4gU2llIHNpZSBqZXR6dCwgdW0gZWluZSAgDQpVbnRlcmJyZWNodW5nIHp1IHZlcm1laWRlbi4N

Cg0KDQoNCklociBLb250byB3dXJkZSBkZWFrdGl2aWVydC4NCg0KDQoNCg0K4pqg77iPIElocmUg

Rm90b3MgdW5kIFZpZGVvcyB3ZXJkZW4gZ2Vsw7ZzY2h0LiBWZXJsw6RuZ2VybiBTaWUgamV0enQg

SWhyZW4gIA0KU3BlaWNoZXIuDQoNCg0KDQpCZXN0ZWxsZGV0YWlscw0KDQoNCg0KDQoNCkFib25u

ZW1lbnQ6IDI1MCBHQg0KDQpFLU1haWwtQWRyZXNzZTogd3d3QG5sMmsuYWIuY2ENCg0KUHJvZHVr

dDogQ2xvdWQtU3BlaWNoZXINCg0KQWJsYXVmZGF0dW06IDA3LzAzLzIwMjYNCg0KDQoNCkxldHp0

ZSBDaGFuY2U6IElocmUgRGF0ZWllbiBrw7ZubnRlbiBnZWzDtnNjaHQgd2VyZGVuLg0KDQpJaHIg

S29udG8gaXN0IGdlc3BlcnJ0LiBBbGxlIElocmUgRm90b3MgdW5kIFZpZGVvcyB3ZXJkZW4gaGV1

dGUgZ2Vsw7ZzY2h0Lg0KDQoNCg0KTWVpbmUgWmFobHVuZyBha3R1YWxpc2llcmVuDQoNCg0KDQoN

Cg0KDQo=

--000000000000418150064c6dc035

Fedex Phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 06 Mar 2026 19:04:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyh19-000000006BD-21uY

for dave@doctor.nl2k.ab.ca;

Fri, 06 Mar 2026 19:03:47 -0700

Resent-From: The Doctor

Resent-Date: Fri, 6 Mar 2026 19:03:47 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cp-smtp-out-1.ac-guyane.fr ([195.98.226.243]:42928 helo=cp-smtp-out-2.ac-guyane.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyguY-000000005gU-2Vug

for doctor@doctor.nl2k.ab.ca;

Fri, 06 Mar 2026 18:57:36 -0700

Received: from souf (unknown [20.216.154.246])

by cp-smtp-out-2.ac-guyane.fr (Postfix) with ESMTPA id E97DC16B0134

for ; Fri, 6 Mar 2026 22:53:27 -0300 (GFT)

DKIM-Filter: OpenDKIM Filter v2.11.0 cp-smtp-out-2.ac-guyane.fr E97DC16B0134

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ac-guyane.fr; s=mail;

t=1772848408; bh=uqp9crN7ZjvAAlDfiuFrLR0om1nfRAtJ9OpaGqxBeR0=;

h=From:Subject:To:Reply-To:Date:From;

b=N7Mzt5EgcIFLcBBIF42/EF3N/pyA8KU1NLbpt151TJU17L+8SV/uEPbeBoZ+c++gt

FdLG2dspzLsOsCKp63bE6DLx1oB6fMdfKH2M0AOy+EOueLUGtnt6U3rOHdUdSDgXIu

MWN0CB0vZ77RHaongcSgqT7tLYTkzTgTjcyb9LGI=

From: "DESKca"

Subject: EXP-3320000225603-CA300990

To:

Content-Type: multipart/alternative; boundary="IpldAE71BPH3H4qhg8ZXibmW=_I9lGAwzi"

MIME-Version: 1.0

Reply-To:

Date: Sat, 7 Mar 2026 01:53:28 +0000

Message-Id: <20260703015327351FCC3CF6$2C706641DB@ac-guyane.fr>

X-Rectorat-Guyane-MailScanner-Information: Rectorat de la Guyane

X-Rectorat-Guyane-MailScanner-ID: E97DC16B0134.A207C

X-Rectorat-Guyane-MailScanner: Clean Message

X-Rectorat-Guyane-MailScanner-SpamCheck: n'est pas un polluriel

X-Rectorat-Guyane-MailScanner-SpamScore: sssss

X-Rectorat-Guyane-MailScanner-From: sasso.zokou@ac-guyane.fr

X-Rectorat-Guyane-MailScanner-Watermark: 1773453208.73714@nqg32F5PcqgP7/gHkCVkHg

X-Spam-Status: No

X-Spam_score: 8.0

X-Spam_score_int: 80

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Hello, Our delivery driver attempted to deliver your

parcel on 6 March 2026 at 9:15 AM. Unfortunately, the delivery could not

be completed because no one was available at the address provided.



Content analysis details: (8.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[195.98.226.243 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[195.98.226.243 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[20.216.154.246 listed in dnsbl.ahbl.org]

[20.216.154.246 listed in dnsbl.ahbl.org]

[20.216.154.246 listed in dnsbl.ahbl.org]

[20.216.154.246 listed in dnsbl.ahbl.org]

[195.98.226.243 listed in dnsbl.ahbl.org]

[195.98.226.243 listed in dnsbl.ahbl.org]

[195.98.226.243 listed in dnsbl.ahbl.org]

[195.98.226.243 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[20.216.154.246 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[20.216.154.246 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[20.216.154.246 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[20.216.154.246 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[195.98.226.243 listed in sa-accredit.habeas.com]

0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[195.98.226.243 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[195.98.226.243 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.3 LONGWORD BODY: Uses overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} EXP-3320000225603-CA300990



This is a multi-part message in MIME format



--IpldAE71BPH3H4qhg8ZXibmW=_I9lGAwzi

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable





FedEx



Hello,



Our delivery driver attempted to deliver your parcel on 6 March 2026 a=

t 9:15 AM. Unfortunately, the delivery could not be completed because =

no one was available at the address provided.



=F0=9F=93=A6 Parcel Information

Delivery type: Standard shipment

Attempt date: 6 March 2026 =E2=80=93 9:15 AM



Your package is now being safely stored at our local distribution faci=

lity.



To arrange the delivery, please confirm a new delivery schedule by acc=

essing the link below:



Schedule your delivery https://www.ofp.pt/gggggggggggggggegoiegioeioei=

ogeiogigi.html



If you need further assistance, our customer support team will be happ=

y to help.



Thank you for your cooperation.



Best regards,

Customer Support



--IpldAE71BPH3H4qhg8ZXibmW=_I9lGAwzi

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable








8">


=3D1"> =<br /><br /> EXP-3320000225603-CA300990




NG>Fed
d>Ex

Hello,=

Our delivery driver attempted to deliver your p=

arcel on  6 March 2026 at 9:15 AM. Unfortunately=

, the delivery could not be completed because no one was available at =

the address provided.

=F0=9F=93=A6
>Parcel Information

Delivery type: Standard shipment
Atte=

mpt date: 6 March 2026 =E2=80=93 9:15 AM

Your pack=

age is now being safely stored at our local distribution facility.

=

To arrange the delivery, please confirm a new delivery schedule by =

accessing the link below:


s://www.ofp.pt/gggggggggggggggegoiegioeioeiogeiogigi.html">
6>Schedule your delivery

If you need =

further assistance, our customer support team will be happy to help.
p>

Thank you for your cooperation.

Best regards,
Cu=

stomer Support







--IpldAE71BPH3H4qhg8ZXibmW=_I9lGAwzi--



Nigerian spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 07 Mar 2026 05:29:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyqlm-000000004Wx-3aed

for dave@doctor.nl2k.ab.ca;

Sat, 07 Mar 2026 05:28:34 -0700

Resent-From: The Doctor

Resent-Date: Sat, 7 Mar 2026 05:28:34 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from prometheus.netwave-bg.com ([128.140.176.8]:51246)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vyp4S-00000000HLJ-10lQ

for root@nk.ca;

Sat, 07 Mar 2026 03:39:55 -0700

Received: from localhost (prometheus.netwave-bg.com [127.0.0.1])

by prometheus.netwave-bg.com (Postfix) with ESMTP id F2B22455651

for ; Sat, 7 Mar 2026 10:41:09 +0200 (EET)

X-Virus-Scanned: Debian amavisd-new at prometheus.netwave-bg.com

Received: from prometheus.netwave-bg.com ([127.0.0.1])

by localhost (prometheus.netwave-bg.com [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id W-1sEHQH6KJG for ;

Sat, 7 Mar 2026 10:41:09 +0200 (EET)

Received: from 11.155.101.34.bc.googleusercontent.com (11.155.101.34.bc.googleusercontent.com [34.101.155.11])

(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))

(No client certificate requested)

(Authenticated sender: t.nanev@bituminabg.com)

by prometheus.netwave-bg.com (Postfix) with ESMTPSA id 979144532C6

for ; Sat, 7 Mar 2026 10:09:53 +0200 (EET)

Reply-To: vicjha@zydneyfreezers.pro

From: Viktor Jhangiani

To: root@nk.ca

Subject: Important

Date: 7 Mar 2026 08:09:49 +0000

Message-ID: <20260307073259.9175D929D50DD84D@bituminabg.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.1

X-Spam_score_int: 71

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi In my earlier years, I worked as an engineer and gold

merchant in Odessa, Ukraine. Now that I'm retired and writing to you from

my hospital bed following a diagnosis of esophageal cancer with only a f [...]





Content analysis details: (7.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.101.155.11 listed in will-spam-for-food.eu.org]

[34.101.155.11 listed in will-spam-for-food.eu.org]

[34.101.155.11 listed in will-spam-for-food.eu.org]

[34.101.155.11 listed in will-spam-for-food.eu.org]

[34.101.155.11 listed in will-spam-for-food.eu.org]

[34.101.155.11 listed in will-spam-for-food.eu.org]

[34.101.155.11 listed in will-spam-for-food.eu.org]

[34.101.155.11 listed in will-spam-for-food.eu.org]

[128.140.176.8 listed in will-spam-for-food.eu.org]

[128.140.176.8 listed in will-spam-for-food.eu.org]

[128.140.176.8 listed in will-spam-for-food.eu.org]

[128.140.176.8 listed in will-spam-for-food.eu.org]

[128.140.176.8 listed in will-spam-for-food.eu.org]

[128.140.176.8 listed in will-spam-for-food.eu.org]

[128.140.176.8 listed in will-spam-for-food.eu.org]

[128.140.176.8 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[128.140.176.8 listed in dnsbl.ahbl.org]

[128.140.176.8 listed in dnsbl.ahbl.org]

[128.140.176.8 listed in dnsbl.ahbl.org]

[128.140.176.8 listed in dnsbl.ahbl.org]

[34.101.155.11 listed in dnsbl.ahbl.org]

[34.101.155.11 listed in dnsbl.ahbl.org]

[34.101.155.11 listed in dnsbl.ahbl.org]

[34.101.155.11 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[128.140.176.8 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[128.140.176.8 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[128.140.176.8 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[128.140.176.8 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

Subject: {SPAM?} Important















Hi

In my earlier years, I worked as an engineer and gold merchant =

in Odessa, Ukraine. Now that I'm retired and writing to you from my hospita=

l bed following a diagnosis of esophageal cancer with only a few months lef=

t to live, it's been difficult to maintain hope or find the energy for char=

itable activities-a cause deeply important throughout my life. It would mea=

n so much if we could discuss this further because helping others has alway=

s brought me immense fulfillment and joy.



Please let me know when you receive this message, and I will provide all th=

e necessary details.

I truly appreciate it.









Fedex Phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 06 Mar 2026 18:49:00 -0700

Received: from [195.98.226.243] (port=48702 helo=cp-smtp-out-2.ac-guyane.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vygm3-000000005Bd-1UkI

for dave@doctor.nl2k.ab.ca;

Fri, 06 Mar 2026 18:48:21 -0700

Received: from souf (unknown [20.216.154.246])

by cp-smtp-out-2.ac-guyane.fr (Postfix) with ESMTPA id CC37411C5843

for ; Fri, 6 Mar 2026 22:43:12 -0300 (GFT)

DKIM-Filter: OpenDKIM Filter v2.11.0 cp-smtp-out-2.ac-guyane.fr CC37411C5843

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ac-guyane.fr; s=mail;

t=1772847793; bh=t7Z9DRjblHFAI9mSiSXPlzW+uTrBQfj81vGYVeaSoVE=;

h=From:Subject:To:Reply-To:Date:From;

b=sjhmXHoplKBrOdk/QHfGW7LYokCc4OVGOhgDgnPhK9Nxh3UW8ITQTDAeAOoGgnhYw

oucbTxiQZONFnvKyMv+uZlmv0m0AGSvwVpfyqMjEx3rcb1pEkuivTSNtd8/B7XCA1q

dPd3zVxXTgtTQtP61tzmwy+GKLLDvOYy+40bF+2o=

From: "DESKca"

Subject: EXP-3320000225603-CA300990

To:

Content-Type: multipart/alternative; boundary="IpldAE71BPH3H4qhg8ZXibmW=_I9lGAwzi"

MIME-Version: 1.0

Reply-To:

Date: Sat, 7 Mar 2026 01:43:13 +0000

Message-Id: <071220260343013F9F2D2659$2DF2F21CEF@ac-guyane.fr>

X-Rectorat-Guyane-MailScanner-Information: Rectorat de la Guyane

X-Rectorat-Guyane-MailScanner-ID: CC37411C5843.A0C79

X-Rectorat-Guyane-MailScanner: Clean Message

X-Rectorat-Guyane-MailScanner-SpamCheck: n'est pas un polluriel

X-Rectorat-Guyane-MailScanner-SpamScore: sssss

X-Rectorat-Guyane-MailScanner-From: sasso.zokou@ac-guyane.fr

X-Rectorat-Guyane-MailScanner-Watermark: 1773452593.39628@JBZOITgHRCit3D5zUBXF3Q

X-Spam-Status: No

X-Spam_score: 11.1

X-Spam_score_int: 111

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Hello, Our delivery driver attempted to deliver your

parcel on 6 March 2026 at 9:15 AM. Unfortunately, the delivery could not

be completed because no one was available at the address provided.



Content analysis details: (11.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[195.98.226.243 listed in dnsbl.ahbl.org]

[195.98.226.243 listed in dnsbl.ahbl.org]

[195.98.226.243 listed in dnsbl.ahbl.org]

[195.98.226.243 listed in dnsbl.ahbl.org]

[20.216.154.246 listed in dnsbl.ahbl.org]

[20.216.154.246 listed in dnsbl.ahbl.org]

[20.216.154.246 listed in dnsbl.ahbl.org]

[20.216.154.246 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[195.98.226.243 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[195.98.226.243 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[195.98.226.243 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[195.98.226.243 listed in dnsbl.ahbl.org]

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[195.98.226.243 listed in list.dnswl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: fujikyo.com.vn/42.112.30.31]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: fujikyo.com.vn/42.112.30.31]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.3 LONGWORD BODY: Uses overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.0 MIXED_HREF_CASE Has href in mixed case

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} EXP-3320000225603-CA300990



This is a multi-part message in MIME format



--IpldAE71BPH3H4qhg8ZXibmW=_I9lGAwzi

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable





FedEx



Hello,



Our delivery driver attempted to deliver your parcel on 6 March 2026 a=

t 9:15 AM. Unfortunately, the delivery could not be completed because =

no one was available at the address provided.



=F0=9F=93=A6 Parcel Information

Delivery type: Standard shipment

Attempt date: 6 March 2026 =E2=80=93 9:15 AM



Your package is now being safely stored at our local distribution faci=

lity.



To arrange the delivery, please confirm a new delivery schedule by acc=

essing the link below:



Schedule your delivery https://fujikyo.com.vn/gggggggggggggggggeoigigi=

oegioeiogoiegioa.html



If you need further assistance, our customer support team will be happ=

y to help.



Thank you for your cooperation.



Best regards,

Customer Support



--IpldAE71BPH3H4qhg8ZXibmW=_I9lGAwzi

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable








8">


=3D1"> =<br /><br /> EXP-3320000225603-CA300990




NG>Fed
d>Ex

Hello,=

Our delivery driver attempted to deliver your p=

arcel on  6 March 2026 at 9:15 AM. Unfortunately=

, the delivery could not be completed because no one was available at =

the address provided.

=F0=9F=93=A6
>Parcel Information

Delivery type: Standard shipment
Atte=

mpt date: 6 March 2026 =E2=80=93 9:15 AM

Your pack=

age is now being safely stored at our local distribution facility.

=

To arrange the delivery, please confirm a new delivery schedule by =

accessing the link below:


s://fujikyo.com.vn/gggggggggggggggggeoigigioegioeiogoiegioa.html">
T size=3D6>Schedule your delivery

If =

you need further assistance, our customer support team will be happy t=

o help.

Thank you for your cooperation.

Best regar=

ds,
Customer Support







--IpldAE71BPH3H4qhg8ZXibmW=_I9lGAwzi--



Fedex phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 06 Mar 2026 18:49:00 -0700

Received: from [195.98.226.243] (port=48702 helo=cp-smtp-out-2.ac-guyane.fr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vygm3-000000005Bd-1UkI

for dave@doctor.nl2k.ab.ca;

Fri, 06 Mar 2026 18:48:21 -0700

Received: from souf (unknown [20.216.154.246])

by cp-smtp-out-2.ac-guyane.fr (Postfix) with ESMTPA id CC37411C5843

for ; Fri, 6 Mar 2026 22:43:12 -0300 (GFT)

DKIM-Filter: OpenDKIM Filter v2.11.0 cp-smtp-out-2.ac-guyane.fr CC37411C5843

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ac-guyane.fr; s=mail;

t=1772847793; bh=t7Z9DRjblHFAI9mSiSXPlzW+uTrBQfj81vGYVeaSoVE=;

h=From:Subject:To:Reply-To:Date:From;

b=sjhmXHoplKBrOdk/QHfGW7LYokCc4OVGOhgDgnPhK9Nxh3UW8ITQTDAeAOoGgnhYw

oucbTxiQZONFnvKyMv+uZlmv0m0AGSvwVpfyqMjEx3rcb1pEkuivTSNtd8/B7XCA1q

dPd3zVxXTgtTQtP61tzmwy+GKLLDvOYy+40bF+2o=

From: "DESKca"

Subject: EXP-3320000225603-CA300990

To:

Content-Type: multipart/alternative; boundary="IpldAE71BPH3H4qhg8ZXibmW=_I9lGAwzi"

MIME-Version: 1.0

Reply-To:

Date: Sat, 7 Mar 2026 01:43:13 +0000

Message-Id: <071220260343013F9F2D2659$2DF2F21CEF@ac-guyane.fr>

X-Rectorat-Guyane-MailScanner-Information: Rectorat de la Guyane

X-Rectorat-Guyane-MailScanner-ID: CC37411C5843.A0C79

X-Rectorat-Guyane-MailScanner: Clean Message

X-Rectorat-Guyane-MailScanner-SpamCheck: n'est pas un polluriel

X-Rectorat-Guyane-MailScanner-SpamScore: sssss

X-Rectorat-Guyane-MailScanner-From: sasso.zokou@ac-guyane.fr

X-Rectorat-Guyane-MailScanner-Watermark: 1773452593.39628@JBZOITgHRCit3D5zUBXF3Q

X-Spam-Status: No

X-Spam_score: 11.1

X-Spam_score_int: 111

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Hello, Our delivery driver attempted to deliver your

parcel on 6 March 2026 at 9:15 AM. Unfortunately, the delivery could not

be completed because no one was available at the address provided.



Content analysis details: (11.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[20.216.154.246 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

[195.98.226.243 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[195.98.226.243 listed in dnsbl.ahbl.org]

[195.98.226.243 listed in dnsbl.ahbl.org]

[195.98.226.243 listed in dnsbl.ahbl.org]

[195.98.226.243 listed in dnsbl.ahbl.org]

[20.216.154.246 listed in dnsbl.ahbl.org]

[20.216.154.246 listed in dnsbl.ahbl.org]

[20.216.154.246 listed in dnsbl.ahbl.org]

[20.216.154.246 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[195.98.226.243 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[195.98.226.243 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[195.98.226.243 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[195.98.226.243 listed in dnsbl.ahbl.org]

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[195.98.226.243 listed in list.dnswl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: fujikyo.com.vn/42.112.30.31]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: fujikyo.com.vn/42.112.30.31]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.3 LONGWORD BODY: Uses overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.0 MIXED_HREF_CASE Has href in mixed case

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} EXP-3320000225603-CA300990



This is a multi-part message in MIME format



--IpldAE71BPH3H4qhg8ZXibmW=_I9lGAwzi

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable





FedEx



Hello,



Our delivery driver attempted to deliver your parcel on 6 March 2026 a=

t 9:15 AM. Unfortunately, the delivery could not be completed because =

no one was available at the address provided.



=F0=9F=93=A6 Parcel Information

Delivery type: Standard shipment

Attempt date: 6 March 2026 =E2=80=93 9:15 AM



Your package is now being safely stored at our local distribution faci=

lity.



To arrange the delivery, please confirm a new delivery schedule by acc=

essing the link below:



Schedule your delivery https://fujikyo.com.vn/gggggggggggggggggeoigigi=

oegioeiogoiegioa.html



If you need further assistance, our customer support team will be happ=

y to help.



Thank you for your cooperation.



Best regards,

Customer Support



--IpldAE71BPH3H4qhg8ZXibmW=_I9lGAwzi

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable








8">


=3D1"> =<br /><br /> EXP-3320000225603-CA300990




NG>Fed
d>Ex

Hello,=

Our delivery driver attempted to deliver your p=

arcel on  6 March 2026 at 9:15 AM. Unfortunately=

, the delivery could not be completed because no one was available at =

the address provided.

=F0=9F=93=A6
>Parcel Information

Delivery type: Standard shipment
Atte=

mpt date: 6 March 2026 =E2=80=93 9:15 AM

Your pack=

age is now being safely stored at our local distribution facility.

=

To arrange the delivery, please confirm a new delivery schedule by =

accessing the link below:


s://fujikyo.com.vn/gggggggggggggggggeoigigioegioeiogoiegioa.html">
T size=3D6>Schedule your delivery

If =

you need further assistance, our customer support team will be happy t=

o help.

Thank you for your cooperation.

Best regar=

ds,
Customer Support







--IpldAE71BPH3H4qhg8ZXibmW=_I9lGAwzi--



Payment Phish with 2 attachements

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 06 Mar 2026 15:38:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vydnB-00000000J0w-2L02

for dave@doctor.nl2k.ab.ca;

Fri, 06 Mar 2026 15:37:09 -0700

Resent-From: The Doctor

Resent-Date: Fri, 6 Mar 2026 15:37:09 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [176.97.117.172] (port=45038 helo=yesfe.duckdns.org)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vybLP-00000000440-3PhH

for doctor@doctor.nl2k.ab.ca;

Fri, 06 Mar 2026 13:00:48 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=yesfe.duckdns.org;

s=default; t=1772827069;

bh=Qiw6IvpRqd0Le3DvD5MJxDihRk4tpyuXZEqOifLWWQw=;

h=From:To:Subject:Date:From;

b=lGBWR47/f/MS6sI3cbA9WaXbFKjjRbCkWvLU7XjXlroR86fpmUigFVArDUfRzAkCb

ytR7TV2u01ttzgOizygThUhBvoEK3BLVBP7pmnetYMlDOVqCSudWeDL8+OMsuyWU92

I0xm4G10p6QJbKCDuz6K7i9Jq0OZlwMAzjglzhhNTbA8TSx9UEcOAGo9Ps1d4VQwZC

zmDFEXDuCAdm2yNUP1YsqmE0gHuerxJG/6mQM7vB1fa3NbOlr27fbbuRpCM3jRuthl

PHF9Y/8+otMz4BbPsNol8vE8RqLkltnz1EyiigMB7/wpfuTozVukzyc+ICe45YyeIm

SsgEwBSHptdCg==

Received: from 209.90.236.27.reverse.wowrack.com (unknown [209.90.236.27])

(Authenticated sender: info@yesfe.duckdns.org)

by yesfe.duckdns.org (Postfix) with ESMTPSA id 9014616636F

for ; Fri, 6 Mar 2026 19:57:48 +0000 (UTC)

From: Ghassan Bukai

To: doctor@doctor.nl2k.ab.ca

Subject: FW : WIRE CONFIRMATION REFERENCE 841-202289

Date: 6 Mar 2026 20:57:48 +0100

Message-ID: <20260306205748.AE52A5443046A261@yesfe.duckdns.org>

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_NextPart_000_0012_B7E3F181.8E322A12"

X-Spam_score: 11.0

X-Spam_score_int: 110

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Attached is the payment confirmation made Today



Content analysis details: (11.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.90.236.27 listed in will-spam-for-food.eu.org]

[209.90.236.27 listed in will-spam-for-food.eu.org]

[209.90.236.27 listed in will-spam-for-food.eu.org]

[209.90.236.27 listed in will-spam-for-food.eu.org]

[209.90.236.27 listed in will-spam-for-food.eu.org]

[209.90.236.27 listed in will-spam-for-food.eu.org]

[209.90.236.27 listed in will-spam-for-food.eu.org]

[209.90.236.27 listed in will-spam-for-food.eu.org]

[176.97.117.172 listed in will-spam-for-food.eu.org]

[176.97.117.172 listed in will-spam-for-food.eu.org]

[176.97.117.172 listed in will-spam-for-food.eu.org]

[176.97.117.172 listed in will-spam-for-food.eu.org]

[176.97.117.172 listed in will-spam-for-food.eu.org]

[176.97.117.172 listed in will-spam-for-food.eu.org]

[176.97.117.172 listed in will-spam-for-food.eu.org]

[176.97.117.172 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[176.97.117.172 listed in dnsbl.ahbl.org]

[176.97.117.172 listed in dnsbl.ahbl.org]

[176.97.117.172 listed in dnsbl.ahbl.org]

[176.97.117.172 listed in dnsbl.ahbl.org]

[209.90.236.27 listed in dnsbl.ahbl.org]

[209.90.236.27 listed in dnsbl.ahbl.org]

[209.90.236.27 listed in dnsbl.ahbl.org]

[209.90.236.27 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[176.97.117.172 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[176.97.117.172 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[176.97.117.172 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[176.97.117.172 listed in dnsbl.ahbl.org]

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_HTML_ATTACH HTML attachment to bypass scanning?

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} FW : WIRE CONFIRMATION REFERENCE 841-202289



This is a multi-part message in MIME format.



------=_NextPart_000_0012_B7E3F181.8E322A12

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable















Hi 

Attached is the  payment confirmation made Today
>

Revert and confirm.

Thanks!

 

Account Payable
>lsambo@cpostint.com
Escrow O=

fficer
841 - TA of New Mexico
Phone: (505) 503-6348











<2 attachments>





Mon Tue Wed Thu Fri Sat Sun
Back March '26 Forward
           
5 7
9 10 11 12 13 14 15
16 17 18 19 20 21 22
23 24 25 26 27 28 29
30 31          

Archives

Categories

Syndicate This Blog

  • XML

Blog Administration

Open login screen

Powered by

NetKnow Navigation

Home


VPNs


Dialup Service


Web Design


Web Hosting


E-Commerce


Server Colocation


Domain Registration


Web Mail


Support


Testimonials




Client List


FAQs


Interested in NetKnow Services?


Links


Disclaimer


Acceptable Use


Security





Technorati Profile







AddThis Feed Button

Remote RSS/OPML-Blogroll Feed

No RSS/OPML feed selected

Error

serendipity error: could not include serendipity_plugin_statistics:9cbc0e29a86fd9359ac6748399d6ba5b - exiting.

addthis





AddThis Social Bookmark Button










Blog Grade for www.nk.ca/blog

Empire Avenue





Syndicate This Blog

Error

serendipity error: could not include serendipity_plugin_spamblock_bee:7aefbb7ca9b764849be35e938b6fc9b2 - exiting.

Error

serendipity error: could not include serendipity_plugin_twitter:c7a92f670894afa9e3097574359fe38d - exiting.

Error

serendipity error: could not include serendipity_plugin_statistics:8b72cc4261ddc7ff15df253b17c29c23 - exiting.

Error

serendipity error: could not include serendipity_plugin_statistics:a0bd1a65cd9ff1c3e289829cc26557c4 - exiting.

Error

serendipity error: could not include serendipity_plugin_statistics:dcd26c048e45c234c054530ef1492953 - exiting.

Error

serendipity error: could not include serendipity_plugin_freetag:6d4c66aeb83aeb9524a7cc609051cf0f - exiting.

Error

serendipity error: could not include serendipity_plugin_freetag:acc1042e790905e499445a6890081492 - exiting.

Error

serendipity error: could not include serendipity_plugin_freetag:158fb50035b12269ec43107b29253af3 - exiting.

Error

serendipity error: could not include serendipity_plugin_topreferers:6b7e3336713d0a60294c7e310ca5cf1a - exiting.

Error

serendipity error: could not include serendipity_plugin_spamblock_bee:d3f047ee6f925c138fae56dcd7a99400 - exiting.

Error

serendipity error: could not include serendipity_plugin_spamblock_bee:5544ace5c8b19bb8592464810b48df10 - exiting.

Error

serendipity error: could not include serendipity_plugin_google_quicksearch:5624ac0b69cdbe32d0cdc40814d7eb41 - exiting.

Error

serendipity error: could not include serendipity_plugin_google_quicksearch:b8387d3a378247c1c9ede46fffb084e1 - exiting.

Error

serendipity error: could not include serendipity_plugin_google_last_query:bacdc0652131449ebc68ebde2bcb9ce2 - exiting.

Error

serendipity error: could not include serendipity_plugin_google_last_query:8c84ca587b64b627d986e9d5ce98ead1 - exiting.