Dating phish from google gmail
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 23 Aug 2026 22:30:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from)
id 1wyMIx-00000000H0V-48Hg
for dave@doctor.nl2k.ab.ca;
Sun, 23 Aug 2026 22:29:03 -0600
Resent-From: The Doctor
Resent-Date: Sun, 23 Aug 2026 22:29:03 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vk1-f198.google.com ([209.85.221.198]:57650)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100 (FreeBSD))
(envelope-from)
id 1wyL0u-0000000015O-1lJa
for root@nk.ca;
Sun, 23 Aug 2026 21:06:29 -0600
Received: by mail-vk1-f198.google.com with SMTP id 71dfb90a1353d-5c0fc9b4f43so3542759e0c.3
for; Sun, 23 Aug 2026 20:05:33 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=colegiosba-cl.20251104.gappssmtp.com; s=20251104; t=1787540727; x=1788145527; darn=nk.ca;
h=content-type:to:from:subject:date:message-id:mime-version:from:to
:cc:subject:date:message-id:reply-to:content-type;
bh=Sp7zUbn7glq7akKCB224tE9fdAcHLGGWaFk+3CNxJPc=;
b=cYkJ0XIzkHrHjD9JmLd38eXLRJ+akhD9vRB7NY/d2I710BXpuqBWccjRyHOT4L42fm
n55vVhjN8aWnHDyhV/glxcfH7A5EaEFY7T7RFW0TMi9CoTCBsntiFaAzmqDpW838Sc0P
NNeBKw84pDO9mP7n3bqQCrrwO6yDoOQmllMvq/YW/sheMmxNkwwjIHs8ItvTDEHmKPUR
lwnLDAV2Xy2HCzK98dm0QwDNYEA+Jqh2a4VCacHU3sbYtUmshR5iZ7H0KDV1e+/zGTm9
EO6oTHNyvpNW3uD3TKXIcIP2i52yLwbpsLlupZfc/J05oSpaiQiF4PehFlpDaV81hASu
qMRQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1787540727; x=1788145527;
h=content-type:to:from:subject:date:message-id:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=Sp7zUbn7glq7akKCB224tE9fdAcHLGGWaFk+3CNxJPc=;
b=BC+NRBc4dMgBLo5pISeqAzr5e9WoYgo+GxLiSHtR673jFwma6nvH3Kx99Z/31Fs5CN
Z9AndJRq/pRG2VMe4bP/kd15tqGncsfIdW5tJk3/BV+iSg3RJ+LK11j0wpjgtOR8a1ZD
5aaiJorIxGYZwTNgEPf5zs+pwZZA5KFDOTSK0kom/G/qStKoOwT7+XSr9Kb7S/5tpO0G
dB5jBghijICjuFhwHyRL8ljd7HnvNcEStyNzcRZfC+msuZBhT9aJFz3j5DegiELhBuIp
NJLXv+T7/HaOhzAaiRoXpHlXHphdJ6ZcAWSGTi6SasVD44HW0Bb0xIRjPxnlxSfo7ju0
3cRA==
X-Gm-Message-State: AFuF++nCc5SEguPU+k5vnKHanXfaPGxOwHvjY2NZWovAFC7/Wv6NIhvR
yHbEntNvBrpk+0m2CY8Lv+eG1JpR+3DhvJfn0sAeU7q+eX/z0aJP1nq7XJl57Eskhr59akO2HUz
8WlWYPT49zRPBEaPQOPsurA==
MIME-Version: 1.0
X-Received: by 2002:a05:690e:138c:b0:66d:c2c:c959 with SMTP id
956f58d0204a3-66d0c2cd563mr35555d50.25.1787540204135; Sun, 23 Aug 2026
19:56:44 -0700 (PDT)
Message-ID:
Date: Mon, 24 Aug 2026 02:56:44 +0000
Subject: did you
From: Anna
To: root@nk.ca
Content-Type: multipart/alternative; boundary="000000000000e3b6b10659c2221c"
X-Spam_score: 7.2
X-Spam_score_int: 72
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: 1,200+ single Ukrainian women online. They make the first
move — you just have to show up. Dating, but backwards Here, she writes
first.
Content analysis details: (7.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.221.198 listed in will-spam-for-food.eu.org]
[209.85.221.198 listed in will-spam-for-food.eu.org]
[209.85.221.198 listed in will-spam-for-food.eu.org]
[209.85.221.198 listed in will-spam-for-food.eu.org]
[209.85.221.198 listed in will-spam-for-food.eu.org]
[209.85.221.198 listed in will-spam-for-food.eu.org]
[209.85.221.198 listed in will-spam-for-food.eu.org]
[209.85.221.198 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.221.198 listed in dnsbl.ahbl.org]
[209.85.221.198 listed in dnsbl.ahbl.org]
[209.85.221.198 listed in dnsbl.ahbl.org]
[209.85.221.198 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.221.198 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.221.198 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.221.198 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.221.198 listed in dnsbl.ahbl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.221.198 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.198 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.221.198 listed in bl.score.senderscore.com]
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Rejected by SPF record.]
1.0 OPT_OUT BODY: No description available.
0.2 MARKETING_PARTNERS BODY: Claims you registered with a partner
0.3 OFFER BODY: Offers you Something
1.7 BAD_CREDIT BODY: Eliminate Bad Credit
0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
Subject: {SPAM?} did you
--000000000000e3b6b10659c2221c
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
MSwyMDArIHNpbmdsZSBVa3JhaW5pYW4gd29tZW4gb25saW5lLiBUaGV5IG1ha2UgdGhlIGZpcnN0
IG1vdmUg4oCUIHlvdSBqdXN0ICANCmhhdmUgdG8gc2hvdyB1cC4NCg0KDQoNCg0KRGF0aW5nLCBi
dXQgYmFja3dhcmRzDQoNCkhlcmUsIHNoZSB3cml0ZXMgZmlyc3QuDQoNCjEsMjAwKyBzaW5nbGUg
VWtyYWluaWFuIHdvbWVuIGFyZSBvbmxpbmUgdG9uaWdodCDigJQgd2l0dHksIGRpcmVjdCwgYW5k
IHRpcmVkICANCm9mIHdhaXRpbmcgYXJvdW5kLg0KDQpNYWtlIGEgcHJvZmlsZSwgYW5kIHRoZSBm
cmllbmQgcmVxdWVzdHMgY29tZSB0byB5b3UuDQoNCg0KDQoNClNlZSB3aG8ncyBvbmxpbmUg4oaS
DQoNCg0KDQpGcmVlIHJlZ2lzdHJhdGlvbiDCtyBObyBjcmVkaXQgY2FyZCDCtyBObyBmYWtlIHBy
b2ZpbGVzDQoNCg0KDQpZb3UgYXJlIHJlY2VpdmluZyB0aGlzIG1lc3NhZ2UgYmVjYXVzZSB5b3Ug
b3B0ZWQgaW4gdG8gcmVjZWl2ZSBvZmZlcnMgZnJvbSAgDQpvbmUgb2Ygb3VyIG1hcmtldGluZyBw
YXJ0bmVycy4gU2VudCBieSBhbiBpbmRlcGVuZGVudCB0aGlyZC1wYXJ0eSBtYXJrZXRpbmcgIA0K
Y29tcGFueSwgbm90IHRoZSBhZHZlcnRpc2VyLiBNdXN0IGJlIDE4Ky4NClVuc3Vic2NyaWJlIMK3
IE9wdCBvdXQgb2YgYWxsIG1haWxpbmdzDQoNCg0KDQo=
--000000000000e3b6b10659c2221c
Content-Type: text/html; charset="UTF-8"
Someone new
--000000000000e3b6b10659c2221c--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 23 Aug 2026 22:30:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from
id 1wyMIx-00000000H0V-48Hg
for dave@doctor.nl2k.ab.ca;
Sun, 23 Aug 2026 22:29:03 -0600
Resent-From: The Doctor
Resent-Date: Sun, 23 Aug 2026 22:29:03 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-vk1-f198.google.com ([209.85.221.198]:57650)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100 (FreeBSD))
(envelope-from
id 1wyL0u-0000000015O-1lJa
for root@nk.ca;
Sun, 23 Aug 2026 21:06:29 -0600
Received: by mail-vk1-f198.google.com with SMTP id 71dfb90a1353d-5c0fc9b4f43so3542759e0c.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=colegiosba-cl.20251104.gappssmtp.com; s=20251104; t=1787540727; x=1788145527; darn=nk.ca;
h=content-type:to:from:subject:date:message-id:mime-version:from:to
:cc:subject:date:message-id:reply-to:content-type;
bh=Sp7zUbn7glq7akKCB224tE9fdAcHLGGWaFk+3CNxJPc=;
b=cYkJ0XIzkHrHjD9JmLd38eXLRJ+akhD9vRB7NY/d2I710BXpuqBWccjRyHOT4L42fm
n55vVhjN8aWnHDyhV/glxcfH7A5EaEFY7T7RFW0TMi9CoTCBsntiFaAzmqDpW838Sc0P
NNeBKw84pDO9mP7n3bqQCrrwO6yDoOQmllMvq/YW/sheMmxNkwwjIHs8ItvTDEHmKPUR
lwnLDAV2Xy2HCzK98dm0QwDNYEA+Jqh2a4VCacHU3sbYtUmshR5iZ7H0KDV1e+/zGTm9
EO6oTHNyvpNW3uD3TKXIcIP2i52yLwbpsLlupZfc/J05oSpaiQiF4PehFlpDaV81hASu
qMRQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1787540727; x=1788145527;
h=content-type:to:from:subject:date:message-id:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=Sp7zUbn7glq7akKCB224tE9fdAcHLGGWaFk+3CNxJPc=;
b=BC+NRBc4dMgBLo5pISeqAzr5e9WoYgo+GxLiSHtR673jFwma6nvH3Kx99Z/31Fs5CN
Z9AndJRq/pRG2VMe4bP/kd15tqGncsfIdW5tJk3/BV+iSg3RJ+LK11j0wpjgtOR8a1ZD
5aaiJorIxGYZwTNgEPf5zs+pwZZA5KFDOTSK0kom/G/qStKoOwT7+XSr9Kb7S/5tpO0G
dB5jBghijICjuFhwHyRL8ljd7HnvNcEStyNzcRZfC+msuZBhT9aJFz3j5DegiELhBuIp
NJLXv+T7/HaOhzAaiRoXpHlXHphdJ6ZcAWSGTi6SasVD44HW0Bb0xIRjPxnlxSfo7ju0
3cRA==
X-Gm-Message-State: AFuF++nCc5SEguPU+k5vnKHanXfaPGxOwHvjY2NZWovAFC7/Wv6NIhvR
yHbEntNvBrpk+0m2CY8Lv+eG1JpR+3DhvJfn0sAeU7q+eX/z0aJP1nq7XJl57Eskhr59akO2HUz
8WlWYPT49zRPBEaPQOPsurA==
MIME-Version: 1.0
X-Received: by 2002:a05:690e:138c:b0:66d:c2c:c959 with SMTP id
956f58d0204a3-66d0c2cd563mr35555d50.25.1787540204135; Sun, 23 Aug 2026
19:56:44 -0700 (PDT)
Message-ID:
Date: Mon, 24 Aug 2026 02:56:44 +0000
Subject: did you
From: Anna
To: root@nk.ca
Content-Type: multipart/alternative; boundary="000000000000e3b6b10659c2221c"
X-Spam_score: 7.2
X-Spam_score_int: 72
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: 1,200+ single Ukrainian women online. They make the first
move — you just have to show up. Dating, but backwards Here, she writes
first.
Content analysis details: (7.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.221.198 listed in will-spam-for-food.eu.org]
[209.85.221.198 listed in will-spam-for-food.eu.org]
[209.85.221.198 listed in will-spam-for-food.eu.org]
[209.85.221.198 listed in will-spam-for-food.eu.org]
[209.85.221.198 listed in will-spam-for-food.eu.org]
[209.85.221.198 listed in will-spam-for-food.eu.org]
[209.85.221.198 listed in will-spam-for-food.eu.org]
[209.85.221.198 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.221.198 listed in dnsbl.ahbl.org]
[209.85.221.198 listed in dnsbl.ahbl.org]
[209.85.221.198 listed in dnsbl.ahbl.org]
[209.85.221.198 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.221.198 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.221.198 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.221.198 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.221.198 listed in dnsbl.ahbl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.221.198 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.221.198 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.221.198 listed in bl.score.senderscore.com]
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Rejected by SPF record.]
1.0 OPT_OUT BODY: No description available.
0.2 MARKETING_PARTNERS BODY: Claims you registered with a partner
0.3 OFFER BODY: Offers you Something
1.7 BAD_CREDIT BODY: Eliminate Bad Credit
0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
Subject: {SPAM?} did you
--000000000000e3b6b10659c2221c
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64
MSwyMDArIHNpbmdsZSBVa3JhaW5pYW4gd29tZW4gb25saW5lLiBUaGV5IG1ha2UgdGhlIGZpcnN0
IG1vdmUg4oCUIHlvdSBqdXN0ICANCmhhdmUgdG8gc2hvdyB1cC4NCg0KDQoNCg0KRGF0aW5nLCBi
dXQgYmFja3dhcmRzDQoNCkhlcmUsIHNoZSB3cml0ZXMgZmlyc3QuDQoNCjEsMjAwKyBzaW5nbGUg
VWtyYWluaWFuIHdvbWVuIGFyZSBvbmxpbmUgdG9uaWdodCDigJQgd2l0dHksIGRpcmVjdCwgYW5k
IHRpcmVkICANCm9mIHdhaXRpbmcgYXJvdW5kLg0KDQpNYWtlIGEgcHJvZmlsZSwgYW5kIHRoZSBm
cmllbmQgcmVxdWVzdHMgY29tZSB0byB5b3UuDQoNCg0KDQoNClNlZSB3aG8ncyBvbmxpbmUg4oaS
DQoNCg0KDQpGcmVlIHJlZ2lzdHJhdGlvbiDCtyBObyBjcmVkaXQgY2FyZCDCtyBObyBmYWtlIHBy
b2ZpbGVzDQoNCg0KDQpZb3UgYXJlIHJlY2VpdmluZyB0aGlzIG1lc3NhZ2UgYmVjYXVzZSB5b3Ug
b3B0ZWQgaW4gdG8gcmVjZWl2ZSBvZmZlcnMgZnJvbSAgDQpvbmUgb2Ygb3VyIG1hcmtldGluZyBw
YXJ0bmVycy4gU2VudCBieSBhbiBpbmRlcGVuZGVudCB0aGlyZC1wYXJ0eSBtYXJrZXRpbmcgIA0K
Y29tcGFueSwgbm90IHRoZSBhZHZlcnRpc2VyLiBNdXN0IGJlIDE4Ky4NClVuc3Vic2NyaWJlIMK3
IE9wdCBvdXQgb2YgYWxsIG1haWxpbmdzDQoNCg0KDQo=
--000000000000e3b6b10659c2221c
Content-Type: text/html; charset="UTF-8"
|
--000000000000e3b6b10659c2221c--
