Enence phish from Google Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 12 Jan 2026 06:23:00 -0700

Received: from 70.231.79.34.bc.googleusercontent.com ([34.79.231.70]:48034 helo=freenet-mobilfunk.de)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vfHsD-00000000NDe-1f1x

for dave@doctor.nl2k.ab.ca;

Mon, 12 Jan 2026 06:22:29 -0700

Received: by freenet-mobilfunk.de (Postfix, from userid 1000)

id 1962E369B14; Mon, 12 Jan 2026 13:21:27 +0000 (UTC)

To: dave@doctor.nl2k.ab.ca

From: "=?UTF-8?B?RW5lbmNl?="

Subject: =?UTF-8?B?UmVhbC10aW1lIHRyYW5zbGF0aW9uIGluIG92ZXIgNDAgbGFuZ3VhZ2Vz?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Message-Id: <20260112132127.1962E369B14@freenet-mobilfunk.de>

Date: Mon, 12 Jan 2026 13:21:27 +0000 (UTC)

X-Spam_score: 12.2

X-Spam_score_int: 122

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Things are always hectic. Learning languages is great —

but who has time for that?



Content analysis details: (12.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.79.231.70 listed in dnsbl.ahbl.org]

[34.79.231.70 listed in dnsbl.ahbl.org]

[34.79.231.70 listed in dnsbl.ahbl.org]

[34.79.231.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.79.231.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.79.231.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.79.231.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.79.231.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.79.231.70 listed in will-spam-for-food.eu.org]

[34.79.231.70 listed in will-spam-for-food.eu.org]

[34.79.231.70 listed in will-spam-for-food.eu.org]

[34.79.231.70 listed in will-spam-for-food.eu.org]

[34.79.231.70 listed in will-spam-for-food.eu.org]

[34.79.231.70 listed in will-spam-for-food.eu.org]

[34.79.231.70 listed in will-spam-for-food.eu.org]

[34.79.231.70 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.3 SPECIAL_OFFER BODY: Special Offer

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?UmVhbC10aW1lIHRyYW5zbGF0aW9uIGluIG92ZXIgNDAgbGFuZ3VhZ2Vz?=



PCFET0NUWVBFIGh0bWw+PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2

bWwiIHhtbG5zOm89InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgbGFu

Zz0iZW4iPjxoZWFkPjx0aXRsZT48L3RpdGxlPjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlw

ZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij48bWV0YSBuYW1lPSJ2aWV3cG9y

dCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLGluaXRpYWwtc2NhbGU9MSI+PCEtLVtpZiBt

c29dPgo8eG1sPjx3OldvcmREb2N1bWVudCB4bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQt

Y29tOm9mZmljZTp3b3JkIj48dzpEb250VXNlQWR2YW5jZWRUeXBvZ3JhcGh5UmVhZGluZ01haWwv

PjwvdzpXb3JkRG9jdW1lbnQ+CjxvOk9mZmljZURvY3VtZW50U2V0dGluZ3M+PG86UGl4ZWxzUGVy

SW5jaD45NjwvbzpQaXhlbHNQZXJJbmNoPjxvOkFsbG93UE5HLz48L286T2ZmaWNlRG9jdW1lbnRT

ZXR0aW5ncz48L3htbD4KPCFbZW5kaWZdLS0+PCEtLVtpZiAhbXNvXT48IS0tPjxsaW5rIGhyZWY9

Imh0dHBzOi8vZm9udHMuZ29vZ2xlYXBpcy5jb20vY3NzMj9mYW1pbHk9TW9udHNlcnJhdDp3Z2h0

QDEwMDs0MDA7NzAwOzkwMCZhbXA7ZGlzcGxheT1zd2FwIiByZWw9InN0eWxlc2hlZXQiIHR5cGU9

InRleHQvY3NzIj48IS0tPCFbZW5kaWZdLS0+PHN0eWxlPgoqe2JveC1zaXppbmc6Ym9yZGVyLWJv

eH1ib2R5e21hcmdpbjowO3BhZGRpbmc6MH1hW3gtYXBwbGUtZGF0YS1kZXRlY3RvcnNde2NvbG9y

OmluaGVyaXQhaW1wb3J0YW50O3RleHQtZGVjb3JhdGlvbjppbmhlcml0IWltcG9ydGFudH0jTWVz

c2FnZVZpZXdCb2R5IGF7Y29sb3I6aW5oZXJpdDt0ZXh0LWRlY29yYXRpb246bm9uZX1we2xpbmUt

aGVpZ2h0OmluaGVyaXR9LmRlc2t0b3BfaGlkZSwuZGVza3RvcF9oaWRlIHRhYmxle21zby1oaWRl

OmFsbDtkaXNwbGF5Om5vbmU7bWF4LWhlaWdodDowO292ZXJmbG93OmhpZGRlbn0uaW1hZ2VfYmxv

Y2sgaW1nK2RpdntkaXNwbGF5Om5vbmV9c3ViLHN1cHtmb250LXNpemU6NzUlO2xpbmUtaGVpZ2h0

OjB9IEBtZWRpYSAobWF4LXdpZHRoOjYyMHB4KXsubW9iaWxlX2hpZGV7ZGlzcGxheTpub25lfS5y

b3ctY29udGVudHt3aWR0aDoxMDAlIWltcG9ydGFudH0uc3RhY2sgLmNvbHVtbnt3aWR0aDoxMDAl

O2Rpc3BsYXk6YmxvY2t9Lm1vYmlsZV9oaWRle21pbi1oZWlnaHQ6MDttYXgtaGVpZ2h0OjA7bWF4

LXdpZHRoOjA7b3ZlcmZsb3c6aGlkZGVuO2ZvbnQtc2l6ZTowfS5kZXNrdG9wX2hpZGUsLmRlc2t0

b3BfaGlkZSB0YWJsZXtkaXNwbGF5OnRhYmxlIWltcG9ydGFudDttYXgtaGVpZ2h0Om5vbmUhaW1w

b3J0YW50fX0KPC9zdHlsZT48IS0tW2lmIG1zbyBdPjxzdHlsZT5zdXAsIHN1YiB7IGZvbnQtc2l6

ZTogMTAwJSAhaW1wb3J0YW50OyB9IHN1cCB7IG1zby10ZXh0LXJhaXNlOjEwJSB9IHN1YiB7IG1z

by10ZXh0LXJhaXNlOi0xMCUgfTwvc3R5bGU+IDwhW2VuZGlmXS0tPjwvaGVhZD48Ym9keSBjbGFz

cz0iYm9keSIgc3R5bGU9ImJhY2tncm91bmQtY29sb3I6I2ZmZjttYXJnaW46MDtwYWRkaW5nOjA7

LXdlYmtpdC10ZXh0LXNpemUtYWRqdXN0Om5vbmU7dGV4dC1zaXplLWFkanVzdDpub25lIj48dGFi

bGUgY2xhc3M9Im5sLWNvbnRhaW5lciIgd2lkdGg9IjEwMCUiIGJvcmRlcj0iMCIgY2VsbHBhZGRp

bmc9IjAiIGNlbGxzcGFjaW5nPSIwIiByb2xlPSJwcmVzZW50YXRpb24iIHN0eWxlPSJtc28tdGFi

bGUtbHNwYWNlOjA7bXNvLXRhYmxlLXJzcGFjZTowO2JhY2tncm91bmQtY29sb3I6I2ZmZiI+PHRi

b2R5Pjx0cj48dGQ+PHRhYmxlIGNsYXNzPSJyb3cgcm93LTEiIGFsaWduPSJjZW50ZXIiIAp3aWR0

aD0iMTAwJSIgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMCIgY2VsbHNwYWNpbmc9IjAiIHJvbGU9

InByZXNlbnRhdGlvbiIgc3R5bGU9Im1zby10YWJsZS1sc3BhY2U6MDttc28tdGFibGUtcnNwYWNl

OjAiPjx0Ym9keT48dHI+PHRkPjx0YWJsZSBjbGFzcz0icm93LWNvbnRlbnQgc3RhY2siIGFsaWdu

PSJjZW50ZXIiIGJvcmRlcj0iMCIgY2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIiByb2xl

PSJwcmVzZW50YXRpb24iIHN0eWxlPSJtc28tdGFibGUtbHNwYWNlOjA7bXNvLXRhYmxlLXJzcGFj

ZTowO2JvcmRlci1yYWRpdXM6MDtjb2xvcjojMDAwO3dpZHRoOjYwMHB4O21hcmdpbjowIGF1dG8i

IHdpZHRoPSI2MDAiPjx0Ym9keT48dHI+PHRkIGNsYXNzPSJjb2x1bW4gY29sdW1uLTEiIHdpZHRo

PSIxMDAlIiAKc3R5bGU9Im1zby10YWJsZS1sc3BhY2U6MDttc28tdGFibGUtcnNwYWNlOjA7Zm9u

dC13ZWlnaHQ6NDAwO3RleHQtYWxpZ246bGVmdDtwYWRkaW5nLWJvdHRvbTo1cHg7cGFkZGluZy10

b3A6NXB4O3ZlcnRpY2FsLWFsaWduOnRvcCI+PHRhYmxlIGNsYXNzPSJpbWFnZV9ibG9jayBibG9j

ay0xIiB3aWR0aD0iMTAwJSIgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMTUiIGNlbGxzcGFjaW5n

PSIwIiByb2xlPSJwcmVzZW50YXRpb24iIHN0eWxlPSJtc28tdGFibGUtbHNwYWNlOjA7bXNvLXRh

YmxlLXJzcGFjZTowIj48dHI+PHRkIGNsYXNzPSJwYWQiPjxkaXYgY2xhc3M9ImFsaWdubWVudCIg

YWxpZ249ImNlbnRlciI+PGRpdiBzdHlsZT0ibWF4LXdpZHRoOjE4MHB4Ij48YSBocmVmPSJodHRw

czovL3N0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vZWNmdnl6ZWZ6ZXl1ZmN1eXpmdXplY3Z6dXpldmN1

emZldWNmdXplY2cvZW5lY2hrdGdsaXNibWl0bHNva29sejdkaTU0ZHNjeGttN2diZi5odG1sIiB0

YXJnZXQ9Il9ibGFuayIgc3R5bGU9Im91dGxpbmU6bm9uZSIgdGFiaW5kZXg9Ii0xIj48aW1nIApz

cmM9Imh0dHBzOi8vZDE1azJkMTFyNnQ2cmwuY2xvdWRmcm9udC5uZXQvcHVibGljL3VzZXJzL0lu

dGVncmF0b3JzLzY2OWQ1NzEzLTliNmEtNDZiYi1iZDdlLWM1NDJjZmY2ZGQ2YS9lM2JmNTg3MTJi

NTc0ODcwOGY5M2MxYWQyODkwMTE0My9sb2dvLWVuZW5jZTItMy5wbmciIHN0eWxlPSJkaXNwbGF5

OmJsb2NrO2hlaWdodDphdXRvO2JvcmRlcjowO3dpZHRoOjEwMCUiIHdpZHRoPSIxODAiIGFsdCB0

aXRsZSBoZWlnaHQ9ImF1dG8iPjwvYT48L2Rpdj48L2Rpdj48L3RkPjwvdHI+PC90YWJsZT48L3Rk

PjwvdHI+PC90Ym9keT48L3RhYmxlPjwvdGQ+PC90cj48L3Rib2R5PjwvdGFibGU+PHRhYmxlIGNs

YXNzPSJyb3cgcm93LTIiIGFsaWduPSJjZW50ZXIiIHdpZHRoPSIxMDAlIiBib3JkZXI9IjAiIGNl

bGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgcm9sZT0icHJlc2VudGF0aW9uIiBzdHlsZT0i

bXNvLXRhYmxlLWxzcGFjZTowO21zby10YWJsZS1yc3BhY2U6MCI+Cjx0Ym9keT48dHI+PHRkPjx0

YWJsZSBjbGFzcz0icm93LWNvbnRlbnQgc3RhY2siIGFsaWduPSJjZW50ZXIiIGJvcmRlcj0iMCIg

Y2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIiByb2xlPSJwcmVzZW50YXRpb24iIHN0eWxl

PSJtc28tdGFibGUtbHNwYWNlOjA7bXNvLXRhYmxlLXJzcGFjZTowO2JhY2tncm91bmQtY29sb3I6

IzViMjk2MTtib3JkZXItcmFkaXVzOjA7Y29sb3I6IzAwMDt3aWR0aDo2MDBweDttYXJnaW46MCBh

dXRvIiB3aWR0aD0iNjAwIj48dGJvZHk+PHRyPjx0ZCBjbGFzcz0iY29sdW1uIGNvbHVtbi0xIiB3

aWR0aD0iMTAwJSIgc3R5bGU9Im1zby10YWJsZS1sc3BhY2U6MDttc28tdGFibGUtcnNwYWNlOjA7

Zm9udC13ZWlnaHQ6NDAwO3RleHQtYWxpZ246bGVmdDtwYWRkaW5nLWJvdHRvbTo1cHg7cGFkZGlu

Zy10b3A6NXB4O3ZlcnRpY2FsLWFsaWduOnRvcCI+PHRhYmxlIGNsYXNzPSJwYXJhZ3JhcGhfYmxv

Y2sgYmxvY2stMSIgd2lkdGg9IjEwMCUiIApib3JkZXI9IjAiIGNlbGxwYWRkaW5nPSIwIiBjZWxs

c3BhY2luZz0iMCIgcm9sZT0icHJlc2VudGF0aW9uIiBzdHlsZT0ibXNvLXRhYmxlLWxzcGFjZTow

O21zby10YWJsZS1yc3BhY2U6MDt3b3JkLWJyZWFrOmJyZWFrLXdvcmQiPjx0cj48dGQgY2xhc3M9

InBhZCIgc3R5bGU9InBhZGRpbmctYm90dG9tOjIwcHg7cGFkZGluZy1sZWZ0OjEwcHg7cGFkZGlu

Zy1yaWdodDoxMHB4O3BhZGRpbmctdG9wOjIwcHgiPjxkaXYgc3R5bGU9ImNvbG9yOiNmZmY7ZGly

ZWN0aW9uOmx0cjtmb250LWZhbWlseTpNb250c2VycmF0LCdUcmVidWNoZXQgTVMnLCdMdWNpZGEg

R3JhbmRlJywnTHVjaWRhIFNhbnMgVW5pY29kZScsJ0x1Y2lkYSBTYW5zJyxUYWhvbWEsc2Fucy1z

ZXJpZjtmb250LXNpemU6MjRweDtmb250LXdlaWdodDo0MDA7bGV0dGVyLXNwYWNpbmc6MDtsaW5l

LWhlaWdodDoxLjU7dGV4dC1hbGlnbjpjZW50ZXI7bXNvLWxpbmUtaGVpZ2h0LWFsdDozNnB4Ij48

cCAKc3R5bGU9Im1hcmdpbjowIj48c3Ryb25nPlRoaW5ncyBhcmUgYWx3YXlzIGhlY3RpYy48L3N0

cm9uZz48L3A+PC9kaXY+PC90ZD48L3RyPjwvdGFibGU+PC90ZD48L3RyPjwvdGJvZHk+PC90YWJs

ZT48L3RkPjwvdHI+PC90Ym9keT48L3RhYmxlPjx0YWJsZSBjbGFzcz0icm93IHJvdy0zIiBhbGln

bj0iY2VudGVyIiB3aWR0aD0iMTAwJSIgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMCIgY2VsbHNw

YWNpbmc9IjAiIHJvbGU9InByZXNlbnRhdGlvbiIgc3R5bGU9Im1zby10YWJsZS1sc3BhY2U6MDtt

F-Secure Phish from Google

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 12 Jan 2026 06:21:00 -0700

Received: from 158.27.148.146.bc.googleusercontent.com ([146.148.27.158]:33286 helo=freenet-mobilfunk.de)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vfHpr-00000000N6K-2PNy

for dave@doctor.nl2k.ab.ca;

Mon, 12 Jan 2026 06:20:06 -0700

Received: by freenet-mobilfunk.de (Postfix, from userid 1000)

id 3B76A369B22; Mon, 12 Jan 2026 13:19:02 +0000 (UTC)

To: dave@doctor.nl2k.ab.ca

From: "=?UTF-8?B?Ri1TZWN1cmUgRGVhbHM=?="

Subject: =?UTF-8?B?U2VjdXJlIFlvdXIgRGlnaXRhbCBMaWZlIHdpdGggRi1TZWN1cmU=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Message-Id: <20260112131902.3B76A369B22@freenet-mobilfunk.de>

Date: Mon, 12 Jan 2026 13:19:02 +0000 (UTC)

X-Spam_score: 12.9

X-Spam_score_int: 129

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Protect Your Digital Life with F-Secure Secure Your Digital

Life with F-Secure Exclusive Promotional Price — Limited Time Offer



Content analysis details: (12.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[146.148.27.158 listed in dnsbl.ahbl.org]

[146.148.27.158 listed in dnsbl.ahbl.org]

[146.148.27.158 listed in dnsbl.ahbl.org]

[146.148.27.158 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[146.148.27.158 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[146.148.27.158 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[146.148.27.158 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[146.148.27.158 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[146.148.27.158 listed in will-spam-for-food.eu.org]

[146.148.27.158 listed in will-spam-for-food.eu.org]

[146.148.27.158 listed in will-spam-for-food.eu.org]

[146.148.27.158 listed in will-spam-for-food.eu.org]

[146.148.27.158 listed in will-spam-for-food.eu.org]

[146.148.27.158 listed in will-spam-for-food.eu.org]

[146.148.27.158 listed in will-spam-for-food.eu.org]

[146.148.27.158 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.3 OFFER BODY: Offers you Something

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?U2VjdXJlIFlvdXIgRGlnaXRhbCBMaWZlIHdpdGggRi1TZWN1cmU=?=



PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CjxtZXRhIGNoYXJzZXQ9IlVU

Ri04Ij4KPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCxp

bml0aWFsLXNjYWxlPTEuMCI+Cjx0aXRsZT5Qcm90ZWN0IFlvdXIgRGlnaXRhbCBMaWZlIHdpdGgg

Ri1TZWN1cmU8L3RpdGxlPgo8c3R5bGU+CiAgYm9keSB7IG1hcmdpbjogMDsgcGFkZGluZzogMDsg

Zm9udC1mYW1pbHk6IEFyaWFsLCBzYW5zLXNlcmlmOyBiYWNrZ3JvdW5kLWNvbG9yOiAjZjRmNGY0

OyB9CiAgLmNvbnRhaW5lciB7IHdpZHRoOiAxMDAlOyBtYXgtd2lkdGg6IDYwMHB4OyBtYXJnaW46

IGF1dG87IGJhY2tncm91bmQtY29sb3I6ICNmZmZmZmY7IH0KICAuaGVhZGVyIHsgYmFja2dyb3Vu

ZC1jb2xvcjogIzAwMzM2NjsgcGFkZGluZzogMjBweDsgdGV4dC1hbGlnbjogY2VudGVyOyBjb2xv

cjogI2ZmZmZmZjsgfQogIC5oZWFkZXIgaDEgeyBtYXJnaW46IDA7IGZvbnQtc2l6ZTogMjRweDsg

fQogIC5oZXJvIHsgdGV4dC1hbGlnbjogY2VudGVyOyBwYWRkaW5nOiAyMHB4OyB9CiAgLmhlcm8g

aW1nIHsgbWF4LXdpZHRoOiAxMDAlOyBoZWlnaHQ6IGF1dG87IH0KICAuY29udGVudCB7IHBhZGRp

bmc6IDIwcHg7IGNvbG9yOiAjMzMzMzMzOyB9CiAgLmNvbnRlbnQgaDIgeyBmb250LXNpemU6IDIw

cHg7IG1hcmdpbi10b3A6IDA7IH0KICAuYnV0dG9uIHsgZGlzcGxheTogYmxvY2s7IHdpZHRoOiAx

MDAlOyB0ZXh0LWFsaWduOiBjZW50ZXI7IG1hcmdpbjogMjBweCAwOyB9CiAgLmJ0biB7IGJhY2tn

cm91bmQtY29sb3I6ICMwMDczZTY7IGNvbG9yOiAjZmZmZmZmOyB0ZXh0LWRlY29yYXRpb246IG5v

bmU7IHBhZGRpbmc6IDE1cHggMjVweDsgYm9yZGVyLXJhZGl1czogNXB4OyBmb250LXNpemU6IDE2

cHg7IH0KICAuZm9vdGVyIHsgZm9udC1zaXplOiAxMnB4OyBjb2xvcjogIzc3Nzc3NzsgdGV4dC1h

bGlnbjogY2VudGVyOyBwYWRkaW5nOiAyMHB4OyB9CiAgLmZvb3RlciBhIHsgY29sb3I6ICM3Nzc3

Nzc7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgfQo8L3N0eWxlPgo8L2hlYWQ+Cjxib2R5Pgo8dGFi

bGUgY2xhc3M9ImNvbnRhaW5lciIgY2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIj4KICA8

IS0tIEhFQURFUiAtLT4KICA8dHI+CiAgICA8dGQgY2xhc3M9ImhlYWRlciI+CiAgICAgIDxoMT5T

ZWN1cmUgWW91ciBEaWdpdGFsIExpZmUgd2l0aCBGLVNlY3VyZTwvaDE+CiAgICA8L3RkPgogIDwv

dHI+CgogIDwhLS0gSEVSTyBJTUFHRSAtLT4KICA8dHI+CiAgICA8dGQgY2xhc3M9Imhlcm8iPgog

ICAgICA8aW1nIHNyYz0iaHR0cHM6Ly9pLmd5YXpvLmNvbS85NTY5MzU3YTdjMmE2ZGM3OGVmZWM5

MmZlMTdkMGMxOS53ZWJwIiBhbHQ9IkYtU2VjdXJlIj4KICAgIDwvdGQ+CiAgPC90cj4KCiAgPCEt

LSBNQUlOIENPTlRFTlQgLS0+CiAgPHRyPgogICAgPHRkIGNsYXNzPSJjb250ZW50Ij4KICAgICAg

PGgyPkV4Y2x1c2l2ZSBQcm9tb3Rpb25hbCBQcmljZSDigJQgTGltaXRlZCBUaW1lIE9mZmVyPC9o

Mj4KICAgICAgPHA+U3RheSBzYWZlIG9ubGluZSB3aXRoIGF3YXJkLXdpbm5pbmcgcHJvdGVjdGlv

biBmcm9tIEYtU2VjdXJlLiBDb21wbGV0ZSBvbmxpbmUgc2VjdXJpdHksIHByaXZhY3kgcHJvdGVj

dGlvbiwgc2NhbSBhbmQgaWRlbnRpdHkgcHJvdGVjdGlvbiDigJQgYWxsIGluIG9uZSBwb3dlcmZ1

bCBzb2x1dGlvbi48L3A+CiAgICAgIDxwPlByb3RlY3QgeW91ciBjb21wdXRlcnMsIHBob25lcyBh

bmQgdGFibGV0cyBhbmQgZ2V0IHBlYWNlIG9mIG1pbmQga25vd2luZyB5b3VyIGRhdGEgYW5kIGlk

ZW50aXR5IGFyZSBzZWN1cmUuPC9wPgoKICAgICAgPHVsPgogICAgICAgIDxsaT5BZHZhbmNlZCBh

bnRpLXZpcnVzIGFuZCBtYWx3YXJlIHByb3RlY3Rpb248L2xpPgogICAgICAgIDxsaT5VbmxpbWl0

ZWQgVlBOIGZvciBwcml2YXRlIGJyb3dzaW5nPC9saT4KICAgICAgICA8bGk+RGFyayB3ZWIgbW9u

aXRvcmluZyBhbmQgaWRlbnRpdHkgcHJvdGVjdGlvbjwvbGk+CiAgICAgICAgPGxpPlNjYW0gcHJv

dGVjdGlvbiBmb3Igb25saW5lIGJhbmtpbmcgYW5kIHNob3BwaW5nPC9saT4KICAgICAgPC91bD4K

CiAgICAgIDxwIHN0eWxlPSJmb250LXNpemU6MThweDsgZm9udC13ZWlnaHQ6Ym9sZDsiPlNwZWNp

YWwgcHJvbW90aW9uYWwgcHJpY2luZyBhdmFpbGFibGUgbm93LiBEb27igJl0IG1pc3Mgb3V0ITwv

cD4KCiAgICAgIDxkaXYgY2xhc3M9ImJ1dHRvbiI+CiAgICAgICAgPGEgaHJlZj0iaHR0cHM6Ly9z

dG9yYWdlLmdvb2dsZWFwaXMuY29tL2RlYzhrbW5jNXNhZjJnYmM1NGttZ2g2a2xhZGN6NDNoL2Zz

ZWNoa3RnbGlzYm1pdGxzb2tvbHo3ZGk1NGRzY3hrbTdnYmYuaHRtbCIgY2xhc3M9ImJ0biIgdGFy

Z2V0PSJfYmxhbmsiPgogICAgICAgICAgR2V0IFRoaXMgRGVhbCBOb3cKICAgICAgICA8L2E+CiAg

ICAgIDwvZGl2PgoKICAgICAgPHA+SWYgeW914oCZcmUgbm90IHJlYWR5IHRvIGJ1eSB5ZXQsIHRy

eSBGLVNlY3VyZSByaXNrLWZyZWUgd2l0aCBhIDMwLWRheSBtb25leS1iYWNrIGd1YXJhbnRlZS48

L3A+CiAgICA8L3RkPgogIDwvdHI+CgogIDwhLS0gRk9PVEVSIC0tPgogIDx0cj4KICAgIDx0ZCBj

bGFzcz0iZm9vdGVyIj4KICAgICAgPHA+WW91IGFyZSByZWNlaXZpbmcgdGhpcyBlbWFpbCBiZWNh

dXNlIHlvdSBvcHRlZCBpbiB0byByZWNlaXZlIG9mZmVycyBmcm9tIHVzLjwvcD4KICAgICAgPHA+

PGEgaHJlZj0iVXNlIHlvdXIgb3duIFVuc3ViIGxpbmsiPlVuc3Vic2NyaWJlPC9hPiB8IDxhIGhy

ZWY9Imh0dHBzOi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9kZWM4a21uYzVzYWYyZ2JjNTRrbWdo

NmtsYWRjejQzaC9mc2VjaGt0Z2xpc2JtaXRsc29rb2x6N2RpNTRkc2N4a203Z2JmLmh0bWwiPk1h

bmFnZSBQcmVmZXJlbmNlczwvYT48L3A+CiAgICAgIDxwPkYtU2VjdXJlIHByb2R1Y3RzIGFyZSBz

dWJqZWN0IHRvIGF2YWlsYWJpbGl0eSBhbmQgcHJpY2luZyBtYXkgdmFyeSBieSByZWdpb24uIEFs

bCBwdXJjaGFzZXMgYXJlIHByb2Nlc3NlZCBzZWN1cmVseS48L3A+CiAgICA8L3RkPgogIDwvdHI+

CjwvdGFibGU+CjwvYm9keT4KPC9odG1sPg==



Performance Enhancer phish from Google

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 12 Jan 2026 06:04:00 -0700

Received: from 138.235.90.34.bc.googleusercontent.com ([34.90.235.138]:50706 helo=freenet-mobilfunk.de)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vfHa6-00000000MKI-1M2z

for dave@doctor.nl2k.ab.ca;

Mon, 12 Jan 2026 06:03:48 -0700

Received: by freenet-mobilfunk.de (Postfix, from userid 1000)

id F2157369B3A; Mon, 12 Jan 2026 13:02:44 +0000 (UTC)

To: dave@doctor.nl2k.ab.ca

From: "=?UTF-8?B?UGVyZm9ybWFuY2UgRW5oYW5jZXI=?="

Subject: =?UTF-8?B?VW5sZWE=?==?UTF-8?B?c2ggWW91ciBU?==?UTF-8?B?cnVlIFBvdGVudA==?==?UTF-8?B?aWFsIPCfmoA=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Message-Id: <20260112130244.F2157369B3A@freenet-mobilfunk.de>

Date: Mon, 12 Jan 2026 13:02:44 +0000 (UTC)

X-Spam_score: 11.9

X-Spam_score_int: 119

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: StratosBoost — Luxury Black & Gold Unleash Your True Potential

🚀



Content analysis details: (11.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.90.235.138 listed in dnsbl.ahbl.org]

[34.90.235.138 listed in dnsbl.ahbl.org]

[34.90.235.138 listed in dnsbl.ahbl.org]

[34.90.235.138 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.90.235.138 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.90.235.138 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.90.235.138 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.90.235.138 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.90.235.138 listed in will-spam-for-food.eu.org]

[34.90.235.138 listed in will-spam-for-food.eu.org]

[34.90.235.138 listed in will-spam-for-food.eu.org]

[34.90.235.138 listed in will-spam-for-food.eu.org]

[34.90.235.138 listed in will-spam-for-food.eu.org]

[34.90.235.138 listed in will-spam-for-food.eu.org]

[34.90.235.138 listed in will-spam-for-food.eu.org]

[34.90.235.138 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} =?UTF-8?B?VW5sZWE=?==?UTF-8?B?c2ggWW91ciBU?==?UTF-8?B?cnVlIFBvdGVudA==?==?UTF-8?B?aWFsIPCfmoA=?=



PCFkb2N0eXBlIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CjxtZXRhIGNoYXJzZXQ9InV0

Zi04Ij4KPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCxp

bml0aWFsLXNjYWxlPTEiPgo8dGl0bGU+U3RyYXRvc0Jvb3N0IOKAlCBMdXh1cnkgQmxhY2sgJiBH

b2xkPC90aXRsZT4KPHN0eWxlPgpodG1sLGJvZHl7aGVpZ2h0OjEwMCU7bWFyZ2luOjA7Zm9udC1m

YW1pbHk6IlBvcHBpbnMiLEFyaWFsLHNhbnMtc2VyaWY7YmFja2dyb3VuZDojMGUwZTBmO2NvbG9y

OiNmZmY7fQouY29udGFpbmVye21heC13aWR0aDo2ODBweDttYXJnaW46MjhweCBhdXRvO3BhZGRp

bmc6MjRweDtib3JkZXItcmFkaXVzOjEwcHg7YmFja2dyb3VuZDojMTYxNjE2O2JveC1zaGFkb3c6

MCAxMHB4IDQwcHggcmdiYSgyNTUsMjE1LDAsLjE1KTt9Ci5oZXJvLWltZ3t3aWR0aDoxMDAlO2hl

aWdodDphdXRvO2JvcmRlci1yYWRpdXM6OHB4O2Rpc3BsYXk6YmxvY2s7b2JqZWN0LWZpdDpjb3Zl

cjtib3gtc2hhZG93OjAgOHB4IDI0cHggcmdiYSgyNTUsMjE1LDAsLjA4KTt9Ci5jb250ZW50e3Bh

ZGRpbmc6MjRweCAxMHB4fQpoMXt0ZXh0LWFsaWduOmNlbnRlcjtjb2xvcjojZmZjYzMzO2ZvbnQt

c2l6ZToyNnB4O2ZvbnQtd2VpZ2h0OjcwMDttYXJnaW46OHB4IDAgMTJweH0KLmxlYWR7dGV4dC1h

bGlnbjpjZW50ZXI7Y29sb3I6I2NjYztmb250LXNpemU6MTVweDtsaW5lLWhlaWdodDoxLjY7bWFy

Z2luLWJvdHRvbToxOHB4fQouYnRue2Rpc3BsYXk6aW5saW5lLWJsb2NrO2JhY2tncm91bmQ6bGlu

ZWFyLWdyYWRpZW50KDEzNWRlZywjZmZjYzMzLCNkMWEwMDApO2NvbG9yOiMwMDA7cGFkZGluZzox

NHB4IDIycHg7Ym9yZGVyLXJhZGl1czo2cHg7Zm9udC13ZWlnaHQ6NzAwO3RleHQtZGVjb3JhdGlv

bjpub25lO3RleHQtdHJhbnNmb3JtOnVwcGVyY2FzZTtib3gtc2hhZG93OjAgOHB4IDI1cHggcmdi

YSgyNTUsMjA0LDUxLC4zKTt9Ci5mZWF0dXJlc3tkaXNwbGF5OmZsZXg7ZmxleC13cmFwOndyYXA7

Z2FwOjEycHg7anVzdGlmeS1jb250ZW50OmNlbnRlcjttYXJnaW4tdG9wOjE2cHh9Ci5jaGVja3ti

YWNrZ3JvdW5kOiNmZmNjMzM7Y29sb3I6IzAwMDt3aWR0aDoyMHB4O2hlaWdodDoyMHB4O2JvcmRl

ci1yYWRpdXM6NTAlO2Rpc3BsYXk6ZmxleDthbGlnbi1pdGVtczpjZW50ZXI7anVzdGlmeS1jb250

ZW50OmNlbnRlcjtmb250LXNpemU6MTNweDtmb250LXdlaWdodDo4MDB9Ci5mZWF0IHB7Y29sb3I6

I2UwZTBlMDtmb250LXNpemU6MTRweDttYXJnaW46MH0KLnBpbGx7bWFyZ2luOjIwcHggYXV0byA2

cHg7bWF4LXdpZHRoOjUyMHB4O2JhY2tncm91bmQ6IzI4MjAwMDtjb2xvcjojZmZjYzMzO3BhZGRp

bmc6MTJweCAxNHB4O2JvcmRlci1yYWRpdXM6NnB4O3RleHQtYWxpZ246Y2VudGVyO2ZvbnQtd2Vp

Z2h0OjYwMDtib3gtc2hhZG93OjAgNnB4IDE2cHggcmdiYSgyNTUsMjA0LDUxLC4xKTt9Ci5mb290

ZXJ7Y29sb3I6Izg4ODt0ZXh0LWFsaWduOmNlbnRlcjtmb250LXNpemU6MTJweDttYXJnaW4tdG9w

OjIwcHh9Ci51bnN1YnNjcmliZXtjb2xvcjojYWFhO3RleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmV9

Cjwvc3R5bGU+CjwvaGVhZD4KPGJvZHk+CjxkaXYgY2xhc3M9ImNvbnRhaW5lciI+CjxpbWcgY2xh

c3M9Imhlcm8taW1nIiBzcmM9Imh0dHBzOi8vaS5neWF6by5jb20vNDc4ZDRlYjZmZjZiMmQ1YzJh

MTBhYzFlOTYwZDczN2IucG5nIiBhbHQ9IlN0cmF0b3NCb29zdCBwcm9kdWN0Ij4KPGRpdiBjbGFz

cz0iY29udGVudCI+CjxoMT5VbmxlYXNoIFlvdXIgVHJ1ZSBQb3RlbnRpYWwg8J+agDwvaDE+Cjxw

IGNsYXNzPSJsZWFkIj5TdHJhdG9zQm9vc3QgZnVlbHMgeW91ciBlbmVyZ3ksIGZvY3VzICYgcGVy

Zm9ybWFuY2Ug4oCUIHRydXN0ZWQgYnkgZXhwZXJ0cyBhbmQgYmFja2VkIGJ5IHNjaWVuY2UuPC9w

Pgo8cCBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPjxhIGNsYXNzPSJidG4iIGhyZWY9Imh0dHBz

Oi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9iYWwwMmZ2eG5zNjRram41OGIxNmZkdnhzNzhrai9z

dHJhb3NibWl0bHNva29sejdkaTU0ZHNjeGttN2diZi5odG1sIj5DbGFpbSBZb3VyIFN0cmF0b3NC

b29zdCBOb3c8L2E+PC9wPgo8ZGl2IGNsYXNzPSJmZWF0dXJlcyI+CjxkaXYgY2xhc3M9ImZlYXQi

PjxkaXYgY2xhc3M9ImNoZWNrIj7inJM8L2Rpdj48cD5GYXN0LWFjdGluZyBuYXR1cmFsIGZvcm11

bGE8L3A+PC9kaXY+CjxkaXYgY2xhc3M9ImZlYXQiPjxkaXYgY2xhc3M9ImNoZWNrIj7inJM8L2Rp

dj48cD5CYWNrZWQgYnkgZXhwZXJ0czwvcD48L2Rpdj4KPGRpdiBjbGFzcz0iZmVhdCI+PGRpdiBj

bGFzcz0iY2hlY2siPuKckzwvZGl2PjxwPkVuZXJneSAmIHN0YW1pbmEgc3VwcG9ydDwvcD48L2Rp

dj4KPGRpdiBjbGFzcz0iZmVhdCI+PGRpdiBjbGFzcz0iY2hlY2siPuKckzwvZGl2PjxwPkVhc3kg

ZGFpbHkgdXNlPC9wPjwvZGl2Pgo8ZGl2IGNsYXNzPSJmZWF0Ij48ZGl2IGNsYXNzPSJjaGVjayI+

4pyTPC9kaXY+PHA+TWVudGFsIGZvY3VzIGJvb3N0PC9wPjwvZGl2Pgo8ZGl2IGNsYXNzPSJmZWF0

Ij48ZGl2IGNsYXNzPSJjaGVjayI+4pyTPC9kaXY+PHA+MTAwJSBzYXRpc2ZhY3Rpb24gZ3VhcmFu

dGVlPC9wPjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0icGlsbCI+4pqhIExpbWl0ZWQgc3RvY2sg

YXZhaWxhYmxlIOKAlCBvcmRlciB0b2RheSBiZWZvcmUgaXQncyBnb25lITwvZGl2Pgo8ZGl2IGNs

YXNzPSJmb290ZXIiPgo8cD5Zb3UgcmVjZWl2ZWQgdGhpcyBlbWFpbCBiZWNhdXNlIHlvdSBzdWJz

Y3JpYmVkIHRvIFN0cmF0b3NCb29zdCBvZmZlcnMuPC9wPgo8cD48YSBjbGFzcz0idW5zdWJzY3Jp

YmUiIGhyZWY9Imh0dHBzOi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9mYXRrbW5zLTYya21uZmct

ZnY2c25jOC1qbWRuc2V0L3N0cmFvc2JtaXRsc29rb2x6N2RpNTRkc2N4a203Z2JmLmh0bWwiPlVu

c3Vic2NyaWJlPC9hPjwvcD4KPC9kaXY+CjwvZGl2PjwvZGl2Pgo8L2JvZHk+CjwvaHRtbD4=



Nigerian spam from Google Gmail PaRT 2



--000000000000a1c2f606482cb959

Content-Type: text/plain; charset="UTF-8"



1 Lothbury, London EC2R 7DB

United Kingdom,

Good day ,

ZHOU XIN is my name with the Bank of China. I want to partner with you to

transfer funds into our account for investment.

Please state your direct phone number and full names in your reply so that

we can discuss benefits and process.

I await your reply on your willingness to partner with me .

PLEASE REPLY TO MY PRIVATE EMAIL :: xinzhouuk@aol.com

Yours sincerely

ZHOU XIN



--000000000000a1c2f606482cb959

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




t;,Helvetica,Arial,sans-serif">1 Lothbury, London EC2R 7DB


=3D"font-family:Roboto,"Helvetica Neue",Helvetica,Arial,sans-seri=

f">
rial,sans-serif">United Kingdom,


t;Helvetica Neue",Helvetica,Arial,sans-serif">
ly:Roboto,"Helvetica Neue",Helvetica,Arial,sans-serif">Good day=

=C2=A0

elvetica,Arial,sans-serif">,


lvetica Neue",Helvetica,Arial,sans-serif">
oboto,"Helvetica Neue",Helvetica,Arial,sans-serif">ZHOU XIN is my=

name with the Bank of China. I want to partner with you to transfer funds =

into our account for investment.


t;Helvetica Neue",Helvetica,Arial,sans-serif">
ly:Roboto,"Helvetica Neue",Helvetica,Arial,sans-serif">Please sta=

te your direct phone number and full names in your reply so that we can dis=

cuss benefits and process.


etica Neue",Helvetica,Arial,sans-serif">
oto,"Helvetica Neue",Helvetica,Arial,sans-serif">I await your rep=

ly on your willingness to partner with me .


Roboto,"Helvetica Neue",Helvetica,Arial,sans-serif">
=3D"font-family:Roboto,"Helvetica Neue",Helvetica,Arial,sans-seri=

f">PLEASE REPLY TO MY PRIVATE EMAIL ::=C2=A0

uuk@aol.com" target=3D"_blank" style=3D"font-family:Roboto,"Helvetica =

Neue",Helvetica,Arial,sans-serif">xinzhouuk@aol.com


nt-family:Roboto,"Helvetica Neue",Helvetica,Arial,sans-serif">
an style=3D"font-family:Roboto,"Helvetica Neue",Helvetica,Arial,s=

ans-serif">Yours sincerely

etica Neue",Helvetica,Arial,sans-serif">
oto,"Helvetica Neue",Helvetica,Arial,sans-serif">ZHOU XIN
<=

/div>



--000000000000a1c2f606482cb959--

Nigerian spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 12 Jan 2026 07:53:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vfJHb-000000006uF-2WgH

for dave@doctor.nl2k.ab.ca;

Mon, 12 Jan 2026 07:52:39 -0700

Resent-From: The Doctor

Resent-Date: Mon, 12 Jan 2026 07:52:39 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f68.google.com ([209.85.217.68]:47353)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vfDNE-000000009ka-3blF

for doctor@doctor.nl2k.ab.ca;

Mon, 12 Jan 2026 01:34:15 -0700

Received: by mail-vs1-f68.google.com with SMTP id ada2fe7eead31-5ef2561e395so2064276137.2

for ; Mon, 12 Jan 2026 00:33:17 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1768206790; x=1768811590; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=C2dU0yTZI7I2ilWy2IqBs0TB0FRAsoWqxDG3h/QuvFY=;

b=Gom45vHWF8Kl+1MFjJNWTKkcS3EuyzZYKqpSb+wmMUR8sUBeD52C7CbjIhzoR4UMOG

zvevDHbAc1a7pwuZNNmexDJYSyW/+sMdJqp21ziwxd2YDjB/aaS4F4621Bj1a09R1pl0

GRz49QwCNZ9hiJSChToRFyHHZXZCE3HtHIZaavv2LyGtC6M4v4BZ4ZV5PIBh8iTY3vsT

imgwO7FrrOm/4JB1Es+mNIv7Dj0CaljUlXoN45olhBliN3Sa5gLWGWhU/kBzj6nXAHYr

qGDxNMAVwXkhcq5+vS4HCGVS7OZeCTiFiYdsLHU0rL4RZuPnVHzW8laCDtMiBWqCDvWE

ggPQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1768206790; x=1768811590;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=C2dU0yTZI7I2ilWy2IqBs0TB0FRAsoWqxDG3h/QuvFY=;

b=JSUfmqxo1hWN0UwpaWK+OEyVU4iUqBiZxU/wl5t9MNrM7PvLhf52Pr2/F630Ud1d2A

T5iDNP/nlSjMO6IlGqC2XdRPUmAaUTuhXVcWKN2jRY1LQfCPL9bKeHM6w4r0CLzCEnNe

P4fbyQhHeGUTkbVAqrnXCi1n4SkT+lMEU+eU1ZvkUViivpmnFZLE0rkAg10iw9wwqVOv

WbedXIL6PY6Tz+r/L1veojVTX/a7GWhy2xWSux2+qPTcaAMawZ1N1XJ7MUEl0h7qKj0G

Lq6JfObw2WvDZQvcTElgj4BCprp/2hMBzfmW5kuW+17uK9xZ6sR2ywYMONskLyuoAENd

SVrg==

X-Forwarded-Encrypted: i=1; AJvYcCXttUqSM2Tr3Hm11qVulA0ORzfvgb21HOD1LZSpbzu+gSzq31kd04FNXegLL547dyeCdeY8poo=@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YxrTYKpNUPeaLnRZWRAUpk0GGsaQQ/8UKt9fW7/L57HmKchLWM5

8cjc3J8LIUhCan0+zKNJn0Mgfw0umfDN9wuKvg8BUGjPH9b63ssaljnkTiKvI9qf2+fQd8ozkKy

6AZ4YtwXBLNitZu32np220heaVDbVSGk=

X-Gm-Gg: AY/fxX7pgpeeF52CJLCIFhptwGuP2FDBrcxNujN9UeGPqyeE5Dvs1UgtygKz8nhnw6P

HjE4mBhmGXtZkcq/jXjuqDztTDzP1J4BvKRNrEUvHzSE7PifVObkz9NsSxjzPHiJE/dGGB4wag6

DigAYwMKYcAZRjYqq+50mIxp1KP6sei9SRRhUOt0CemU9E2MnCUFWqHPuADmiFpOisTBnn4E+QK

uhWVWgg4vPCmAHCSWQV4AUmrzOy+5fC2Zs+jzYY7d1EDrDOKvW2yi02rlx7q2LTuZ+OpAGsK7nU

tlcxBvKiKd88EzRXeNYc15gFcq0OsO/RDQ==

X-Google-Smtp-Source: AGHT+IEnqpQsZ+spKc1sLxXJN/12Pztpr5yYFYUCoFxvQoNHVFgeexILuSvrY51Tw7yMzGrHFflVoLKdtLhR6qS36vY=

X-Received: by 2002:a05:6102:5ccb:b0:5dd:b61a:a9c5 with SMTP id

ada2fe7eead31-5ecb062b3e1mr7272732137.0.1768206790409; Mon, 12 Jan 2026

00:33:10 -0800 (PST)

MIME-Version: 1.0

Reply-To: mtsolicitorsp1@gmail.com

From: BANK OF CHINA

Date: Mon, 12 Jan 2026 08:32:56 +0000

X-Gm-Features: AZwV_Qh8b8sRMhSDglfeWRZsqy70wFFKHsjU6jXp8cyh_xIB1rRXPMg97JSIpYU

Message-ID:

Subject: HAPPY NEW YEAR /INVESTMENT OFFER

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000a1c2f606482cb959"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 15.1

X-Spam_score_int: 151

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 1 Lothbury, London EC2R 7DB United Kingdom, Good day , ZHOU

XIN is my name with the Bank of China. I want to partner with you to transfer

funds into our account for investment. Please state your direc [...]



Content analysis details: (15.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.217.68 listed in dnsbl.ahbl.org]

[209.85.217.68 listed in dnsbl.ahbl.org]

[209.85.217.68 listed in dnsbl.ahbl.org]

[209.85.217.68 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.217.68 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.217.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.217.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.217.68 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.217.68 listed in will-spam-for-food.eu.org]

[209.85.217.68 listed in will-spam-for-food.eu.org]

[209.85.217.68 listed in will-spam-for-food.eu.org]

[209.85.217.68 listed in will-spam-for-food.eu.org]

[209.85.217.68 listed in will-spam-for-food.eu.org]

[209.85.217.68 listed in will-spam-for-food.eu.org]

[209.85.217.68 listed in will-spam-for-food.eu.org]

[209.85.217.68 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.217.68 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.68 listed in wl.mailspike.net]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[mtsolicitorsp1(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[mtsolicitorsp1(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[mtsolicitorsp1(at)gmail.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} HAPPY NEW YEAR /INVESTMENT OFFER

AI puppy robot phish part 3







A Futuristic Puppy That Adores You





Over 67% of families want a pet, but many worry about allergies, mess, or responsibility.

Wuffy solves this by bringing the joy of a real puppy into your home –

without the challenges.







30-Day Money-Back Guarantee




Try Wuffy at home. If your child doesn't fall in love, simply return it within 30 days

for a full refund. No questions asked.

















Real Families. Real Joy. 4.7 / 5



Over 1,400+ reviews – 97% of parents would recommend Wuffy to a friend.







Gemma B.


Verified Customer – 18 days ago


★★★★★




"I bought this for my niece's 7th birthday, thought it'd just be some fun gadget but she

literally screamed when she opened it! She named it 'Cupcake' right away and now

takes it everywhere. It barks when she pets it and she's obsessed – best gift I've ever given."









Melinda


★★★★★




"We love Wuffy!!! We got it for our toddler daughter and even we love to play with it.

It acts like a real puppy and the laughter we get from her is worth so much more than the price."









Carla


★★★★★




"Didn't expect it to be this interactive – it seriously reacts to you and doesn't just bark.

It walks, plays, and feels like a real little companion. Amazing!"

















Limited-Time Offer: GET -70% Discount




In stock and ready to ship. Don't miss the chance to give your child a best friend they'll never forget.









Get Wuffy Now & Save 70%







*Offer valid while stocks last.























.cta-button {

display: inline-block;

background-color: #ff6a3d;

color: #ffffff !important;

padding: 12px 28px;

border-radius: 999px;

font-size: 15px;

font-weight: bold;

text-transform: uppercase;

letter-spacing: 0.5px;

}

.cta-button:hover {

opacity: 0.9;

}

.guarantee-box {

margin: 15px 0;

padding: 10px 12px;

border-radius: 8px;

background-color: #fdf5e6;

border: 1px solid #f2d39e;

font-size: 13px;

}

.guarantee-title {

font-weight: bold;

color: #8b5a1e;

margin-bottom: 4px;

}

.review-box {

margin: 12px 0;

padding: 10px 12px;

border-radius: 8px;

background-color: #f4f7ff;

border: 1px solid #d4ddff;

font-size: 13px;

}

.review-name {

font-weight: bold;

color: #2b2a5a;

margin-bottom: 2px;

}

.review-meta {

color: #888;

font-size: 11px;

margin-bottom: 5px;

}

.stars {

color: #ffb347;

font-size: 13px;

margin-bottom: 4px;

}

.footer {

width: 100%;

max-width: 600px;

margin: 12px auto 0;

font-size: 11px;

color: #777777;

text-align: center;

}

.footer a {

color: #777777;

text-decoration: underline;

}

@media only screen and (max-width: 620px) {

.content {

padding: 18px 16px 6px;

}

.cta-section {

padding: 12px 16px 16px;

}

}



























































AI puppy robot phish part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 11 Jan 2026 18:54:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vf77E-00000000Anq-3eeH

for dave@doctor.nl2k.ab.ca;

Sun, 11 Jan 2026 18:53:08 -0700

Resent-From: The Doctor

Resent-Date: Sun, 11 Jan 2026 18:53:08 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [147.45.50.200] (port=58503 helo=solaceteletherapy.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

id 1vf3NB-00000000LKp-2FoP

for sales@netknow.ca;

Sun, 11 Jan 2026 14:53:28 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=netknow.ca;

h=Date:Message-Id:To:From:Subject:Content-Type:Mime-Version:

Content-Transfer-Encoding; i=sales@netknow.ca;

bh=nme0bSgEnnm+kb0kg+c6zI28uQg=;

b=Bof9Z0NjkzSnqpLv1Y1Y6/uvQmx/4kJuBxXEhVTSFfEpc8U666Jg0TulDjw8uGkhp1WSIsS/j3u3

Ofv3+uuHfKz6oVzpzgERAs/Lz+54JvUhLQGzvsa4VkjHDiCjG4MFwzfxmlwRlFeVl6X5jJ2Tt7Uj

bdIdSZjzBx8XAElfTuc=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=netknow.ca;

b=AnVrTcyiHYCetf8BGp/vxr8Ytm/9YtITRiJflYQ6KDPPeMKGIndwQbktnhIt/vOxv+/O5pamqUQ1

z8axjNigUaxfl7HyxMAQf+Z1ppHKcoCrYcRGlNb1wuldzFPMrJBceI/kdoZEMdU+b3HQvqkMzbDD

oDqZjTB8x/CIgvtuSFg=;

Date: Sun, 11 Jan 2026 21:52:33 +0000

Message-Id: <797224537056678.2.ZLB2101528018@solaceteletherapy.com>

To: sales@netknow.ca

From: Natural Balance Coach

Subject: Say Goodbye to Old Habits – Hello Energy

Content-Type: text/html; charset="UTF-8"

Mime-Version: 1.0

Content-Transfer-Encoding: 8bit

X-Spam_score: 13.9

X-Spam_score_int: 139

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Meet Wuffy – Your Child's New Best Friend Your Child's

New Best Friend: Wuffy



Content analysis details: (13.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[147.45.50.200 listed in dnsbl.ahbl.org]

[147.45.50.200 listed in dnsbl.ahbl.org]

[147.45.50.200 listed in dnsbl.ahbl.org]

[147.45.50.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[147.45.50.200 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[147.45.50.200 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[147.45.50.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[147.45.50.200 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[147.45.50.200 listed in will-spam-for-food.eu.org]

[147.45.50.200 listed in will-spam-for-food.eu.org]

[147.45.50.200 listed in will-spam-for-food.eu.org]

[147.45.50.200 listed in will-spam-for-food.eu.org]

[147.45.50.200 listed in will-spam-for-food.eu.org]

[147.45.50.200 listed in will-spam-for-food.eu.org]

[147.45.50.200 listed in will-spam-for-food.eu.org]

[147.45.50.200 listed in will-spam-for-food.eu.org]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: leaadpersons.com]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: 89.185.80.148]

0.3 OFFER_2 BODY: Offers you Something (2)

1.0 SAVE_PERCENT BODY: Save some percentage

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.3 MIME_8BIT_HEADER Message header contains 8-bit character

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

1.8 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

Subject: {SPAM?} Say Goodbye to Old Habits – Hello Energy











Meet Wuffy – Your Child's New Best Friend















Slim, secure, and built to last—get 75% OFF CardShield today.





















































































RFID-Blocking Protection — CardShield







11K+ Happy Customers · Rated 4.7/5





"Front-pocket comfort, zero bulk, and real peace of mind." — Peter R.














style="display:inline-block; background:#10b981; border:1px solid #34d399; color:#0b1222; font-family:Arial, Helvetica, sans-serif; font-weight:bold; font-size:15px; line-height:44px; height:44px; padding:0 20px; border-radius:8px; text-align:center;">

Secure Yours Now







Limited-time offer. While supplies last.



















You received this email because you subscribed to CardShield updates.




Unsubscribe

 | 

Shop CardShield



















shielding credit card phish part 3









Slim, secure, and built to last—get 75% OFF CardShield today.