CAA phish Part 3

Posted by Dave Yadallee on





































































































































































































































































































































































































































w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">=0D=0A=0D=0A
charset=3D"UTF-8">=0D=0A=0D=

=0A
=3D"1">=0D=0A=

=0D=0A=0D=0A=0D=0A=0D=0A=0D=0A=

=0D=0A=0D=0A=0D=0A=0D=0A=

=0D=0A
Arial, "Helvetica Neue", Helvetica, sans-serif; font-size: 16px; =

background-color: #e8e9eb;" eo-background=3D"" class=3D"">=0D=0A

=3D"color:transparent;visibility:hidden;opacity:0;font-size:0px;border:0;ma=

x-height:1px;width:1px;margin:0px;padding:0px;border-width:0px!important;di=

splay:none!important;line-height:0px!important;">
"1" height=3D"1" src=3D"https://sptr.eocampaign1.com/q/1VLWBuyPj7xLPARbzvU8=

uw~~/AAAHUQA~/RgRooWqEPVcFc3BjZXVCCma8hOW-Zsbpb9lSFmpvZS53YWtlcnNlbkB5YWhvb=

y5jb21YBAAAjw0~" alt=3D""/>
=0D=0A=0D=0A

CAA phish Part 2

Posted by Dave Yadallee on
Read them right here! =0D=0A=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=

=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=

=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=

=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=

=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=

=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=C2=A0=E2=80=8C=C2=A0=E2=

=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=

=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=

=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=

=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=

=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=0D=

=0A=0D=0A=0D=0AREAD YOUR LATEST EDITIONS HERE=0D=0AFremantle Herald [1]=0D=

=0AMelville Herald [2]=0D=0ACockburn Herald [3]=0D=0APerth Voice [4] =0D=0A=

=0D=0A =09=09 [1] =0D=0A=0D=0AClick the cover to read your latest edition! =

=0D=0A=0D=0A =09=09 [5] =0D=0A=0D=0AADVERTISEMENT: Click to find out more a=

bout Indian Ocean Experiences.=0D=0AWOULD YOU LIKE THIS SPACE TO PROMOTE YO=

UR BUSINESS=3F=C2=A0=0D=0AEmail matt.eeles@fremantleherald.com to find out =

how.=C2=A0 =0D=0A=0D=0A =09=09 [4] =0D=0A=0D=0AClick the cover to read your=

latest edition! =0D=0A=0D=0AYOUR FAMILY-OWNED, INDEPENDENT NEWSPAPER SINCE=

=C2=A01989!=0D=0A=0D=0ANEWSPAPER HOUSE=0D=0A37-45 Cliff Street,=C2=A0Freman=

tle WA 6160=0D=0APOSTAL: PO Box 85=C2=A0North Fremantle, WA 6159=0D=0A=0D=

=0AEDITOR / CHIEF OF STAFF: Steve Grant=C2=A0=0D=0Anews@fremantleherald.com=

=C2=A0OR news@perthvoice.com=0D=0A=0D=0AADVERTISING DIRECTOR: Matt Eeles=0D=

=0Amatt.eeles@fremantleherald.com=0D=0A=0D=0AGET PAID TO GET FIT!=0D=0ABeco=

me a Herald and Perth Voice distributor today!=C2=A0=0D=0ADISTRIBUTION =

MANAGER: Stephanie Campbell=0D=0Adistribution.manager@fremantleherald.com =

=0D=0A=0D=0A=09=09 [facebook social link] [6] =0D=0A=0D=0AYou received this=

email because you subscribed to our list. You can=0D=0Aunsubscribe [7] at =

any time. =0D=0A=0D=0A45 Cliff Streey=0D=0AFremantle=0D=0AWA=0D=0A6160=0D=

=0AAustralia =0D=0A=0D=0A =09=09 [Powered by EmailOctopus] [8] =0D=0A=0D=0A=

=0D=0A=0D=0ALinks:=0D=0A------=0D=0A[1] https://sptr.eocampaign1.com/f/a/R=

u2hjpNSzp93WN3I6THWpw~~/AAAHUQA~/RgRooWqEP0RKaHR0cHM6Ly9oZXJhbGRvbmxpbmVqb3=

VybmFsLmNvbS93cC1jb250ZW50L3VwbG9hZHMvMjAyNC8wOC9mcmVtYW50bGUtMS5wZGZXBXNwY=

2V1QgpmvITlvmbG6W_ZUhZqb2Uud2FrZXJzZW5AeWFob28uY29tWAQAAI8N=0D=0A[2] https:=

//sptr.eocampaign1.com/f/a/-i8doz6OqBiT1Cy67TO-9A~~/AAAHUQA~/RgRooWqEP0RJaH=

R0cHM6Ly9oZXJhbGRvbmxpbmVqb3VybmFsLmNvbS93cC1jb250ZW50L3VwbG9hZHMvMjAyNC8wO=

C9tZWx2aWxsZS0xLnBkZlcFc3BjZXVCCma8hOW-Zsbpb9lSFmpvZS53YWtlcnNlbkB5YWhvby5j=

b21YBAAAjw0~=0D=0A[3] https://sptr.eocampaign1.com/f/a/X9opIFrgtp9ZmDjO09RB=

Zw~~/AAAHUQA~/RgRooWqEP0RJaHR0cHM6Ly9oZXJhbGRvbmxpbmVqb3VybmFsLmNvbS93cC1jb=

250ZW50L3VwbG9hZHMvMjAyNC8wOC9jb2NrYnVybi0xLnBkZlcFc3BjZXVCCma8hOW-Zsbpb9lS=

FmpvZS53YWtlcnNlbkB5YWhvby5jb21YBAAAjw0~=0D=0A[4] https://sptr.eocampaign1.=

com/f/a/bu3hc3F-pnRqZK9zUmA3MQ~~/AAAHUQA~/RgRooWqEP0RGaHR0cHM6Ly9oZXJhbGRvb=

mxpbmVqb3VybmFsLmNvbS93cC1jb250ZW50L3VwbG9hZHMvMjAyNC8wOC92b2ljZS0xLnBkZlcF=

c3BjZXVCCma8hOW-Zsbpb9lSFmpvZS53YWtlcnNlbkB5YWhvby5jb21YBAAAjw0~=0D=0A[5] h=

ttps://sptr.eocampaign1.com/f/a/8uKtv3WMCgvDTJE48QQcBw~~/AAAHUQA~/RgRooWqEP=

0QpaHR0cHM6Ly93d3cuaW5kaWFub2NlYW5leHBlcmllbmNlcy5jb20uYXVXBXNwY2V1QgpmvITl=

vmbG6W_ZUhZqb2Uud2FrZXJzZW5AeWFob28uY29tWAQAAI8N=0D=0A[6] https://sptr.eoca=

mpaign1.com/f/a/L17SSwFTO6DaHaErEa37zQ~~/AAAHUQA~/RgRooWqEP0QoaHR0cHM6Ly93d=

3cuZmFjZWJvb2suY29tL0ZyZW1hbnRsZUhlcmFsZFcFc3BjZXVCCma8hOW-Zsbpb9lSFmpvZS53=

YWtlcnNlbkB5YWhvby5jb21YBAAAjw0~=0D=0A[7] https://sptr.eocampaign1.com/f/a/=

Cs3eyrEdTDokc0BtjzqeuQ~~/AAAHUQA~/RgRooWqEP4QWAWh0dHBzOi8vYmFsYm9haS5lb2Nhb=

XBhaWduMS5jb20vdW5zdWJzY3JpYmU_ZXA9MiZsPTg3NGQ0MGIyLTM3NjUtMTFlZi1hNzhiLWZi=

M2FhZmEzNzUwYiZsYz02NTlkMTM2OC01M2JhLTExZWYtYjA2Ny1jZGY2MzIyMzI3N2ImcD0yNDc=

1YWIyZS01YjkwLTExZWYtYTRmYi1iMTg4OGQ3YjczYjYmcHQ9Y2FtcGFpZ24mcHY9NCZzcGE9MT=

cyMzc4NjUwMiZ0PTE3MjM3ODY2Mjgmcz05ZThjM2MxNGY5ZTljZjIyM2E5YzllZDRjOTUzZDMwY=

Tg3ZmQ3NzUxMDdlNWVjOGQ1NjFjZTAxY2U2MmJjNjE5VwVzcGNldUIKZryE5b5mxulv2VIWam9l=

Lndha2Vyc2VuQHlhaG9vLmNvbVgEAACPDQ~~=0D=0A[8] https://sptr.eocampaign1.com/=

f/a/jKODJ7fTdcNn5JOzxbkCmw~~/AAAHUQA~/RgRooWqEP0TSaHR0cHM6Ly9iYWxib2FpLmVvY=

2FtcGFpZ24xLmNvbS9yZXdhcmRzP2xjPTY1OWQxMzY4LTUzYmEtMTFlZi1iMDY3LWNkZjYzMjIz=

Mjc3YiZwPTI0NzVhYjJlLTViOTAtMTFlZi1hNGZiLWIxODg4ZDdiNzNiNiZwdD1jYW1wYWlnbiZ=

0PTE3MjM3ODY2Mjgmcz03ZDJjZDM1NmM2ZTA3MWZkMzVhMDE2MWFjOWVmY2VhYzIwOGRkYmNmZT=

BhODZlMzBlYjNhOTVjMmIxODNkMWZhVwVzcGNldUIKZryE5b5mxulv2VIWam9lLndha2Vyc2VuQ=

HlhaG9vLmNvbVgEAACPDQ~~=0D=0A

--h7hQwmWe

Content-Transfer-Encoding: 7bit

Content-Type: text/html; charset="utf-8"















CAA Winter Safety Kit



CAA phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 16 Dec 2025 15:12:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVdGV-00000000Lnz-0jrN

for dave@doctor.nl2k.ab.ca;

Tue, 16 Dec 2025 15:11:31 -0700

Resent-From: The Doctor

Resent-Date: Tue, 16 Dec 2025 15:11:31 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [84.234.30.27] (port=36708 helo=pullcreativo.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVd8f-00000000Kjc-0jdZ

for root@nk.ca;

Tue, 16 Dec 2025 15:03:32 -0700

Received: from 10.222.142.148

by atlas310.free.mail.ne1.yahoo.com pod-id NONE with HTTPS; Fri, 16 Aug 2024 05:37:09 +0000

X-Originating-Ip: [147.253.220.180]

Received-SPF: pass (domain of sp.eocampaign1.com designates 147.253.220.180 as permitted sender)

Authentication-Results: atlas310.free.mail.ne1.yahoo.com;

dkim=pass header.i=@sp.eocampaign1.com header.s=scph0920;

dkim=pass header.i=@eu.sparkpostmail2.com header.s=ssp0116;

spf=pass smtp.mailfrom=sp.eocampaign1.com;

dmarc=unknown header.from=fremantleherald.com;

X-Apparently-To: joe.wakersen@yahoo.com; Fri, 16 Aug 2024 05:37:10 +0000

X-YMailISG: D8kDHTUWLDujxpocc3yE7aGPiibHgZUWwgoAh60ZaFJxFFEJ

Zy5T.FgbCtPIm6p1BvETkSqOMFbymcfAeimFshhmY6huEVRGQKcfdmJUi5DF

WWyZnX2iDsoXptNqlev_2n0m4FSY3V57AwsgaybmRAfy.P0wDsjaT1I4q3ja

aY_ZFty.zsqX9uCtHdIXcB3OSHTWp.b1M4CQKal4YmDIEJ.Mrmk.WKIzvP_L

U.FmZ_GmceLC0xnDlLDnGT8iaZfOCyURSoFnsC9qwGNeoJ4pqJQnl19aZZba

.watRy5Jzg.Lc.sGsD0UphOopSVgpXRrGk1b6h2BqsDY.HNhHH7Fg82GPUTK

UFXbGu_mOAfBLZR3keY.ZQ4JkbpuDb.FaIjZXBtwcU0NkLwW01Vyczeh.Jqt

47rHXEpyVtx_UTmRJyr6dVBr2EOnDeRKV7JMvxCwXG6loUe3cUmtukWziLhI

DFO0HmD7kH8MfMXmt4GdLC6gUsyLCWKT9odMBc3CWfhOGwoYZbZboylaeSL0

aSkqHXGZff7bLyzuWc_7F9gtz1nHsxnBOcogHTMooqvurpjye230aKJYTItN

4Ilfml_WdaRCybcGrplHWykx4PjqP5_DIsfJC.PEOo88nGo7M9Sce4DxqObG

4aJa7Mbmy9w8w1db0Y_0Xa703_NKLZXYJLKEw4QymkUzdRTGLi35raOo0LBN

YD4KRLLcLEHa1NRdMLVNUucylUphu5F.L.oTyGQsUCyKCyFMQPShRuiLXUTt

.8IAqRscgr.FnTS7LeJKh7purakSf6kYzcA7BZBrVYcwbcm1tkN5FiKSWT5A

b9Vu5XzK4s3pEeo_awmhpMxD94EjAX7aONKYIDQFjMVX6CO9nM7rIoH.neP9

_pwHzsn8d0KhUAAJv8QLwIg3iW5kIkA0yrvoiL6puF0lpoBXu0KMzKBejYRe

5C6pALLnnOEz_DpHd4oXG5c7jAMKXbqwEND4K45m6RTBd.owvs05vYSbuU_H

xVvjLLKJ44OGUsgBGWI32nh6wQBPDc2D.Ke59SMm6CY86Kww7OCfGY.Y_9IX

YX.1YOO38ncNMdGFuOluwtPAylzMCdL_4A3uT2W.R_muDgj17..VJkhtf8mv

pNbSvetMw6lYCcB7uyiTTz1tgvXcj.5fne8Eejr_8BoRFPupoFyAQ6CeMf1A

48qWt2xl80LRrlps6oby8BkudCEaC7tipu4emkr8S5oA7SPep5eMy9iUV4os

4wbzcwcTPTd2JC6ITZJKIb.V.c_ExJrRnyF6gzCQjofHkFJTCG4snF_zvzhS

suay3EOVkeALKfpXsOvjalHoeViRcko.3PxvwTPohpH.T4RyziL_iSWdrAd5

xsPi0t31df6nGDuwJgPEFEfnBQ--

Received: from 147.253.220.180 (EHLO mta-253-220-180.emailoctopus.com.sparkpostmail.com)

by 10.222.142.148 with SMTPs

(version=TLS1_2 cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256);

Fri, 16 Aug 2024 05:37:09 +0000

X-MSFBL: z8ck42fwNnb+tsU2HEBPSQG+SXQ0vnlGTddoOUKz8TE=|eyJtZXNzYWdlX2lkIjo

iNjZiYzg0ZTViZTY2YzZlOTZmZDkiLCJ0ZW5hbnRfaWQiOiJzcGNldSIsInN1YmF

jY291bnRfaWQiOiIzNjYyMSIsInIiOiJqb2Uud2FrZXJzZW5AeWFob28uY29tIiw

iY3VzdG9tZXJfaWQiOiIxODczIn0=

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sp.eocampaign1.com;

s=scph0920; t=1723786628; i=@sp.eocampaign1.com;

bh=kaW53h0moNGz7W65BJyr4F5Uu25jKMnoFNcahJnWd1E=;

h=From:To:Subject:List-Unsubscribe:List-Unsubscribe-Post:Date:

Message-ID:Content-Type:From:To:Cc:Subject;

b=pYhS1I5RV9dfApRJBkN68T3bANkNKhF61DZv1nEDodcJYkeaNHu/xV0sQH6C81s7U

4g5v9eCYylxQ5Hc/jKdYw6wo1cfnYbFTKJNNm1ZUeZMyuNcUDXkK3YmE38DLc6Jlp5

B95bVgPJYrJWfVm9aVt/VIZEcTY3rYmR6v4Ceh7o=

DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=eu.sparkpostmail2.com;

s=ssp0116; t=1723786628; i=@eu.sparkpostmail2.com;

bh=kaW53h0moNGz7W65BJyr4F5Uu25jKMnoFNcahJnWd1E=;

h=From:To:Subject:List-Unsubscribe:List-Unsubscribe-Post:Date:

Message-ID:Content-Type:From:To:Cc:Subject;

b=IyqsEosDO/4EtDwKsTE2NnhPuGzE6+W3odZjZn7ybRIEuok1oGqASr0yWINZtIWl0

YtDaxEwBDABsv1ViXnfDCPMVtIW1gPi8YQ9eVxm17R0Y3t3oQ51EkQQfWD/nO7s87R

PdnB1PKnNoaogp5haPxa5+bTVyPdNzE29F5K+hdE=

From: CAA Special Survey Access Granted

To: root@nk.ca

Subject: root, Act Fast: Only a Few Slots Remain!

X-Entity-Ref-Id: 3d399e1a-db38-48ea-87e2-4c9f9f4c0c07

X-EmailOctopus-Parent-Id: 2475ab2e-5b90-11ef-a4fb-b1888d7b73b6

X-EmailOctopus-Parent-Type-Id: campaign

X-EmailOctopus-List-Id: 874d40b2-3765-11ef-a78b-fb3aafa3750b

X-EmailOctopus-List-Contact-Id: 659d1368-53ba-11ef-b067-cdf63223277b

X-EmailOctopus-Started-Preparing-At: 2024-08-16T05:35:02+00:00

X-EmailOctopus-Sent-At: 2024-08-16T05:37:08+00:00

X-EmailOctopus-Team-Id: a9b87556-3763-11ef-8fd1-fb3aafa3750b

X-EmailOctopus-Version: 4

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Sender: noreply@sp.eocampaign1.com

MIME-Version: 1.0

Date: Tue, 16 Dec 2025 16:02:07 -0600

Message-ID: <3153737965ff9efee3297655272982c996d3267f65@sp.eocampaign1.com>

Content-Type: multipart/alternative; boundary=h7hQwmWe

X-Spam_score: 33.9

X-Spam_score_int: 339

X-Spam_bar: +++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Read them right here! тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ

тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ

тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тАМ тА [...]



Content analysis details: (33.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[147.253.220.180 listed in will-spam-for-food.eu.org]

[147.253.220.180 listed in will-spam-for-food.eu.org]

[147.253.220.180 listed in will-spam-for-food.eu.org]

[147.253.220.180 listed in will-spam-for-food.eu.org]

[147.253.220.180 listed in will-spam-for-food.eu.org]

[147.253.220.180 listed in will-spam-for-food.eu.org]

[147.253.220.180 listed in will-spam-for-food.eu.org]

[147.253.220.180 listed in will-spam-for-food.eu.org]

[84.234.30.27 listed in will-spam-for-food.eu.org]

[84.234.30.27 listed in will-spam-for-food.eu.org]

[84.234.30.27 listed in will-spam-for-food.eu.org]

[84.234.30.27 listed in will-spam-for-food.eu.org]

[84.234.30.27 listed in will-spam-for-food.eu.org]

[84.234.30.27 listed in will-spam-for-food.eu.org]

[84.234.30.27 listed in will-spam-for-food.eu.org]

[84.234.30.27 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[147.253.220.180 listed in dnsbl.ahbl.org]

[147.253.220.180 listed in dnsbl.ahbl.org]

[147.253.220.180 listed in dnsbl.ahbl.org]

[147.253.220.180 listed in dnsbl.ahbl.org]

[84.234.30.27 listed in dnsbl.ahbl.org]

[84.234.30.27 listed in dnsbl.ahbl.org]

[84.234.30.27 listed in dnsbl.ahbl.org]

[84.234.30.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[147.253.220.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[147.253.220.180 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[147.253.220.180 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[147.253.220.180 listed in dnsbl.ahbl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: eocampaign1.com]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

15 GR_DOMAIN_SPARKP1 Received contains spammer id (sparkp)

0.7 LOCALPART_IN_SUBJECT Local part of To: address appears in Subject

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.6 J_CHICKENPOX_19 BODY: 1alpha-pock-9alpha

2.3 MANGLED_EMAIL BODY: mangled email

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

3.0 TO_NAME_SUBJ_NO_RDNS Recipient username in subject + no rDNS

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} root, Act Fast: Only a Few Slots Remain!



--h7hQwmWe

Content-Transfer-Encoding: quoted-printable

Content-Type: text/plain; charset="utf-8"

Social Media spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 16 Dec 2025 15:12:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVdGF-00000000LnI-2Yqt

for dave@doctor.nl2k.ab.ca;

Tue, 16 Dec 2025 15:11:15 -0700

Resent-From: The Doctor

Resent-Date: Tue, 16 Dec 2025 15:11:15 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yx1-f71.google.com ([74.125.224.71]:39301)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVcdL-00000000HT7-3cnd

for sales@nk.ca;

Tue, 16 Dec 2025 14:31:11 -0700

Received: by mail-yx1-f71.google.com with SMTP id 956f58d0204a3-640d4dc536aso2031558d50.1

for ; Tue, 16 Dec 2025 13:30:19 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1765920613; x=1766525413; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=YpyfNcQQYbr/B4ekMXI4fVKx0YgTXc/zYyjGMUE3Pwo=;

b=dHWr3vIyyIoXq+Ap/t++QGfv7Ir6igZwL+IIjGC5avNllf+b2nKWVlHlrsxbIymmUr

wEGcyEEefwazSN+zXurqTOt5xU6/6RGTwnDCLQ/7s4kM1yEQ/2awpj/xxTTd+8BSbyxl

ZdZABS5fzvKlXPuXHIeAr1YfCgxiW8gyo7ZfxOwoSP2wo3xqKZqgB/bRtojV7njZbmIV

50541VbuODxhpF3bYO8TF4KUq+MxEqcrraZC75b1D5kwEBxTQbh0k0N9qS9Ey0YuPWSb

PfrrXmUskeJfh91HcYLYGWMOpMZs+ZCDCqiY67fYNoR4C9e1TDsAvWB+9I91lSVFBYwO

d2ww==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1765920613; x=1766525413;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=YpyfNcQQYbr/B4ekMXI4fVKx0YgTXc/zYyjGMUE3Pwo=;

b=PmTHX/PjK0Bwj3k+ekElm6nSGnJi+WclsyReNScz5bdcKW37ao7G3X+Q7nDh391rNr

M1cQAnpZc6KOVUDXXTc/9SfJemhbBu4ubwj2k4ffuC1jrURGOlcObbpefE/MuBR2jOey

S0mgYwkLlrPdc7wBhSaDAvbypa1W7TiphpjXYPYnCU8tPnZ+0T0g3ft8Hgdt6e5U1MP0

amoILMSj1gymQhHBELAkvJTnn5cNH+gBSlVE+JNu89buuXRfohCJH7Elfc9+rODmTpI+

gFBXmXXYNrU0LpS5DIa9YvrVDHic3CdJWGtQzXtHAW8D49x+O9az4ZtZhrSxkSTNDCKs

Bq6A==

X-Gm-Message-State: AOJu0YzSpiDyS3eGB7d2q8DDSFw2Zvs4Ho8xdCtbB39BxPQ1lsVYC/HY

X+Tg47AJujh/jXOE9xQEJ7bTlRMxRRDe+Imq/NeZ4qONzB8ktk7afassH/PAc+WeA0kGQSZvpeY

dPO8=

X-Google-Smtp-Source: AGHT+IEqSwtcoO+ESxi3q5ry8yvDmL80j3aC0dxCvZuVtUQW7tOHCWCg3Xk4Qn4UOM0DleSsajq/NiiVmg==

MIME-Version: 1.0

X-Received: by 2002:a05:690c:399:b0:78c:651d:7fec with SMTP id

00721157ae682-78e66ca28a0mr120626257b3.8.1765920613116; Tue, 16 Dec 2025

13:30:13 -0800 (PST)

Message-ID:

Date: Tue, 16 Dec 2025 21:30:13 +0000

Subject: netknowyeg, instamax.online

From: bsjehh12@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

X-Spam_score: 8.6

X-Spam_score_int: 86

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, netknowyeg, instamax.online Sorry to interrupt your

time. We offer social media services, If you're interested, please visit

our Website. If you're not interested, please skip this step. We will help

you increase your social media presence to another level. ( Threads, Instagram,

Twitter, Youtube, Facebook, etc. )



Content analysis details: (8.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.224.71 listed in will-spam-for-food.eu.org]

[74.125.224.71 listed in will-spam-for-food.eu.org]

[74.125.224.71 listed in will-spam-for-food.eu.org]

[74.125.224.71 listed in will-spam-for-food.eu.org]

[74.125.224.71 listed in will-spam-for-food.eu.org]

[74.125.224.71 listed in will-spam-for-food.eu.org]

[74.125.224.71 listed in will-spam-for-food.eu.org]

[74.125.224.71 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.224.71 listed in dnsbl.ahbl.org]

[74.125.224.71 listed in dnsbl.ahbl.org]

[74.125.224.71 listed in dnsbl.ahbl.org]

[74.125.224.71 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.224.71 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.224.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.224.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.224.71 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: instamax.online (online)]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[bsjehh12(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[bsjehh12(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.224.71 listed in wl.mailspike.net]

1.5 MR_STRANGE_QUESTION URI: No description available.

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} netknowyeg, instamax.online



Hello, netknowyeg, instamax.online

Sorry to interrupt your time.



We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.



We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )



Are you interested in a free trial ?

Please visit our page Instagram ( @instamax.online )

Instamax Social Media Website

[ https://instamax.42web.io/?Netknow Internet Service ]





Take free trial service today only...!!

10 -101K Instagram Followers



Thank you.

Regards,

Web/SEO/App Spam from Microsoft Outlook Part 3

Posted by Dave Yadallee on




--_000_SE2P216MB2572F1ED5202A624A599BBABD0AAASE2P216MB2572KORP_

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: base64



SGksDQoNCkp1c3QgZm9sbG93aW5nDQoNCnVwIHRvIHNlZSBpZiB5b3XigJlyZSBpbnRlcmVzdGVk

IGluIHRoYXQgbG9jYWwgU0VPIEkgbWVudGlvbmVkLg0KDQpJdCBpbmNsdWRlczoNCg0KDQrinIUg

SG93IHlvdXIgYnVzaW5lc3MgYXBwZWFycyBpbiBHb29nbGUgc2VhcmNoICYgbWFwcyBMb2NhbCBs

aXN0aW5ncyByZXBvcnQNCg0K4pyFIExvY2FsIGtleXdvcmRzIHlvdSdyZSBtaXNzaW5nDQoNCuKc

hSBDb21wZXRpdG9yIGNvbXBhcmlzb25zDQpDb3N0LCBjYXRjaC4NCg0KSnVzdCBsZXQgbWUga25v

dyBpZiB5b3UnZCBsaWtlIGl0Lg0KDQpUaGFua3MsDQoNCg==



--_000_SE2P216MB2572F1ED5202A624A599BBABD0AAASE2P216MB2572KORP_

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: base64



PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i

dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyIgc3R5bGU9

ImRpc3BsYXk6bm9uZTsiPiBQIHttYXJnaW4tdG9wOjA7bWFyZ2luLWJvdHRvbTowO30gPC9zdHls

ZT4NCjwvaGVhZD4NCjxib2R5IGRpcj0ibHRyIj4NCjxkaXYgc3R5bGU9ImRpcmVjdGlvbjogbHRy

OyBmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3NfTVNGb250U2Vy

dmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDEycHQ7IGNv

bG9yOiByZ2IoMCwgMCwgMCk7Ij4NCkhpLCZuYnNwOzwvZGl2Pg0KPGRpdiBzdHlsZT0iZGlyZWN0

aW9uOiBsdHI7IGZvbnQtZmFtaWx5OiBBcHRvcywgQXB0b3NfRW1iZWRkZWRGb250LCBBcHRvc19N

U0ZvbnRTZXJ2aWNlLCBDYWxpYnJpLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTog

MTJwdDsgY29sb3I6IHJnYigwLCAwLCAwKTsiPg0KPGJyPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJk

aXJlY3Rpb246IGx0cjsgZm9udC1mYW1pbHk6IEFwdG9zLCBBcHRvc19FbWJlZGRlZEZvbnQsIEFw

dG9zX01TRm9udFNlcnZpY2UsIENhbGlicmksIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1z

aXplOiAxMnB0OyBjb2xvcjogcmdiKDAsIDAsIDApOyI+DQpKdXN0IGZvbGxvd2luZzwvZGl2Pg0K

PGRpdiBzdHlsZT0iZGlyZWN0aW9uOiBsdHI7IGZvbnQtZmFtaWx5OiBBcHRvcywgQXB0b3NfRW1i

ZWRkZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBDYWxpYnJpLCBIZWx2ZXRpY2EsIHNhbnMt

c2VyaWY7IGZvbnQtc2l6ZTogMTJwdDsgY29sb3I6IHJnYigwLCAwLCAwKTsiPg0KPGJyPg0KPC9k

aXY+DQo8ZGl2IHN0eWxlPSJkaXJlY3Rpb246IGx0cjsgZm9udC1mYW1pbHk6IEFwdG9zLCBBcHRv

c19FbWJlZGRlZEZvbnQsIEFwdG9zX01TRm9udFNlcnZpY2UsIENhbGlicmksIEhlbHZldGljYSwg

c2Fucy1zZXJpZjsgZm9udC1zaXplOiAxMnB0OyBjb2xvcjogcmdiKDAsIDAsIDApOyI+DQp1cCB0

byBzZWUgaWYgeW914oCZcmUgaW50ZXJlc3RlZCBpbiB0aGF0IGxvY2FsIFNFTyBJIG1lbnRpb25l

ZC48L2Rpdj4NCjxkaXYgc3R5bGU9ImRpcmVjdGlvbjogbHRyOyBmb250LWZhbWlseTogQXB0b3Ms

IEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0

aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDEycHQ7IGNvbG9yOiByZ2IoMCwgMCwgMCk7Ij4N

Cjxicj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0iZGlyZWN0aW9uOiBsdHI7IGZvbnQtZmFtaWx5OiBB

cHRvcywgQXB0b3NfRW1iZWRkZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBDYWxpYnJpLCBI

ZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTJwdDsgY29sb3I6IHJnYigwLCAwLCAw

KTsiPg0KSXQgaW5jbHVkZXM6PC9kaXY+DQo8ZGl2IHN0eWxlPSJkaXJlY3Rpb246IGx0cjsgZm9u

dC1mYW1pbHk6IEFwdG9zLCBBcHRvc19FbWJlZGRlZEZvbnQsIEFwdG9zX01TRm9udFNlcnZpY2Us

IENhbGlicmksIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxMnB0OyBjb2xvcjog

cmdiKDAsIDAsIDApOyI+DQo8YnI+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9ImRpcmVjdGlvbjogbHRy

OyBmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3NfTVNGb250U2Vy

dmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDEycHQ7IGNv

bG9yOiByZ2IoMCwgMCwgMCk7Ij4NCjxicj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0iZGlyZWN0aW9u

OiBsdHI7IGZvbnQtZmFtaWx5OiBBcHRvcywgQXB0b3NfRW1iZWRkZWRGb250LCBBcHRvc19NU0Zv

bnRTZXJ2aWNlLCBDYWxpYnJpLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTJw

dDsgY29sb3I6IHJnYigwLCAwLCAwKTsiPg0K4pyFIEhvdyB5b3VyIGJ1c2luZXNzIGFwcGVhcnMg

aW4gR29vZ2xlIHNlYXJjaCAmYW1wOyBtYXBzIExvY2FsIGxpc3RpbmdzIHJlcG9ydDwvZGl2Pg0K

PGRpdiBzdHlsZT0iZGlyZWN0aW9uOiBsdHI7IGZvbnQtZmFtaWx5OiBBcHRvcywgQXB0b3NfRW1i

ZWRkZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBDYWxpYnJpLCBIZWx2ZXRpY2EsIHNhbnMt

c2VyaWY7IGZvbnQtc2l6ZTogMTJwdDsgY29sb3I6IHJnYigwLCAwLCAwKTsiPg0KPGJyPg0KPC9k

aXY+DQo8ZGl2IHN0eWxlPSJkaXJlY3Rpb246IGx0cjsgZm9udC1mYW1pbHk6IEFwdG9zLCBBcHRv

c19FbWJlZGRlZEZvbnQsIEFwdG9zX01TRm9udFNlcnZpY2UsIENhbGlicmksIEhlbHZldGljYSwg

c2Fucy1zZXJpZjsgZm9udC1zaXplOiAxMnB0OyBjb2xvcjogcmdiKDAsIDAsIDApOyI+DQrinIUg

TG9jYWwga2V5d29yZHMgeW91J3JlIG1pc3Npbmc8L2Rpdj4NCjxkaXYgc3R5bGU9ImRpcmVjdGlv

bjogbHRyOyBmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3NfTVNG

b250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDEy

cHQ7IGNvbG9yOiByZ2IoMCwgMCwgMCk7Ij4NCjxicj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0iZGly

ZWN0aW9uOiBsdHI7IGZvbnQtZmFtaWx5OiBBcHRvcywgQXB0b3NfRW1iZWRkZWRGb250LCBBcHRv

c19NU0ZvbnRTZXJ2aWNlLCBDYWxpYnJpLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6

ZTogMTJwdDsgY29sb3I6IHJnYigwLCAwLCAwKTsiPg0K4pyFIENvbXBldGl0b3IgY29tcGFyaXNv

bnM8L2Rpdj4NCjxkaXYgc3R5bGU9ImRpcmVjdGlvbjogbHRyOyBmb250LWZhbWlseTogQXB0b3Ms

IEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0

aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDEycHQ7IGNvbG9yOiByZ2IoMCwgMCwgMCk7Ij4N

CkNvc3QsIGNhdGNoLjwvZGl2Pg0KPGRpdiBzdHlsZT0iZGlyZWN0aW9uOiBsdHI7IGZvbnQtZmFt

aWx5OiBBcHRvcywgQXB0b3NfRW1iZWRkZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBDYWxp

YnJpLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTJwdDsgY29sb3I6IHJnYigw

LCAwLCAwKTsiPg0KPGJyPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJkaXJlY3Rpb246IGx0cjsgZm9u

dC1mYW1pbHk6IEFwdG9zLCBBcHRvc19FbWJlZGRlZEZvbnQsIEFwdG9zX01TRm9udFNlcnZpY2Us

IENhbGlicmksIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxMnB0OyBjb2xvcjog

cmdiKDAsIDAsIDApOyI+DQpKdXN0IGxldCBtZSBrbm93IGlmIHlvdSdkIGxpa2UmbmJzcDtpdC48

L2Rpdj4NCjxkaXYgc3R5bGU9ImRpcmVjdGlvbjogbHRyOyBmb250LWZhbWlseTogQXB0b3MsIEFw

dG9zX0VtYmVkZGVkRm9udCwgQXB0b3NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNh

LCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDEycHQ7IGNvbG9yOiByZ2IoMCwgMCwgMCk7Ij4NCjxi

cj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0iZGlyZWN0aW9uOiBsdHI7IGZvbnQtZmFtaWx5OiBBcHRv

cywgQXB0b3NfRW1iZWRkZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBDYWxpYnJpLCBIZWx2

ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTJwdDsgY29sb3I6IHJnYigwLCAwLCAwKTsi

Pg0KVGhhbmtzLDwvZGl2Pg0KPGRpdiBzdHlsZT0iZGlyZWN0aW9uOiBsdHI7IGZvbnQtZmFtaWx5

OiBBcHRvcywgQXB0b3NfRW1iZWRkZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBDYWxpYnJp

LCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTJwdDsgY29sb3I6IHJnYigwLCAw

LCAwKTsiPg0KPGJyPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo=

Web/SEO/App Spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on
Content-Type: multipart/alternative;

boundary="_000_SE2P216MB2572F1ED5202A624A599BBABD0AAASE2P216MB2572KORP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SE2P216MB2572.KORP216.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 01d8edf5-76f5-45b6-e0bf-08de3ccdc975

X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Dec 2025 18:06:07.8725

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SE1P216MB1478

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Just following up to see if you’re interested in that

local SEO I mentioned.



Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:101:1c5:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:1c5:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:1c5:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:1c5:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:1c5:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:1c5:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:1c5:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:1096:101:1c5:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[52.103.74.24 listed in will-spam-for-food.eu.org]

[52.103.74.24 listed in will-spam-for-food.eu.org]

[52.103.74.24 listed in will-spam-for-food.eu.org]

[52.103.74.24 listed in will-spam-for-food.eu.org]

[52.103.74.24 listed in will-spam-for-food.eu.org]

[52.103.74.24 listed in will-spam-for-food.eu.org]

[52.103.74.24 listed in will-spam-for-food.eu.org]

[52.103.74.24 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.74.24 listed in dnsbl.ahbl.org]

[52.103.74.24 listed in dnsbl.ahbl.org]

[52.103.74.24 listed in dnsbl.ahbl.org]

[52.103.74.24 listed in dnsbl.ahbl.org]

[2603:1096:101:1c5:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:1096:101:1c5:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:1096:101:1c5:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:1096:101:1c5:0:0:0:13 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.74.24 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.74.24 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.74.24 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.74.24 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.74.24 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.74.24 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.0 ARC_VALID Message has a valid ARC signature

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[https.www.remineal4562(at)outlook.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[https.www.remineal4562(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.5 VOWEL_TOCC_5 To or Cc header with 5 consecutive vowels

Subject: {SPAM?} =?utf-8?B?UmU6IFllc+KApj8=?=

--_000_SE2P216MB2572F1ED5202A624A599BBABD0AAASE2P216MB2572KORP_--

Web/SEO/App Spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 16 Dec 2025 11:08:00 -0700

Received: from mail-koreacentralazolkn19011024.outbound.protection.outlook.com ([52.103.74.24]:39740 helo=SLXP216CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVZSR-00000000OMj-3tzT

for dave@doctor.nl2k.ab.ca;

Tue, 16 Dec 2025 11:07:47 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=FltgQh8J+kY1L76BndBCAn2QTyjWKWkLReC2V6Yygg0XK09D/NxaHrQhvS/3+nqKyS8JqLLWLnp6mOvBUDWAT0co1QkMGeRLOVtBlCoYX1uXiceY47609js4vodBu6jcyyKhp7TR2Ujkl2oIS7HP5AZK6wf4xgUxe0iDGtZhRcWse4APhZNMruoQiFixkdeQpHzkFuUtFlLA0mSuwYs5Cp802Zd+dyqVPaEzGfBqZHzj84zuAKnDa5JdpyBLXMjFNQ+VE/U89R8m3dhMU7nlCv6/4jL5x6EL4nydUY4BUJ+5dRYbQlEhLKNzSWUPTJBkrVcohL3xBW99mPpeSaI0ow==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=9pmUmh+0WgYuwZAl2DdWXsaAmGHNEutpqjqidq/we/o=;

b=DZBT6OKrmMkaPWGTgKErjDj+8BnXTtQX7eR0zvY8MMyuUput+XDJ0JDQQW8Qd9PtrQRAb8gwMcr0lL9s9CNAMWlH989ONTSYCUnEFfld5d+oL04ISbxV/2eyBdr0BsvJumq6ANQEccBo85pRtcUNLNi5Jn5Hj8svMTYtgEyAxNzj4B5OFWXGMqA4iz/ZufAoKCmv7nqWTFTMq7utYJyugZxzjkkM96rdkHzP/8qr+O9UZ992Oqn2F09RPYQZCjHPyhuBpYrGhhpJexJSuTvB90XnxnLQfHWyu7TeFibKICQv36vbuKSllsUFWlDM807E/wIElLAa+/GOkZZ4p6+Tcg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=9pmUmh+0WgYuwZAl2DdWXsaAmGHNEutpqjqidq/we/o=;

b=LXmd6Q850PvB7Wzd+o8XWLzo2w1BrUwi9pa5wPR9T3MCiA6galvPyAGX2dKxek6rFeMjRhFYLg44B9l2w48l45JvyDofqXIvP3sQ1vc4aFQyhahz4GBC5LwmjxFZt7Nutcam/YnkI+Xp1O3Ukf09AGR2993GbaeKctb1YMBd9h7H0GmFJybPOx/2RkqqmWJifAl5/neppHfd0RXOxtsHSn/BBfeUG7V8SoJOx6yIF4d38hLcINIuk0KBTQSOLbLUa/07fz8rjCfvFTk8kkFil3nWnfZTBajpvz4UJN11dbDkAM1E7fMtWjiJinZqJGtx3+YV3DQXR3K2I+jjzJUTtg==

Received: from SE2P216MB2572.KORP216.PROD.OUTLOOK.COM (2603:1096:101:1c5::13)

by SE1P216MB1478.KORP216.PROD.OUTLOOK.COM (2603:1096:101:1d::10) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9434.6; Tue, 16 Dec

2025 18:06:08 +0000

Received: from SE2P216MB2572.KORP216.PROD.OUTLOOK.COM

([fe80::78a0:4db1:c1ed:6b56]) by SE2P216MB2572.KORP216.PROD.OUTLOOK.COM

([fe80::78a0:4db1:c1ed:6b56%3]) with mapi id 15.20.9434.001; Tue, 16 Dec 2025

18:06:08 +0000

From: Remi Neal

To: Remi Neal

Subject: =?utf-8?B?UmU6IFllc+KApj8=?=

Thread-Topic: =?utf-8?B?WWVz4oCmPw==?=

Thread-Index:

AQHcZsCBOVUf0zSyt0COOlEJfGGMhLUWQ26jgAaImziAAXtsB4AEkCIAgAAAMv6AAAAwh4ABx8Dl

Date: Tue, 16 Dec 2025 18:06:07 +0000

Message-ID:



References:



















































In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-exchange-messagesentrepresentingtype: 1

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SE2P216MB2572:EE_|SE1P216MB1478:EE_

x-ms-office365-filtering-correlation-id: 01d8edf5-76f5-45b6-e0bf-08de3ccdc975

x-microsoft-antispam:

BCL:0;ARA:14566002|7071999006|31061999003|8060799015|8062599012|15030799006|15080799012|39105399006|19110799012|37102599003|461199028|3412199025|440099028|41105399003|40105399003|39145399003|102099032|1710799026;

x-microsoft-antispam-message-info:

=?utf-8?B?T1JydTVoTnhPK1NXZHNkSmU3R2ZTNVpuVDY1eWg0UzBadGxXSDBCUHVKdThN?=

=?utf-8?B?Vk5FaUxEVi9JanlpTGNxNDZsNUFnR1pkdWxKeFgrb0FIUU9tMjFPN2ltNGdU?=

=?utf-8?B?bUZpWitPcjRYR2d5YWlxTkZpVHc4RmN4aEZYK2xnSDlpWElqUjF3S2dQSjFN?=

=?utf-8?B?bnN5OXhrdE9tTUd4aThyTkJoVFpIMk5xMytWUmVxNE9IcVF2b2dBZ3NJMXc0?=

=?utf-8?B?V3ZJTWRmQlhyTnRBRHhtMm9kd0w4WXdUYlA1Q0VwRWlMWlppbEZPYkdkR3RB?=

=?utf-8?B?akM3eTJKUnJsbEpENTh4NVB2Y0doeU5FdUEwbXR1b0ZpWm55OUlzYk1RNFVT?=

=?utf-8?B?WTZrSVZ0OWNkZTIrUFY5VElPNEtWQWZYMnRjcXhLU3k1TWJnK1F2bFBuQi94?=

=?utf-8?B?Q08vbnRhOTVibVNYWXRESEttTEkxa2ExbmRIbkhPMyt5dlpwN2dacnRQNEVh?=

=?utf-8?B?Ujh2bFhLcXZMQTJNTlhYbjRXTFFVU1VCSWhZanFzZnZ5dlNTTXlzc2dkYXJC?=

=?utf-8?B?SnNRWGt2Q3g4QnFHei9KRDZ1K2RVcW9peUJXRUN5SDNSa2NCKzJrMEt5MTNF?=

=?utf-8?B?UUdzVlA5MlF0V3Ftb3JBRGpDUVpVcHAvUU5MVWxldy8yQ3YxL2k2L2FLaGNt?=

=?utf-8?B?SHo4OFAwODlaY1NRSjE2bTNGajQzM2pmVGNNRk9WUUdYOUhkc2g2L3RCMFln?=

=?utf-8?B?cTJjT0V6L29NWHZHRHgvVy8yWVVoa0IrNHNrYlJxZStqaDludEF4T2t5anM2?=

=?utf-8?B?MFhYaWdsOUV1ZDlTSVZ1eXV1Ykg2MExNWXBpK2g0Y2o3NzdPZDZZdWdsNE1T?=

=?utf-8?B?QzJ2amFhd1UrYTQwUkJFVWZ3cFlsN1pLcHd6RHJkeFdPUmlYMGlmRm1PMDhB?=

=?utf-8?B?bldPUXJzek53Qzk0MEQ1cVVVUTc5K1J0K2pNUXJUVEE4ODBicUQ1MG1kOWx2?=

=?utf-8?B?UjBnLzJ2SFJZY0VNRHpnMTF3ck9sM1VYcy9ZQjlCaGVGRWlVZXFYWGZUckto?=

=?utf-8?B?SkY1c1EzcXRWcllJK1crVXNqRnRHV05DVVluSVh4ZkdLZExsV0w0SS9HRG1r?=

=?utf-8?B?T1dpS2NOdU5KUWdjcGtOckhlNGIyV0tLcHFBRHpzbitaNjYxd0JLNHhIWmR1?=

=?utf-8?B?SFhBOEZ3VnI1SlBIQ3dpTGNpZ3NwTi83NktrdGZyRkpMYkZ3c0MrZHIvS2pm?=

=?utf-8?B?alFseERkSS9UTC9Xck5udmtVNFZjdUxvR1FQd1drdnRYOTdkQmVzMlE3Sisy?=

=?utf-8?B?L055eUJnMTFYU3Q1ZG5lU2xYdTdPODVMQnJ2SWVFN2Y3UElVZTd0WXJGSDV5?=

=?utf-8?B?Q01xZk04d1A1QkcxLzlJbTU3M2JNekdUVm9Jb0ExMGplRkpGR3JWTzhtYVFP?=

=?utf-8?B?SVB5YkdXK2RKdU5tc2xEbDJtaURkVms5NzF0RkV6ZVJwYWVLSkIrMTc2aEpo?=

=?utf-8?B?a2NhQzZtYm0vc2ZJcDRpTFdDQkpWK1lVYXhXZEs4SjFnOThVc1pmZ1BZencx?=

=?utf-8?B?YjVmSk1ycUYxRnBmRXFUUTlSQzJxTDI3OG9lQWpla04xTXNqVUJoWGRUYmZ3?=

=?utf-8?B?aG90R29HNXl0K3JVRGY1eE5BWkhheE1abHdvdEVNVVlVNjZiOXFNZGdmK20z?=

=?utf-8?B?S0RoSEMxUHVjSnhiK3JRNDBBakEwOTJNa2hiRVZ1UWtYR3FqczJVNnJ0Tnds?=

=?utf-8?B?eW1xT2NmTDZmclRnR2JsZ3IxYnhEcURDdWw0TDFiKzk2YXg5ZVhEdnJoeUY1?=

=?utf-8?B?amNhZ0ljaFpMOW5DVXQ4WWpyYmd0NjE4Q2xJVk82bzNsUmRVTFFsaW13MXd5?=

=?utf-8?Q?SegBAnlpPazO2Muu5rhChBqUrJCXTNWdL5ra4=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?utf-8?B?L2tWZWFwN1Bjb25uRmp1WTVsZEhVNTgxNEF3c1B3eWN4cytGTy9tbmdUNzFE?=

=?utf-8?B?SzRWSDBFWG9nbHNva054MGE2QlpXc2hhSU5XWFpaR0o5UXpNa21ZWTlZNVc2?=

=?utf-8?B?QU83ZFdOdFpyUHN1K1BIK3FhZExlay9ndlhiRFM2N2FnSEMwNUxGcmtqakhY?=

=?utf-8?B?a1h2N2JBNWZEMVBCZXQ3RWU0Y2JRQ1N3TDRsUHRvL0lXbjhpNWlva0RjanRT?=

=?utf-8?B?dXdkelFoSjEzcFFrTkVaUk9Xc25tYVNtYjB1U1UzbEMvWkYxSmFPbHRCN1hB?=

=?utf-8?B?ZVc4MEoyaGVZRURzNDBMYTExU281anpWdkFpU085emc5bEVRVkt1QXFuakZU?=

=?utf-8?B?TEFoNkMvTS8rVFR6bGpWNGxPWjk3Ym4xdytLTE56Y29tcHhzcjlMSG5GM2Y1?=

=?utf-8?B?SW5MTXAyUVIyTWl6a3Q3Q25MaThBUFNTRTh6aFgrN2xITS95WnBOSEVtd29y?=

=?utf-8?B?MjQxRVl6ZWtXUERwMmxsb29NZXgzRmRTaHQxaWVTMWlOWmkrcytyS01lR0RQ?=

=?utf-8?B?dVM2cTV3TTRPYUU2OVVPQWk0M2p2bGxISURnSzAydW1aUDhSaytzeElUTHQ2?=

=?utf-8?B?ZUc1alVEc0VRL05yMjM4dk9kczlWbk9WY1hDVUNhU3FrRmxiTDJKczNTdXFh?=

=?utf-8?B?YzJJOWJFYkdyb1lvMUY2L1k1ZFVEMG4yZHpBbUgyOC9BRXVtbHdTOGpRMnY4?=

=?utf-8?B?S0NXSGZlZU5XQmxYM3RFU3RjMFhNMjNkQWFYakRycHRlS240YzQ5cFpuMXpI?=

=?utf-8?B?TDNXMmNnbHpwcHpYczhzTEN0amdic1BRZ1pTdWY5aTVYS3lCMENCLzJjWTJq?=

=?utf-8?B?SlgzMnR4QThlNm1sOTNuVGxnVXR5b09mRjZpeVNWSGYvTUVJcThQTXFNNVEz?=

=?utf-8?B?WWh0eGhLRnZ3Zm9zMGpaZHg0YUhYcThBNnhKRkVhcTFveDFCRk9zY2JPaEdB?=

=?utf-8?B?cTcxYkZYOTl4TlVCajBYbkdVRUlvczlHRWFDS1ZtQmRJUnNSN1Y3TjlRMTgv?=

=?utf-8?B?T2NhZGw1cW5QUEhnRDVqN1RpbDM0WDQ1cVhtN01pM0lDenE4ZjBTa3dkVU5N?=

=?utf-8?B?VGU0Z1FCRGdHeTBwNDdyTW9tRStsb3RnSFdWZmZEVm9YWmdTQnk5UWFJZHA3?=

=?utf-8?B?ekNkdDgwU2xVOGhlU0xHK1F3ZGFwazd0TXlhQUlkVU1EWGxwVHV0ZWlBbzhJ?=

=?utf-8?B?d01qaDVPblhYdUxJK1VrMTN2ajR4bVBHTnlWMDZlM25nTXBxRStna1dDN2JN?=

=?utf-8?B?N1Z1cGtmdGV6OEtJMkhOYks0M0xMOXhuWnZ5NklGM2JYdFRnZ283S29CRWdo?=

=?utf-8?B?VlRNTG5HRUJjY2ZnRDRRR081bi9JVkNmeU9RSVowTzQ1dDlQaHhKRWJOdTVy?=

=?utf-8?B?SDRvNER3ZHh0ejJqZDdRRW1sR28vc09VeDRiRjN4TXF1T3hzdXdmTENTbXRB?=

=?utf-8?B?NHFVU1E0ekVpc1AvMUpRbnpUOXVZWDA5c1FMaDdmY3ZISFM0akNOMUd1L01v?=

=?utf-8?B?cW9HQkFyOHgzSHROdEs4UXlIaUFRcXBZRGJnUEM0L284M3dZRGFVTGJVeDl5?=

=?utf-8?B?UE9KOWNsN0lNTXVRU1dSZzR0a2NkZ0ZZOW5kSk81V01hQ3VLSUJudGdFMWRS?=

=?utf-8?B?NlVCZXdlUG55dTVpcXNNL2trOGtLbldCeW1uT1BrQlF3RlkxK1JZVGcwQVdq?=

=?utf-8?B?ZjJpVmFJbk9qOE9oTi94MmFkRlVKUWlqeFBHVyszakEySVFqKy9IOWRzVmd5?=

=?utf-8?Q?zWV2X1feWUKr/z/8fz8dwhypQtsrfiDV5EEG5tm?=



Credential phishing Part 2

Posted by Dave Yadallee on
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Attention Mail users, Your account has exceeded the quota

limit set by your administrator and needs to be re-authenticated immediately

or your account will be disabled. To authenticate your account, click here

If you do not verify, your account will be permanently disabled and deleted

from our database.



Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[202.44.11.210 listed in will-spam-for-food.eu.org]

[202.44.11.210 listed in will-spam-for-food.eu.org]

[202.44.11.210 listed in will-spam-for-food.eu.org]

[202.44.11.210 listed in will-spam-for-food.eu.org]

[202.44.11.210 listed in will-spam-for-food.eu.org]

[202.44.11.210 listed in will-spam-for-food.eu.org]

[202.44.11.210 listed in will-spam-for-food.eu.org]

[202.44.11.210 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[202.44.11.210 listed in dnsbl.ahbl.org]

[202.44.11.210 listed in dnsbl.ahbl.org]

[202.44.11.210 listed in dnsbl.ahbl.org]

[202.44.11.210 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[202.44.11.210 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[202.44.11.210 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[202.44.11.210 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[202.44.11.210 listed in dnsbl.ahbl.org]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: 500apps.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Re: UPDATE



--_000_dafefcceea494c7cbd2953544290577ckmuttacth_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Attention Mail users,



Your account has exceeded the quota limit set by your administrator and nee=

ds to be re-authenticated immediately or your account will be disabled.



To authenticate your account, click here
apps.org/forms/3018/email>

If you do not verify, your account will be permanently disabled and deleted=

from our database.



=A92025 Customer Service







--_000_dafefcceea494c7cbd2953544290577ckmuttacth_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








-family:Calibri,Helvetica,sans-serif;" dir=3D"ltr">



=

Attention Mail users,




erif; font-size: small;">


8176882m_4488031976134076923m_-1386441591256819376m_-2294937808046511236m_-=

7431942429727543635m_1044486564259301909m_-7167391478572544311m_-7575908189=

660229868m_5124445605009022194m_6217419163993937009m_-4888862368657789276m_=

-2072205396121769899m_682879439444531118m_3899932313212325907m_-79908924346=

55085709m_2818965282480535347m_-6003252462576324582m_-6901109906779144675m_=

9085287897416909827m_-7954286592643722612m_-7118632125705438199m_-314495259=

7543972536divtagdefaultwrapper" dir=3D"ltr" style=3D"font-family: Arial, He=

lvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe =

UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android =

Emoji", EmojiSymbols;">


8176882m_4488031976134076923m_-1386441591256819376m_-2294937808046511236m_-=

7431942429727543635m_1044486564259301909m_-7167391478572544311m_-7575908189=

660229868m_5124445605009022194m_6217419163993937009m_-4888862368657789276m_=

-2072205396121769899m_682879439444531118m_3899932313212325907m_-79908924346=

55085709m_2818965282480535347m_-6003252462576324582m_-6901109906779144675m_=

9085287897416909827m_-7954286592643722612m_-7118632125705438199m_-314495259=

7543972536m_-3731003826545987989gmail-divtagdefaultwrapper" dir=3D"ltr">


rif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", =

NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", Emo=

jiSymbols; font-size: 12pt;">







rif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", =

NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", Emo=

jiSymbols; font-size: 12pt;">

Your account has exceeded the quot=

a limit set by your administrator and needs to be re-authenticated immediat=

ely or your  account will be disabled.



rif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", =

NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", Emo=

jiSymbols; font-size: 12pt;">







=3D"Calibri, Helvetica, sans-serif, EmojiFont, Apple Color Emoji, Segoe UI =

Emoji, NotoColorEmoji, Segoe UI Symbol, Android Emoji, EmojiSymbols">
style=3D"font-size: 12pt;">To authenticate

your account, 
orms/3018/email" target=3D"_blank" rel=3D"noopener noreferrer" style=3D"col=

or: rgb(17, 85, 204); font-family: Arial, Helvetica, sans-serif; font-size:=

small;">click here



rif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", =

NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", Emo=

jiSymbols; font-size: 12pt;">

If you do not verify, your account=

will be permanently disabled and deleted from our database.



rif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", =

NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", Emo=

jiSymbols; font-size: 12pt;">







rif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", =

NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", Emo=

jiSymbols; font-size: 12pt;">

 =A92025  Customer Service
font>














EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", Noto=

ColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSy=

mbols;">










:#000000; font-family:Calibri,Helvetica,sans-serif">




















--_000_dafefcceea494c7cbd2953544290577ckmuttacth_--

Credential phishing Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 16 Dec 2025 09:46:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVYAn-00000000Hvy-0VZe

for dave@doctor.nl2k.ab.ca;

Tue, 16 Dec 2025 09:45:17 -0700

Resent-From: The Doctor

Resent-Date: Tue, 16 Dec 2025 09:45:17 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp-gw1.kmutt.ac.th ([202.44.11.210]:13878)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVXmY-00000000GMe-0Jqj

for root@mail.nl2k.ab.ca;

Tue, 16 Dec 2025 09:20:25 -0700

DomainKey-Signature: s=mailgw; d=kmutt.ac.th; c=nofws; q=dns;

h=X-CSE-ConnectionGUID:X-CSE-MsgGUID:

Authentication-Results:X-ThreatScanner-Verdict:

X-IPAS-Result:IronPort-PHdr:IronPort-Data:

IronPort-HdrOrdr:X-Talos-CUID:X-Talos-MUID:

X-IronPort-Anti-Spam-Filtered:X-IronPort-AV:Received:

Received:Received:From:To:Subject:Thread-Topic:

Thread-Index:Date:Message-ID:References:In-Reply-To:

Accept-Language:Content-Language:X-MS-Has-Attach:

X-MS-TNEF-Correlator:x-originating-ip:Content-Type:

MIME-Version;

b=UBWhif8On7O04GyjdcWJErtGSxucesAVtmJAcv1W5tU4j6lC7i7PFtaQ

0NeNCyrmM2VupGJLOILTzvfxxerVsxLOb3yhnKU54yhpJhYp0XP8ivHNF

iDStDNmVOOz0A/UQq0gRBE6aED0BYntVifwOEDYPANR49IAbrwRP7+1ge

wwu3TKYSA0q9Gff5IJZfcYSVF9R2Gnhp14FN791ad7VPsAs6zqXK8VGAj

dCoGnuSe8co5Rp+nHmFBTlY2VX8GHJRMkf0d2pnnj3n12glKGt85S0lKQ

b46bkqJ5lZ1OzBypLesdRPzyUJ2geLFnLh/ijY79RAnaHLlSafOhJTpVq

Q==;

DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;

d=kmutt.ac.th; i=@kmutt.ac.th; q=dns/txt; s=smtp-gw1;

t=1765902016; x=1797438016;

h=from:to:subject:date:message-id:references:in-reply-to:

mime-version;

bh=yigKvt4SjtOPWykE6olXHczlUTRWfU7m26MpXLoKSdM=;

b=r/ejwtXbbq63XXeqU4HCRwRkQFk1PLxHimZi4af/ITOUm89lUZqj4TYR

HZeMFtlyKAb0d92qVfcx4mkJxYn12K1kWbMchklDZnHkrtYLnGhFFcQag

zfScZ8M8cIMcx50zy1xm5j1/Q3cy3zMm5NpTT1mXPRpGR0IrGo7JtlR48

ZGabzkVU4X/yTM4CXSOgSPnuHzGvpDmowLXZClYdTrPC+VBsHAOjz0UhT

HztYcg/zn89K2jBs3gcLu32ekoQ44JKh5coJz1uZNQdY6K8ka6KXdQCK6

U2CWjxxjCEsDTtcZNDaWlYblaZ6xtTmuBGjrVwPJuMfNz2XwRr6M3L4s4

A==;

X-CSE-ConnectionGUID: 03RSSkIrTSuJOMPiaE/rxw==

X-CSE-MsgGUID: 4lA9GhxFSjeu6a90bqs6DQ==

Authentication-Results: mailout.kmutt.ac.th; dkim=none (message not signed) header.i=none

X-ThreatScanner-Verdict: Negative

X-IPAS-Result: =?us-ascii?q?A2HhWwDhhUFp/wELAgpaDnsJgUmBO1sogQaBOgEBLh0OA?=

=?us-ascii?q?QEBDYdpjiWGQYtuiRiCVxNlE3MGCQEBAQEBAQEBAQgBPRQEAQEDBIUAAkoBB?=

=?us-ascii?q?AECEAITAQGLcSc6BA0BAgQBAQEBAwIDAQEBAQEBAQEBAQELAQEBBQEBAQEBA?=

=?us-ascii?q?QYEAQEBAoEdhglGDYFVWwEUgUB2AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBA?=

=?us-ascii?q?QEBAQE+Ag1IDwodAgEDSEECAQgNIAQCEzElAgQbgnuCHRZAFLIAgS9hUxoCZ?=

=?us-ascii?q?YJ2ggbYfC0WgWcGgUyBaYQEgmUBKoE0hAeFAYILRIFKgnU+gVKBDwSBFwgKA?=

=?us-ascii?q?QELBQIBA1whAoViBIIiehQdgUOYFywmciIDJjMsAQ9GExcLBwWBI0MDgQsjS?=

=?us-ascii?q?wUtHYEjIR0XE2BUQINJGAZoDwaBERlJAgICBQJAOoFmIgYcEgIDAQICOlULg?=

=?us-ascii?q?XYCAgICghh+ggoPhz6BAQUugR8yAwsHZj03FBsIAYE1kzxcToFCOHcbPyFYV?=

=?us-ascii?q?oEcHIMFED2PPY9DgXyhaAMPByuDdIFkijqVQRIcF4QEk3kDkmuZBoJYizCVJ?=

=?us-ascii?q?AGFaAIEAgQFAhiCAgxdI3CCXgmBQVEXAo43gS0BAodciiG5OAR6OgIHCwEBA?=

=?us-ascii?q?wmGK4tAARkLDhUOCzwBQh4BAQ?=

IronPort-PHdr: A9a23:Ly7w0xXWNOAHuP/dSk+tnRCw9/zV8KxTUzF92vMcY1JmTK2v8tzYM

VDF4r011RmVBtmds6oP17KP6OigATVGvc3a9ihZMdRlbFwst4Y/p0QYGsmLCEn2frbBThcRO

4BvcmEg1FyAdXZvJcDlelfJqWez5zNBUj/2NA5yO/inUtWK15f/2O+94YDcbBtVjzShf7xyM

A+2rQLMvcUKnIduMKk8xxXGr3dSZ+ha2WxkKF2Pkxrh6Mq74Zpv/zhNt/47+MNNX6v3c74kQ

bFWCTgtLnw46tDsuRTfQgSD4WcRXH8LmRRSGQjF6x/6Xpb1siTks+d2xTeXM87rQ70qQDqu9

6hlRgfnhyseKTM3/3zZhtR/g6xHrh2hoQd/w5PPb4GOKPV+ZKLdcsgESmdHQ81cSjZOAoK4b

4sIEuoBIeNVpJTzqlcSsRezAxSnC+TzxzJGmnP6wLQ23/g8HQrb2AAsAtIDvHHSod7oNqkdT

Pq1wbHIwzvdcv1WxTnz5ovGch8joPGDQb1/fNHLxkUzFQPIlEmcpZD4Mz6Ty+8Ds3Kb7+1lV

e+3kWApqAN+ryS1yMkuloTHnp8exFTY+Ct82Yg7OcCzRUljYd6lEJpfrTmaN4tsTcMkWW1ou

jw1yr4dtJ64eSgK1YgnxwLFZ/Odb4eE+A7jVOaILDp+mXlqd66xiQyo/ki81u3zSNO00FBSo

yZbjNTBtGwA2wHd5MaIVvZx4lqs1CiT2g3S9+1IPU45m6XYJpM9zLM9ipoevEXDECL2hUj7j

rObe1kq9OW19+nqZKjtqJGbN49xkA7+M6Iul9S/DOgkLgQBRXCb+fyn1LH5+k35WrpKg/srm

afaqJDXPdkXqrKjDwNLyIov9guzAy273NgAgHULMEhJdA+dg4XoOVzCOu70APehj1mqjTxl3

erJPqf7DZXINnXDlbDhcqtj5ENE0wozyMxf54pTCrEcPPL/Qk/xu8LcDh8+KwG73enmB8l91

owEX2KPDbGWPL/PvVOS5eIvJvSMZJMJuDrnMfcq++TijWM5mVMFfKmp24UYaGygE/h7P0mVe

2Tgjs0cHWsXpAYyUfTmiFiYXj5SY3ayUbg85jY+CI++FYfDR4Csj6aZ3Ce7BJJWYHpKClKWH

nfrbIiEWPIMaD+OIs99iDALT6SuR5U91RGurAP60aZoLvLI+i0EspLuzMJ15+zPmhEy7zN0F

dmS33uJT25unmMHXT83075krENjxVaD0K14g/lfFdBJ+/xGSB82NYTAwOxiF9DyRgXBc8+TS

FahWdWpHzcxQckrzN8TeEt9HsmtjhXZ0CqxH78aiaaLCIYo/a3Gx3TxPdpyy27a1Kk9iFkrW

tFPNWq9hqFl8wjTHI3JkkWCmqaxaaQTxjLN+H2ezWaWpkFXTBZwUbnZXXAYfkbWt9P55lvYQ

L+0F7snNBdBxNWEKqRRbN3mk0lGSO3lONvFeW6+h32/CQ6SxryQdIrqZ3kd3CLFBUYYig4d5

2+KOxInCCm9uG/RECZuFU7zbE/2/ulxtGm3QVMuwA2SdU1uy6K1+gIJhfybU/4TxLUEuCA9q

zhvGVayxdPWC96aqwpneKVQf9A97E1d2m3CrQByIoavI7h4hlECawR3o1/u1xJvB4Valsgqq

3UqwxRyKKKayFNMbDaY0oz1OrLNMWny4A6ga7TM1l7Cytma4r0P5+ggq1X/oAGpEVIv829g0

9lT3HuT+pXKAxAUUZL+SEo46xh6qK/cYiQm+4PUzmdgMaiysj/M3dIlHuolygrzN+tYZZulJ

SbKM+Q8T+qHC8sQ0wyxbwMNJOBb8ug2NsCOdP6bxLLtNe0mgDLw3kpd54Uo6mO93hJcY8iA/

b8m5MvQihOGRj7kjF6n9ML+mqhHYCwOAiy2wm74BNgCNeVJYY8XBDL2cIWMzdJkisu0Bhawl

XamDlIC39K1PxmXckDhmwRbk1gX8jSrmiq9mjpzlTxh7q+SxzfHzOmqch0bcnVKS29vgRakI

YW9g90AGkn9aQ8vmXOY

IronPort-Data: A9a23:CMeqpagyyPjHuSgoee6LTcnMX161FxkKZh0ujC45NGQN5FlHY01je

htvX22FOf3bNmL8KtkjPoS2ox9V68KHmoNiSlBv/ChhRXkW8JqUDtmwEBz9bniYRiHhoOOLz

Cm8hv3odp1coqr0/0/1WlTZhSAik/nOHfykVLKs1hlZHWdMUD0mhQ9oh9k3i4tphcnRKw6Ws

LsemeWGULOe82AyaDt8B56r8ks14a2o4W1A5DTSWNgS1LPgvyhIZH4gDfzpR5fIatE8NvK3Q

e/F0Ia48gvxlz8xCsmom6rMaUYDRLjfJ2Cm0hK6jID733CuDgRrukoKHKJ0hXV/0l1lrPgoo

Dl5jqFcfC9yVkH6dETxZDEDe812FfUuFLYquhFTu+TLp6HNWyOEL/mDkCjalGDXkwp6KTgmy

BAWFNwCRkjYvdmNw5OhdtJxpOMGFMjiEcQFqm41mFk1Dd5+KXzCa6ja7t9R2jg93pkIHvPDe

9ZfYDEpcBSojx9nYw9RUtRnxaHx7pX8W2QwRFa9vasm6nDTxQo30rHuGNnQZ8CWA8xe2FqYz

o7D1zShUkhGaYbOodaD2i6or77gnTPVY4AfCeOxp6ZgmUbN6lVGXXX6UnP++5FVkHWWQdNUK

0UO9mwqpKg75UGDQ8n8Whi/5nWN1jYGXMFdFecz9SmIwa/d+BqUHC4PR1Zpcts9vcstRi0Cz

UOAg5X0bRR1t6WcU3+b6p+SpzW/JW4TJykJbEcsdyw9puHEmqk4lA7ECNloVqW85vXvHjbs6

zWDrSx4gbFJjogC3eOw9DjvmTWroJXYTBYd4w7SV3m54xk/b4fNT5av71fQ7f9GI8CSTlSHl

GQf3cmY4uZIDI3lvDaKROEAFbSB4v2AOSbAjEQpFJBJ3y6q4GWiVY5R7Dh6JU4vOcEBERfzZ

1TevwEBzJpYOXKxcaJtJYm4Y+wwyqLxE5LlUfTRY8FmYJhqdwPB9ygGTXSX1WHr1k0llaUyJ

YuWWd62CmgGBKAhxz2zL88H1rUm3Dw7zmLXWpn6yRmP3LOFeHqUT7RDO1LmRvo+5q6evDLK/

s5HM8aQ4xBEVqv1ZSy/2ZQUJ10QMT4pBIjrsddUZ8aIKw9mXmooY9fLxrksYZAjgaVam/3g9

Wu2WlJcjkf7jGPOLUOBYxhLcrTlUIxj62gqNCoEMluj12MpJ4GpqqwWH7MterMq7vAl1/dyQ

PQfU9+GCfFCRjXOvT8UBbHnq4NvbjyxjB2RPjCoZDUkZNhrTmTh4Nvpfxfp+TMmEi2trtc3u

fur32vzW50cTAlkENzbQPiiy1f3tnF1sPk0WkrML8NIPkPh7oVwLyvqg9c3JN0JIBTHgDCd0

m6+GlEYpO/AuKcp7tXSj+aPpu+BCK11Gk1HA2jW956yNCfX4W25wslLWY6gZyHRWXnx0KCpY

OxO0/zmdvYO9H5QooN6VbFwx6Uk4dbHvLRd0xh/Wn7CB3yxFb5qKFGZ0MNFvaoLzbYxkRGrR

ViS5fFVPLyIPIXuF1t5DDA4df+O0fVSgDDO7dw/LUH+oiR+lJKdTF5JMh3V1ARYJ758K58o2

6EqsaY+8RGkigAtIoyugSVd9mDKJXsFO409q5UeB4bDjwEuw0pebIaaASaeyIuSaNVXO1NsK

zuVrKHIjPJXzyLqaWY6FnHI1OlcrY4Jtx1Q1xkJIFHhssDeg/gz3RtK8jUfSQ9cwggB2OsbE

nJwPE1xLKaL9jFAi9JKWWGwFgdMGFuS/UmZ40ETk3zxSFG0V2vLJ2o7NeHL90lx23hFZSZD1

K+ZxGviTSzteof610MaQ0l1ofv5SvR28BHLgsGgEs2eA988bCaNqrWpem4FuhDrKcY6gUTcu

eRwuu15AYXhMiQdubF9E42T06gdYAucKXdFT+1+9bkEW2rbfVmawz+FIEmZYd9EPeCM+kbQI

/ZpLM9VS1KG3TyHojEALa4dL6Vzm/gkotEFf9vDP2kMvqGD6D9itZvL6iXkrHEgQ5NlmK4VM

ITbeiieVGmbgHJPh2LXhNROMSyzaLEsfgz33Omv/OEACZUCvadlb0Y526ectXiRNA1q41Sft

Wvrfa3dy+1o4YFnmoL3DqhZQQ69QfvpVu+g9Qu2us9SYMmJOs6mnxkXglTuMABbbesVR9gxn

r3lmMT22krOvbEeSGDQhN+KHsFh38S+UOpWdM3+KnVanAOJUYnp6BdF8Ge9QbRTkdhd48ChS

iO3b9X2c8V9c81cz31ccSVaOxMWDq3scqr64yi0x9yWCxMd2BbLMNqr73jyRWBeczcBK9v1A

2fcofel5tlCoI9FHgcJAe1rGbdyOlblRaUhbdG3vjDwJnOrn1aLoJPnnAYgry7CG3+JVsv2/

PrtfBn1dB2otOf3zNBFt4t5vTUPDGx8x+I5FmoH+tV2giq2SnIPKe4aLb0cAJpfl2r505SQT

CvMZ2srEym7RihNdwr969fLQAafD6oFM7/RPD0i/0qOZ2GtGIqODrx7+g9v5GkwcDClx+jPA

csf8X35JBT3x5pvRO0U4viTiv1mw7XRzxog40H2k8XoD1AbCLUHyWxJGQdBVCvCVcrKkS3jP

2k+RWleTAe/TlHZDctkZmUTHhwF1Bv1zj4oZD2DhtLSsYGSyuZow+D6ffj4lLYKBOwRLbUOW

G/6XUOR6GvQ3XpVsqJBk8gunqJxAOijG8O/JbT/SBdUlKjYwn4jNtkDgysCVswK5g9THlTBj

D6qpXM3bGyfLUlN2LCNzgMh45Z4TnkLCnfChWbXvzzclhE558PUcAWwwQT2Ndf2prSLl19fS

joIcACUqFifryfpvxF1v/Eb4FeOaekLEnPJSDxuS5rojhaqYGRHCLsn3Ep83Ns52GdDzIhOa

OCV3sss0JiuUiKImhvkldMeZ/5spt8pAAMJhqX1uhZmDfO13YL/NculLay9SBoVxxp/MXw71

cfecUCZKQvMrSFJXiZk/cbYI7Rm7b61za5+5lEyDNtbtZeZ2Z0WgIK1+0+lcWx+T6KLWJyfK

kvQ5fK6FhAfKFTgYY5bhVNQ2p7f8+906g7ti1DlO1mS3rqK025tSNpJjIQj2qWCV3ppNn07p

Rf0SvP5stfq+HqipEKy9FqzlKMeeRGuxYoZUQG4FHThPSg/soNjjaKctfmo7SIYDItBG5FC9

UouFUz33u3e/m0pWjzXfhQjRQvPGTKEGOiIIsQpS9aClsToat1xKdcC03pLTeFH6mNnrt9iN

i6/P7Kkj8lbV5VOfIKNr06aRS0qF4LXNBqVnsPhg2APM4C/B5Do6bfCFvKNkKTqPxubg3j2t

KAcgsBLgHbP2sEt5F5A3QxclMqqrOAT4W6ETQ2Q3QtMizrAPZCIwF7FBf1lpZT7rmkjnQg3y

I2yW2IJzrYvNsLqEDLDD8XdzgmdBUfKaw6c02aJPhoAG0a3pl848Jn3bb3opc3F9Sad0+kdn

Q6PQcQaHrIbGVE/PTdtJHB2q5gLjt/2SQXa89hyslJbClxNxCEvrxeoGKn3Wy3Ztj3eDI9+3

Hg=

IronPort-HdrOrdr: A9a23:R1S0XKOCVnYLCsBcTvajsMiBIKoaSvp037By7TEUdfUnSL3+qy

nOpoVh6faaslYssR0b9OxofZPwJE80lqQFm7X5X43SPzUO0VHAROoJ0WKh+UyDJ8SUzIFgPN

JbEpSWf+efMbEVt6rHCUKDYrAdKZG8gdmVbMnlvg9QcT0=

X-Talos-CUID: 9a23:kD4mYGGKYMzrzocrqmI/r3QvIcMEaEHm0VX3Bne5AEsuUq2KHAo=

X-Talos-MUID: =?us-ascii?q?9a23=3Az3QbjQ6ydGrSNuIbDcc2URu/xow0543/J0Adv64?=

=?us-ascii?q?EttTaPH0oMS6G0hiOF9o=3D?=

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-AV: E=Sophos;i="6.21,153,1763398800";

d="scan'208,217";a="80814529"

Received: from unknown (HELO exchange01.kmutt.ac.th) ([10.2.11.1])

by mailout.kmutt.ac.th with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 16 Dec 2025 23:19:16 +0700

Received: from exchange01.kmutt.ac.th (10.2.11.1) by exchange01.kmutt.ac.th

(192.168.1.238) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.38; Tue, 16 Dec

2025 23:19:16 +0700

Received: from exchange01.kmutt.ac.th ([fe80::d494:721b:c286:2f4d]) by

exchange01.kmutt.ac.th ([fe80::d494:721b:c286:2f4d%15]) with mapi id

15.02.1258.038; Tue, 16 Dec 2025 23:19:16 +0700

From: PIYAPHAN JAKOR

To: PIYAPHAN JAKOR

Subject: Re: UPDATE

Thread-Topic: UPDATE

Thread-Index: AQHcbqYjuYD8p/jfkUmZjFgvMfHe4bUkcg72

Date: Tue, 16 Dec 2025 16:19:15 +0000

Message-ID:

References: <70734567a445486ea27b544bc8320495@kmutt.ac.th>

In-Reply-To: <70734567a445486ea27b544bc8320495@kmutt.ac.th>

Accept-Language: en-US, th-TH

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip: [10.1.67.252]

Content-Type: multipart/alternative;

boundary="_000_dafefcceea494c7cbd2953544290577ckmuttacth_"

MIME-Version: 1.0

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

Benefits programme spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on


=?utf-8?B?bkJ0V1hET3pVSGtqT0RTTXlmVWk1RlltSWJpdFRRdkxOWE8zeWhrWDI3bkhL?=

=?utf-8?B?cFFKZjVnWmdLZnJnTkJFY1c2Nms2YkJSSXg3YldCNnBNTkVVOHNIY0ZVR0Fh?=

=?utf-8?B?VkNWZUJLbU5NZ2txbENCQkRsQW5mTmcydS9MS0pmeFgzbCtScjIwYjNISHJV?=

=?utf-8?B?T2IrSHhDRkdJUVpaUnR6c0NoVFlZMlVneDEvclprcVFqZjBoUWtnUFVJVnRj?=

=?utf-8?B?SE9aNytEZHFxamJaTDRrbklnMkZZSG0xdEYwTjhoOTFBSGhPcllSMEF2QWxO?=

=?utf-8?B?YzRDcHZadmhnWHpGakMwbEVaZnRKSTZ3TFNtVXVLOHZva0VoR25VS08wQkZZ?=

=?utf-8?B?cVRBYlVPZFNsY3U4M0k0UGhjZmFjRncxb3NUVGZrVms4OGlmNG9RL0p1bnVV?=

=?utf-8?Q?IVrk1hwsuQwUif+C3BpXBNgGq?=

X-OriginatorOrg: dld-ascent.com

X-MS-Exchange-CrossTenant-Network-Message-Id: f580e38b-1749-460f-4bd4-08de3cbcd9bf

X-MS-Exchange-CrossTenant-AuthSource: SA0PR07MB7657.namprd07.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Dec 2025 16:04:54.7450

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 26a196c2-e6d5-4e1c-9f42-ef9434a221f8

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: qikgg5fcUtWphCMcnmFLhdX3vlID/Ee35NWIs1sLgBFBbF3IQ8yXLFR4uZc19D0GQnRT+Lf6YeKUdi8UOIYnmg==

X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN0PR07MB8894

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Dave, I came across your profile and thought I’d reach

out directly. We recently helped a 50-person business save over $416,000

in 5 years through our benefits program, including free WorkSafe claims management

and locked-in health & dental rates for 6 years, all witho [...]



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10b6:806:bb:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:bb:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:bb:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:bb:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:bb:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:bb:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:bb:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:bb:0:0:0:15 listed in]

[will-spam-for-food.eu.org]

[52.101.52.133 listed in will-spam-for-food.eu.org]

[52.101.52.133 listed in will-spam-for-food.eu.org]

[52.101.52.133 listed in will-spam-for-food.eu.org]

[52.101.52.133 listed in will-spam-for-food.eu.org]

[52.101.52.133 listed in will-spam-for-food.eu.org]

[52.101.52.133 listed in will-spam-for-food.eu.org]

[52.101.52.133 listed in will-spam-for-food.eu.org]

[52.101.52.133 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.101.52.133 listed in dnsbl.ahbl.org]

[52.101.52.133 listed in dnsbl.ahbl.org]

[52.101.52.133 listed in dnsbl.ahbl.org]

[52.101.52.133 listed in dnsbl.ahbl.org]

[2603:10b6:806:bb:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:bb:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:bb:0:0:0:15 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:bb:0:0:0:15 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.101.52.133 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.101.52.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.101.52.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.101.52.133 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.101.52.133 listed in list.dnswl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.0 ARC_VALID Message has a valid ARC signature

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.101.52.133 listed in wl.mailspike.net]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 MONEY_NOHTML Lots of money in plain text

Subject: {SPAM?} Quick Question - Dave



Hi Dave,=C2=A0



I came across your profile and thought I=E2=80=99d reach out directly.



We recently helped a 50-person business save over $416,000 in 5 years throu=

gh our benefits program, including free WorkSafe claims management and lock=

ed-in health & dental rates for 6 years, all without changing providers.



If you=E2=80=99re open to it, I=E2=80=99d be happy to walk you through how =

it works.=C2=A0



Would you be opposed to a quick 10=E2=80=9315 minute call this week or next=

?



--

Ryan Stanimir

Partner

DLD Financial Group Ltd.

604.681.7185 (ext.3)







If you would no longer like to receive emails from me, please reply with =

=E2=80=9Cno thanks=E2=80=9D

=C2=A0

Benefits programme spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 16 Dec 2025 09:45:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVYAO-00000000HtW-3u9N

for dave@doctor.nl2k.ab.ca;

Tue, 16 Dec 2025 09:44:52 -0700

Resent-From: The Doctor

Resent-Date: Tue, 16 Dec 2025 09:44:52 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastusazon11021133.outbound.protection.outlook.com ([52.101.52.133]:59294 helo=BL2PR02CU003.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVXYa-00000000Fhp-3iK0

for root@nk.ca;

Tue, 16 Dec 2025 09:05:58 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=xrHJ5IRdQtqlG8FBv7zskJYxLEGTb82eEHLDV1cd09/0b9yJKiMJ+aGy32FWAAlRfpAIMmN33r6Kyqgsi7va3iexlznPmhaUECkK2nWH1SJrOq4YFugsCnXLkXw2eZt24t6TxRp1MUkKou1Ws8PQHvPLMQOgETyColGNP3yHcwOBJoNgujMRyfY9F+XC/SOBmsMUN62yC4jKKMpFEW1kTFy7y7ItDERWqSMvFqmAcVlmK26HrxWO2KCTv+IthhqXvk1kb6F6sRRkUoU7NqJr0eR19GcEdQZXWvm0buwURiDIX5WOWUGqm0rR4cR3YCP0penNS9QWfrDa9HZagKDhkA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=q55TmWk5xF83fRkgCAZfDohAMifYOwqtarj+3cBEvcs=;

b=doh0qoqpYQTI1mwCDDcYPfWKbUzDFuY7QhPo5a30yVEwd+TkA8yp4rp36gNuTYDAnkzmzmZVHbADBVYijvesyd7k+PtR9f2L/BgJq970rMjm8k5AFK3Kurn1TlGTomiedXzAjWTlWN2vlDpBE71K3r0MWA1sNa0mgFvS8ey10j22JIQdnercFqFH7Pl3xUT96Hh2F6g8WtF8/u4AzY8zOPYc19hEggj8EDRACX2ofAuMlf1X2N3nsbGbqBPq3IAdzrwZTkShS6O4G2mkb5aS7gLzhIyVjYqtCFZfsM5UUq2e95HZqVTu13RLaXEE0jJQOHkDEJIZV3xuE1hwkcktCQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=dld-ascent.com; dmarc=pass action=none

header.from=dld-ascent.com; dkim=pass header.d=dld-ascent.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dld-ascent.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=q55TmWk5xF83fRkgCAZfDohAMifYOwqtarj+3cBEvcs=;

b=HueyNaOw0qHGTg7vacl2FxStrg+eyJVgV2eZaIs//l2jXiRtM82ThJCQtoWJT7YiFHTubrKdNLb9lQk1+/2Uxw5HR2vTAo3Z0CLDmPYzKAS+9i4p2aMSdMHq2ndQVNVaDDOh1/t3YRoN2okCbCEH19u0XiaJXLXLP6fYpwtKo1I8e92gaQRG6Jwf/C/DMHcZBd7DDu5R/IuM+TjGJFAw4PGFUCbj7j4hmZ+SuKEMm+7qQQPdZNDl/BkxY+I+XtbzvJYEwtlAQgJcJJjGFDdr4CVwn4fA8+7O4yglvG7e+N8dMcLKQL11QWoqypJWj4iGXR37bRvJ3ufqYCfbrX2N3g==

Authentication-Results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=dld-ascent.com;

Received: from SA0PR07MB7657.namprd07.prod.outlook.com (2603:10b6:806:bb::15)

by BN0PR07MB8894.namprd07.prod.outlook.com (2603:10b6:408:16c::21) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9434.6; Tue, 16 Dec

2025 16:04:54 +0000

Received: from SA0PR07MB7657.namprd07.prod.outlook.com

([fe80::f491:bd7c:b645:58db]) by SA0PR07MB7657.namprd07.prod.outlook.com

([fe80::f491:bd7c:b645:58db%3]) with mapi id 15.20.9434.001; Tue, 16 Dec 2025

16:04:54 +0000

Message-ID: <019b27e8-4643-7df2-9770-1e1f6c058a96@dld-ascent.com>

From: Ryan Stanimir

To: root@nk.ca

Subject: Quick Question - Dave

Content-Transfer-Encoding: quoted-printable

Date: Tue, 16 Dec 2025 16:04:52 +0000

Content-Type: text/plain; charset=utf-8

X-ClientProxiedBy: CH0PR03CA0192.namprd03.prod.outlook.com

(2603:10b6:610:e4::17) To SA0PR07MB7657.namprd07.prod.outlook.com

(2603:10b6:806:bb::15)

MIME-Version: 1.0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SA0PR07MB7657:EE_|BN0PR07MB8894:EE_

X-MS-Office365-Filtering-Correlation-Id: f580e38b-1749-460f-4bd4-08de3cbcd9bf

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|1800799024;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?NXFQdDgydENxSmpEdU5PbnBuL0NxeG95R2duVHBMdnkxNGZsU1lpQmJTOUZw?=

=?utf-8?B?aHBJSmtvTVRoMjZUZFphN25UUUo1aEF0TzVJbExwbTR0K3lRQlNzblJTMjZE?=

=?utf-8?B?WlRvWWxiU1ZQNmFFOFZrUzRGVThPODY1b3F1cUtRYS9MQ20rbnU1cE5xSk5S?=

=?utf-8?B?Z2NOVzRlbDlrTkdYSDE1VGNFUDg4VkY0ZEswUmJPK2JrdFZ4MkVQeWozelF0?=

=?utf-8?B?R05HbG1VMGRkMXBOVVdnV3MrSE5TeEF0TWF3L2M0VTVKTHNBZE9yRzJGaFRo?=

=?utf-8?B?SlJuTUl2ajR0UzNFWU9vbWdibnViblI3dzRRV2taRU1oWStTSXRyT0dEZG5n?=

=?utf-8?B?K3o5RXhqYzVaRTFJRE16LzFPdlQ5eGw0U3NRRjN6OXRCYXYwNHNxc3BmKzND?=

=?utf-8?B?SEJ3TzNIS3UzbG1Vd1VUaWdvamRMRlpXamp5dEY4MEpndWRNd1BYbXJ5dXJz?=

=?utf-8?B?WTBmRVBMeTQyNWR4Z1hIS05UMHd0WFFlNkxZSEJCWnh1ajdsYXFUN1pUeTVB?=

=?utf-8?B?MlYxdEJDQm1HWFRzbTVBT002WXpkbGVFTE9YZWlzTXVKM2dDUTlXMTVHT0t5?=

=?utf-8?B?VmEydXdPbzhpOVM3VlVpMnlwUENVOFhtVm1tS1IxejZ1NnVhNXRObmNMQUNs?=

=?utf-8?B?UU1LOXNjWE9PY2VjUVZYM2tQeTgrS2JhTXRWT2xlZ08yeE1YbTJyc1NkVHRa?=

=?utf-8?B?SkhwWWtxbllqMi9xcFpMOHlDWlFCTnEzTzZUTUxwNFVmY2xjL3pkUnk0MXph?=

=?utf-8?B?MHpwYitseFdGNDBUa2hPdkozbWxxYXJTcGtaVGFIRUMwYWFCTWJ0SU9ObXE0?=

=?utf-8?B?bkQyNDJZZGk2aEN4RWZYSU1aWjlBbytMMCtwaFZOUnZqdUhRMlp0ZkVxT3Vn?=

=?utf-8?B?VS96VTh5WlV4cnJLTHVHdFFqZGRvdE9XNFFxSHJNMWluaS9IYnhNN3UzUitx?=

=?utf-8?B?M0ZYSlFGeXVTNS83c1hwS040TWlhZ1NKR3NLZnZqc1M5N3o0aUZtVG1xSE4w?=

=?utf-8?B?ekRCN1hKSnhqY3czUDdFR2crUGQ4ZW8vc0NHTUdBZWRKeTQ0TjFVU2puZTZY?=

=?utf-8?B?ZTNCUlpkYUVPa01hYlp4aGllWWUvRks0cGtENjQ1SEkrV0NEYkwrNGhScXJH?=

=?utf-8?B?V3pIdTh5Tmo3bmExSjNvUmtEL3pUVkRRQ3N3cHlWWU9tc2lYaXF2ZGVBL2h3?=

=?utf-8?B?MzY2TnNwVndnOW5VVnBtb3FpWnRQdEFvRnVjNVdXQnpDVDVzSkY3eTdsU3Nh?=

=?utf-8?B?YTBHdnRsRUZmdlN5VkFxTk9GcjRNckUvZ3FGclBERlUyYmJNVDdOTzFKWTdq?=

=?utf-8?B?UXRjWnAxaVBRZ1lsTTN5TnNtZUh4UFRjOHc1S0VDdVY3L2xOWGN5ZDd1S2Zt?=

=?utf-8?B?TjFEdHRGY2JVOTV3Vkp2QXpBaXptZWE4bXBJZngzQzVuZkQwbXdyT01QZXky?=

=?utf-8?B?QVhRYUwzejNKUHZFZStqTy9yZVBlenVKK2RQNzViNFlyNC9xQjJ2VDk5amh5?=

=?utf-8?B?TnJaa0Zwbk8xd0l1cTlmMGFXcXY2VkRxQmJtNnJpZmpaTmF1TFJDeFFGeWdB?=

=?utf-8?B?aC9sOTJyeDhPRGFrTXFIejRlRWlYcStmcVpCbmFCeUdpcXcvbERLelVUN3Fu?=

=?utf-8?B?UjZQd25pRHBNTHIrMDVSaHowYzliWnpvbUw1d0lrbTIxTjdVd3greUpPdG1p?=

=?utf-8?B?MlNaZXRPZzQydkdPZWQyUjVzZGxnVzU3RjZXWEdabG9XcllhdWUzeXd3NEpL?=

=?utf-8?B?eGNYWHZUbGpxY2FIWFJNcmdNQUJEVjVyKzZPK0FIMFZRMnpxYSsyTWxOTXlu?=

=?utf-8?B?ZHFkSHd2RHV1eVg3eGVYTUpvc0p5bVZFV005cWM3Mkw3TTE5a1BRQ2Q1Z1I0?=

=?utf-8?B?M3p4dWtKZ3BrYlpEVTRyU0I1eG1EREEyemNYU3RYZWNadDUzRXlGVVdJWjdD?=

=?utf-8?Q?EUCjYtxJtPmtNtm4mTMBHB9AIj5XR4M1?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA0PR07MB7657.namprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?aWsralNZcHhzWW1NQXBZTTFsejFIZHp4REgxeURyVytJakgvWXh2WTd0aTNO?=

=?utf-8?B?VFhTNEd4UnhKOGdBbTBuN3FmdHJ3dnF4T3FQWlRhcHZRZDVBZFR1ZXFWSy9K?=

=?utf-8?B?WWNwM0VYM2hOUUlDMFMrdlpJMUV5WUU3QVN2bU44TDV4SUFSSGpYZ25VeWpm?=

=?utf-8?B?bzg1NXN2M0dzZXNFcWcvZnJlWTJPYXNqaTgwK3VNZitUdjZNQnQ3enVsUitS?=

=?utf-8?B?QS9FckJSemVwYXFGS1BnaW9PVWFLeElJUDU5QzNJODZZcm1Gdkp3OWQ5Yi8y?=

=?utf-8?B?bzhVdjIzcVJRVVN5MDRnWWN2dDhsM2RVbkZsR0RUbUxVNXlUeXU3alVoVDkv?=

=?utf-8?B?MldDaTZYRDAvRWdBcFBNa0c3T0RIL3JzVThBUytSZm9GMVJSajhZeDhOVGFC?=

=?utf-8?B?RXBTRHNPZzdFZDJGN1FLMDdiU1V3cTBhdWVWV1ZPUE1tdjQvdStPczcyUkFv?=

=?utf-8?B?NXg1anlyMjhKd1piM2xKMUNLUndhYmlkVERLb3RIczI0SU5JNU5FVHAxdnJ6?=

=?utf-8?B?UTZDa0JmbiszWldSV2I3TWtoM215UnpvMi91b1hYN0xqdlJ0bnRmcTlFdDFi?=

=?utf-8?B?UndJMk5tTU02WXpTSmRpU1RDZVdFTTRsRVVLajF5VGRsbS9raXVDRUdhUHI2?=

=?utf-8?B?cTBwb1VHNm1IcFkrY2N2bEhORjdCOTRJa2grWUVjdlB2TW1mdU1aVkRhK2RB?=

=?utf-8?B?QjA5Y3NIUnAyaUg1WkpIZkxVMEJqdWZGOWphZWFnVTJVSFBibWtGSytxbzJn?=

=?utf-8?B?U0cvbnNNYmRCY0c5MkpYaVlQakFxNi9IdWdoRmhGc3c4bnpuU0FmWHdzQTla?=

=?utf-8?B?UFZURndJZWxKVnJPOWpMQVgwU0p5SW5JTXRxUVJGVENBbjBTcWJEbGFXc3lO?=

=?utf-8?B?NERUb0RSNHMvbTBZNU1xSXVMcHBlUVY4eEQ3L0pPOTRLY1JBUVhmQzNXeWVK?=

=?utf-8?B?Nkl3SStxVkZlRit4R2gvcThCY2xjaVROeExMVHk1SVlySTZYWGQvSGF6R2pK?=

=?utf-8?B?L2M2OUdQWkpTRk1CcEMxY3pCZ1F6aGlOaGtYN3hmaXo4eFlmSlh2S2VlOWs2?=

=?utf-8?B?UEsxTStFTWJJM2piTkdHQkgybTlTaDU1VCsvUHNFaXNmNm1VandNUnM5cW1t?=

=?utf-8?B?U0pzcFJPSk93N05GcTViQU1kbXl5MHd1UzN5UlJUbkFIbnYwdUR3TUtjU0Ju?=

=?utf-8?B?am1FZ1ZpTDFPM2xsMjFpb3V0TUFHMFREQXRkdmtib2ZaZTUzU3N4L0VuNFpH?=

=?utf-8?B?dGgxSGMvKzlFdHBSR0xDZ0I5cTFtcnlpRFkyQVZrQ0pFcm5IWnROMHpaS251?=

=?utf-8?B?Mlc1eFQyaVo3cFpKU2VXMk1iL1FEWUZSdGFJNkN5bHRJNnF4MFZzVzEvUk02?=

=?utf-8?B?YnIrRjZsa0l1Z0ZndU9WVmFnWkM3SzdETk5BZzU0bXpjbTU0cnVXMHQzS05N?=

=?utf-8?B?eU1jSGVoQjF4eVpGZHhmaWQ3bmNtUFNQcENtcytSWFpXZDBWRGFzdGxCOVRE?=

=?utf-8?B?bmE4eS9Qc1M1UEJsNWRLclorQjRmZkZWN2Rtb29adVRLdlFJaHl1ZXNxOEFU?=

=?utf-8?B?Y0RsOWJ2VEttOTVPQkl1TEdlcFQzY2RZRXBKVGZiUTR1MkhUMzFydW9vQkNS?=

=?utf-8?B?S2RjR29CYkpuWUJTdGFESHZrK01tVzNhZU5NcUFieVlyeldTUjJnYldyU1R0?=

Web/SEO/App Spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on
--_000_SEZPR01MB4630D7123A3626848CD45D8587AAASEZPR01MB4630apcp_

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: base64



SGV5IHNhbGVzQG5rLmNhLA0KDQpDYW4gSSBzZW5kIHlvdSBhIFNFTyBwYWNrYWdlIGFuZCBwcmlj

aW5nIGRldGFpbHM/IGlmIHlvdSdyZSBpbnRlcmVzdGVkLg0KDQpLaW5kIFJlZ2FyZHMsDQoNCkNh

bWlsYQ0KDQpGcm9tOiBDYW1pbGEgc21pdGgNCg0KU2VudDogMjkgTm92ZW1iZXIgMjAyNQ0KDQpU

bzogc2FsZXNAbmsuY2ENCg0KU3ViamVjdDogUmU6IEhpZ2gtSW1wYWN0IFNFTyBQYWNrYWdlIPCf

kqUgIiBzYWxlc0Buay5jYSAiDQoNCg0KDQpIaSBzYWxlc0Buay5jYSwNCg0KSnVzdCBhIHF1aWNr

IGZvbGxvdy11cCBhcyBJIGhhdmVu4oCZdCByZWNlaXZlZCBhIHJlcGx5IHRvIG15IGxhc3QgZW1h

aWwuDQoNCklmIGludGVyZXN0ZWQsIENhbiBJIHNlbmQgeW91IGEgU0VPIHBhY2thZ2UgYW5kIHBy

aWNpbmcgZGV0YWlscz8NCg0KS2luZHMgUmVnYXJkcywNCg0KQ2FtaWxhDQoNCkZyb206IENhbWls

YSBzbWl0aA0KDQpTZW50OiAxMSBPY3RvYmVyIDIwMjUNCg0KVG86IHNhbGVzQG5rLmNhDQoNClN1

YmplY3Q6IFJlOiBIaWdoLUltcGFjdCBTRU8gUGFja2FnZSDwn5KlICIgc2FsZXNAbmsuY2EgIg0K

DQoNCg0KSGV5IHNhbGVzQG5rLmNhLA0KDQpNeSBuYW1lIGlzIENhbWlsYSwgSSB3YXMgY2hlY2tp

bmcgeW91ciB3ZWJzaXRlIGFuZCBzZWUgeW91IGhhdmUgYSBnb29kIGRlc2lnbiBhbmQgaXQgbG9v

a3MgZ3JlYXQsIGJ1dCBpdOKAmXMgbm90IHJhbmtpbmcgb24gR29vZ2xlIGFuZCBvdGhlciBtYWpv

ciBzZWFyY2ggZW5naW5lLg0KDQpJ4oCZbSBhIFNFTyBFeHBlcnQgYW5kIEkgaGF2ZSBoZWxwZWQg

b3ZlciBtYW55IGJ1c2luZXNzZXMgcmFuayBvbiB0aGUgMXN0IFBhZ2Ugb2YgR29vZ2xlLg0KDQpN

eSByYXRlcyBhcmUgdmVyeSBhZmZvcmRhYmxlLiBMZXQgbWUga25vdyB3aGF0IHlvdSB0aGluay4N

Cg0KSGF2ZSBhIGdyZWF0IGRheSENCg0KS2luZCBSZWdhcmRzLA0KDQpDYW1pbGENCg==



--_000_SEZPR01MB4630D7123A3626848CD45D8587AAASEZPR01MB4630apcp_

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: base64



PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i

dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5Pg0KPHA+SGV5IDxzdHJv

bmc+c2FsZXNAbmsuY2EsPC9zdHJvbmc+PC9wPg0KPHA+PHN0cm9uZz48dT5DYW4gSSBzZW5kIHlv

dSBhIFNFTyBwYWNrYWdlIGFuZCBwcmljaW5nIGRldGFpbHM/PC91Pjwvc3Ryb25nPiZuYnNwO2lm

IHlvdSdyZSBpbnRlcmVzdGVkLjwvcD4NCjxwPktpbmQgUmVnYXJkcyw8L3A+DQo8cD48c3Ryb25n

PkNhbWlsYTwvc3Ryb25nPjwvcD4NCjxwPjxzdHJvbmc+RnJvbTo8L3N0cm9uZz4mbmJzcDtDYW1p

bGEgc21pdGg8L3A+DQo8cD48c3Ryb25nPlNlbnQ6PC9zdHJvbmc+Jm5ic3A7MjkgTm92ZW1iZXIg

MjAyNSA8L3A+DQo8cD48c3Ryb25nPlRvOjwvc3Ryb25nPiZuYnNwO3NhbGVzQG5rLmNhPC9wPg0K

PHA+PHN0cm9uZz5TdWJqZWN0Ojwvc3Ryb25nPiZuYnNwO1JlOiBIaWdoLUltcGFjdCBTRU8gUGFj

a2FnZSDwn5KlICZxdW90OyBzYWxlc0Buay5jYSAmcXVvdDs8L3A+DQo8cD4mbmJzcDs8L3A+DQo8

cD5IaSA8c3Ryb25nPnNhbGVzQG5rLmNhLDwvc3Ryb25nPjwvcD4NCjxwPkp1c3QgYSBxdWljayBm

b2xsb3ctdXAgYXMgSSBoYXZlbuKAmXQgcmVjZWl2ZWQgYSByZXBseSB0byBteSBsYXN0IGVtYWls

LjwvcD4NCjxwPklmIGludGVyZXN0ZWQsIDxzdHJvbmc+PHU+Q2FuIEkgc2VuZCB5b3UgYSBTRU8g

cGFja2FnZSBhbmQgcHJpY2luZyBkZXRhaWxzPzwvdT4mbmJzcDs8L3N0cm9uZz48L3A+DQo8cD5L

aW5kcyBSZWdhcmRzLDwvcD4NCjxwPjxzdHJvbmc+Q2FtaWxhPC9zdHJvbmc+PC9wPg0KPHA+PHN0

cm9uZz5Gcm9tOjwvc3Ryb25nPiZuYnNwO0NhbWlsYSBzbWl0aDwvcD4NCjxwPjxzdHJvbmc+U2Vu

dDo8L3N0cm9uZz4mbmJzcDsxMSBPY3RvYmVyIDIwMjU8L3A+DQo8cD48c3Ryb25nPlRvOjwvc3Ry

b25nPiZuYnNwO3NhbGVzQG5rLmNhPC9wPg0KPHA+PHN0cm9uZz5TdWJqZWN0Ojwvc3Ryb25nPiZu

YnNwO1JlOiBIaWdoLUltcGFjdCBTRU8gUGFja2FnZSDwn5KlICZxdW90OyBzYWxlc0Buay5jYSAm

cXVvdDs8L3A+DQo8cD4mbmJzcDs8L3A+DQo8cD5IZXkgPHN0cm9uZz5zYWxlc0Buay5jYSw8L3N0

cm9uZz48L3A+DQo8cD5NeSBuYW1lIGlzIDxzdHJvbmc+Q2FtaWxhPC9zdHJvbmc+LCBJIHdhcyBj

aGVja2luZyB5b3VyIHdlYnNpdGUgYW5kIHNlZSB5b3UgaGF2ZSBhIGdvb2QgZGVzaWduIGFuZCBp

dCBsb29rcyBncmVhdCwgYnV0IGl04oCZcyBub3QgcmFua2luZyBvbiBHb29nbGUgYW5kIG90aGVy

IG1ham9yIHNlYXJjaCBlbmdpbmUuPC9wPg0KPHA+SeKAmW0gYSBTRU8gRXhwZXJ0IGFuZCBJIGhh

dmUgaGVscGVkIG92ZXIgbWFueSBidXNpbmVzc2VzIHJhbmsgb24gdGhlIDFzdCBQYWdlIG9mIEdv

b2dsZS48L3A+DQo8cD48c3Ryb25nPk15IHJhdGVzIGFyZSB2ZXJ5IGFmZm9yZGFibGUuIExldCBt

ZSBrbm93IHdoYXQgeW91IHRoaW5rLjwvc3Ryb25nPjwvcD4NCjxwPkhhdmUgYSBncmVhdCBkYXkh

PC9wPg0KPHA+S2luZCBSZWdhcmRzLDwvcD4NCjxwPjxzdHJvbmc+Q2FtaWxhPC9zdHJvbmc+PC9w

Pg0KPC9ib2R5Pg0KPC9odG1sPg0K



--_000_SEZPR01MB4630D7123A3626848CD45D8587AAASEZPR01MB4630apcp_--

Web/SEO/App Spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 16 Dec 2025 09:45:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVY9x-00000000HrN-007s

for dave@doctor.nl2k.ab.ca;

Tue, 16 Dec 2025 09:44:25 -0700

Resent-From: The Doctor

Resent-Date: Tue, 16 Dec 2025 09:44:24 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japaneastazolkn19013077.outbound.protection.outlook.com ([52.103.43.77]:5999 helo=TYDPR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVXMt-00000000Ew5-35rA

for sales@nk.ca;

Tue, 16 Dec 2025 08:53:54 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=CMVjDV3whJw+WdoFpCJHiW77C1BHQN9u12bPRAEVpPNBVareiU/e0CRzGwsvks6PgE9xIZC6WGGnZCA0q53tKlFq6HBd/f9Ca/OJCwQdu/ixP2Zz9xr7e642fZOyeCbwrUeJp6CmYffhwi/jDWWZNgvHA74SGkJifJpX9UNQK0ODRVqxSwFwmnfXHFvoXIkt8ZwAzPQY/cZLa60W+G77ywRz6YNywCeqH1FVGzg+Tz0QiONxgCXTtrVconAYHKn3IhCPL2pTWlWn4mWsGrxWOzxMRc7MeKqWqwEm9VvioqCt05tQ5PP0N1tB+3ovaktJAnV/neBu9hEyOgh/LAB6bw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=QBuOyHROCvNH8oajwfJhh5yAvS5poywTpJ4m83ONGA4=;

b=P1BAhoxVBgRUIqmAOi2r+urMxfdpP1OVTO0whIbB4xlEAM53DyDZ9pxuOm9FQoT7hsTPy72H/p5TiO/r7RoOwdBTjqyr72RDlIxdzaPtCmfAo/oLLGtLok+AzHKwx1BhkgC3h7WigydwbzU+NPtXYJO2WaJ9Uf3Q1biRuKDAhbEDe9fFN1KPJvW4K3vbb1DwvYSMIk+6D0OP7TKmH4ryMtUFGq2feQ4Er/xlfVyG/90lTVUO/UD6n8Vk3BwQn3Hu0p3vwpSiVkq1Gz1bIeV/qHTI1enu3DiUuPp86xECTblDfCQCPK0gVfR6K+yUzRIJAYsBoE1YgPG/dI44+U+geg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=QBuOyHROCvNH8oajwfJhh5yAvS5poywTpJ4m83ONGA4=;

b=kO7OXWmx//6cvqh3nVbMHI1l1hpKPDF0S+26ytdEvo2a/NOoP0HNKHmV0KpcCRjBox+C6qvxmqCDudRuwqn9IPJ7Zk7KsgK8HZEfaK3Pfa4/f1ukyGG781HFbjFT/PNolx9Pis5ISGlje6pN6vOTa8ikJqTn8vOoNfOaTOtPcCyCZ4kdfCqpPokvwTInGa8g+zyytEjb0vExhqyIoe9e8ijfXu9V86Avmnv4iYAWiHFVUlOFK4+FHQRogefUt44MjPFnjCQXX/UZjxVwtzjRBp2YHQTkcHC6OSkyEFr2Q7nepg2BnBttLmef++r8fuQPkZ8q141DdSapIXUOOu7f5w==

Received: from SEZPR01MB4630.apcprd01.prod.exchangelabs.com

(2603:1096:101:95::6) by KUZPR01MB7892.apcprd01.prod.exchangelabs.com

(2603:1096:d10:58::6) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9434.6; Tue, 16 Dec

2025 15:52:50 +0000

Received: from SEZPR01MB4630.apcprd01.prod.exchangelabs.com

([fe80::9141:ecca:caa4:3ddd]) by SEZPR01MB4630.apcprd01.prod.exchangelabs.com

([fe80::9141:ecca:caa4:3ddd%5]) with mapi id 15.20.9412.011; Tue, 16 Dec 2025

15:52:50 +0000

From: Camila smith

To: "sales@nk.ca"

Subject:

=?utf-8?B?UmU6IEhpZ2gtSW1wYWN0IFNFTyBQYWNrYWdlIPCfkqUgIiBzYWxlc0Buay5j?=

=?utf-8?Q?a_"?=

Thread-Topic:

=?utf-8?B?SGlnaC1JbXBhY3QgU0VPIFBhY2thZ2Ug8J+SpSAiIHNhbGVzQG5rLmNhICI=?=

Thread-Index: AQHcbqQHy6e0w8nsRU6E8E9Aa9Ynww==

Date: Tue, 16 Dec 2025 15:52:50 +0000

Message-ID:



Accept-Language: en-IN, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SEZPR01MB4630:EE_|KUZPR01MB7892:EE_

x-ms-office365-filtering-correlation-id: 16b3b406-4fc2-43e4-00fc-08de3cbb2a65

x-ms-exchange-slblob-mailprops:

gMiuAN0LASIPtJFHWBzvUtRfhjUdI+tGno24p7rhTGR/oZcoXlrl+rrv4af0gTokSSGGPRn79TAHjfeSCkVublOBqnnhojKmcquUYMeg/qfDVZbXDpFGm6vOjO1ERZ+UGc5XuQOu7BBABr4Q541T416bcreEz/DhxCV6VM1H/W49SKCtKxUBIA6AxyPuuAPtdr7240LgonqrNhKPEpdbE/pvpuB6tVEtWrIEp1nKhT4/TcIwYI1EDnDbouo13cDxzY7AMqfJgh1ylYmjwszUf5NODz9+N+Kxv8QKBFVpN295mvhMxziLjNYX33wg8+jOrlKjR/MXYX6LmDsGGch3SSTnJE51hmmRxEtH6jvCugpAqQiJ9x9HJSA3vQaDxkxlt8IDyQMtyA8sQ0G+D1kCmTwKWpwR26xoMfmA/b6R8n/neNqV6WXAlcIyIOzSbZGOhlzzEzmuPuy2AhyQgSJ+04QDAM+Yu2dp4qD5jucFlt1ecX0+qn/XnMk/6MSPBlvoCCZKBKDfmxuIioBQlbhnQ230z/0sSI9+US94JEvP3k9oorthw62QoZ1pptK87sDjPiUz3aHwt+FXgGzsSY1SGsVfgsAegqQjsj66nAwonqZYHE7Y9T36ees38js69FccExWTWy/aQrWoqZje6AArDF6W3h4xoFEWN1XuV/YiJvSJhqahAMnwL1tr0q+9qXeongUNWmX85EEr25gWO4EDTA==

x-microsoft-antispam:

BCL:0;ARA:14566002|7042599007|38102599003|15080799012|461199028|31061999003|5062599005|41001999006|8060799015|8062599012|39105399006|19110799012|3412199025|440099028|40105399003|102099032|13041999003;

x-microsoft-antispam-message-info:

=?utf-8?B?UDNyTTFnR3Z2VDRSWGtja1dDaHI2WXFGUnFveDRVMFlIS2FZWTNHN1U4RHM5?=

=?utf-8?B?VC9oRHp6SG9RQzRFL3dRQTVxZ3NFMEdTSVpnbk9PUit0UkxBTmdFdWt6SWhM?=

=?utf-8?B?KzErdVN1YTlhbnJURDBFNktGS1VxbkdWdjVRTjcrcVpHemJ4RlVPU3FOV2Qv?=

=?utf-8?B?dVlhQkFOTTRoRzIrblczSSt1UmNBdjhpT0hNandyalZYUDJ2a0svK0o1MVFn?=

=?utf-8?B?OHN0TW1vbHNBMFkyTllhcGtKbklSZVVNV1l4QVdhOFI1QUJ6eEFoQ3RiMHY2?=

=?utf-8?B?R09SZHJOeC9QSVVDc1piZHJZOHVmMWxSMlFiSG5IU1NXWmNkVE1oMmh2OXJF?=

=?utf-8?B?NXd3THZwaUs3SkpOSDRUMDFDSlUraTI2citZNWlGR1ZNekU1TVhDQVV2Skk3?=

=?utf-8?B?UUowY3JZTStvU1BQVW15MUhLZ1lGVFVSdXJKeVlJRWVWMUh6NVdBYllQKzN3?=

=?utf-8?B?S1FJaklSTVc4Y0NmMGlQSXhsMjhZT2JGSjJ5cS9BQ1g4dVhqaEpIaDVtYXU5?=

=?utf-8?B?aGJVbWsxNzNiK2daU0dYUVhMREE5SUVRaWpOWWVyQWlDS0UvZ2xXU1o0N09Z?=

=?utf-8?B?RUhXcFFIZkpUbTVObkt2MEhHamJOeE9KdE9sVy9hd3hEOWRTaXlMNDNlNDFq?=

=?utf-8?B?R3c0NnVVYlhhcldFSjk1VDlUSmE1VjN1aFdoUytBcjRuWFR1aG5SYmNGT0tB?=

=?utf-8?B?dURLNmZkODE4ajJIeWNSTGxBM2t3WW9sYlZPUVBYWkozR1lKdzM4emxsZmpy?=

=?utf-8?B?ZWp0cnR4U0tDN0ExVWRackM5ZzZkVDJndEdWVUFBVHd1L2FxeFo5SHZ6ckhz?=

=?utf-8?B?NE5NRDIyeDJMYlJlS3BJcWdrRWxKeXpGakVab0t6cEJPeVFGK2RUdWIzbkN3?=

=?utf-8?B?WEdqaW12OTNFcTUzTlZueSs4R2haRmxoMGxvSHRZYXI4Z1NSOU5nWlFiNTFp?=

=?utf-8?B?K203RUVMVkdrTWFCR3BmK3lCOUtMWnM0K0wxeEZzU0pPSi9RdzJNTFUwYndF?=

=?utf-8?B?WVpheTlacFBMR1d3YkUvZzQyclZBRWgzMHdETmFYYXYvNlV4Q1lVL3RXQitU?=

=?utf-8?B?MzJPRFhUU0M0WjRpU1NGQThoYjBzSWpubDJqaXg5S0pPNjVUaWIwSXlyQnc1?=

=?utf-8?B?cGg0WkEzRTNJem1Xd1NpRTVoQlpJR1U0T3F1VlJmNVZWTWhZYWRiRVp6UUM3?=

=?utf-8?B?dVYvR24zaWFhTDJBOStldXhyL0pyelA3SFpWRlNDendrN1M5STgxYlNWelNC?=

=?utf-8?B?NjBXQmpPUFZXcUgxQkpIKzhmQ0lxb2JBK3NBYlBKbEoraU5VL1FzUzdHWjVB?=

=?utf-8?B?YUdxUlV0dDFMRllyeVlUZVNLWDl6QTdUQ0tLRUVwUXU4UXFTenhhYkpvdGFM?=

=?utf-8?B?WWZTM0RFZFVZS1BkOWNzd0d4Uk9xMDdBQitZd3lWL2J4Wk9vNkVFRHNGYWdJ?=

=?utf-8?B?NGRkeHhLd2VrdVlZdys3WjZzVlBMUVp3OG92Vk5JVzJJOXlrWlBPa3BCRmdj?=

=?utf-8?B?RGJqWUVYRkxvenVndWdCZXIrQlk0LzFNNWl6M1F2TWk1M01nbmdnaFJVSWZR?=

=?utf-8?B?c2h2RnhDdmZ1SmN0Q1FDZFlRaERsZVlNSlhqSHc3UGsvMXhzMlhXbFFTem1C?=

=?utf-8?B?aUJsWGwrdGltQTliYWtYR0UvTVdEbW44V3huNXJVR3krd0lvVXNpZ09LaG1R?=

=?utf-8?B?NnRuVWRIS21Na3dldnhsa0FZMmVack04OUFXZHk4MWVUSkpVcXltTi8wakFt?=

=?utf-8?B?MWN1bkF6VzcwUkV1K1lwZ2tPTEdLVE9rZnNrTWFlV29iYjNQUnpBai9yaVhH?=

=?utf-8?B?SEpMdjhiR0pkRFZBWWRTQT09?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?utf-8?B?QzJQVW4vM25jTkFYekd1dlhMcGo2QXhFMXRXaStxZUxSYXVKSnN0dmJZYVh3?=

=?utf-8?B?ak9KY3l6QUhsYmhpaDVHZjBwOWZReWVaYS9BdDJKcVo2TXRLUXM0ZXJDVjVU?=

=?utf-8?B?QWhmY1lkVEJzc3AxWGdPV2t6ZkhrczBZY1V1ekZLRy9BaHhLaWI1anEyODdz?=

=?utf-8?B?TVRqTVQvbkxVNE9uQXZIcUFSU05xMlVqaEthYnRQbFhadkFTV0lIWXJvQmhQ?=

=?utf-8?B?dlR5TTJwTzdDdVV4Ui8rb1NHTmtFbTQrcmpJL0QyREw3QmRDRDJCWjY3Q1VZ?=

=?utf-8?B?OXU4WTJwRW1BZUswYS9PSThFUkQ2b0d1UklhSDFKclB0SllrcUlKQVFLSVBV?=

=?utf-8?B?VktFOEs0SE80YllGYUE1SXVDMnZQTlNwRDBtMjJzd3dpdVZYcDRFcE40QVp4?=

=?utf-8?B?Z3A4Qml0aXZIcVpKYjQ1czVEWWNXdmlSWldkSm52TGE5WGhvL2I2STg3QlBC?=

=?utf-8?B?REc4d2g3WlpNcllIbkE1bDRGaUhiYkx4MzM0S0cvWHVkWFRUWFJXKzVHYmVQ?=

=?utf-8?B?TlJkbXlpaTh3cFZNU1RSMFM2TE5WMVBkUkpGRFNCQ3FEQkkxL0FueWJEbUxZ?=

=?utf-8?B?bTUrUENSQ0o1dWlkNm00cGdRalRHcGd3TzZpVnpOemxueStBOW0xaDRpN0x2?=

=?utf-8?B?NDVaVXkycHdtWmN3Y2NMaFRBNkgzZk01by9rclEwS2NvUGZvN0xRUWQrN2ZG?=

=?utf-8?B?aHVGZ1BueVFaUFk4L1VoOWFQVXNwWm5OZmxKLzlUazkreHlMei9WTW1yZlIy?=

=?utf-8?B?SDBxbVpDVE5KUFU2bEoyTjMzUE5GZXhsNVd1SGhvbnNwcjJuK2lnUlZmYUdW?=

=?utf-8?B?dFQzQ1NyTmJJd3lwUWJCU0Fzc3lqUlgwV2d3dXVYaWpWaHR6cXEvck8xaWF3?=

=?utf-8?B?dUZUYitWdkNXbzhSTllaTDg0NjA3QU5HSVZIbUZscElyUDdDZUdvRHdJUk9s?=

=?utf-8?B?ckt4MjBuVDZxV2JrL1c2eHhxdXExanRBeW1hdC9oaVRPNFMrdGZ4dFdXSlZs?=

=?utf-8?B?OWdDVVV5TXNQa3NmM3J5R3J1M0FIYWZ4b2R6blk3Q2VodVdvQUZUWFVXS1VG?=

=?utf-8?B?UUFTY2N3SzQvT3B0dk00Qy9VSkZoNzVUTVYzSE9oUHBOeThkZml6YXlTSUlM?=

=?utf-8?B?WW1kNXdtbENRS0JvZnZDb2VENUd6eWt3bnBpUHlqNUoxK090VXY1WmltWUZn?=

=?utf-8?B?L0h6R01nR2swWElNaS9EUXZGeUVUTEFDYmlINzJOWTRER3ZzYzJpWXJmSEJG?=

=?utf-8?B?djR1d2xoejhGQXB5eDRKMkhwaW5tSGRJelk0WmpqbXBhQTBBS29QZmNFNzA3?=

=?utf-8?B?RlA5UkllZjRqcDViRVRTUmdpN0dOK09DM3AwSU9xK3hKcXdyK2Zhb3ZNYjds?=

=?utf-8?B?L2h1dmQ4VzdBMlAxdFhHNkZSK0F6S2pITmJjTHkzY0xoK0MzQkM3SjRnVkpW?=

=?utf-8?B?enNhOTNUUWdYajE0R05PNjNzK2tUeEZjNWxnaW9oYUlsdERFZ1VxT3hPT3li?=

=?utf-8?B?TjZTV0lPQ2xyMXBadVdheHJEU1RhMkRZQ1VJejVvdUtpQ0RxMWljbDhBVVJI?=

=?utf-8?B?TnA4UkhnbnZPbHhXQzJPQWdIUzJpTmRndDVWelVQc0tTMSsxS0F1djRuVVZi?=

=?utf-8?Q?jhdJPzQXnqRbrczulSg/83hmHFcNRmH9STXP5yBAhZZc=3D?=

Content-Type: multipart/alternative;

boundary="_000_SEZPR01MB4630D7123A3626848CD45D8587AAASEZPR01MB4630apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SEZPR01MB4630.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 16b3b406-4fc2-43e4-00fc-08de3cbb2a65

X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Dec 2025 15:52:50.0469

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: KUZPR01MB7892

Chinese products spam part 2

Posted by Dave Yadallee on

Hi Manager=EF=BC=8C


"color:#000000">Nice day. This is Bill Sun from Tianjin Tianfei High Tech Valv=

e Co,.Ltd. We are motorized valves manufacturer with over 20 years in Tianjin =

City. We have 5 production centers in China. And motorized valves is one of ou=

r hot-selling product. Here are 2 production line combine with mini valves and=

industry valves. Glad to know your side may have such kind related demands.
span>


/11/2025/12/Motorized-Valves-1.jpg" _src=3D"https://www.motorisevanne.com/wp-c=

ontent/uploads/sites/11/2025/12/Motorized-Valves-1.jpg"/>


2" cellspacing=3D"0" cellpadding=3D"0" data-mce-style=3D"border-collapse: coll=

apse; width: 723px; border-color: #000000;" data-mce-selected=3D"1" style=3D"c=

olor: rgb(0, 0, 0);font-family: Verdana, Arial, Helvetica, sans-serif;font-siz=

e: 12px;text-wrap-mode: wrap;width: 723px;border-color: rgb(0, 0, 0)"><=

tr data-mce-style=3D"height: 19px;" style=3D"height: 19px">
tyle=3D"height: 20px;" style=3D"height: 20px">
d height=3D"20" data-mce-style=3D"border-color: #000000; background-color: #ff=

f5f5; width: 719px;" data-mce-selected=3D"1" style=3D"margin: 8px;background-c=

olor: rgb(255, 245, 245);border-color: rgb(0, 0, 0);width: 719px">
"font-size:16px">3. International logistics leading companies have long cooper=

ation time and offer big discounts
t: 20px;" style=3D"height: 20px"><=

/tr>
yle=3D"height: 20px;" style=3D"height: 20px">
ce-style=3D"height: 20px;" style=3D"height: 20px">

ata-mce-style=3D"border-color: #000000; background-color: #fff5f5; text-align:=

center; width: 719px;" data-mce-selected=3D"1" style=3D"margin: 8px;backgroun=

d-color: rgb(255, 245, 245);border-color: rgb(0, 0, 0);text-align: center;widt=

h: 719px">
ht: 21px;font-size:18px">Why Choose Us

=3D"border-color: #000000; background-color: #fff5f5; width: 719px;" data-mce-=

selected=3D"1" style=3D"margin: 8px;background-color: rgb(255, 245, 245);borde=

r-color: rgb(0, 0, 0);width: 719px">1. Large Pr=

oduction Capacity. Each day over units completed ready out of factory.<=

/td>

t=3D"20" data-mce-style=3D"border-color: #000000; background-color: #fff5f5; w=

idth: 719px;" data-mce-selected=3D"1" style=3D"margin: 8px;background-color: r=

gb(255, 245, 245);border-color: rgb(0, 0, 0);width: 719px">
-size:16px">2. Directly Factory Sell. No middleman earn the price difference.<=

/span>

lor: #000000; background-color: #fff5f5; width: 719px;" data-mce-selected=3D"1=

" style=3D"margin: 8px;background-color: rgb(255, 245, 245);border-color: rgb(=

0, 0, 0);width: 719px">4. The production line h=

as strict control and we regards product quality as the lifeline.

20" data-mce-style=3D"border-color: #000000; background-color: #fff5f5; width:=

719px;" data-mce-selected=3D"1" style=3D"margin: 8px;background-color: rgb(25=

5, 245, 245);border-color: rgb(0, 0, 0);width: 719px">
:16px">5. The products are widely sold in domestic and abroad, with a wide ran=

ge of applications and large market demanding.

"border-color: #000000; background-color: #fff5f5; width: 719px;" data-mce-sel=

ected=3D"1" style=3D"margin: 8px;background-color: rgb(255, 245, 245);border-c=

olor: rgb(0, 0, 0);width: 719px">
f;" style=3D"line-height: 18px;font-size:16px;;color:#00b0f0">6.
-style=3D"mso-spacerun: yes;" style=3D"line-height: 18px;"> 
style=3D"line-height: 18px;">Accept label, color, voltage, wire customization =

to meet various customization needs

tyle=3D"border-color: #000000; background-color: #fff5f5; width: 719px;" data-=

mce-selected=3D"1" style=3D"margin: 8px;background-color: rgb(255, 245, 245);b=

order-color: rgb(0, 0, 0);width: 719px">7. MOQ =

1, can relieve financial pressure, also can ship goods to your final user.
an>

Once your side m=

eet such kind needs, feel free let me know.


#000000">Regards,

Bill Sun
p>

Chinese products spam part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 16 Dec 2025 07:38:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVWB6-00000000OC7-2DF9

for dave@doctor.nl2k.ab.ca;

Tue, 16 Dec 2025 07:37:28 -0700

Resent-From: The Doctor

Resent-Date: Tue, 16 Dec 2025 07:37:28 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out196-31.us.a.dm.aliyun.com ([47.90.196.31]:28881)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vVQjQ-00000000ESz-0y73

for root@nk.ca;

Tue, 16 Dec 2025 01:48:41 -0700

X-AliDM-RcptTo: cm9vdEBuay5jYQ==

Feedback-ID: default:vip@vip0.motorizedvalves.ltd:alibabak_WebBatch:306498

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=vip0.motorizedvalves.ltd; s=aliyun-cn-hangzhou;

t=1765874809; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=cFcpJSmnh4HuC9sPhXttbO8bI/nu780QSl5zKOTQBbY=;

b=I/YVjjtcX6AQGFD3jgMV7s9/zJBXQP6eZju35Z65vI96RkOUodkYVBvLJUJ2ckuzgKKm3oa4iJnNGTB+tZTTfWaOaeumZ6WtxMKAsx7SFejXcy/W19yWn9Or/nppUYYj2gCKAoUjuub/DQa1jn36knEMkH/TRSOHVBUqzdG2lYE=

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dm-fbl.aliyuncs.com; s=feedback;

t=1765874809; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=cFcpJSmnh4HuC9sPhXttbO8bI/nu780QSl5zKOTQBbY=;

b=fZqYnTmUWQzMOxBlEF/IjYOhyzKO3EKmcdh+oUh9J5FfL0FX4z5hLzvwHGCaaIFX6a24pt+C1BpVFcZMb4P+voqtpFqAuoV5L4oPXQBk0NvUNdblt+jtTfr6LAqjyGht3puaW8403a5NhJb2W5AFQB/+Ft6rj+iGz6vKSk0qcFM=

Received: from chitu-hsf(mailfrom:vip@vip0.motorizedvalves.ltd fp:ma_600000253265311017 cluster:AY35D)

by smtp.aliyun-inc.com(127.0.0.1);

Tue, 16 Dec 2025 16:43:58 +0800

Date: Tue, 16 Dec 2025 16:43:58 +0800

From: "Bill Sun"

To:

Reply-To:

Message-ID:

Subject: =?UTF-8?B?T0VNIE1vdG9yaXplZCBWYWx2ZXMgRmFjdG9yeQ==?=

X-Priority: 3

MIME-Version: 1.0

X-EnvId: 600000253265311018

X-AliDM-Settings: eyJPdXRib3VuZElwIjp7IklwTGlzdCI6W10sIklwUG9vbElkIjoiIn0sIlVuc3Vic2NyaWJlIjp7IkZpbHRlckxldmVsIjoiZGVmYXVsdCIsIkxpbmtUeXBlIjoiZGVmYXVsdCJ9LCJWZXJzaW9uIjoiMS4wIn0=

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 9.9

X-Spam_score_int: 99

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Manager， Nice day. This is Bill Sun from Tianjin Tianfei

High Tech Valve Co,.Ltd. We are motorized valves manufacturer with over 20

years in Tianjin City. We have 5 production centers in China. And motorized

v [...]



Content analysis details: (9.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[47.90.196.31 listed in will-spam-for-food.eu.org]

[47.90.196.31 listed in will-spam-for-food.eu.org]

[47.90.196.31 listed in will-spam-for-food.eu.org]

[47.90.196.31 listed in will-spam-for-food.eu.org]

[47.90.196.31 listed in will-spam-for-food.eu.org]

[47.90.196.31 listed in will-spam-for-food.eu.org]

[47.90.196.31 listed in will-spam-for-food.eu.org]

[47.90.196.31 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[47.90.196.31 listed in dnsbl.ahbl.org]

[47.90.196.31 listed in dnsbl.ahbl.org]

[47.90.196.31 listed in dnsbl.ahbl.org]

[47.90.196.31 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[47.90.196.31 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[47.90.196.31 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[47.90.196.31 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[47.90.196.31 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[47.90.196.31 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.3 OFFER_2 BODY: Offers you Something (2)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} =?UTF-8?B?T0VNIE1vdG9yaXplZCBWYWx2ZXMgRmFjdG9yeQ==?=