amazon Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 16 Feb 2026 14:14:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vs5ub-00000000Lm1-0AiP

for dave@doctor.nl2k.ab.ca;

Mon, 16 Feb 2026 14:13:45 -0700

Resent-From: The Doctor

Resent-Date: Mon, 16 Feb 2026 14:13:44 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [147.45.49.46] (port=48161 helo=acheterdesmedicaments.space)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

id 1vs4SG-00000000FuQ-3voy

for root@nk.ca;

Mon, 16 Feb 2026 12:40:32 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nk.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version; i=root@nk.ca;

bh=2dE/gbGXHYNxqna3ULNpGECzJX8=;

b=dmuuuSyRCgeDwV0f/fdHqfdaO+rtVcszOeUFGcM0MtFAnj3ogA5X2N7gh1WP6UhsaYKeWVRSm73V

UFhHLTQnFdz9HXffVyxmOom6r/1OxuIAGzKx2pd3KGXBbfM7OPoVSU4viDj580GiPNK6qD15BoTK

0Be6oho6zZVXDe5U3Qc=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nk.ca;

b=QdngaBMMWdaXXrY8iojSO7AO6jzZbGaHH80n/R+EU1cBagGIxeCNQjlpGl43FB955adHwttj9fJC

cxk71JapnUrpQnoWKthMlmgWz3XMtqJhXzccPCae9GlQ0d6tV3VHwYUVPfWxZcEM7h7v/ZWNFKN2

J6weEsu2HtKrdX/HTZo=;

Date: Mon, 16 Feb 2026 19:39:35 +0000

To: root@nk.ca

From: Amazon

Subject: Amazon's Best Deals on Gift Gadgets Under 60%

Content-Type: text/html

Mime-Version: 1.0

X-Spam_score: 13.1

X-Spam_score_int: 131

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Our 10 Favorite Deals That Just Went Live on Amazon Since

the New Year, Amazon has already launched thousands of new 2026 deals! Know

what that means? Deal Watchdogs got to sniff out our 10 favorite deals for

you to shop on Amazon, plus shop our own ex [...]



Content analysis details: (13.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[147.45.49.46 listed in dnsbl.ahbl.org]

[147.45.49.46 listed in dnsbl.ahbl.org]

[147.45.49.46 listed in dnsbl.ahbl.org]

[147.45.49.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[147.45.49.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[147.45.49.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[147.45.49.46 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[147.45.49.46 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[147.45.49.46 listed in will-spam-for-food.eu.org]

[147.45.49.46 listed in will-spam-for-food.eu.org]

[147.45.49.46 listed in will-spam-for-food.eu.org]

[147.45.49.46 listed in will-spam-for-food.eu.org]

[147.45.49.46 listed in will-spam-for-food.eu.org]

[147.45.49.46 listed in will-spam-for-food.eu.org]

[147.45.49.46 listed in will-spam-for-food.eu.org]

[147.45.49.46 listed in will-spam-for-food.eu.org]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 HTML_MESSAGE BODY: HTML included in message

0.6 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 ADMITS_SPAM Admits this is an ad

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

1.5 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX

Subject: {SPAM?} Amazon's Best Deals on Gift Gadgets Under 60%




























Our 10 Favorite Deals That Just Went Live on Amazon












Since the New Year, Amazon has already launched thousands of new 2026 deals! Know what that means? Deal Watchdogs got to sniff out our 10 favorite deals for you to shop on Amazon, plus shop our own exclusive deals at up to 70% off! Amazon can only dreams of having these finds on sale!





Shop Our 10 Favorite 2026 Deals on Amazon Now

















style="font-family: Arial, sans-serif; font-size: 12px; color: #a3a9b5; line-height: 16px; padding: 20px 40px 40px 40px;">

This is an advertisement.
To discontinue receipt of notifications from this

advertiser, please
style="font-family: Arial, sans-serif; font-size: 11px; color: #a3a3a3; line-height: 16px;">click

here.
or write us directly at: 1968 S Coast Highway #739, Laguna Beach, CA 92651.






Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 16 Feb 2026 07:14:53 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vrzMt-00000000NEE-1aAP

for dave@doctor.nl2k.ab.ca;

Mon, 16 Feb 2026 07:14:31 -0700

Resent-From: The Doctor

Resent-Date: Mon, 16 Feb 2026 07:14:31 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [80.244.175.3] (port=57929 helo=mail.mdkadima.org.il)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vrwTh-00000000M7k-09b5

for sales@nk.ca;

Mon, 16 Feb 2026 04:09:31 -0700

Received: from 213.177.179.22 ([213.177.179.22]) by mdkadima.org.il with

MailEnable ESMTPA; Mon, 16 Feb 2026 13:08:24 +0200

Message-ID: <8B71389D19CDE370ACA9E05DF9382875@213.177.179.22>

Reply-To: "Sergio Bedpesti"

From: "Sergio Bedpesti"

To:

Subject: Urgent!

Date: Mon, 16 Feb 2026 03:08:24 -0800

Organization: RECOVERY

MIME-Version: 1.0

Content-Type: text/plain;

format=flowed;

charset="windows-1251";

reply-type=original

Content-Transfer-Encoding: quoted-printable

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2900.5931

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.6157

X-Spam_score: 22.2

X-Spam_score_int: 222

X-Spam_bar: ++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: A 60-year-old woman with a terminal diagnosis seeks a compassionate,

like-minded partner to help establish a charitable foundation and transform

her legacy into a lasting force for good. If this missi [...]



Content analysis details: (22.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[80.244.175.3 listed in dnsbl.ahbl.org]

[80.244.175.3 listed in dnsbl.ahbl.org]

[80.244.175.3 listed in dnsbl.ahbl.org]

[80.244.175.3 listed in dnsbl.ahbl.org]

[213.177.179.22 listed in dnsbl.ahbl.org]

[213.177.179.22 listed in dnsbl.ahbl.org]

[213.177.179.22 listed in dnsbl.ahbl.org]

[213.177.179.22 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[80.244.175.3 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[80.244.175.3 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[80.244.175.3 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[80.244.175.3 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[213.177.179.22 listed in will-spam-for-food.eu.org]

[213.177.179.22 listed in will-spam-for-food.eu.org]

[213.177.179.22 listed in will-spam-for-food.eu.org]

[213.177.179.22 listed in will-spam-for-food.eu.org]

[213.177.179.22 listed in will-spam-for-food.eu.org]

[213.177.179.22 listed in will-spam-for-food.eu.org]

[213.177.179.22 listed in will-spam-for-food.eu.org]

[213.177.179.22 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[213.177.179.22 listed in sbl-xbl.spamhaus.org]

[213.177.179.22 listed in sbl-xbl.spamhaus.org]

[213.177.179.22 listed in sbl-xbl.spamhaus.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[213.177.179.22 listed in zen.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 STOX_REPLY_TYPE No description available.

0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.9 STOX_REPLY_TYPE_WITHOUT_QUOTES No description available.

2.0 FSL_HELO_BARE_IP_2 No description available.

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.0 ZMIde_OutlookExpress Outlook Express should not be used anymore

2.5 XPRIO_VISTA X-Priority + old MSFT msgid format

Subject: {SPAM?} Urgent!



A 60-year-old woman with a terminal diagnosis seeks a compassionate, like=

-minded partner to help establish a charitable foundation and transform h=

er legacy into a lasting force for good. If this mission resonates with y=

ou, please reply with your interest.

=20

Best regards,

Sergio Bedpesti



Business proposal spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 16 Feb 2026 14:13:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vs5tN-00000000LBf-41dn

for dave@doctor.nl2k.ab.ca;

Mon, 16 Feb 2026 14:12:29 -0700

Resent-From: The Doctor

Resent-Date: Mon, 16 Feb 2026 14:12:29 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ws66.host4g.com ([190.210.9.41]:37546)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vs3oP-00000000DJP-46oa

for doctor@doctor.nl2k.ab.ca;

Mon, 16 Feb 2026 11:59:23 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;

d=escencialconsult.com.ar; s=201707; t=1771263578;

bh=JsNdRaawQMT7aUdF8jrMSqHydWQrzQ8uOc0RfIhha+8=;

h=Subject:To:From:Date:Reply-To:From;

b=Y1SVXFIXYEK/i6z9LdHeOLfQwG/a+9MCcyL82E/o/lg6x9VmZtqnNz0W/IubT0yWE

2cridQL45T2Cqf7IxffjRVGLEhnkZYEaeY1/HdWEVUHVEMw2QxfUa5UHM0Pbwp9oAj

BwB1qRopIkPzzmAEpcOdTdzpFc+HrzNnM3rhNhhv1L4Tj86LF6DS95inmRJqR2wh2h

+CH8A59LgaGfRAI6sSUVuu418VErX6wgt7Dxmz/AmRtqWIBfziQ4NhW7OZVyvw/vV/

+c/o2jYYs0EX6Tt5BoJFAihr2R4oRUZ5803Ma/PCF5QuWrDes6sdDAPJ4r6coL15+6

ED6u8rSpUGrRw==

Received: from [192.168.1.71] (unknown [41.90.172.161])

by ws66.host4g.com (Postfix) with ESMTPA id 8C3043D89ED1;

Mon, 16 Feb 2026 14:39:17 -0300 (-03)

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Re: Business Proposal

To: Recipients

From: "Sigrid Rausing"

Date: Mon, 16 Feb 2026 20:38:54 +0300

Reply-To: helpservice322@gmail.com

X-Spam_score: 17.7

X-Spam_score_int: 177

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, My name is Sigrid Rausing, I am a Swedish philanthropist,

anthropologist and publisher. I am the founder of the Sigrid Rausing Trust..

I have a financial business proposal for you. Kindly respond back for more

info.



Content analysis details: (17.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[190.210.9.41 listed in dnsbl.ahbl.org]

[190.210.9.41 listed in dnsbl.ahbl.org]

[190.210.9.41 listed in dnsbl.ahbl.org]

[190.210.9.41 listed in dnsbl.ahbl.org]

[41.90.172.161 listed in dnsbl.ahbl.org]

[41.90.172.161 listed in dnsbl.ahbl.org]

[41.90.172.161 listed in dnsbl.ahbl.org]

[41.90.172.161 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[190.210.9.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[190.210.9.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[190.210.9.41 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[190.210.9.41 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[41.90.172.161 listed in will-spam-for-food.eu.org]

[41.90.172.161 listed in will-spam-for-food.eu.org]

[41.90.172.161 listed in will-spam-for-food.eu.org]

[41.90.172.161 listed in will-spam-for-food.eu.org]

[41.90.172.161 listed in will-spam-for-food.eu.org]

[41.90.172.161 listed in will-spam-for-food.eu.org]

[41.90.172.161 listed in will-spam-for-food.eu.org]

[41.90.172.161 listed in will-spam-for-food.eu.org]

[190.210.9.41 listed in will-spam-for-food.eu.org]

[190.210.9.41 listed in will-spam-for-food.eu.org]

[190.210.9.41 listed in will-spam-for-food.eu.org]

[190.210.9.41 listed in will-spam-for-food.eu.org]

[190.210.9.41 listed in will-spam-for-food.eu.org]

[190.210.9.41 listed in will-spam-for-food.eu.org]

[190.210.9.41 listed in will-spam-for-food.eu.org]

[190.210.9.41 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[41.90.172.161 listed in sbl-xbl.spamhaus.org]

[41.90.172.161 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[41.90.172.161 listed in zen.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: escencialconsult.com.ar]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.0 REPTO_419_FRAUD_GM Reply-To is known advance fee fraud collector

mailbox

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[helpservice322(at)gmail.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Re: Business Proposal



Hello,



My name is Sigrid Rausing, I am a Swedish philanthropist, anthropologist an=

d publisher. I am the founder of the Sigrid Rausing Trust..



I have a financial business proposal for you. Kindly respond back for more =

info.



Regards.

Sigrid Rausing.

Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 16 Feb 2026 07:14:53 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vrzMt-00000000NEE-1aAP

for dave@doctor.nl2k.ab.ca;

Mon, 16 Feb 2026 07:14:31 -0700

Resent-From: The Doctor

Resent-Date: Mon, 16 Feb 2026 07:14:31 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [80.244.175.3] (port=57929 helo=mail.mdkadima.org.il)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vrwTh-00000000M7k-09b5

for sales@nk.ca;

Mon, 16 Feb 2026 04:09:31 -0700

Received: from 213.177.179.22 ([213.177.179.22]) by mdkadima.org.il with

MailEnable ESMTPA; Mon, 16 Feb 2026 13:08:24 +0200

Message-ID: <8B71389D19CDE370ACA9E05DF9382875@213.177.179.22>

Reply-To: "Sergio Bedpesti"

From: "Sergio Bedpesti"

To:

Subject: Urgent!

Date: Mon, 16 Feb 2026 03:08:24 -0800

Organization: RECOVERY

MIME-Version: 1.0

Content-Type: text/plain;

format=flowed;

charset="windows-1251";

reply-type=original

Content-Transfer-Encoding: quoted-printable

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2900.5931

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.6157

X-Spam_score: 22.2

X-Spam_score_int: 222

X-Spam_bar: ++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: A 60-year-old woman with a terminal diagnosis seeks a compassionate,

like-minded partner to help establish a charitable foundation and transform

her legacy into a lasting force for good. If this missi [...]



Content analysis details: (22.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[80.244.175.3 listed in dnsbl.ahbl.org]

[80.244.175.3 listed in dnsbl.ahbl.org]

[80.244.175.3 listed in dnsbl.ahbl.org]

[80.244.175.3 listed in dnsbl.ahbl.org]

[213.177.179.22 listed in dnsbl.ahbl.org]

[213.177.179.22 listed in dnsbl.ahbl.org]

[213.177.179.22 listed in dnsbl.ahbl.org]

[213.177.179.22 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[80.244.175.3 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[80.244.175.3 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[80.244.175.3 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[80.244.175.3 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[213.177.179.22 listed in will-spam-for-food.eu.org]

[213.177.179.22 listed in will-spam-for-food.eu.org]

[213.177.179.22 listed in will-spam-for-food.eu.org]

[213.177.179.22 listed in will-spam-for-food.eu.org]

[213.177.179.22 listed in will-spam-for-food.eu.org]

[213.177.179.22 listed in will-spam-for-food.eu.org]

[213.177.179.22 listed in will-spam-for-food.eu.org]

[213.177.179.22 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

[80.244.175.3 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[213.177.179.22 listed in sbl-xbl.spamhaus.org]

[213.177.179.22 listed in sbl-xbl.spamhaus.org]

[213.177.179.22 listed in sbl-xbl.spamhaus.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[213.177.179.22 listed in zen.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 STOX_REPLY_TYPE No description available.

0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.9 STOX_REPLY_TYPE_WITHOUT_QUOTES No description available.

2.0 FSL_HELO_BARE_IP_2 No description available.

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.0 ZMIde_OutlookExpress Outlook Express should not be used anymore

2.5 XPRIO_VISTA X-Priority + old MSFT msgid format

Subject: {SPAM?} Urgent!



A 60-year-old woman with a terminal diagnosis seeks a compassionate, like=

-minded partner to help establish a charitable foundation and transform h=

er legacy into a lasting force for good. If this mission resonates with y=

ou, please reply with your interest.

=20

Best regards,

Sergio Bedpesti



Web/SEO/App Spam from Microsoft Outlook Part 3

Posted by Dave Yadallee on








How to Receive Your Free Kit

















1


Answer a
Short Survey

2


Confirm Shipping
Information

3


Receive Your Box
In 5–7 Days
















CLAIM MY FREE SAFETY BOX »





Limited quantity • One per household

















Why is this free?


AAA is helping members stay prepared for emergencies and safer travel.















© 2025 AAA Member Programs


Limited-time member benefit • While supplies last



Privacy |

Terms |

Contact





Unsubscribe

































--_635fd502-1110-4a6b-9c4e-e09f388247a1_--

Web/SEO/App Spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on
X-Forefront-Antispam-Report:

CIP:213.255.227.145;CTRY:US;LANG:en;SCL:8;SRV:;IPV:NLI;SFV:SPM;H:christhospital16432.onmicrosoft.com;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(13230040)(61400799027)(4022899009)(82310400026)(35950700016)(34020700016)(376014)(8096899003)(54012099003)(85622059)(6050799012);DIR:OUT;SFP:1023;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

F5TJHfl8yi+oeuvqIjPcRtuVsMZVKB9DCnwC0VwE0Vvgt9qp0ojjLYIlkjltrs/0BmGot3FkiiGfaXcHU/Yabv70nlGysrWZI9kDgoWo3+2fhP4rvZTe8nJsc/jSWPPHCr13mtbV8jg5b5k8TJwJx5sYTFVz/OWRfPSgrS6QFfoWHd1A2JcpaBB7sMb5yn9EzaJ2RlGtE9NUPdys+NJXZ26dhWN6ZmZOLm8G6AytgJSRdDTO9vTCI+JhthtVTuunLjFyWSC8xp4u1zxCoq0VRzPUY7OfZe4UKsor3MYuHBFTTq1spNZdwR+sLfep23iqunau04Kr0CDN7FH8bzDUZfdf6jlNTxCbxOLSldIQnKG/SHE0Mf2ayU6xbQ5B7+dUuyTay9FXqMfrGHw9aHSWnW6ZAxCK1kvP4mA4u9KyR7zdKvKBhOY85B3cwAcrJTqfHiVdCfkcE70u+rUWp9GBqDIGzwQPmXEM734F9NeIDWDsz68gbYSUfCd5DesLbyHDf0WDclyncGcppcqjMpHQC/PLB/CXxncuBmTHUBhGwuVYo2g2q7+BuTgAWIUulj8H7y4YSp46OheNWvkf1gpmLA==

X-OriginatorOrg: christhospital16432.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Feb 2026 03:10:50.9627

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 78341b17-5b89-4430-386c-08de6d08fd56

X-MS-Exchange-CrossTenant-Id: c83d019c-e4d2-471c-bfd2-6634bc06c21b

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=c83d019c-e4d2-471c-bfd2-6634bc06c21b;Ip=[213.255.227.145];Helo=[christhospital16432.onmicrosoft.com]

X-MS-Exchange-CrossTenant-AuthSource:

SN1PEPF000397B1.namprd05.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR16MB935066

X-Spam_score: 20.4

X-Spam_score_int: 204

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: AAA RoadReady Safety Program 🚗 LIMITED RELEASE – FREE

SAFETY BOX FOR MEMBERS 🚗 100% FREE You’re Approved for a AAA RoadReady

Safety Box™ $99.95 Value — Yours FREE Just confirm your details today





Content analysis details: (20.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.139.14 listed in dnsbl.ahbl.org]

[52.103.139.14 listed in dnsbl.ahbl.org]

[52.103.139.14 listed in dnsbl.ahbl.org]

[52.103.139.14 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.139.14 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.139.14 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.139.14 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.139.14 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[52.103.139.14 listed in will-spam-for-food.eu.org]

[52.103.139.14 listed in will-spam-for-food.eu.org]

[52.103.139.14 listed in will-spam-for-food.eu.org]

[52.103.139.14 listed in will-spam-for-food.eu.org]

[52.103.139.14 listed in will-spam-for-food.eu.org]

[52.103.139.14 listed in will-spam-for-food.eu.org]

[52.103.139.14 listed in will-spam-for-food.eu.org]

[52.103.139.14 listed in will-spam-for-food.eu.org]

4.5 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist

[URI: apolokmi.sa.com]

2.1 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: ww.apolokmi.sa.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: apolokmi.sa.com]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[hqutwwhj(at)christhospital16432.onmicrosoft.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} Today Only: Free Car Emergency Kit



--_635fd502-1110-4a6b-9c4e-e09f388247a1_

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 7bit



























































Web/SEO/App Spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 15 Feb 2026 20:40:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vrpRz-0000000039z-3QrL

for dave@doctor.nl2k.ab.ca;

Sun, 15 Feb 2026 20:39:07 -0700

Resent-From: The Doctor

Resent-Date: Sun, 15 Feb 2026 20:39:07 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-centralusazrlh10231014.outbound.protection.outlook.com ([52.103.139.14]:45545 helo=DM5PR21CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

id 1vrp1V-0000000015x-3Ojd

for doctor@doctor.nl2k.ab.ca;

Sun, 15 Feb 2026 20:11:54 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=YvXSbr958GWXzgqPEnVklYdtcYvOBHwu3F5q5/jegxv703BPRouvVC8T4V3hfV3iv96Alm9XDiiFj+hsdzmaJRD9XdUt/+25zbByTZLFQSjwsezxv13wgl4VwWaaPfyw9OtUSzPhzZHoTYL04TQ3vcgtGFAOnOgmY8GB21rUexgAuQNQmxXih80qGMcgeGd8YyrQuiypT27cDCSBJxhtrBq7Y6ciLfG9/ouEuGZHMQnyFG6RxQtjG9IdwYNM/VxWyOwREorhhv/vuH4cK545EpeFPAY7faJHY8GV+QXjvVXtqwDpGp4Dea5Q/mDvpmDB5MgZHX7cdw73dLNNSG+VrA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=x1jy6ahCbqL45i70ZRm26g282E44Z4IlggFmAi93aDQ=;

b=QkKhzRZhIdqGYthM6mhrFpunWX0dJH8OomNVLv+rNzJ1/WK4wd1DqWDZ6hCud4KSmMV6zYr7/6QVeKACy156S3TU2kTXjqlgZxA0b7II1Pfwz/tlNXFCT7GKh3RMdEkL9nONGjxnyKvOHYO+r7GqJ5fX4EOgzU3CMY7CX0Pv6qySZfTQHiEMUzHAG9sqMtwSTjBfe36K9BksiICJkOosC+niLTTDAmZipNcCVm5eEpae1sysZu+WxtLW2MqQO0FwACS5WCkXiJfr57twuKqVAYe1DHy1wIrJeTbGtVf8liwSgzSckhTCTbIuK+xWEmJLkT11qZX17JTXCah5SmyWrA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

213.255.227.145) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.helo=christhospital16432.onmicrosoft.com; dmarc=none action=none

header.from=christhospital16432.onmicrosoft.com; dkim=none (message not

signed); arc=none (0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=christhospital16432.onmicrosoft.com;

s=selector1-christhospital16432-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=x1jy6ahCbqL45i70ZRm26g282E44Z4IlggFmAi93aDQ=;

b=prjLQCpBaBda9wnYhyC2n6M2CkkFhjkaayXrWi2n0VIbmr0chB9dIPGITyBzkk/gAbcxrgtxG7VmJHTcy87zSZnI8lvK0WQ7/2m/u+iyBElVjR24iM/QB7AEjh26y76/f8Y8VemRuNd4YJZHrb/4F+6CkRKePzJwD9ejrLeAJHOaN7JKnjFmFWoom8IOtjbEIRnasspXXVjsNyFDY8rOjDLLWuaK7dBXwBhiop1Gq3ZFMxtVSwzbEZU6VuqYPSmHqXKODejQCY0vK2h7LguWson7lng6IDGF7FYyUa2WfLU0x5zSjqNxnL7HMEqkOSiNuvnnXeYlvAhiuJIuLhRIBw==

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 213.255.227.145)

smtp.helo=christhospital16432.onmicrosoft.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none

header.from=christhospital16432.onmicrosoft.com;

MIME-Version: 1.0

From: Get Your Car Emergency Kit

Subject: Today Only: Free Car Emergency Kit

Date: Mon, 16 Feb 2026 04:06:19 +0100

To: doctor@doctor.nl2k.ab.ca

Content-Type: multipart/alternative;

boundary="_635fd502-1110-4a6b-9c4e-e09f388247a1_"

Message-ID:

<5a3c6446-f6c0-4567-8e49-08ab73a4d465@SN1PEPF000397B1.namprd05.prod.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SN1PEPF000397B1:EE_|SA1PR16MB935066:EE_

X-MS-Office365-Filtering-Correlation-Id: 78341b17-5b89-4430-386c-08de6d08fd56

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam:

BCL:0;ARA:13230040|61400799027|4022899009|82310400026|35950700016|34020700016|376014|8096899003|54012099003|85622059|6050799012;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?Wjg2bmd5RXBwN3NPRFZ4ODRxNzRVVC9VeWpHTE00elZ4TVRIWHR3WURaRlNG?=

=?utf-8?B?SkJSNXl2ZXRjSDE0ZzBSdEZOUkg1andkYmU4YUs5N1Y2eUZOZW5aNkxNWVJ0?=

=?utf-8?B?MEtLV3JxbVdxdmUvN3R4ZTdwcFVYejZ1QytyajZTak1VcXd5eXhiemp1Tnkx?=

=?utf-8?B?cUxLbEpvcXdVMnVoTGh3SktRR0cwckZqemo3YW1TVHRrQTlyLzFsWTNPQ0pK?=

=?utf-8?B?K1NkRjlLOWxlU3RINGJLa2VyTDh6T2xnZ3NyMHJxN0syNkduRzNzeW9aU3dJ?=

=?utf-8?B?K2s5bW9MZzR1MEptazBDZTRzWi9Ya09IVkgzelFwajdzazZKQTBQelBiTllN?=

=?utf-8?B?QmxQQjdTVjBkUXUvVUZWU3lzQUUrTk1INWUwM1JEREQ0am5NelNXSTFDcGl2?=

=?utf-8?B?aERDcXlCTDBTblFFeFBvUXBDM1RXU0pITldISWVJeEFvaTJIaTBkeHBvaUpn?=

=?utf-8?B?Kzk1RWpzOHVqaGlaZUh2UXVnNHJ5ajEwVTljRG9VS1Jsa1RwakprS2NPSFNF?=

=?utf-8?B?b1ZGYnVBbDd4VG1US2RUN2FsT1pzL1pSaWFXRDEzcUpvQjVyWmtuZ0RuVmJm?=

=?utf-8?B?MWNTNnRuQlB1YXpXN25kamIvUlNKajdTTEZ5SUJUTEhDRExIY0grYUwxZWNm?=

=?utf-8?B?cjgzdngzOXNnNDlCQXZwNThDTWQ1OWZaN21GclV0dVR2NjIvUVlYa0hkSWFG?=

=?utf-8?B?R3FMQjBJd1ZNN0ZQTVZpeHpRN0Q4R3VSKzdZUkp3L1VVTGhmN1drdlZ0MTZ5?=

=?utf-8?B?V3VIMy9nT3FNaCtrekVERVFIajNNUlI2NzA2cEJBN3F0aGFCQW1iNUVoRnY3?=

=?utf-8?B?Wkh1dGpjUnhiM3ZidHBLd2xDeFkzczNkVkVHN2s2N1ViUm9YRyswSUdDV240?=

=?utf-8?B?WUR5SDREZ0dMc01KdEM5emp5ams4b2NLYVVkc0xiZVRlYmpiNVFpeU9FQXU5?=

=?utf-8?B?ZGNQWSt4cDBLM3lFUEpNRWJPSUV3bEJZWm84a2wwZkF3VG85VUdxckdDZE95?=

=?utf-8?B?MFZqNTNhMi9jdUdCbjc4TnZMTEh1UXFWTHg2OU1sRGZwR3UrTzMrQUdKclla?=

=?utf-8?B?YUplZ3UreGU4TVpsdmFMSEJPcFhkUG1wRFdCclVxcUlhYkJyRm1BNkdUSzFP?=

=?utf-8?B?djhFOWlueTI2NE1WSDFnODBBMWhjTTZ1Q0c0RDVUMjhqRWhZeTRXeCtORi82?=

=?utf-8?B?ZzlMZjVhTTZNQUo1ZHU4Z21vK0ZPOXVpYWVxMXkrQlJHblBoNFAxa2t3ZG9O?=

=?utf-8?B?RUs0TWhrVzdSNVBWZFFBazNQRlZrTThlNUt6bnFnY1RqcG5iNCtyRFFVMDNt?=

=?utf-8?B?Y2I5eitLL0FGblJDSy9FS2lYRHpvSE1XQ3BQSVkwUVN3T21wOUIwZklQK1pW?=

=?utf-8?B?NlNLYXladTRieVJkVUJvVFBXU3ZTTVEwbDBQWFU2R0QrQWhUZVpiaUxuZVE0?=

=?utf-8?B?WW9kdVFFNGxGRmczT3AyYjdES1pSR1AwUTR0UWh0NGdLQmxZSXNjbTZoblVr?=

=?utf-8?B?aDFCL3JUNkE1WFhJSVFEaHRUdUVKOEZ3Tk9ISlpCMThmV0ZvelYrUmwvWTFG?=

=?utf-8?B?a0tTWGpPV0FHc2dMN2dhWDBJMXhuMzJoUHBDRXZGVEYyM09lWlczcm44eFJh?=

=?utf-8?B?dGxMZ3B3eE9vUUsvSUJvRkhVTkU3Y3ZvUksxSTAraXBVaUR5RVlOcmxTcEFU?=

=?utf-8?B?bkFZWkY0RGUwOU4vOHhyVEYzZy9SbmU1MTRsYXRNVCtIZG96dWNqb3FUclVk?=

=?utf-8?B?Y2IxS3BSQ2FzSlNaOE5ITGNDTEVUZE50V3oxdTBGYUtnR2JKOU43Q3ppQlhp?=

=?utf-8?B?cVpSbUhwNU1IZytTNUl2Sy85T2VZMVg2U3Z4anFBVElHMmVMMlRmK1hKL0hi?=

=?utf-8?B?aHZTaU1CUXMrUDhYZW5vL3R2M241am5ndTRleThPMU1vRXY5RFMvOTZ0S0tE?=

=?utf-8?B?Z2lsRm9YQUJteFFiTEFJUHpEMUQyTXRmdmdqQnorSy8vVkhrUk12ZkFzdjlo?=

=?utf-8?B?RG1WVzNQbWZqbXZpVTF2WnkyYVBjaUxpdCtLODJlYzF1QmtFTWxzbmhDNlo3?=

=?utf-8?B?TXIrSlJxWHFNMFZaSmo1VnBIdmpmVzhwbnlyb254Tzg5NmlnQkNSMHBhbU1w?=

=?utf-8?B?VlVEblo1MElHRnl3MnFQRTZvOVNGVzFmeHZkSGh4Vzd1MjI3djhiOFZnclVE?=

=?utf-8?B?ZXpVanJnZHdhdXJlcXU4bjYxY3NudDFEcHNiNGR2SkZMbER5NG5wZVZvVTZk?=

=?utf-8?B?S2RvTGNvdXBWeUtkV2ZLbEtjQzQwTjFmNkNoWXV1cHFESDVoY25iWVdYRDI3?=

=?utf-8?B?Y3JBQ01wOVdsZWJuYTluT1BtNGwwVmRWdVBkbk92MVlPNlRlL2xaTDVmdk5l?=

=?utf-8?B?NUs4MitUTlNFZTRZa1BIcnRud2RXTXZPbVJKWXJMdlVRcEV3RnU1akt1WDVw?=

=?utf-8?B?WVVHVlljS3JWdjhuZWs3TFhpcFIxREdvQ1pxTjdqSWdBZVJvN2wrS05maUwv?=

=?utf-8?B?QTNyenVXTTFsVUlYU0dKQzl4cnJvSTdlVURENGRhV044ZThOeklreFRZVzVK?=

=?utf-8?B?bnlFbUVTTE0yem9YaytqZkxUWnNWUXJpbHhZU2V3RjNGQjJIakE1cmNYbjFi?=

=?utf-8?B?aXVMUUgrYU1rdm02NmJWRnptVGFHN1FlRjFjWjdqSldpMzNoRTJIZDE0MHFr?=

=?utf-8?B?Z0ErTXhwcVNUQTFaaFdiTUxrRU5mMFhTR2NqL1MvaU12VjFxRlh6V09nV28r?=

=?utf-8?B?L3JmYTRnOTJWMEE4M1FleGhjaEczb0I2S3lPcy8zSTY2b0tTclNFSExmNEIr?=

=?utf-8?B?bSs0d005U2hMVHNKaTJVaTRJRS8xVEYzZjlOMmI1aDVLcGNNRHdTUzZxOFM2?=

=?utf-8?B?cmdOZlljYjd0NGtvaDhuY054V2RXUFZYNE44QU1sd2I5L3J2SFRnenZ0Tk1p?=

=?utf-8?B?V043MWhWSUQrTkVqSG5PNWN4TjU5KzJwOGMwUWpoYzFlUkZpMWZEWjdPZ0wy?=

=?utf-8?B?c1BqcmorTTArM0RNaDR3SnBaRWJjcGdyZEtYTnJqN3hoSkhIQkhnUVRHb09E?=

=?utf-8?B?UUtYNW4zbGJpeFo4RnkrTmh2d1YrZnpJVE1pYVByNVFvam43NlV2Q2lRZzNt?=

=?utf-8?B?eW9Xa3NUbGxXZWZRUlJmTUQ1cjJBWnc3VlNQYW80cGl0bGF4MXkvb0ZWSC85?=

=?utf-8?B?QTdlbjE2cWVhTWNBRUpwbHdUSHRzc2d4Y3BTYkZqWkl4WXNYZGx1NjIxZnZv?=

=?utf-8?B?T0l5WU5pdCt5UjI4eGpqSkU5SEJKeEVoZytKU1R4Y2tXTFY5UlJ1ZW51c2pr?=

=?utf-8?B?OFpSWG4zZjNKVGQraUZrV2Ryc09NMXR1VGpCakJqRFRXZWhPNTZxcGpJK2Fk?=

=?utf-8?B?MHlZTEtxMlliTk9ZSExSTDgwU1hpcXg0RHZnc2dEOFlNRFRWZjNUQVlQNXQ4?=

=?utf-8?B?TTR6eW5RSzRlVGxObG93RWpmSWZwL3pvRVdIRyt0MkFsdFZMMC9VSSs0bkhq?=

=?utf-8?B?R2ZCb2l5V2RWZFYxMGFxa1EyQkdFYllJbUdaY2QvQWlkSko0NktpVjlJTjc5?=

=?utf-8?B?QnptN1oxc0RjSTMrYVNvMkEzOC9wQW55cUM1OHNIdWZYVkNlUkpUSE1LUGZj?=

=?utf-8?B?QnJJN3dSRm1tK1FCM0djSzJMcUhFOHE2d3U2Z0lqYXdrL1hJTld3TXhvTXlE?=

=?utf-8?B?Qk1wWkRZbnREWHZuSW9pemwwRExFbTlueUI0YXJIR3FlcDEvRkZJZzRzSS9J?=

=?utf-8?B?aTZEZ1o4a2hvTFJrazhUMnJSY0FiRDRhai96eFd5ckpJTEJxR3FyaElzbXA3?=

=?utf-8?B?U0ovRENVMlljaVh1TUdNc2hUU2dCd1ZBa0JmZnl6T3d2cWVON1dHejhDVmk1?=

=?utf-8?B?anE3SzhFTW4wQVNsN3gwazhEbVZ2UkEyTEl3bTR6TzhmS3FXTDdxaVJBaFVx?=

=?utf-8?B?R2F1VVlhQlhFWGZNNlBxQTlqS3dHTnJSbVlPeTNpYzZHZklxNFlWbTgya2dx?=

=?utf-8?B?TFQ3SHkxR2w0dlR5YkR3N3lrOUd0NXBmaHVJdEx2em5jdERWVHZ6RVZZWnhG?=

=?utf-8?B?ZTFtV0ZuRXY4a0RXVU5GZUlaQ3FTMTQyejlIRkNXcDVTK2F1eHB0NWYzZG5h?=

=?utf-8?B?QUV0eERnOGhVQnJqT1ZqbXdNa3VvUlFmVC9CWmFZRmFteEg4dWIycWFWL2pt?=

=?utf-8?B?RHYyVUhzOFpyNzNOb2VpZW5oY0ErN3M2d3lSd1JXbnBpV0o4UnZEMmtZcG11?=

=?utf-8?B?TXY2YWFSMnMrTUFseUxKTk55cTFQcVFxNjRNeit0ZGM4NDZkTGVKM3JrSHpv?=

=?utf-8?Q?es3YFaYOuS22RmLQr9ZtKxtdmADhw=3D?=

Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 15 Feb 2026 17:05:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vrm5w-00000000CtL-1JV7

for dave@doctor.nl2k.ab.ca;

Sun, 15 Feb 2026 17:04:08 -0700

Resent-From: The Doctor

Resent-Date: Sun, 15 Feb 2026 17:04:08 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [45.15.50.215] (port=25587 helo=MX21.diba.cat)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vrlzw-00000000C9y-3CfS

for doctor@doctor.nl2k.ab.ca;

Sun, 15 Feb 2026 16:58:05 -0700

Received: from SW0399.corpo.ad.diba.es (sw0399.corpo.ad.diba.es [192.168.53.99])

by MX21.diba.cat with ESMTPS id 61FNt2OS028374-61FNt2Oc028374

(version=TLSv1.2 cipher=AES256-SHA256 bits=256 verify=NO);

Mon, 16 Feb 2026 00:56:48 +0100

Received: from sw0853.corpo.ad.diba.es (192.168.53.107) by

SW0399.corpo.ad.diba.es (192.168.53.99) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id

15.1.2507.55; Sun, 15 Feb 2026 20:51:04 +0100

Received: from [198.46.173.33] (192.168.171.10) by sw0853.corpo.ad.diba.es

(192.168.53.107) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.55; Sun, 15 Feb

2026 20:50:58 +0100

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: RE: $9.5M DONATION REF:FB/DN/M.Z/XX2/15/2026

To: Recipients

From:

Date: Sun, 15 Feb 2026 11:50:55 -0800

Reply-To:

Message-ID: <72dc08bd-9b23-42d9-8d65-30d0ea0a2d92@sw0853.corpo.ad.diba.es>

X-Originating-IP: [192.168.171.10]

X-ClientProxiedBy: SW0398.corpo.ad.diba.es (192.168.53.98) To

sw0853.corpo.ad.diba.es (192.168.53.107)

X-FEAS-BEC-Info: WlpIGw0aAQkEARIJHAEHBlJSCRoLAAEeDUhZUEhYSFhIWUhZXkguLT4lWFA8JVpeWFhYWFxYSFleSAoHGwcFCwIoDAEKCUYLCRxIWUhZXkgFCRocAAkoEQkABwdGCwcFSFhIWkhZW0hZUVpGWV5QRl1bRlFRSFBIWEhYSF9IWEhYSFhIWl1IDAcLBQcACQUNDAkGHw0aKA8FCQEERgsHBUhYSFlcSAwHCwcGDSgFCQEERgwDSFhIWVFIDAcLGR0BDRooAQsEBx0MRgsHBUhYSFlRSAwHCxsoDQkECQoACQZGCwdGEglIWEhZXUgMBwsbKAYBGAdGCwdGEglIWEhZUUgMBwscDwEdBCgABxwFCQEERgEcSFhIWlxIDAcLHAcaKAwHCxwHGkYGBFoDRgkKRgsJSFg=

X-FEAS-Client-IP: 192.168.53.99

X-FE-Policy-ID: 1:3:0:SYSTEM

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; d=diba.cat; s=s1; c=relaxed/relaxed;

h=content-type:mime-version:subject:to:from:date:reply-to:message-id;

bh=jH3LS76c/elvMDsuNJM6lh2PNzb2C5FFn0qHhNAjLuc=;

b=TenFJDLeHfl5CbO9T1h+7JAS6kO/pGQTCv1zzlOtuQwqCoBiEQuvZizk4/1IIPP2jHhZQ8S8vUq4

vSeBRyJ7OfHryshAUoiyhGHtk+o8+kmpYeKyTbba9ZiOTQjocxiTvAzTjPh+5f4DX7wHsoh9d0pF

QzPNlrfpLju40Vor5AHsUUvQgJg32lm6y7bfoETNLMmeQWoRQhE8oJsS02SCpApDO610KqEUyPjW

9ktHbhYDn8iHPcCy01/tlA2bu/m+FVAm8SAnF7/S+kJ5tQ1HLdXmLptR7Z8wM/N831lJ6Bce8vtf

oeNSN0wCPP9QMhXeuopY/vI+qPEdtdRELGPq2A==

X-Spam_score: 16.9

X-Spam_score_int: 169

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Exciting News !!! We are reaching out to inform you that you

have been selected as a potential recipient of a $9,500,000 USD charitable

donation from Mr. Mark Zuckerberg Charity Foundation, as part of their 2026

Donati [...]



Content analysis details: (16.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[45.15.50.215 listed in dnsbl.ahbl.org]

[45.15.50.215 listed in dnsbl.ahbl.org]

[45.15.50.215 listed in dnsbl.ahbl.org]

[45.15.50.215 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[45.15.50.215 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[45.15.50.215 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[45.15.50.215 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[45.15.50.215 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[45.15.50.215 listed in will-spam-for-food.eu.org]

[45.15.50.215 listed in will-spam-for-food.eu.org]

[45.15.50.215 listed in will-spam-for-food.eu.org]

[45.15.50.215 listed in will-spam-for-food.eu.org]

[45.15.50.215 listed in will-spam-for-food.eu.org]

[45.15.50.215 listed in will-spam-for-food.eu.org]

[45.15.50.215 listed in will-spam-for-food.eu.org]

[45.15.50.215 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[mzprogram4(at)gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} RE: $9.5M DONATION REF:FB/DN/M.Z/XX2/15/2026



Exciting News !!!



We are reaching out to inform you that you have been selected as a potentia=

l recipient of a $9,500,000 USD charitable donation from Mr. Mark Zuckerber=

g Charity Foundation, as part of their 2026 Donation Support Initiative, Se=

nd this REF:FB/DN/260215AX to claim



We kindly ask that you respond at your earliest convenience to receive furt=

her instructions on how to proceed.



Regards

Mark Zuckerberg

M.Z Foundation Program

CEO, Facebook=A9

Nigerian spam from Mailgun

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 15 Feb 2026 14:18:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vrjUc-000000001mO-07Sb

for dave@doctor.nl2k.ab.ca;

Sun, 15 Feb 2026 14:17:26 -0700

Resent-From: The Doctor

Resent-Date: Sun, 15 Feb 2026 14:17:25 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from v512.v51e342bd.use4.send.mailgun.net ([69.72.42.12]:51716)

by doctor.nl2k.ab.ca with utf8esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vrjF1-000000006tt-3pjQ

for root@nl2k.ab.ca;

Sun, 15 Feb 2026 14:01:29 -0700

DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=mg.opsguardiq.com; q=dns/txt; s=mailo; t=1771189220; x=1771196420;

h=Content-Type: Mime-Version: Message-ID: List-Unsubscribe: Date: Subject: Subject: To: To: Reply-To: From: From: Sender: Sender;

bh=hUpAvWOLchBgNm8c0qF/dMbMh56nFegP6WqmUidMv9E=;

b=Zer0pxOdzj08gj/r8hL4aeDIZ+RCuCABKMJuTfuSKlf0MeOj77DN/ipjlPATzgMvpshHunTotuUwv9mjLTg1CDfyCtnGpFWnQ5oT9TqfF4a33hdQSzM5YUu8gd+f+xO8sAO5KQGKg1obwt0sS0PgUJWaKePnQ91ALbs3e5xftcDDpcAJVLBz3/h+w/1FjKXFUcnNtAp57AOeTJq1dlAZwZ31V8jPbhlzM908gwwYWrSUUCI3JtcqtfgckDnDsfOJ+EvqOor5NgoaWYijoLF3+jN6h8DR5Y+JxymVyP4qWlO23NA7r15gXDrEfeWMmrkFIom6rmtyEl2Onm0xCvc4kw==

X-Mailgun-Sid: WyI0NjUzNyIsInJvb3RAbmwyay5hYi5jYSIsImNhOTFiNSJd

Received: from mail.opsguardiq.com (static.59.109.161.5.clients.your-server.de

[5.161.109.59]) by

fdef9915b78e139534200e195c2c4f6cc6ab6f628356f72396c1c64224a07b14 with SMTP id

699233e45561252d4950da1e (version=TLS1.3, cipher=TLS_AES_128_GCM_SHA256);

Sun, 15 Feb 2026 21:00:20 GMT

X-Mailgun-Sending-Ip: 69.72.42.12

Sender: alxx199946685=inbox.opsguardiq.com@mg.opsguardiq.com

Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id B87C69F5A8

for ; Sun, 15 Feb 2026 16:00:19 -0500 (EST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=inbox.opsguardiq.com;

s=dkim; t=1771189219;

h=from:reply-to:subject:date:message-id:to:mime-version:content-type:

list-unsubscribe; bh=hUpAvWOLchBgNm8c0qF/dMbMh56nFegP6WqmUidMv9E=;

b=TOnBM/MuFNZuBwYLeDmjDiAy0e8MbAWyxLndMTH4c6Lb53s0kucy85Ip2Jyp8GQa5ek5KR

Lnh/ozP373D3k5pTgY9r6b2r3j7fdiG14WUtC1OyD4M0RmVRJpIEwcz/s1jHNg63mc+aap

x4puoqDTgwPXTGi/GQQ9+x8i3MvKM41PbdVdFmZYxId00Py1MLZcec3qPQLQvv5LYn3j+s

5A/bm/cmtj/wvREgey7Roxyjd2OVeyoxr66UOLPtn8i/ihlJt0pyFZHYf5Nbl3EuQAlrMa

Sq4rDt1g+uH8I3+aeGGGKi/h7Biq3hzHk7rAgwEikUx/A3u3fAAnb8UYMkP8gw==

From: =?utf-8?B?QUs=?=

Reply-To: businessbroker1010@gmail.com

To: root@nl2k.ab.ca

Subject: =?utf-8?B?QnVzaW5lc3MgT3Bwb3J0dW5pdHkgZm9yOiByb290QG5sMmsuYWIuY2E=?=

Date: Sun, 15 Feb 2026 22:00:21 +0100

List-Unsubscribe:

X-Priority: 3

Message-ID: <1C04A0970A7F4F49977C26CF6354FF00@inbox.opsguardiq.com>

Mime-Version: 1.0

Content-Type: multipart/alternative; boundary="F21D9AC10B794908969CAA021B80F56B"

X-Last-TLS-Session-Version: TLSv1.3

X-Spam_score: 16.8

X-Spam_score_int: 168

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings. I am looking to engage you in profit oriented

ventures, I have the directive of SHK Mubarak from Qatar to look for a foreigner

that is capable of managing 200,000,000 U.S.D held abroad. If you are interested,

kindly get back to me for further discussion.



Content analysis details: (16.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[69.72.42.12 listed in dnsbl.ahbl.org]

[69.72.42.12 listed in dnsbl.ahbl.org]

[69.72.42.12 listed in dnsbl.ahbl.org]

[69.72.42.12 listed in dnsbl.ahbl.org]

[5.161.109.59 listed in dnsbl.ahbl.org]

[5.161.109.59 listed in dnsbl.ahbl.org]

[5.161.109.59 listed in dnsbl.ahbl.org]

[5.161.109.59 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[69.72.42.12 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[69.72.42.12 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[69.72.42.12 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[69.72.42.12 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[5.161.109.59 listed in will-spam-for-food.eu.org]

[5.161.109.59 listed in will-spam-for-food.eu.org]

[5.161.109.59 listed in will-spam-for-food.eu.org]

[5.161.109.59 listed in will-spam-for-food.eu.org]

[5.161.109.59 listed in will-spam-for-food.eu.org]

[5.161.109.59 listed in will-spam-for-food.eu.org]

[5.161.109.59 listed in will-spam-for-food.eu.org]

[5.161.109.59 listed in will-spam-for-food.eu.org]

[69.72.42.12 listed in will-spam-for-food.eu.org]

[69.72.42.12 listed in will-spam-for-food.eu.org]

[69.72.42.12 listed in will-spam-for-food.eu.org]

[69.72.42.12 listed in will-spam-for-food.eu.org]

[69.72.42.12 listed in will-spam-for-food.eu.org]

[69.72.42.12 listed in will-spam-for-food.eu.org]

[69.72.42.12 listed in will-spam-for-food.eu.org]

[69.72.42.12 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[69.72.42.12 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

4.0 GR_DOMAIN_YOUSER1 Received contains spam friendly ISP (youser)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[69.72.42.12 listed in wl.mailspike.net]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[businessbroker1010(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 XPRIO Has X-Priority header

0.1 TO_IN_SUBJ To address is in Subject

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} =?utf-8?B?QnVzaW5lc3MgT3Bwb3J0dW5pdHkgZm9yOiByb290QG5sMmsuYWIuY2E=?=



--F21D9AC10B794908969CAA021B80F56B

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable



=0D=0A
quiv=3DContent-type>=0D=0A=0D=0A=0D=0A
=3D"MSHTML=2011.00.9600.21615">=0D=0A=0D=0A
Greetings.
=

I=20am=20looking=20to=20engage=20you=20in=20profit=20oriented=20ventures,=20=

I=20have=20the=20directive=20of=20SHK=20Mubarak=20from=20Qatar=20to=20look=20=

for=20a=20foreigner=20that=20is=20capable=20of=20managing=20200,000,000=20U=

.S.D=20held=20abroad.
=0D=0A
 
=0D=0A
If=20you=20are=

=20interested,=20kindly=20get=20back=20to=20me=20for=20further=20discussion=

.
=0D=0A
 
=0D=0A
Best=20regards,
AK.
=0D=0A=

 
=0D=0A

=0D=0A

=0D=0A=0D=0A

=0D=0A

02/15/2026<=

/P>=0D=0A

 

=0D=0A



--F21D9AC10B794908969CAA021B80F56B--

Invoice Phish from Google Gmail Part 2

Posted by Dave Yadallee on
--000000000000f6a54f064ad54b3e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable












=3D1.0">

Invoice - Order MST67111893






y: Arial, sans-serif;">





AAA RoadReady Safety Program


🚗 LIMITED RELEASE – FREE SAFETY BOX FOR MEMBERS 🚗


100% FREE



You’re Approved for a


AAA RoadReady Safety Boxâ„¢





$99.95 Value — Yours FREE


Just confirm your details today






















What’s Inside Your Safety Box


✔ Heavy-Duty Jumper Cables


✔ LED Emergency Flashlight


✔ Reflective Safety Vest

✔ Tire Inflator & Gauge


✔ First-Aid Essentials Pack


✔ Weather-Proof Storage Bag



ng=3D"0" border=3D"0" style=3D"background-color: #f4f4f4;">










" cellspacing=3D"0" border=3D"0" style=3D"background-color: #ffffff; max-wi=

dth: 600px; width: 100%;">









=20









=20









=20





=20









=20









=20










px 30px; border-bottom: 2px solid #e0e0e0;">


font-weight: bold; margin-bottom: 10px;">CA



ze: 28px; font-weight: bold;">Invoice




color: #666;">Canadian Invoice



lpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"background-color: #f=

8f9fa;">




















-bottom: 1px solid #e0e0e0;">


=3D"100%" cellpadding=3D"0" cellspacing=3D"0" border=3D"0">










old; color: #555; font-size: 14px;">Order Number:
=3D"color: #333; font-size: 14px; font-weight: bold; color: #007bff;">MST67=

111893



-bottom: 1px solid #e0e0e0;">


=3D"100%" cellpadding=3D"0" cellspacing=3D"0" border=3D"0">










old; color: #555; font-size: 14px;">Date:
=3D"color: #333; font-size: 14px;">01/01/2026





=3D"100%" cellpadding=3D"0" cellspacing=3D"0" border=3D"0">










old; color: #555; font-size: 14px;">Status:


inline-block; padding: 5px 15px; background-color: #fff3cd; color: #856404=

; border-radius: 20px; font-size: 12px; font-weight: bold; text-transform: =

uppercase;">Awaiting Confirmation







lpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"background-color: #e=

7f3ff; border-left: 4px solid #007bff;">










lor: #007bff; margin-bottom: 5px; font-size: 14px;">Order Status:



r: #333;">4152548





lpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"background-color: #2=

c3e50;">








25px;">


-transform: uppercase; letter-spacing: 1px; color: #ffffff; margin-bottom: =

10px; opacity: 0.9;">Total Amount (CAD)



-weight: bold; color: #ffffff; margin: 10px 0;">$869.99 CAD



r: #ffffff; margin-top: 5px; opacity: 0.8;">Canadian Dollar





lpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"background-color: #f=

0f8ff; border-left: 4px solid #0066cc;">








13px; color: #555; line-height: 1.6;">

G=

ST/HST Information: his invoice includes GST/HST (Goods and Servi=

ces Tax / Harmonized Sales Tax) in accordance with Canadian tax regulations=

. GST/HST amount: $113.10 CAD (included in total). Business Number: 1234567=

89 RT0001



30px;">


cellspacing=3D"0" border=3D"0">








d-color: #007bff; border-radius: 5px;">


nkific.com/c/eJw0zE1uAyEMQOHTwK7I9swAs2DRzdzDMSZYmZ8qQZF6-6qVun16-mphacTktW=

BKCBkpJ99LFWxZ5zVq5YWWjBh5mlZFgAqYJm-FgCIQzrgA0hLq7RYxR0oaU24N3QznNax9h9Htf=

FgzCXIdfi99jK-Xmz4dbY426SqPYOf7MtGPl-67Pn9HR9t_FHa0-We5h87nwZUPXN0M94Nt_zPf=

hX4CAAD__1muPGA" target=3D"_blank" rel=3D"noopener noreferrer" style=3D"dis=

play: inline-block; padding: 14px 35px; color: #ffffff; text-decoration: no=

ne; font-weight: bold; font-size: 16px;">Download Invoice



1px solid #e0e0e0;">


lpadding=3D"0" cellspacing=3D"0" border=3D"0">








op: 20px; font-size: 12px; color: #666;">


ght: bold; color: #333;">Thank you for your purchase!



If you=

have any questions regarding this invoice, please contact our support team=

.




t-size: 11px; color: #888; line-height: 1.6;">

Canadian Office:
g>


Phone: +1 (416) 123-4567 | Emai=

l: support@globalservices.ca


Address: 123 Business Street, T=

oronto, ON M5H 2N2, Canada


Business Number: 123456789 RT00=

01




or: #999; font-size: 11px;">This is an automated email. Please do not reply=

.












--000000000000f6a54f064ad54b3e--

Invoice Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 15 Feb 2026 04:16:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vra69-00000000O4H-0fOX

for dave@doctor.nl2k.ab.ca;

Sun, 15 Feb 2026 04:15:33 -0700

Resent-From: The Doctor

Resent-Date: Sun, 15 Feb 2026 04:15:33 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f70.google.com ([209.85.161.70]:48593)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vrTmu-00000000MDz-2PV2

for sales@nk.ca;

Sat, 14 Feb 2026 21:31:24 -0700

Received: by mail-oo1-f70.google.com with SMTP id 006d021491bc7-67986abad39so5331862eaf.1

for ; Sat, 14 Feb 2026 20:30:29 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1771129823; x=1771734623; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=c6vNAU8uVHKegwOEiHVxAbUsNRdJRzqknBH97e8ReJ8=;

b=HY4HQRPfDKSlDtJV6hL9cd85HW/7CLgkzuggJ9KOdKYJfjAd/OAWWEX/KJRrWVO8P0

rgIEQ2urRU+5aLbIqgFmSqmrkuc5c6SZ/PZzaXlFhlmIS3lOz4Zi/NZqY8/fRlU3GX8/

VA9Rr3coZeCCBK8QiQGOmTaGZVpDE2Bf4+5WPhYFd4XJ7ajj4XEmLbvsgwVB/YKLf3dx

B1JjK92Ew4kYf8jS6OvUCz+CYdKSFCClHQTuujE6I09Da5dyCZBj0wO9hmtbSITWEtZI

lmwm7xMgBSIPszQ0RuF2HWxeOetcRjQfegbGk7fr1WEgKxah84uFMhbsloSHQswDaavA

A04A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1771129823; x=1771734623;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=c6vNAU8uVHKegwOEiHVxAbUsNRdJRzqknBH97e8ReJ8=;

b=kRyChLGCYVGfFxNfFQM2HxbxPb0kzHsW++q8zTFUcHWJ0kpAJ/WA4O0tOhjmrkA/57

fQcQOFCzM2Zy4E8IGW8ck4yb/7FjGwLLBGNKay9rU6Wd+qt5pYzqvrNwXDWrRwewqo/+

HOwSXrwZr3O2b0IqRv21LP6wQKkdtJ4ulvLUOBKs65EIPUin8w4n25Wh/FrRO0/tgz23

p1hGAMOwgEWlZAw1MIq4bTtXStQLlkanxbGSca2CWdbCKmcy6ZQSV5JnHMRjvq9Ph0QV

pTs9HPFciOR2xi/YXjCZeUL+WSVIaDYn7lxDWYMruSNXRUJrxFgJeNknvwhEfbtM6dy3

wIHw==

X-Gm-Message-State: AOJu0YxI+avhNIk6iGhw1FvOTwr8NWuzib4BkFNlZ6mSGyoqxAeyDCu1

FVdxs6DJJtYbeJdb9AonyKRCtKAXLo0jRpKo2QGp8W7WRTPq0Kzr4DTXIvuWa9Q6pz2TxX8b2M5

XNMfJ0T0eCA==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:4410:b0:679:1a3:ba08 with SMTP id

006d021491bc7-67901b30259mr1181946eaf.43.1771129823208; Sat, 14 Feb 2026

20:30:23 -0800 (PST)

Message-ID: <000000000000f6a55f064ad54b41@google.com>

Date: Sun, 15 Feb 2026 04:30:23 +0000

Subject: Invoice Available for Download - MST67111893

From: "no-reply@invoiceserv.com"

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000f6a54f064ad54b3e"

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: CA Invoice Canadian Invoice



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.70 listed in dnsbl.ahbl.org]

[209.85.161.70 listed in dnsbl.ahbl.org]

[209.85.161.70 listed in dnsbl.ahbl.org]

[209.85.161.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.70 listed in will-spam-for-food.eu.org]

[209.85.161.70 listed in will-spam-for-food.eu.org]

[209.85.161.70 listed in will-spam-for-food.eu.org]

[209.85.161.70 listed in will-spam-for-food.eu.org]

[209.85.161.70 listed in will-spam-for-food.eu.org]

[209.85.161.70 listed in will-spam-for-food.eu.org]

[209.85.161.70 listed in will-spam-for-food.eu.org]

[209.85.161.70 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: thinkific.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.70 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address

0.7 PDS_FROM_2_EMAILS From header has multiple different addresses

Subject: {SPAM?} Invoice Available for Download - MST67111893



--000000000000f6a54f064ad54b3e

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



CA



Invoice



Canadian Invoice













Order Number: MST67111893











Date: 01/01/2026











Status: Awaiting Confirmation











Order Status:



4152548













Total Amount (CAD)



$869.99 CAD



Canadian Dollar













GST/HST Information: This invoice includes GST/HST (Goods and Services Tax

/ Harmonized Sales Tax) in accordance with Canadian tax regulations.

GST/HST amount: $113.10 CAD (included in total). Business Number: 123456789

RT0001











Download Invoice











Thank you for your purchase!



If you have any questions regarding this invoice, please contact our

support team.



Canadian Office:

Phone: +1 (416) 123-4567 | Email: support@globalservices.ca

Address: 123 Business Street, Toronto, ON M5H 2N2, Canada

Business Number: 123456789 RT0001



This is an automated email. Please do not reply.









Invoice Phish from Google Gmail Part 2

Posted by Dave Yadallee on
--00000000000086185b064ad47a42

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable












=3D1.0">

Invoice - Order MST67111893






y: Arial, sans-serif;">


ng=3D"0" border=3D"0" style=3D"background-color: #f4f4f4;">










" cellspacing=3D"0" border=3D"0" style=3D"background-color: #ffffff; max-wi=

dth: 600px; width: 100%;">









=20









=20









=20





=20









=20









=20










px 30px; border-bottom: 2px solid #e0e0e0;">


font-weight: bold; margin-bottom: 10px;">CA



ze: 28px; font-weight: bold;">Invoice




color: #666;">Canadian Invoice



lpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"background-color: #f=

8f9fa;">




















-bottom: 1px solid #e0e0e0;">


=3D"100%" cellpadding=3D"0" cellspacing=3D"0" border=3D"0">










old; color: #555; font-size: 14px;">Order Number:
=3D"color: #333; font-size: 14px; font-weight: bold; color: #007bff;">MST67=

111893



-bottom: 1px solid #e0e0e0;">


=3D"100%" cellpadding=3D"0" cellspacing=3D"0" border=3D"0">










old; color: #555; font-size: 14px;">Date:
=3D"color: #333; font-size: 14px;">01/01/2026





=3D"100%" cellpadding=3D"0" cellspacing=3D"0" border=3D"0">










old; color: #555; font-size: 14px;">Status:


inline-block; padding: 5px 15px; background-color: #fff3cd; color: #856404=

; border-radius: 20px; font-size: 12px; font-weight: bold; text-transform: =

uppercase;">Awaiting Confirmation







lpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"background-color: #e=

7f3ff; border-left: 4px solid #007bff;">










lor: #007bff; margin-bottom: 5px; font-size: 14px;">Order Status:



r: #333;">4152548





lpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"background-color: #2=

c3e50;">








25px;">


-transform: uppercase; letter-spacing: 1px; color: #ffffff; margin-bottom: =

10px; opacity: 0.9;">Total Amount (CAD)



-weight: bold; color: #ffffff; margin: 10px 0;">$869.99 CAD



r: #ffffff; margin-top: 5px; opacity: 0.8;">Canadian Dollar





lpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"background-color: #f=

0f8ff; border-left: 4px solid #0066cc;">








13px; color: #555; line-height: 1.6;">

G=

ST/HST Information: This invoice includes GST/HST (Goods and Servi=

ces Tax / Harmonized Sales Tax) in accordance with Canadian tax regulations=

. GST/HST amount: $113.10 CAD (included in total). Business Number: 1234567=

89 RT0001



30px;">


cellspacing=3D"0" border=3D"0">








d-color: #007bff; border-radius: 5px;">


nkific.com/c/eJw0zE1uAyEMQOHTwK7I9swAs2DRzdzDMSZYmZ8qQZF6-6qVun16-mphacTktW=

BKCBkpJ99LFWxZ5zVq5YWWjBh5mlZFgAqYJmFgCIQzrgA0hLq7RYxR0oaU24N3QznNax9h9Htf=

FgzCXIdfi99jK-Xmz4dbY426SqPYOf7MtGPl-67Pn9HR9t_FHa0-We5h87nwZUPXN0M94Nt_zPf=

hX4CAAD__1muPGA" target=3D"_blank" rel=3D"noopener noreferrer" style=3D"dis=

play: inline-block; padding: 14px 35px; color: #ffffff; text-decoration: no=

ne; font-weight: bold; font-size: 16px;">Download Invoice



1px solid #e0e0e0;">


lpadding=3D"0" cellspacing=3D"0" border=3D"0">








op: 20px; font-size: 12px; color: #666;">


ght: bold; color: #333;">Thank you for your purchase!



If you=

have any questions regarding this invoice, please contact our support team=

.




t-size: 11px; color: #888; line-height: 1.6;">

Canadian Office:
g>


Phone: +1 (416) 123-4567 | Emai=

l: support@globalservices.ca


Address: 123 Business Street, T=

oronto, ON M5H 2N2, Canada


Business Number: 123456789 RT00=

01




or: #999; font-size: 11px;">This is an automated email. Please do not reply=

.












--00000000000086185b064ad47a42--

Invoice Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 15 Feb 2026 04:16:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vra5s-00000000O3J-1b0N

for dave@doctor.nl2k.ab.ca;

Sun, 15 Feb 2026 04:15:16 -0700

Resent-From: The Doctor

Resent-Date: Sun, 15 Feb 2026 04:15:16 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f69.google.com ([209.85.161.69]:43377)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vrSsC-00000000IBm-3xgC

for root@nk.ca;

Sat, 14 Feb 2026 20:32:48 -0700

Received: by mail-oo1-f69.google.com with SMTP id 006d021491bc7-677d92bb88dso13468496eaf.1

for ; Sat, 14 Feb 2026 19:31:55 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1771126309; x=1771731109; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=XpYfu/rTi3OLXBuWuSqmaFRP6rev9XpmnwTMOUIzhdY=;

b=Mi/gAjvJbGAk1Las1hQHhjG0e+q5nhVaOsK/vICZjQ7hsEXudTiwZC96azExXaBbLD

fdWCYwy7Z0bINB4O1fnI+4/3IEQUqSQE4kxSC/bUsgmL1HrFeqAVJ/JWC7onK8KzORs7

SGk0xdJLPaTzus0pPDj/WxTt7n30CcZgJDEX/M+kXrFjHCnvPPWzg31+OVTfAJW46Ghg

5Sufn0EiR4STjsy1Wwy2byHvFSau9L7FHdGjU24HQ9uvBMGIFgjgH9lL6ULm66psNV8l

zhV94HSew196609K3ewu2nf6kFxxcC5da9jXIa8GxGW8vdK5PDj4lKF+JY9WhSqjnV8N

Utmg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1771126309; x=1771731109;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=XpYfu/rTi3OLXBuWuSqmaFRP6rev9XpmnwTMOUIzhdY=;

b=iIdELkh/27mY+kV0pJHAbyghsGRC+UgWyVHeabPcFE7qBFVWcwbGjbvCQNuMWWcqg+

1LCadmI0kCob68z07FfHqL4ByMXr0TkBpNCiGhCMh2Rq5KbjFavSHTJrbGzUWX/p7FH+

c5e7zMQbX9R9p5OTY44p7ICYMGlD8Lvv6Z8EOZPZsgtUM8JDj0H2UvcJLpmha+JBvLcg

z2aMW5MzoYfovCG8TnY/wrRDMTzbvV1YMfYrGzo1pCumo3gJMmyGuc8Fj6ZHL4ha0nj5

i+NClUdVUyrRtAJM0SsPPKkucqpyxJ3hrOPT15TG4FEB9+hNbZRvHRqX7vnE849Wczd4

lJww==

X-Gm-Message-State: AOJu0YzIc1f+NtQY2BRtpyerlgcVTSfPybfXe1pU6c9eJv7hpJhefLUT

0EVUEWfG0iInyUHlSHd+w7iAe9l+xAqqXZMCkbSdIQrh8+R07IlLY0a4eprN27Ch9tkM6qmC/EG

uweUgOxUgsw==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:1349:b0:675:9d7e:4da6 with SMTP id

006d021491bc7-67822c69b03mr2794962eaf.34.1771126309393; Sat, 14 Feb 2026

19:31:49 -0800 (PST)

Message-ID: <000000000000861867064ad47a45@google.com>

Date: Sun, 15 Feb 2026 03:31:49 +0000

Subject: Invoice Available for Download - MST67111893

From: "no-reply@invoiceserv.com"

To: root@nk.ca

Content-Type: multipart/alternative; boundary="00000000000086185b064ad47a42"

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: CA Invoice Canadian Invoice



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.69 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.69 listed in wl.mailspike.net]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: thinkific.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.7 PDS_FROM_2_EMAILS From header has multiple different addresses

Subject: {SPAM?} Invoice Available for Download - MST67111893



--00000000000086185b064ad47a42

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



CA



Invoice



Canadian Invoice













Order Number: MST67111893











Date: 01/01/2026











Status: Awaiting Confirmation











Order Status:



4152548













Total Amount (CAD)



$869.99 CAD



Canadian Dollar













GST/HST Information: This invoice includes GST/HST (Goods and Services Tax

/ Harmonized Sales Tax) in accordance with Canadian tax regulations.

GST/HST amount: $113.10 CAD (included in total). Business Number: 123456789

RT0001











Download Invoice











Thank you for your purchase!



If you have any questions regarding this invoice, please contact our

support team.



Canadian Office:

Phone: +1 (416) 123-4567 | Email: support@globalservices.ca

Address: 123 Business Street, Toronto, ON M5H 2N2, Canada

Business Number: 123456789 RT0001



This is an automated email. Please do not reply.