Costco Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 13:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAvB6-00000000MmJ-1U0p

for dave@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 13:04:20 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 13:04:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [87.120.219.77] (port=55795 helo=support-uk.online)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

id 1vAuje-00000000KbW-2pf2

for sales@netknow.ca;

Mon, 20 Oct 2025 12:36:06 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=netknow.ca;

h=Date:To:From:Subject:Content-Type:Content-Transfer-Encoding:Mime-Version; i=sales@netknow.ca;

bh=pXAxvJPYSQ3NBwx3fSStzoKVUvU=;

b=LHSNv6I+G17LfPepFF+O571QiAIFizo06cjS/rjHykI/NiRAGoYHYH1NRw7bksEPCp9DMoW9l4hx

8SmytkpnhwlKrqulR9ebJDR2xzdAZlqcJYGSubw6I9PSs4cUADChHKNQgbNUxzoVF7OHKkTBsHjc

BG2MyZzRdTQfK4bT7HM=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=netknow.ca;

b=ts3tNu7N5cYWYo+/T116Um2Ue7XdxoBQrBSmDO5vemrpz2Ws5MmNPVC69uiLgunhm43zZLoxRKrh

9nGhI8FlHKbk+Zo+MCrX6bKD1ZWd3V0nT8R3ODN2bbcaq9IUGswTNHHzoHiDgdRYTKcmZ2EBn9Uu

RUeBAVEjP6V8Y1g60yY=;

Date: Mon, 20 Oct 2025 18:35:04 +0000

To: sales@netknow.ca

From: Costco Wholesale

Subject: “Special Delivery for Costco Members—Fresh Meat Boxes Inside”

Content-Type: text/html; charset="UTF-8"



Content-Transfer-Encoding :BASE64

Mime-Version: 1.0

X-Spam_score: 12.6

X-Spam_score_int: 126

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Congrats,sales! If you no longer wish to receive these emails,

you can unsubscribe by clicking here.



Content analysis details: (12.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[87.120.219.77 listed in will-spam-for-food.eu.org]

[87.120.219.77 listed in will-spam-for-food.eu.org]

[87.120.219.77 listed in will-spam-for-food.eu.org]

[87.120.219.77 listed in will-spam-for-food.eu.org]

[87.120.219.77 listed in will-spam-for-food.eu.org]

[87.120.219.77 listed in will-spam-for-food.eu.org]

[87.120.219.77 listed in will-spam-for-food.eu.org]

[87.120.219.77 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[87.120.219.77 listed in dnsbl.ahbl.org]

[87.120.219.77 listed in dnsbl.ahbl.org]

[87.120.219.77 listed in dnsbl.ahbl.org]

[87.120.219.77 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[87.120.219.77 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[87.120.219.77 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[87.120.219.77 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[87.120.219.77 listed in dnsbl.ahbl.org]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 BASE64_LENGTH_79_INF BODY: base64 encoded email part uses line length

greater than 79 characters

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image

0.3 MIME_8BIT_HEADER Message header contains 8-bit character

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

Subject: {SPAM?} “Special Delivery for Costco Members—Fresh Meat Boxes Inside”



Cgo8IURPQ1RZUEUgaHRtbD4KPGh0bWw+CjxoZWFkPgogICAgPHN0eWxlPgogICAgICAgIGJvZHkgewogICAgICAgICAgICBiYWNrZ3JvdW5kLWNvbG9yOiAjZWZlZmVmOwogICAgICAgICAgICBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsKICAgICAgICB9CiAgICAgICAgcCB7CiAgICAgICAgICAgIGZvbnQtc2l6ZTogMTNweDsKICAgICAgICAgICAgY29sb3I6ICM3OTc5Nzk7CiAgICAgICAgICAgIG1heC13aWR0aDogNTgwcHg7CiAgICAgICAgICAgIGxpbmUtaGVpZ2h0OiAxLjQ7CiAgICAgICAgfQogICAgICAgIGEgewogICAgICAgICAgICBjb2xvcjogIzY2NjsKICAgICAgICAgICAgdGV4dC1kZWNvcmF0aW9uOiBub25lOwogICAgICAgIH0KICAgICAgICBpbWcgewogICAgICAgICAgICBtYXgtd2lkdGg6IDEwMCU7CiAgICAgICAgICAgIGhlaWdodDogYXV0bzsKICAgICAgICAgICAgd2lkdGg6IDc1MHB4OyAvKiBDaGFuZ2UgdGhpcyB2YWx1ZSB0byByZXNpemUgdGhlIGltYWdlICovCiAgICAgICAgICAgIGRpc3BsYXk6IGJsb2NrOwogICAgICAgIH0KICAgIDwvc3R5bGU+CjwvaGVhZD4KPGJvZHk+CiAgICA8Y2VudGVyPgogICAgICAgIDxicj4KICAgICAgICA8YQogICAgICAgICAgICBocmVmPSJodHRwOi8vMzEuMTI5LjIyLjE4NS80RWxJS1M4MjRiY3lZMzdzeWhremduYW54MVJESkVWTUhOWkJFRVhRTjE3OTczMlNVQVYyMDZMMSI+PGNlbnRlcj48aDIgc3R5bGU9ImNvbG9yOmJsYWNrIj5Db25ncmF0cyxzYWxlcyE8L2gyPjwvY2VudGVyPjxpbWcgYm9yZGVyPSIwIiBzcmM9Imh0dHBzOi8vcGJzLnR3aW1nLmNvbS9tZWRpYS9HM3VUS2VIWEVBQWxKQlc/Zm9ybWF0PWpwZyZuYW1lPTQwOTZ4NDA5NiIgYWx0PSJJbWFnZSI+PC9hPjxicj4KICAgICAgICA8cD4KICAgICAgICAgICAgSWYgeW91IG5vIGxvbmdlciB3aXNoIHRvIHJlY2VpdmUgdGhlc2UgZW1haWxzLCB5b3UgY2FuIHVuc3Vic2NyaWJlIGJ5IGNsaWNraW5nIDxhCiAgICAgICAgICAgICAgICBocmVmPSJodHRwOi8vMzEuMTI5LjIyLjE4NS81dUtKa2Y4MjRKWnNGMzdrdWd0eG5jY252MUpMWkdXRkFWV0xBQlpMUTE3OTczMkxNVkkyMDZLMSI+aGVyZS48L2E+CiAgICAgICAgPC9wPgogICAgPC9jZW50ZXI+CjwvYm9keT4KPGltZyBzcmM9Imh0dHA6Ly8zMS4xMjkuMjIuMTg1L3RyYWNrLzNybGNWVTgyNFVwdHgzN2todGZuZGNrY3UxSEZLWkdUUldRS1hPQUJMMTc5NzMyUU9HSTIwNnMxIiB3aWR0aD0iMSIgaGVpZ2h0PSIxIiBib3JkZXI9IjAiIGFsdD0iIiBzdHlsZT0iZGlzcGxheTogbm9uZTsiPgo8L2h0bWw+Cgo=

Costco Phish

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 13:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAvB2-00000000Mm2-0ssq

for dave@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 13:04:16 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 13:04:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [87.120.219.77] (port=46883 helo=support-uk.online)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

id 1vAuje-00000000KbX-2pjf

for root@nk.ca;

Mon, 20 Oct 2025 12:36:06 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nk.ca;

h=Date:To:From:Subject:Content-Type:Content-Transfer-Encoding:Mime-Version; i=root@nk.ca;

bh=sWtdcaBa8CwKKYRiL4mre63m1yQ=;

b=WSKsc8AQiTX/I1ghAMFNioOOHx0p+nnXyaigd2HGyTgXevSDzf54gbw2tVZtSCnecgW1CQST6ACz

3OKfcx2/ob+iqZMYrYkFWP8L16eg1JxC4BZaH++IJCvdUtTjaQ3PjDm4iPqFw6OQSPPhlryasJvD

RPlyRGOZ+SxQqomhssU=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nk.ca;

b=lCKAkqR50wPtbjyJSqqcGEfWQzxCt6zpJ/N3Bk8zFjPa7wOK25PL5MhxKDwvByIhacq2jbDXyogw

aHZB8nfiRVw/FWN7IFN/m+b9f5ZjmfWOQFZLANGtAcpFkS8+cEYWPGw36nLiW62IbiHFBMX60WBY

bJUunEKY6RdEjWO1yKM=;

Date: Mon, 20 Oct 2025 18:35:02 +0000

To: root@nk.ca

From: Costco Wholesale

Subject: “Special Delivery for Costco Members—Fresh Meat Boxes Inside”

Content-Type: text/html; charset="UTF-8"



Content-Transfer-Encoding :BASE64

Mime-Version: 1.0

X-Spam_score: 13.2

X-Spam_score_int: 132

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Congrats,root! If you no longer wish to receive these emails,

you can unsubscribe by clicking here.



Content analysis details: (13.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[87.120.219.77 listed in will-spam-for-food.eu.org]

[87.120.219.77 listed in will-spam-for-food.eu.org]

[87.120.219.77 listed in will-spam-for-food.eu.org]

[87.120.219.77 listed in will-spam-for-food.eu.org]

[87.120.219.77 listed in will-spam-for-food.eu.org]

[87.120.219.77 listed in will-spam-for-food.eu.org]

[87.120.219.77 listed in will-spam-for-food.eu.org]

[87.120.219.77 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[87.120.219.77 listed in dnsbl.ahbl.org]

[87.120.219.77 listed in dnsbl.ahbl.org]

[87.120.219.77 listed in dnsbl.ahbl.org]

[87.120.219.77 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[87.120.219.77 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[87.120.219.77 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[87.120.219.77 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[87.120.219.77 listed in dnsbl.ahbl.org]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid

0.6 J_CHICKENPOX_84 BODY: 8alpha-pock-4alpha

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 BASE64_LENGTH_79_INF BODY: base64 encoded email part uses line length

greater than 79 characters

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.3 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image

0.3 MIME_8BIT_HEADER Message header contains 8-bit character

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

Subject: {SPAM?} “Special Delivery for Costco Members—Fresh Meat Boxes Inside”



Cgo8IURPQ1RZUEUgaHRtbD4KPGh0bWw+CjxoZWFkPgogICAgPHN0eWxlPgogICAgICAgIGJvZHkgewogICAgICAgICAgICBiYWNrZ3JvdW5kLWNvbG9yOiAjZWZlZmVmOwogICAgICAgICAgICBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsKICAgICAgICB9CiAgICAgICAgcCB7CiAgICAgICAgICAgIGZvbnQtc2l6ZTogMTNweDsKICAgICAgICAgICAgY29sb3I6ICM3OTc5Nzk7CiAgICAgICAgICAgIG1heC13aWR0aDogNTgwcHg7CiAgICAgICAgICAgIGxpbmUtaGVpZ2h0OiAxLjQ7CiAgICAgICAgfQogICAgICAgIGEgewogICAgICAgICAgICBjb2xvcjogIzY2NjsKICAgICAgICAgICAgdGV4dC1kZWNvcmF0aW9uOiBub25lOwogICAgICAgIH0KICAgICAgICBpbWcgewogICAgICAgICAgICBtYXgtd2lkdGg6IDEwMCU7CiAgICAgICAgICAgIGhlaWdodDogYXV0bzsKICAgICAgICAgICAgd2lkdGg6IDc1MHB4OyAvKiBDaGFuZ2UgdGhpcyB2YWx1ZSB0byByZXNpemUgdGhlIGltYWdlICovCiAgICAgICAgICAgIGRpc3BsYXk6IGJsb2NrOwogICAgICAgIH0KICAgIDwvc3R5bGU+CjwvaGVhZD4KPGJvZHk+CiAgICA8Y2VudGVyPgogICAgICAgIDxicj4KICAgICAgICA8YQogICAgICAgICAgICBocmVmPSJodHRwOi8vMzEuMTI5LjIyLjE4NS80eXpLT084MjRadm9iMzd6c2lzbmlxZXh3MU5KTldPTkxOUE9TVVRMWTE3ODU0MVNNTFgyMDZBMSI+PGNlbnRlcj48aDIgc3R5bGU9ImNvbG9yOmJsYWNrIj5Db25ncmF0cyxyb290ITwvaDI+PC9jZW50ZXI+PGltZyBib3JkZXI9IjAiIHNyYz0iaHR0cHM6Ly9wYnMudHdpbWcuY29tL21lZGlhL0czdVRLZUhYRUFBbEpCVz9mb3JtYXQ9anBnJm5hbWU9NDA5Nng0MDk2IiBhbHQ9IkltYWdlIj48L2E+PGJyPgogICAgICAgIDxwPgogICAgICAgICAgICBJZiB5b3Ugbm8gbG9uZ2VyIHdpc2ggdG8gcmVjZWl2ZSB0aGVzZSBlbWFpbHMsIHlvdSBjYW4gdW5zdWJzY3JpYmUgYnkgY2xpY2tpbmcgPGEKICAgICAgICAgICAgICAgIGhyZWY9Imh0dHA6Ly8zMS4xMjkuMjIuMTg1LzVIS09HWTgyNHF2cWszN2RyZHB2c2lwZGExT1dXSExQSVFXV1VXT0VKMTc4NTQxRk9SVjIwNncxIj5oZXJlLjwvYT4KICAgICAgICA8L3A+CiAgICA8L2NlbnRlcj4KPC9ib2R5Pgo8aW1nIHNyYz0iaHR0cDovLzMxLjEyOS4yMi4xODUvdHJhY2svM3hWdmRJODI0WEVVZjM3dWlmaW93b3NvZjFJWklYRlNOTkZDTUxPS0QxNzg1NDFYTVlNMjA2TzEiIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIGJvcmRlcj0iMCIgYWx0PSIiIHN0eWxlPSJkaXNwbGF5OiBub25lOyI+CjwvaHRtbD4KCg==

Anti Snoring Health spam from Google Gmail

Return-path:

Envelope-to: dve@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 11:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAtGC-00000000DAe-3R8V

for dve@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 11:01:28 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 11:01:28 -0600

Resent-Message-ID:

Resent-To: dve@doctor.nl2k.ab.ca

Received: from mail-vs1-f69.google.com ([209.85.217.69]:57788)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAsNe-00000000K7h-38jW

for sales@nk.ca;

Mon, 20 Oct 2025 10:05:13 -0600

Received: by mail-vs1-f69.google.com with SMTP id ada2fe7eead31-5d6162e0605so9308482137.3

for ; Mon, 20 Oct 2025 09:04:20 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760976254; x=1761581054; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=+lKbG9NxLug9tpbTExvADER/4NXxIUge+fwaTajMZ0k=;

b=YprshrggKlcnEIxfik5ZL/uKwg+P6UAa+hA1X4Ni5J6GPPQom351BgAA3K5MiMmdAt

ZkfcTTw8uu1dm7D23RIx/VD3bzgenT3E8MQynxplivD+a18hs4/hma/3cwAIudFwC/DC

xQ1/kF0LFDKEEeLDtCiydqDl958HkHWh9XGXbozWwZh4+ER3jJUeMtPJSRsAdXYut5ao

wcdlrs8xOcftyoyPeTZlCRoKlZNfdsu4xe3J5HWvz4SN+kR/Ry9Du+79rJcKTorX3J/l

MAaWEIYkIPhivWtZR05eSgoiG4mc0tdpe1tMIYK8AIruAHNEpyqUNDDf/Ox8KCE9FThY

0Euw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760976254; x=1761581054;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=+lKbG9NxLug9tpbTExvADER/4NXxIUge+fwaTajMZ0k=;

b=Yh1TVWerRXKvuBHLpOXubAR0YfRuekAcbvxfPMxLE6d3eccrPQvkPjg4KPAYXxegbA

7PDYEk9yNryiiF71GrKpuC55MBlRMfVkPZ6tINi6RwV60Xy7a7uunhmjwSnv4Drsa/xH

HZ86a7c2wlwFnDfcqjF7Db2L9nAE76pETKZZag9muStdSYRXurDQMhGDx5zTOFG03H7U

fIzv/HOGk/VRAJa8UCzXJHnUaD/wsfwnSxTl0Tbn0wpgslc5NvR6NNJwfrcKxQDX5Evr

gmLUfFN/jdrw2iVYrbdys8l6oYhJal4rhy/rGV4jKfZ0x2hN/bLbppr1nTDi81q7WQSR

VUDg==

X-Gm-Message-State: AOJu0YyKid6zZuxOgcKC16RDgxk8eBfBNVom1nTfQgDlOXQavCPg0Gxz

DFObA84Ayp43+S7BtknVbR1vuKdcgvjuoeRa5o+H7lD7HaqJePKXZ4F9puDGfsQl3lkIFe8GqKW

6XiCdZHq9VA==

X-Google-Smtp-Source: AGHT+IEeHgN/Dj0b1C04H6exn666gxUNGgnW48ajzV8onAhD5f8b4TVCQGBf99cVUnvjMLm9BN2vO0Z9Ey6TP08=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:4421:b0:5d6:254f:4e24 with SMTP id

ada2fe7eead31-5d7dd5ea5f5mr5006435137.32.1760976254360; Mon, 20 Oct 2025

09:04:14 -0700 (PDT)

Message-ID: <000000000000195b1d0641993c2a@google.com>

Date: Mon, 20 Oct 2025 16:04:14 +0000

Subject: =?UTF-8?Q?He_Snored_for_20_Years=E2=80=A6_Then_One_Night=2C_It_Just_St?=

=?UTF-8?Q?opped?=

From: SleepZee Support

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000195b120641993c27"

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Image 1 Image 2 Device Width Images



Content analysis details: (10.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.217.69 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

[209.85.217.69 listed in dnsbl.ahbl.org]

[209.85.217.69 listed in dnsbl.ahbl.org]

[209.85.217.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

1.9 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: gefeliciteerdexclusievecoted.s3.amazonaws.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: gefeliciteerdexclusievecoted.s3.amazonaws.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/3.18.56.123]

[URI: click.convertkit-mail2.com/3.141.222.179]

[URI: click.convertkit-mail2.com/18.220.225.51]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.69 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?He_Snored_for_20_Years=E2=80=A6_Then_One_Night=2C_It_Just_St?=

=?UTF-8?Q?opped?=



--000000000000195b120641993c27

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Image 1 Image 2







--000000000000195b120641993c27

Content-Type: text/html; charset="UTF-8"













Device Width Images

















--000000000000195b120641993c27--

Anti Snoring Health spam from Google Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 11:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAtGI-00000000DBQ-00Vu

for dave@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 11:01:34 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 11:01:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f71.google.com ([209.85.222.71]:42242)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAsWq-00000000L1Y-0UW8

for doctor@netknow.ca;

Mon, 20 Oct 2025 10:14:43 -0600

Received: by mail-ua1-f71.google.com with SMTP id a1e0cc1a2514c-932ccaf3577so3820947241.1

for ; Mon, 20 Oct 2025 09:13:49 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760976823; x=1761581623; darn=netknow.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=8/gKMX8jYzlsxXrtTDrR+I/Py6UDOiWAF2gu7JgeFlM=;

b=JNNmH7ElVyfofA6lz2XIL5BBf2PkCTPmZ/zzUb2vwJFThLguP9F/2KkgdLWD4xrBoM

OBW5XKLyAY28tgll0/mpuuxlONSBfDiykfz7Uq7B9Ej6Czm9QsIahWOmniWGoSIPm2N3

aUjG31ZgDA8a/9slQ1ClfF1dX1Oky/XXfIE4/vy6JUEuNDuXyuFWT72b4mW/9QhktbvD

ThW1uWT+SATzcw40wXY4ngBtxkodWCNiSoWlZyuIuBzkQApID3ZBBdzpSfliRti3vOcF

C2cSjwjWyyqD1s5nHQwe6GcrAtvRFeFDqJVBEMfFkQ2IYrfCQtwZ1c+8vENcvCVNChMI

+tpw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760976823; x=1761581623;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=8/gKMX8jYzlsxXrtTDrR+I/Py6UDOiWAF2gu7JgeFlM=;

b=MlVyi4HRlE6nf9hUvWvTbYIMES5dYsNcNv10FCGGJqIzJysmWTW9kAWJBSMK3gN80z

USfCQ4M2Owb6hQ6QP4hoQcllZuWVaU2hi7RjdmL69bHGqszfcswjEJH2keBUzzc3Yi4J

2FIK/2bWDcd4/I76h4klyWijOwocRJe5Mn2V24CskoK8Od4oQ4TkPh2NPpkR7IKEQQSq

1HB1PJV/G03REH+ccFSD+mu3L9tTOUopYBYyiauV+IlppFQwSp6IWsj6YNWgjeCLRIDU

asjMmXLQH/kB4P9Pzc3W/6gIEpsGdo3AI9owVEnAYaklFFhvluzCDqLNmNnvFEaBKr3t

+iag==

X-Gm-Message-State: AOJu0YySy8lK9NjQUXz6j7FFMlxbySwyQYbJhtXUGcgKiV0aSJdXhrv9

bHkAiU5Gt/COLVYshHgkQM8N/olLUV+EGZb6VKJkH63bL3NJiOr+eaUd7YoUC7ngJwFFyxJws5R

vblHp4GFsfA==

X-Google-Smtp-Source: AGHT+IGTwPZ7niT4fQBX47wPma4LZcJrqqhCM8twr3+s+QnsH0P7X1mHDjZL5Dr4iCv+QvLI19CWumJsjXG8z24=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:510c:b0:5d6:12fa:b4ec with SMTP id

ada2fe7eead31-5d7dd507b67mr4562510137.4.1760976823351; Mon, 20 Oct 2025

09:13:43 -0700 (PDT)

Message-ID: <0000000000000379360641995e6c@google.com>

Date: Mon, 20 Oct 2025 16:13:43 +0000

Subject: =?UTF-8?Q?He_Snored_for_20_Years=E2=80=A6_Then_One_Night=2C_It_Just_St?=

=?UTF-8?Q?opped?=

From: SleepZee Support

To: doctor@netknow.ca

Content-Type: multipart/alternative; boundary="0000000000000379280641995e69"

X-Spam_score: 13.2

X-Spam_score_int: 132

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Image 1 Image 2 Device Width Images



Content analysis details: (13.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.71 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

1.9 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: gefeliciteerdexclusievecoted.s3.amazonaws.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: gefeliciteerdexclusievecoted.s3.amazonaws.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/18.220.225.51]

[URI: click.convertkit-mail2.com/3.141.222.179]

[URI: click.convertkit-mail2.com/3.18.56.123]

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[209.85.222.71 listed in psbl.surriel.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.71 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?He_Snored_for_20_Years=E2=80=A6_Then_One_Night=2C_It_Just_St?=

=?UTF-8?Q?opped?=



--0000000000000379280641995e69

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Image 1 Image 2







--0000000000000379280641995e69

Content-Type: text/html; charset="UTF-8"













Device Width Images

















--0000000000000379280641995e69--

Anti Snoring Health spam from Google Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 11:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAtGQ-00000000DCp-3kYm

for dave@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 11:01:42 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 11:01:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f197.google.com ([209.85.221.197]:43433)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAsZL-00000000LHp-43vh

for support@nk.ca;

Mon, 20 Oct 2025 10:17:18 -0600

Received: by mail-vk1-f197.google.com with SMTP id 71dfb90a1353d-54bbdfb584eso12705956e0c.1

for ; Mon, 20 Oct 2025 09:16:25 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760976979; x=1761581779; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=xwkKn/ggUQ3XBknWLj6ssccjFTXXAvmDLo3mfpSRK90=;

b=OEKAxmjWwgx3BmY6dCHuu8mzu8I7ycUlH00qD4Y+iVN+mQv8yaXV0/ALQxFMha4QHq

+DvSCytupKzDn3PwkGQ4qgzFpAhNM+0h51gizHYP0FIGhWe0QLXmT+vMcI2A8ftehKzV

LKTy9MXmaRpDTwxClB9x+QNe2lxFF2BRdCOTyCTdmVph/IWgyL7/ICX8u3SU1lOgOFcX

kS1cIgCaFBI7gJEQSL1asQ0bFIYrf32BiBJPsKjjitWXor080RhyZlj1+V+TvciWH/Oi

Brl3mDMzFmas3hTpI1JeAaQPex8cv/+60PJG0m5D9H04HyguutaPGqO3otLt4j9XRSKr

YWDA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760976979; x=1761581779;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=xwkKn/ggUQ3XBknWLj6ssccjFTXXAvmDLo3mfpSRK90=;

b=Z6JThyfUmW4WkEr/mduiwAcMm0WU9vlDJMqimd54z6AU8X2A6+C5+zM+R24Jb7Twvd

KLUa58Ha1gOvxaIcdsCmW0c00mto5Nj7fq6FHpzqBh9Cug1p8HZLJubO13UiePRM4khV

aRgsmQvjGxrGNrPBHNkwYGj6pwg1Mzw2ESDSlvUK07NTdMfjQzE1Qh2Dd31UbcE9tRJr

jPISQptPgdw6Cj7+/cvj9XfNmaHkPvpfy3pAicXIog4crdpKWBHZL7wljcN9CBdCGnvY

hXvxiiWK6Oh/UX60FRcUL2rn+8iMrmzIdRPKvNeu4IsvLSAv15Diz1QubmgIAfJ+o9re

ReUg==

X-Gm-Message-State: AOJu0YwEOryeRsDjaLDjubZyIFWIaysRqkzt8Vbxfsrsg9Zp7NsmycRO

la2FyR0A14lyagPqcno38mF86Z9Yz28vEJpc6C9fdfsJtcaQtTwb9KIREVmGO/BBfrNTN10aFjp

jIBGi21jeIw==

X-Google-Smtp-Source: AGHT+IGaThTwu1z87uDu/rbA9xOEF4wDNK15raYeLxrVnUfhykFjdj77fgL+4iUlWXg/8JPdtK3LTqcR07tdl5A=

MIME-Version: 1.0

X-Received: by 2002:a05:6122:d95:b0:54a:8690:7193 with SMTP id

71dfb90a1353d-5564ee82868mr4108001e0c.4.1760976979645; Mon, 20 Oct 2025

09:16:19 -0700 (PDT)

Message-ID: <0000000000005453c2064199679c@google.com>

Date: Mon, 20 Oct 2025 16:16:19 +0000

Subject: =?UTF-8?Q?He_Snored_for_20_Years=E2=80=A6_Then_One_Night=2C_It_Just_St?=

=?UTF-8?Q?opped?=

From: SleepZee Support

To: support@nk.ca

Content-Type: multipart/alternative; boundary="0000000000005453a50641996799"

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Image 1 Image 2 Device Width Images



Content analysis details: (10.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.197 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

[209.85.221.197 listed in dnsbl.ahbl.org]

[209.85.221.197 listed in dnsbl.ahbl.org]

[209.85.221.197 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

1.9 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: gefeliciteerdexclusievecoted.s3.amazonaws.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: gefeliciteerdexclusievecoted.s3.amazonaws.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/3.141.222.179]

[URI: click.convertkit-mail2.com/3.18.56.123]

[URI: click.convertkit-mail2.com/18.220.225.51]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.197 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?He_Snored_for_20_Years=E2=80=A6_Then_One_Night=2C_It_Just_St?=

=?UTF-8?Q?opped?=



--0000000000005453a50641996799

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Image 1 Image 2







--0000000000005453a50641996799

Content-Type: text/html; charset="UTF-8"













Device Width Images

















--0000000000005453a50641996799--

Anti Snoring Health spam from Google Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 11:01:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAtFW-00000000Cxx-0i4o

for dave@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 11:00:46 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 11:00:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f199.google.com ([209.85.221.199]:58381)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vArxB-00000000Hp9-2uZh

for doctor@nk.ca;

Mon, 20 Oct 2025 09:37:52 -0600

Received: by mail-vk1-f199.google.com with SMTP id 71dfb90a1353d-54bcbbc35d1so343664e0c.0

for ; Mon, 20 Oct 2025 08:36:58 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760974612; x=1761579412; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=8qpJDS5LbbdZKLQOgItOgHZGWXFpaztTlXj3UzVbc88=;

b=He1UspGngy5vzQ54ZD49Q1Eu+mXVG1uLM6Gku/undCUAIHgsEgJOkrfE3lWHa34CGZ

r9UN7vpvmRMwKFs858+CJGLC/sKuRJwER8klXvQ/IFAfzyjPKXKHitLJMRZP71xFFwsd

G/AiJGtO27NSq2BCPKlI+vE8bksnCLvke/6qSA5DW/3+inJKp5KM6IO/XI5p9t4qrPwY

YkkyzHX/7jsJPomsYtK/sLkL7ej2mJILNhEITaptxfwAVS9ZiHBaAIgec2RtDx80kWDE

pG4EJdrABglWwQWpxEhjAfV1qfb4PB0Rg7SEQapB2HSTN2DmyUD8+v/IudxOBRw/GZ5S

8otw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760974612; x=1761579412;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=8qpJDS5LbbdZKLQOgItOgHZGWXFpaztTlXj3UzVbc88=;

b=GsR9fctRUZ6iSYovAa1wdM/deAy/W2N2260FygDFS3K7j3kL9GusYBwFZBerVNueVp

xqNW3zJ+1PBOQJKdCqTaSlciuKQSg2EdgpDM3mujgpM3l8XhkBQnUHy0lzT930TVC4CY

7r2mp6GQockkzw+wka+i0ti5VkOHKpSzwXlxW11Mxcgfxyt/Db13cVO0kz5iRfYCFnrT

si25+httmoISeXg5dfZlk0CXNDSpoTXwD3vpJ64K7BDsLmXcUpAllcdt6zIrH40U/G3l

WnN3S/+BnohN6rddpoMhi2T7Qf6MM3/Obop2uHBXMA5tEOhNBOREc3htybhU3VxdKbNi

tOlw==

X-Gm-Message-State: AOJu0YyAW9eDwJ5uwGWR2iLRDLvfcjhoY1B7PzD4jVb+IWlN6SnAsK2/

vPaFzjxicHZWFt/fTXEPG17+sACGrQyls5wCKkMIsQPrKM6SPRYW7fPf6OsNUN1PVl+GmuLK7wZ

wXNJFENM9bA==

X-Google-Smtp-Source: AGHT+IG35ewLbNKXNAjiHkOTLzdvA3kE4zoVB1tEfpI5QVjTamEuWYgNwK+N1jVZoVAkv/KpC9zr5V9Os0o3bCQ=

MIME-Version: 1.0

X-Received: by 2002:a05:6122:d8e:b0:554:afee:9a83 with SMTP id

71dfb90a1353d-5564ee607c4mr3604512e0c.4.1760974612702; Mon, 20 Oct 2025

08:36:52 -0700 (PDT)

Message-ID: <0000000000003fa7fa064198da6f@google.com>

Date: Mon, 20 Oct 2025 15:36:52 +0000

Subject: =?UTF-8?Q?He_Snored_for_20_Years=E2=80=A6_Then_One_Night=2C_It_Just_St?=

=?UTF-8?Q?opped?=

From: SleepZee Support

To: doctor@nk.ca

Content-Type: multipart/alternative; boundary="0000000000003fa7e5064198da6c"

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Image 1 Image 2 Device Width Images



Content analysis details: (10.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.199 listed in will-spam-for-food.eu.org]

[209.85.221.199 listed in will-spam-for-food.eu.org]

[209.85.221.199 listed in will-spam-for-food.eu.org]

[209.85.221.199 listed in will-spam-for-food.eu.org]

[209.85.221.199 listed in will-spam-for-food.eu.org]

[209.85.221.199 listed in will-spam-for-food.eu.org]

[209.85.221.199 listed in will-spam-for-food.eu.org]

[209.85.221.199 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.221.199 listed in dnsbl.ahbl.org]

[209.85.221.199 listed in dnsbl.ahbl.org]

[209.85.221.199 listed in dnsbl.ahbl.org]

[209.85.221.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.221.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.221.199 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.221.199 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.221.199 listed in dnsbl.ahbl.org]

1.9 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: gefeliciteerdexclusievecoted.s3.amazonaws.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: gefeliciteerdexclusievecoted.s3.amazonaws.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/3.18.56.123]

[URI: click.convertkit-mail2.com/3.141.222.179]

[URI: click.convertkit-mail2.com/18.220.225.51]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.199 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?He_Snored_for_20_Years=E2=80=A6_Then_One_Night=2C_It_Just_St?=

=?UTF-8?Q?opped?=



--0000000000003fa7e5064198da6c

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Image 1 Image 2







--0000000000003fa7e5064198da6c

Content-Type: text/html; charset="UTF-8"













Device Width Images

















--0000000000003fa7e5064198da6c--

Anti Snoring Health spam from Google Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 11:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAtFO-00000000CtB-0gzw

for dave@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 11:00:38 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 11:00:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f69.google.com ([209.85.217.69]:47283)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vArr9-00000000HJ2-23M9

for doctor@nl2k.ab.ca;

Mon, 20 Oct 2025 09:31:38 -0600

Received: by mail-vs1-f69.google.com with SMTP id ada2fe7eead31-5d5eb99cf08so9620207137.2

for ; Mon, 20 Oct 2025 08:30:44 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760974238; x=1761579038; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=/UCevZM6Lyhq2hNhTL4Pt3YmdmjzvmeCgnr1KVfR5do=;

b=Rg/YkiqHgmvHP1lh5dUA+YiC8YHrvgFe93Qc0cmQZSE0W1dokDyYr33frC8wkdergq

ZNjBLIfTNWQ/4A2fWXa4qoI9MUwHADeWkBYHAZC5z79gGp1OlDsQEANAM0VwCOu3qVhc

HjIVM2eyfq4t3tRU7hEou0fWguImTd1pDniy06qMjUWIixFY0zhhHdjQMeK/sx+95LVh

4/whIoOWkdX3qgAvZgwdS7xP6WgbNOe1iDQFjEZyrx1VaB6KeY1yf+49+Lw2PGxQC6/C

jZ3EMhGvRGav5Ez3YOLPCf1/Mt7msI2PCcM6bE28AWonsq1IMAEGDpZTLHxM+RfkRbBu

EjEA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760974238; x=1761579038;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=/UCevZM6Lyhq2hNhTL4Pt3YmdmjzvmeCgnr1KVfR5do=;

b=RtNkdtdcvyLv0JY9UoXdrzyMTZEO75mjJh/3JrByQYuaWAOAcu+Rlfv5BDWO/JuNfL

zaEyo4lDjEKrOcL4JJf1uIr2//6+DTFrtiEFcWHwEmu3AsWuBnx4DUpSm5QQixIxiEBU

q3d7wefQue7xRMGKy8A81ycZhLrRtuI07jRC25/GTs6LpqZ+K6Z3NAqLTnsPTdr97dQ4

P2vfG5yONiDO4vbxgzhOhQcGR+363tXG/C3QtDo1J5+omdKdP3YSY1BcG/YpgwaBFI+b

GKArlHRyIOr8Qy31Jt5zqbdqMvPt1hzcAoHPFxnSCdgFZcAvkMOCiZmagaGzS1sMwwBp

OR5g==

X-Gm-Message-State: AOJu0YwY+YfGrbqN/thj9V94sqznhDzPzJ1mUPOK38v/Yeq5+l73c/Sj

iDbOrGw/bWANAaTvLJQ/CI+vMSM8IlyEs33AGI7xjcc+MJ+vX9jyyfFz80dOKQstBNa2BXmSbef

K43y7oTNNdA==

X-Google-Smtp-Source: AGHT+IF0F231gL+2+c07FI8dmfSZgh+AOUGSB+buAxGkFz91xV5Jg9i4SNFR2FKurMIay+kV37qJneWnxRhIrE8=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:358d:b0:537:f1db:76ab with SMTP id

ada2fe7eead31-5d7dd471c4dmr4200066137.14.1760974238166; Mon, 20 Oct 2025

08:30:38 -0700 (PDT)

Message-ID: <000000000000ecad93064198c337@google.com>

Date: Mon, 20 Oct 2025 15:30:38 +0000

Subject: =?UTF-8?Q?He_Snored_for_20_Years=E2=80=A6_Then_One_Night=2C_It_Just_St?=

=?UTF-8?Q?opped?=

From: SleepZee Support

To: doctor@nl2k.ab.ca

Content-Type: multipart/alternative; boundary="000000000000ecad8a064198c334"

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Image 1 Image 2 Device Width Images



Content analysis details: (10.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.217.69 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

[209.85.217.69 listed in dnsbl.ahbl.org]

[209.85.217.69 listed in dnsbl.ahbl.org]

[209.85.217.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

1.9 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: gefeliciteerdexclusievecoted.s3.amazonaws.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: gefeliciteerdexclusievecoted.s3.amazonaws.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/18.220.225.51]

[URI: click.convertkit-mail2.com/3.18.56.123]

[URI: click.convertkit-mail2.com/3.141.222.179]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.69 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?He_Snored_for_20_Years=E2=80=A6_Then_One_Night=2C_It_Just_St?=

=?UTF-8?Q?opped?=



--000000000000ecad8a064198c334

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Image 1 Image 2







--000000000000ecad8a064198c334

Content-Type: text/html; charset="UTF-8"













Device Width Images

















--000000000000ecad8a064198c334--

Anti Snoring Health spam from Google Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 11:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAtF2-00000000BxZ-1b7L

for dave@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 11:00:16 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 11:00:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f69.google.com ([209.85.222.69]:51532)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vArCO-00000000Dc7-2ngK

for support@nk.ca;

Mon, 20 Oct 2025 08:49:31 -0600

Received: by mail-ua1-f69.google.com with SMTP id a1e0cc1a2514c-92eb7ac6c06so8935451241.3

for ; Mon, 20 Oct 2025 07:48:38 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760971712; x=1761576512; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=EAvZuZvkPxUU4W8VpQc8BnhxqYdjOKoPYOdbzorJLuM=;

b=TykMBzVLOwLNuTdwdXayxoq35tkz0FpJYi3K4fmfIt+WvDyV4DZxNRGqMTnmCKDu7q

ww2xbRrnV5v2GBOKOzvwAc0iiK8ZcnuyZIWWqZGiIk2vsdU30rV2poJeV99EuMBnCiZL

Srh7XlRa/ZwxcR8XSMDpUwYvrRDYrnRt8b7v12SVvtudc5pW4aOim2upHdeyr3Ogd3AV

O4u7ahg9rQZfqpFoUvQeMV2z03hKKSi/gIbv5FwBLpU2GGmNjAlvGDq2r5llWpM5GMlw

g0CEp9m9KKPzo2oC+4GGQ6sNv/Cg9alp6S4aqcp2nfMsftwr4YwqpEYlraNBOb9h1mo0

1zvg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760971712; x=1761576512;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=EAvZuZvkPxUU4W8VpQc8BnhxqYdjOKoPYOdbzorJLuM=;

b=FyzRHtwYctKP4c80jXJ5QaoO0hCff7mYt8UY7AhX4qlX9NgDibAv8LYLeZ5uktEKw/

KrVrqBOnLvU4WQXNMKC6l+CTx7ws8dSyU4HUzpPdj3h23OCDfnz4KWUgB3fh5ZcG7vLO

LYl8TF8L8fbgTOjoXb/+HIQ85YydUBNdobRCXoQOFRf9em4Ds5reVM3bVcUbz+F2MoGe

zFA9JX8pG1HvYmniidhwjfKX3m+gpLT58ztupBxvMbKCL3D/s8BNUum3UGO5QK0ZBEwz

jzv/VAsfT1sPjVke4vFGUtiS5Miz/3ua9HjnIvJA990R6XJ3zXTN42C1I+5SANQRdYqv

OV9g==

X-Gm-Message-State: AOJu0YysXI/08e5l+HDoHbY3/l2hk8ygFgYP2WG2lt+K6nM02vriv7Ir

563IxdcKk4BJsgKTDFaOhmiiXlS/AlrbpFqdpdONzYPVhTX6m1Fldpq7rdLID/sXD26JszQ8+zv

sGuUh1prJbQ==

X-Google-Smtp-Source: AGHT+IFzmwcz8Puj5w3O2Q1if9PKwambLJrd8GIEcUaI3rh5UINZDBmuByFjKzpnNFcY3fRpoFXkVf9a1Fd3Fgg=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:c08:b0:5d6:36fd:8163 with SMTP id

ada2fe7eead31-5d7dd6d3bbfmr4371753137.39.1760971712394; Mon, 20 Oct 2025

07:48:32 -0700 (PDT)

Message-ID: <0000000000006074760641982d5c@google.com>

Date: Mon, 20 Oct 2025 14:48:32 +0000

Subject: =?UTF-8?Q?He_Snored_for_20_Years=E2=80=A6_Then_One_Night=2C_It_Just_St?=

=?UTF-8?Q?opped?=

From: SleepZee Support

To: support@nk.ca

Content-Type: multipart/alternative; boundary="0000000000006074680641982d59"

X-Spam_score: 13.2

X-Spam_score_int: 132

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Image 1 Image 2 Device Width Images



Content analysis details: (13.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.69 listed in list.dnswl.org]

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[209.85.222.69 listed in psbl.surriel.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

[209.85.222.69 listed in dnsbl.ahbl.org]

[209.85.222.69 listed in dnsbl.ahbl.org]

[209.85.222.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

1.9 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: gefeliciteerdexclusievecoted.s3.amazonaws.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: gefeliciteerdexclusievecoted.s3.amazonaws.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/18.220.225.51]

[URI: click.convertkit-mail2.com/3.18.56.123]

[URI: click.convertkit-mail2.com/3.141.222.179]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.69 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?He_Snored_for_20_Years=E2=80=A6_Then_One_Night=2C_It_Just_St?=

=?UTF-8?Q?opped?=



--0000000000006074680641982d59

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Image 1 Image 2







--0000000000006074680641982d59

Content-Type: text/html; charset="UTF-8"













Device Width Images

















--0000000000006074680641982d59--

Anti Snoring Health spam from Google Gmail

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 11:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAtEx-00000000BYd-2Uy6

for dave@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 11:00:11 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 11:00:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f71.google.com ([209.85.217.71]:56565)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAr70-00000000D99-2mkM

for doctor@netknow.ca;

Mon, 20 Oct 2025 08:43:57 -0600

Received: by mail-vs1-f71.google.com with SMTP id ada2fe7eead31-59d4df51326so8828131137.0

for ; Mon, 20 Oct 2025 07:43:04 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760971378; x=1761576178; darn=netknow.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=IAwq2fQ9KUsIFXtyWXIXoPMUClvdtFtaj1yvhjwgXrI=;

b=f/2hQDjJ+lG5i5yF4X4WsTncUOUzbtjLTW3XRnAMsufRej7CE64HAkmohkLR/7JgOf

oE2yvOzc8bIh5az4ZSjVg58LVvQMU8RhU9mfTr0Tn1/QWAoO/V9qOQX4LpfgpQWRdGdv

0Cazlv0qXWVhon+jtGfTotwOsqyy8etUUFANg+XchV11TLi02u1gnqel/mdituJKg04U

df9EkP3DaW/1W6RR45kVs/kLQj3ZmtIN1mLzP94P8xbyOJg9RWh4wbPxxHt4rC5NaReD

u9xukBRZEQTLVMvz8MnSKhRhiO+Q6mVgIJqc2rk7Uo0eSarlJpZsp2gq5hsBlxnFJxbS

cr2g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760971378; x=1761576178;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=IAwq2fQ9KUsIFXtyWXIXoPMUClvdtFtaj1yvhjwgXrI=;

b=xOk0KYAEmupO3PCg6+K46lMQBS+EmK1KUMR3r0AEjZ1UpUgtkhdFVg7dfHaeE/6pwU

6h9fggl7poBQy5LfOE/+h+ZJhFMbJstRn4F2Di357j8Nvj1auR4Ei44ogBNNUH7kzmAM

lNxoUrY0lViSeUVq5elAJnKm1LNbz+Z82bG7FF47BJPEZHF7AgET56j+/mFm8nlvf+o8

vCLKWv6dIERLtwc6rGqX+srsExpO3RHvfiyDlz1YdhqVKvAa88fvXtTEdLEUDnLAjBCu

qbl/02YrcA7veeWY5vg4E7/KWkYZBRV1u7SRdf1C+yCkdaJ4NRZw2bpxCDDT25rzL/yZ

C8dg==

X-Gm-Message-State: AOJu0YxuP72mg+8BkB3ao3fkDXSPvQjJq4tyzEQYG19EwgeL7mqDJumx

8LT8+lSLZpNcDDfobKv0bmFM4FdPyqy6TVvAz7UfkjB56e3YNS8CVs8prQIgS/YgjRqosUHSayn

CeSt/a09HvQ==

X-Google-Smtp-Source: AGHT+IFMi2tQI6iJiYBYafGNjHb/aiX1zHlGGwwkBDNgw2mhKmXR1jL563yo9FTpmHdX8GDpJnAA6L//n0BBp/Q=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:c89:b0:5d5:f6ae:38fa with SMTP id

ada2fe7eead31-5d7dd62020dmr4316680137.39.1760971377789; Mon, 20 Oct 2025

07:42:57 -0700 (PDT)

Message-ID: <0000000000006ecbcf06419819d1@google.com>

Date: Mon, 20 Oct 2025 14:42:57 +0000

Subject: =?UTF-8?Q?He_Snored_for_20_Years=E2=80=A6_Then_One_Night=2C_It_Just_St?=

=?UTF-8?Q?opped?=

From: SleepZee Support

To: doctor@netknow.ca

Content-Type: multipart/alternative; boundary="0000000000006ecbab06419819ce"

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Image 1 Image 2 Device Width Images



Content analysis details: (10.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

[209.85.217.71 listed in dnsbl.ahbl.org]

[209.85.217.71 listed in dnsbl.ahbl.org]

[209.85.217.71 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: gefeliciteerdexclusievecoted.s3.amazonaws.com]

1.9 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: gefeliciteerdexclusievecoted.s3.amazonaws.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/18.220.225.51]

[URI: click.convertkit-mail2.com/3.18.56.123]

[URI: click.convertkit-mail2.com/3.141.222.179]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.217.71 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.71 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?He_Snored_for_20_Years=E2=80=A6_Then_One_Night=2C_It_Just_St?=

=?UTF-8?Q?opped?=



--0000000000006ecbab06419819ce

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Image 1 Image 2







--0000000000006ecbab06419819ce

Content-Type: text/html; charset="UTF-8"













Device Width Images

















--0000000000006ecbab06419819ce--

Nigerian spam

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 11:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAtEr-00000000BBz-46YU

for dave@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 11:00:05 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 11:00:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.msyajans.com ([213.238.181.239]:33435)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vArnr-00000000Gvc-1dJP

for root@nl2k.ca;

Mon, 20 Oct 2025 09:28:15 -0600

Received: from server.msyajans.com (localhost.localdomain [127.0.0.1])

by server.msyajans.com (Postfix) with ESMTP id 041BDC7D0A;

Mon, 20 Oct 2025 17:42:53 +0300 (+03)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pestavrasya.com.tr;

s=default; t=1760971374;

bh=FXBtIpyFfZg33+uADBDFEYbjs4HrEZR4BELxwL8FDRw=;

h=Received:Received:From:To:Subject;

b=iGwljlNODdT3aZve2IYxq3B3lLXqIoUj25fp04dqtCaorkfWqZqjNEnaejoMH/93B

hlX1UrNUhST63N4IgBDOHxdLwyx3ldtqSHNZcFXBVlyznpVDL0vPk8vWkOZADsooNj

PN3fFPalgOm0rEe0XzPgQLd+dKq19Llsoweur/MiEugjBWAIDBBM9TAZJ3ejvVKjFD

jkG0QKZdHS1qX3AkudBgoV/RyBE7vWMOpUqy5oNwyBbGY4JjzV4TDy3RUBbYDwAR3z

zlQkc1Mq6IxbRubXtUpvTpW3dWARWFcmOe2XnCiDAwchHJmfp/km9EpRq/yU7w+OMs

HkHBnIDJd6mHA==

Authentication-Results: server.msyajans.com;

spf=pass (sender IP is 127.0.0.1) smtp.mailfrom=access@pestavrasya.com.tr smtp.helo=server.msyajans.com

Received-SPF: pass (server.msyajans.com: localhost is always allowed.) client-ip=127.0.0.1; envelope-from=access@pestavrasya.com.tr; helo=server.msyajans.com;

X-Spam-Flag: YES

X-Spam-Score: 4.486

X-Spam-Level: ****

X-Spam-Status: Yes, score=4.486 tagged_above=-9999 required=1

tests=[ALL_TRUSTED=-1, BAYES_00=-1.9, DKIM_SIGNED=0.1,

DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,

FREEMAIL_FORGED_REPLYTO=2.095, FREEMAIL_REPLYTO_END_DIGIT=0.25,

HTML_MESSAGE=0.001, ODD_FREEM_REPTO=1.844, SPF_PASS=-0.001,

UNDISC_MONEY=3.396, URIBL_BLOCKED=0.001]

autolearn=no autolearn_force=no

Authentication-Results: server.msyajans.com (amavisd-new);

dkim=pass (2048-bit key) header.d=pestavrasya.com.tr

Received: from server.msyajans.com ([127.0.0.1])

by server.msyajans.com (server.msyajans.com [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id Bou5PcGf4_Me; Mon, 20 Oct 2025 17:42:51 +0300 (+03)

Received: from webmail.pestavrasya.com.tr (localhost.localdomain [IPv6:::1])

by server.msyajans.com (Postfix) with ESMTPSA id 6A655C7C4D;

Mon, 20 Oct 2025 17:42:34 +0300 (+03)

Received-SPF: pass (server.msyajans.com: connection is authenticated)

MIME-Version: 1.0

Date: Mon, 20 Oct 2025 15:42:34 +0100

From: Faisal

To: undisclosed-recipients:;

Subject: Hello

Reply-To: faisalaalhamad55@gmail.com

Mail-Reply-To: faisalaalhamad55@gmail.com

Message-ID: <315c2eb619841e30314c9adfe385dfcf@pestavrasya.com.tr>

X-Sender: access@pestavrasya.com.tr

Content-Type: multipart/alternative;

boundary="=_5f7ebd67ab6c4d17b35faa65f1731b44"

X-PPP-Message-ID:

<176097135541.1034752.10603231568937916581@server.msyajans.com>

X-PPP-Vhost: pestavrasya.com.tr

X-Spam_score: 10.0

X-Spam_score_int: 100

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello It is my pleasure to communicate with you for the first

time and it is for a great cause. As an investment Banker, I have funds in

my bank I wish to direct to you as a foreigner for investment p [...]



Content analysis details: (10.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[faisalaalhamad55(at)gmail.com]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[213.238.181.239 listed in sa-accredit.habeas.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[213.238.181.239 listed in sa-trusted.bondedsender.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[213.238.181.239 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.8 ODD_FREEM_REPTO Has unusual reply-to header

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[213.238.181.239 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[213.238.181.239 listed in bl.score.senderscore.com]

Subject: {SPAM?} Hello



--=_5f7ebd67ab6c4d17b35faa65f1731b44

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=US-ASCII;

format=flowed



Hello

It is my pleasure to communicate with you for the first time and it is

for a great cause. As an investment Banker, I have funds in my bank I

wish to direct to you as a foreigner for investment purpose. Contact me

now via my private email for more information and modalities. Email:

faisalaalhamad55@gmail.com



Faisal A.Al-Hamad,

CEO Global Wealth Management,

National Bank of Kuwait, Kuwait.

--=_5f7ebd67ab6c4d17b35faa65f1731b44

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8




=3DUTF-8" />
eva,sans-serif'>






Hello
It is my pleasure to communicate with you for the first time =

and it is for a great cause. As an investment Banker, I have funds in my ba=

nk I wish to direct to you as a foreigner for investment purpose. Contact m=

e now via my private email for more information and modalities. Email: fais=

alaalhamad55@gmail.com



Faisal A.Al-Hamad,
CEO Global Wealth Management,
National Bank=

of Kuwait, Kuwait.









--=_5f7ebd67ab6c4d17b35faa65f1731b44--

Nigerian spam

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 13:04:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAvAA-00000000MhV-2Ohp

for dave@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 13:03:22 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 13:03:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.msyajans.com ([213.238.181.239]:43003)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAtrn-00000000GW9-06Z7

for usenet@nl2k.ab.ca;

Mon, 20 Oct 2025 11:40:27 -0600

Received: from server.msyajans.com (localhost.localdomain [127.0.0.1])

by server.msyajans.com (Postfix) with ESMTP id 6708AC84E1;

Mon, 20 Oct 2025 19:40:46 +0300 (+03)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pestavrasya.com.tr;

s=default; t=1760978447;

bh=RxUZ7+EoefOzzJuHHtmPlAumNEKtXYX2v4uMhMCatj0=;

h=Received:Received:From:To:Subject;

b=WeJvt03cVCHbGR4rXXVqrm+19+rRXIsphzibwFd7ZT4K0fLBAaX/zyPieDia+KYXg

+bXSF7rCwy0IHdYZ2DmYkXxMxAVdO/VQRlut15s9ULH0LAkJCF/E50LLAAXfEKc2ID

M1p8Gdngsv4ADiQ9MU8cZ+nYQPnuL08h8shh+5Gxif+0Ksa/KmRoyJamUz81NLF5VD

9s1MGIBrVwSr8v3DE2P1CVX76UnB2RuMGb3LVxqBJyG/6jngPreXzjmjlHy00zLHlk

+adZuiSarCtyR0i4U9543WdbRevWsxB3Jl2S5vXCp/EpM+K3r2qjcSd0nHroToeZbZ

MLRzdDDcwe0VQ==

Authentication-Results: server.msyajans.com;

spf=pass (sender IP is 127.0.0.1) smtp.mailfrom=access@pestavrasya.com.tr smtp.helo=server.msyajans.com

Received-SPF: pass (server.msyajans.com: localhost is always allowed.) client-ip=127.0.0.1; envelope-from=access@pestavrasya.com.tr; helo=server.msyajans.com;

X-Spam-Flag: YES

X-Spam-Score: 4.486

X-Spam-Level: ****

X-Spam-Status: Yes, score=4.486 tagged_above=-9999 required=1

tests=[ALL_TRUSTED=-1, BAYES_00=-1.9, DKIM_SIGNED=0.1,

DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,

FREEMAIL_FORGED_REPLYTO=2.095, FREEMAIL_REPLYTO_END_DIGIT=0.25,

HTML_MESSAGE=0.001, ODD_FREEM_REPTO=1.844, SPF_PASS=-0.001,

UNDISC_MONEY=3.396, URIBL_BLOCKED=0.001]

autolearn=no autolearn_force=no

Authentication-Results: server.msyajans.com (amavisd-new);

dkim=pass (2048-bit key) header.d=pestavrasya.com.tr

Received: from server.msyajans.com ([127.0.0.1])

by server.msyajans.com (server.msyajans.com [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id fv0tsYlZPjU7; Mon, 20 Oct 2025 19:40:44 +0300 (+03)

Received: from webmail.pestavrasya.com.tr (localhost.localdomain [IPv6:::1])

by server.msyajans.com (Postfix) with ESMTPSA id E5740C8BA9;

Mon, 20 Oct 2025 19:40:25 +0300 (+03)

Received-SPF: pass (server.msyajans.com: connection is authenticated)

MIME-Version: 1.0

Date: Mon, 20 Oct 2025 17:40:25 +0100

From: Faisal

To: undisclosed-recipients:;

Subject: Hello

Reply-To: faisalaalhamad55@gmail.com

Mail-Reply-To: faisalaalhamad55@gmail.com

Message-ID: <6cd6c76cae283d5f5395076f582cd9bb@pestavrasya.com.tr>

X-Sender: access@pestavrasya.com.tr

Content-Type: multipart/alternative;

boundary="=_599dea1e644ff35e1bebd7505ffd1198"

X-PPP-Message-ID:

<176097842735.1371379.1546738991294121439@server.msyajans.com>

X-PPP-Vhost: pestavrasya.com.tr

X-Spam_score: 10.0

X-Spam_score_int: 100

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello It is my pleasure to communicate with you for the first

time and it is for a great cause. As an investment Banker, I have funds in

my bank I wish to direct to you as a foreigner for investment p [...]



Content analysis details: (10.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[213.238.181.239 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[213.238.181.239 listed in sa-trusted.bondedsender.org]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[213.238.181.239 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[213.238.181.239 listed in bl.score.senderscore.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[faisalaalhamad55(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[213.238.181.239 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.8 ODD_FREEM_REPTO Has unusual reply-to header

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Hello



--=_599dea1e644ff35e1bebd7505ffd1198

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=US-ASCII;

format=flowed



Hello

It is my pleasure to communicate with you for the first time and it is

for a great cause. As an investment Banker, I have funds in my bank I

wish to direct to you as a foreigner for investment purpose. Contact me

now via my private email for more information and modalities. Email:

faisalaalhamad55@gmail.com



Faisal A.Al-Hamad,

CEO Global Wealth Management,

National Bank of Kuwait, Kuwait.

--=_599dea1e644ff35e1bebd7505ffd1198

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8




=3DUTF-8" />
eva,sans-serif'>






Hello
It is my pleasure to communicate with you for the first time =

and it is for a great cause. As an investment Banker, I have funds in my ba=

nk I wish to direct to you as a foreigner for investment purpose. Contact m=

e now via my private email for more information and modalities. Email: fais=

alaalhamad55@gmail.com



Faisal A.Al-Hamad,
CEO Global Wealth Management,
National Bank=

of Kuwait, Kuwait.









--=_599dea1e644ff35e1bebd7505ffd1198--

Nigerian spam

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 13:04:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAv9z-00000000Mgp-3p4K

for dave@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 13:03:11 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 13:03:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.msyajans.com ([213.238.181.239]:46779)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAtQZ-00000000E7N-3vCT

for postmaster@nl2k.ab.ca;

Mon, 20 Oct 2025 11:12:20 -0600

Received: from server.msyajans.com (localhost.localdomain [127.0.0.1])

by server.msyajans.com (Postfix) with ESMTP id B518EC892D;

Mon, 20 Oct 2025 19:14:11 +0300 (+03)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pestavrasya.com.tr;

s=default; t=1760976852;

bh=7aeW2iXWPhaWtamk0AJos9MmYoR5oG16eP7t6JlPqKI=;

h=Received:Received:From:To:Subject;

b=V4+8klElsFO5XGKoCfvPpQozW2O21sPaCrYsi71KgNI7Gb7p/sojlwWu55nIxCVes

qy7RghVsKqQqnIDoKNwNSUE8mZbRM1u3OCo8y+ayxCuh04xh9MAPFgEXG9DVrGWp90

xkZ9WO7HVIiWuSQKSwyjesuWTHIuyJ9ASX9Iz3rQ0vSv97RNNh9LNiwcwImUTCDRi6

ZQNNbF/B8tmKeWjCiHdvOEDhBujE8uSuivbKfp5WaZxpB7G04FxtOMJDz+YaENXE3x

ZWQBnWiSodbtAmuM1DJF6U7ctQmyzCyiSKbK5iFsdUbbl+/48b8cyLVJ6HGwcaq8Bo

kp8mVAPhek3DA==

Authentication-Results: server.msyajans.com;

spf=pass (sender IP is 127.0.0.1) smtp.mailfrom=access@pestavrasya.com.tr smtp.helo=server.msyajans.com

Received-SPF: pass (server.msyajans.com: localhost is always allowed.) client-ip=127.0.0.1; envelope-from=access@pestavrasya.com.tr; helo=server.msyajans.com;

X-Spam-Flag: YES

X-Spam-Score: 4.486

X-Spam-Level: ****

X-Spam-Status: Yes, score=4.486 tagged_above=-9999 required=1

tests=[ALL_TRUSTED=-1, BAYES_00=-1.9, DKIM_SIGNED=0.1,

DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,

FREEMAIL_FORGED_REPLYTO=2.095, FREEMAIL_REPLYTO_END_DIGIT=0.25,

HTML_MESSAGE=0.001, ODD_FREEM_REPTO=1.844, SPF_PASS=-0.001,

UNDISC_MONEY=3.396, URIBL_BLOCKED=0.001]

autolearn=no autolearn_force=no

Authentication-Results: server.msyajans.com (amavisd-new);

dkim=pass (2048-bit key) header.d=pestavrasya.com.tr

Received: from server.msyajans.com ([127.0.0.1])

by server.msyajans.com (server.msyajans.com [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id TXSUjZsmeTbo; Mon, 20 Oct 2025 19:14:08 +0300 (+03)

Received: from webmail.pestavrasya.com.tr (localhost.localdomain [IPv6:::1])

by server.msyajans.com (Postfix) with ESMTPSA id 1982EC8897;

Mon, 20 Oct 2025 19:13:45 +0300 (+03)

Received-SPF: pass (server.msyajans.com: connection is authenticated)

MIME-Version: 1.0

Date: Mon, 20 Oct 2025 17:13:44 +0100

From: Faisal

To: undisclosed-recipients:;

Subject: Hello

Reply-To: faisalaalhamad55@gmail.com

Mail-Reply-To: faisalaalhamad55@gmail.com

Message-ID:

X-Sender: access@pestavrasya.com.tr

Content-Type: multipart/alternative;

boundary="=_cd09a3bab734d18e7cd7a0e214ea57ef"

X-PPP-Message-ID:

<176097682651.1296437.5077892840705373560@server.msyajans.com>

X-PPP-Vhost: pestavrasya.com.tr

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello It is my pleasure to communicate with you for the first

time and it is for a great cause. As an investment Banker, I have funds in

my bank I wish to direct to you as a foreigner for investment p [...]



Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[faisalaalhamad55(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[213.238.181.239 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.8 ODD_FREEM_REPTO Has unusual reply-to header

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Hello



--=_cd09a3bab734d18e7cd7a0e214ea57ef

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=US-ASCII;

format=flowed



Hello

It is my pleasure to communicate with you for the first time and it is

for a great cause. As an investment Banker, I have funds in my bank I

wish to direct to you as a foreigner for investment purpose. Contact me

now via my private email for more information and modalities. Email:

faisalaalhamad55@gmail.com



Faisal A.Al-Hamad,

CEO Global Wealth Management,

National Bank of Kuwait, Kuwait.

--=_cd09a3bab734d18e7cd7a0e214ea57ef

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8




=3DUTF-8" />
eva,sans-serif'>






Hello
It is my pleasure to communicate with you for the first time =

and it is for a great cause. As an investment Banker, I have funds in my ba=

nk I wish to direct to you as a foreigner for investment purpose. Contact m=

e now via my private email for more information and modalities. Email: fais=

alaalhamad55@gmail.com



Faisal A.Al-Hamad,
CEO Global Wealth Management,
National Bank=

of Kuwait, Kuwait.









--=_cd09a3bab734d18e7cd7a0e214ea57ef--

Nigerian spam

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 11:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAtFK-00000000CqO-0mOv

for dave@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 11:00:34 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 11:00:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.msyajans.com ([213.238.181.239]:53989)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAsWg-00000000L1B-2wQz

for root@nk.ca;

Mon, 20 Oct 2025 10:14:35 -0600

Received: from server.msyajans.com (localhost.localdomain [127.0.0.1])

by server.msyajans.com (Postfix) with ESMTP id 2407AC8289;

Mon, 20 Oct 2025 18:30:22 +0300 (+03)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pestavrasya.com.tr;

s=default; t=1760974223;

bh=ou7qVSbCcxvfKb8wdNl4Z9ajdADFJD4dRXznpLFo11Q=;

h=Received:Received:From:To:Subject;

b=PWVpRDo9ntAprk18iXdgQX8LKYt6j2QDPGHiOI1d63tzUvWWRx8g0Zl5O8/+yVt8n

KNZNvRYUH2u5PFgOdI8fkKzStYvdCPVgGSwMixhMomf9TTL/3KL/dkomri7zOf5l9m

mm6xoSP7tiVpY9SNHb5U+aBHpK6Arhscl9HxOsBnMlbDRZQNA+5FuPdLryWvVDOkrZ

I3sOUYzlMVzyqAz9nS5GpymhEfj115t2uTCkZVI8WTanHRs7vRo47cJgDX+zn1afgI

EiZTiwmOBNnRHjf4vVzuBTQ5bgxh8oJL9qJq7T+zUb5TIFv0is4MwYIBuc3JXGVhA4

ne9/23KD/kWnA==

Authentication-Results: server.msyajans.com;

spf=pass (sender IP is 127.0.0.1) smtp.mailfrom=access@pestavrasya.com.tr smtp.helo=server.msyajans.com

Received-SPF: pass (server.msyajans.com: localhost is always allowed.) client-ip=127.0.0.1; envelope-from=access@pestavrasya.com.tr; helo=server.msyajans.com;

X-Spam-Flag: YES

X-Spam-Score: 4.486

X-Spam-Level: ****

X-Spam-Status: Yes, score=4.486 tagged_above=-9999 required=1

tests=[ALL_TRUSTED=-1, BAYES_00=-1.9, DKIM_SIGNED=0.1,

DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,

FREEMAIL_FORGED_REPLYTO=2.095, FREEMAIL_REPLYTO_END_DIGIT=0.25,

HTML_MESSAGE=0.001, ODD_FREEM_REPTO=1.844, SPF_PASS=-0.001,

UNDISC_MONEY=3.396, URIBL_BLOCKED=0.001]

autolearn=no autolearn_force=no

Authentication-Results: server.msyajans.com (amavisd-new);

dkim=pass (2048-bit key) header.d=pestavrasya.com.tr

Received: from server.msyajans.com ([127.0.0.1])

by server.msyajans.com (server.msyajans.com [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id N-ZqRd8g6ygx; Mon, 20 Oct 2025 18:30:20 +0300 (+03)

Received: from webmail.pestavrasya.com.tr (localhost.localdomain [IPv6:::1])

by server.msyajans.com (Postfix) with ESMTPSA id 6FB1FC787C;

Mon, 20 Oct 2025 18:30:02 +0300 (+03)

Received-SPF: pass (server.msyajans.com: connection is authenticated)

MIME-Version: 1.0

Date: Mon, 20 Oct 2025 16:30:02 +0100

From: Faisal

To: undisclosed-recipients:;

Subject: Hello

Reply-To: faisalaalhamad55@gmail.com

Mail-Reply-To: faisalaalhamad55@gmail.com

Message-ID:

X-Sender: access@pestavrasya.com.tr

Content-Type: multipart/alternative;

boundary="=_58a01080615da36173be5c26f74f2e63"

X-PPP-Message-ID:

<176097420469.1144276.15936090095097068086@server.msyajans.com>

X-PPP-Vhost: pestavrasya.com.tr

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello It is my pleasure to communicate with you for the first

time and it is for a great cause. As an investment Banker, I have funds in

my bank I wish to direct to you as a foreigner for investment p [...]



Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[faisalaalhamad55(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[213.238.181.239 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.8 ODD_FREEM_REPTO Has unusual reply-to header

3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Hello



--=_58a01080615da36173be5c26f74f2e63

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=US-ASCII;

format=flowed



Hello

It is my pleasure to communicate with you for the first time and it is

for a great cause. As an investment Banker, I have funds in my bank I

wish to direct to you as a foreigner for investment purpose. Contact me

now via my private email for more information and modalities. Email:

faisalaalhamad55@gmail.com



Faisal A.Al-Hamad,

CEO Global Wealth Management,

National Bank of Kuwait, Kuwait.

--=_58a01080615da36173be5c26f74f2e63

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8




=3DUTF-8" />
eva,sans-serif'>






Hello
It is my pleasure to communicate with you for the first time =

and it is for a great cause. As an investment Banker, I have funds in my ba=

nk I wish to direct to you as a foreigner for investment purpose. Contact m=

e now via my private email for more information and modalities. Email: fais=

alaalhamad55@gmail.com



Faisal A.Al-Hamad,
CEO Global Wealth Management,
National Bank=

of Kuwait, Kuwait.









--=_58a01080615da36173be5c26f74f2e63--

Nigerian spam

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 11:00:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAtE6-000000008z5-0Wq2

for dave@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 10:59:18 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 10:59:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.msyajans.com ([213.238.181.239]:60611)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAr0y-00000000Cb5-1rwe

for www@nl2k.ab.ca;

Mon, 20 Oct 2025 08:37:44 -0600

Received: from server.msyajans.com (localhost.localdomain [127.0.0.1])

by server.msyajans.com (Postfix) with ESMTP id 2FD47C7802;

Mon, 20 Oct 2025 17:19:44 +0300 (+03)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pestavrasya.com.tr;

s=default; t=1760969985;

bh=B8BkSrPinKXRJr+B6qJ6Eke0HvAj2qRa3L4/lQCeDAs=;

h=Received:Received:From:To:Subject;

b=kAXxz+/pe/0i9AZamilGf6GFQnh194J/D3ZjrjH6gc57WIapv/ozThGhw8r6dkMz0

OIEch5cIudTI0/Fw9hfUyFB4PLWnouiQn3QbAYePL+Oy80jzOwCsu8MeZVcbdQNRAq

f9vyP8x80DCADjLNWA8WomlNkVnOUJO+9FX2HLjemvdSVC7egfarZwppxWX+X5u37O

RQFNhcbmCo8qqTFq3IJcqQCMq5ikNOv9p46VQwRf4XLwt4lSlRY+wLQG0vFN03fhpi

OA+kqQ73AgdY1uQElpKB/k6Ei+lUv/A/5/0Dcmjob0uDp99cXN3uRty1+00FqSx/fk

MRqSNx4IfkR7Q==

Authentication-Results: server.msyajans.com;

spf=pass (sender IP is 127.0.0.1) smtp.mailfrom=access@pestavrasya.com.tr smtp.helo=server.msyajans.com

Received-SPF: pass (server.msyajans.com: localhost is always allowed.) client-ip=127.0.0.1; envelope-from=access@pestavrasya.com.tr; helo=server.msyajans.com;

X-Spam-Flag: YES

X-Spam-Score: 4.486

X-Spam-Level: ****

X-Spam-Status: Yes, score=4.486 tagged_above=-9999 required=1

tests=[ALL_TRUSTED=-1, BAYES_00=-1.9, DKIM_SIGNED=0.1,

DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,

FREEMAIL_FORGED_REPLYTO=2.095, FREEMAIL_REPLYTO_END_DIGIT=0.25,

HTML_MESSAGE=0.001, ODD_FREEM_REPTO=1.844, SPF_PASS=-0.001,

UNDISC_MONEY=3.396, URIBL_BLOCKED=0.001]

autolearn=no autolearn_force=no

Authentication-Results: server.msyajans.com (amavisd-new);

dkim=pass (2048-bit key) header.d=pestavrasya.com.tr

Received: from server.msyajans.com ([127.0.0.1])

by server.msyajans.com (server.msyajans.com [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id 11K6OON7QD2d; Mon, 20 Oct 2025 17:19:42 +0300 (+03)

Received: from webmail.pestavrasya.com.tr (localhost.localdomain [IPv6:::1])

by server.msyajans.com (Postfix) with ESMTPSA id A1199C1701;

Mon, 20 Oct 2025 17:19:23 +0300 (+03)

Received-SPF: pass (server.msyajans.com: connection is authenticated)

MIME-Version: 1.0

Date: Mon, 20 Oct 2025 15:19:23 +0100

From: Faisal

To: undisclosed-recipients:;

Subject: Hello

Reply-To: faisalaalhamad55@gmail.com

Mail-Reply-To: faisalaalhamad55@gmail.com

Message-ID:

X-Sender: access@pestavrasya.com.tr

Content-Type: multipart/alternative;

boundary="=_ba0e544b12f2e3efe6d0e571dcff71e6"

X-PPP-Message-ID: <176096996499.908003.906901964919599571@server.msyajans.com>

X-PPP-Vhost: pestavrasya.com.tr

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello It is my pleasure to communicate with you for the first

time and it is for a great cause. As an investment Banker, I have funds in

my bank I wish to direct to you as a foreigner for investment p [...]



Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[faisalaalhamad55(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.8 ODD_FREEM_REPTO Has unusual reply-to header

3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[213.238.181.239 listed in wl.mailspike.net]

Subject: {SPAM?} Hello



--=_ba0e544b12f2e3efe6d0e571dcff71e6

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=US-ASCII;

format=flowed



Hello

It is my pleasure to communicate with you for the first time and it is

for a great cause. As an investment Banker, I have funds in my bank I

wish to direct to you as a foreigner for investment purpose. Contact me

now via my private email for more information and modalities. Email:

faisalaalhamad55@gmail.com



Faisal A.Al-Hamad,

CEO Global Wealth Management,

National Bank of Kuwait, Kuwait.

--=_ba0e544b12f2e3efe6d0e571dcff71e6

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8




=3DUTF-8" />
eva,sans-serif'>






Hello
It is my pleasure to communicate with you for the first time =

and it is for a great cause. As an investment Banker, I have funds in my ba=

nk I wish to direct to you as a foreigner for investment purpose. Contact m=

e now via my private email for more information and modalities. Email: fais=

alaalhamad55@gmail.com



Faisal A.Al-Hamad,
CEO Global Wealth Management,
National Bank=

of Kuwait, Kuwait.









--=_ba0e544b12f2e3efe6d0e571dcff71e6--

Nigerian spam

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 20 Oct 2025 11:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAtFS-00000000CtT-0EzV

for dave@doctor.nl2k.ab.ca;

Mon, 20 Oct 2025 11:00:42 -0600

Resent-From: The Doctor

Resent-Date: Mon, 20 Oct 2025 11:00:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.msyajans.com ([213.238.181.239]:58163)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAsaW-00000000LO4-12U6

for sales@nk.ca;

Mon, 20 Oct 2025 10:18:32 -0600

Received: from server.msyajans.com (localhost.localdomain [127.0.0.1])

by server.msyajans.com (Postfix) with ESMTP id A5D4BC838C;

Mon, 20 Oct 2025 18:31:25 +0300 (+03)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pestavrasya.com.tr;

s=default; t=1760974286;

bh=7XYi7wdvxSAm2iZyhglfEKoi0MHgQJuDZOK9UBeWbkA=;

h=Received:Received:From:To:Subject;

b=NQO174vU3hRba4WyE0q7UnJZWHjkjMe89bxCblVZwtzWIRUkWVXTuKJE6ov2Jlp6c

zTIPz855YIDUuHxO/e3njlOrRToEbZOgv+gi/Mi802gvwO+MR6n/iksWwWca2oNmsD

WyRI+111wRiQ/ssrQHoIdSQxIZ0Tp1bnr36ZfuDSMb3TVui46EjAX7n4CeQMUG9b9Z

rMApSbt/5Cy8+oWgk/2CyGa0H0rdEOfFj1+Uzr4R9XObxnEO7uigowVHlszC6LqNXG

CADHYgjrb1iWLa69oSDSeYgCPYBzw0JT43UIZWls/new0HI1wbtlR9vZZ2I+szoKme

HdjLnSY5md9Mw==

Authentication-Results: server.msyajans.com;

spf=pass (sender IP is 127.0.0.1) smtp.mailfrom=access@pestavrasya.com.tr smtp.helo=server.msyajans.com

Received-SPF: pass (server.msyajans.com: localhost is always allowed.) client-ip=127.0.0.1; envelope-from=access@pestavrasya.com.tr; helo=server.msyajans.com;

X-Spam-Flag: YES

X-Spam-Score: 4.486

X-Spam-Level: ****

X-Spam-Status: Yes, score=4.486 tagged_above=-9999 required=1

tests=[ALL_TRUSTED=-1, BAYES_00=-1.9, DKIM_SIGNED=0.1,

DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,

FREEMAIL_FORGED_REPLYTO=2.095, FREEMAIL_REPLYTO_END_DIGIT=0.25,

HTML_MESSAGE=0.001, ODD_FREEM_REPTO=1.844, SPF_PASS=-0.001,

UNDISC_MONEY=3.396, URIBL_BLOCKED=0.001]

autolearn=no autolearn_force=no

Authentication-Results: server.msyajans.com (amavisd-new);

dkim=pass (2048-bit key) header.d=pestavrasya.com.tr

Received: from server.msyajans.com ([127.0.0.1])

by server.msyajans.com (server.msyajans.com [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id tUIo_-zrS7uF; Mon, 20 Oct 2025 18:31:23 +0300 (+03)

Received: from webmail.pestavrasya.com.tr (localhost.localdomain [IPv6:::1])

by server.msyajans.com (Postfix) with ESMTPSA id C7DE2C7863;

Mon, 20 Oct 2025 18:31:07 +0300 (+03)

Received-SPF: pass (server.msyajans.com: connection is authenticated)

MIME-Version: 1.0

Date: Mon, 20 Oct 2025 16:31:07 +0100

From: Faisal

To: undisclosed-recipients:;

Subject: Hello

Reply-To: faisalaalhamad55@gmail.com

Mail-Reply-To: faisalaalhamad55@gmail.com

Message-ID: <17a6c9a51823b6c08e2ad76cb9c5eef4@pestavrasya.com.tr>

X-Sender: access@pestavrasya.com.tr

Content-Type: multipart/alternative;

boundary="=_a81c44a7a4562e2ccf96dfb9584897df"

X-PPP-Message-ID:

<176097426874.1153765.2410151051390072678@server.msyajans.com>

X-PPP-Vhost: pestavrasya.com.tr

X-Spam_score: 10.0

X-Spam_score_int: 100

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello It is my pleasure to communicate with you for the first

time and it is for a great cause. As an investment Banker, I have funds in

my bank I wish to direct to you as a foreigner for investment p [...]



Content analysis details: (10.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

[213.238.181.239 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

[213.238.181.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[213.238.181.239 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[faisalaalhamad55(at)gmail.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[213.238.181.239 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[213.238.181.239 listed in sa-trusted.bondedsender.org]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.8 ODD_FREEM_REPTO Has unusual reply-to header

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

3.0 UNDISC_MONEY Undisclosed recipients + money/fraud signs

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[213.238.181.239 listed in wl.mailspike.net]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[213.238.181.239 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[213.238.181.239 listed in bl.score.senderscore.com]

Subject: {SPAM?} Hello



--=_a81c44a7a4562e2ccf96dfb9584897df

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=US-ASCII;

format=flowed



Hello

It is my pleasure to communicate with you for the first time and it is

for a great cause. As an investment Banker, I have funds in my bank I

wish to direct to you as a foreigner for investment purpose. Contact me

now via my private email for more information and modalities. Email:

faisalaalhamad55@gmail.com



Faisal A.Al-Hamad,

CEO Global Wealth Management,

National Bank of Kuwait, Kuwait.

--=_a81c44a7a4562e2ccf96dfb9584897df

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8




=3DUTF-8" />
eva,sans-serif'>






Hello
It is my pleasure to communicate with you for the first time =

and it is for a great cause. As an investment Banker, I have funds in my ba=

nk I wish to direct to you as a foreigner for investment purpose. Contact m=

e now via my private email for more information and modalities. Email: fais=

alaalhamad55@gmail.com



Faisal A.Al-Hamad,
CEO Global Wealth Management,
National Bank=

of Kuwait, Kuwait.









--=_a81c44a7a4562e2ccf96dfb9584897df--