Domain monetisation spam from Google Gmail Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 26 Jun 2026 06:41:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wd5rT-00000000Dp1-0LRW
for dave@doctor.nl2k.ab.ca;
Fri, 26 Jun 2026 06:40:47 -0600
Resent-From: The Doctor
Resent-Date: Fri, 26 Jun 2026 06:40:46 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-qk1-f194.google.com ([209.85.222.194]:53350)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wd3WG-00000000BJI-07sJ
for root@nl2k.ab.ca;
Fri, 26 Jun 2026 04:10:52 -0600
Received: by mail-qk1-f194.google.com with SMTP id af79cd13be357-915b5ce94c7so75484385a.2
for; Fri, 26 Jun 2026 03:09:55 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1782468589; cv=none;
d=google.com; s=arc-20260327;
b=jXZYUy4aomYdGCd5/LHADd2jieKsrhi358Za0CkmZV9vTzPb0lQ/JaVIK5JbH3Ei/G
iwak66CLSH5ff92L+EPEl2hP/jkfqFwrdHpkgSEXk+sjP8PuXehJIUJ1I7Sl1qn6QNhx
QclXeuRGgm8McWC+ceVMe5rLyuSnevgCXDUBlZp76TD6RPzN1VknnIJ9Y7oAsDwINVhm
a9QPiQvqGDFqt/d4P2Z+fHilwM96sDVdVWn5lsqtAxvs4AzWQSFlbzZ8/Kg9jBuuZefD
7nVOiaJTWkOHZ8BeHvBCfNubqmOGMz5lv6pzFWFjGgO2BgPDr0qi3QhZ3QspUho+Bim8
sSRg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;
h=to:subject:message-id:date:from:mime-version:dkim-signature;
bh=H9+9ZXpPOJGSINFd5gV+RPQB73Xki5oeraT6UKMkY54=;
fh=xlaqb4BBoLdJtBZev3L7vUQ7NrRWtYUi797wkNVG1OA=;
b=H232fqOCJoHqVvcXkk8ZZ+6UE/d6FnSX9CEqD7DOtbKdhgymOYbQNxW4drN0h4kyK5
p3miSdJ6g+w7oYFhzB+Plfb0cdgB8mieHLZcdBSQUBqgma1T1/baZ9itNBIOx6PH6gka
lfqeRSf1y6oPwhYOuHjOXmOjcA4ZJwlWWMPc1lRsmH/YuIocrb0Frp69Brv2XuSWlG+b
KgrxjP44BdCaDY0jrGgrW2Zq7NzvVZJ1g7poG8piOB1oVwLfhyOemZld+TnHvHscZXNN
VQ8PSddkdHuLsQ7xgnmHW1mBQAGXHRXgac6MRAH91uVcplfwPVrDewyShgBZUDrE/k7p
toLw==;
darn=nl2k.ab.ca
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=wearerollerads.com; s=google; t=1782468589; x=1783073389; darn=nl2k.ab.ca;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=H9+9ZXpPOJGSINFd5gV+RPQB73Xki5oeraT6UKMkY54=;
b=dYnAqV6pyP3YK5IacTm/tpDpbIFwdYXRJxJ+zlZxeKdslxQS9G579XVkyzzMVjJivZ
4FhUzYVWF8tXJexX/Y832t7p2XccNcyODi3a9857JQO/cqIK6b+BIS07LSoORakV0uwS
dee12yfd/k86WXjXCBI4mSDspKQYgBk2ODl7A=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1782468589; x=1783073389;
h=to:subject:message-id:date:from:mime-version:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=H9+9ZXpPOJGSINFd5gV+RPQB73Xki5oeraT6UKMkY54=;
b=Psq+NbKsjy6ptWazvp+u1xl+x9Ac+SUoGId39e+tx3DTwDFCaG35E477OFnIh4WQIZ
+FkjPhYAzY70+61jwptQLE3hJDHrDSCS4LDWAO98L/1FIf4y6jEOL5nLXDXBZ96riozo
zHUuBEL1pJzS8o9coA6Ddy2J7wFn4mXtj2Wgu34siBomqQG5xnlBz3NR0MF6L4jIWbXm
mOxSUGwUIHxtq9o27qLXE3XV537cyXLxpazChgIvMwfJqZApkqelTKUaMz1wFafeIwev
/g0PVjOeRM3oUjWHvAVekCR2ldMhGfIMD5+OoFvIaGaSH2WM1XE/rMNErmOXdXc0NRCW
jRpw==
X-Gm-Message-State: AOJu0YwcA0fcMVf6URWW1y4jSzBHzvlT2qK2/PEY9iRnp6ZZiYDgkGsf
Ymb1R6ExEpj8vJIgs83ciCdhLoR/5brA7pCWa8XTrKhdZmWvCVmj7fkPksFqEQUMPPSjbBf9kJO
Bc35MqPI0IHWb331y52dJc1gjf34WVo9PvJeSQ/iX5dT0QkmUn4It3w==
X-Gm-Gg: AfdE7cmncIcXOSLf/vI1pOOJ64k6+MQ6bU+PMDAHwR3K9Q8GDCWtqmUCWsgRV2SBVw4
kKS2+UGj+YqcBW018mmyJZUKJ3DJPfx/v1YhUndv74Dn8LYEOlvmFgbOC9ERpf+WjUkvIXPHXxY
Z+dMmT582nuLWPPupJGZKvqYviNFq0VEEruq4pF7zP4MS5PR6WB+AQ4HpqOcmfSF8C0QnCwXo5Y
l9a632IxsnInLDOaXXVM+emvh9AuNh2jctXF6Dfndj+2CzsW7PFp/aKXidQ72LzypqCCnZnIDZr
h4gNRaEnIKqKrQ2AUaiXtbfozw==
X-Received: by 2002:a05:620a:6412:b0:915:aa63:f34a with SMTP id
af79cd13be357-9293abad59bmr931719785a.22.1782468589114; Fri, 26 Jun 2026
03:09:49 -0700 (PDT)
Received: from 776393159873 named unknown by gmailapi.google.com with
HTTPREST; Fri, 26 Jun 2026 03:09:48 -0700
Received: from 776393159873 named unknown by gmailapi.google.com with
HTTPREST; Fri, 26 Jun 2026 03:09:48 -0700
MIME-Version: 1.0
From: Niko
Date: Fri, 26 Jun 2026 03:09:48 -0700
X-Gm-Features: AVVi8Cf4whc8IkGTtQEOmaJl4worBUlu6FspxiInwc2CafThRCj9bvd84jFebNs
Message-ID:
Subject: Parker Roller Party
To: root@nl2k.ab.ca
Content-Type: multipart/alternative; boundary="00000000000013e2c00655254f58"
X-Spam_score: 6.8
X-Spam_score_int: 68
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hey, this is Nik from Roller. Could you please clarify whether
you currently monetize your domains? -- Teams : nik@rollerads.com
Content analysis details: (6.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.222.194 listed in will-spam-for-food.eu.org]
[209.85.222.194 listed in will-spam-for-food.eu.org]
[209.85.222.194 listed in will-spam-for-food.eu.org]
[209.85.222.194 listed in will-spam-for-food.eu.org]
[209.85.222.194 listed in will-spam-for-food.eu.org]
[209.85.222.194 listed in will-spam-for-food.eu.org]
[209.85.222.194 listed in will-spam-for-food.eu.org]
[209.85.222.194 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.222.194 listed in dnsbl.ahbl.org]
[209.85.222.194 listed in dnsbl.ahbl.org]
[209.85.222.194 listed in dnsbl.ahbl.org]
[209.85.222.194 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.222.194 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.222.194 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.222.194 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.222.194 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.222.194 listed in list.dnswl.org]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: rmailroute.net]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: hmailroute.net]
[URI: rmailroute.net]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 SPF_PASS SPF: sender matches SPF record
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.222.194 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.222.194 listed in wl.mailspike.net]
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters
Subject: {SPAM?} Parker Roller Party
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 26 Jun 2026 06:41:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wd5rT-00000000Dp1-0LRW
for dave@doctor.nl2k.ab.ca;
Fri, 26 Jun 2026 06:40:47 -0600
Resent-From: The Doctor
Resent-Date: Fri, 26 Jun 2026 06:40:46 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-qk1-f194.google.com ([209.85.222.194]:53350)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wd3WG-00000000BJI-07sJ
for root@nl2k.ab.ca;
Fri, 26 Jun 2026 04:10:52 -0600
Received: by mail-qk1-f194.google.com with SMTP id af79cd13be357-915b5ce94c7so75484385a.2
for
ARC-Seal: i=1; a=rsa-sha256; t=1782468589; cv=none;
d=google.com; s=arc-20260327;
b=jXZYUy4aomYdGCd5/LHADd2jieKsrhi358Za0CkmZV9vTzPb0lQ/JaVIK5JbH3Ei/G
iwak66CLSH5ff92L+EPEl2hP/jkfqFwrdHpkgSEXk+sjP8PuXehJIUJ1I7Sl1qn6QNhx
QclXeuRGgm8McWC+ceVMe5rLyuSnevgCXDUBlZp76TD6RPzN1VknnIJ9Y7oAsDwINVhm
a9QPiQvqGDFqt/d4P2Z+fHilwM96sDVdVWn5lsqtAxvs4AzWQSFlbzZ8/Kg9jBuuZefD
7nVOiaJTWkOHZ8BeHvBCfNubqmOGMz5lv6pzFWFjGgO2BgPDr0qi3QhZ3QspUho+Bim8
sSRg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;
h=to:subject:message-id:date:from:mime-version:dkim-signature;
bh=H9+9ZXpPOJGSINFd5gV+RPQB73Xki5oeraT6UKMkY54=;
fh=xlaqb4BBoLdJtBZev3L7vUQ7NrRWtYUi797wkNVG1OA=;
b=H232fqOCJoHqVvcXkk8ZZ+6UE/d6FnSX9CEqD7DOtbKdhgymOYbQNxW4drN0h4kyK5
p3miSdJ6g+w7oYFhzB+Plfb0cdgB8mieHLZcdBSQUBqgma1T1/baZ9itNBIOx6PH6gka
lfqeRSf1y6oPwhYOuHjOXmOjcA4ZJwlWWMPc1lRsmH/YuIocrb0Frp69Brv2XuSWlG+b
KgrxjP44BdCaDY0jrGgrW2Zq7NzvVZJ1g7poG8piOB1oVwLfhyOemZld+TnHvHscZXNN
VQ8PSddkdHuLsQ7xgnmHW1mBQAGXHRXgac6MRAH91uVcplfwPVrDewyShgBZUDrE/k7p
toLw==;
darn=nl2k.ab.ca
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=wearerollerads.com; s=google; t=1782468589; x=1783073389; darn=nl2k.ab.ca;
h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=H9+9ZXpPOJGSINFd5gV+RPQB73Xki5oeraT6UKMkY54=;
b=dYnAqV6pyP3YK5IacTm/tpDpbIFwdYXRJxJ+zlZxeKdslxQS9G579XVkyzzMVjJivZ
4FhUzYVWF8tXJexX/Y832t7p2XccNcyODi3a9857JQO/cqIK6b+BIS07LSoORakV0uwS
dee12yfd/k86WXjXCBI4mSDspKQYgBk2ODl7A=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1782468589; x=1783073389;
h=to:subject:message-id:date:from:mime-version:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=H9+9ZXpPOJGSINFd5gV+RPQB73Xki5oeraT6UKMkY54=;
b=Psq+NbKsjy6ptWazvp+u1xl+x9Ac+SUoGId39e+tx3DTwDFCaG35E477OFnIh4WQIZ
+FkjPhYAzY70+61jwptQLE3hJDHrDSCS4LDWAO98L/1FIf4y6jEOL5nLXDXBZ96riozo
zHUuBEL1pJzS8o9coA6Ddy2J7wFn4mXtj2Wgu34siBomqQG5xnlBz3NR0MF6L4jIWbXm
mOxSUGwUIHxtq9o27qLXE3XV537cyXLxpazChgIvMwfJqZApkqelTKUaMz1wFafeIwev
/g0PVjOeRM3oUjWHvAVekCR2ldMhGfIMD5+OoFvIaGaSH2WM1XE/rMNErmOXdXc0NRCW
jRpw==
X-Gm-Message-State: AOJu0YwcA0fcMVf6URWW1y4jSzBHzvlT2qK2/PEY9iRnp6ZZiYDgkGsf
Ymb1R6ExEpj8vJIgs83ciCdhLoR/5brA7pCWa8XTrKhdZmWvCVmj7fkPksFqEQUMPPSjbBf9kJO
Bc35MqPI0IHWb331y52dJc1gjf34WVo9PvJeSQ/iX5dT0QkmUn4It3w==
X-Gm-Gg: AfdE7cmncIcXOSLf/vI1pOOJ64k6+MQ6bU+PMDAHwR3K9Q8GDCWtqmUCWsgRV2SBVw4
kKS2+UGj+YqcBW018mmyJZUKJ3DJPfx/v1YhUndv74Dn8LYEOlvmFgbOC9ERpf+WjUkvIXPHXxY
Z+dMmT582nuLWPPupJGZKvqYviNFq0VEEruq4pF7zP4MS5PR6WB+AQ4HpqOcmfSF8C0QnCwXo5Y
l9a632IxsnInLDOaXXVM+emvh9AuNh2jctXF6Dfndj+2CzsW7PFp/aKXidQ72LzypqCCnZnIDZr
h4gNRaEnIKqKrQ2AUaiXtbfozw==
X-Received: by 2002:a05:620a:6412:b0:915:aa63:f34a with SMTP id
af79cd13be357-9293abad59bmr931719785a.22.1782468589114; Fri, 26 Jun 2026
03:09:49 -0700 (PDT)
Received: from 776393159873 named unknown by gmailapi.google.com with
HTTPREST; Fri, 26 Jun 2026 03:09:48 -0700
Received: from 776393159873 named unknown by gmailapi.google.com with
HTTPREST; Fri, 26 Jun 2026 03:09:48 -0700
MIME-Version: 1.0
From: Niko
Date: Fri, 26 Jun 2026 03:09:48 -0700
X-Gm-Features: AVVi8Cf4whc8IkGTtQEOmaJl4worBUlu6FspxiInwc2CafThRCj9bvd84jFebNs
Message-ID:
Subject: Parker Roller Party
To: root@nl2k.ab.ca
Content-Type: multipart/alternative; boundary="00000000000013e2c00655254f58"
X-Spam_score: 6.8
X-Spam_score_int: 68
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hey, this is Nik from Roller. Could you please clarify whether
you currently monetize your domains? -- Teams : nik@rollerads.com
Content analysis details: (6.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.222.194 listed in will-spam-for-food.eu.org]
[209.85.222.194 listed in will-spam-for-food.eu.org]
[209.85.222.194 listed in will-spam-for-food.eu.org]
[209.85.222.194 listed in will-spam-for-food.eu.org]
[209.85.222.194 listed in will-spam-for-food.eu.org]
[209.85.222.194 listed in will-spam-for-food.eu.org]
[209.85.222.194 listed in will-spam-for-food.eu.org]
[209.85.222.194 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.222.194 listed in dnsbl.ahbl.org]
[209.85.222.194 listed in dnsbl.ahbl.org]
[209.85.222.194 listed in dnsbl.ahbl.org]
[209.85.222.194 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.222.194 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.222.194 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.222.194 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.222.194 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.222.194 listed in list.dnswl.org]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: rmailroute.net]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: hmailroute.net]
[URI: rmailroute.net]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_PASS SPF: sender matches SPF record
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.222.194 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.222.194 listed in wl.mailspike.net]
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters
Subject: {SPAM?} Parker Roller Party