Nigerian spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 06 Feb 2026 15:57:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1voUkf-000000003Am-31Uv

for dave@doctor.nl2k.ab.ca;

Fri, 06 Feb 2026 15:56:37 -0700

Resent-From: The Doctor

Resent-Date: Fri, 6 Feb 2026 15:56:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ed1-f67.google.com ([209.85.208.67]:51382)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1voTmx-00000000Phf-1qqZ

for root@nk.ca;

Fri, 06 Feb 2026 14:55:04 -0700

Received: by mail-ed1-f67.google.com with SMTP id 4fb4d7f45d1cf-65815ec51d3so1727288a12.2

for ; Fri, 06 Feb 2026 13:54:08 -0800 (PST)

ARC-Seal: i=1; a=rsa-sha256; t=1770414841; cv=none;

d=google.com; s=arc-20240605;

b=LEnJu9ysLdTw1aikm0AGA1bTEAoWIzr6BhkW1kCzU5H+66FEejVuxlZu3zpaueTe2g

tqvQ6gH48Ipo2+/OtPnGUrrtFM9akwNzHd1A2wmzzIw9dKK35J6UoFmQMnW8CWXrtF1S

nElMnzt7g9TT3yRnToKix1AkiCCnmZAj6m1u+Bark4/tt0i5z6cozmefrqyqDrqQaisa

oNlhTI4a9/YnT/w/dwvRHv5RvpD1PqZFJls7dnw5ng3JaNHkZSmZ9VafT/ZrD8+xzvCX

z5s6vO7jXUq7klUqVmJ2iI99mKeiRaXa/TRqB9InX0zTzskbBUlZxQzYPX8aaCJZRebN

1/iA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=STZJhGYJOpwauIzdTedI+cmefIOVzpfPtigsgIreWq4=;

fh=KgnDcNBjnojzG2zCPBvTvbX6K+DP1nuk584dg/a4bAg=;

b=bxcgjfZRQLseCkaJ4dtnGKw6H/WrlEWPWDl7iqaxa9DeY7Iuqn1dHCkWGbcAqtGFM6

Hm4HLdLTu1GHesAIro+jFxh35G1S+V1Xoz/Ln3++RZDxzHziczaIjZ8SXc3GF47L0KjO

lI8X09nhPlIjTsrhXaH6mFX/5FFTA+hz7AV3pAGafb3fk3E3+gBEkRkFQymwFp2OpAfC

2WDPgZWPN4hj6C2XmmoF4/Nar7cq/NQ6KQS49bKzcRZ7AGesRg3pxqengTIbXFv7jR3K

c7usxtpNkGaeb395iBAP0/K9NCvNLlq99eVRoY8t85KHL7ArKg97uOE26Wa7o3ujaeou

7YCQ==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=khamsoipit-ac-th.20230601.gappssmtp.com; s=20230601; t=1770414841; x=1771019641; darn=nk.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=STZJhGYJOpwauIzdTedI+cmefIOVzpfPtigsgIreWq4=;

b=Uxi7orQDt8gpMd+oFT9E4Q4zW6cR3cbn3mYEyxnklWcR+Vtyj/1ui72VJ+joQkdCPY

qtQKymg91OJbuIGMWDi1NJ3g1hclY8LMpymILtCcvTGPI9YrnobmQyWtQOaozAa2dwAK

hXKPc44TbqdWvCsByo38PNZD52xuXJ3NFcTrpJOTvCoSNwxPTAYEwOTrKvYwTZ/37DQ3

JAml1QCXpcGbmDAG+w8p6mRWK22xtcnZDol4M3nuHzfcRJz7S7w84/gU8j+KuwIAwxzQ

2DuGh29mnB6U1NSo0knpDh9Xp1LmgEYY79m6C33ajEVkSpEV8mqFST1Snku/yZi8Ffrd

ihug==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1770414841; x=1771019641;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=STZJhGYJOpwauIzdTedI+cmefIOVzpfPtigsgIreWq4=;

b=kOe+GcFA6gbEHC3LX7qFDp2BQSSlhWgfYHqHz+lIfyWVq7nnUvvAaikKBRVDtnAX04

cueS99qDcbZMxr0aEa9LO+HLgiLdMX3cdYY/5HWTUQ0DmKbAeNLcrbFxI3AjRadtX5xO

dBa+Am5iZsma33aLcg5ETRObnjgWZBs7EcpphsOj5i2ghowR1EhyrcYkHEa5oKLp81m6

JeI9Y5tPcNY7Uyu3Kl3pu4bPbVYFAg2QjtatlboqYqS2Rh+mExOGRPEkGjzXpHVQhyJf

cY6B6xUVvCYW2o5eUsIZm6JpWlToJCdCPwCzG7iGcPTIuO5dcv6LzH9Xjj3xD+3WUbF7

XOYA==

X-Forwarded-Encrypted: i=1; AJvYcCXfY0r5DID61iMC8kox5Kx9whLTke1FeIQ0cOcR7M6uS+TyAqcp1xnfLGpyvZMlCp5nZIMf@nk.ca

X-Gm-Message-State: AOJu0YwgGvdrauWnv7G6Vm5hYCrtyM5H0QxE5CmaBUuhZLlGu6CnnY5Q

HD4NPwO96tnULOqsNbqhchuusZil1ZeAnIvMNwxuX6fMuPqfVSVXcmVV0F33czo5LTkK5doEnQF

kDtp9UucuPhzQX0YOoEgEDePlCj0czmlPXPeEMT/uDQ==

X-Gm-Gg: AZuq6aKRoQF6u92i+/agidC/aEDZCzKwzVICJ5XPoAH94eIoRLM843/4bOOocKHJWov

Aj61mQHl1Tyhe3iNGmaS4Mws4XdQEYhwppxNZWTXdEZIxFDTbTgaX/SIzOHmscllIv1Xd38O7P4

Jc72V0cKN2zTlU4uLMS6sKn3ZDQQHaQV34OhEjM7txiUxJNwjvbyiLe4YsyK0LnZObGhZv1EoNQ

LQAijpUFOCTXdsIHn0qkOhwDQV0P7CbRNjmik0dvpzlQzLWO/utIiJdxXYv4iD3+lOFZgYqxzI=

X-Received: by 2002:a05:6402:2551:b0:658:b87a:6eac with SMTP id

4fb4d7f45d1cf-6598419d5demr2539056a12.33.1770414840963; Fri, 06 Feb 2026

13:54:00 -0800 (PST)

MIME-Version: 1.0

Reply-To: sengsokrith30@gmail.com

From: Sokrith Seng

Date: Sat, 7 Feb 2026 04:53:50 +0700

X-Gm-Features: AZwV_Qgoy7O_h0fK9_vcil12W20I3WxIOZWog7RSDEDnrPeGVo8H856AJl6auLM

Message-ID:

Subject: Greetings....

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000b37070064a2ed39e"

Bcc: root@nk.ca

X-Spam_score: 22.3

X-Spam_score_int: 223

X-Spam_bar: ++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings, My Name is Mr. Sokrith Seng, a personal Accountant/Executive

board Member of Directors working with Foreign Trade Bank Of Cambodian (FTB).

A late investor who died and left $31,640,000.00 Million doll [...]



Content analysis details: (22.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.208.67 listed in will-spam-for-food.eu.org]

[209.85.208.67 listed in will-spam-for-food.eu.org]

[209.85.208.67 listed in will-spam-for-food.eu.org]

[209.85.208.67 listed in will-spam-for-food.eu.org]

[209.85.208.67 listed in will-spam-for-food.eu.org]

[209.85.208.67 listed in will-spam-for-food.eu.org]

[209.85.208.67 listed in will-spam-for-food.eu.org]

[209.85.208.67 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.67 listed in dnsbl.ahbl.org]

[209.85.208.67 listed in dnsbl.ahbl.org]

[209.85.208.67 listed in dnsbl.ahbl.org]

[209.85.208.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.67 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.67 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.67 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[sengsokrith30(at)gmail.com]

2.5 HK_SCAM_N2 BODY: No description available.

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HK_SCAM No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money

3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Greetings....



--000000000000b37070064a2ed39e

Content-Type: text/plain; charset="UTF-8"



Greetings,



My Name is Mr. Sokrith Seng, a personal Accountant/Executive board Member

of Directors working with Foreign Trade Bank Of Cambodian (FTB).

A late investor who died and left $31,640,000.00 Million dollars with Our

Bank for some years and no Next of kin has come forward all these years for

claim.



Please get back to me as soon as possible for more details if you are

interested in my proposal. contact me:



Best Regards,



Mr. Sokrith Seng

Executive Member Board Directors



--000000000000b37070064a2ed39e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings,

My Name is Mr. Sokrith Seng, a personal =

Accountant/Executive board Member of Directors =C2=A0working with Foreign T=

rade Bank Of Cambodian (FTB). =C2=A0
A late investor who died and left $=

31,640,000.00 Million dollars with Our Bank for some years and no Next of k=

in has come forward all these years for claim.

Please get back to me=

as soon as possible for more details if you are interested in my proposal.=

contact me:

Best Regards,

Mr. Sokrith Seng
Executive Memb=

er Board Directors




--000000000000b37070064a2ed39e--

Follow up spam from Google Gmail Part 2

Posted by Dave Yadallee on




Content analysis details: (17.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[158.94.210.205 listed in will-spam-for-food.eu.org]

[158.94.210.205 listed in will-spam-for-food.eu.org]

[158.94.210.205 listed in will-spam-for-food.eu.org]

[158.94.210.205 listed in will-spam-for-food.eu.org]

[158.94.210.205 listed in will-spam-for-food.eu.org]

[158.94.210.205 listed in will-spam-for-food.eu.org]

[158.94.210.205 listed in will-spam-for-food.eu.org]

[158.94.210.205 listed in will-spam-for-food.eu.org]

[182.16.174.22 listed in will-spam-for-food.eu.org]

[182.16.174.22 listed in will-spam-for-food.eu.org]

[182.16.174.22 listed in will-spam-for-food.eu.org]

[182.16.174.22 listed in will-spam-for-food.eu.org]

[182.16.174.22 listed in will-spam-for-food.eu.org]

[182.16.174.22 listed in will-spam-for-food.eu.org]

[182.16.174.22 listed in will-spam-for-food.eu.org]

[182.16.174.22 listed in will-spam-for-food.eu.org]

[209.85.216.100 listed in will-spam-for-food.eu.org]

[209.85.216.100 listed in will-spam-for-food.eu.org]

[209.85.216.100 listed in will-spam-for-food.eu.org]

[209.85.216.100 listed in will-spam-for-food.eu.org]

[209.85.216.100 listed in will-spam-for-food.eu.org]

[209.85.216.100 listed in will-spam-for-food.eu.org]

[209.85.216.100 listed in will-spam-for-food.eu.org]

[209.85.216.100 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.100 listed in dnsbl.ahbl.org]

[209.85.216.100 listed in dnsbl.ahbl.org]

[209.85.216.100 listed in dnsbl.ahbl.org]

[209.85.216.100 listed in dnsbl.ahbl.org]

[158.94.210.205 listed in dnsbl.ahbl.org]

[158.94.210.205 listed in dnsbl.ahbl.org]

[158.94.210.205 listed in dnsbl.ahbl.org]

[158.94.210.205 listed in dnsbl.ahbl.org]

[182.16.174.22 listed in dnsbl.ahbl.org]

[182.16.174.22 listed in dnsbl.ahbl.org]

[182.16.174.22 listed in dnsbl.ahbl.org]

[182.16.174.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.100 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.100 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.100 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[158.94.210.205 listed in sbl-xbl.spamhaus.org]

[158.94.210.205 listed in sbl-xbl.spamhaus.org]

[158.94.210.205 listed in sbl-xbl.spamhaus.org]

[158.94.210.205 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[158.94.210.205 listed in zen.spamhaus.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[158.94.210.205 listed in zen.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.100 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.100 listed in list.dnswl.org]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[sw832827(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} 02/3/2026..



Hello,



Could you let me know if you received my last email? I await your response.=

..

Best Regards.

E-Mail: sw832827@gmail.com

G Wei



Follow up spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 06 Feb 2026 12:44:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1voRk8-00000000FZI-1VAx

for dave@doctor.nl2k.ab.ca;

Fri, 06 Feb 2026 12:43:52 -0700

Resent-From: The Doctor

Resent-Date: Fri, 6 Feb 2026 12:43:52 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f100.google.com ([209.85.216.100]:52578)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1voP3Q-00000000E9s-1kjV

for doctor@nl2k.ab.ca;

Fri, 06 Feb 2026 09:51:46 -0700

Received: by mail-pj1-f100.google.com with SMTP id 98e67ed59e1d1-3530f597ea3so408002a91.1

for ; Fri, 06 Feb 2026 08:50:50 -0800 (PST)

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1770396645; x=1771001445;

h=message-id:reply-to:date:from:to:subject:content-description

:content-transfer-encoding:mime-version:dkim-signature:dkim-filter

:dkim-signature:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to;

bh=cUpoIzuqBojPpF2U3V/x6+nXXZQjlX1M5iu86diwODE=;

b=PfhLvL75BbAw3o73UGn/5HxMSRonFGHqNLPsGwxQXJHEhk8pGTaqOCXq6x2rhw6r9K

mkKIV12bW+VM9/K2Kni3txocYKBzk8ixAH9NqZblSkWwbf4y4Edb5PVLWQnFsGEEIuVx

4Ag0vbybX6yURB0PFEtK6p+1mqJ6k868YwI9Lh45UUe6ovs8OPPsFmerJReYM5d6KLzt

hEVXew/5xNEOuBDV4/4unrv8qaQACjHww1jQ7Qhqb+8LiFxg8BnjQQLeLuLFyrrFIlHr

WCGcQgCMy4+pmDxOSxy4pp7oBjszPECHc1dZ4ztxCarKiqaUVcmG+ylDZZmQXTw/jBjH

WZkA==

X-Forwarded-Encrypted: i=1; AJvYcCXXyOWQD2Y81Ao8/ARPiFcQNb/gNS01xLNIBjNqHN2J06rJYJuSM7uEuM0tAKAY2yBUMQBjTgA=@nl2k.ab.ca

X-Gm-Message-State: AOJu0Yx+6JjY4VUuCuU+sDqltjNaoKK4dtktj5VG/ifX4nhpe7N8eS7H

UbJobQFQH5aC0mUlCl2Mki7NdPLnnRstqE7upXdIJKsc9HBtg5z+KCHQcKEMYOk4t/1VBtqGtLz

MCSK77PEGkX+18Kah8zDB4s6B2EVoP+ubFVKj

X-Gm-Gg: AZuq6aL3vI3rtTF2LuzTqIaacWnrUogCnKpNtP7twSqY9uNhy8/w5L7xoyRMqJ3yoez

pZCbAxOQuBC9yBj9eQhSM6GipBrxjCtdWLvTebh9ZxvvXKSewXV6BLZWrEsFra6KjjYG+DxH377

uNBb3Qn93auTInqyZcvJ3eyFj7I9J9Bld3A1ovKLrAJdrGd0ZfrHc9G3VlDtE+3Z5ZLDAxE+ezY

n6HG8JgDOS5HKdSMYdykxPe8g6vhw7gBmE0FWpF2KFEhs0tJFsvyDWBl36j6syO3tGI+Clwc73y

vrgYI2gGExVrgUwO27qm5NOMYXw4l10gtRxIlvFvwEjMWEvj63ujGMmOZ7KqDhvy3BN7dlN3+AY

=

X-Received: by 2002:a17:90b:3a05:b0:33b:a906:e40 with SMTP id 98e67ed59e1d1-354b3c3823amr2658292a91.2.1770396644866;

Fri, 06 Feb 2026 08:50:44 -0800 (PST)

Received: from mg.cnn.co.id ([182.16.174.22])

by smtp-relay.gmail.com with ESMTPS id 98e67ed59e1d1-354b43835b0sm142877a91.1.2026.02.06.08.50.44

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 06 Feb 2026 08:50:44 -0800 (PST)

X-Relaying-Domain: cnn.id

Received: from mg.cnn.co.id (localhost.localdomain [127.0.0.1])

by mg.cnn.co.id (Proxmox) with ESMTP id 53A091B9B1F6;

Thu, 5 Feb 2026 23:59:17 +0700 (WIB)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cnn.co.id; h=cc

:content-description:content-transfer-encoding:content-type

:content-type:date:from:from:message-id:mime-version:reply-to

:reply-to:subject:subject:to:to; s=mg; bh=cUpoIzuqBojPpF2U3V/x6+

nXXZQjlX1M5iu86diwODE=; b=m2zMqi1MhuOCPl5h+Cnltp1lRW9TWSVey6ji+j

ELJi8Zqd5RkEbJn9VHdYhKcUUfbtYm4IJZieTKzyEunuVuOMYzg8aBuzP+gjMXHC

zTdR03oYAReSpc6HqSQFmSAn4rdpCmA4h7fqbRkR7j/8tbLunEyewaik8tGuXIWK

k3QRh8ZOa42AZ9h0JPlt9GS0ui6alYfRGqsg1R2ZrPRtY48EdwDp068LhTDJbacR

Gmw4INKIGd7bK7QmwYBo1XkCfY1Bgo1dM+ofv0y8jmXoVHj9KbPuikvY2kOHB9bQ

CFwAsFrMObIcRo07ZUSq7lerjBRmnpCtE3U3SR1rL8f+SHwg==

Received: from mail.cnn.co.id (mail.cnn.co.id [172.17.52.24])

by mg.cnn.co.id (Proxmox) with ESMTPS id 038E91C6109A;

Thu, 5 Feb 2026 20:21:04 +0700 (WIB)

Received: from localhost (localhost.localdomain [127.0.0.1])

by mail.cnn.co.id (Postfix) with ESMTP id 42A7C9CBF59;

Thu, 5 Feb 2026 15:35:01 +0700 (WIB)

Received: from mail.cnn.co.id ([127.0.0.1])

by localhost (mail.cnn.co.id [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id nVyg-vdMSXlE; Thu, 5 Feb 2026 15:34:59 +0700 (WIB)

Received: from localhost (localhost.localdomain [127.0.0.1])

by mail.cnn.co.id (Postfix) with ESMTP id D159B7BAEEB;

Thu, 5 Feb 2026 06:06:40 +0700 (WIB)

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.cnn.co.id D159B7BAEEB

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cnn.co.id;

s=618A6F30-1553-11EC-AC97-D64BA216FC9C; t=1770246400;

bh=cUpoIzuqBojPpF2U3V/x6+nXXZQjlX1M5iu86diwODE=;

h=MIME-Version:To:From:Date:Message-Id;

b=H8EWQz+Vj2iM04mCiOCbcwsxlcc9lr0Crop3uD7xxwdLymc57Mpurgk2esAbuv9wY

X5Ciif6ls5VIxQsbuz57zY02MAKL+yledmp85ksf/62OWRSxJ6fO934zTm+7CpMpFg

eq8VJvv1fKC0UeNmS7H6/SK7e+J3YXpi/ZWAK2P0meS1gH4oE1w8ZkiscRx2wYcgXK

sc/I6JSRUEB7URJwC1Blwk1OJWM9Tt1skP8bQoSSLSJyMFek87g2dNapkhZcUJT5RB

i/VdLqGZQLc2DXbBYDbyIRg7qhqu/my+pQ0rEPk/5JcOE7qIiIgVO5e+2nUmI3Z410

HCqXic/n/k1KA==

X-Virus-Scanned: amavisd-new at mail.cnn.co.id

Received: from mail.cnn.co.id ([127.0.0.1])

by localhost (mail.cnn.co.id [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id JMjmXFUV2qwN; Thu, 5 Feb 2026 06:06:40 +0700 (WIB)

Received: from [158.94.210.205] (unknown [158.94.210.205])

by mail.cnn.co.id (Postfix) with ESMTPSA id 02B699D0427;

Thu, 5 Feb 2026 00:06:35 +0700 (WIB)

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: 02/3/2026..

To: Recipients

From: nanda.rosandi@cnn.co.id

Date: Wed, 04 Feb 2026 09:05:31 -0800

Reply-To: sw832827@gmail.com

Message-Id: <20260204170636.02B699D0427@mail.cnn.co.id>

X-Spam_score: 17.6

X-Spam_score_int: 176

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Could you let me know if you received my last email?

I await your response... Best Regards. E-Mail: sw832827@gmail.com G Wei

Instagram followers spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 06 Feb 2026 12:47:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1voRmk-00000000G63-08AM

for dave@doctor.nl2k.ab.ca;

Fri, 06 Feb 2026 12:46:34 -0700

Resent-From: The Doctor

Resent-Date: Fri, 6 Feb 2026 12:46:33 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f69.google.com ([209.85.219.69]:43331)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from <3kzyGaQoJBXgWlWufajeqociWeh.YkioWhaojg.YW@maestro.bounces.google.com>)

id 1voREI-000000006Lb-34EA

for sales@nk.ca;

Fri, 06 Feb 2026 12:11:06 -0700

Received: by mail-qv1-f69.google.com with SMTP id 6a1803df08f44-88fcbe2e351so105656936d6.1

for ; Fri, 06 Feb 2026 11:10:18 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1770405012; x=1771009812; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=Mt53FO10xmQLF8DRc2hAJVNSLHqgJoL41s/q1diNQOU=;

b=cZLszPc3TuHyxmafm+/VNxo2ukfPDmnYVNCwx+OqcN4J3FXHXHE8Y/UFA1qbHQjojC

hwCuSgaEnxqrjlZRtenQyCJS+NLHKcLugj6t8vpunblIvvAnVyxTr8C/omapwUd225hQ

zHfgnZs1rrCO6zXX5/9OBxlAiOC1447ZKO9KNnjBDay+J+QpQocf0GRjPz2gd6uiHFVq

DfVArEmleytDH79MzWxClvHeivi5Sg8X7PIhH0n6Xx5qUHQPPlXLX3gYc6jLXqXhJqIS

uGcRo99uI1Oi6osEelCFO4/KLKa3age3e6q06s/pocjjyNoJ99CqV5ir7HJqoBZzm+gZ

q4Sw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1770405012; x=1771009812;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=Mt53FO10xmQLF8DRc2hAJVNSLHqgJoL41s/q1diNQOU=;

b=XKYVQt8aBt7GSXhy1WGCB7UIFQe7mjjHlDVrdwBsz/da1k6tOMQ6153vYXRVWqZktZ

HxXAIhaKpfKyo9hHB0J215uaQpjskYYn0m/qzTru2Voe1IDCV8S3Ri+7DRVxdYdIBx8C

HwHsXG+AyiK4Jw7l8/i4pQIVtec0LNZN34NJUEpp1ES4O7keQOJjMrTMNjcy9Por4MzQ

eR9t5/Ev3xPUH43qvxQAdxC7z/WeTrs9RgJlTr72mmb9pnbIX6zVI/hcAP5wKxzWLaPD

OFx3jIIJxA86Tj5THknKLPbBQS+Nd+SPL3pqS7U30CvA7lnC/+gbfwpEwUWc0oy5TG7V

eNGA==

X-Gm-Message-State: AOJu0YzPtIRG96eW1V7bBuNFUXD1G352XhBQhI+QgrW/dDZyN5PzGl6I

Qg9w7cK5nt2VXCG8xkEaZ4ptAp1IMK+zBnSzBpkAok5CrQeavVTamRpbHSSPe89ioq4Tb52QqgA

1NpI=

MIME-Version: 1.0

X-Received: by 2002:ad4:5bcd:0:b0:894:7218:ce8d with SMTP id

6a1803df08f44-89530100232mr120297876d6.32.1770405011915; Fri, 06 Feb 2026

11:10:11 -0800 (PST)

Message-ID:

Date: Fri, 06 Feb 2026 19:10:11 +0000

Subject: daveyadallee, Get More 1,000 Instagram Followers and 1,000 Facebook

Likes here

From: apayjenius@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, daveyadallee, Get More 1,000 Instagram Followers and 1,000

Facebook Likes here Sorry to interrupt your time. We offer social media services,

If you're interested, please visit our Website. If you're not interested,

please skip this step.



Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.219.69 listed in will-spam-for-food.eu.org]

[209.85.219.69 listed in will-spam-for-food.eu.org]

[209.85.219.69 listed in will-spam-for-food.eu.org]

[209.85.219.69 listed in will-spam-for-food.eu.org]

[209.85.219.69 listed in will-spam-for-food.eu.org]

[209.85.219.69 listed in will-spam-for-food.eu.org]

[209.85.219.69 listed in will-spam-for-food.eu.org]

[209.85.219.69 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.219.69 listed in dnsbl.ahbl.org]

[209.85.219.69 listed in dnsbl.ahbl.org]

[209.85.219.69 listed in dnsbl.ahbl.org]

[209.85.219.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.219.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.219.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.219.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.219.69 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.219.69 listed in list.dnswl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.219.69 listed in sa-trusted.bondedsender.org]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[apayjenius(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.219.69 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.69 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.219.69 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.219.69 listed in bl.score.senderscore.com]

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} daveyadallee, Get More 1,000 Instagram Followers and 1,000 Facebook

Likes here





Hi, daveyadallee, Get More 1,000 Instagram Followers and 1,000 Facebook Likes here

Sorry to interrupt your time.



We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.



We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )



Are you interested in a free trial ?

Special For You Bonus Extra $2 FREE SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :



[ https://instatool.site/services/?daveyadallee ]





Take free trial service today only...!!

10 -101K Instagram Followers



- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest



Thank you,

Regards,



Copyright © 2014 - 2026 instatool.site

Instagram follower phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 06 Feb 2026 12:47:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1voRmk-00000000G63-08AM

for dave@doctor.nl2k.ab.ca;

Fri, 06 Feb 2026 12:46:34 -0700

Resent-From: The Doctor

Resent-Date: Fri, 6 Feb 2026 12:46:33 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f69.google.com ([209.85.219.69]:43331)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from <3kzyGaQoJBXgWlWufajeqociWeh.YkioWhaojg.YW@maestro.bounces.google.com>)

id 1voREI-000000006Lb-34EA

for sales@nk.ca;

Fri, 06 Feb 2026 12:11:06 -0700

Received: by mail-qv1-f69.google.com with SMTP id 6a1803df08f44-88fcbe2e351so105656936d6.1

for ; Fri, 06 Feb 2026 11:10:18 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1770405012; x=1771009812; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=Mt53FO10xmQLF8DRc2hAJVNSLHqgJoL41s/q1diNQOU=;

b=cZLszPc3TuHyxmafm+/VNxo2ukfPDmnYVNCwx+OqcN4J3FXHXHE8Y/UFA1qbHQjojC

hwCuSgaEnxqrjlZRtenQyCJS+NLHKcLugj6t8vpunblIvvAnVyxTr8C/omapwUd225hQ

zHfgnZs1rrCO6zXX5/9OBxlAiOC1447ZKO9KNnjBDay+J+QpQocf0GRjPz2gd6uiHFVq

DfVArEmleytDH79MzWxClvHeivi5Sg8X7PIhH0n6Xx5qUHQPPlXLX3gYc6jLXqXhJqIS

uGcRo99uI1Oi6osEelCFO4/KLKa3age3e6q06s/pocjjyNoJ99CqV5ir7HJqoBZzm+gZ

q4Sw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1770405012; x=1771009812;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=Mt53FO10xmQLF8DRc2hAJVNSLHqgJoL41s/q1diNQOU=;

b=XKYVQt8aBt7GSXhy1WGCB7UIFQe7mjjHlDVrdwBsz/da1k6tOMQ6153vYXRVWqZktZ

HxXAIhaKpfKyo9hHB0J215uaQpjskYYn0m/qzTru2Voe1IDCV8S3Ri+7DRVxdYdIBx8C

HwHsXG+AyiK4Jw7l8/i4pQIVtec0LNZN34NJUEpp1ES4O7keQOJjMrTMNjcy9Por4MzQ

eR9t5/Ev3xPUH43qvxQAdxC7z/WeTrs9RgJlTr72mmb9pnbIX6zVI/hcAP5wKxzWLaPD

OFx3jIIJxA86Tj5THknKLPbBQS+Nd+SPL3pqS7U30CvA7lnC/+gbfwpEwUWc0oy5TG7V

eNGA==

X-Gm-Message-State: AOJu0YzPtIRG96eW1V7bBuNFUXD1G352XhBQhI+QgrW/dDZyN5PzGl6I

Qg9w7cK5nt2VXCG8xkEaZ4ptAp1IMK+zBnSzBpkAok5CrQeavVTamRpbHSSPe89ioq4Tb52QqgA

1NpI=

MIME-Version: 1.0

X-Received: by 2002:ad4:5bcd:0:b0:894:7218:ce8d with SMTP id

6a1803df08f44-89530100232mr120297876d6.32.1770405011915; Fri, 06 Feb 2026

11:10:11 -0800 (PST)

Message-ID:

Date: Fri, 06 Feb 2026 19:10:11 +0000

Subject: daveyadallee, Get More 1,000 Instagram Followers and 1,000 Facebook

Likes here

From: apayjenius@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, daveyadallee, Get More 1,000 Instagram Followers and 1,000

Facebook Likes here Sorry to interrupt your time. We offer social media services,

If you're interested, please visit our Website. If you're not interested,

please skip this step.



Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.219.69 listed in will-spam-for-food.eu.org]

[209.85.219.69 listed in will-spam-for-food.eu.org]

[209.85.219.69 listed in will-spam-for-food.eu.org]

[209.85.219.69 listed in will-spam-for-food.eu.org]

[209.85.219.69 listed in will-spam-for-food.eu.org]

[209.85.219.69 listed in will-spam-for-food.eu.org]

[209.85.219.69 listed in will-spam-for-food.eu.org]

[209.85.219.69 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.219.69 listed in dnsbl.ahbl.org]

[209.85.219.69 listed in dnsbl.ahbl.org]

[209.85.219.69 listed in dnsbl.ahbl.org]

[209.85.219.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.219.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.219.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.219.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.219.69 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.219.69 listed in list.dnswl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.219.69 listed in sa-trusted.bondedsender.org]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[apayjenius(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.219.69 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.69 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.219.69 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.219.69 listed in bl.score.senderscore.com]

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} daveyadallee, Get More 1,000 Instagram Followers and 1,000 Facebook

Likes here





Hi, daveyadallee, Get More 1,000 Instagram Followers and 1,000 Facebook Likes here

Sorry to interrupt your time.



We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.



We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )



Are you interested in a free trial ?

Special For You Bonus Extra $2 FREE SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :



[ https://instatool.site/services/?daveyadallee ]





Take free trial service today only...!!

10 -101K Instagram Followers



- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest



Thank you,

Regards,



Copyright © 2014 - 2026 instatool.site

Web/SEO/App Spam from Google Gmail Part 2

Posted by Dave Yadallee on
From: rose.atkins@thedatabuild.com

Sent: Wednesday, February 4, 2026 9:04 PM

To: dave@doctor.nl2k.ab.ca

Subject: Shopify Users List







Hi,







I wanted to check if you are interested in acquiring Shopify Users List for

your sales and marketing initiatives?







You might be interested in following users list: WooCommerce, BigCommerce,

NetSuite, Klaviyo, Ecwid, SAP Commerce Cloud, Magento, eBay, Stripe, Wix,

Avalara, Gorgias, Weebly, FastSpring, PrestaShop, Oracle Commerce and many

more.







Please let me know your target audience and geography so that I can get back

to you with samples, counts and pricing for the same.







Appreciate your time and look forward to your response.







Best Regards,



Rose Atkins



Sr. Demand Generation







Please reply with "Not Interested" in the subject line if you would prefer

not to receive emails in the future.





------=_NextPart_000_0AA9_01DC97C5.8952AAC0

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
http-equiv=3DContent-Type content=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">
style=3D'word-wrap:break-word'>


class=3DMsoNormal>
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:=

standardcontextual'>Hi,


style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:=

standardcontextual'> 


class=3DMsoNormal>
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:=

standardcontextual'>Just wanted to check if you have received my =

previous email.


style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:=

standardcontextual'> 


class=3DMsoNormal>
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:=

standardcontextual'>Any update for me?


class=3DMsoNormal>
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:=

standardcontextual'> 


class=3DMsoNormal>
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:=

standardcontextual'>Awaiting your reply.


class=3DMsoNormal>
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:=

standardcontextual'> 


class=3DMsoNormal>
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:=

standardcontextual'>Regards,


class=3DMsoNormal>
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:=

standardcontextual'>Rose


class=3DMsoNormal>
style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'> 
o:p>


1.0pt;padding:3.0pt 0in 0in 0in'>


style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>From:<=

/b> =

rose.atkins@thedatabuild.com <rose.atkins@thedatabuild.com> =


Sent: Wednesday, February 4, 2026 9:04 PM
To: =

dave@doctor.nl2k.ab.ca
Subject: Shopify Users =

List


class=3DMsoNormal> 


class=3DMsoNoSpacing>Hi,


class=3DMsoNoSpacing> 

I =

wanted to check if you are interested in acquiring Shopify Users List =

for your sales and marketing initiatives?


class=3DMsoNoSpacing> 

You =

might be interested in following users list: WooCommerce, =

BigCommerce, NetSuite, Klaviyo, Ecwid, SAP Commerce Cloud, Magento, =

eBay, Stripe, Wix, Avalara, Gorgias, Weebly, FastSpring, PrestaShop, =

Oracle Commerce and many more.


class=3DMsoNoSpacing> 


class=3DMsoNoSpacing>Please let me know your target audience and =

geography so that I can get back to you with samples, counts and =

pricing for the same.


class=3DMsoNoSpacing> 


class=3DMsoNoSpacing>Appreciate your time and look forward to your =

response.

 


class=3DMsoNoSpacing>Best Regards,


class=3DMsoNoSpacing>Rose =

Atkins


style=3D'mso-bookmark:_Hlk159549989'>


class=3DMsoNoSpacing>Sr. Demand Generation


class=3DMsoNoSpacing> 


style=3D'color:gray'>Please reply with "Not Interested" in the =

subject line if you would prefer not to receive emails in the =

future.



------=_NextPart_000_0AA9_01DC97C5.8952AAC0--



Web/SEO/App Spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 06 Feb 2026 11:38:00 -0700

Received: from mail-pf1-f193.google.com ([209.85.210.193]:61733)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1voQhJ-000000003yx-0uba

for dave@doctor.nl2k.ab.ca;

Fri, 06 Feb 2026 11:37:04 -0700

Received: by mail-pf1-f193.google.com with SMTP id d2e1a72fcca58-81f4f4d4822so1383327b3a.3

for ; Fri, 06 Feb 2026 10:36:06 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=thedatabuild-com.20230601.gappssmtp.com; s=20230601; t=1770402960; x=1771007760; darn=doctor.nl2k.ab.ca;

h=disposition-notification-to:content-language:thread-index

:mime-version:message-id:date:subject:in-reply-to:references:to:from

:from:to:cc:subject:date:message-id:reply-to;

bh=aSMAXW2Ufzc6gwlvtc2t3Wn05Td//uH4WFzAT5bg7bE=;

b=LOmmHmLyMIejG+FmLw3/mEO6t7KaWeJTqYHFlh8mz9itspiDCQPMVMno5YOV3DLCT6

oNfTDteeqOulluF08cSq6pc/9YbIZQQ64DNIP9yu36hZdulK/NYKGrmolV9tViLcpINi

N9/nScIzEjanmGvyiCsLRaR+D2NKlgKtd3B2e+tPFUeN9oT/BuZkA9qyoYnO7Sfd27Om

F96f1fdybDiA0ubTa6k5zhIM/ZZBpss2ltpgy1OZvJI5Cyo7bVpb0iILyQHG6hLHGklA

TPYPPC8xs/Pomd7Z1JGMFPFuuFiiXJknN27M3ZL2oXn2yvDQp8nOtOnOm3VZtFX7pn0u

AEZw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1770402960; x=1771007760;

h=disposition-notification-to:content-language:thread-index

:mime-version:message-id:date:subject:in-reply-to:references:to:from

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=aSMAXW2Ufzc6gwlvtc2t3Wn05Td//uH4WFzAT5bg7bE=;

b=DmcnIZ7xYOY7Bpp0oxF/syv3T4zjs+MIKB7OjE0ULtBH87nZXCs9tWLmj+VR8FapZ6

YcE2TPx+mh53hTD1pUIVoni8fou4Gg37xbubzPHTg2hSRggXFFllF8CJQB1TRS73NroY

S6SomSmh3DBxw43jIO8PW7M2YIvJlIdfqHm5RG7R3i6+X05l5i15iqNh758MukyNK/DL

iIfbjnc0Gml2spJtnM3eXXyLPpm1+1uCtKAaETaFY+zqNaK3wEuYO+w/zQoMa/CL+ZPL

iybbUf1+1kaHchufOeOcpcfWxK7tIHJFkTZSNWam8jSzg7a9PmZVffzE2Lnd7QPjk15c

gCsQ==

X-Gm-Message-State: AOJu0YyCUq4XTlvBCwvhjxhWT3JuYGCBGoCgG/QKreHIQadskh7AnfKi

lWu7FJmDDxiSQqh/Dmicz59EX1yHFZAMMcFd6IvthJSd+wtRd9MZRkDXQlDcqdpBbJCgZgiNYKj

FtQXeS1g=

X-Gm-Gg: AZuq6aIR8RxmWYbHGD8KmKAFFxisW4KC+ODdL5x48MePjlSPsWVx9vVwIF6Reoc74eR

69En+81RPxIsBLtiu2yF2I5MBbvBm8DuHLU3vOmo9nsu+m9vQS6Yy/JwVWp7F0iJAz5otGGmKUF

XZfMb1LJx/WYnaGnrWPHXkVPVLPR/vIA8ZRQR3PADvgl6m5qEuzY5ugcdSQ0E/az8vXpyNUep2n

rmd27i5VwnAx5BCbZ+1HPq3ecQou6B/qVEpPTOjyRti+z2P4t1yFooFxuXculyuZW3pIoFNJY3d

ENVmy8Y/MkbOkrvHUbWNFOAyIou/SGi8L5QXEMjJbQCJe1PcHsN1wmeqySItxhBB836YItorKtx

nDy1OPne/11Dhh4P1hkpgElraE2paXT32sH02Dv1qQ/Sg3irMwD8GQiO6BPWz0K9ZAr78ry0+YN

7RYZwpQ6NH/mDzVTCDvGnOhqVL9ciZrv5aEOk=

X-Received: by 2002:a05:6a00:2381:b0:7e8:43f5:bd39 with SMTP id d2e1a72fcca58-824416f2b42mr3396295b3a.37.1770402959711;

Fri, 06 Feb 2026 10:35:59 -0800 (PST)

Received: from DESKTOPDP4EVTG ([103.214.61.57])

by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-824418856d5sm2703765b3a.38.2026.02.06.10.35.58

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Fri, 06 Feb 2026 10:35:59 -0800 (PST)

From:

To:

References: <080601dc95eb$d8a7c8c0$89f75a40$@thedatabuild.com>

In-Reply-To: <080601dc95eb$d8a7c8c0$89f75a40$@thedatabuild.com>

Subject: RE: Shopify Users List

Date: Sat, 7 Feb 2026 00:05:20 +0530

Message-ID: <0aa801dc9797$6f9a6ec0$4ecf4c40$@thedatabuild.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0AA9_01DC97C5.8952AAC0"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: AQIZlVuqsVwHYhhgt+KfniuLSZ0rJbT8A0lw

Content-Language: en-us

Disposition-Notification-To:

X-Spam_score: 5.2

X-Spam_score_int: 52

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Just wanted to check if you have received my previous

email. Any update for me?



Content analysis details: (5.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.214.61.57 listed in will-spam-for-food.eu.org]

[103.214.61.57 listed in will-spam-for-food.eu.org]

[103.214.61.57 listed in will-spam-for-food.eu.org]

[103.214.61.57 listed in will-spam-for-food.eu.org]

[103.214.61.57 listed in will-spam-for-food.eu.org]

[103.214.61.57 listed in will-spam-for-food.eu.org]

[103.214.61.57 listed in will-spam-for-food.eu.org]

[103.214.61.57 listed in will-spam-for-food.eu.org]

[209.85.210.193 listed in will-spam-for-food.eu.org]

[209.85.210.193 listed in will-spam-for-food.eu.org]

[209.85.210.193 listed in will-spam-for-food.eu.org]

[209.85.210.193 listed in will-spam-for-food.eu.org]

[209.85.210.193 listed in will-spam-for-food.eu.org]

[209.85.210.193 listed in will-spam-for-food.eu.org]

[209.85.210.193 listed in will-spam-for-food.eu.org]

[209.85.210.193 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.193 listed in dnsbl.ahbl.org]

[209.85.210.193 listed in dnsbl.ahbl.org]

[209.85.210.193 listed in dnsbl.ahbl.org]

[209.85.210.193 listed in dnsbl.ahbl.org]

[103.214.61.57 listed in dnsbl.ahbl.org]

[103.214.61.57 listed in dnsbl.ahbl.org]

[103.214.61.57 listed in dnsbl.ahbl.org]

[103.214.61.57 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.193 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.193 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.193 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.193 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.193 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.193 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} RE: Shopify Users List



This is a multipart message in MIME format.



------=_NextPart_000_0AA9_01DC97C5.8952AAC0

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,







Just wanted to check if you have received my previous email.







Any update for me?







Awaiting your reply.







Regards,



Rose





Intelcom Phish Part 2

Posted by Dave Yadallee on
























Â

















This is an automated email, please do not reply.











Â





















--1c9e5bbbb9336e3669a57250f88edd9c8

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit































Hello,





⚠️ We need you to confirm your delivery before it expires and returned to the sender !


















Â


































Â
Â
















Please be advised that international mail entering Canada is subject to examination by the Canada Border Services Agency (CBSA). The CBSA determines whether goods are admissible into Canada and whether duties and taxes are applicable.





However, you have a package awaiting delivery due to non-payment of customs fees, taxes and brokerage to which it is subject in accordance with the terms and conditions of the Canada Border Services Agency in the amount of CA$ 2.29 payable via our secure form below:





Confirm my delivery





Intelcom - Dragonfly, as a delivery company, is responsible for collecting duties and taxes prior to delivering a mail item to the recipient, but the taxes and duties themselves are imposed by the Canada Border Services Agency (CBSA).





Have a great day!


Â


































Â





















This is an automated email, please do not reply.


Â














--1c9e5bbbb9336e3669a57250f88edd9c8--



Intelcom Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 06 Feb 2026 12:46:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1voRm1-00000000Fz3-415v

for dave@doctor.nl2k.ab.ca;

Fri, 06 Feb 2026 12:45:49 -0700

Resent-From: The Doctor

Resent-Date: Fri, 6 Feb 2026 12:45:49 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [83.167.253.186] (port=59184 helo=givemeabreak.ca)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1voQnm-000000004Vp-2ejz

for games@nl2k.ab.ca;

Fri, 06 Feb 2026 11:43:42 -0700

Received: by givemeabreak.ca (Postfix, from userid 33)

id 2C3D24247B; Fri, 6 Feb 2026 18:42:45 +0000 (UTC)

To: games@nl2k.ab.ca

Subject: We have not received payment for your customs duties! Your package will be returned to the sender.

Date: Fri, 6 Feb 2026 18:27:07 +0000

From: =?UTF-8?Q?Intelcom=C2=AE?=

Reply-To: noreply@wightman.com

Message-ID: <3413b5518fb7056ab443faca23279481@givemeabreak.ca>

List-Unsubscribe: mailto:bounce522-eXtBSWEj0otsQoy@givemeabreak.ca?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1c9e5bbbb9336e3669a57250f88edd9c8"

Content-Transfer-Encoding: 8bit

X-Spam_score: 16.0

X-Spam_score_int: 160

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: intelcom-dragonfly@intelcom.ca | Hello,



Content analysis details: (16.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[83.167.253.186 listed in will-spam-for-food.eu.org]

[83.167.253.186 listed in will-spam-for-food.eu.org]

[83.167.253.186 listed in will-spam-for-food.eu.org]

[83.167.253.186 listed in will-spam-for-food.eu.org]

[83.167.253.186 listed in will-spam-for-food.eu.org]

[83.167.253.186 listed in will-spam-for-food.eu.org]

[83.167.253.186 listed in will-spam-for-food.eu.org]

[83.167.253.186 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[83.167.253.186 listed in dnsbl.ahbl.org]

[83.167.253.186 listed in dnsbl.ahbl.org]

[83.167.253.186 listed in dnsbl.ahbl.org]

[83.167.253.186 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[83.167.253.186 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[83.167.253.186 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[83.167.253.186 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[83.167.253.186 listed in dnsbl.ahbl.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: ctmsapp.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: ctmsapp.com]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: ctmsapp.com]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: jii.li]

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.8 A_HREF_NOWHERE A link tag with empty href

0.0 HREF_EMPTY_NORDNS Empty href + no rDNS

0.0 GOOG_REDIR_NORDNS Google redirect to obscure spamvertised website +

no rDNS

Subject: {SPAM?} We have not received payment for your customs duties! Your package will be returned to the sender.



This is a multi-part message in MIME format.



--1c9e5bbbb9336e3669a57250f88edd9c8

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit













intelcom-dragonfly@intelcom.ca |











Hello,



⚠️ We need you to confirm your delivery before it expires and returned to the sender !



































Â















Â





Â















Please be advised that international mail entering Canada is subject to examination by the Canada Border Services Agency (CBSA). The CBSA determines whether goods are admissible into Canada and whether duties and taxes are applicable.



However, you have a package awaiting delivery due to non-payment of customs fees, taxes and brokerage to which it is subject in accordance with the terms and conditions of the Canada Border Services Agency in the amount of CA$ 2.29 payable via our secure form below:



Confirm my delivery



Intelcom - Dragonfly, as a delivery company, is responsible for collecting duties and taxes prior to delivering a mail item to the recipient, but the taxes and duties themselves are imposed by the Canada Border Services Agency (CBSA).



Have a great day!















Â

Antimalware phish from Google Gmail Part 3

Posted by Dave Yadallee on


=20



=20



=20



=20















Antimalware phish from Google Gmail Part 4

Posted by Dave Yadallee on
.cse-banner .encryption-icon {

/ We use the IE workaround instead. /

background-image: none !important;

}



.cse-banner .encryption-icon .ms-fallback {

display: block !important;

}



/ NB: Some MS clients ignore dark-scheme styling and apply their o=

wn, so there's nothing we can do to help there. /

@media (prefers-color-scheme: dark) {

.cse-banner:not([class^=3D"x_"]) .encryption-icon .ms-fallback {

display: none !important;

}



.cse-banner:not([class^=3D"x_"]) .encryption-icon .ms-fallback-da=

rk {

display: block !important;

}

}






/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Austin Nunnelly: Order VIHD31635 =E2=80=93 Update finalized"/>
an>
>
"/>
anization">
a itemprop=3D"eventId/googleCalendar" content=3D"ljAnZWXc17QnZLHzVMAOnaTsAs=

"/>
1px; height: 0; max-height: 0; width: 0; max-width: 0; opacity: 0; overflow=

: hidden;" itemprop=3D"name">Order VIHD31635 =E2=80=93 Update finalized
an>
le=3D"presentation" align=3D"center" style=3D"width:100%;" class=3D"body-co=

ntainer">

=3D"height:16px;" aria-hidden=3D"true">  

=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" class=

=3D"">

temtype=3D"http://schema.org/EmailMessage">

Orde=

r VIHD31635 =E2=80=93 Update finalized

=

=


=3D"border: solid 1px #dadce0; border-radius: 8px; direction: rtl; font-siz=

e: 0; padding: 24px 32px; text-align: left; vertical-align: top;" class=3D"=

main-container-inner">

style=3D"font-size: 13px; text-align: left; direction: ltr; display: inline=

-block; vertical-align: top; width: 100%;overflow: hidden; word-wrap: break=

-word;">
sentation" width=3D"100%" class=3D"main-column-table-ltr" style=3D"padding-=

right: 32px; padding-left: 0;;table-layout: fixed;">=


"main-column-td" style=3D"padding:0; vertical-align:top;">
0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%"=

style=3D"table-layout: fixed;">

text-align: left; word-break: break-word;;padding-bottom:2px;">

=3D"font-family: 'Google Sans', Roboto, sans-serif;font-weight: 400=

; font-size: 22px; line-height: 28px;color: #3c4043; text-decoration: none;=

" class=3D"primary-text" role=3D"presentation">Orde=

r VIHD31635 =E2=80=93 Update finalized

=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word;;pad=

ding-bottom:24px;">

: normal; font-weight: 400; font-size: 14px; line-height: 20px; letter-spac=

ing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-text" r=

ole=3D"presentation">Friday Feb 6, 2026 =E2=8B=85 10:4=

9pm (Pacific Time - Los Angeles)

t-size: 0; padding: 0; text-align: left; word-break: break-word;;padding-bo=

ttom:24px;">

l; font-weight: 400; font-size: 14px; line-height: 20px; letter-spacing: 0.=

2px;color: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D"=

presentation">

Windows MalwareSafe
1 865 209-0967<=

/strong>

Order Date: Saturday, 07 February 2026
Order number: 9681=

-KEBZ-3975

Subscription is active and up to date

=

We thank you for choosing Windows MalwareSafe. Your membership has reach=

ed its expiration today.

Product Inventory View

<=

p>Selected Service: Premium Advantage
Warranty: One Year
Charged: $30=

5.44

This email is sent because you previously subscribed to our serv=

ices.

If you wish to cancel and obtain a full refund, contact
>1 865 209-0967 immediately.

Warm greetings,
The Windows=

MalwareSafe, LLC
Manager: Kimberly May

Copyright =C2=A92026 compa=

ny. All rights reserved.


tent=3D"Windows MalwareSafe1 865 209-0967Order Date: Saturday, 07 February=

2026Order number: 9681-KEBZ-3975Subscription is active and up to dateWe th=

ank you for choosing Windows MalwareSafe. Your membership has reached its e=

xpiration today.Product Inventory ViewSelected Service: Premium AdvantageWa=

rranty: One YearCharged: $305.44This email is sent because you previously s=

ubscribed to our services.If you wish to cancel and obtain a full refund, c=

ontact 1 865 209-0967 immediately.Warm greetings,The Windows MalwareSafe, =

LLCManager: Kimberly MayCopyright =C2=A92026 company. All rights reserved."=

/>

ft; word-break: break-word;;padding-bottom:24px;">

: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px;=

line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: =

none;" class=3D"primary-text" role=3D"presentation">
lpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-bot=

tom: 4px;">


r: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing: =

antialiased;margin: 0; padding: 0;">Guests

(Guest lis=

t has been hidden at organizer's request)


--000000000000d6cf65064a2b683b--

Antimalware phish from Google Gmail Part 2

Posted by Dave Yadallee on
--000000000000d6cf65064a2b683b

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



T3JkZXIgVklIRDMxNjM1IOKAkyBVcGRhdGUgZmluYWxpemVkDQoNCk9yZGVyIFZJSEQzMTYzNSDi

gJMgVXBkYXRlIGZpbmFsaXplZA0KRnJpZGF5IEZlYiA2LCAyMDI2IOKLhSAxMDo0OXBtDQpQYWNp

ZmljIFRpbWUgLSBMb3MgQW5nZWxlcw0KDQoNCg0KV2luZG93cyBNYWx3YXJlU2FmZTEgODY1ICAy

MDktMDk2N09yZGVyIERhdGU6IFNhdHVyZGF5LCAwNyBGZWJydWFyeSAgDQoyMDI2T3JkZXIgbnVt

YmVyOiA5NjgxLUtFQlotMzk3NVN1YnNjcmlwdGlvbiBpcyBhY3RpdmUgYW5kIHVwIHRvIGRhdGVX

ZSAgDQp0aGFuayB5b3UgZm9yIGNob29zaW5nIFdpbmRvd3MgTWFsd2FyZVNhZmUuIFlvdXIgbWVt

YmVyc2hpcCBoYXMgcmVhY2hlZCBpdHMgIA0KZXhwaXJhdGlvbiB0b2RheS5Qcm9kdWN0IEludmVu

dG9yeSBWaWV3U2VsZWN0ZWQgU2VydmljZTogUHJlbWl1bSAgDQpBZHZhbnRhZ2VXYXJyYW50eTog

T25lIFllYXJDaGFyZ2VkOiAkMzA1LjQ0VGhpcyBlbWFpbCBpcyBzZW50IGJlY2F1c2UgeW91ICAN

CnByZXZpb3VzbHkgc3Vic2NyaWJlZCB0byBvdXIgc2VydmljZXMuSWYgeW91IHdpc2ggdG8gY2Fu

Y2VsIGFuZCBvYnRhaW4gYSAgDQpmdWxsIHJlZnVuZCwgY29udGFjdCAxIDg2NSAgMjA5LTA5Njcg

aW1tZWRpYXRlbHkuV2FybSBncmVldGluZ3MsVGhlIFdpbmRvd3MgIA0KTWFsd2FyZVNhZmUsIExM

Q01hbmFnZXI6IEtpbWJlcmx5IE1heUNvcHlyaWdodCDCqTIwMjYgY29tcGFueS4gQWxsIHJpZ2h0

cyAgDQpyZXNlcnZlZC4NCg0KT3JnYW5pemVyDQpBdXN0aW4gTnVubmVsbHkNCmFudGhvbnlrbmln

aHRqaEBib21pc2Eub3JnDQoNCkd1ZXN0cw0KKEd1ZXN0IGxpc3QgaGFzIGJlZW4gaGlkZGVuIGF0

IG9yZ2FuaXplcidzIHJlcXVlc3QpDQoNCg==

--000000000000d6cf65064a2b683b

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

















Antimalware phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 06 Feb 2026 12:46:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1voRlT-00000000FvC-1ps1

for dave@doctor.nl2k.ab.ca;

Fri, 06 Feb 2026 12:45:15 -0700

Resent-From: The Doctor

Resent-Date: Fri, 6 Feb 2026 12:45:15 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oi1-f201.google.com ([209.85.167.201]:60526)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1voPyC-000000000Kf-1f77

for doctor@nl2k.ab.ca;

Fri, 06 Feb 2026 10:50:25 -0700

Received: by mail-oi1-f201.google.com with SMTP id 5614622812f47-462a9191720so7818053b6e.0

for ; Fri, 06 Feb 2026 09:49:29 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1770400163; x=1771004963; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=cmMhlAzaT65WmdF00kLBZcerfGW5RawaFkzqmubSoXw=;

b=mqi11sMLg+vxxZaQiWN8xdDlCaEIFjowtKvKH/md/xHJcV4D5GElqtQHF/Ei0MpqCR

fUWLTz60TQdVC/AGD2eum4D/R8lKDDoFDaydC0kRZJJeADoEG3Nuh+6ujWmJuMbhTTPq

c1qv3cJgRr1e3NLbJ5X+h+QUUC8TenVYeV9mCYKeINk1TlnNTy+e3BzqSCObn/kOzX7l

OjmyDCKZDKHuSEbKEjkBdPNVIRYKWiZ15oL9PM3S9Cv21cO9xugPJa3vJYI8KcMRNiZw

ecJynpEj+ce1it4fV/zW1IUTQaggZnYj2ecqlM5r17xy6TD20yvFHkUDVuq+PFZ4baVm

id6Q==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=bomisa-org.20230601.gappssmtp.com; s=20230601; t=1770400163; x=1771004963; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=cmMhlAzaT65WmdF00kLBZcerfGW5RawaFkzqmubSoXw=;

b=0bN+3htbXXJydF8/qwRYoW5MAv2Si8UYGHn83wBpRx3YnTQFxTpBMz0j7ZihleuMVu

ghMuqFAu91Uf1cIm9XeVNCVAMGhjPFdlb+G/1qZ4wp0i3qnI0zLdCc/aV7pBoS0GMThF

tKBGvXh9Dh0ZdmVfsejjDnZQ1hEZWgiWEVEmjExSd2AmdPcbXaiQpu30g3S/EIFHjqsq

+rXYf/p6uLIRye6Jm0Q1qlyNbiKphgWLtb6Kj6ZgxjQCbXQtmSd150I91uSuMnyd6P57

bISGpxe5suEhpE/wdDYR3SwHsgXm1bcPUWFX+nMvRUDEVoJijLavFmQJUCZDNEz4ZmN8

vn7Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1770400163; x=1771004963;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=cmMhlAzaT65WmdF00kLBZcerfGW5RawaFkzqmubSoXw=;

b=bOsROHMSMmaUEnb+pszW9wDvXDrL+NbBlVvRz0+stq2PY80a+hq9W4WXhQgM39vOSc

uLN08GxmCBR0TG7NSHcfQEAw91d7F/MEajKhPJbG10w6vTBqPmQtPKWcBT/pkuBTfOEH

PjjvVprujqZHCsSkxGA1cKesw0zbBmX5xDblNYRmX0vBiSGaf1+LF2a7excAWKiNkUhb

gTgTqM0crmJiTjRgGgz5N4Ur1BDFVxDPowXXAwHv/jECiHAvBdE4uYc7qCCS3exrnIEk

1s0cv4pDcVhaShoXnv7sDJAnXb/+vm6ZaxeH6V0hX3f5ajiOVPmjQHlgMiFrTuntjIBb

3T0g==

X-Forwarded-Encrypted: i=1; AJvYcCXi0LQR7w53nK23TKNJcETP6luotyOm+5MxhEUULpBVcPZxW2mxMFHCJo8i6sqQQjYsXvuyHbU=@nl2k.ab.ca

X-Gm-Message-State: AOJu0YxFDvAALVMBHPFmA7YUw3znJKY5AC8fYcFxtefK125MLzFFIZ3y

93SVkaFOYtVlqYt0OKdBeUkTFjzNLXPWa5lYM49wag/9DzLcN6pPkOvmr0YBKA8KmxMqGOtJXDs

ehDIxd2GsRT8hr4WR2sCC6hk7S4OHtmT/oOVwdfb7kY2DDw==

MIME-Version: 1.0

X-Received: by 2002:a4a:ec42:0:b0:659:9a49:9043 with SMTP id

006d021491bc7-66d099c5b61mt1999009eaf.14.1770400163091; Fri, 06 Feb 2026

09:49:23 -0800 (PST)

Reply-To: Austin Nunnelly

Sender: Google Calendar

Message-ID:

Date: Fri, 06 Feb 2026 17:49:23 +0000

Subject: Order VIHD31635 - Update finalized

From: Austin Nunnelly

Content-Type: multipart/alternative; boundary="000000000000d6cf65064a2b683b"

X-Spam_score: 13.0

X-Spam_score_int: 130

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Order VIHD31635 – Update finalized Order VIHD31635 – Update

finalized Friday Feb 6, 2026 â‹… 10:49pm Pacific Time - Los Angeles Windows

MalwareSafe1 865 209-0967Order Date: Saturday, 07 February 2026Order number:

9681-KEBZ-3975Subscription is active and up to dateWe thank you for choosing

Windows MalwareSafe. Your membership h [...]



Content analysis details: (13.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.201 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.201 listed in will-spam-for-food.eu.org]

[209.85.167.201 listed in will-spam-for-food.eu.org]

[209.85.167.201 listed in will-spam-for-food.eu.org]

[209.85.167.201 listed in will-spam-for-food.eu.org]

[209.85.167.201 listed in will-spam-for-food.eu.org]

[209.85.167.201 listed in will-spam-for-food.eu.org]

[209.85.167.201 listed in will-spam-for-food.eu.org]

[209.85.167.201 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.201 listed in dnsbl.ahbl.org]

[209.85.167.201 listed in dnsbl.ahbl.org]

[209.85.167.201 listed in dnsbl.ahbl.org]

[209.85.167.201 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.201 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.201 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.201 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.201 listed in dnsbl.ahbl.org]

1.2 MISSING_HEADERS Missing To: header

0.6 J_CHICKENPOX_93 BODY: 9alpha-pock-3alpha

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.167.201 listed in sa-trusted.bondedsender.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.167.201 listed in sa-accredit.habeas.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.201 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.167.201 listed in bl.score.senderscore.com]

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[209.85.167.201 listed in psbl.surriel.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.201 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.9 REPLYTO_WITHOUT_TO_CC No description available.

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Order VIHD31635 - Update finalized

Web/SEO/App Spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on
--_000_KL1PR0401MB45627CD0D48F7B4E31A8127DA666AKL1PR0401MB4562_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








ht: 19.2px; background-color: rgb(255, 255, 255); margin: 0in 0in 0.0001pt;=

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementT=

oProof">

Hello,



ht: 19.2px; background-color: rgb(255, 255, 255); margin: 0in 0in 0.0001pt;=

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementT=

oProof">

 



ht: 19.2px; background-color: rgb(255, 255, 255); margin: 0in 0in 0.0001pt;=

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(200, 38, 19);" class=3D"elem=

entToProof">

Your website has a few performance and SEO errors.



ht: 19.2px; background-color: rgb(255, 255, 255); margin: 0in 0in 0.0001pt;=

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementT=

oProof">

 



ht: 19.2px; background-color: rgb(255, 255, 255); margin: 0in 0in 0.0001pt;=

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementT=

oProof">

I can share a detailed report showing them.



ht: 19.2px; background-color: rgb(255, 255, 255); margin: 0in 0in 0.0001pt;=

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementT=

oProof">

 



ht: 19.2px; background-color: rgb(255, 255, 255); margin: 0in 0in 0.0001pt;=

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementT=

oProof">

We can also optimize your site to appear on Google=92s first page.



ht: 19.2px; background-color: rgb(255, 255, 255); margin: 0in 0in 0.0001pt;=

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementT=

oProof">

 



ht: 19.2px; background-color: rgb(255, 255, 255); margin: 0in 0in 0.0001pt;=

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementT=

oProof">

Shall I send our prop=

osal and price list?



ht: 19.2px; background-color: rgb(255, 255, 255); margin: 0in 0in 0.0001pt;=

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementT=

oProof">

 



d-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_Embedde=

dFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt=

; color: rgb(0, 0, 0);" class=3D"elementToProof">

Thank you,



d-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Aptos_Embedde=

dFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt=

; color: rgb(0, 0, 0);" class=3D"elementToProof">

Mary Smith



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">












--_000_KL1PR0401MB45627CD0D48F7B4E31A8127DA666AKL1PR0401MB4562_--

Web/SEO/App Spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Fri, 06 Feb 2026 10:11:53 -0700

Received: from mail-japaneastazolkn19012056.outbound.protection.outlook.com ([52.103.43.56]:5562 helo=TYPPR03CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1voPMr-00000000FAO-1vu8

for dave@nk.ca;

Fri, 06 Feb 2026 10:11:52 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=pS2Q99krkuId6YvcFvHuVNUBkoz3esyD3N2n8TqrJgfccPlTUsJmwJ5elNUyh6GQC5EXTqEl86dEF29nidBVQVnlq+R7Rbwe+uZjtRTtXcXTQVbfkIbgithYqBAABUCF8GWvfmNTDxRPxHE9bztMCv1+odjwxyaaPBt+jU/UVaCAKZX8M6WqQyHoThRABCs9vPCLoBRbgjD1LR6SvXwbBgsVfQDdhzC5St7g2CN3dkg7ylkssGZhwMt8e+qXRCJgfmxEAXB8YVZYMfI+VFXCyQ9DhSmABySQBS8oiHae1PGjH1eG9gtH9cCbw9wlNo98PBtmfDN1s5DSrTvJoaP8Wg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=wiourjKM/4C3o5cGbR8AJgMpY2d1gI0BgPVvu6fFyZ0=;

b=e0/gFtQcrRiwf1jbf+GBTC9rfjxSjbkasUsdbuu9hmh7fvuAvQCZ0FwJ3l6v4CNOOuUAfx384rKtOIXQ3ugTj7Xq1sIyhEUUUMVZaCjrQOoN6hqfW1CV4qha2cNldJ3nL7g3pdnwjefeandoKfCE+3wb4mR4J2E3xYKbsOM8J+A8PIgZ2VUFcN4qyF2YZclZlGXG4EdtCapdZGkAn0YbYDukQjBJAuWaNhf1tgLe+kNsnIbsaqSOD3cz9A1vRfSjMfeVIIe9BnFdzglYiiVqMmxeFcF9eBrSyGxgzUmVJD/5RS/byplMUDUQVwXnriLjYQ1sA3OFRddy5jL+a19nWg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=wiourjKM/4C3o5cGbR8AJgMpY2d1gI0BgPVvu6fFyZ0=;

b=ExKqy+X5KgH9kLdSA1QT+gkk/200Okk8BhSk7vLjRhxH9Xth8tUZnSX6pN0fmYd5UfyAr4eq7SLcV79MFb+KLa0PgiGizztrOllaQujefE3OYU32jIdW1QIRznVf+/ZKkD3rPmKhZIY0pXYzLsYwWHXk5Wj8p0caGP3oMmdFkOZ1kTe1qmCXzedQqrstyMmJNN99Z1DQ1uO07oEKVhIH63qpXuOr8nAovzl6ISkMmhibp2Ne9ka0a9rnT9ni4KgGipZodAPwSqxen1NaSlAS00g1d0uK/1/D2xm3d4OEj8ptRpOL5E4EP4+NA7LBRgG71tpDgC5TPhcekU/5OKih9w==

Received: from KL1PR0401MB4562.apcprd04.prod.outlook.com

(2603:1096:820:5b::12) by TYZPR04MB7579.apcprd04.prod.outlook.com

(2603:1096:405:3c::13) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9587.14; Fri, 6 Feb

2026 17:10:12 +0000

Received: from KL1PR0401MB4562.apcprd04.prod.outlook.com

([fe80::e931:588c:1bd3:fda9]) by KL1PR0401MB4562.apcprd04.prod.outlook.com

([fe80::e931:588c:1bd3:fda9%6]) with mapi id 15.20.9587.013; Fri, 6 Feb 2026

17:10:11 +0000

From: Mary Smith

To: Mary Smith

Subject: Re: Google's first page?

Thread-Topic: Google's first page?

Thread-Index: AQHcl4tQJGAHgRDyiUS6+rOZ8KxhjQ==

Date: Fri, 6 Feb 2026 17:10:10 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: KL1PR0401MB4562:EE_|TYZPR04MB7579:EE_

x-ms-office365-filtering-correlation-id: de5520b2-4065-4aa9-9b39-08de65a2966a

x-ms-exchange-slblob-mailprops:

Tiovf1Kk+H/L9aKHoPn9H41xx/Z8qAxiISZkYvQHHLPt46hQe5G+xcokVXgKJbsFBP+todDen7DbRo5Vjgv5GNi660rYrY+9NeMHQPpXS751u0PiPDf/p7Z5EEOgTy64OBfti0ypb5GH5IzYqw42JgH+Ry4WoZToz1GXfJLLbX2tZuNL0zkLOk5SQl2EzCydIr2E6iX90ZXb0eK6ZjChonL3NJazk6l4Qnf71qWx21pAFXVC+6KGSM3l4w8hJboWm+NRxubbIM78nYHe3b1PSlgnD4RAV0BG80aDoDogRp3SyLTlLikKaLskBMdblKoYcRgvZk5p7a+QfuMEH+ib+nTls7xwoBkAQT8Yqlck0hh7eqqvNtmEBkQIYrkMXcOXfeViox9o5j/1eDDd0nXTbODW3wXqqTPLQzIvAQwmZjgfVUez0ufjXRipVZYWTbh8PLZa6r87dIlJtPirzDKRrnvfyzSZAi6y3jo57YZu8QZN7QGdYdCuxPiCY3CfJ2AXPuJXSA2LqEdqwEcuWs2FbqP0aAZbLsCYRvDdHpEnYiPMA4pdhiCpHfKp29RSnwZQ3nzVJTIi6+9Kd0PlJ9SM+N07BCiGlXn2dzqlMdUeR7Y=

x-microsoft-antispam:

BCL:0;ARA:14566002|31061999003|19110799012|39105399006|461199028|15030799006|15080799012|8060799015|8062599012|39145399003|41105399003|40105399003|3412199025|440099028|102099032|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?0leOx6+pctDWc3gFzwdJdzFQoc8a41DUoZZ4IQ3u20OqYRkbv86SQogD?=

=?Windows-1252?Q?WQfPw+m+JyxBm9Dy2+u+PQJcvvYVsSmpFF/64bLzdJyehxm6vxu33OSS?=

=?Windows-1252?Q?7idGRZHeJwAHr5pdSREy3KpYx+f4PaNxtFlMyUuob4FmwkqdpQ/MEgQW?=

=?Windows-1252?Q?j5zAjeeF21AYW9fahfiBphWUdY6eH7AZDFwjoa8SDkCmHgEAepLHbWtE?=

=?Windows-1252?Q?UhzmA2G5ovyfr7qmlxkzhHQ3wOMz/l+pLeYNpTsv/NFAtshcXcEzRQNA?=

=?Windows-1252?Q?8mrzK+CtS5alyfBkV6MxD3yaMgN8xV4tOuH57S9AXHF1e6BUA8wZebfZ?=

=?Windows-1252?Q?JFF+dt5TAjseqRKTcOvgeR5A7ZuJaAGae2k5paDdXHZJAnqJgg6XlYS3?=

=?Windows-1252?Q?cXgcfgAUD6oNiN+NH20tN0AIVKL5sSgrF17yjAhF8TCXfmQa9VZcporZ?=

=?Windows-1252?Q?FIBVSoTx/8kcaGySXkOXYQPexSCuXVkNGJMGsX8k4rKC2AgUBVK2Y0pq?=

=?Windows-1252?Q?9bk7Z2Ep/IoBxYHMqvH/K9CNmO59B38+lbAFLNP/9RHwkSrCMb3i5VsL?=

=?Windows-1252?Q?QIhNnHJ+mS8DZ8EDOKuvTe2x24/844B/3kpnYJteioOiC3D8g7hT6f/O?=

=?Windows-1252?Q?HVaez/dzNQELnetE/udkx2rdqkX6wbs4eXYKoiFOeSrQkct9Ke2o3YeB?=

=?Windows-1252?Q?Pn/q93sXcjBaeWrHR/f9kN59JC4+//keX9XVR7d/FgubOqXMJ6qljXzj?=

=?Windows-1252?Q?b9B6ZZFAi/oRqQq31vTjEeOlRlOXjbYT2d/9mWXA1r1xot2cX1/0OU++?=

=?Windows-1252?Q?WDkrSV5uy0X1LkEQTJjfpsAvjy2PjF/IiCYElpHZN9Zuy796Y/WwLIYz?=

=?Windows-1252?Q?wjlOP6/4vf1rQ9CXwoCTfJBACEdP26ZnJvTEWr4wQZGyiVJG759BCA0v?=

=?Windows-1252?Q?Yh/p/ORoYaN9I0lxqVHbG0STdS0a84X27LYvn9XXJ0Dz5Fo/zb/n5TVv?=

=?Windows-1252?Q?dcBnmUoLapOZJ6+/cV3KIWVr/91u7/niWJJTifdumgK6UD/uxruqRxL7?=

=?Windows-1252?Q?cALr0FUHOcQjVsTb1JtlrkGCMD01AH4CggmzUEmFHELzqQmK3S/KtuVw?=

=?Windows-1252?Q?Hyv8TcIU+RJo7syUvvjOU/U0KlyU5qJLQ88cgpzhh9i9tIQSiTN9b0hs?=

=?Windows-1252?Q?O9x7rZx49F5JtddB4mRmFwVA39U9gpSFUy4qEmxAXg1T6c97Np8yzcwM?=

=?Windows-1252?Q?gS1bQwvcSA2ZaBHcLUM6vZyrLe2WFcYoyVklpZlDz+prVdJzy5DljqdM?=

=?Windows-1252?Q?O0sIDvI7EEztX2LZdjn/14vMk0G2cmxRkEPk6h/3qFCXbpBg/v2Ye2Qx?=

=?Windows-1252?Q?QmMfH6YKyo3g6YY0Jmjfbi80+Tf8O6QDmHE=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?MEhnJPh+GcFMvK9oqvBk6Mj9prH23WjJwCV6TGT7tmpUCpB/xuOM+AK7?=

=?Windows-1252?Q?rKYVXFyumNPj8RezaM/5rfD80eX+NMt8g3UBaFHk6TZVxBPZ4Q+AoPS/?=

=?Windows-1252?Q?BMcNEIbPQ00ViOJOlIyO1SGfYutJsxo1xjP/WfCZTIrVICZWGQzTjHDA?=

=?Windows-1252?Q?rUYSzCnnnjuHv0D0mL0PZpRckDE5/GVWVZZL6HhDEDHapF76fji7SPyL?=

=?Windows-1252?Q?14WL508OGGvxircqehjnQpY0fi1/U2B2pl9ZYsPNfYEkz1QZSg8IEHHY?=

=?Windows-1252?Q?YQe5YUb0tXQOHWJrwxQFDRqmxUEJJkC0h+69v5bMVlhiEIom30boKWeI?=

=?Windows-1252?Q?SdAjDFpuUZbNNi2AZzRWoXZnlQ7QFYz4vC7uClOPpubUiAeBUmxsuPQH?=

=?Windows-1252?Q?qcjP8jcg4CwgV92XEWs2oo65qL/RwM1fqK/+q0eFetnGRtZXIGBc9coV?=

=?Windows-1252?Q?Nq82/C2j8i/iIb+SdGBKSrMT9QljEaxNOkJ/BQ+yIkZd7MVvNR1hOW/7?=

=?Windows-1252?Q?5YdDyKUlDUdnSv6cCMGjQelw7nH7K53N2jkKhhZFtPS4iqXT1W+NnR42?=

=?Windows-1252?Q?4CEcXzwbq+8W6vHkM7ykCH1GLjZIe8/XkWnPg8h60YmoPvZRRreSAEcF?=

=?Windows-1252?Q?DL0LN5gV0AjSp8WJMxlU3ubxy4RboSIxYubA0DxB4eiSUec1spdYAOTe?=

=?Windows-1252?Q?6D2gE2oDB4pO3Pw1/Ww9vPw67x8bl31nnbNktRQgkRjoELu/34Y34UcD?=

=?Windows-1252?Q?rWOrhKGG7Q4JD4rNaLd5ZfioVdynN+2rIdQA1mnVUA/yvsRrqNjC0Sdx?=

=?Windows-1252?Q?BTOoRYlr4NQunJMH4ECjyCB9hB52wLQmZxGgmawIGAOgGyvrwu6rlts8?=

=?Windows-1252?Q?j64djcDX8GxHy/bpdaITm5rml5wCfNUKSo2iJ2ri3UPuTs10UBQLY6Zl?=

=?Windows-1252?Q?hpddlGlfxA8Rn54EFlGs2seOF1gU2oNFYJ1Pxdzvx6JwH1Keac7OWLXL?=

=?Windows-1252?Q?8Dof2YpKlS3bN0Rwh+AlZG//sa+I9lURSPFdS4u27JD/ExRyWLwqDAZ2?=

=?Windows-1252?Q?YTDEpo1XbFcDcfSBsqgrqMfE87Gq0ujril52NbubxAdxMQXqR7iCvS9Q?=

=?Windows-1252?Q?G1nFqT9f0vTQY3d2K269H8DOssla7um8uOhBM0DBmp9wLdmaHZOebwAu?=

=?Windows-1252?Q?IfmERbRH6mGmvE/KdD/TvSUwGwo54FwzqYx6E+M6x2UcaIQG+GWoXmaO?=

=?Windows-1252?Q?7Fd34jCx9iOzrmIzySWMKQ48hE3W24AuZvrTqtBOWZ4y0IU6V0BzD8FX?=

=?Windows-1252?Q?cQQl7vuXkCsE0bqLkwTWiCNcSE0s/HzQ6FRYvyCRkO4ligcnd5F3QD5T?=

=?Windows-1252?Q?oCpFuZuuBns8AVkQWymCEj0VwpiH4FOJLLnZ3RPLvWZaZ4lZ7IBGmWqq?=

=?Windows-1252?Q?CZQip0zD0L/RvCEM6l8cwXZoauv2Aqlfgo9u4ZtATdsRE18Wt8nXVDLC?=

=?Windows-1252?Q?FVVgNkBorzRHlObXr99rPY6NkVPFvlzkSvuUOkEJU/m5bvu+BXOjYgQd?=

=?Windows-1252?Q?wUpVKhnGeRuLics5HZ2ZfK6m3pEPV4FnhrOkHw=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_KL1PR0401MB45627CD0D48F7B4E31A8127DA666AKL1PR0401MB4562_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: KL1PR0401MB4562.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: de5520b2-4065-4aa9-9b39-08de65a2966a

X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Feb 2026 17:10:10.8546

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYZPR04MB7579



--_000_KL1PR0401MB45627CD0D48F7B4E31A8127DA666AKL1PR0401MB4562_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hello,



Your website has a few performance and SEO errors.



I can share a detailed report showing them.



We can also optimize your site to appear on Google=92s first page.



Shall I send our proposal and price list?



Thank you,

Mary Smith