Received: from mail-m158152.netease.com ([47.251.158.152]:37440)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from )
id 1wkCks-00000000ClH-0OcE
for sales@nk.ca;
Wed, 15 Jul 2026 21:27:31 -0600
Content-Type: multipart/alternative; BOUNDARY="=_Part_270763_1837582587.1784172327445"
To: sales
Reply-To: huangyi@nmtbiotech.com
Subject: =?UTF-8?B?UmU6ICBGcmllbmRseSBSZW1pbmRlciBhbmQgUGVyc29uYWxpemVkIFByb2R1Y3QgUmVjb21tZW5kYXRpb24g?=
X-Priority: 3
MIME-Version: 1.0
Received: from td@nmtbiotech.com( [10.139.1.59] ) by ajax-webmail ( [127.0.0.1] ) ; Thu, 16 Jul 2026 11:25:27 +0800 (GMT+08:00)
From: Vivian
Date: Thu, 16 Jul 2026 11:25:27 +0800 (GMT+08:00)
X-WM-Tid: 0a9f68f531bc0266kunm5e1c5aec50b08
DKIM-Signature: a=rsa-sha256;
b=btA5dEVA4zadLBvKygmxRIGT8ektMNxqAqtB5q+eUoxA5ACQQK3TnEXODm8joHw+kVgiEKmhN86ARGR4rd6KedvfKO3dk6g+FVDFi69DIJ86tQ7SnRg6aCyiO6M644SXEn4m2oyiUH5AErPt5OROKaWzJZqAl71cYq7UUzV17+E=; s=default; c=relaxed/relaxed; d=nmtbiotech.com; v=1;
bh=E1H62Bn1SE2EfcDAuAmBNKJlNXAb3HyV67K1wXh9VVE=;
h=date:mime-version:subject:message-id:from;
Message-ID:
Hi,
You don't need to pay premium brand prices to get reliable strength machines.
We offer budget-friendly commercial strength lines designed for high-traffic gyms. We focus purely on solid durability and lower costs, helping you stretch your budget further.
Would you be open to a quick look at our price list?
Best regards,
Rachel Tian
Tianjin Xuruihengda International Trading Co.,ltd
Content analysis details: (17.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[128.14.209.174 listed in dnsbl.ahbl.org]
[128.14.209.174 listed in dnsbl.ahbl.org]
[128.14.209.174 listed in dnsbl.ahbl.org]
[128.14.209.174 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[128.14.209.174 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[128.14.209.174 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[128.14.209.174 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[128.14.209.174 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[128.14.209.174 listed in will-spam-for-food.eu.org]
[128.14.209.174 listed in will-spam-for-food.eu.org]
[128.14.209.174 listed in will-spam-for-food.eu.org]
[128.14.209.174 listed in will-spam-for-food.eu.org]
[128.14.209.174 listed in will-spam-for-food.eu.org]
[128.14.209.174 listed in will-spam-for-food.eu.org]
[128.14.209.174 listed in will-spam-for-food.eu.org]
[128.14.209.174 listed in will-spam-for-food.eu.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries | ]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries | ]
-0.0 SPF_PASS SPF: sender matches SPF record
15 GR_DOMAIN_EMARKE3 Header from spammer tool signature (emarke)
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
2.3 MANGLED_FULL BODY: mangled full
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[128.14.209.174 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list
manager
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
0.0 UNICODE_OBFU_ZW_MANY Heavily obfuscating text with hidden characters
Subject: {SPAM?} Reminder: =?utf-8?b?WeKBoG/igIvigaF177u/IGjigaTigaFh77u/duKBomU=?=
=?utf-8?b?4oGgIGHvu7/igaAgbuKAjOKBoWXigaJ34oCN4oGjIG3igaLigItl4oGi4oCLcw==?=
=?utf-8?b?4oGj4oCMc+KAjWHigIvigIxn4oCNZeKBoCE=?=
PayPal
You have a new message
Hello,
You have a new message in your PayPal Message Center with important information about your account.
For security reasons, message content is not sent by email. Please log in to your PayPal account to read it.
Login to PayPal
Help & Contact | Security | Apps
Please do not reply to this email. We are unable to respond to inquiries sent to this address.
PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name.
Copyright © 1999–2026 PayPal. All rights reserved.
PayPal, Inc. N.A., 2211 N. First Street, San Jose, CA 95131, USA.
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 15 Jul 2026 19:56:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from )
id 1wkBJX-000000007l3-1yxh
for dave@doctor.nl2k.ab.ca;
Wed, 15 Jul 2026 19:55:03 -0600
Resent-From: The Doctor
Resent-Date: Wed, 15 Jul 2026 19:55:03 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mta49.integratedcollision.com ([128.14.209.174]:43275)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from )
id 1wkBCL-000000007J5-1SZ6
for sales@nk.ca;
Wed, 15 Jul 2026 19:47:45 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=pmta1783260803;
d=integratedcollision.com;
h=MIME-Version:Content-Type:Subject:From:To:Date:Message-ID:Reply-To:
List-Unsubscribe:List-ID:List-Post:List-Owner:List-Archive:List-Help;
i=no-reply@integratedcollision.com;
bh=Mks4Tvjkw/nVlrJUS0ARFEnk4NbpDavf4sgPiRppvl4=;
b=pGzhkLmuz7ia7wqb3t1ystFS9ph43ta+fJj+/vqkLSE9xf2h2XOvFpBm6s9AtfLpXQEYMODdaMlp
3EWdTdwsb6o2T3iBvk4k7qxsNjh8O/0i5WS8atrCv/JcKZEzqtTa08HZufupzLDn80KzeF+8pWHj
4KAEicJEY9/eWBuWKlk=
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative";
boundary="===============5795285501818955415=="
Subject: Reminder: =?utf-8?b?WeKBoG/igIvigaF177u/IGjigaTigaFh77u/duKBomU=?=
=?utf-8?b?4oGgIGHvu7/igaAgbuKAjOKBoWXigaJ34oCN4oGjIG3igaLigItl4oGi4oCLcw==?=
=?utf-8?b?4oGj4oCMc+KAjWHigIvigIxn4oCNZeKBoCE=?=
From:
=?utf-8?b?UOKAjWHigI154oCMUOKBoGHigIts?=
To: sales@nk.ca
Date: Thu, 16 Jul 2026 01:46:43 +0000
Message-ID:
<178416640349.2807136.15477553829507125164@integratedcollision.com>
X-Virtual-MTA: pmta-pool
X-Mailer-RecptId: a7fcd11f90a74c30
Reply-To: support@integratedcollision.com
List-Unsubscribe: =?utf-8?q?=3Cmailto=3Aunsubscribe=40integratedcollision=2E?=
=?utf-8?q?com=3Fsubject=3Dunsubscribe-a7fcd11f90a74c30=3E=2C_=3Chttps=3A//i?=
=?utf-8?q?ntegratedcollision=2Ecom/unsubscribe=3Fid=3Da7fcd11f90a74c30=26e?=
=?utf-8?q?=3Dc2FsZXNAbmsuY2E=3E?=
List-Unsubscribe-Post: List-Unsubscribe=One-Click
List-ID: main.integratedcollision.com
List-Post: NO
Feedback-ID: main:integratedcollision.com
X-Report-Abuse: Please report abuse here: abuse@integratedcollision.com
X-Complaints-To: abuse@integratedcollision.com
List-Owner:
List-Archive:
List-Help:
Organization: =?utf-8?b?UOKAjWHigI154oCMUOKBoGHigIts?=
Content-Language: en
X-Auto-Response-Suppress: OOF, AutoReply
Importance: normal
X-Spam_score: 17.6
X-Spam_score_int: 176
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Y​‌o‌u​†hâ£â¡aâ¢â€Œvâ eâ€ï»¿ aâ â nâ¢â¡eâ¢wâ
m​â£eâ¤â€sâ¢â sâ£â£aâ¢â€‹gâ¡â¤e -⢠Pâ€â€‹â€‹a​â€â€Œy‌â¤â€ŒPâ ​aâ ​lâ£â¤
Y‌​oâ uâ£â¡ hâ a​vâ£â¡eâ¡â€‹ a⣠n‌​e​​w​ mâ€â€eâ¡â s‌sâ¤aâ¤â€gâ â¡e​
iâ£n‌ yâ oâ¤uâ râ¡â¢ Pâ¢â€‹aâ ‌yâ â€â€ŒPâ€â€â€Œa‌â€lâ¡
Mâ e [...]
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 15 Jul 2026 18:40:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from )
id 1wkA8K-000000003jE-1jzd
for dave@doctor.nl2k.ab.ca;
Wed, 15 Jul 2026 18:39:24 -0600
Resent-From: The Doctor
Resent-Date: Wed, 15 Jul 2026 18:39:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [163.172.35.53] (port=43631 helo=real.imobilisco.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from )
id 1wk8Iv-00000000MFc-1GeH
for doctor@nl2k.ab.ca;
Wed, 15 Jul 2026 16:42:23 -0600
Received: from webmail.qelbo.com (localhost.localdomain [IPv6:::1])
by real.imobilisco.com (Postfix) with ESMTPSA id 4BBACA01481;
Wed, 15 Jul 2026 22:40:43 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qelbo.com;
s=default; t=1784155257;
bh=/G5kVMHlnPMDdm/f0Je2dUOrOStqaMgEH6kjaIFI1vI=; h=From:To:Subject;
b=xA/YVq34WLi/spKB48XFb07s/To3J3HvnqGAlqJ7/q29x7nnOYErNg3upp3C7FYXf
rUA2SDsDfFRGM4Cfi2/jxGa491V1DF/WSfFpSKj99HjrBmu+uGqTwIzzF+jTDb1pdt
6F7iVgFLxdtzMVvm7cH9MbnEDlYMDNmmmMUKkiHLiCbjp0hN9POrMvx1mfPs1K+7Wh
X6/5Uw7JkDemBsRoPY/UsUgWfxWTOfmFqDKj89CdKg1bKXoDPCIg6kTAJquhfqYNpK
sYtZYkUZjvlOLju/quFpNikjOljnknNL2ykfo0UytehLVzRFA/Se6m+KuyhaeLp4dw
l2P1YW4b9R2fQ==
Authentication-Results: real.imobilisco.com;
spf=pass (sender IP is ::1) smtp.mailfrom=info@qelbo.com smtp.helo=webmail.qelbo.com
Received-SPF: pass (real.imobilisco.com: connection is authenticated)
MIME-Version: 1.0
Date: Wed, 15 Jul 2026 23:40:43 +0100
From: Ms Olivier Lincoln
To: undisclosed-recipients:;
Subject: Funding Project
Reply-To: admin@bstbetonstar.com
Mail-Reply-To: admin@bstbetonstar.com
Message-ID:
X-Sender: info@qelbo.com
Content-Type: text/plain; charset=US-ASCII;
format=flowed
Content-Transfer-Encoding: 7bit
X-Spam_score: 18.0
X-Spam_score_int: 180
X-Spam_bar: ++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: -- Hello Good Day, My name is Ms Olivier Lincoln, and I am
a Financial Consultant with Round stone Finance Limited, an investment and
project financing firm representing a consortium of private investors. We
specialize [...]
Content analysis details: (18.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[163.172.35.53 listed in dnsbl.ahbl.org]
[163.172.35.53 listed in dnsbl.ahbl.org]
[163.172.35.53 listed in dnsbl.ahbl.org]
[163.172.35.53 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[163.172.35.53 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[163.172.35.53 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[163.172.35.53 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[163.172.35.53 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[163.172.35.53 listed in will-spam-for-food.eu.org]
[163.172.35.53 listed in will-spam-for-food.eu.org]
[163.172.35.53 listed in will-spam-for-food.eu.org]
[163.172.35.53 listed in will-spam-for-food.eu.org]
[163.172.35.53 listed in will-spam-for-food.eu.org]
[163.172.35.53 listed in will-spam-for-food.eu.org]
[163.172.35.53 listed in will-spam-for-food.eu.org]
[163.172.35.53 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries | ]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[163.172.35.53 listed in bb.barracudacentral.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries | ]
1.1 HK_SCAM_N3 BODY: No description available.
2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[163.172.35.53 listed in bl.score.senderscore.com]
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 HK_SCAM No description available.
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 MONEY_NOHTML Lots of money in plain text
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form
2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs
2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
Subject: {SPAM?} Funding Project
--
Hello Good Day,
My name is Ms Olivier Lincoln, and I am a Financial Consultant with
Round
stone Finance Limited, an investment and project financing firm
representing a consortium of private investors. We specialize in
providing
tailored financial solutions to both companies and individuals seeking
funding for viable projects across various sectors. Our financing
options
are highly competitive, with $500,000,000.00 USD, under annual interest
as
low as 5% APR, depending on the size and nature of the project. We focus
on
projects with solid business models, clear return on investment, and
long-term growth potential. If you are currently working on a project
that
requires funding, we would be happy to review your executive summary or
project proposal for possible financing consideration.
Our team will evaluate each submission carefully to determine the most
suitable funding structure for your needs. Please feel free to reach out
directly for more details or to submit your project documentation for
assessment.
Please send your response with your direct telephone number to my
private
email address below: secretariageneral@schec.cl, indicating readiness to
proceed with this transaction, I will forward you more details.
Thank you for your time and consideration. I look forward to hearing
from
you.
Warm regards,
Ms Olivier Lincoln
Managing Partner
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 15 Jul 2026 20:09:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from )
id 1wkBWc-000000008PK-447p
for dave@doctor.nl2k.ab.ca;
Wed, 15 Jul 2026 20:08:34 -0600
Resent-From: The Doctor
Resent-Date: Wed, 15 Jul 2026 20:08:34 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mailbak.spirito.de ([144.76.32.16]:33868)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.3 (FreeBSD))
(envelope-from )
id 1wkBUd-000000008Fr-1Hb3
for doctor@doctor.nl2k.ab.ca;
Wed, 15 Jul 2026 20:06:41 -0600
Received: from [10.0.3.1] (port=51590 helo=mail.spirito.de)
by mailbak.spirito.de with esmtps (TLS1.0) tls TLS_RSA_WITH_AES_256_CBC_SHA
(Exim 4.94.2)
(envelope-from )
id 1wk8XN-0008MM-A3
for doctor@doctor.nl2k.ab.ca; Wed, 15 Jul 2026 22:57:11 +0000
Received: from [147.90.209.40] (port=45769 helo=spirito.de)
by mail.spirito.de with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)
(Exim 4.69)
(envelope-from )
id 1wk3yN-0000MS-Vd
for doctor@doctor.nl2k.ab.ca; Wed, 15 Jul 2026 20:04:44 +0200
Reply-To: illuminatebrother1@gmail.com
From: Illuminati Great Brotherhood
To: doctor@doctor.nl2k.ab.ca
Date: 15 Jul 2026 19:04:43 +0100
Message-ID: <20260715190442.9127F87BC08C9C56@spirito.de>
MIME-Version: 1.0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-SA-Exim-Connect-IP: 10.0.3.1
X-SA-Exim-Mail-From: spa@spirito.de
Subject: Illuminati Great
X-SA-Exim-Version: 4.2.1 (built Sat, 13 Feb 2021 17:57:42 +0000)
X-SA-Exim-Scanned: No (on mailbak.spirito.de); Unknown failure
X-Spam_score: 10.6
X-Spam_score_int: 106
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello We are pleased to invite you to become a member of the
world's largest conglomerate, offering you an opportunity to reach the pinnacle
of your career. We believe you have strong technical and academic [...]
Content analysis details: (10.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[144.76.32.16 listed in dnsbl.ahbl.org]
[144.76.32.16 listed in dnsbl.ahbl.org]
[144.76.32.16 listed in dnsbl.ahbl.org]
[144.76.32.16 listed in dnsbl.ahbl.org]
[147.90.209.40 listed in dnsbl.ahbl.org]
[147.90.209.40 listed in dnsbl.ahbl.org]
[147.90.209.40 listed in dnsbl.ahbl.org]
[147.90.209.40 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[144.76.32.16 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[144.76.32.16 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[144.76.32.16 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[144.76.32.16 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[147.90.209.40 listed in will-spam-for-food.eu.org]
[147.90.209.40 listed in will-spam-for-food.eu.org]
[147.90.209.40 listed in will-spam-for-food.eu.org]
[147.90.209.40 listed in will-spam-for-food.eu.org]
[147.90.209.40 listed in will-spam-for-food.eu.org]
[147.90.209.40 listed in will-spam-for-food.eu.org]
[147.90.209.40 listed in will-spam-for-food.eu.org]
[147.90.209.40 listed in will-spam-for-food.eu.org]
[144.76.32.16 listed in will-spam-for-food.eu.org]
[144.76.32.16 listed in will-spam-for-food.eu.org]
[144.76.32.16 listed in will-spam-for-food.eu.org]
[144.76.32.16 listed in will-spam-for-food.eu.org]
[144.76.32.16 listed in will-spam-for-food.eu.org]
[144.76.32.16 listed in will-spam-for-food.eu.org]
[144.76.32.16 listed in will-spam-for-food.eu.org]
[144.76.32.16 listed in will-spam-for-food.eu.org]
3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[147.90.209.40 listed in zen.spamhaus.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[147.90.209.40 listed in sbl-xbl.spamhaus.org]
[147.90.209.40 listed in sbl-xbl.spamhaus.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see ]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries | ]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries | ]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[144.76.32.16 listed in bl.score.senderscore.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[illuminatebrother1(at)gmail.com]
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
Subject: {SPAM?} Illuminati Great
Hello
We are pleased to invite you to become a member of the world's
largest conglomerate, offering you an opportunity to reach the
pinnacle of your career. We believe you have strong technical and
academic skills, making you an ideal candidate for the
Illuminati.
By joining us, you'll gain access to wealthy individuals who can
help you achieve wealth, power, fame, and honor. Benefits include
cars, houses, a substantial monthly income, and the means to
start a better life with your family.
Kindly reply back if you are interested
Thanks
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 15 Jul 2026 13:29:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from )
id 1wk5Hf-00000000Dpe-0267
for dave@doctor.nl2k.ab.ca;
Wed, 15 Jul 2026 13:28:43 -0600
Resent-From: The Doctor
Resent-Date: Wed, 15 Jul 2026 13:28:42 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [175.215.224.56] (port=51682 helo=serverdata.com)
by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))
(envelope-from )
id 1wk2zh-000000006o0-2pLE
for root@doctor.nl2k.ab.ca;
Wed, 15 Jul 2026 11:02:09 -0600
From: "TD Canada Trust"
To: root@doctor.nl2k.ab.ca
Subject: Interac Transfer Alert
Date: 16 Jul 2026 02:01:09 +0900
Message-ID: <20260716020109.4F90CBD80612224B@serverdata.com>
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_0012_F4DA1A1F.4E945E5B"
X-Spam_score: 11.4
X-Spam_score_int: 114
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your interac payment is pending awaiting your approval. Kindly
login below to accept your payment.
Content analysis details: (11.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[175.215.224.56 listed in dnsbl.ahbl.org]
[175.215.224.56 listed in dnsbl.ahbl.org]
[175.215.224.56 listed in dnsbl.ahbl.org]
[175.215.224.56 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[175.215.224.56 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[175.215.224.56 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[175.215.224.56 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[175.215.224.56 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[175.215.224.56 listed in will-spam-for-food.eu.org]
[175.215.224.56 listed in will-spam-for-food.eu.org]
[175.215.224.56 listed in will-spam-for-food.eu.org]
[175.215.224.56 listed in will-spam-for-food.eu.org]
[175.215.224.56 listed in will-spam-for-food.eu.org]
[175.215.224.56 listed in will-spam-for-food.eu.org]
[175.215.224.56 listed in will-spam-for-food.eu.org]
[175.215.224.56 listed in will-spam-for-food.eu.org]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: oppaweb.com]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries | ]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries | ]
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[175.215.224.56 listed in bl.score.senderscore.com]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
2.8 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -
probable phishing
3.0 URI_WP_HACKED URI for compromised WordPress site, possible malware
Subject: {SPAM?} Interac Transfer Alert
------=_NextPart_000_0012_F4DA1A1F.4E945E5B
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
k" border=3D"0" alt=3D"TD" src=3D"cid:tdshieldstv1.png" width=3D"67" height=
=3D"60" data-bit=3D"iit">
; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(68,=
68,68); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; =
BACKGROUND-COLOR: rgb(253,253,253); TEXT-INDENT: 0px; font-variant-ligature=
s: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-=
decoration-thickness: initial; text-decoration-style: initial; text-decorat=
ion-color: initial">
; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(68,=
68,68); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; =
BACKGROUND-COLOR: rgb(253,253,253); TEXT-INDENT: 0px; font-variant-ligature=
s: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-=
decoration-thickness: initial; text-decoration-style: initial; text-decorat=
ion-color: initial" dir=3Dltr align=3Dleft>
Your interac payment is pending awaiting your approval. Kindly login=
below to accept your payment.
_DWT116_com_zimbra_url class=3DObject style=3D"CURSOR: pointer; TEXT-DECORA=
TION: none; COLOR: rgb(51,102,153)">
AMILY: helvetica, arial, sans-serif; FONT-WEIGHT: bold; COLOR: rgb(255,255,=
255); PADDING-BOTTOM: 10px; PADDING-TOP: 10px; PADDING-LEFT: 25px; DISPLAY:=
inline-block; PADDING-RIGHT: 25px; BACKGROUND-COLOR: rgb(0,138,0); border-=
radius: 5px" href=3D"https://t.co/hIES56oh51" rel=3D"nofollow noopener nore=
ferrer" target=3D_blank>Accept Your Payment Standard mess=
age and data rates may apply.
Thank you for choosing TD Bank. This is a servicing message from TD =
Bank. Please do not reply to this email. Your privacy is our priorit=
y. We'll never ask you to confirm your account number, PIN, password, or pe=
rsonal information via email. Receive a suspicious email? Forward it to
N>
er class=3DObject style=3D"CURSOR: pointer; TEXT-DECORATION: none; COLOR: r=
gb(51,102,153)">
Phishing=
@td.com or call 1 866 222 3356. Learn more abo=
ut our
a_url class=3DObject style=3D"CURSOR: pointer; TEXT-DECORATION: none; COLOR=
: rgb(51,102,153)">
" href=3D"https://www.td.com/privacy-and-security/privacy-and-security/our-=
privacy-commitments/td-privacy-code/privacy.jsp" rel=3D"nofollow noopener n=
oreferrer" target=3D_blank>TD Privacy Code.
------=_NextPart_000_0012_F4DA1A1F.4E945E5B
Content-Type: image/png; name="tdshieldstv1.png"
Content-Transfer-Encoding: base64
Content-ID:
...
------=_NextPart_000_0012_F4DA1A1F.4E945E5B--
Content analysis details: (5.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[52.103.21.28 listed in dnsbl.ahbl.org]
[52.103.21.28 listed in dnsbl.ahbl.org]
[52.103.21.28 listed in dnsbl.ahbl.org]
[52.103.21.28 listed in dnsbl.ahbl.org]
[2603:10d6:103:d8:0:0:0:11 listed in]
[dnsbl.ahbl.org]
[2603:10d6:103:d8:0:0:0:11 listed in]
[dnsbl.ahbl.org]
[2603:10d6:103:d8:0:0:0:11 listed in]
[dnsbl.ahbl.org]
[2603:10d6:103:d8:0:0:0:11 listed in]
[dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[52.103.21.28 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[52.103.21.28 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[52.103.21.28 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[52.103.21.28 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[2603:10d6:103:d8:0:0:0:11 listed in]
[will-spam-for-food.eu.org]
[2603:10d6:103:d8:0:0:0:11 listed in]
[will-spam-for-food.eu.org]
[2603:10d6:103:d8:0:0:0:11 listed in]
[will-spam-for-food.eu.org]
[2603:10d6:103:d8:0:0:0:11 listed in]
[will-spam-for-food.eu.org]
[2603:10d6:103:d8:0:0:0:11 listed in]
[will-spam-for-food.eu.org]
[2603:10d6:103:d8:0:0:0:11 listed in]
[will-spam-for-food.eu.org]
[2603:10d6:103:d8:0:0:0:11 listed in]
[will-spam-for-food.eu.org]
[2603:10d6:103:d8:0:0:0:11 listed in]
[will-spam-for-food.eu.org]
[52.103.21.28 listed in will-spam-for-food.eu.org]
[52.103.21.28 listed in will-spam-for-food.eu.org]
[52.103.21.28 listed in will-spam-for-food.eu.org]
[52.103.21.28 listed in will-spam-for-food.eu.org]
[52.103.21.28 listed in will-spam-for-food.eu.org]
[52.103.21.28 listed in will-spam-for-food.eu.org]
[52.103.21.28 listed in will-spam-for-food.eu.org]
[52.103.21.28 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[52.103.21.28 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries | ]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries | ]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit
[jimraphael833(at)outlook.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
1.2 MISSING_HEADERS Missing To: header
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[jimraphael833(at)outlook.com]
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[52.103.21.28 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[52.103.21.28 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.4 MALFORMED_FREEMAIL Bad headers on message from free email service
Subject: {SPAM?} HELLO DEAR
Hi, I am JIM RALPHAEL, I represent a client who is seeking investment opportunities away from his native country, but wants a trustworthy and capable person. Can you help achieve this? Respond for further details. Thank you. Best Regards, JIM RALPHAEL.
Error
serendipity error: could not include serendipity_plugin_freetag:6c39baf097de002d8b1c2e33b9661474 - exiting.
Error
serendipity error: could not include serendipity_plugin_statistics:f520e0fa688ba61bd1ed85c0fd80d550 - exiting.
Error
serendipity error: could not include serendipity_plugin_twitter:b18e142d4998b6b0092d068ad858683d - exiting.