Web/SEo/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 08 Mar 2025 06:32:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tquGw-00000000HHV-1R4O

for dave@doctor.nl2k.ab.ca;

Sat, 08 Mar 2025 06:31:22 -0700

Resent-From: The Doctor

Resent-Date: Sat, 8 Mar 2025 06:31:22 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f80.google.com ([209.85.216.80]:38881)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.1 (FreeBSD))

(envelope-from <7mar2+bncBCXPFL4PYMNBBXEFWC7AMGQEAHSBRRI@weballen.top>)

id 1tqpnK-0000000021W-1MTS

for sales@nk.ca;

Sat, 08 Mar 2025 01:44:36 -0700

Received: by mail-pj1-f80.google.com with SMTP id 98e67ed59e1d1-2fe8a5c5410sf919334a91.3

for ; Sat, 08 Mar 2025 00:42:36 -0800 (PST)

ARC-Seal: i=2; a=rsa-sha256; t=1741423350; cv=pass;

d=google.com; s=arc-20240605;

b=WNOKaymmE1RIEHSJdVjJMhpSAa8598DhLhG/DksHI/ISOagnLI8EW0HFt9GZXzphQP

JMtQ8aQ9PtustbGAZ+4JtdF+Y6wBLirJN9zrn7voIll2m2sJksnxzzhR3hdaiYihWDNy

/SjKTqNn1BZjAnqfJ6eupxT0PqxtNfN5aQBVhEDEOPvPsQzldhZUlJj/bbm46ESRs/BV

7Inbob+eqGgyHQIAxm0rEIYa7KmVSCCwqXUeFfpESHgOfpzhdGFUX+MhPGuZftcrpKNs

oN0XcW1T437sFe1WaKYuyvluB+XifTeqNO8OaulkAfMYJZ69vy+ua0Bo9WR0mfGx7GKm

Q7hA==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=list-unsubscribe:list-archive:list-help:list-post:list-id

:mailing-list:precedence:to:subject:message-id:date:from

:mime-version:dkim-signature;

bh=piFFaIQEay2BzbsykAG16AdkOfPNOOdHxkhXJllVJC8=;

fh=v2WSFS3W45MvW5eqURinYfxs9bqenjZoU9cETBivatQ=;

b=gMumeuye2NFXnIL+sP5V3hZjskYA7qoXRe4L/xaOKwRTCfd8tCKnIw30M4zLSfUqYn

+NpEom2/XFMTnJHvyDIRrj3kHO61+01dLEXqDquKBu5uNgqI1vy/MU1jOUhR0AMwpQIZ

ZVpo3re7KoyiHXHfePEO0nTvpIiEdjOpfvOrytDzvsQIxYkB0OI7s3OOkEWhThtTNPiR

TdZtWoh314z6Y5qttCqBvZHpIsLhxophJlv6r9K05tsqds/c1mQ2DxB1uEOxKhT4vxHF

z3J2zaDf7RHcBz9z3t9KfzR3LbOgWaqgsnJcJ9g2bITEzv/Y0BX5VzwRlnNYI58TTLps

TXYg==;

darn=nk.ca

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20230601 header.b=WTyZGOB3;

spf=pass (google.com: domain of ginnamarkus968@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=ginnamarkus968@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=pass header.i=@weballen.top

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=weballen-top.20230601.gappssmtp.com; s=20230601; t=1741423350; x=1742028150; darn=nk.ca;

h=list-unsubscribe:list-archive:list-help:list-post:list-id

:mailing-list:precedence:x-original-authentication-results

:x-original-sender:to:subject:message-id:date:from:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=piFFaIQEay2BzbsykAG16AdkOfPNOOdHxkhXJllVJC8=;

b=Snzqvf6OYgTPmKygAljgEpuLetjY4STTIIhW6nKfNRLuF5uHkvO0tK+QD/uXPV3JJX

12tjxuerdLKgaMqq1j+eNp5shk3fxl3tXGQPs7peHGw60jWdxqrQyduaE2fHXSn0lucP

ZkqsbVaSDuDSzq4nj+1JfnsjXou0towiRYzy95qLZU2bld9zymhoLa9q4hJn9Fiefs8o

aSUYDPP1IEmeRaDaMe8+UqD1SR08E1+odvDYJEbCAA0RXpVv4m+f1vq/JH6BG1ocPAId

gqK4czNt4ZGg4dXFao8F0cWXCq6tOv+uwpsClOPQ5Fm3ny1AZYMAfmAg4yuu8yL0u41b

3wgQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1741423350; x=1742028150;

h=list-unsubscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence

:x-original-authentication-results:x-original-sender:to:subject

:message-id:date:from:mime-version:x-beenthere:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=piFFaIQEay2BzbsykAG16AdkOfPNOOdHxkhXJllVJC8=;

b=Ea9i5WUUYrphMY76m+vIvyHrXv1QusqsMLiRzMFJlG2UIQvFJeXR7a87F7RY8I7//r

DhJuKuRJFlLSQffMB7O9pcpJgyJE0bXkPSBn/+t4A5QYAq0enZMEPYnROsCIrShioSSl

csKWruPvCqumVeW2ehpoA+aqJ+j2BUKJN5RAlmW2U1xGE3QKIQWVCE3sYTPb3TAG4PMW

5FYddY9hKY6KQ2iisJ6/qsKZimq6x4ajzErmmmGEPudqhavoeo9/6CubCneyBsipKaOo

IE/FHRdl9HngS6OUd7fnWJEzS7Eu2G6xP8j42qGv1sjLQkhEIWKNd0RRtIPgKP38Rd+k

zc0g==

X-Forwarded-Encrypted: i=2; AJvYcCUOZ6YoOb0qnFt989QSIn32IgmpJAhOhpZ4Iakqz+IbJRt6PZm3Zlxn6UBEqZMNo+sMY6svsw==@nk.ca

X-Gm-Message-State: AOJu0YwmEaNFsUexBi/MN06a4MXtA794fsggztF9m1mq6DDtWjL7uotS

TquzhtcZ9+5QDUG0vfebcCybWMhjbxQxZSCZG459RJtIi4Z5E39jw3rHxGT4Ce8=

X-Google-Smtp-Source: AGHT+IHjuR3GB97t9DT3TrMkmDUHqG5ZINMfBWFLK/dktk1vw7iyFFNC/CvPFKrxpSmK++5zRoRSAA==

X-Received: by 2002:a05:6a00:2e97:b0:736:6ecd:8e39 with SMTP id d2e1a72fcca58-736becaf4famr1334515b3a.2.1741423349829;

Sat, 08 Mar 2025 00:42:29 -0800 (PST)

X-BeenThere: 7mar2@weballen.top; h=Adn5yVGmMe8v9crpDdVoNcNzym9KmrVDZtah+rHn4h/YIajkjA==

Received: by 2002:a05:6a00:8301:b0:725:e3f6:b149 with SMTP id

d2e1a72fcca58-736949bf7d4ls2500221b3a.1.-pod-prod-02-us; Sat, 08 Mar 2025

00:42:04 -0800 (PST)

X-Forwarded-Encrypted: i=2; AJvYcCUtEleTNZNn7wSQFdDvG9XWJizEca3SSPZelKvW1WjVvG5y57k2fxUJQPo9CQTqpwzZGaHvqQ==@weballen.top

X-Received: by 2002:a05:6a21:6d97:b0:1f3:269c:6706 with SMTP id adf61e73a8af0-1f544ad7016mr11261421637.8.1741423323738;

Sat, 08 Mar 2025 00:42:03 -0800 (PST)

ARC-Seal: i=1; a=rsa-sha256; t=1741423323; cv=none;

d=google.com; s=arc-20240605;

b=VsQzYMnSNknnP1b8dDwWf8ueg9JpL6ekRZlFvWSz9lSFMK9J+/Zscb4aZbecjXHoXQ

C4cdMQVjNhPrduWbEoJjWnZ25dnwBlj1Xakt+A1jKNMBGfRVrohWznMCNFnuB2/w4WlJ

Wt1L4+wCHWu3QRIT047ah6DzFC9KtbgGURQwKMvz3o4VoGMUcesj83gZI06Om1TI/NZT

u3kLg35/yB+0HAeOmWjOXT2S+0dbexPjqQXoYpIwziRkUb3M7mJGSdllfjLtX9TpTQnd

9P0zdCetyzzZvnSLfrmFokW0FD9jj5zE45x52XSnBynJWx/kmGbHMvNN6Cb5DdZQnRtT

yxlw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=piFFaIQEay2BzbsykAG16AdkOfPNOOdHxkhXJllVJC8=;

fh=vmS5w8pt5Jg8tHVjEpwJdIaEZrpTzhHFb79e0nZH4uQ=;

b=IGDS0+i3Ms/d7dahQuG38r5jr81yIR4C8uOFYlOXeJDfsf0h/YOvs4Ynf1DKZJoBF0

uT2nLUx1L90QlnloGECcuGIx+Y4m/zHgv3lIKZmx1TpeXXeLbJNgha9B0mOnMu4zEASq

Kd636YDauJtOKKgKQb7uNtricztxuGkXu1CwUHnReFzJ97W8y4d9PBhVeMslSj2iXG6r

kZy9yG2zXLFUQHhLH29kSNAKQ8+DzdZ+Nv+3azdysU3xQbhKshUSqikmQu9F9XjeNYws

qADgemeAVdAxM90HJVZMVVobLwoSTP/EQXlOu/8k47V+2uadCAXvFcrWYhzIxGiPMbvB

ZW+Q==;

dara=google.com

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20230601 header.b=WTyZGOB3;

spf=pass (google.com: domain of ginnamarkus968@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=ginnamarkus968@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=pass header.i=@weballen.top

Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])

by mx.google.com with SMTPS id 41be03b00d2f7-af281092afesor2460190a12.1.2025.03.08.00.42.03

for <7mar2@weballen.top>

(Google Transport Security);

Sat, 08 Mar 2025 00:42:03 -0800 (PST)

Received-SPF: pass (google.com: domain of ginnamarkus968@gmail.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;

X-Forwarded-Encrypted: i=1; AJvYcCX7cbQ6dQSZPvDsRr8HmEso5wWGQANf//JDJkrMH+5HqvuS4lM85IczbqozB4LSpLgGZVZenA==@weballen.top

X-Gm-Gg: ASbGncuveWlq9nuBKTldoUZFDInu/TE7gkozA4lNCVaznU6+hY9W2vmyVnnTLgSd9P6

4NC4PxMemIbh6IbijPsKtkLrSR6WKok4M7o0h8f/Zz48UjROmuByW00ZzUl7ZFmMFNKFi2zVoFQ

CQ2Gqe/qOzmh+mdrbNFI/15Y6oZd01Q9e+q9Nf+ZsM6ODes0L8cMG+6AGPlkgM

X-Received: by 2002:a17:90b:4c8f:b0:2fe:8902:9ecd with SMTP id

98e67ed59e1d1-2ff7ce61e9bmr9602281a91.1.1741423322988; Sat, 08 Mar 2025

00:42:02 -0800 (PST)

MIME-Version: 1.0

From: Gianna Markus

Date: Sat, 8 Mar 2025 14:11:51 +0530

X-Gm-Features: AQ5f1JoILtv3ajpkD_Y2Udr7uMZgA-JeXiMLXSB41BxVj_vDZmG-XPrdMS7RV08

Message-ID:

Subject: Custom software development...!!!

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000920adf062fd0b60b"

Bcc: 7mar2@weballen.top

X-Original-Sender: ginnamarkus968@gmail.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@gmail.com header.s=20230601 header.b=WTyZGOB3; spf=pass

(google.com: domain of ginnamarkus968@gmail.com designates 209.85.220.41 as

permitted sender) smtp.mailfrom=ginnamarkus968@gmail.com; dmarc=pass

(p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com; dara=pass header.i=@weballen.top

Precedence: list

Mailing-list: list 7mar2@weballen.top; contact 7mar2+owners@weballen.top

List-ID: <7mar2.weballen.top>

X-Spam-Checked-In-Group: 7mar2@weballen.top

X-Google-Group-Id: 332912648134

List-Post: ,

List-Help: ,



List-Archive:

List-Unsubscribe: ,



X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Do you need help with your ongoing or any new Project

in the following? *Followed are our key services*-



Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.80 listed in dnsbl.ahbl.org]

[209.85.216.80 listed in dnsbl.ahbl.org]

[209.85.216.80 listed in dnsbl.ahbl.org]

[209.85.216.80 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.80 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.80 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.80 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.80 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.80 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.80 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ginnamarkus968(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 FROM_SUSPICIOUS_NTLD From abused NTLD

Subject: {SPAM?} Custom software development...!!!



--000000000000920adf062fd0b60b

Content-Type: text/plain; charset="UTF-8"



Hello,



Do you need help with your ongoing or any new Project in the following?



Followed are our key services*-



 Mobile app development (iOS and Android)







 Custom software development*



Let me know if you need help with the above services and would be happy to

discuss over a no-obligation consultation on how you may plan your project

and how we may help.



Look forward to your reply.



Thanks & Regards

Gianna



--000000000000920adf062fd0b60b

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




t;font-family:"Times New Roman","serif"">
"font-size:11pt;font-family:Calibri,"sans-serif"">Hello,=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=

=C2=A0
erif"">


5pt;background-size:initial;font-size:12pt;font-family:"Times New Roma=

n","serif"">
yle=3D"font-size:11pt;font-family:Calibri,"sans-serif";color:blac=

k">Do you need help with your ongoing or any new Project in the following?<=

/span>
erif"">


5pt;background-size:initial;font-size:12pt;font-family:"Times New Roma=

n","serif"">
style=3D"font-size:11pt;font-family:Calibri,"sans-serif";color:b=

lack">Followed are our key services
ze:11pt;font-family:Calibri,"sans-serif";color:black">-
an style=3D"font-size:10pt;font-family:Verdana,"sans-serif"">
an>


:0cm;margin-left:0cm;font-size:12pt;font-family:"Times New Roman"=

,"serif"">
=3D"font-size:11pt;font-family:Calibri,"sans-serif";color:black">=

=C2=A0=C2=A0=C2=A0=C2=A0 Mobile app development (iOS and Android)
>
quot;">


ackground-size:initial;font-size:12pt;font-family:"Times New Roman&quo=

t;,"serif"">
e=3D"font-size:11pt;font-family:Calibri,"sans-serif";color:black"=

>=C2=A0=C2=A0=C2=A0 =C2=A0Custom software development


pan>
;">


round-size:initial;font-size:12pt;font-family:"Times New Roman",&=

quot;serif"">
nt-size:11pt;font-family:Calibri,"sans-serif";color:black">Let me=

know if you need help with the above services and would be happy to discus=

s over a no-obligation consultation on how you may plan your project and ho=

w we may help.=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=

=C2=A0=C2=A0=C2=A0
erdana,"sans-serif"">


pt;line-height:11.75pt;background-size:initial;font-size:12pt;font-family:&=

quot;Times New Roman","serif"">
e:initial">
if";color:black">Look forward to your reply.
=3D"font-size:10pt;font-family:Verdana,"sans-serif"">

<=

p style=3D"margin-right:0cm;margin-left:0cm">
rif">Thanks & Regards
t>
"font-size:13.3333px">

"sans-serif";font-size:11pt">Gianna





--000000000000920adf062fd0b60b--

Fedex phish from Google Cloud

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 08 Mar 2025 06:31:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tquGX-00000000FnT-0Msp

for dave@doctor.nl2k.ab.ca;

Sat, 08 Mar 2025 06:30:57 -0700

Resent-From: The Doctor

Resent-Date: Sat, 8 Mar 2025 06:30:57 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 83.251.106.34.bc.googleusercontent.com ([34.106.251.83]:38162 helo=localhost)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqosf-00000000Mgr-3xHX

for doctor@nk.ca;

Sat, 08 Mar 2025 00:46:04 -0700

Received: by localhost (Postfix, from userid 0)

id 471FC224AAC; Sat, 8 Mar 2025 07:43:57 +0000 (UTC)

To: doctor@nk.ca

From: noreply@FedEx.com

Subject: FedEx Delivery Waiting

MIME-Version: 1.0

Content-Type: text/html

Message-Id: <20250308074357.471FC224AAC@localhost>

Date: Sat, 8 Mar 2025 07:43:57 +0000 (UTC)

X-Spam_score: 15.6

X-Spam_score_int: 156

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: International Priority® FedEx informs you that your shipment

169###340 is still waiting for instructions from you.



Content analysis details: (15.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.106.251.83 listed in will-spam-for-food.eu.org]

[34.106.251.83 listed in will-spam-for-food.eu.org]

[34.106.251.83 listed in will-spam-for-food.eu.org]

[34.106.251.83 listed in will-spam-for-food.eu.org]

[34.106.251.83 listed in will-spam-for-food.eu.org]

[34.106.251.83 listed in will-spam-for-food.eu.org]

[34.106.251.83 listed in will-spam-for-food.eu.org]

[34.106.251.83 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.106.251.83 listed in dnsbl.ahbl.org]

[34.106.251.83 listed in dnsbl.ahbl.org]

[34.106.251.83 listed in dnsbl.ahbl.org]

[34.106.251.83 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.106.251.83 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.106.251.83 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.106.251.83 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.106.251.83 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[34.106.251.83 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[34.106.251.83 listed in sbl-xbl.spamhaus.org]

0.0 TVD_RCVD_IP Message was received from an IP address

3.6 HELO_LOCALHOST No description available.

0.0 FSL_HELO_NON_FQDN_1 No description available.

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 DYN_RDNS_SHORT_HELO_HTML Sent by dynamic rDNS, short HELO, and HTML

Subject: {SPAM?} FedEx Delivery Waiting

























International Priority®




FedEx informs you that your shipment 169###340 is still waiting for instructions from you.



Delivery option : International Priority®

Fees to pay :  79 USD.








This link will expire in 24 hours.






© 2025 FedEx Inc. All rights reserved.

this email was sent automatically please do not reply.


 












nk.ca credential phising from hostzealot.com

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 10:50:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqbpa-00000000FXw-1ZDv

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 10:49:54 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 10:49:54 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [79.141.162.46] (port=51204 helo=mail0.henutepsa.ooguy.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqaSn-00000000O5r-3WOw

for doctor@nl2k.ab.ca;

Fri, 07 Mar 2025 09:22:22 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=henutepsa.ooguy.com;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:

Content-Transfer-Encoding; i=info@henutepsa.ooguy.com;

bh=AkRPadb3WTz274LGfbsKqLvqBd2gBUOZBQzNpyE9Ic8=;

b=GjjZe97C2QJLR6afWV6IgIrMF3Ll1CXTo/Q2nvGOOVumAxrcWyDIUJ8BOa2495otRhxkit+nUtIO

NoxkzFqtb3gdcolSFzRpY2WjtJHGEeGC3F2kUavTTSccl883dzdOmsMibxkurhypTG3jogx0/LJC

Ofk90QI+J3NY6GiI1Dg=

From: " nl2k.ab.ca "< info@henutepsa.ooguy.com>

To: doctor@nl2k.ab.ca

Subject: =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=

Date: 7 Mar 2025 08:20:21 -0800

Message-ID: <20250307082021.24E36A420FD4ECAD@henutepsa.ooguy.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.4

X-Spam_score_int: 134

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Password Expiration Notice Password Expiration Alert



Content analysis details: (13.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 FROMSPACE Idiosyncratic "From" header format

2.7 FROM_WSP_LEAD Leading whitespace after '<' in From header field

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 FROM_MISSPACED From: missing whitespace

Subject: {SPAM?} =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=














=3D1.0">

Password Expiration Notice






background-color: #f4f4f4;

margin: 0;

padding: 0;

color: #333333">


margin: 40px auto;

background-color: #ffffff;

padding: 40px;

border-radius: 8px;

box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1)" class=3D"email-conta=

iner">


color: #2c3e50;

margin-bottom: 20px;

text-align: center;

border-bottom: 2px solid #3498db;

padding-bottom: 10px">Password Expiration Alert




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Dear doctor,




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">We are writing to inform you that your current =

password for the mailbox doctor@nl2k.ab.ca has expired.
p>


border-left: 4px solid #3498db;

padding: 15px;

margin-bottom: 20px" class=3D"highlight">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; color: #e74c3c;

font-weight: bold" class=3D"warning-text">Important: Failure to=

update your password will result in temporary loss of access to your =

mailbox. We strongly recommend taking action promptly to avoid any interrup=

tions to your service.






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">However, it is advised to continue using y=

our current password. To continue using current password, please click the =

button below:






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Thank you for your prompt attention to this mat=

ter.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Best regards,
The nl2k.ab.ca Team






color: #7f8c8d;

text-align: center;

margin-top: 40px;

padding-top: 20px;

border-top: 1px solid #ecf0f1" class=3D"footer">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">© 2025 nl2k.ab.ca. All righ=

ts reserved.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">Privacy Policy=

| Terms of Service | Contact Support
p>





nk.ca credential phising from hostzealot.com

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 10:50:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqbpW-00000000FXh-33AP

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 10:49:50 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 10:49:50 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [79.141.162.46] (port=59309 helo=mail0.henutepsa.ooguy.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqaSx-00000000O5p-2d3a

for doctor@nk.ca;

Fri, 07 Mar 2025 09:22:31 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=henutepsa.ooguy.com;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:

Content-Transfer-Encoding; i=info@henutepsa.ooguy.com;

bh=ME/ig4A1LB96hSEahz3HXwCUgOt1PegSWj+TCwm3YLA=;

b=Q1+DGJY1ZMsYB6dCTiKMXFwJ2fPVV/+r54nMEvQk1apnOKBEPfkn7p9t2QVIOsqKeZ9ZbJxnHKCQ

fPTs2hNRlOrSgb3s9AyrVtlTXuCPpaq5DtTtnC15SuGls4ONQvgXgJavT9T72WL6cokcjpUyXpFs

F46TKBne0/jdtapCMJU=

From: " nk.ca "< info@henutepsa.ooguy.com>

To: doctor@nk.ca

Subject: =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=

Date: 7 Mar 2025 08:20:21 -0800

Message-ID: <20250307082021.F002D008A2E9DB2B@henutepsa.ooguy.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.4

X-Spam_score_int: 134

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Password Expiration Notice Password Expiration Alert



Content analysis details: (13.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 FROMSPACE Idiosyncratic "From" header format

2.7 FROM_WSP_LEAD Leading whitespace after '<' in From header field

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FROM_MISSPACED From: missing whitespace

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=














=3D1.0">

Password Expiration Notice






background-color: #f4f4f4;

margin: 0;

padding: 0;

color: #333333">


margin: 40px auto;

background-color: #ffffff;

padding: 40px;

border-radius: 8px;

box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1)" class=3D"email-conta=

iner">


color: #2c3e50;

margin-bottom: 20px;

text-align: center;

border-bottom: 2px solid #3498db;

padding-bottom: 10px">Password Expiration Alert




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Dear doctor,




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">We are writing to inform you that your current =

password for the mailbox doctor@nk.ca has expired.




border-left: 4px solid #3498db;

padding: 15px;

margin-bottom: 20px" class=3D"highlight">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; color: #e74c3c;

font-weight: bold" class=3D"warning-text">Important: Failure to=

update your password will result in temporary loss of access to your =

mailbox. We strongly recommend taking action promptly to avoid any interrup=

tions to your service.






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">However, it is advised to continue using y=

our current password. To continue using current password, please click the =

button below:






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Thank you for your prompt attention to this mat=

ter.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Best regards,
The nk.ca Team






color: #7f8c8d;

text-align: center;

margin-top: 40px;

padding-top: 20px;

border-top: 1px solid #ecf0f1" class=3D"footer">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">© 2025 nk.ca. All rights re=

served.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">Privacy Policy=

| Terms of Service | Contact Support
p>





nk.ca credential phising from hostzealot.com

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 10:50:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqbpP-00000000FX5-1m7n

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 10:49:43 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 10:49:43 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [79.141.162.46] (port=59309 helo=mail0.henutepsa.ooguy.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqaSn-00000000O5p-3WO7

for sales@nk.ca;

Fri, 07 Mar 2025 09:22:22 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=henutepsa.ooguy.com;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:

Content-Transfer-Encoding; i=info@henutepsa.ooguy.com;

bh=PUNMthvTma3OObBXPv4jc4uaW2FINOUeh0dhfzPKpQc=;

b=d39SaFGYB2zUrFpN/EF/J51EdUMZYlRrQFFVe2yAwdBrSuGGrpdYSj0lbmtweve65Wu/xqo1UV0f

hEIWycEs0WgNYEy+NdbmwAGhtNiAplmDD1QiQWVRNcYTwH5B0CB3KrjOVUc/lJMDDSEEfe07792W

jPmhsEfqcG3tfAOrjgQ=

From: " nk.ca "< info@henutepsa.ooguy.com>

To: sales@nk.ca

Subject: =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=

Date: 7 Mar 2025 08:20:20 -0800

Message-ID: <20250307082020.6340A8243B7E3A90@henutepsa.ooguy.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.4

X-Spam_score_int: 134

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Password Expiration Notice Password Expiration Alert



Content analysis details: (13.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 FROMSPACE Idiosyncratic "From" header format

2.7 FROM_WSP_LEAD Leading whitespace after '<' in From header field

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FROM_MISSPACED From: missing whitespace

Subject: {SPAM?} =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=














=3D1.0">

Password Expiration Notice






background-color: #f4f4f4;

margin: 0;

padding: 0;

color: #333333">


margin: 40px auto;

background-color: #ffffff;

padding: 40px;

border-radius: 8px;

box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1)" class=3D"email-conta=

iner">


color: #2c3e50;

margin-bottom: 20px;

text-align: center;

border-bottom: 2px solid #3498db;

padding-bottom: 10px">Password Expiration Alert




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Dear sales,




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">We are writing to inform you that your current =

password for the mailbox sales@nk.ca has expired.




border-left: 4px solid #3498db;

padding: 15px;

margin-bottom: 20px" class=3D"highlight">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; color: #e74c3c;

font-weight: bold" class=3D"warning-text">Important: Failure to=

update your password will result in temporary loss of access to your =

mailbox. We strongly recommend taking action promptly to avoid any interrup=

tions to your service.






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">However, it is advised to continue using y=

our current password. To continue using current password, please click the =

button below:






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Thank you for your prompt attention to this mat=

ter.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Best regards,
The nk.ca Team






color: #7f8c8d;

text-align: center;

margin-top: 40px;

padding-top: 20px;

border-top: 1px solid #ecf0f1" class=3D"footer">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">© 2025 nk.ca. All rights re=

served.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">Privacy Policy=

| Terms of Service | Contact Support
p>





nk.ca credential phising from hostzealot.com

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 10:50:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqbpe-00000000FYa-1s4Q

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 10:49:58 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 10:49:58 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [79.141.162.46] (port=59309 helo=mail0.henutepsa.ooguy.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqaSs-00000000O5p-2wFP

for root@nk.ca;

Fri, 07 Mar 2025 09:22:27 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=henutepsa.ooguy.com;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:

Content-Transfer-Encoding; i=info@henutepsa.ooguy.com;

bh=ALvw0ueLTWOKJ3b7uypWUm2Hx7RdkOkXQy1C/zJ4OWs=;

b=D0cvBzpbS76MbFdkuW1bQWyE7IYwiCUbkvFIopSlFYnFGPcB7XRnCrtP3CnRm/tRPKhg70CnHiJk

ZOVQY+UjCM0HUVOMDnVBtOrcEmTXUl6FcaonGuC7jNiGsSeLvgdqGljCYj1VzCPh3zG/r6YuH2m/

FgiUt1tzMYEMQZFtDZ8=

From: " nk.ca "< info@henutepsa.ooguy.com>

To: root@nk.ca

Subject: =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=

Date: 7 Mar 2025 08:20:21 -0800

Message-ID: <20250307082021.CF564FCB0A4053C9@henutepsa.ooguy.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.4

X-Spam_score_int: 134

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Password Expiration Notice Password Expiration Alert



Content analysis details: (13.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 FROMSPACE Idiosyncratic "From" header format

2.7 FROM_WSP_LEAD Leading whitespace after '<' in From header field

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 FROM_MISSPACED From: missing whitespace

Subject: {SPAM?} =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=














=3D1.0">

Password Expiration Notice






background-color: #f4f4f4;

margin: 0;

padding: 0;

color: #333333">


margin: 40px auto;

background-color: #ffffff;

padding: 40px;

border-radius: 8px;

box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1)" class=3D"email-conta=

iner">


color: #2c3e50;

margin-bottom: 20px;

text-align: center;

border-bottom: 2px solid #3498db;

padding-bottom: 10px">Password Expiration Alert




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Dear root,




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">We are writing to inform you that your current =

password for the mailbox root@nk.ca has expired.




border-left: 4px solid #3498db;

padding: 15px;

margin-bottom: 20px" class=3D"highlight">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; color: #e74c3c;

font-weight: bold" class=3D"warning-text">Important: Failure to=

update your password will result in temporary loss of access to your =

mailbox. We strongly recommend taking action promptly to avoid any interrup=

tions to your service.






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">However, it is advised to continue using y=

our current password. To continue using current password, please click the =

button below:






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Thank you for your prompt attention to this mat=

ter.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Best regards,
The nk.ca Team






color: #7f8c8d;

text-align: center;

margin-top: 40px;

padding-top: 20px;

border-top: 1px solid #ecf0f1" class=3D"footer">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">© 2025 nk.ca. All rights re=

served.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">Privacy Policy=

| Terms of Service | Contact Support
p>





Web/SEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 10:49:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqboQ-00000000FRb-26Cm

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 10:48:42 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 10:48:42 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vi1eur05olkn2051.outbound.protection.outlook.com ([40.92.90.51]:20577 helo=EUR05-VI1-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqZt5-00000000I93-36FX

for doctor@nk.ca;

Fri, 07 Mar 2025 08:45:28 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=kEX8ThBrN0l4/y11QiJ0Xedl//+RK+pG3q0q3A8opt5JiiRwqObbNzOHH9dKvgKRUI7831/AxCskiZ2nXZNk8J9Ee1Kf4MdOMKT6tRvedeiEGNOdhJtZYcbxI17/Xq4El+DHVEOLJEVcZfTtmx1w7Rg0realwxkd7yDPfABVa/mxFzkHqjC/3kbLx8nS9EevhMQK3YUfl4sE5bJsVeqbwTTpn1GLlaZ8uvang7ngoMtsScrtSZNzrhodZOD+xkome6MmV80TwwOiMXw4fMj3B1QXnb4BL9cMP4AZqT/5dzquRXa8S1ugq2NJjK6e4cGvDqi6anjkSGkszabuExQROw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=5+PYsOZev8YqER+xZvLl5A4aLFiHn4CdqS11QXZWn1I=;

b=CPdJRi3zKBcF8439XyvDFZRoUM8U1HZhJE0jOX5hQAtmsrg/ExFuhasGRSoBfVZNbO4gP3UHHzC2TtHT74eyFTfYKCjjTNU9AoT2f6FgnKe0zvExhSYiZJhgwi9vR3aIbU877AZh1bihWpdxunPrmddx1gayIxFRjl6pYv2GXOq86VcFwTZvHKlq0GVmkYJ3XyUFPW6HcXjA9VvINncqz6wcdrl62zj5+Rq4B7E4ecIZ0aw4PPryLJZKXsPMM4T0clBCjfxo+ueqdFbP7eqcKCmyctEBcv1T+nC8VDZ7E+vNEjKa4XGUzKMRIQbtb30YFKOUZE9GaA+7DEA1vspnXw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=5+PYsOZev8YqER+xZvLl5A4aLFiHn4CdqS11QXZWn1I=;

b=Th/n1DiN1VFy02UGoBsrEHnxOMMhxA/xhBKYbqLeYz1ILqjy+WByZ6D+wvKBIF5Vq4UhFGuLN613SxqWvRFJOopBb8Ik0tD7VbwWvHHjy1J0jO3Q1Si1ys5Hoa2f+hYJLpaUPDW2+ylFcajqs5FIWID5e95UU7Vynh3UIgUQ4Wodq2ymr7k4M9Fh10tZOElWP+v58FVk9XLZzCxntQ2HogBxONFZuEExuEPKzSxeJ12zc4kBsnm/njRnGD70gZDo36L3lObSf3pLrOtyUxCmi4TYAtq4cZvq1LmKOY4a2cRMfePxpQ+T67LQPPjlpOna9+2R34EYOEP5tSi6MhGoOA==

Received: from DBAP193MB1132.EURP193.PROD.OUTLOOK.COM (2603:10a6:10:1c7::5) by

AS8P193MB2206.EURP193.PROD.OUTLOOK.COM (2603:10a6:20b:449::19) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.8511.19; Fri, 7 Mar 2025 15:41:19 +0000

Received: from DBAP193MB1132.EURP193.PROD.OUTLOOK.COM

([fe80::c00a:7967:aa6a:ea5b]) by DBAP193MB1132.EURP193.PROD.OUTLOOK.COM

([fe80::c00a:7967:aa6a:ea5b%6]) with mapi id 15.20.8511.020; Fri, 7 Mar 2025

15:41:19 +0000

From: Oliver Clintonn

To: "doctor@nk.ca"

Subject: Question about

https://www.nk.ca/~precision/One/firstwebsite/wp-content/plugins/types/embedded/toolset/toolset-common/visual-editor/res/js/codemirror/doc/realworld.html

Thread-Topic: Question about

https://www.nk.ca/~precision/One/firstwebsite/wp-content/plugins/types/embedded/toolset/toolset-common/visual-editor/res/js/codemirror/doc/realworld.html

Thread-Index: AQHbj3de3dM1mC1O0EeZkgrE5wXUfA==

Date: Fri, 7 Mar 2025 15:41:19 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: DBAP193MB1132:EE_|AS8P193MB2206:EE_

x-ms-office365-filtering-correlation-id: 0c655c22-427a-4e9d-7df5-08dd5d8e813b

x-microsoft-antispam:

BCL:0;ARA:14566002|9400799030|461199028|8060799006|19110799003|7042599007|38102599003|8062599003|15080799006|12050799009|3412199025|4302099013|440099028|10035399004|56899033|102099032|1602099012;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?d0AUxm5YEjPUsc5czxCrPExPnwSw6xON4fPajnkUhfU2xXAgFMowObmy?=

=?Windows-1252?Q?o5DJ6CDCWOp8hjSGGMPB31PMh9NEsr+YLkiJ5DNwGjyD9rWdPd0rbH4y?=

=?Windows-1252?Q?EA/cTYpBqkL39KRftdWYZDdfLyEsEg35e6Xf37u+qeYxsz0i1P+xPuS5?=

=?Windows-1252?Q?Gy7sTf90jXEpsBj4lbKNwt30D5fnZ3j6ZxikYvTmEigGxgQMNMrYHyh3?=

=?Windows-1252?Q?HQ7vljpplDFgrKJOloFt8+tDv0uIdCKbBFJqrt7ISFT5+7Z+ThEB7Xo5?=

=?Windows-1252?Q?wH8i7Plp5CsCmwRiRrfS7VRcOMTocjBlrPPO4ujMJt7t4fA+0WXmOJoY?=

=?Windows-1252?Q?lBNzfB9rXZ2TcyKTh1QcKr6BqO0i/D5fZz+NCCzXf+BSiN+pTR/W06Fd?=

=?Windows-1252?Q?5UgQFbsPANEkrMVGRIWJpm1aPMnRDROqh+tyBPdrQh1VQEO4uOYzUbFp?=

=?Windows-1252?Q?v4EiclBScPB2S5UL8HqVHNzb0l00NAZ/W347npzQkm4vmimzuCwjNM7g?=

=?Windows-1252?Q?JvsnJViI0xmva2FDxWTUrF5vOqBKoTUJIyZ+3DV/NSpJdmD4q9jxOGPq?=

=?Windows-1252?Q?rCaM4/QlYlm7TzgilAQApFIy/hdPs7f+jyUlcr3MUHPwAyvm6EPqmdPv?=

=?Windows-1252?Q?Hn7zY43pbfZ73QdFH2VHfzypn+EyIclYVk63GzpomPcfEcvOaIU1WyJj?=

=?Windows-1252?Q?MV/vZ+Dd41I8vOC4DVH8bD3UAVkKH1dT04liuam0R6xaWjy/ZCTXSeRR?=

=?Windows-1252?Q?cGJNR+Q0NCN7TAdHKAqjwnLRt+iZrZGpBJ8GM3dlicNrh6OIhB0uH/Wf?=

=?Windows-1252?Q?/yIrryGkfh0852NMDHLBthDBiu4ruqo99GMAAyLUVGljRI6c2ZRr1fO4?=

=?Windows-1252?Q?JVn1Yx+sIm2KcOt7SpnQRtFaeGl/UfGpcZVykfCkSgCbtyxIfjCc0pBg?=

=?Windows-1252?Q?jUQ2i+62EDrHsHZFMXjd4bdjgxQBA+SO+9QWXcZMfd8j2tMX/kDVtKN5?=

=?Windows-1252?Q?2SdtF0643X3mqG/ufsqLSXGPUjIX1OBE9ut5O9I17jSDGgHShLsPHcFK?=

=?Windows-1252?Q?uT8QZlk2AfVRD6jndw9MXTMhe0nYUTp5y7gYC3Oq1bTjCJuTmKHusTMp?=

=?Windows-1252?Q?p/cokNxA2utHh5zzO7spPTiCxyZlZYgATAmptnELF98l9nt+tXradavI?=

=?Windows-1252?Q?fX6LCJokbXZ6XUUKa41UN2LB1BBg8X3W3eFuuaTWopRWT8zlu509y3Bn?=

=?Windows-1252?Q?Gbu7RHyaCse6mwji5yW1v6iry2vzwBrmMK09qtysY3YFVgXli0lXqeA5?=

=?Windows-1252?Q?z4P7zYw4VkUlvD0cCKUZ9EGzB4qUFvq0vkIEAu5LloOVrR/Aj7wvUpKt?=

=?Windows-1252?Q?5cfd2Ql/0BoRCuJHus7adqedoR6heJqYIKY=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?YWYp4psVmLmIo7SAN3PUTS85ZT8YFBJpwMzZNOB+Mr2Yu2DLNUIvCnDy?=

=?Windows-1252?Q?qLr5F5nfy+KxkEPsY5SXMzt1Wi08BslfMlj/V2niypyXt+x7ZQZkRQ1Q?=

=?Windows-1252?Q?Oeyoh9MCqHr1aqSNM8KsXBDuNAtDSnamcNJKxRYPhY8+gH8GlPa/yseC?=

=?Windows-1252?Q?KpNCvCDqrdJRcyp6nNv2ynTiAGNSeUvmwrvNrelf5l5+IrOhc3Hpe9Py?=

=?Windows-1252?Q?m02mTTzuW0fNObPtaCXjLIzf+cQJFuln9q4pWSwXRdUjuTrK6lLCzH7X?=

=?Windows-1252?Q?OdALBkUoXxldSXvB9LtJqvvp1/xUvyQKwccWgwcrVerfiXIq5VhAoMU9?=

=?Windows-1252?Q?tnAQd/l66+dDhH6+OAysF4K9eLFVRMsQJnyq4QzsmMYrrQh+s/oNP0/g?=

=?Windows-1252?Q?njIyNJKtRbxbki5t1HNY6gtZSZmLJXnBpBl4UE5RX7erf/fW4e+X8kQz?=

=?Windows-1252?Q?EZAk5RfBh5q+00NtnhOCxT+AohnoAGP6ZOBfSk7Pvuq+FZQmsTeoaV32?=

=?Windows-1252?Q?jKE2wiJxRn1ryY5Dwx5EP/58uysBYpWB12qGDBevR08XbR9R1t2lr0WK?=

=?Windows-1252?Q?LHHNtNsIIkuI9vq7gQUcQwcRvQxtSLp5Fg+tiv/J4ZYuPt0rarVQVykR?=

=?Windows-1252?Q?b69swBfJogbnbxu+WTqlFv/jWfNkFO3iwMY6EH3Vl7dKvpnDJ/l7Tzdt?=

=?Windows-1252?Q?m1xVxD1kerLRV+CNckZnw2nZgSfH1q0y5NbCS/SmXvFhvOnaPJwMI/hs?=

=?Windows-1252?Q?pr4qXbBS5t5qClC8aNCONGvIFPQZEM4VLMGf1TbnpquHWkmLZN4LpzNq?=

=?Windows-1252?Q?K8gc4hZMHla0BlxwXe8kQcuM6WL3liRXqgywKaBfjXJaxE0USi/jrUTj?=

=?Windows-1252?Q?iGxYTcdWCmOhaJLVfvdV5rlOcoKG+n3skym/f7cfx4j2XK2aOajscnfD?=

=?Windows-1252?Q?JJIhMdPSRTnnZC5pQQIfaTGI4Z4n1pYyx445qo+KFHT80pnsYVnO7LbO?=

=?Windows-1252?Q?rTECv7vFJzZZWnQGcNen8BwLmqanqhFayC36ogGEDVWsBtQJxrwC2bZz?=

=?Windows-1252?Q?49DlIqIb5yB4ZA/tS0RIWW6laTMe7YY4JrWuGWIpBJ2jlI4qzEXdD7iX?=

=?Windows-1252?Q?DDILa+fJDCXVot+9zTomHDpDgqBqOIXfLZwrV6lJPSuU3bzcBXjYNsST?=

=?Windows-1252?Q?mcCUZ03W4mucOI5u4Kb6psw7nYhDyz5VZxrRkW7y66KyoZMGr7R32CeF?=

=?Windows-1252?Q?r+dVkRaAIH7rcUzE1FDC6Fnhy3Ei+STbAfWHatFVkiYdhZ5XvB4x6zRg?=

=?Windows-1252?Q?Clou4GeflofvlQzHeY5BI1sC0yU=3D?=

Content-Type: multipart/alternative;

boundary="_000_DBAP193MB1132F4B41A38BC538490FFF1C4D52DBAP193MB1132EURP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DBAP193MB1132.EURP193.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 0c655c22-427a-4e9d-7df5-08dd5d8e813b

X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Mar 2025 15:41:19.0783

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P193MB2206

X-Spam_score: 5.5

X-Spam_score_int: 55

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello I’m Olive and I run an advanced AI service called

ZeroGPT.com ZeroGPT.com is a plagiarism detection website designed to help

users identify and prevent instances of copied content. Utilizing advanced

algorithms and comprehensive databases, ZeroGPT.com scans text [...]



Content analysis details: (5.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[40.92.90.51 listed in will-spam-for-food.eu.org]

[40.92.90.51 listed in will-spam-for-food.eu.org]

[40.92.90.51 listed in will-spam-for-food.eu.org]

[40.92.90.51 listed in will-spam-for-food.eu.org]

[40.92.90.51 listed in will-spam-for-food.eu.org]

[40.92.90.51 listed in will-spam-for-food.eu.org]

[40.92.90.51 listed in will-spam-for-food.eu.org]

[40.92.90.51 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[40.92.90.51 listed in dnsbl.ahbl.org]

[40.92.90.51 listed in dnsbl.ahbl.org]

[40.92.90.51 listed in dnsbl.ahbl.org]

[40.92.90.51 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.90.51 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[clintonnoliver(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Question about

https://www.nk.ca/~precision/One/firstwebsite/wp-content/plugins/types/embedded/toolset/toolset-common/visual-editor/res/js/codemirror/doc/realworld.html



--_000_DBAP193MB1132F4B41A38BC538490FFF1C4D52DBAP193MB1132EURP_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hello





I=92m Olive and I run an advanced AI service called ZeroGPT.com





ZeroGPT.com is a plagiarism detection website designed to help users identi=

fy and prevent instances of copied content. Utilizing advanced algorithms a=

nd comprehensive databases, ZeroGPT.com scans text for similarities with ex=

isting online content, academic papers, and other sources. The platform is =

suitable for students, educators, writers, and professionals who need to en=

sure the originality of their work. It offers an intuitive interface, detai=

led reports, and multiple language support, making it a versatile tool for =

maintaining content integrity across various fields.





ZeroGPT is one of the most used and famous plagiarism checker tool.





I stumbled upon your website https://www.nk.ca/~precision/One/firstwebsite/=

wp-content/plugins/types/embedded/toolset/toolset-common/visual-editor/res/=

js/codemirror/doc/realworld.html , and I just have to say: WOW!





I had a quick proposal, I was wondering, would you be interested in featuri=

ng a link to my website https://www.zerogpt.com/plagiarism-checker in your =

piece?





I think it could be a great reference for your own article to provide your =

readers with more valuable information!





Either way, thanks for the shout out and keep up the great work!





Thanks,



Olive



ZeroGPT.com CEM



[https://www.semrush.com/link_building/tracksrv/?id=3D1c9e9be2-5357-4a06-98=

53-011bad6b02bb]



--_000_DBAP193MB1132F4B41A38BC538490FFF1C4D52DBAP193MB1132EURP_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">





Hello








I=92m Olive and I run an advanced AI service called ZeroGPT.com








ZeroGPT.com is a plagiarism detection website designed to help users ide=

ntify and prevent instances of copied content. Utilizing advanced algorithm=

s and comprehensive databases, ZeroGPT.com scans text for similarities with=

existing online content, academic

papers, and other sources. The platform is suitable for students, educator=

s, writers, and professionals who need to ensure the originality of their w=

ork. It offers an intuitive interface, detailed reports, and multiple langu=

age support, making it a versatile

tool for maintaining content integrity across various fields.








ZeroGPT is one of the most used and famous plagiarism checker tool.








I stumbled upon your website https://www.nk.ca/~precision/One/first=

website/wp-content/plugins/types/embedded/toolset/toolset-common/visual-edi=

tor/res/js/codemirror/doc/realworld.html , and I just have to say: WOW=

!








I had a quick proposal, I was wondering, would you be interested in feat=

uring a link to my website 
sm-checker">https://www.zerogpt.com/plagiarism-checker in your pie=

ce?








I think it could be a great reference for your own article to provide yo=

ur readers with more valuable information!








Either way, thanks for the shout out and keep up the great work!








Thanks,



Olive



ZeroGPT.com CEM




om/link_building/tracksrv/?id=3D1c9e9be2-5357-4a06-9853-011bad6b02bb">







--_000_DBAP193MB1132F4B41A38BC538490FFF1C4D52DBAP193MB1132EURP_--

Web/SEo/App spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 10:49:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqboN-00000000FRH-07m4

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 10:48:39 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 10:48:38 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-am0eur02olkn2084.outbound.protection.outlook.com ([40.92.49.84]:10273 helo=EUR02-AM0-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqZrb-00000000I2F-0Ss4

for support@nk.ca;

Fri, 07 Mar 2025 08:43:55 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=uUisfUeZvatP9cieNEXnFgaR9oeJHf+CH4I0DtnmpOfDFoHceapmH5aGwiL04gY4poBiuxLH6Lvsvp5szlcTiPW9HnFg36GxbXEHuAWWDA+JEbD8dEnMCR06KOT4lcRFnBmZ3i+muGOW8xN5Xz/tSeO1Emqe4SYqv5oLP+W0+ZQzIli+rhDuUOzkyUi9dVPbyzeWnOtx4ZImxyDnkbTpYQY/D5R7NHn9F908QdV2BRMqRLbH/uElaaNtzXRvWsJMdR7B6yMb+9GmtFxDbbk9LzdxpSyXB8/HSTQbG1q5XH8TwVW/i+DuQ1uE/EpgG1RukI2bdZnAS52xG9N0J7hbPw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=AJ5Ft+H/orYmTi23ArwyIi1Jl4ESrD9BYXL9JQZMTok=;

b=v4NmX//pCh8fx+Tw6X/TWBW3EsQo4auycU5NpoV8yIhbBP5VbzFxWp/WNTqCEqy5So3rBKbB/CtFavdgV0AH2VYYQw1jNoUBYiZ6vj/Qzt3Lu7JqIwAKOdYg8/gNxpwaw7SUBfwCa3nzHNjq1p+yH8NVoESZjXrGh9HcM7PCRUMNxgFAaSlercwpKg1O71n3fMvmvKOYJDJWGGd6dtoTbQy1X3eiuVc1PuQgiJpJT6sf5MFoPQ5VkrrAI+YWx0DptbtQmU8zqp1R/mAH58YS33eBi8YnKSUfT9t0Db14Cugzj3YnX7cODzVNocMszMjeWOo4v9ATzuXMAWGMm7gKoA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=AJ5Ft+H/orYmTi23ArwyIi1Jl4ESrD9BYXL9JQZMTok=;

b=W5zskgz23flyxiNJVVGqNwHNsuEl7muSsDcykw1Ma/vrWT4CBXrTnVGbDhWLxRY5VB4Ox3FgEJknzNmPw3TwooBcG0vBFlbE8O5YpEbVwYmxzgdCGJ0N8iW/J8lxnvD4Edla/aSBjAjdo7FWe5ows3yCD+hjtdTAWppWa+dwFP8KiPq6CA129trd1BPrqKOx60y/5fkqd2ANUXYSOh8S0F6uRxDf/CH6N/EfYrcxucKJvxtHopaQl/b6iWxg11xWPZtBTZYznAX4Z9nYn5N0EmYAMXmn68QMA0aIgxvnesa4M4Vc8g9rGV7hOtt4oInuxinAiHRl0IIm2mZmsNS3Mw==

Received: from DBAP193MB1132.EURP193.PROD.OUTLOOK.COM (2603:10a6:10:1c7::5) by

AS8P193MB2206.EURP193.PROD.OUTLOOK.COM (2603:10a6:20b:449::19) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.8511.19; Fri, 7 Mar 2025 15:41:15 +0000

Received: from DBAP193MB1132.EURP193.PROD.OUTLOOK.COM

([fe80::c00a:7967:aa6a:ea5b]) by DBAP193MB1132.EURP193.PROD.OUTLOOK.COM

([fe80::c00a:7967:aa6a:ea5b%6]) with mapi id 15.20.8511.020; Fri, 7 Mar 2025

15:41:15 +0000

From: Oliver Clintonn

To: "support@nk.ca"

Subject: Question about

https://www.nk.ca/~precision/One/firstwebsite/wp-content/plugins/types/embedded/toolset/toolset-common/visual-editor/res/js/codemirror/doc/realworld.html

Thread-Topic: Question about

https://www.nk.ca/~precision/One/firstwebsite/wp-content/plugins/types/embedded/toolset/toolset-common/visual-editor/res/js/codemirror/doc/realworld.html

Thread-Index: AQHbj3dc9H8M0be5JEaOdcbhVFlsmA==

Date: Fri, 7 Mar 2025 15:41:15 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: DBAP193MB1132:EE_|AS8P193MB2206:EE_

x-ms-office365-filtering-correlation-id: 6cfb67c0-90ab-4041-07a1-08dd5d8e7ee5

x-microsoft-antispam:

BCL:0;ARA:14566002|9400799030|461199028|8060799006|19110799003|7042599007|38102599003|8062599003|15080799006|12050799009|3412199025|4302099013|440099028|10035399004|56899033|102099032|1602099012;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?4LVw8CLr1I+hPmL9JVt8ALFTj3qy5carljdyLzrJIhYEY8HdLCpqecfX?=

=?Windows-1252?Q?xjsSronLT/82+g+9B5YgA9S+Plj6wXuC6NUTF0y+i1/V6VLHspvuEN2T?=

=?Windows-1252?Q?okIfUJpwTrCIYWkRM2Bw+cMYdIt8ryQZPNOoYTLyK0+H4eh2X/vy9v6J?=

=?Windows-1252?Q?NyBaOVJemrgSDVLJE6MditO+Rm4K7ksrc9gIF1xbdjeTJO+iU95f6J8g?=

=?Windows-1252?Q?n9rd/o4Y+oJ0/ZhB+E53SwMv6wlSLAB45X3N57ilroGPxdVd3GzanfDI?=

=?Windows-1252?Q?wfEOaQlXMm5RLP4MMhGhyz0bEm26KgWLIc5D5y3DbuyxQFVgtQp4HaAo?=

=?Windows-1252?Q?SVtpNNe888iK+QEN6yydh1NLxBPd9QFz8/A+xr5Z2pVk9m7EnfFyAnag?=

=?Windows-1252?Q?YWzTO3DwbF6uHNzCatNv1zcWzTjaieQ2pCZUoPtkqvzs30F2hqIA05lF?=

=?Windows-1252?Q?m6sM/W/CqbItS05YJ7vYDqrRr+77MFdGCNKYjtuSzO2SOU74mL7viFU0?=

=?Windows-1252?Q?c6IMYervm5zHX8FqUQViF04PMG3hw7M91U6Q33CXa/w/eaRk5GQSdohe?=

=?Windows-1252?Q?ZAe3qtLnOCHhOWsWPhE7kWRsuA/qWYSmugXUwJAMn9r5uL8rrBLb9bRy?=

=?Windows-1252?Q?WLI1vlyFb9fO9IoFunE5c+GLYRwBaavp+Zy7vUJh+32MFhsnj7UqlLiy?=

=?Windows-1252?Q?9GSjSyamoRPaYu9kZElybtTjmfeIUujhTVUf1QK/A7h7P093flV4EIzm?=

=?Windows-1252?Q?u73q88vjNXjnQByqcdGvsgxyO6nV0yiLvpuI8m8mV0SztSyrLRbfW4tC?=

=?Windows-1252?Q?6LxK6jsD7jtuJ1+DcF0/2rW/R0LzkAMY6jXAAt52rHYyaD0fVERRRnNy?=

=?Windows-1252?Q?yMY/4W8clhPSup1vSGXXpv9JahuAwtMiMK146N4oaCeukWxeoQ572m8p?=

=?Windows-1252?Q?4c2d+7cbexLKq6iVEi6/bdTBsIo8ZC/+QZKs8b71Rk+phe1ASPKPXN9U?=

=?Windows-1252?Q?5VNcVTa1KhkHumB7kKOV/xyWApURZXZNZwLykE1+bn5F8BrBbO4cdJF9?=

=?Windows-1252?Q?flzEHfWkzu//Jm2qLHbRdj9xudvkVZy1/SzB/cLhQzHnz10yA2lyv1Gx?=

=?Windows-1252?Q?umGFB7p7/5jUXTuxzBJtw/4OWSIEuwIm9rvhk91SU63zu+LOeAVA+Zj0?=

=?Windows-1252?Q?7fnWjKw3m0weUR6bylqGiskkoKjPm3L4DmwSa7ZeyggR5mYysxktcI/E?=

=?Windows-1252?Q?tGS2mayMp7lx/iwlfWXcatLYdBAmSN3o06a+uy7VMnzaUYybm2zJgDHm?=

=?Windows-1252?Q?shPbVcXKrhiME0sFZ4Z70FDCxqL+3UAvFuAK2DfMZlgWz0m7Sj6cmp0c?=

=?Windows-1252?Q?zabBKhBMoaPMPrzKUzqbYXtnKcrYOd9xYZw=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?IYdpJ1C4Gk68nty2pMpCxJL6u3yX74CixXznwbuqbXlUPqnywY3WW0V7?=

=?Windows-1252?Q?XGACVvFpJ47le19pe58I/l90ngMmW/zkn3SCEpky8PtDdDv0iVSM3Y2A?=

=?Windows-1252?Q?MhGr1hcnyghQfNGCLYejZvHr9QjnM7SInbbiXQ7fSZuNDs2LWaAqyeGJ?=

=?Windows-1252?Q?yfCD437iT55X3SMUsBx+ZRILdpq7CRSKvVMZQfuIiNgKzzKffXMcyH5W?=

=?Windows-1252?Q?0kq5b2FrmTPczq/iif3WXYU3SDGyEw4ULXlO7Sefq6TDM7aKqg37cOB8?=

=?Windows-1252?Q?+G/TigAo2tAE5fvNfYHUHrbNQiEbUBYC2qyIJsZxKwqHb8pJ1mOmgEsu?=

=?Windows-1252?Q?Q9voZ17NPl/FxItQgjQc8+lKnwEbE7UVnlctDaUF/mj4DTM4cVnHexGd?=

=?Windows-1252?Q?weub2gc3JAgm7cPshQhKOlim7AuzqYOvoLVc9DIHslyGO/HCC/hzl0wV?=

=?Windows-1252?Q?FF//8v38IP1kXz/GYqZPEwY+rVrvyul6fmTA2SGsJMobM45Yn/QJJMag?=

=?Windows-1252?Q?LwlY9ajRylZN/+gMH3CyS3jiYdOxGsSvz6ZDNLps1e047yexWqzS77mU?=

=?Windows-1252?Q?FwhwBKcVMkz48zu4fgnH3XhflQykQV+an5Qur8dK65E3aqn+aYUlHKkg?=

=?Windows-1252?Q?uGSdImJnnDBq9yuuxYX+6902fV0kn7SS7X8qHJC2/7FA7fQNdOaaEeAA?=

=?Windows-1252?Q?+9bnKOj+v/es9Mgkdk85wbsm6auxIHdMgkORkic+hlulXuJGkf9gCv1G?=

=?Windows-1252?Q?FdMBS84x5UnrPVtt4dnYPWNc0+aMojljOPjkda1KsWlO7/8oDxginV8L?=

=?Windows-1252?Q?1DlZ6MeGQcGrq728vIauVE/rLEuVQA67AAEC0RapUnao4QxvBGQS8NQP?=

=?Windows-1252?Q?Pf5/Yy7RiVpY4uA1HKtJ/237Ns4Tr1O7UwzH+GqhIgLT1ozGrlxqvYmH?=

=?Windows-1252?Q?9Ct4Urz/i82Ygz68jy6KFzBjgOLY4HXabrbrW6wOMMn3sSeN6Pu8872w?=

=?Windows-1252?Q?h5mDY3rzHoLeGfRkRWlu8ynA9zpXRondoW5Twf8gotxTY2+c9xBNmz0L?=

=?Windows-1252?Q?pTS1UbR9C8JX5bS46tO7Mv1Xn79dlDsNMpVaeWKs4MZbarsLRK/r1aoT?=

=?Windows-1252?Q?k+ER0rl5cx9fN2pwySwtOdcLw1u5h+tsiumNJyC/leILI5+Gjhec5Lqc?=

=?Windows-1252?Q?weZP4eCppRbbq0CjcSH5xtxu3nR2+0R+Obzgv19tX3fG7Ro813osK+Ob?=

=?Windows-1252?Q?HPy6422G1jttde3/D0B4nlbYcuPYSfM75nZeOWqabUK8jXbVoSgJOELq?=

=?Windows-1252?Q?ZMZeixrH1MR4KMSBRwrSo8C5hho=3D?=

Content-Type: multipart/alternative;

boundary="_000_DBAP193MB11323F36BBEE67D6ABD1781DC4D52DBAP193MB1132EURP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DBAP193MB1132.EURP193.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 6cfb67c0-90ab-4041-07a1-08dd5d8e7ee5

X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Mar 2025 15:41:15.1784

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P193MB2206

X-Spam_score: 5.5

X-Spam_score_int: 55

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello I’m Olive and I run an advanced AI service called

ZeroGPT.com ZeroGPT.com is a plagiarism detection website designed to help

users identify and prevent instances of copied content. Utilizing advanced

algorithms and comprehensive databases, ZeroGPT.com scans text [...]



Content analysis details: (5.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[40.92.49.84 listed in will-spam-for-food.eu.org]

[40.92.49.84 listed in will-spam-for-food.eu.org]

[40.92.49.84 listed in will-spam-for-food.eu.org]

[40.92.49.84 listed in will-spam-for-food.eu.org]

[40.92.49.84 listed in will-spam-for-food.eu.org]

[40.92.49.84 listed in will-spam-for-food.eu.org]

[40.92.49.84 listed in will-spam-for-food.eu.org]

[40.92.49.84 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[40.92.49.84 listed in dnsbl.ahbl.org]

[40.92.49.84 listed in dnsbl.ahbl.org]

[40.92.49.84 listed in dnsbl.ahbl.org]

[40.92.49.84 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.49.84 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[clintonnoliver(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Question about

https://www.nk.ca/~precision/One/firstwebsite/wp-content/plugins/types/embedded/toolset/toolset-common/visual-editor/res/js/codemirror/doc/realworld.html



--_000_DBAP193MB11323F36BBEE67D6ABD1781DC4D52DBAP193MB1132EURP_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hello





I=92m Olive and I run an advanced AI service called ZeroGPT.com





ZeroGPT.com is a plagiarism detection website designed to help users identi=

fy and prevent instances of copied content. Utilizing advanced algorithms a=

nd comprehensive databases, ZeroGPT.com scans text for similarities with ex=

isting online content, academic papers, and other sources. The platform is =

suitable for students, educators, writers, and professionals who need to en=

sure the originality of their work. It offers an intuitive interface, detai=

led reports, and multiple language support, making it a versatile tool for =

maintaining content integrity across various fields.





ZeroGPT is one of the most used and famous plagiarism checker tool.





I stumbled upon your website https://www.nk.ca/~precision/One/firstwebsite/=

wp-content/plugins/types/embedded/toolset/toolset-common/visual-editor/res/=

js/codemirror/doc/realworld.html , and I just have to say: WOW!





I had a quick proposal, I was wondering, would you be interested in featuri=

ng a link to my website https://www.zerogpt.com/plagiarism-checker in your =

piece?





I think it could be a great reference for your own article to provide your =

readers with more valuable information!





Either way, thanks for the shout out and keep up the great work!





Thanks,



Olive



ZeroGPT.com CEM



[https://www.semrush.com/link_building/tracksrv/?id=3D9c1d939c-8d60-432c-b2=

e3-9b3e246146da]



--_000_DBAP193MB11323F36BBEE67D6ABD1781DC4D52DBAP193MB1132EURP_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">





Hello








I=92m Olive and I run an advanced AI service called ZeroGPT.com








ZeroGPT.com is a plagiarism detection website designed to help users ide=

ntify and prevent instances of copied content. Utilizing advanced algorithm=

s and comprehensive databases, ZeroGPT.com scans text for similarities with=

existing online content, academic

papers, and other sources. The platform is suitable for students, educator=

s, writers, and professionals who need to ensure the originality of their w=

ork. It offers an intuitive interface, detailed reports, and multiple langu=

age support, making it a versatile

tool for maintaining content integrity across various fields.








ZeroGPT is one of the most used and famous plagiarism checker tool.








I stumbled upon your website https://www.nk.ca/~precision/One/first=

website/wp-content/plugins/types/embedded/toolset/toolset-common/visual-edi=

tor/res/js/codemirror/doc/realworld.html , and I just have to say: WOW=

!








I had a quick proposal, I was wondering, would you be interested in feat=

uring a link to my website 
sm-checker">https://www.zerogpt.com/plagiarism-checker in your pie=

ce?








I think it could be a great reference for your own article to provide yo=

ur readers with more valuable information!








Either way, thanks for the shout out and keep up the great work!








Thanks,



Olive



ZeroGPT.com CEM




om/link_building/tracksrv/?id=3D9c1d939c-8d60-432c-b2e3-9b3e246146da">







--_000_DBAP193MB11323F36BBEE67D6ABD1781DC4D52DBAP193MB1132EURP_--

Web/SEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 10:49:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqboH-00000000FQj-1pmN

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 10:48:33 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 10:48:33 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-am0eur02olkn2058.outbound.protection.outlook.com ([40.92.49.58]:37793 helo=EUR02-AM0-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqZr4-00000000I08-35YS

for sales@nk.ca;

Fri, 07 Mar 2025 08:43:23 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=hXarRzi06vPyK/OPdzDK/2u219caDqIbiPCU+it4xIU+R1tUPalE0yGzKizBQFS1/SWIglBfr0zUcBPhs7dzaHqWob606/ix96Kg+IQozS5ZG+nrFiPzLLgFctdiGZW+F7/gPp3lOlQsJJi5YQU0oOJkfX7XLKZmkXbcq2+Y6YID88puRvCgxV+2n0nVG1ObNGpfB9vnE+ssvBtxCxcDm/+YMt6UHBlUBBcUSQcQ0JUNFMJ6kv4JxlnM99p4ZlHyc4F8k1d1ociP0YtbrnU1+0rcooMrkz6Z/14T5MfI4jH2eKtYXidOaq8oLR7280ZAU8LOychI0FUm30D/F9qc7g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=rvkdAs1qqpKPnbZ4qarb3bm7KFtZsa1nyOtLGQu1O6w=;

b=Mms9LH8vgmpYq+Ak4Lokw55NOHzgaJBnmg6/vqqj1+pmT9x+giPw8NnRKErVQ9H7JdhDfloueTGcKR7C/I1WXbvjsYGp6AdPySuQitrn8kSw1p1KBp4AKMWN/to4SuZ5JL3+DmB79Z4swY2i7jcgKPrXf92ZlIyA1B4qKKzSeEYnGkBgLM8njND8bKzDSYjn+y4R8N/npVRx+unr9MM/yMf5iyf8hhtCyoO9KC/ewLV/+Ke8bU5MBE5Fg0Y13mh34aLD839e6owu9jLHbDb/1MRsYNkH2oT7BchXI8zGWfn+T/+/caVYg6FVHwRkIlcOWqX1ks4m88ag2fmOspcbrw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=rvkdAs1qqpKPnbZ4qarb3bm7KFtZsa1nyOtLGQu1O6w=;

b=k+VSRkk+jr+TdO4iNSTmWpNJP09F5+ZvZPgI7pfo9emCHBOBgY9rABq9cZ+auF4iNtNKbG6a5s0iPy3Y4W/y1ymGOnZzovmZNQpWuZJGHrknlq30ie/v8V9FNHg5oNbQgpFlDEaS/CNkO/1mHMie0deUjS/BxYLhj6WXPGQNNpfffkxGv5HotPwSAhRtbRvUtjOExumB3p9N4BSDF6sJXRCmTWg5yVTRLQ43CwIVmD9oIi00yfr3Y16VegR3p3+3BCm04kIL4tgwGPaDHTVBbWJFuyFrflAzBM7oWY/RpLFGiDE7MtF4fAH3iMouGm0EIYOsyfKsHheLYeSv3/yLrg==

Received: from DBAP193MB1132.EURP193.PROD.OUTLOOK.COM (2603:10a6:10:1c7::5) by

AS8P193MB2206.EURP193.PROD.OUTLOOK.COM (2603:10a6:20b:449::19) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.8511.19; Fri, 7 Mar 2025 15:41:14 +0000

Received: from DBAP193MB1132.EURP193.PROD.OUTLOOK.COM

([fe80::c00a:7967:aa6a:ea5b]) by DBAP193MB1132.EURP193.PROD.OUTLOOK.COM

([fe80::c00a:7967:aa6a:ea5b%6]) with mapi id 15.20.8511.020; Fri, 7 Mar 2025

15:41:13 +0000

From: Oliver Clintonn

To: "sales@nk.ca"

Subject: Question about

https://www.nk.ca/~precision/One/firstwebsite/wp-content/plugins/types/embedded/toolset/toolset-common/visual-editor/res/js/codemirror/doc/realworld.html

Thread-Topic: Question about

https://www.nk.ca/~precision/One/firstwebsite/wp-content/plugins/types/embedded/toolset/toolset-common/visual-editor/res/js/codemirror/doc/realworld.html

Thread-Index: AQHbj3dbPvOWrHRVVU6h7wlPvw5IjQ==

Date: Fri, 7 Mar 2025 15:41:13 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: DBAP193MB1132:EE_|AS8P193MB2206:EE_

x-ms-office365-filtering-correlation-id: 16d493bf-22ca-44ce-44bd-08dd5d8e7e26

x-microsoft-antispam:

BCL:0;ARA:14566002|9400799030|461199028|8060799006|19110799003|7042599007|38102599003|8062599003|15080799006|12050799009|3412199025|4302099013|440099028|10035399004|56899033|102099032|1602099012;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?ZRK3zNqSvGrI9H7A2SM/oiv/Itw5rhogp3Er5zDHIqzdkf/Z9AuNf+rF?=

=?Windows-1252?Q?R8yxwA5BuRtBlvgel4Nl4xVVRBPODy0XzlUoKk1tpsLdbJvuMVvblZpC?=

=?Windows-1252?Q?APh0/03HplYevQfO9LAcRsEN2f8VU+QIkLUHYBllp4np+bUgwGItYFo3?=

=?Windows-1252?Q?efV3smvuAMCCzU5ttF43J1so4dxNeHrjGxkOVdrZ8aA6psDn+3vy4YLa?=

=?Windows-1252?Q?M1CqUvqBp2M/sRE3VYStUog65a5lUsNUCK8mol315QAednD7LVl+TM4b?=

=?Windows-1252?Q?k4bc5pZalU0EZCd/bdQrdsd5EFgCYCQ8CvY9iErQv37HK9l44qW/Qrco?=

=?Windows-1252?Q?SMnmUyRXza3+m0Lvw+BbWgx+XucqpxquvwES6Gxa7cOx30qk/FBjcAIO?=

=?Windows-1252?Q?gFRKsiEnPX9M9INKpUH21xyy0B8UZ/lCEeIFku5cw3eBIvkKcJVl+xHZ?=

=?Windows-1252?Q?057xfj02lJM47WVSynFE2H21FnKDEkkMLF+NYOj/A937af30t6eO8iSK?=

=?Windows-1252?Q?4nTwm6ls0Y+LauBft0HJ6vO0NMfBMdqOGli+OqBZfErcCRy+fA6fF6gN?=

=?Windows-1252?Q?BFtci9+7GLS9/aAyiiiz1Yb4qfH8+jSKITljnPVWAx1ojM40zRz34/BB?=

=?Windows-1252?Q?8hhVaMmi0hSY3Nz/G2lHWDDxpASkurTbiHbcKN6ytTWjGUJ32eePGWSZ?=

=?Windows-1252?Q?AKW1oKQC1UdnHtI74PZ1QGVpD+GpvMi5DSo4pBPKNOlAOWRdb/XfOck5?=

=?Windows-1252?Q?c3Tdpt94Vdc5s7B8fMTmo/ycB0xlc8mprKX7W3Y0bpcDJfvwPPjMDiJt?=

=?Windows-1252?Q?PuHKguiH6rGGWBMoNNPT+AlejisegOrwORzCP5to8l5rQdEcWlwMc58e?=

=?Windows-1252?Q?492Gwr0K01hUJ70uU1xvclkwNv1re8xpQL2P3r02wmZQFQOmKugExkcy?=

=?Windows-1252?Q?FyffYRYq6OeX8tgeBYmUS5WgyrV2rojpxXHJ5YgkSnFQ3atQw8XpASjI?=

=?Windows-1252?Q?JrddfTUFOLHwWbdCREran1L5/XgMKC9cPxjsvi/HkTY2r5BhNdg+pzTT?=

=?Windows-1252?Q?ybxTsHqIoSq1VDqpy9zUiE+dBPLjOHmrEI7QDQDsvaR8HEPlahrhcQSJ?=

=?Windows-1252?Q?hcN4w50S51pDlQY+wTbB6LiUTQ4OBE23s1XtV6mCDm1X2lSkQc5XjvM/?=

=?Windows-1252?Q?PVWx/A++KvwagDTG/Mn/rfItHD2NOZYwBT3uFKq7FjXqMfOLozK3ZDqJ?=

=?Windows-1252?Q?HHoS3BZaXfY7plqX+QVx7Uo9w0Bdjh+2miIcDtPiIQLBe/+JO3NSm9xi?=

=?Windows-1252?Q?tNNea6gkcolwReTkYhr5JiDtkgn/jiYIrdy8FpI/wYcgiJ+eeCBKEBgR?=

=?Windows-1252?Q?nIab1scIlqyZqvCh9/h8xnQB/nHKP8lTBvk=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?s6eZJhGTc5N2dLj/uaJiGkxLuCN+Ju21YHMacWYsnCv7V0SNeqaERW6t?=

=?Windows-1252?Q?tDWgFN/zi5Eh7WQGlM03ToBQg9Rg4eJm8hlr6k8J5XSQSGwvUUXpiY/e?=

=?Windows-1252?Q?mibuckPMuQQXTBV723cpW6rfs2c7PqDiddogEYYF0PLoeYs9aqHn82tl?=

=?Windows-1252?Q?T0Bw80Hb6aMRtD9b/wJnigWOm5JxoyWihtlHMUOCTw2tBIODnCxmJizO?=

=?Windows-1252?Q?hle8u82pfMoUAL5bgECKH40lMhy3MbdfXgLZx81eAHQp/GbKVIU2d3YO?=

=?Windows-1252?Q?zks6kbWgyT1mh8sTXaf5mcui6PSfDU4q9XgO7l1hWVlxIz53JfDrMUwT?=

=?Windows-1252?Q?r+aJKfryhE4BQrOcMJ8b6Nd0XaOEGwALRclxGzF84yaweyWGQAKeRcBD?=

=?Windows-1252?Q?Vs0X//ajMB+amlKgFk+2+2Q+T4zrn2ZAC0nm5q/gl7TablDbUI45N+5V?=

=?Windows-1252?Q?548/8GzfOkl2gzhpnGO1cWpkQ9CKO8wvirLB+PPDR5/Jbgkb5xPMBeXh?=

=?Windows-1252?Q?eU52PkRyQzYwDvkDGw/BwNj7JWL5MpdNvGj8WMif6NLFjsY3cPSGxZKy?=

=?Windows-1252?Q?+RJnQiX29KbTyvHt3ybDgAZ9fV/Z8/vhDLCdkbFqlfox5Y00V27bc3AL?=

=?Windows-1252?Q?mavsLMeJ6hAg1oDveKaIhs9nrH9SBplGgTG4kW1mKJpcLjyYOFD0zwLw?=

=?Windows-1252?Q?FSfKSarmBzX30mhmb4TTY/iSorM3VB0qIMsC2Peys5w15JiqFy9bA0jg?=

=?Windows-1252?Q?oxv/4wnmZKxQoJNtHx1RmOLzZVxegpmNzesoXPQ/NF68INQw3QTSMZEc?=

=?Windows-1252?Q?dkPGCU2yLeyEDUVN7/x6KiR6PPEeYLV6EmjOtuJe62+dj72cr1kxPXzA?=

=?Windows-1252?Q?SLO/QJ8TxgQcK+/DgOGi4hnC4894oywf9eIEYnS9IVTQbKkJcHfwhpT8?=

=?Windows-1252?Q?W8Wg8LGmEzUn4sQQgZwQvhroyWkv5L6SXD5/ZA4P+8RXCvf3lEHK8SWm?=

=?Windows-1252?Q?BvYQtp018N7Q1WCSVpOYfTPIQHPwsj6LHWFzjoY4Nq4cOREiASBlRkwh?=

=?Windows-1252?Q?/869cdSscwRH+rjGC5V4preKDa1rh2TGe2LiAeNphc+7UICzvoRDk8Hg?=

=?Windows-1252?Q?KGFNRVRYeJ4exH+sxDHRHNy1h+BYkDOSRlD6vWZWLMHkYPM6DPe5PTER?=

=?Windows-1252?Q?mu/1kIMW5gPMc/nysvApb2tU6G/S4aBF7fmYjB5aCEBWyolvuGUlx+fF?=

=?Windows-1252?Q?IY1LOQFoCExIeqUWij8VAAwVBl5X7YyvhWiO5hPfmcOPb1qW3z+pGAfK?=

=?Windows-1252?Q?1RAiZP6ig92lsUyQg5QpG+kxVpU=3D?=

Content-Type: multipart/alternative;

boundary="_000_DBAP193MB11323AEC8023F185CFA9819AC4D52DBAP193MB1132EURP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DBAP193MB1132.EURP193.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 16d493bf-22ca-44ce-44bd-08dd5d8e7e26

X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Mar 2025 15:41:13.9269

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P193MB2206

X-Spam_score: 5.6

X-Spam_score_int: 56

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello I’m Olive and I run an advanced AI service called

ZeroGPT.com ZeroGPT.com is a plagiarism detection website designed to help

users identify and prevent instances of copied content. Utilizing advanced

algorithms and comprehensive databases, ZeroGPT.com scans text [...]



Content analysis details: (5.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[40.92.49.58 listed in will-spam-for-food.eu.org]

[40.92.49.58 listed in will-spam-for-food.eu.org]

[40.92.49.58 listed in will-spam-for-food.eu.org]

[40.92.49.58 listed in will-spam-for-food.eu.org]

[40.92.49.58 listed in will-spam-for-food.eu.org]

[40.92.49.58 listed in will-spam-for-food.eu.org]

[40.92.49.58 listed in will-spam-for-food.eu.org]

[40.92.49.58 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.92.49.58 listed in dnsbl.ahbl.org]

[40.92.49.58 listed in dnsbl.ahbl.org]

[40.92.49.58 listed in dnsbl.ahbl.org]

[40.92.49.58 listed in dnsbl.ahbl.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:1c7:0:0:0:5 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.92.49.58 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.92.49.58 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.92.49.58 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.92.49.58 listed in dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.49.58 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[clintonnoliver(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.1 TW_CB BODY: Odd Letter Triples with CB

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Question about

https://www.nk.ca/~precision/One/firstwebsite/wp-content/plugins/types/embedded/toolset/toolset-common/visual-editor/res/js/codemirror/doc/realworld.html



--_000_DBAP193MB11323AEC8023F185CFA9819AC4D52DBAP193MB1132EURP_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hello





I=92m Olive and I run an advanced AI service called ZeroGPT.com





ZeroGPT.com is a plagiarism detection website designed to help users identi=

fy and prevent instances of copied content. Utilizing advanced algorithms a=

nd comprehensive databases, ZeroGPT.com scans text for similarities with ex=

isting online content, academic papers, and other sources. The platform is =

suitable for students, educators, writers, and professionals who need to en=

sure the originality of their work. It offers an intuitive interface, detai=

led reports, and multiple language support, making it a versatile tool for =

maintaining content integrity across various fields.





ZeroGPT is one of the most used and famous plagiarism checker tool.





I stumbled upon your website https://www.nk.ca/~precision/One/firstwebsite/=

wp-content/plugins/types/embedded/toolset/toolset-common/visual-editor/res/=

js/codemirror/doc/realworld.html , and I just have to say: WOW!





I had a quick proposal, I was wondering, would you be interested in featuri=

ng a link to my website https://www.zerogpt.com/plagiarism-checker in your =

piece?





I think it could be a great reference for your own article to provide your =

readers with more valuable information!





Either way, thanks for the shout out and keep up the great work!





Thanks,



Olive



ZeroGPT.com CEM



[https://www.semrush.com/link_building/tracksrv/?id=3Dc52e8df4-cbb2-4dce-ac=

f9-f17b33545f2e]



--_000_DBAP193MB11323AEC8023F185CFA9819AC4D52DBAP193MB1132EURP_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">





Hello








I=92m Olive and I run an advanced AI service called ZeroGPT.com








ZeroGPT.com is a plagiarism detection website designed to help users ide=

ntify and prevent instances of copied content. Utilizing advanced algorithm=

s and comprehensive databases, ZeroGPT.com scans text for similarities with=

existing online content, academic

papers, and other sources. The platform is suitable for students, educator=

s, writers, and professionals who need to ensure the originality of their w=

ork. It offers an intuitive interface, detailed reports, and multiple langu=

age support, making it a versatile

tool for maintaining content integrity across various fields.








ZeroGPT is one of the most used and famous plagiarism checker tool.








I stumbled upon your website https://www.nk.ca/~precision/One/first=

website/wp-content/plugins/types/embedded/toolset/toolset-common/visual-edi=

tor/res/js/codemirror/doc/realworld.html , and I just have to say: WOW=

!








I had a quick proposal, I was wondering, would you be interested in feat=

uring a link to my website 
sm-checker">https://www.zerogpt.com/plagiarism-checker in your pie=

ce?








I think it could be a great reference for your own article to provide yo=

ur readers with more valuable information!








Either way, thanks for the shout out and keep up the great work!








Thanks,



Olive



ZeroGPT.com CEM




om/link_building/tracksrv/?id=3Dc52e8df4-cbb2-4dce-acf9-f17b33545f2e">







--_000_DBAP193MB11323AEC8023F185CFA9819AC4D52DBAP193MB1132EURP_--

Web/SEo/App spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 08:16:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqZQN-000000006ea-1zhf

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 08:15:43 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 08:15:43 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f67.google.com ([209.85.161.67]:43150)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqYhq-000000002Xu-2J7y

for sales@nk.ca;

Fri, 07 Mar 2025 07:29:47 -0700

Received: by mail-oo1-f67.google.com with SMTP id 006d021491bc7-60018359e1aso1695818eaf.0

for ; Fri, 07 Mar 2025 06:27:47 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=smartstreamingott-com.20230601.gappssmtp.com; s=20230601; t=1741357660; x=1741962460; darn=nk.ca;

h=to:subject:message-id:date:from:sender:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=Uzj0pyGxBjwSKJlAWfoIVNiM8hB2EBh2K1/wtMp6/1o=;

b=Yaq4A5OzzBphWQqzCAa5TL7SJEfNpH5qzJDbksON/gg3ifVk4VF776tPhQNt6fI4E4

xQtS8MOmQ2qCIsTRL39+om+/99Hn8no8mT9OCigg5JmhwYw8Q5S7k3drjIJuo1qRk5r4

VpQPdVmVxSOnkSPB8yZTcdAZZsmXatfGpTRWFgNZ8UBkG3+olwOzKEHkSPvaKhIQ3AlI

w0hv6/umn3oxuiOSKALRc9RWnTDmMp6YdiwII2MAcjyyudt3evO1Kbg9xhCHeoMBy2lv

tZnjjCld2RbBdTM4oWY9T/UrIfd/CtwAS5CiieazOJTxWseYyAav9PWzpj524kFQkqzM

vTgA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1741357660; x=1741962460;

h=to:subject:message-id:date:from:sender:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Uzj0pyGxBjwSKJlAWfoIVNiM8hB2EBh2K1/wtMp6/1o=;

b=GJnv0xqdHgRmwwPIHcRNYIcNQvEHUsP7GTR/HQOzbBan5q//AYc5aO7c5ntoqzYaza

GyM+6Du3SgXpgxcwQqWrZSm6CXpmtBp4pFgtdbtpMVyttIY2KypFtkilhwSYIU522dAn

HvyheASPEbCjZ/yyigbRru76MwHJbdYldxx8QWVGIjQWxfgCvlur3HRtogQIluN99RRo

6eSEZi3V35BIY2Y4++KloglmEZAd3J5XU9R6bTdIFNZ2hY4De+ZdOUDbOe+KkNuTEPx4

KKvWyMNA5LfKxrTGXW178MRVW4CI2C2vv7mYu2g/DczkQWIBJZ1taHGMXWLRuFpwundJ

hkGg==

X-Gm-Message-State: AOJu0Yzna2obWJo05Zu5Q7zD1W6RQdyORVI2aFmSFJZIYLuFEO3S6G6V

PhmHMN5PgY+bt3vfMTsdMwjUdQLRBGgjm+XQiSQ15Bac2RwIVvouoUD3to+hMykEzbPL/auFd4A

NnCZIFJuGz+ZjdJI/5jRkqbvV7hhbWT8HYUmSfk6+ge2cBGOmA5k=

X-Gm-Gg: ASbGnctLUNOXyOkfDvV5Z22zFUn7aKMromxBXIPDa4Zn6t2WdEQ8Oq5punWb2aRMwVs

+X1Gpa1JczF0lArVJQDWeTrR3LkKll3+LqtxBVn1SXSwyLFxqmRFY2Tydv+POxDn0Cmqwh/7C1Q

q13DJMK+8Z+OU/N3Rk5MYV48fSqBs7omQXhqEhFPwXfCz3sFmNXM1XUaDY

X-Google-Smtp-Source: AGHT+IHcREi5l9ndRSBZWr+2BqjkvPZ3VnuJEKSDho36Fymj5owIYp8+rY0jJZPVxtLtFOc0SbusrqO61v5McVctH7A=

X-Received: by 2002:a05:6808:1b0f:b0:3f4:1875:e651 with SMTP id

5614622812f47-3f68c85bb0cmr4349885b6e.6.1741357660262; Fri, 07 Mar 2025

06:27:40 -0800 (PST)

Received: from 52669349336 named unknown by gmailapi.google.com with HTTPREST;

Fri, 7 Mar 2025 09:27:39 -0500

Received: from 52669349336 named unknown by gmailapi.google.com with HTTPREST;

Fri, 7 Mar 2025 09:27:37 -0500

MIME-Version: 1.0

Sender: "Matt Brady,"

From: "Matt Brady,"

Date: Fri, 7 Mar 2025 09:27:39 -0500

X-Google-Sender-Auth: 44ut3_QYpby6BD5eOctK_yuliL0

X-Gm-Features: AQ5f1Jp3Ed5bZSEeuAt6humz_NMV-Cmg7GJlvwpNGeaJN-E2CJFyGXZQ8PiZJnc

Message-ID:

Subject: nk.ca : Can i send a Proposal..

To: Sales

Content-Type: multipart/alternative; boundary="000000000000c46b82062fc16c77"

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi *nk.ca
[...]



Content analysis details: (8.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.67 listed in will-spam-for-food.eu.org]

[209.85.161.67 listed in will-spam-for-food.eu.org]

[209.85.161.67 listed in will-spam-for-food.eu.org]

[209.85.161.67 listed in will-spam-for-food.eu.org]

[209.85.161.67 listed in will-spam-for-food.eu.org]

[209.85.161.67 listed in will-spam-for-food.eu.org]

[209.85.161.67 listed in will-spam-for-food.eu.org]

[209.85.161.67 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.67 listed in dnsbl.ahbl.org]

[209.85.161.67 listed in dnsbl.ahbl.org]

[209.85.161.67 listed in dnsbl.ahbl.org]

[209.85.161.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.67 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.67 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.67 listed in wl.mailspike.net]

0.3 LONGWORD BODY: Uses overlong words

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} nk.ca : Can i send a Proposal..



--000000000000c46b82062fc16c77

Content-Type: text/plain; charset="UTF-8"



Hi nk.ca



Owner,



Hope you are doing well.



I am reaching out to you to ask whether you would be interested in

collaborating on an outreach digital marketing strategy about the

website nk.ca

,

We

guarantee you on a strategy that will work 100% in organic growth of the

website.



Would you be interested to receive a detailed proposal? I can provide the

deliverable for you to review.



I am waiting for your reply.



Regards,



Matt Brady,



Business Development Manager



-------------------------------------------------------------



*Note:*-If you want to receive a detailed plan of action, please feel

free to reply. *Yes*, we will get back to you with details..



If you will be interested my senior will connect you through email or by

call as per your comfortable time.



Note: If you are not interested, please



reply here to remove





[image: beacon]



--000000000000c46b82062fc16c77

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




ight:16.8667px;font-size:11pt;font-family:Calibri,sans-serif">
"EN-US" style=3D"font-size:13.5pt;font-family:Arial,sans-serif;color:black"=

>Hi=C2=A0
ly:Arial,sans-serif">
pspot.com/2_t62OxAE5Gmx4nUCzFkLpAXutKnw9fzew2q7ry825-NmLgFxlQGml68T5Q8M-0NT=

XgPZa3JIX3JOCdziWYyIH6nAsE5MZSRK4AWTpgt4f8sgw0dJsXR_Otkte-wxMtPzyEdujsDytUS=

tBaZD23BR2t8wScXeelaP4XxmNrPKt7d3" rel=3D"nofollow">nk.ca=


;color:black">=C2=A0Owner,
ily:Arial,sans-serif">


0cm 8pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-seri=

f">
rif">Hope you are doing well.
ly:Arial,sans-serif">


0cm 8pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif=

">
if">I am reaching out to you to ask whether you would be interested in coll=

aborating on an outreach digital marketing strategy about the website=C2=A0=


CM1oSJ-HOF1Lq1XeO6b1VD5ktVwXgeu6_oPJuLgFxlQFfXMdOdzAxaoG5Vo_SXPA00-SmUwgRgU=

EcX0JyeYFjYowr-pCuFppx72Vvh9syTlRTAfqnY9GWI9c1e7ZZa7Gnd_tqWp4PAxLgcCTw5vMdB=

lozgCpn0BiEcwgH" rel=3D"nofollow">nk.ca,=C2=A0We guarantee you on a=

strategy that will work 100% in organic growth of the website.
lang=3D"EN-US" style=3D"font-family:Arial,sans-serif">


=3D"MsoNormal" style=3D"margin:0cm 0cm 8pt;line-height:16.8667px;font-size:=

11pt;font-family:Calibri,sans-serif">
size:13.5pt;font-family:Arial,sans-serif;background-color:rgb(0,255,0)">Wou=

ld you be=C2=A0interested=C2=A0to receive
yle=3D"font-size:13.5pt;font-family:Arial,sans-serif">
ound-color:rgb(0,255,0)">=C2=A0a detailed proposal?=C2=A0I can provi=

de the deliverable for you to review.
ont-family:Arial,sans-serif">


gin:0cm 0cm 8pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,sa=

ns-serif">
sans-serif">=C2=A0I am waiting for your reply.
N-US" style=3D"font-family:Arial,sans-serif">


al" style=3D"margin:0cm 0cm 8pt;line-height:16.8667px;font-size:11pt;font-f=

amily:Calibri,sans-serif">
nt-family:Arial,sans-serif">Regards,
nt-family:Arial,sans-serif">


in:0cm 0cm 8pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,san=

s-serif">
l,sans-serif;color:rgb(31,31,31)">Matt Brady,
" style=3D"font-family:Arial,sans-serif">


style=3D"margin:0cm 0cm 8pt;line-height:16.8667px;font-size:11pt;font-famil=

y:Calibri,sans-serif">
t-family:Arial,sans-serif;color:black">Business Development Manager=C2=A0
span>
>


px;font-size:11pt;font-family:Calibri,sans-serif">
e=3D"font-size:13.5pt;font-family:Arial,sans-serif;color:black">-----------=

--------------------------------------------------
S" style=3D"font-family:Arial,sans-serif">


style=3D"margin:0cm 0cm 8pt;line-height:16.8667px;font-size:11pt;font-fami=

ly:Calibri,sans-serif">
nt-family:Arial,sans-serif">Note:
ont-size:13.5pt;font-family:Arial,sans-serif">-If you want to receive a=C2=

=A0detailed plan of action,=

=C2=A0please feel free to reply.=C2=A0=

Yes,=C2=A0we will get b=

ack to you with details..
rial,sans-serif">


8pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif">
pan lang=3D"EN-US" style=3D"font-size:13.5pt;font-family:Arial,sans-serif">=

If you will be interested my senior will connect you through email or by ca=

ll as per your comfortable time.
amily:Arial,sans-serif">


nt-family:"Times New Roman",serif">
font-size:13.5pt;font-family:Arial,sans-serif">Note: If you are not interes=

ted, please
f">


New Roman",serif">
-family:Arial,sans-serif">reply here to remove


mal" style=3D"margin:0cm 0cm 10pt;line-height:12.65pt;background-image:init=

ial;background-position:initial;background-size:initial;background-repeat:i=

nitial;background-origin:initial;background-clip:initial;font-size:11pt;fon=

t-family:Calibri,sans-serif">
ont-family:Verdana,sans-serif">=C2=A0




mXDohle_OTgCjyG0J5450kclFRPh_Yh_Q9cLgFxlQFa9DyZiE-NDGPlDAtt-h889NObWZ7QFXMj=

ELPM95clJL2e6I6LBns4u5LiM7hvZn5GXBw1-Y5a1RefYio5bsON753UkuhkXiOFlEMUAt_lqWm=

0OTTu" width=3D"1" height=3D"1" alt=3D"beacon" style=3D"display:none; displ=

ay:none!important;">



--000000000000c46b82062fc16c77--

nk.ca credential phising from hostzealot.com

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 08:16:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqZQF-000000006dg-2Z8i

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 08:15:35 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 08:15:35 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [79.141.162.46] (port=53936 helo=mail0.henutepsa.ooguy.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqYbo-0000000021d-0kqI

for root@nk.ca;

Fri, 07 Mar 2025 07:23:32 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=henutepsa.ooguy.com;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:

Content-Transfer-Encoding; i=info@henutepsa.ooguy.com;

bh=ALvw0ueLTWOKJ3b7uypWUm2Hx7RdkOkXQy1C/zJ4OWs=;

b=GNfhrKwmEeovDwl5KDVkTN5XeiW6ACwndJYF6P0GPvFYCCehAgPCURgaP1yo43Vy7jGhNC8LtAtW

3mrQsdOoUgh34CDCMDkP2glwxlekZZ7onyCEhMCdMZCXUt5JAgNLMUTI/9/5S3/I9/Lj3akAFSST

qij4mgICGfcOSLbds8w=

From: " nk.ca "< info@henutepsa.ooguy.com>

To: root@nk.ca

Subject: =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=

Date: 7 Mar 2025 06:21:26 -0800

Message-ID: <20250307062126.32DDDD197F77C9B1@henutepsa.ooguy.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.4

X-Spam_score_int: 134

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Password Expiration Notice Password Expiration Alert



Content analysis details: (13.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 FROMSPACE Idiosyncratic "From" header format

2.7 FROM_WSP_LEAD Leading whitespace after '<' in From header field

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 FROM_MISSPACED From: missing whitespace

Subject: {SPAM?} =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=














=3D1.0">

Password Expiration Notice






background-color: #f4f4f4;

margin: 0;

padding: 0;

color: #333333">


margin: 40px auto;

background-color: #ffffff;

padding: 40px;

border-radius: 8px;

box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1)" class=3D"email-conta=

iner">


color: #2c3e50;

margin-bottom: 20px;

text-align: center;

border-bottom: 2px solid #3498db;

padding-bottom: 10px">Password Expiration Alert




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Dear root,




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">We are writing to inform you that your current =

password for the mailbox root@nk.ca has expired.




border-left: 4px solid #3498db;

padding: 15px;

margin-bottom: 20px" class=3D"highlight">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; color: #e74c3c;

font-weight: bold" class=3D"warning-text">Important: Failure to=

update your password will result in temporary loss of access to your =

mailbox. We strongly recommend taking action promptly to avoid any interrup=

tions to your service.






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">However, it is advised to continue using y=

our current password. To continue using current password, please click the =

button below:






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Thank you for your prompt attention to this mat=

ter.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Best regards,
The nk.ca Team






color: #7f8c8d;

text-align: center;

margin-top: 40px;

padding-top: 20px;

border-top: 1px solid #ecf0f1" class=3D"footer">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">© 2025 nk.ca. All rights re=

served.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">Privacy Policy=

| Terms of Service | Contact Support
p>





nk.ca credential phising from hostzealot.com

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 08:16:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqZQ8-000000006cb-1A2b

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 08:15:28 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 08:15:28 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [79.141.162.46] (port=53936 helo=mail0.henutepsa.ooguy.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqYbs-0000000021d-21Pg

for doctor@nk.ca;

Fri, 07 Mar 2025 07:23:36 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=henutepsa.ooguy.com;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:

Content-Transfer-Encoding; i=info@henutepsa.ooguy.com;

bh=ME/ig4A1LB96hSEahz3HXwCUgOt1PegSWj+TCwm3YLA=;

b=TJCwdRbmPv/BWfXeiXV5OVHqFq+m0ofAk1NRYWKb+Ml5E6E+lBKOB81TbAX2YBB+wT0n6/WyCfu1

BbusqB3IW6JQaNimhFujz4CrBP1InUsovIke5V/eAzQkHzW3bLIDygkVchLtOOCXMmwiieKMehoa

zbZeGtyrw8ljAB2eIdI=

From: " nk.ca "< info@henutepsa.ooguy.com>

To: doctor@nk.ca

Subject: =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=

Date: 7 Mar 2025 06:21:26 -0800

Message-ID: <20250307062126.1AC69419F1F88ABB@henutepsa.ooguy.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.4

X-Spam_score_int: 134

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Password Expiration Notice Password Expiration Alert



Content analysis details: (13.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 FROMSPACE Idiosyncratic "From" header format

2.7 FROM_WSP_LEAD Leading whitespace after '<' in From header field

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 FROM_MISSPACED From: missing whitespace

Subject: {SPAM?} =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=














=3D1.0">

Password Expiration Notice






background-color: #f4f4f4;

margin: 0;

padding: 0;

color: #333333">


margin: 40px auto;

background-color: #ffffff;

padding: 40px;

border-radius: 8px;

box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1)" class=3D"email-conta=

iner">


color: #2c3e50;

margin-bottom: 20px;

text-align: center;

border-bottom: 2px solid #3498db;

padding-bottom: 10px">Password Expiration Alert




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Dear doctor,




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">We are writing to inform you that your current =

password for the mailbox doctor@nk.ca has expired.




border-left: 4px solid #3498db;

padding: 15px;

margin-bottom: 20px" class=3D"highlight">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; color: #e74c3c;

font-weight: bold" class=3D"warning-text">Important: Failure to=

update your password will result in temporary loss of access to your =

mailbox. We strongly recommend taking action promptly to avoid any interrup=

tions to your service.






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">However, it is advised to continue using y=

our current password. To continue using current password, please click the =

button below:






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Thank you for your prompt attention to this mat=

ter.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Best regards,
The nk.ca Team






color: #7f8c8d;

text-align: center;

margin-top: 40px;

padding-top: 20px;

border-top: 1px solid #ecf0f1" class=3D"footer">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">© 2025 nk.ca. All rights re=

served.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">Privacy Policy=

| Terms of Service | Contact Support
p>





nk.ca credential phishing hostzealot.com

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 08:16:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqZQ4-000000006c6-1BLO

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 08:15:24 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 08:15:24 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [79.141.162.46] (port=53936 helo=mail0.henutepsa.ooguy.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqYbj-0000000021d-1Oae

for sales@nk.ca;

Fri, 07 Mar 2025 07:23:27 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=henutepsa.ooguy.com;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:

Content-Transfer-Encoding; i=info@henutepsa.ooguy.com;

bh=PUNMthvTma3OObBXPv4jc4uaW2FINOUeh0dhfzPKpQc=;

b=F1gPRxPjnEWBPdlThPWJ/oH9AIIjOIPPdjiUNFtqgGvOWskbk4FGFDwRGT3OV22bql7WqC7NCvHN

bbzb8ZYIqsRONP4OQjFhllIEvvyk0h4H/gArwPCsHAaoLcdoLVvYucXMiMMD5HW4BaumerFLjp3e

rV5nAdguNyOxMGXgq8s=

From: " nk.ca "< info@henutepsa.ooguy.com>

To: sales@nk.ca

Subject: =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=

Date: 7 Mar 2025 06:21:25 -0800

Message-ID: <20250307062125.F0F7891A615994FC@henutepsa.ooguy.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.4

X-Spam_score_int: 134

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Password Expiration Notice Password Expiration Alert



Content analysis details: (13.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 FROMSPACE Idiosyncratic "From" header format

2.7 FROM_WSP_LEAD Leading whitespace after '<' in From header field

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 FROM_MISSPACED From: missing whitespace

Subject: {SPAM?} =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=














=3D1.0">

Password Expiration Notice






background-color: #f4f4f4;

margin: 0;

padding: 0;

color: #333333">


margin: 40px auto;

background-color: #ffffff;

padding: 40px;

border-radius: 8px;

box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1)" class=3D"email-conta=

iner">


color: #2c3e50;

margin-bottom: 20px;

text-align: center;

border-bottom: 2px solid #3498db;

padding-bottom: 10px">Password Expiration Alert




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Dear sales,




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">We are writing to inform you that your current =

password for the mailbox sales@nk.ca has expired.




border-left: 4px solid #3498db;

padding: 15px;

margin-bottom: 20px" class=3D"highlight">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; color: #e74c3c;

font-weight: bold" class=3D"warning-text">Important: Failure to=

update your password will result in temporary loss of access to your =

mailbox. We strongly recommend taking action promptly to avoid any interrup=

tions to your service.






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">However, it is advised to continue using y=

our current password. To continue using current password, please click the =

button below:






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Thank you for your prompt attention to this mat=

ter.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Best regards,
The nk.ca Team






color: #7f8c8d;

text-align: center;

margin-top: 40px;

padding-top: 20px;

border-top: 1px solid #ecf0f1" class=3D"footer">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">© 2025 nk.ca. All rights re=

served.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">Privacy Policy=

| Terms of Service | Contact Support
p>





nk.ca credential phising from hostzealot.com

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 08:16:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqZQB-000000006d6-44mg

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 08:15:31 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 08:15:31 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [79.141.162.46] (port=52788 helo=mail0.henutepsa.ooguy.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqYbj-0000000021k-1OYX

for doctor@nl2k.ab.ca;

Fri, 07 Mar 2025 07:23:27 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=henutepsa.ooguy.com;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:

Content-Transfer-Encoding; i=info@henutepsa.ooguy.com;

bh=AkRPadb3WTz274LGfbsKqLvqBd2gBUOZBQzNpyE9Ic8=;

b=T04sIzckr3hhFzdfsfw61+Y5cEG6i3nXJJ7jHmWDIrtWtj/hGAiAPI0mks3V+HsIz7QPcXiYGlJK

hUwOaOrHmsGNoP4ibQI9TG2jvtQTOVDwzlPv5Pk97xnUA6WgMj160CWk8ZwA0WMsNxPiEsPhd8kk

uOg20nTNJTEgmFAIHzs=

From: " nl2k.ab.ca "< info@henutepsa.ooguy.com>

To: doctor@nl2k.ab.ca

Subject: =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=

Date: 7 Mar 2025 06:21:26 -0800

Message-ID: <20250307062126.98FF5772925A2114@henutepsa.ooguy.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.4

X-Spam_score_int: 134

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Password Expiration Notice Password Expiration Alert



Content analysis details: (13.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 FROMSPACE Idiosyncratic "From" header format

2.7 FROM_WSP_LEAD Leading whitespace after '<' in From header field

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FROM_MISSPACED From: missing whitespace

Subject: {SPAM?} =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=














=3D1.0">

Password Expiration Notice






background-color: #f4f4f4;

margin: 0;

padding: 0;

color: #333333">


margin: 40px auto;

background-color: #ffffff;

padding: 40px;

border-radius: 8px;

box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1)" class=3D"email-conta=

iner">


color: #2c3e50;

margin-bottom: 20px;

text-align: center;

border-bottom: 2px solid #3498db;

padding-bottom: 10px">Password Expiration Alert




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Dear doctor,




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">We are writing to inform you that your current =

password for the mailbox doctor@nl2k.ab.ca has expired.
p>


border-left: 4px solid #3498db;

padding: 15px;

margin-bottom: 20px" class=3D"highlight">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; color: #e74c3c;

font-weight: bold" class=3D"warning-text">Important: Failure to=

update your password will result in temporary loss of access to your =

mailbox. We strongly recommend taking action promptly to avoid any interrup=

tions to your service.






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">However, it is advised to continue using y=

our current password. To continue using current password, please click the =

button below:






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Thank you for your prompt attention to this mat=

ter.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Best regards,
The nl2k.ab.ca Team






color: #7f8c8d;

text-align: center;

margin-top: 40px;

padding-top: 20px;

border-top: 1px solid #ecf0f1" class=3D"footer">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">© 2025 nl2k.ab.ca. All righ=

ts reserved.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">Privacy Policy=

| Terms of Service | Contact Support
p>





IPTV spam from Google Cloud

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 08:16:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqZQa-000000006fz-0cDO

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 08:15:56 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 08:15:56 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 66.234.141.34.bc.googleusercontent.com ([34.141.234.66]:44864 helo=cs-499278764548-default.europe-west4-a.c.i2f7e30109524dc12-tp.internal)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqYql-000000003LW-3jDT

for doctor@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 07:39:01 -0700

Received: from cs-499278764548-default (localhost [127.0.0.1])

by cs-499278764548-default.europe-west4-a.c.i2f7e30109524dc12-tp.internal (Postfix) with ESMTP id 3E4E636A9C5

for ; Fri, 7 Mar 2025 14:36:38 +0000 (UTC)

Date: Fri, 7 Mar 2025 14:36:38 +0000

To: doctor@doctor.nl2k.ab.ca

From: IPTV Offers

Reply-To: David

Subject: Get Access to Premium IPTV Service Today!

Message-ID:

X-Mailer: PHPMailer 6.9.3 (https://github.com/PHPMailer/PHPMailer)

MIME-Version: 1.0

Content-Type: text/html; charset=iso-8859-1

X-Spam_score: 27.8

X-Spam_score_int: 278

X-Spam_bar: +++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Black Friday Offer - Best IPTV TOP 2025 OFFERS



Content analysis details: (27.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[34.141.234.66 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.141.234.66 listed in will-spam-for-food.eu.org]

[34.141.234.66 listed in will-spam-for-food.eu.org]

[34.141.234.66 listed in will-spam-for-food.eu.org]

[34.141.234.66 listed in will-spam-for-food.eu.org]

[34.141.234.66 listed in will-spam-for-food.eu.org]

[34.141.234.66 listed in will-spam-for-food.eu.org]

[34.141.234.66 listed in will-spam-for-food.eu.org]

[34.141.234.66 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.141.234.66 listed in dnsbl.ahbl.org]

[34.141.234.66 listed in dnsbl.ahbl.org]

[34.141.234.66 listed in dnsbl.ahbl.org]

[34.141.234.66 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.141.234.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.141.234.66 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.141.234.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.141.234.66 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[34.141.234.66 listed in zen.spamhaus.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: www.casamiatv.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: casamiatv.com]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[iptvbusinwwess19(at)gmail.com]

3.1 URI_OBFU_WWW BODY: Obfuscated URI

0.6 J_CHICKENPOX_39 BODY: 3alpha-pock-9alpha

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

Subject: {SPAM?} Get Access to Premium IPTV Service Today!















Black Friday Offer - Best IPTV













  TOP 2025 OFFERS 



Get 24 Months of Best IPTV for ONLY $89!







Why Choose Casamia TV?



Here’s what you’ll enjoy:





  •  Perfect for Sports Fans (Champions league , NBA , NFL , ... )


  •  A Paradise for Movie Lovers


  •  Over 30,000+ Worldwide Channels


  •  Stunning HD, FHD, and 4K Quality


  •  Works on All Devices


  •  Free Trial for 24H


  • 100% Money-Back Guarantee


  • Become an IPTV Reseller


  • All Subscription With Good Prices : 1/3/6/12/24 Months


Grab the Deal - 24 Months for $89

Learn More on Our Website: www.casamiatv. com

 Have questions? Chat with us on WhatsApp:

 Contact via WhatsApp





Casamia TV -  The Ultimate Viewing Experience © 2025



Unsubscribe from these emails