NetKnow Corporate Blog

Instragram followers spam from Google Gmail

Posted by Dave Yadallee on Sunday, March 16. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Mar 2025 12:46:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1ttsz0-000000009Cl-0tYr

for dave@doctor.nl2k.ab.ca;

Sun, 16 Mar 2025 12:45:10 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Mar 2025 12:45:10 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qt1-f198.google.com ([209.85.160.198]:50581)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1ttsqn-000000000Jo-32r6

for sales@nk.ca;

Sun, 16 Mar 2025 12:36:51 -0600

Received: by mail-qt1-f198.google.com with SMTP id d75a77b69052e-474f079562dso142221991cf.1

for ; Sun, 16 Mar 2025 11:34:46 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1742150080; x=1742754880; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=UI5KNLb4pgzuH8VUQNLB9Zrf5xyJkwkfLJi7bX2uhOk=;

b=YQ4tD57MfG363MS5q8pRsmnqtfM9ZCx14lG0T5j3bI6H/h8Zy/hjx5EKmJWwXxTedD

1Os3Je8FmKTZiV79fIllQZOSUNQshNN4ujdLCi4yDp0EEbN4EPns81XyfdoC99cSlxyX

d07ZxPw+IxKiNoOwhzSBdMPGGwHhTw+5PDuULbQglyKkVR8EDZ50kvE+Nie16Gerb+2P

oYqB/g08RWbCpfv46n/vE8Vb/TMPLUHsEaYbMDSerm3nPKsYhddi6RoYjS7cy+TR4kxq

N0rSPzw6Dntz3JIWnHFX8qPCm1BNB2Zddirj3uV3jW9h4tuDR+/sz+Mquv0HQccWFeCu

r8Lg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1742150080; x=1742754880;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=UI5KNLb4pgzuH8VUQNLB9Zrf5xyJkwkfLJi7bX2uhOk=;

b=ptUsh75R4k2aH6yAUEe9obuqYG4SHu0dlihyvI9A9ZD4TldSYbGLGu1qRc9p0zvWoe

q8ioajZ7Y4RsbAjjKQCONihjAXf+youykch/aPeEA44SnORhIntkgEyGsUlQ57zAYNWV

oK68zWXp6lF18kO/4Y5I62+PI5bVdiNKDxiuBnafDeThb/W6ULkw7vWTgyRrMe1iqRg4

nYd+Jd+35flHmrarRAuZ03rgmq3fH6fFun+eZZstvGD4EFdOH+hqj3+NEV50CXXRiKrP

VviKlikmIwm3N2BxfmYwG+XG9HyaJ0n0U3RAoQzI916KKBYasMVSEU/WOZvEXn5l/Xld

uopw==

X-Gm-Message-State: AOJu0Yy45CxatxS5qtJlYZ8IQIAilk2tx5rZ+5kOgZ5NCSzpk27967AG

iEClblsM65xJsSc7aTdFkk110akzIzKKcIaP+tAYEpJmRubAjrYX5Ig8Yhvh5ZLKHNNZNdoZANo

=

X-Google-Smtp-Source: AGHT+IEk4cXuIH3OKgLONTrpvW1LWci9+a1x85N+v7Lr8qemY/NDpAt5ejpPzYim2MAJ+paURNYIlr13nA==

MIME-Version: 1.0

X-Received: by 2002:ac8:5a8a:0:b0:476:923a:ca7b with SMTP id

d75a77b69052e-476c812401fmr162030291cf.1.1742150080259; Sun, 16 Mar 2025

11:34:40 -0700 (PDT)

Message-ID:

Date: Sun, 16 Mar 2025 18:34:40 +0000

Subject: netknowyeg,Specials order

From: kakakmella100@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello, netknowyeg,Specials order Special For You GET 100K

Followers Instagram NOW !!! Order here : [ https://graminsta.shop/store/InstagramFollowers/?Netknow

Internet Service ]

Content analysis details: (7.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

[209.85.160.198 listed in dnsbl.ahbl.org]

[209.85.160.198 listed in dnsbl.ahbl.org]

[209.85.160.198 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.198 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.198 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[kakakmella100(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[kakakmella100(at)gmail.com]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} netknowyeg,Specials order

SGVsbG8sDQpuZXRrbm93eWVnLFNwZWNpYWxzIG9yZGVyDQoNClNwZWNpYWwgRm9yIFlvdQ0KR0VU

IDEwMEsgRm9sbG93ZXJzIEluc3RhZ3JhbSBOT1cgISEhDQpPcmRlciBoZXJlIDoNCg0KWyBodHRw

czovL2dyYW1pbnN0YS5zaG9wL3N0b3JlL0luc3RhZ3JhbUZvbGxvd2Vycy8/TmV0a25vdyBJbnRl

cm5ldCBTZXJ2aWNlICANCl0NCg0KRG8geW91IGhhdmUgYWJvdXQgWyBuZXRrbm93eWVnIF0gRm9s

bG93ZXJzID8NCkRpc2NvdW50IGZvciBhbGwgc2VydmljZXMgNDAlIFRvZGF5Li4uIQ0KSW5jcmVh

c2UgTm93IC4uISEhDQoNCi0gSW5zdGFudCBTdGFydA0KLSBTYWZlc3QgTWV0aG9kcw0KLSBQcml2

YWN5IFByb3RlY3Rpb24NCi0gU3BlZWQgMjAwSyBGb2xsb3dlcnMvZGF5DQotIEhpZ2ggUXVhbGl0

eSBGb2xsb3dlcnMNCi0gRHJvcC1CYWNrIEd1YXJhbnRlZQ0KLSBUcnVzdGVkIFNlbGxlciB0ZXN0

aW1vbnkNCi0gU3RhcnRpbmcgZ2V0IDEwMEsgRm9sbG93ZXJzIEluc3RhZ3JhbQ0KLSBHdWFyYW50

ZWVkIHRvIGJlIHRoZSBjaGVhcGVzdA0KDQpUaGFuayB5b3UsDQpSZWdhcmRzLA0KDQoNCg0KQ29w

eXJpZ2h0IMKpIDIwMTQgLSAyMDI1IGluc3RhbWVkaWFwcm9tYXgNCg==

NFT phish from OVH

Posted by Dave Yadallee on Sunday, March 16. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Mar 2025 05:32:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1ttmDb-00000000MZB-021g

for dave@doctor.nl2k.ab.ca;

Sun, 16 Mar 2025 05:31:47 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Mar 2025 05:31:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [104.168.30.150] (port=35360 helo=service.gp2o2.cn)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tthAG-000000003AX-2Zsk

for doctor@doctor.nl2k.ab.ca;

Sun, 16 Mar 2025 00:08:09 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mykey; d=service.gp2o2.cn;

h=From:Reply-To:To:Subject:Date:List-Unsubscribe:Mime-Version:Content-Type:Message-ID;

bh=WjVjiS4GlNQJA0MRAb4vihNtj7A=;

b=ncb3tqk28px3xAaOyHS64oBnab2wKU4jVzHa67+RNCc33MtXKJ0a2PVlT0lmt9fCEFVs4FljUo4l

qzfHmdFD6qVRmMbdJB0NhnrvDZLKTlnm8hN8ez9KUyHV+y+0IWG+hRc7vOnnpQG7l/f3IQPcVYB8

Gz/ynI1xbqQTg4HDzME=

Received: from MSI (141.94.204.219) by service.gp2o2.cn id hqpld80001gj for ; Sun, 16 Mar 2025 02:08:14 -0400 (envelope-from )

From: =?utf-8?B?T3BlblNlYeKEog==?=

Reply-To: info@gp2o2.cn

To: doctor@doctor.nl2k.ab.ca

Subject: =?utf-8?B?4pqhIFNvbWVvbmUgV2FudHMgdG8gQnV5IFlvdXIgTkZUIOKAkyBSZXZpZXcgTm93IQ==?=

Date: Sun, 16 Mar 2025 07:07:52 +0100

List-Unsubscribe:

X-Priority: 1

Mime-Version: 1.0

Content-Type: multipart/alternative; boundary="D2AED816758F47E1A0BF6EE0B6B3B7C1"

Message-ID: <0.0.1B.735.1DB9639CD9086BE.0@service.gp2o2.cn>

X-Spam_score: 20.1

X-Spam_score_int: 201

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: ðŸš€ Exciting News! You Have a New Offer Dear OpenSea User,

Someone has placed an offer on your Bored Ape Yacht Club NFT. This could

be your chance to make a great deal!

Content analysis details: (20.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[104.168.30.150 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[141.94.204.219 listed in will-spam-for-food.eu.org]

[141.94.204.219 listed in will-spam-for-food.eu.org]

[141.94.204.219 listed in will-spam-for-food.eu.org]

[141.94.204.219 listed in will-spam-for-food.eu.org]

[141.94.204.219 listed in will-spam-for-food.eu.org]

[141.94.204.219 listed in will-spam-for-food.eu.org]

[141.94.204.219 listed in will-spam-for-food.eu.org]

[141.94.204.219 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[141.94.204.219 listed in dnsbl.ahbl.org]

[141.94.204.219 listed in dnsbl.ahbl.org]

[141.94.204.219 listed in dnsbl.ahbl.org]

[141.94.204.219 listed in dnsbl.ahbl.org]

[104.168.30.150 listed in dnsbl.ahbl.org]

[104.168.30.150 listed in dnsbl.ahbl.org]

[104.168.30.150 listed in dnsbl.ahbl.org]

[104.168.30.150 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[141.94.204.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[141.94.204.219 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[141.94.204.219 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[141.94.204.219 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[104.168.30.150 listed in zen.spamhaus.org]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: service.gp2o2.cn/104.168.30.150]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[104.168.30.150 listed in sa-trusted.bondedsender.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[104.168.30.150 listed in sa-accredit.habeas.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: gp2o2.cn]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: gp2o2.cn]

2.1 RCVD_IN_MSPIKE_L4 RBL: Bad reputation (-4)

[104.168.30.150 listed in bl.mailspike.net]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[104.168.30.150 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[104.168.30.150 listed in bl.score.senderscore.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: service.gp2o2.cn/104.168.30.150]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

0.0 GB_CUSTOM_HTM_URI Custom html uri

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_REMOTE_IMAGE Message contains an external image

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} =?utf-8?B?4pqhIFNvbWVvbmUgV2FudHMgdG8gQnV5IFlvdXIgTkZUIOKAkyBSZXZpZXcgTm93IQ==?=

--D2AED816758F47E1A0BF6EE0B6B3B7C1

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

font-family:=20'Segoe=20UI',=20Arial,=20sans-serif;=20background-color:=20#=

ffffff;=20border-radius:=2010px;=20box-shadow:=200=200=2010px=20rgba(0,=200=

,=200,=200.1);=20padding:=2020px;">=0D=0A=20=20=20=20=0D=0A=20=20=20=20=0D=0A=20=20=20=20=20=20=20=20
align:=20center;=20padding-bottom:=2020px;">=0D=0A=20=20=20=20=20=20=20=20=20=

=20=20=20
onaws.com/clinikapps/bea49825a/email-builder/1738653363.png"=20alt=3D"OpenS=

ea=20Logo"=20style=3D"width:=20150px;=20margin-bottom:=2020px;">=0D=0A=20=20=

=20=20=20=20=20=20=0D=0A=20=20=20=20=0D=0A=0D=0A=20=20=20=20=0D=0A=20=20=20=20=0D=0A=20=20=20=20=20=20=20=20
e=3D"text-align:=20center;">=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20
style=3D"margin:=200;">=F0=9F=9A=80=20Exciting=20News!=20You=20Have=20a=20N=

ew=20Offer=0D=0A=20=20=20=20=20=20=20=20=0D=0A=20=20=20=20=0D=

=0A=0D=0A=20=20=20=20=0D=0A=20=20=20=20=0D=0A=20=20=

=20=20=20=20=20=20
>=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20

Dear=20OpenSea=20User,

=0D=

=0A=20=20=20=20=20=20=20=20=20=20=20=20

Someone=20has=20placed=20an=20off=

er=20on=20your=20Bored=20Ape=20Yacht=20Club=20NFT.=20This=20=

could=20be=20your=20chance=20to=20make=20a=20great=20deal!

=0D=0A=20=20=20=

=20=20=20=20=20=0D=0A=20=20=20=20=0D=0A=0D=0A=20=20=20=20=0D=0A=20=20=20=20=0D=0A=20=20=20=20=20=20=20=20
=20style=3D"padding-top:=2010px;">=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20=

:=2014px;">=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=0D=0A=

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
font-weight:=20bold;=20padding:=205px;">=F0=9F=94=B9=20NFT=20Name:=0D=0A=

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
padding:=205px;">BAYC=20#2745=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20=20=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
le=3D"font-weight:=20bold;=20padding:=205px;">=F0=9F=94=B9=20Offer=20Price:=

=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
style=3D"padding:=205px;">3.8=20ETH=20(~$7429.35=20USD)=0D=0A=20=20=20=

=20=20=20=20=20=20=20=20=20=20=20=20=20=0D=0A=20=20=20=20=20=20=20=20=20=

=20=20=20=0D=0A=20=20=20=20=20=20=20=20=0D=0A=20=20=20=20=

=0D=0A=0D=0A=20=20=20=20=0D=0A=20=20=20=20
r>=0D=0A=20=20=20=20=20=20=20=20
ing:=2020px=200;">=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20
tps://www.duraeval.com/newsletters/promosea?Email=3Ddoctor@doctor.nl2k.ab.c=

a"=20style=3D"font-size:=2016px;=20text-decoration:=20none;=20font-weight:=20=

bold;=20color:=20#ffffff;=20padding:=2012px=2024px;=20background-color:=20#=

0597f0;=20border-radius:=205px;=20display:=20inline-block;">=0D=0A=20=20=20=

=20=20=20=20=20=20=20=20=20=20=20=20=20=20Review=20Offer=20Now=0D=0A=20=20=20=

=20=20=20=20=20=20=20=20=20=0D=0A=20=20=20=20=20=20=20=20=0D=0A=20=

=20=20=20=0D=0A=0D=0A=20=20=20=20=0D=0A=20=

=20=20=20=0D=0A=20=20=20=20=20=20=20=20
ter;=20font-size:=2014px;=20color:=20#d9534f;=20padding:=2010px=200;">=0D=0A=

=20=20=20=20=20=20=20=20=20=20=20=20=E2=9A=A0=EF=B8=8F=20High-demand=20NFTs=

=20like=20this=20receive=20multiple=20offers.=20Act=20fast=20before=20it=20=

expires!=0D=0A=20=20=20=20=20=20=20=20=0D=0A=20=20=20=20=0D=0A=0D=

=0A=20=20=20=20=0D=0A=20=20=20=20=0D=0A=20=

=20=20=20=20=20=20=20
adding-top:=2020px;=20text-align:=20center;">=0D=0A=20=20=20=20=20=20=20=20=

=20=20=20=20

Need=20help?=20Visit=20our=20
al.com/newsletters/promosea?Email=3Ddoctor@doctor.nl2k.ab.ca"=20style=3D"co=

lor:=20#0597f0;">Help=20Center=20for=20assistance.

=0D=0A=20=20=20=20=

=20=20=20=20=20=20=20=20

Happy=20trading!
The=20OpenSea=20Team=

=0D=0A=20=20=20=20=20=20=20=20=0D=0A=20=20=20=20=0D=0A=

=0D=0A

--D2AED816758F47E1A0BF6EE0B6B3B7C1--

NFT phish from OVH

Posted by Dave Yadallee on Sunday, March 16. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 15 Mar 2025 23:58:00 -0600

Received: from [104.168.30.150] (port=34887 helo=service.gp2o2.cn)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1ttgzg-000000002Bj-0Q2S

for dave@doctor.nl2k.ab.ca;

Sat, 15 Mar 2025 23:57:29 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mykey; d=service.gp2o2.cn;

h=From:Reply-To:To:Subject:Date:List-Unsubscribe:Mime-Version:Content-Type:Message-ID;

bh=XVkGgva/EDKuxBzqOjYlj8dBWas=;

b=c//s2bQiEe/NYF7CuhqF9b3rSZ/UQe3VcNxzaKoykX8JhnIg5tFnH8dN+uG1eRt76FQ2cKXxNWEg

8UmycuVMR11GyDEIdF597mUnZcrraUarT0wip/AXTmnm20pLa7eg8dU09XNL6ecDXQ6JOz9p1N5M

ETVD86Wdr3oAp4JNRkA=

Received: from MSI (141.94.204.219) by service.gp2o2.cn id hqpk480001gr for ; Sun, 16 Mar 2025 01:54:32 -0400 (envelope-from )

From: =?utf-8?B?T3BlblNlYeKEog==?=

Reply-To: info@gp2o2.cn

To: dave@doctor.nl2k.ab.ca

Subject: =?utf-8?B?4pqhIFNvbWVvbmUgV2FudHMgdG8gQnV5IFlvdXIgTkZUIOKAkyBSZXZpZXcgTm93IQ==?=

Date: Sun, 16 Mar 2025 06:54:10 +0100

List-Unsubscribe:

X-Priority: 1

Mime-Version: 1.0

Content-Type: multipart/alternative; boundary="60D56474F8B44B1497C50753B5292BB1"

Message-ID: <0.0.17.683.1DB9637E375B3C0.0@service.gp2o2.cn>

X-Spam_score: 20.1

X-Spam_score_int: 201

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: ðŸš€ Exciting News! You Have a New Offer Dear OpenSea User,

Someone has placed an offer on your Bored Ape Yacht Club NFT. This could

be your chance to make a great deal!

Content analysis details: (20.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[104.168.30.150 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[141.94.204.219 listed in will-spam-for-food.eu.org]

[141.94.204.219 listed in will-spam-for-food.eu.org]

[141.94.204.219 listed in will-spam-for-food.eu.org]

[141.94.204.219 listed in will-spam-for-food.eu.org]

[141.94.204.219 listed in will-spam-for-food.eu.org]

[141.94.204.219 listed in will-spam-for-food.eu.org]

[141.94.204.219 listed in will-spam-for-food.eu.org]

[141.94.204.219 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

[104.168.30.150 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[104.168.30.150 listed in zen.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[141.94.204.219 listed in dnsbl.ahbl.org]

[141.94.204.219 listed in dnsbl.ahbl.org]

[141.94.204.219 listed in dnsbl.ahbl.org]

[141.94.204.219 listed in dnsbl.ahbl.org]

[104.168.30.150 listed in dnsbl.ahbl.org]

[104.168.30.150 listed in dnsbl.ahbl.org]

[104.168.30.150 listed in dnsbl.ahbl.org]

[104.168.30.150 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[141.94.204.219 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[141.94.204.219 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[141.94.204.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[141.94.204.219 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[104.168.30.150 listed in sa-trusted.bondedsender.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[104.168.30.150 listed in sa-accredit.habeas.com]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: gp2o2.cn]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: gp2o2.cn]

2.1 RCVD_IN_MSPIKE_L4 RBL: Bad reputation (-4)

[104.168.30.150 listed in bl.mailspike.net]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[104.168.30.150 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[104.168.30.150 listed in bl.score.senderscore.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: service.gp2o2.cn/104.168.30.150]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: service.gp2o2.cn/104.168.30.150]

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_REMOTE_IMAGE Message contains an external image

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} =?utf-8?B?4pqhIFNvbWVvbmUgV2FudHMgdG8gQnV5IFlvdXIgTkZUIOKAkyBSZXZpZXcgTm93IQ==?=

--60D56474F8B44B1497C50753B5292BB1

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Dear=20OpenSea=20User,

=0D=

=0A=20=20=20=20=20=20=20=20=20=20=20=20

Someone=20has=20placed=20an=20off=

er=20on=20your=20Bored=20Ape=20Yacht=20Club=20NFT.=20This=20=

could=20be=20your=20chance=20to=20make=20a=20great=20deal!

:=2014px;">=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=0D=0A=

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
font-weight:=20bold;=20padding:=205px;">=F0=9F=94=B9=20NFT=20Name:=0D=0A=

=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
padding:=205px;">BAYC=20#2745=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20=

=20=20=20=20=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=

=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
le=3D"font-weight:=20bold;=20padding:=205px;">=F0=9F=94=B9=20Offer=20Price:=

=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
style=3D"padding:=205px;">3.8=20ETH=20(~$7429.35=20USD)=0D=0A=20=20=20=

=20=20=20=20=20=20=20=20=20=20=20=20=20=0D=0A=20=20=20=20=20=20=20=20=20=

=20=20=20=0D=0A=20=20=20=20=20=20=20=20=0D=0A=20=20=20=20=

=0D=0A=0D=0A=20=20=20=20=0D=0A=20=20=20=20
r>=0D=0A=20=20=20=20=20=20=20=20
ing:=2020px=200;">=0D=0A=20=20=20=20=20=20=20=20=20=20=20=20
tps://www.duraeval.com/newsletters/promosea?Email=3Ddave@doctor.nl2k.ab.ca"=

=20style=3D"font-size:=2016px;=20text-decoration:=20none;=20font-weight:=20=

bold;=20color:=20#ffffff;=20padding:=2012px=2024px;=20background-color:=20#=

0597f0;=20border-radius:=205px;=20display:=20inline-block;">=0D=0A=20=20=20=

=20=20=20=20=20=20=20=20=20=20=20=20=20=20Review=20Offer=20Now=0D=0A=20=20=20=

=20=20=20=20=20=20=20=20=20=0D=0A=20=20=20=20=20=20=20=20=0D=0A=20=

=20=20=20=0D=0A=0D=0A=20=20=20=20=0D=0A=20=

=20=20=20=0D=0A=20=20=20=20=20=20=20=20
ter;=20font-size:=2014px;=20color:=20#d9534f;=20padding:=2010px=200;">=0D=0A=

=20=20=20=20=20=20=20=20=20=20=20=20=E2=9A=A0=EF=B8=8F=20High-demand=20NFTs=

=20like=20this=20receive=20multiple=20offers.=20Act=20fast=20before=20it=20=

expires!=0D=0A=20=20=20=20=20=20=20=20=0D=0A=20=20=20=20=0D=0A=0D=

=0A=20=20=20=20=0D=0A=20=20=20=20=0D=0A=20=

=20=20=20=20=20=20=20
adding-top:=2020px;=20text-align:=20center;">=0D=0A=20=20=20=20=20=20=20=20=

=20=20=20=20

Need=20help?=20Visit=20our=20
al.com/newsletters/promosea?Email=3Ddave@doctor.nl2k.ab.ca"=20style=3D"colo=

r:=20#0597f0;">Help=20Center=20for=20assistance.

=0D=0A=20=20=20=20=20=

=20=20=20=20=20=20=20

Happy=20trading!
The=20OpenSea=20Team
trong>

=0D=0A=20=20=20=20=20=20=20=20=0D=0A=20=20=20=20=0D=0A<=

/table>=0D=0A

--60D56474F8B44B1497C50753B5292BB1--

Categories: OVH Spam and Phish, Phish

0 Comments

Web/SEO/App spam from Microsoft Outlook
Posted by Dave Yadallee on Saturday, March 15. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 15 Mar 2025 11:19:00 -0600

Received: from mail-sg2apc01olkn2065.outbound.protection.outlook.com ([40.92.53.65]:13632 helo=APC01-SG2-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1ttV9m-000000004Hy-2bEf

for dave@doctor.nl2k.ab.ca;

Sat, 15 Mar 2025 11:18:53 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=N/SGcEFNhTot0oLSg17iipbw4Djx8Qrw8Wuk6G1zwj9FM8jci5ZxeeC6yWCPFUvBMUbBZM4dYqdJ/pZ2E0TWDpztxNWF5Zl9MlAURTeAiOTsf0+o1KnYQEss4jcxUZUMKfwwCBpCsd8GoykekvMToWzxL3408b+0toYr5fLjQ46kKjkAjHQvVkD0bkUMH6FfLGgeiGpYv2UfcDv3F5dJIq0HuDVqSDI8xHOcZ7LXY/uSMmjCVr0kcgCXQcsZ+/V9zVM5r+gJ4zTJaEeey3K9x8kP5lQr9hlw5QkjA8zL/ujKwuhTc5mncAavHk0DGsNjhIj8NwUpi4tdblGkITLRpQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=fFgW80AKQJ3sJBKRRZbAJIRgMYV+/cpBNkXx2YQ40q8=;

b=kVfzXiqQtQOPDKG6sucnF/UokCou0u0MujdujP1bHHyiavDImXmWRI9nSaheYIEEPMyrsq87+S7figOJkFlhdB9HyaD4T5QOd36ockAEdTmWWxfU9YTeM0LO1Mym7pm6XUdwY7J5znbDFQzfl8duLoy7zbh4iqsXi/H7MERUpNoNQOtlUOOi2j7Sd6vYcZ4nS2d6RAI+RW+F16E18IzUDUVKv/+ZKYPAUWes1uanR2nmFajGux26Ak7AOmNKskCamsTc3QPGhfqCJhJ0/59LXYfsHvBfbZVccTQNiC069LVLejuanoW2LEdMRwRkxZSnvz6+yRVDxAEJZguJZEM1KQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=fFgW80AKQJ3sJBKRRZbAJIRgMYV+/cpBNkXx2YQ40q8=;

b=jDgMTJAVY/FWvS91JYtb7pVoSoaiZSBPzdZXrZ/Q0quWVT7VROquuuWo/8jOtcWxavh3cEY2XGo5fTqJ2RqIgkwzsAls1JHw91rZcKglepvLiaaXxwhPisNojy5SlGtc7YYAMVyceNACqkCY7K00x9tf98eBcukPxC6KiL270LSg6LM1+FjxT1NFPDBfeNjIglnG4RNboRYM7bq15hj4zuaxaXPI5M5v1G2Z13nlKgImKU1kXOE7szzA1iegOJkxF1kFXJo8z+QfdqXwLfcRyoV3sAR+7ECueuYe/E6isq/P0YU6XNnzgMTL2qUDQPZ8vUjCh13gWHwEB0KPJhPd8w==

Received: from JH0PR04MB8492.apcprd04.prod.outlook.com (2603:1096:990:86::7)

by TY0PR04MB6495.apcprd04.prod.outlook.com (2603:1096:400:272::7) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8511.30; Sat, 15 Mar

2025 17:16:03 +0000

Received: from JH0PR04MB8492.apcprd04.prod.outlook.com

([fe80::9202:80dd:1356:3af4]) by JH0PR04MB8492.apcprd04.prod.outlook.com

([fe80::9202:80dd:1356:3af4%3]) with mapi id 15.20.8534.024; Sat, 15 Mar 2025

17:16:02 +0000

From: Mae Nolan

To: Mae Nolan

Subject: Re: ready report....#@

Thread-Topic: ready report....#@

Thread-Index: AQHblc09FfZLmha53ECYCcesWfX3Zw==

Date: Sat, 15 Mar 2025 17:16:01 +0000

Message-ID:

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: JH0PR04MB8492:EE_|TY0PR04MB6495:EE_

x-ms-office365-filtering-correlation-id: f7ee6160-8259-417a-a460-08dd63e50faf

x-microsoft-antispam:

BCL:0;ARA:14566002|15080799006|461199028|8062599003|8060799006|15030799003|19110799003|3412199025|440099028|102099032|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?vCOKzuzERYx3+7APpu5GWqS6ldzSvxtuw4IpVKLDSYcnfq8320U+twgr?=

=?Windows-1252?Q?oMOGTE4PL7/4XrkwHsG1ckk+K4xkvocUKCjE0+P7DiEbRsjsOuEin7Oe?=

=?Windows-1252?Q?2oddxTOqwu+icIlbElU7rGigRqkH5q/xENIkviE+84bRF871mQvVQnIz?=

=?Windows-1252?Q?n7sA4pfBAg5T8FjzmnRUZAzjr9IoET0rS0PWNgsEmUVqRG0fpXIEue59?=

=?Windows-1252?Q?z9I3glsOR1igQX19w8PBFkAokztcHoXWGvhSFJu4J4cl8f4SNNbkxw7K?=

=?Windows-1252?Q?+yiroQDiGIRHgr9oOdDFBtQpC5er1GHugSFwHSXLHimWTp4l9KZMl9h/?=

=?Windows-1252?Q?Uq4lVbd2jfFSzxtVcpW2UZ5xhyZH6Yauum9uTw25W7lP1MWPGY9WR4nh?=

=?Windows-1252?Q?zNRHGZYU/DQUcPhHrrRnxhWlL9mu28MP6Sbsm3Z9GjphEa4zym4s481K?=

=?Windows-1252?Q?AWE3DeYXM9PANQDp66uao7lnTtZ/TeiUfZgw4JCKJr3wvwVyNMouRhG0?=

=?Windows-1252?Q?mP6RWlZeUrtIDZdtQ5dFCEoFqvNbdyqoyRtJmLnRN+GNwCcZGGzhuwvH?=

=?Windows-1252?Q?5yR62e5K08Wp8yHe2EhjAPxZJurNQhlH7HJ0ocdFzwTtSq+4P6TpiMMP?=

=?Windows-1252?Q?LxReNo1N3SHgROcigFtzPCABI0qf3kj7diJFcaH0DkcEBb4gDSklM7aC?=

=?Windows-1252?Q?+nuyt5oJrKo19MBsXvo76sZzRWS4XqCjnNiB6oK0ZSvdiN4f8AN8S4t6?=

=?Windows-1252?Q?L3gZ6X+EMaEW9CM/7UZFnd0ESPkmJVvWijMHgqsEbOo0ItwUtnYownKz?=

=?Windows-1252?Q?GqnZ4D/kUnzlWtz3YMj4YLSXtXO+hzKkwP9llXGmBFLP+hednQmhhec8?=

=?Windows-1252?Q?eDUvb1mS7qjxTrJ+CCTZCTqQpwM7IOYjvg6lqJhHw2xEw6Y5KQsz4gdD?=

=?Windows-1252?Q?bKZT7KzA4tt3h8rZLL6F8QaA1niCR0GXi9iwuRqvzJq6EboIIqfLHYvl?=

=?Windows-1252?Q?QMJzUU0zRCD6/dcXmv8Z0eyJ18ZXx1XIgti2GFnPq+XI/d40AKu4gSyR?=

=?Windows-1252?Q?IDV5PYpDdWxopwLPnNwffXl1whlMemjK49cUK4mR4ZkphYesaHRNHOfG?=

=?Windows-1252?Q?nkxgoct6hMnP7nSVMLO/aGQEeXXaS/j/0vnQXCUxV33eHvi3GshAXbiB?=

=?Windows-1252?Q?XJSvP0jJiVovUmBjR9q88Azbb1+45X4EmKMIFegCtm3z+2SyX+3BhQ?=

=?Windows-1252?Q?=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?S8QgWGjJMl2yU0NtbRTnczw0/7NWIbE9iYMZymucDJ2T6zUSDON1DHhL?=

=?Windows-1252?Q?xGfNbzUizdLW23UypSpE6KDYfYJh+JBlKqsRDJples8US4relPt8DG62?=

=?Windows-1252?Q?8cEmOp9UC0KLTmG3YnTzUSDrsFUq21HJzkwXDvPbZatH/zCA1BnTbvcs?=

=?Windows-1252?Q?Jc7+XXC6xKwtA03gdfn5k6z7Azfv9diM4BhTpO9wTf2TV/3lFVHQn1qY?=

=?Windows-1252?Q?9u4H+tK0ZvXIKoDnGaOBOK2Y8CZ1FAa5zF0CU4AFHHi/IrEedMdGuEXQ?=

=?Windows-1252?Q?9AqguCB+lef/TypnDvZtx13HrDGiKt2ItyotuzfC6E78YwJZg7mYfJ3g?=

=?Windows-1252?Q?BQxQRjUGKzqVqBEvED9AVtssZTToDwTsT7DSdFF0/sMOe7XNAXwgafNB?=

=?Windows-1252?Q?2i7/s3iSyA+dbXNDorGqmCBIuPmvQ2wPfdKi9QhDPhAXnh+tbI1mow+y?=

=?Windows-1252?Q?h7UDJc5uajL9Ko5NeqBDdogiTCBBhZlOYh8EnEaF+WXPSrrkYV1bX2vm?=

=?Windows-1252?Q?gWGlbwi6Lwwz++DWDgTa6TGseuCVq7yTasfjLwc5Ep+91LmxNz07p00F?=

=?Windows-1252?Q?7AZvTKK5JMdU8SyKTpbN5w1Ef5q6ZoYyZAT269S40HAeZ0taoXOlsro6?=

=?Windows-1252?Q?pdZddson6jxA/r+md0FPvURLA9JVhVQvgzXxCnQBIsuN99AJkT0zWAHo?=

=?Windows-1252?Q?yzFJK+2diFAKDMaVVfXhQmfx+VbJGku/kDTTA4QQpOcDYDE+2E7gAFBK?=

=?Windows-1252?Q?aNXIxhyR366YYgx6hLFtlVV6hWNyM0nojCOPGfShHOyleLCPt/dmDToA?=

=?Windows-1252?Q?BOJzpUdS+PiWcK7ltox65GQ0Q/o0soWr1h+z14AHD+5TTS9OdCF4+7Xs?=

=?Windows-1252?Q?dnEyygAHVxz94foHUJ3BkXtOnNTK27e7iv4XUUxtxvMHtbFjeE3GrhIx?=

=?Windows-1252?Q?EL2FDkXaocpG0cEZKaeG0X/E68o7LTuMo508D9gPCg9XKlYxicIUuWO7?=

=?Windows-1252?Q?ENHZSyO1zsIuZCFHhHaCAX+hEJ/wbDl582FebsZGmKifU0+S4rTOKs6I?=

=?Windows-1252?Q?Z07tImZntZq8ueyte77BFo0D0416s4UDVYyGKpGFuU2CtlhZQTMlM7Ll?=

=?Windows-1252?Q?AABJyLqerlpyR2wWi+kuDeMzwCW8aNXfAQPVtnztOfXOAZd88SidrvUH?=

=?Windows-1252?Q?CHcYPesZbxdeiwNd10eE2MJyy31M85ay+WRXK0SsJM5J4hfPUyO7aOQZ?=

=?Windows-1252?Q?jPuTuVIegl5WEP+lr7oqLyoYCz7s/PdZ5MV9wh8zwGKcqCiVLVW2JFvJ?=

=?Windows-1252?Q?KHeTN3HH2gGPJDt1klIhgfjnp5dyD0gqgHWJ5sDBQ4Vq68u5HWADilkV?=

=?Windows-1252?Q?DAyRmhXSdHzQ2uiEFkmsRuLYbY7v6cvLaq0=3D?=

Content-Type: multipart/alternative;

boundary="_000_JH0PR04MB84924B298BCED06D54C2F9C5D7DD2JH0PR04MB8492apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: JH0PR04MB8492.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: f7ee6160-8259-417a-a460-08dd63e50faf

X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2025 17:16:01.7968

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY0PR04MB6495

--_000_JH0PR04MB84924B298BCED06D54C2F9C5D7DD2JH0PR04MB8492apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable

Hi,

Can i send you Report of those Errors

Thank you

From: Mae Nolan

Sent: Dec 27, 2024 5:51 PM

Subject: Re: can i..$

Hi,

I' was Going your website. i identified some errors on your website and cau=

ses of those errors your website ranking is collapse down.

If Interested may i send you screenshot of those errors and We can also hel=

p improve your site=92s visibility on Google=92s first page.

May I send you SEO proposal & price list?

Regard

--_000_JH0PR04MB84924B298BCED06D54C2F9C5D7DD2JH0PR04MB8492apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable

252">

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

Hi,

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

Can i send you Repor=

t of those Errors

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

Thank you

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

From: Mae Nolan

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

Sent: Dec 27, 2024 5:51 PM

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

Subject: Re: can i..$

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

Hi,

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

I' was Going your website. i identified some errors on your website and cau=

ses of those errors your website ranking is collapse down.

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

If Interested may i send you screenshot of those errors and We =

can also help improve your site=92s visibility on Google=92s first page.
iv>

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

May I send you SEO proposal & price list?

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

margin: 0px; font-family: "Trebuchet MS", Trebuchet, sans-serif; =

font-size: 12pt; color: rgb(0, 0, 0);">

Regard

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

--_000_JH0PR04MB84924B298BCED06D54C2F9C5D7DD2JH0PR04MB8492apcp_--

Categories: Microsoft Outlook Hotmail Spam

0 Comments

Desperation spam from Google Gmail
Posted by Dave Yadallee on Saturday, March 15. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 15 Mar 2025 08:23:00 -0600

Received: from mail-pj1-f49.google.com ([209.85.216.49]:52680)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1ttSPH-00000000O7g-49iu

for dave@doctor.nl2k.ab.ca;

Sat, 15 Mar 2025 08:22:41 -0600

Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-3014cb646ecso744901a91.1

for ; Sat, 15 Mar 2025 07:20:36 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1742048431; x=1742653231; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=TYueSnSvhqctwtKHsBgaPJ4B+mm1GZmqvdxwv0Ltpk0=;

b=ibziG5cbMbvnH3deAaMpIxGAMq3KJy4M4o/89fonGixrf4XEpsjwU9bMi/TSJ5QC/M

FPRLjcuidlZuUAcMpCVw0yAu9q0TMfv7JOZ9bPegQOHTqsg5zfBOEUE2oLrS7mn1QG1m

OrvWcvVqGZHeP60hH6iGb6IEWbymEHtNfTmIUq9UURXvi6GxbiHOrnuziQT24HN++Phz

ekicb9V/2hnOC90nRzZ4SkSZV99jbMTSROZl373XfXypKpKJZSbyQi0RCjAv2ecjdZ6Z

lyb7naLD9nRdQxy+2LEZHd4V/mOy21/38WZy7PIgykrYto/ccunUkcT0Woi1pIyl/VDE

ZRsw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1742048431; x=1742653231;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=TYueSnSvhqctwtKHsBgaPJ4B+mm1GZmqvdxwv0Ltpk0=;

b=Y5aPKMKr8BNIq2A2Jopdk8nBgIv1n3yxv1rRuO39kP0Otto9/5frajW6Q1DS0rhINM

61a9cPT7A2umTmFcRLHlRj+R/T2uF1b33eXQEr0BFbbVolLNxZ5tAVhKlRk0cc5jECOS

MbBzvM/dvhucrbBCiScGeX5E9Gg/3uC3ct5+83sRc7RlPbt83rv/GHI/CLd3EjE/60T0

M5IsLlwCaisRlUOzzGNetGxuIVYiVRJRK7K5tegnqi94ofZJUrQCpqxwNUGJCcXWGvh+

25+v0BjDNPDy+fTnVZPfO4aVMdlOp2LxZB8xrrkImqrBXOYACuu4yK1qPzsclBKL7QfO

MdCA==

X-Forwarded-Encrypted: i=1; AJvYcCXCIyhMh1WpJBTPk2bB5a3NeT82tYk9kLkECsA+/4Fw6DcAOK2u3PQvTPDktLnXAnk3FgFz@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YzlTrIBytjkb+lki7H4VFNGZvD1riu0uXdrzdFXmLlULjdVmswl

1ys97YwCQAZCdo09nVleZ167/FQdOeThZrZrOULOmltQMQyhwJQJiPUyNNS8CEz1WBi/UnU7Vai

lrqoW9aj/lKjfeZqIhCLv/ihelg==

X-Gm-Gg: ASbGnctCe1DT9I47VMsL4ohmHgELLi/PaiVU/ekYIdu0im96igoRKr+uuD5kU+9WDFP

MzY0wgyHUlqR5i2Yu31OGJtakTE9k35Ebs0mLs+bUEhWRQ5nuo6arBkmy7P2Bynzi5jEZoUnA7x

PyAsZ/9ez9gRPqlSitspwoGi/v

X-Google-Smtp-Source: AGHT+IE+94UuE5SAxCFBGF/aR8rZdjAj5fddSw3WE7ITmIErbrYTZXFoY9/fFz7Ymz1HcL8QcqSKppAKFO2f5oXAT9s=

X-Received: by 2002:a17:90a:fc4f:b0:2fa:15ab:4de7 with SMTP id

98e67ed59e1d1-30151ce15a6mr9331788a91.12.1742048430993; Sat, 15 Mar 2025

07:20:30 -0700 (PDT)

MIME-Version: 1.0

Reply-To: keenelliana@gmail.com

From: Keen Elliana

Date: Sat, 15 Mar 2025 15:20:19 +0100

X-Gm-Features: AQ5f1JpPWn7VArRxRsPMNO8-zF4wt4PMcGMrweDJ0JXLk9AS8eXWsXqwej49Dhw

Message-ID:

Subject: Good day

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000e936db0630624118"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 10.2

X-Spam_score_int: 102

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: An email was sent to you sometime last week with the expectation

of having a return email from you but to my surprise you never bothered to

reply. Kindly reply for further explanations. Respectfully yours, Keen Elliana.

Content analysis details: (10.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.216.49 listed in will-spam-for-food.eu.org]

[209.85.216.49 listed in will-spam-for-food.eu.org]

[209.85.216.49 listed in will-spam-for-food.eu.org]

[209.85.216.49 listed in will-spam-for-food.eu.org]

[209.85.216.49 listed in will-spam-for-food.eu.org]

[209.85.216.49 listed in will-spam-for-food.eu.org]

[209.85.216.49 listed in will-spam-for-food.eu.org]

[209.85.216.49 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.49 listed in dnsbl.ahbl.org]

[209.85.216.49 listed in dnsbl.ahbl.org]

[209.85.216.49 listed in dnsbl.ahbl.org]

[209.85.216.49 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.49 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.49 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.49 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.49 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.49 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.49 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[hestherthembile777(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[hestherthembile777(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

2.5 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

Subject: {SPAM?} Good day

--000000000000e936db0630624118

Content-Type: text/plain; charset="UTF-8"

An email was sent to you sometime last week with the expectation of

having a return email from you but to my surprise you never bothered to

reply.

Kindly reply for further explanations.

Respectfully yours,

Keen Elliana.

--000000000000e936db0630624118

Content-Type: text/html; charset="UTF-8"

An email was sent to you sometime last week with the expectation of
having a return email from you but to my surprise you never bothered to reply.
Kindly reply for further explanations.

Respectfully yours,
Keen Elliana.

--000000000000e936db0630624118--

Categories: Google Gmail Spam

0 Comments

French language Canada post phish from sendgrid.net
Posted by Dave Yadallee on Saturday, March 15. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 14 Mar 2025 20:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1ttHSv-000000007mt-0Hqw

for dave@doctor.nl2k.ab.ca;

Fri, 14 Mar 2025 20:41:33 -0600

Resent-From: The Doctor

Resent-Date: Fri, 14 Mar 2025 20:41:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from o11.ptr9104.mytimemail.mytime.com ([149.72.42.66]:12512)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1ttGDj-00000000Gq2-1yMV

for doctor@doctor.nl2k.ab.ca;

Fri, 14 Mar 2025 19:21:55 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mytime.com;

h=from:subject:mime-version:reply-to:to:content-type:

content-transfer-encoding:cc:content-type:from:subject:to;

s=m1; bh=L/k5jsWZgNRlAFsYMReaw3+hr/Yij2FUVtwXWMz7FtI=;

b=DR+cKWxYsO6jzhPMD0nIfZaVWGA7VUYUexx0nRByi4gYIuX8GXBLEGbTcnNtu6+dyqiN

inY2FrYBwRcvvIBT2aGVnA6Ao6BDH2EI8Vi3lyPix7XMZEkAZ+fhWpJnZ9py93MmNK96mR

nRqeYbK+ZAEy5Ki/t7uTEdtSQoonnLSDQ=

Received: by recvd-54dcf78dc9-nqj2d with SMTP id recvd-54dcf78dc9-nqj2d-1-67D4D5B2-54

2025-03-15 01:19:46.939996672 +0000 UTC m=+3836143.668836354

Received: from mytime.com (unknown)

by geopod-ismtpd-33 (SG) with ESMTP

id Vczk-pO7R768IvEVa3tl7Q

for ;

Sat, 15 Mar 2025 01:19:46.902 +0000 (UTC)

Date: Sat, 15 Mar 2025 01:19:46 +0000 (UTC)

From: Postes livraison

Message-ID: <67d4d5b2bf62a_8f1a36b4481139@2fb265cee77a.mail>

Subject: Confirmez vos =?UTF-8?B?ZMOpdGFpbHM=?= de livraison

Mime-Version: 1.0

Reply-To: pritiranjanmallik7@gmail.com

X-SG-EID:

=?us-ascii?Q?u001=2EBGdfhnQdKWMazd5NZ=2FpGu88TId8PBEhTrsr8E1Wql9J1OR7ZVkellRYdJ?=

=?us-ascii?Q?fsufZWrZaQcZXkUB3ODiYPRBsCgrn2ewkPFBo8=2F?=

=?us-ascii?Q?CNe0AP9KlZkGLhqQLytTjTh1xIu0Ni6YrBCOGtq?=

=?us-ascii?Q?GVA+iBAfj=2FFP98FTnrzf953qr4zAZRFkAv3PJrS?=

=?us-ascii?Q?IOYz7sfGTYKfN7Oe0U4OyGODETSNLkKs+zoI5Fu?=

=?us-ascii?Q?ywVXEQBoDchXSAYAMYPMGGAPuMUDVtdvHWQQIHc?=

=?us-ascii?Q?XM3Am1WCcv4Ce9aHe7Zl1m5nnQ=3D=3D?=

X-SG-ID:

=?us-ascii?Q?u001=2ESdBcvi+Evd=2FbQef8eZF3BmPY44iW6Nu7tZIBPyvVvSqyZHffzXGS6R0xV?=

=?us-ascii?Q?8OUhgDfYEMjufRptlTqR7jIJVQMNORzgRyBJvLr?=

=?us-ascii?Q?fcc4IeczC4VCdn=2F9drd7fMhpkzeAdlpHhJvuMde?=

=?us-ascii?Q?1F+HNShMwRYQ375HfRwBJ7CFJPPHXovk0u=2FnAN+?=

=?us-ascii?Q?fBJtTtw2DgKD83lYgn?=

To: doctor@doctor.nl2k.ab.ca

X-Entity-ID: u001.xp2kuch8wT2KEew8bk4qAg==

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 25.2

X-Spam_score_int: 252

X-Spam_bar: +++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Postes livraison 08249963746 Vоtrе соlіѕ (CA09128034)

еn рrоvеnаnсе dеѕ États-Unis est actuellement en transit et a atteint

le dédouanement.

Content analysis details: (25.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

[149.72.42.66 listed in dnsbl.ahbl.org]

[149.72.42.66 listed in dnsbl.ahbl.org]

[149.72.42.66 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[149.72.42.66 listed in sa-trusted.bondedsender.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[149.72.42.66 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[149.72.42.66 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.42.66 listed in bl.score.senderscore.com]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[pritiranjanmallik7(at)gmail.com]

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

2.5 UNICODE_OBFU_ASC Obfuscating text with unicode

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Confirmez vos =?UTF-8?B?ZMOpdGFpbHM=?= de livraison

w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

e">

0">

=

.png">

0" cellpadding=3D"0" align=3D"center" style=3D"margin:0 auto;max-width:610p=

x">

=C2=A0

g=3D"0" style=3D"min-width:100%">

=C2=A0

"http://www.mytime.com/assets/email_assets/reengagement/corners-top.png" wi=

dth=3D"600" alt=3D"" style=3D"display:block;width:100%;max-width:600px;max-=

height:31px">

g=3D"0" style=3D"min-width:100%">

1px;line-height:1px">

" cellpadding=3D"0" style=3D"min-width:100%">

e-height:1px">=C2=A0

spacing=3D"0" cellpadding=3D"0" style=3D"border-bottom:1px solid #e7e7e7;mi=

n-width:100%">

=C2=A0

r=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"min-width:100%">

ize:0;text-align:center">

s=3D"t-width" width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"=

0" style=3D"max-width:170px;display:inline-block;vertical-align:middle">

height=3D"10" style=3D"font-size:1px;line-height:1px">=C2=A0

align=3D"center" style=3D"width:170px; height:112px">

=

pc-main-logo-EN_2x.png?1741987988" width=3D"170" height=3D"41" alt=3D"" sty=

le=3D"display:block;border:none;max-height:100%;max-width:100%;">

d>

height=3D"10" style=3D"font-size:1px;line-height:1px">=C2=A0

"t-width" width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" s=

tyle=3D"display:inline-block; vertical-align:middle; max-width:360px;">

class=3D"t-none" width=3D"20">=C2=A0

=

=

=

=

=

=

=

=

=

=

=

=

=

=20

=

=20

=

=

=

able>

ble width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=

=3D"min-width:100%">

=

=C2=A0

family:Verdana, Arial, sans-serif;font-size:20px;line-height:24px">Postes l=

ivraison

=C2=A0

ont-family:Verdana, Arial, sans-serif;font-size:14px;line-height:18px">0824=

9963746

=C2=A0

ss=3D"t-none" width=3D"20">=C2=A0

=C2=A0

spacing=3D"0" cellpadding=3D"0" style=3D"min-width:100%">

=C2=A0

-family:Verdana, Arial, sans-serif;font-size:14px;line-height:20px">

cellpadding=3D"0" bgcolor=3D"#f0f0f0">

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px;">
arial, sans-serif; text-decoration: underline;" name=3D"ENGLISH_VERSION"><=

/a>

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
-width: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=

=3D"0">

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
-width: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=

=3D"0"><=

/tr>

ca, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing: 0=

.03125em; line-height: 24px;" bgcolor=3D"#ffffff">
h: 0px; max-width:539px;" src=3D"https://www.canadapost.ca/cpo/mc/emails/cp=

c/images/Chevrons_Image_600x125@2x_Opt2.png" alt=3D"" width=3D"100%">

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
idth: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"=

0">

arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.031=

25em; line-height: 24px; padding: 48px 24px 64px;" bgcolor=3D"#ffffff">
le class=3D"cpc-main-content" border=3D"0" width=3D"100%" cellspacing=3D"0"=

cellpadding=3D"0">

tica, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing:=

0.03125em; line-height: 24px; padding-bottom: 24px;">

V=D0=BEtr=D0=B5 =D1=81=D0=BEl=D1=96=D1=95 (CA09128034) =

=D0=B5n =D1=80r=D0=BEv=D0=B5n=D0=B0n=D1=81=D0=B5 d=D0=B5=D1=95 =C3=89tats-U=

nis=C2=A0est actuellement en transit et a atteint le d=C3=A9douanement.

Afin d'assurer une livraison sans faille, nous sollicitons votre aide po=

ur r=C3=A9gler les droits de douane et taxes n=C3=A9cessaires, pour un mont=

ant total de 0,99 $. Veuillez proc=C3=A9der au paiement en=

utilisant le lien fourni dans les meilleurs d=C3=A9lais.

D=C3=A8s confirmation du paiement, votre colis sera rapidement trait=C3=

=A9 pour la livraison finale.

tica, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing:=

0.03125em; line-height: 24px; padding-bottom: 24px;">=C2=A0

tica, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing:=

0.03125em; line-height: 24px; padding-bottom: 24px;">

<=

tbody>

3333; font-family: roboto, helvetica, arial, sans-serif; font-size: 16px; f=

ont-weight: 300; letter-spacing: 0.03125em; line-height: 24px; text-align:l=

eft;" bgcolor=3D"#0467c6">
s=3D"Object" role=3D"link">
dius: 3px; color: #ffffff; display: inline-block; font-family: roboto, helv=

etica, arial, sans-serif; font-weight: 400; padding: 9px 19px; text-align: =

center; text-decoration: none;" href=3D"https://u528919.ct.sendgrid.net/ls/=

click?upn=3Du001.NDErwtlgSFQ1g1vOEogvwXclqdha-2FC92Hc-2BBc8MKklnoesiOtjXAwx=

qJhlmjz6OiBeo1_GyWe1RRaaz-2B-2B-2Bm2R4SiSUcHZOTY4dgdpSVRaTGu9ktMpGRw6oPin1j=

slNHpFpJkAA-2BatGGMBPWPz5OnVvWTTpbaXI52EMa9AKOmjj0oDC03Drmbrmfxk2bX4idoZ-2B=

HSG9hvoSPNXsfSR3M1K-2BE-2FWLKU8g99-2FBT72YQI5-2BrqV-2BbY5N97-2B5jcEwotpSq5V=

w5BSfNFOIZLuCVsUiEAkls5b3Xj8kNuqJ5IUDYoi0uyP4QTSPIxhM53duVHoKLLq9CPbgxbAOpg=

wvaCYh15pt9-2BOQexzZTpMYro2MRAYMRT7ovyXh04MYIqSdIEO-2F-2B-2F4iMWtZpXtT5d2C9=

2a-2FcYjSnOW0LuSnCFFOirUkz-2FxjA-2BY3dpXvMNM7n8cTK2Z-2B8R9Ht76" target=3D"_=

blank" rel=3D"nofollow noopener noreferrer">Envoyer Mon Colis=C2=A0
an>

=C2=A0

Merci pour votre action rapide

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
-width: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=

=3D"0" bgcolor=3D"#666666">

>

ily: roboto, helvetica, arial, sans-serif; font-size: 16px; font-weight: 30=

0; letter-spacing: 0.03125em; line-height: 24px; padding: 48px 24px 24px;" =

bgcolor=3D"#666666">

0px 24px;">=D0=A0=D0=BE=D1=95t=D0=B5=D1=95 =D0=A1=D0=B0n=D0=B0d=D0=B0 =D0=

=B5nv=D0=BE=D1=96=D0=B5 d=D0=B5=D1=95 =D0=B0v=D1=96=D1=95 =D1=80=D0=B0r =D1=

=81=D0=BEurr=D1=96=D0=B5l =C3=A0 la demande de l'exp=C3=A9diteur ou du dest=

inataire. =D0=A0=D0=BE=D1=95t=D0=B5=D1=95 =D0=A1=D0=B0n=D0=B0d=D0=B0 peut =

=C3=A9galement envoyer des courriels de suivi pour confirmer les d=C3=A9tai=

ls de la transaction.

0px 24px;">=C2=A0

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 48px 24px 0px;" bgcolor=3D"#666666">
_PREFIX_DWT59_com_zimbra_url" class=3D"Object" role=3D"link">
lor: #f0f0f0; font-family: roboto, helvetica, arial, sans-serif; text-decor=

ation: underline;" href=3D"#" target=3D"_blank" rel=3D"nofollow noopener no=

referrer">canadapost.ca

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 0px 24px 16px;" bgcolor=3D"#666666">2701 Riverside =

Drive, Ottawa ON=C2=A0=C2=A0K1A 0B1

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 0px 24px 16px;" bgcolor=3D"#666666">

>
rif; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=3D"nofol=

low noopener noreferrer">Accessibility=C2=A0=C2=A0|=C2=A0=C2=A0<=

span id=3D"OBJ_PREFIX_DWT61_com_zimbra_url" class=3D"Object" role=3D"link">=

if; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=3D"nofoll=

ow noopener noreferrer">Legal=C2=A0=C2=A0|=C2=A0=C2=A0
=3D"OBJ_PREFIX_DWT62_com_zimbra_url" class=3D"Object" role=3D"link">
e=3D"color: #f0f0f0; display: inline-block; font-family: roboto, helvetica,=

arial, sans-serif; text-decoration: underline;" href=3D"#" target=3D"_blan=

k" rel=3D"nofollow noopener noreferrer">Privacy=C2=A0=C2=A0|=C2=

=A0=C2=A0
=3D"link">
, sans-serif; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=

=3D"nofollow noopener noreferrer">Support

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 0px 24px 48px; text-align:bottom;" v=3D"" bgcolor=

=3D"#666666">

=C2=A9 Canada Post Corporation
d=3D"OBJ_PREFIX_DWT64_com_zimbra_url" class=3D"Object" role=3D"link">
le=3D"color: #f0f0f0; font-family: roboto, helvetica, arial, sans-serif; te=

xt-decoration: underline;" href=3D"#" target=3D"_blank" rel=3D"nofollow noo=

pener noreferrer">

family: roboto, helvetica, arial, sans-serif; font-size: 16px; font-weight:=

300; height: 0px; letter-spacing: 0.03125em; line-height: 0;" bgcolor=3D"#=

666666">
=3D"link">
, sans-serif; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=

=3D"nofollow noopener noreferrer">
-align: bottom;" src=3D"https://www.canadapost.ca/cpo/mc/emailcampaigns/cpc=

/images/canada_logo.png" alt=3D"Canada" width=3D"100%">

5ce8c,bbde0fa,1" alt=3D"" width=3D"100%" height=3D"0">

=C2=A0

e-height:1px">=C2=A0

" cellpadding=3D"0" style=3D"min-width:100%">

=C2=A0

f" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-radius:=

5px;min-width:100%">

=C2=A0

r=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"min-width:100%">

=

=C2=A0

nter" style=3D"font-family:Verdana, Arial, sans-serif;font-size:14px;font-w=

eight:bold">
-2BXvV-2FCgmOY7AZE1j6CXqVSxcZ-2BSV57r-2BzsZ28q2uZiLOtsQjdrC-2BAB-2FFXXENku0=

JFtaNEtaJj70oJ7aVI2ObpMT-2FGavDi-2BsMnuo6orYqEw479YJYk1an31fon1wiqaV8qGnUr5=

WbBTz7lGarDv0h2o6yLRb-2BkJzj3zV466rDX8JDXkO83fH2oe-2FvGPOvTqr14lEi_GyWe1RRa=

az-2B-2B-2Bm2R4SiSUcHZOTY4dgdpSVRaTGu9ktMpGRw6oPin1jslNHpFpJkAA-2BatGGMBPWP=

z5OnVvWTTpbaXI52EMa9AKOmjj0oDC03Drmbrmfxk2bX4idoZ-2BHSG9hvoSPNXsfSR3M1K-2BE=

-2FWLKU8g99-2FBT72YQI5-2BrqV-2BbY5N97-2B5jcEwotpSq5Vw5BSR6i6oOqfsdMk5v-2BwM=

7iOc0LGNpw0Nga1LjCph-2FrhVC5KCxx4epgTqzbojbgaZeLwlT6lmiIEaZgoAMb50qCbAPqboI=

9h35fYJA-2FijMEm6WiXonWh9FB9NspDMxPOrhmwRExHLavBPFWWC0S9U63cguITUXFPbKI-2BP=

LCGiHLnATPtp2uUYNq-2FFu3a04n0SQKS" target=3D"_blank" style=3D"color:#339fb4=

;text-decoration:none">
ft.png" width=3D"180" height=3D"45" alt=3D"powered by mytime" style=3D"disp=

lay:block;border:none">

0">=C2=A0

" style=3D"color:#4f4f4f;font-family:Verdana, Arial, sans-serif;font-size:1=

2px;line-height:18px">

This email has =

been sent on behalf of Postes livraison, Nayabazar Bidyadharpur, Cuttack Co=

llege, Cuttack, ODISHA 753004.

You can

https://u528919.ct.sendgrid.net/ls/click?upn=3Du001.-2BXvV-2FCgmOY7AZE1j6CX=

qVV2wf-2F5S5-2BKT9FKhWnWtVdKVM46af2m5SQRuHVogpkkZ2zmCx-2FtOFEIcv6bo07i4gey9=

G-2FKmj-2BgNhJnDzVJymYF8b2xtaGbmgHusVxm-2F-2FfBTGkN6_GyWe1RRaaz-2B-2B-2Bm2R=

4SiSUcHZOTY4dgdpSVRaTGu9ktMpGRw6oPin1jslNHpFpJkAA-2BatGGMBPWPz5OnVvWTTpbaXI=

52EMa9AKOmjj0oDC03Drmbrmfxk2bX4idoZ-2BHSG9hvoSPNXsfSR3M1K-2BE-2FWLKU8g99-2F=

BT72YQI5-2BrqV-2BbY5N97-2B5jcEwotpSq5Vw5BSaQzSdioTM6VOFydGvJrYwMDp4UfU9SQ7D=

51aYmZwqHZVBr27WePqJUao2k4dono0ZD2SKIsg3NSfrU0hZpGg0UTGpeaYySENKB1-2FBv9E5J=

rCzVOrJ0Ni-2F4wmzP9Kf0WHq4YPT9Wk1MO7p-2B-2F9ZdPPosEJ0-2F1ELllHVJHG2lS4djSRj=

XMNQ8bAKTWXjmjtz7zn" target=3D"_blank" style=3D"color:#319fb5;text-decorati=

on:none">login to MyTime to manage your preferences.

=

=C2=A0

rder-bottom: 1px solid #e1e1e1" height=3D"5">=C2=A0

0">=C2=A0

nter" style=3D"color:#4f4f4f;font-family:Verdana, Arial, sans-serif;font-si=

ze:12px;line-height:18px">

Don't want =

further communications from this business?
endgrid.net/ls/click?upn=3Du001.-2BXvV-2FCgmOY7AZE1j6CXqVYDk5MieSqSVEymGwVR=

uDrUlR5Yw-2BZNuL8qnnf4R-2Fo62gmELHeM7bOCNdg7SdFgNHVqO83yaj7yyUZp4do0HU-2Bkl=

0QYB1v7Ead-2F3Fb3GFLukODVazNP-2FQwM82WK8YSNN2rZ-2F4XKfDHiezOdA-2FpmsnlohNjk=

asjX-2FIxMxx9v1FVa5vL7PzLu2lVh-2BzRNKPZKk9MDrveTDOdYSdAExUXJZ2-2FU9R-2FpiU0=

krcROG-2B9IznMRDKkrarNa97YN7PR-2B8mNH4lMuTYLMmcheKtjLqX3SXpK-2FFbV31F9NlzEV=

uUbmTv-2BLF-2BqsPGgetxaWvKIl-2FZ1CeIowFOioFFUkFTcnLBSmQkv1ONYV6iF5qo6RxEJAb=

NmnBDTr-2FuMK2Zpn1cSPQz7A0yiAItTzGn161GFX2-2BgeGTM9MmMirbeEhgCKCGTOSQzLmrK4=

R-2FHRcAUJVJ3t8AdWWEA-3D-3DW9zI_GyWe1RRaaz-2B-2B-2Bm2R4SiSUcHZOTY4dgdpSVRaT=

Gu9ktMpGRw6oPin1jslNHpFpJkAA-2BatGGMBPWPz5OnVvWTTpbaXI52EMa9AKOmjj0oDC03Drm=

brmfxk2bX4idoZ-2BHSG9hvoSPNXsfSR3M1K-2BE-2FWLKU8g99-2FBT72YQI5-2BrqV-2BbY5N=

97-2B5jcEwotpSq5Vw5BSwAGKR5pUGlmteuUtR2JMOnavF4CtHgsmU2i-2BnIKoXn-2Bqkus95t=

9N7X32rrUoRot7gO2SIXoMtUtshIHhFhamIUhgvr6tgjT6ys4E3tqlt3cKz709G4pM3AUfLN-2F=

g8EQLxWETYomEwsqyp7Pi-2Bhe94Ex0QEnYDg8tcgD1ba-2FqzrMbXlMYBa8HpSnq2HpHr-2FK6=

" target=3D"_blank" style=3D"color:#319fb5;text-decoration:none">Unsubscrib=

e

0">=C2=A0

=C2=A0

=C2=A0

1px;line-height:1px">

g=3D"0" style=3D"min-width:100%">

"http://www.mytime.com/assets/email_assets/reengagement/corners-bottom.png"=

width=3D"600" alt=3D"" style=3D"display:block;width:100%;max-width:600px;m=

ax-height:20px">

=C2=A0

=C2=A0

20dbI9Z6QKeFEUiu7Ze4oT3Osa2V9TbD2QPW5eWMnKLKx8udQRezHn1fRJ6uBsM9moZpq7h-2FF=

KcdlgZyjfSaR07nn8f3hDTfchF5N56EEpNbXE-2BJufnsA05fGTJyknxUx4ZUOm00jiYcm-2FIv=

o78tnKDEFR9NdN-2FinLmCWvu-2F6l-2BLATipZxTiliVM6fzm4K8FWmzPqJDOdp1FwCPdpLXkn=

Ckxo-2BdaaG6AYVnGlP1l36TGccqc1yWiuPwyq-2B-2FGJMPHiixEyvtcwfqK-2F06-2Bt818Sk=

KdFgDLyfvLnLQsErvCtZfsV1VbviK1zajLrtSy1eBWYQIjnKfYQWES9Pm7u5-2BGgq7GdOSB41P=

0WwNECqMNfEc6IASAcdBC" alt=3D"" width=3D"1" height=3D"1" border=3D"0" style=

=3D"height:1px !important;width:1px !important;border-width:0 !important;ma=

rgin-top:0 !important;margin-bottom:0 !important;margin-right:0 !important;=

margin-left:0 !important;padding-top:0 !important;padding-bottom:0 !importa=

nt;padding-right:0 !important;padding-left:0 !important;"/>

Categories: Phish, sendgrid.net spam and phish

0 Comments

French language Canada post phish from sendgrid.net
Posted by Dave Yadallee on Saturday, March 15. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 14 Mar 2025 20:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1ttHSz-000000007oa-3oPk

for dave@doctor.nl2k.ab.ca;

Fri, 14 Mar 2025 20:41:37 -0600

Resent-From: The Doctor

Resent-Date: Fri, 14 Mar 2025 20:41:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from o11.ptr9104.mytimemail.mytime.com ([149.72.42.66]:13674)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1ttGDj-00000000Gq8-2MG9

for doctor@nl2k.ab.ca;

Fri, 14 Mar 2025 19:21:55 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mytime.com;

h=from:subject:mime-version:reply-to:to:content-type:

content-transfer-encoding:cc:content-type:from:subject:to;

s=m1; bh=bMKT8bbyX1hOMAkVgG1wP/3IZMyqjJNRPGXvpgVWZ+c=;

b=RnnrKo2qMCGc9Z77rYmhNtM+pWSL3vz5eavUAXQuSFrGQQzr0RXWeIyNyVOalK+/qWnQ

wBbz48bWSlSssv2eb+UQ8P9Ok1RVrnDxiODERn4JeQpAd3XDaUjC7q/8XUSjfgqqREEHRc

/mvGztLJJYgjMh3mGQKuKwP8NlRbDPR+s=

Received: by recvd-6d4df46df7-v9dwr with SMTP id recvd-6d4df46df7-v9dwr-1-67D4D5B3-13

2025-03-15 01:19:47.467708811 +0000 UTC m=+10382274.975049481

Received: from mytime.com (unknown)

by geopod-ismtpd-13 (SG) with ESMTP

id Kk9MNtlFQUKZQ1csKCSMRA

for ;

Sat, 15 Mar 2025 01:19:47.384 +0000 (UTC)

Date: Sat, 15 Mar 2025 01:19:47 +0000 (UTC)

From: Postes livraison

Message-ID: <67d4d5b33b360_8fc46a8170877@f114834235ee.mail>

Subject: Confirmez vos =?UTF-8?B?ZMOpdGFpbHM=?= de livraison

Mime-Version: 1.0

Reply-To: pritiranjanmallik7@gmail.com

X-SG-EID:

=?us-ascii?Q?u001=2EBGdfhnQdKWMazd5NZ=2FpGu88TId8PBEhTrsr8E1Wql9J1OR7ZVkellRYdJ?=

=?us-ascii?Q?fsufZWrZaQcZXkUB3ODiYPRBsCgrn2ewkPFBo8=2F?=

=?us-ascii?Q?CNe0AP9KlZkhB=2FCTkRlPaGbq1zOfKMqy6pYkjh0?=

=?us-ascii?Q?2RglYDfPucCSgIAGu0ncPNNadXu1iUMlODduLiN?=

=?us-ascii?Q?bwopNdJaj8+W0SlUi7B6OqGvWIYYwh9Kmzb7ZFZ?=

=?us-ascii?Q?MAizCXo5epY=2Fxd2JcY50J8y3nrNjzOiVPL6wnfE?= =?us-ascii?Q?W5xB?=

X-SG-ID:

=?us-ascii?Q?u001=2ESdBcvi+Evd=2FbQef8eZF3BmPY44iW6Nu7tZIBPyvVvSqyZHffzXGS6R0xV?=

=?us-ascii?Q?8OUhgDfYEMjufRptlTqR7jIJVQMNORzgRyBJvLr?=

=?us-ascii?Q?fcc4IeczC4VCdn=2F9drd7fMhpkzeAdlpHhJvuMde?=

=?us-ascii?Q?1F+HNShMwRYQ370LGCYS9ZRDDOtojvan831ZbGZ?=

=?us-ascii?Q?IlULx9Hr5ZmHdX62Us?=

To: doctor@nl2k.ab.ca

X-Entity-ID: u001.xp2kuch8wT2KEew8bk4qAg==

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 25.2

X-Spam_score_int: 252

X-Spam_bar: +++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Postes livraison 08249963746 Vоtrе соlіѕ (CA09128034)

еn рrоvеnаnсе dеѕ États-Unis est actuellement en transit et a atteint

le dédouanement.

Content analysis details: (25.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[149.72.42.66 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[149.72.42.66 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[149.72.42.66 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.42.66 listed in bl.score.senderscore.com]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

[149.72.42.66 listed in dnsbl.ahbl.org]

[149.72.42.66 listed in dnsbl.ahbl.org]

[149.72.42.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[pritiranjanmallik7(at)gmail.com]

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

2.5 UNICODE_OBFU_ASC Obfuscating text with unicode

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Confirmez vos =?UTF-8?B?ZMOpdGFpbHM=?= de livraison

w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

e">

0">

=

.png">

0" cellpadding=3D"0" align=3D"center" style=3D"margin:0 auto;max-width:610p=

x">

=C2=A0

g=3D"0" style=3D"min-width:100%">

=C2=A0

"http://www.mytime.com/assets/email_assets/reengagement/corners-top.png" wi=

dth=3D"600" alt=3D"" style=3D"display:block;width:100%;max-width:600px;max-=

height:31px">

g=3D"0" style=3D"min-width:100%">

1px;line-height:1px">

" cellpadding=3D"0" style=3D"min-width:100%">

e-height:1px">=C2=A0

spacing=3D"0" cellpadding=3D"0" style=3D"border-bottom:1px solid #e7e7e7;mi=

n-width:100%">

=C2=A0

r=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"min-width:100%">

ize:0;text-align:center">

s=3D"t-width" width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"=

0" style=3D"max-width:170px;display:inline-block;vertical-align:middle">

height=3D"10" style=3D"font-size:1px;line-height:1px">=C2=A0

align=3D"center" style=3D"width:170px; height:112px">

=

pc-main-logo-EN_2x.png?1741987988" width=3D"170" height=3D"41" alt=3D"" sty=

le=3D"display:block;border:none;max-height:100%;max-width:100%;">

d>

height=3D"10" style=3D"font-size:1px;line-height:1px">=C2=A0

"t-width" width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" s=

tyle=3D"display:inline-block; vertical-align:middle; max-width:360px;">

class=3D"t-none" width=3D"20">=C2=A0

=

=

=

=

=

=

=

=

=

=

=

=

=

=20

=

=20

=

=

=

able>

ble width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=

=3D"min-width:100%">

=

=C2=A0

family:Verdana, Arial, sans-serif;font-size:20px;line-height:24px">Postes l=

ivraison

=C2=A0

ont-family:Verdana, Arial, sans-serif;font-size:14px;line-height:18px">0824=

9963746

=C2=A0

ss=3D"t-none" width=3D"20">=C2=A0

=C2=A0

spacing=3D"0" cellpadding=3D"0" style=3D"min-width:100%">

=C2=A0

-family:Verdana, Arial, sans-serif;font-size:14px;line-height:20px">

cellpadding=3D"0" bgcolor=3D"#f0f0f0">

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px;">
arial, sans-serif; text-decoration: underline;" name=3D"ENGLISH_VERSION"><=

/a>

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
-width: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=

=3D"0">

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
-width: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=

=3D"0"><=

/tr>

ca, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing: 0=

.03125em; line-height: 24px;" bgcolor=3D"#ffffff">
h: 0px; max-width:539px;" src=3D"https://www.canadapost.ca/cpo/mc/emails/cp=

c/images/Chevrons_Image_600x125@2x_Opt2.png" alt=3D"" width=3D"100%">

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
idth: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"=

0">

arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.031=

25em; line-height: 24px; padding: 48px 24px 64px;" bgcolor=3D"#ffffff">
le class=3D"cpc-main-content" border=3D"0" width=3D"100%" cellspacing=3D"0"=

cellpadding=3D"0">

tica, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing:=

0.03125em; line-height: 24px; padding-bottom: 24px;">

V=D0=BEtr=D0=B5 =D1=81=D0=BEl=D1=96=D1=95 (CA09128034) =

=D0=B5n =D1=80r=D0=BEv=D0=B5n=D0=B0n=D1=81=D0=B5 d=D0=B5=D1=95 =C3=89tats-U=

nis=C2=A0est actuellement en transit et a atteint le d=C3=A9douanement.

Afin d'assurer une livraison sans faille, nous sollicitons votre aide po=

ur r=C3=A9gler les droits de douane et taxes n=C3=A9cessaires, pour un mont=

ant total de 0,99 $. Veuillez proc=C3=A9der au paiement en=

utilisant le lien fourni dans les meilleurs d=C3=A9lais.

D=C3=A8s confirmation du paiement, votre colis sera rapidement trait=C3=

=A9 pour la livraison finale.

tica, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing:=

0.03125em; line-height: 24px; padding-bottom: 24px;">=C2=A0

tica, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing:=

0.03125em; line-height: 24px; padding-bottom: 24px;">

<=

tbody>

3333; font-family: roboto, helvetica, arial, sans-serif; font-size: 16px; f=

ont-weight: 300; letter-spacing: 0.03125em; line-height: 24px; text-align:l=

eft;" bgcolor=3D"#0467c6">
s=3D"Object" role=3D"link">
dius: 3px; color: #ffffff; display: inline-block; font-family: roboto, helv=

etica, arial, sans-serif; font-weight: 400; padding: 9px 19px; text-align: =

center; text-decoration: none;" href=3D"https://u528919.ct.sendgrid.net/ls/=

click?upn=3Du001.NDErwtlgSFQ1g1vOEogvwXclqdha-2FC92Hc-2BBc8MKklnoesiOtjXAwx=

qJhlmjz6OiykOA_GyWe1RRaaz-2B-2B-2Bm2R4SiSUSLNNsNhNT8v2yKKPGGyEkKFFEXiogdVEe=

MUuMV3VJwTYkcln3Y2Uc0tLT4Jtu4wJF6Jr2wPDOYFuCDjKf22t9Suhg2IyKjpKtgGlVO3-2BnN=

vGFAbAYRmhVDkbggmJBBfA-2F6Wsmx62ytd1hkF1XI7uHmZQwoSGr9syNIIDrMkz0lY30Um4M9m=

-2FGlqAQ6tIK6uycH11NOUMlLmqSKg4nV6yp-2BDT8KTbXudZIjmT0tw2vlAkUJEIgf50EtuCVK=

UgZvkJ45zKPCZwgSbP841-2FW5jPI9304hyIxFYYBNz8IWvAt1kq9qAHp9h9iy9uYrsCNenByvX=

ylOKDXTpsWpZ55SxH7Y-3D" target=3D"_blank" rel=3D"nofollow noopener noreferr=

er">Envoyer Mon Colis=C2=A0

=C2=A0

Merci pour votre action rapide

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
-width: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=

=3D"0" bgcolor=3D"#666666">

>

ily: roboto, helvetica, arial, sans-serif; font-size: 16px; font-weight: 30=

0; letter-spacing: 0.03125em; line-height: 24px; padding: 48px 24px 24px;" =

bgcolor=3D"#666666">

0px 24px;">=D0=A0=D0=BE=D1=95t=D0=B5=D1=95 =D0=A1=D0=B0n=D0=B0d=D0=B0 =D0=

=B5nv=D0=BE=D1=96=D0=B5 d=D0=B5=D1=95 =D0=B0v=D1=96=D1=95 =D1=80=D0=B0r =D1=

=81=D0=BEurr=D1=96=D0=B5l =C3=A0 la demande de l'exp=C3=A9diteur ou du dest=

inataire. =D0=A0=D0=BE=D1=95t=D0=B5=D1=95 =D0=A1=D0=B0n=D0=B0d=D0=B0 peut =

=C3=A9galement envoyer des courriels de suivi pour confirmer les d=C3=A9tai=

ls de la transaction.

0px 24px;">=C2=A0

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 48px 24px 0px;" bgcolor=3D"#666666">
_PREFIX_DWT59_com_zimbra_url" class=3D"Object" role=3D"link">
lor: #f0f0f0; font-family: roboto, helvetica, arial, sans-serif; text-decor=

ation: underline;" href=3D"#" target=3D"_blank" rel=3D"nofollow noopener no=

referrer">canadapost.ca

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 0px 24px 16px;" bgcolor=3D"#666666">2701 Riverside =

Drive, Ottawa ON=C2=A0=C2=A0K1A 0B1

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 0px 24px 16px;" bgcolor=3D"#666666">

>
rif; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=3D"nofol=

low noopener noreferrer">Accessibility=C2=A0=C2=A0|=C2=A0=C2=A0<=

span id=3D"OBJ_PREFIX_DWT61_com_zimbra_url" class=3D"Object" role=3D"link">=

if; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=3D"nofoll=

ow noopener noreferrer">Legal=C2=A0=C2=A0|=C2=A0=C2=A0
=3D"OBJ_PREFIX_DWT62_com_zimbra_url" class=3D"Object" role=3D"link">
e=3D"color: #f0f0f0; display: inline-block; font-family: roboto, helvetica,=

arial, sans-serif; text-decoration: underline;" href=3D"#" target=3D"_blan=

k" rel=3D"nofollow noopener noreferrer">Privacy=C2=A0=C2=A0|=C2=

=A0=C2=A0
=3D"link">
, sans-serif; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=

=3D"nofollow noopener noreferrer">Support

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 0px 24px 48px; text-align:bottom;" v=3D"" bgcolor=

=3D"#666666">

=C2=A9 Canada Post Corporation
d=3D"OBJ_PREFIX_DWT64_com_zimbra_url" class=3D"Object" role=3D"link">
le=3D"color: #f0f0f0; font-family: roboto, helvetica, arial, sans-serif; te=

xt-decoration: underline;" href=3D"#" target=3D"_blank" rel=3D"nofollow noo=

pener noreferrer">

family: roboto, helvetica, arial, sans-serif; font-size: 16px; font-weight:=

300; height: 0px; letter-spacing: 0.03125em; line-height: 0;" bgcolor=3D"#=

666666">
=3D"link">
, sans-serif; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=

=3D"nofollow noopener noreferrer">
-align: bottom;" src=3D"https://www.canadapost.ca/cpo/mc/emailcampaigns/cpc=

/images/canada_logo.png" alt=3D"Canada" width=3D"100%">

5ce8c,bbde0fa,1" alt=3D"" width=3D"100%" height=3D"0">

=C2=A0

e-height:1px">=C2=A0

" cellpadding=3D"0" style=3D"min-width:100%">

=C2=A0

f" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-radius:=

5px;min-width:100%">

=C2=A0

r=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"min-width:100%">

=

=C2=A0

nter" style=3D"font-family:Verdana, Arial, sans-serif;font-size:14px;font-w=

eight:bold">
-2BXvV-2FCgmOY7AZE1j6CXqVSxcZ-2BSV57r-2BzsZ28q2uZiLOtsQjdrC-2BAB-2FFXXENku0=

JFtaNEtaJj70oJ7aVI2ObpMT-2FGavDi-2BsMnuo6orYqEw479YJYk1an31fon1wiqaV8qGnUr5=

WbBTz7lGarDv0h2o6yLRb-2BkJzj3zV466rDX8JDXkO83fH2oe-2FvGPOvTqr1Xke3_GyWe1RRa=

az-2B-2B-2Bm2R4SiSUSLNNsNhNT8v2yKKPGGyEkKFFEXiogdVEeMUuMV3VJwTYkcln3Y2Uc0tL=

T4Jtu4wJF6Jr2wPDOYFuCDjKf22t9Suhg2IyKjpKtgGlVO3-2BnNvGFAbAYRmhVDkbggmJBBfA-=

2F6Wsmx62ytd1hkF1XI7uHmZQwoSGr9syNIIDrMkz0lY4GPxyu6AD2JlWdRBrQlJRkMY2859sVQ=

vc2ctXj1mXvHH2XNpSVwrlFqFvWhxE9ph5njlyfSKwuvL7lYT3CXZWezRPD5WpzeAjMnIAJDcGJ=

X63BqfBxbhLXSUKZSZFdZlp2quQsrfDIdq0ST9gjx4zefsjtapacPhtG4ttUXupy0-3D" targe=

t=3D"_blank" style=3D"color:#339fb4;text-decoration:none">
//www.mytime.com/assets/email-logo-ft.png" width=3D"180" height=3D"45" alt=

=3D"powered by mytime" style=3D"display:block;border:none">

0">=C2=A0

" style=3D"color:#4f4f4f;font-family:Verdana, Arial, sans-serif;font-size:1=

2px;line-height:18px">

This email has =

been sent on behalf of Postes livraison, Nayabazar Bidyadharpur, Cuttack Co=

llege, Cuttack, ODISHA 753004.

You can

https://u528919.ct.sendgrid.net/ls/click?upn=3Du001.-2BXvV-2FCgmOY7AZE1j6CX=

qVV2wf-2F5S5-2BKT9FKhWnWtVdKVM46af2m5SQRuHVogpkkZ2zmCx-2FtOFEIcv6bo07i4gey9=

G-2FKmj-2BgNhJnDzVJymYF8b2xtaGbmgHusVxm-2F-2FfBTW-Wm_GyWe1RRaaz-2B-2B-2Bm2R=

4SiSUSLNNsNhNT8v2yKKPGGyEkKFFEXiogdVEeMUuMV3VJwTYkcln3Y2Uc0tLT4Jtu4wJF6Jr2w=

PDOYFuCDjKf22t9Suhg2IyKjpKtgGlVO3-2BnNvGFAbAYRmhVDkbggmJBBfA-2F6Wsmx62ytd1h=

kF1XI7uHmZQwoSGr9syNIIDrMkz0lYlwquOBitvtuMwj5VEeuvUJryGd7GZQ9BS-2B1GZeKm5Ik=

Oe4cM85hiXtOPkubPyiM0QzZcRwACYYr6WKQtChbTh3X3-2FD5ok5Umr5regYhtzpgUe7s-2FPF=

iioun0ATl7uPMaF27X8BGVImzhYSpjKmIdhun8YixYhpDEpngl8g4cpSk-3D" target=3D"_bl=

ank" style=3D"color:#319fb5;text-decoration:none">login to MyTime to ma=

nage your preferences.

=

=C2=A0

rder-bottom: 1px solid #e1e1e1" height=3D"5">=C2=A0

0">=C2=A0

nter" style=3D"color:#4f4f4f;font-family:Verdana, Arial, sans-serif;font-si=

ze:12px;line-height:18px">

Don't want =

further communications from this business?
endgrid.net/ls/click?upn=3Du001.-2BXvV-2FCgmOY7AZE1j6CXqVYDk5MieSqSVEymGwVR=

uDrUlR5Yw-2BZNuL8qnnf4R-2Fo62gmELHeM7bOCNdg7SdFgNHVqO83yaj7yyUZp4do0HU-2Bkl=

0QYB1v7Ead-2F3Fb3GFLukODVazNP-2FQwM82WK8YSNN2rZ-2F4XKfDHiezOdA-2FpmsnlohNjk=

asjX-2FIxMxx9v1FVa57dTsJ1n46NrtkB-2BQJY5mesSPtXvwI8puzKcuWpBrCLEAlul36iT4Ln=

vpOMQ-2FMA2eBekeaLz0Qzu4MswAFPBitPBkubDjsVC1w-2Bxn56h-2FxlkGR4d9a-2BB7St4zo=

NvM642xT652mXe-2BjhFGme2CDzTN2SfWduyrWMLvQtWGE5EZVIyg2F6N2k6C7f5I4OuclCR-2F=

I8Gq9QshWcN9pcKcf-2BkHDSpgJi-2BsAaKpKembNf2kfBggsATBOd1khZDnw7cZGJvfG7JNun9=

BUOa1Ucq4TuZ3rg-3D-3DPUV6_GyWe1RRaaz-2B-2B-2Bm2R4SiSUSLNNsNhNT8v2yKKPGGyEkK=

FFEXiogdVEeMUuMV3VJwTYkcln3Y2Uc0tLT4Jtu4wJF6Jr2wPDOYFuCDjKf22t9Suhg2IyKjpKt=

gGlVO3-2BnNvGFAbAYRmhVDkbggmJBBfA-2F6Wsmx62ytd1hkF1XI7uHmZQwoSGr9syNIIDrMkz=

0lYoaXsWYOjy8nx7LBJuP-2BBuCgokdOjznjhoifjRAL4lKAMiPXQF5-2BM9TGWidGAIyaDBdkz=

XFb77s-2FJu0Vdic2WmFPSs6QU7V8f5fsK7aEJGCdcY95YBbFDvPNtw8Htcx1BofoMtsBj0t1DE=

4uw9IobGV1VIiA-2FxZ66Ktqkkr4Zeag-3D" target=3D"_blank" style=3D"color:#319f=

b5;text-decoration:none">Unsubscribe

0">=C2=A0

=C2=A0

=C2=A0

1px;line-height:1px">

g=3D"0" style=3D"min-width:100%">

"http://www.mytime.com/assets/email_assets/reengagement/corners-bottom.png"=

width=3D"600" alt=3D"" style=3D"display:block;width:100%;max-width:600px;m=

ax-height:20px">

=C2=A0

=C2=A0

20dbI9Z6QM-2B1zYdedSRYZN5I9PzIstdT7axCvTR5rLevnD8G-2FcavTcXBgVI1pU98Ntlypq7=

2XxEHIO5MWMBqWXNf5tufoG4rCLwXas3pyz7QgBcBERjGfrwOuVs4yljlsi-2F-2FAb1XNpUvZw=

NlwzISLpJiNrcacWXug11XYCNAvubb5U-2FxY8uQ3ZDklgbzKIn2reNUG9q00MBZhfnzCx-2BPJ=

pwQPNELkOXUqt7qsnfCVwt6HYuTNTs5kx8dQN97Po2lNK6cL1CyavYsUlp-2BTV7k2ROmas4Tq3=

bhYkD7-2Fk26WV-2BwBaoZcamcu1prAxfkjtoedIzlc7ZueHiVxrnWQeaNfHt5sdjXfmQ-3D" a=

lt=3D"" width=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !importan=

t;width:1px !important;border-width:0 !important;margin-top:0 !important;ma=

rgin-bottom:0 !important;margin-right:0 !important;margin-left:0 !important=

;padding-top:0 !important;padding-bottom:0 !important;padding-right:0 !impo=

rtant;padding-left:0 !important;"/>

Categories: Phish, sendgrid.net spam and phish

0 Comments

French language Canada post phish from sendgrid.net
Posted by Dave Yadallee on Saturday, March 15. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 14 Mar 2025 17:46:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1ttEie-00000000Dgs-3VcY

for dave@doctor.nl2k.ab.ca;

Fri, 14 Mar 2025 17:45:36 -0600

Resent-From: The Doctor

Resent-Date: Fri, 14 Mar 2025 17:45:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from o11.ptr9104.mytimemail.mytime.com ([149.72.42.66]:61206)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1ttEBN-000000001E1-40Xs

for doctor@nl2k.ab.ca;

Fri, 14 Mar 2025 17:11:21 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mytime.com;

h=from:subject:mime-version:reply-to:to:content-type:

content-transfer-encoding:cc:content-type:from:subject:to;

s=m1; bh=IsOUBcWwDrIjtlKh5a834Juj7Y13M02gsmqWDecfZAI=;

b=Pa3zAm7Z+RelJO6H/prGnV4TgWXiqCTgbXNyq8Jrs/zcMkhfoOT7PRwiat9BSme4SL9f

SGSuB1pFnNRC29R3dbGDuPdIe7s1A6jTR+Kb4kNIMFp+PZxpyUE3jjRGnYG6kNH9Ki1m9i

Udcxfwe9LyvExsy2e8+DBXs94orvXK9y8=

Received: by recvd-784ff9f57d-bdd8x with SMTP id recvd-784ff9f57d-bdd8x-1-67D4B719-C

2025-03-14 23:09:13.184563018 +0000 UTC m=+3826601.545503045

Received: from mytime.com (unknown)

by geopod-ismtpd-30 (SG) with ESMTP

id 94K6xCdkTTGiDZ-R-9nUGQ

for ;

Fri, 14 Mar 2025 23:09:13.160 +0000 (UTC)

Date: Fri, 14 Mar 2025 23:09:13 +0000 (UTC)

From: Postes livraison

Message-ID: <67d4b71923ae5_8f587c1c1556589@f26333b3a254.mail>

Subject: Confirmez vos =?UTF-8?B?ZMOpdGFpbHM=?= de livraison .

Mime-Version: 1.0

Reply-To: pritiranjanmallik7@gmail.com

X-SG-EID:

=?us-ascii?Q?u001=2EBGdfhnQdKWMazd5NZ=2FpGu88TId8PBEhTrsr8E1Wql9J1OR7ZVkellRYdJ?=

=?us-ascii?Q?fsufZWrZaQcZXkUB3ODiYPRBsCgrn2ewkPFBo8=2F?=

=?us-ascii?Q?CNe0AP9KlZnkLsDb2dsuv45DsoisLBt5X8gtLFJ?=

=?us-ascii?Q?6DH=2FY+Ct7DKd2bU5wA0awDpOwaXIDf5nxOp2x=2FS?=

=?us-ascii?Q?y8R91kA8GjH4jT3vT3K3QA6kApchAXIykEkupT=2F?=

=?us-ascii?Q?n9VO2TKokI4oBmkfp43D1CVdw1MubgizRfjqgec?= =?us-ascii?Q?2071?=

X-SG-ID:

=?us-ascii?Q?u001=2ESdBcvi+Evd=2FbQef8eZF3BmPY44iW6Nu7tZIBPyvVvSqyZHffzXGS6R0xV?=

=?us-ascii?Q?8OUhgDfYEMjufRptlTqR7jIJVQMNORzgRyBJvLr?=

=?us-ascii?Q?fcc4IeczC4VCdn=2F9drd7fMhpkzeAdlpHhJvuMde?=

=?us-ascii?Q?1F+HNShMwRYQ371iPtzqKfY3eE7YLcUVqk+tpvm?=

=?us-ascii?Q?vXvwtjNktAgyqgJHkL?=

To: doctor@nl2k.ab.ca

X-Entity-ID: u001.xp2kuch8wT2KEew8bk4qAg==

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 30.0

X-Spam_score_int: 300

X-Spam_bar: ++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Postes livraison 08249963746 Vоtrе соlіѕ (CA09128034)

еn рrоvеnаnсе dеѕ États-Unis est actuellement en transit et a atteint

le dédouanement.

Content analysis details: (30.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.42.66 listed in will-spam-for-food.eu.org]

[149.72.42.66 listed in will-spam-for-food.eu.org]

[149.72.42.66 listed in will-spam-for-food.eu.org]

[149.72.42.66 listed in will-spam-for-food.eu.org]

[149.72.42.66 listed in will-spam-for-food.eu.org]

[149.72.42.66 listed in will-spam-for-food.eu.org]

[149.72.42.66 listed in will-spam-for-food.eu.org]

[149.72.42.66 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

[149.72.42.66 listed in dnsbl.ahbl.org]

[149.72.42.66 listed in dnsbl.ahbl.org]

[149.72.42.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.42.66 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[pritiranjanmallik7(at)gmail.com]

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 UNICODE_OBFU_ASC Obfuscating text with unicode

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

Subject: {SPAM?} Confirmez vos =?UTF-8?B?ZMOpdGFpbHM=?= de livraison .

w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

e">

0">

=

.png">

0" cellpadding=3D"0" align=3D"center" style=3D"margin:0 auto;max-width:610p=

x">

=C2=A0

g=3D"0" style=3D"min-width:100%">

=C2=A0

"http://www.mytime.com/assets/email_assets/reengagement/corners-top.png" wi=

dth=3D"600" alt=3D"" style=3D"display:block;width:100%;max-width:600px;max-=

height:31px">

g=3D"0" style=3D"min-width:100%">

1px;line-height:1px">

" cellpadding=3D"0" style=3D"min-width:100%">

e-height:1px">=C2=A0

spacing=3D"0" cellpadding=3D"0" style=3D"border-bottom:1px solid #e7e7e7;mi=

n-width:100%">

=C2=A0

r=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"min-width:100%">

ize:0;text-align:center">

s=3D"t-width" width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"=

0" style=3D"max-width:170px;display:inline-block;vertical-align:middle">

height=3D"10" style=3D"font-size:1px;line-height:1px">=C2=A0

align=3D"center" style=3D"width:170px; height:112px">

=

pc-main-logo-EN_2x.png?1741987988" width=3D"170" height=3D"41" alt=3D"" sty=

le=3D"display:block;border:none;max-height:100%;max-width:100%;">

d>

height=3D"10" style=3D"font-size:1px;line-height:1px">=C2=A0

"t-width" width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" s=

tyle=3D"display:inline-block; vertical-align:middle; max-width:360px;">

class=3D"t-none" width=3D"20">=C2=A0

=

=

=

=

=

=

=

=

=

=

=

=

=

=20

=

=20

=

=

=

able>

ble width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=

=3D"min-width:100%">

=

=C2=A0

family:Verdana, Arial, sans-serif;font-size:20px;line-height:24px">Postes l=

ivraison

=C2=A0

ont-family:Verdana, Arial, sans-serif;font-size:14px;line-height:18px">0824=

9963746

=C2=A0

ss=3D"t-none" width=3D"20">=C2=A0

=C2=A0

spacing=3D"0" cellpadding=3D"0" style=3D"min-width:100%">

=C2=A0

-family:Verdana, Arial, sans-serif;font-size:14px;line-height:20px">

cellpadding=3D"0" bgcolor=3D"#f0f0f0">

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px;">
arial, sans-serif; text-decoration: underline;" name=3D"ENGLISH_VERSION"><=

/a>

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
-width: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=

=3D"0">

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
-width: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=

=3D"0"><=

/tr>

ca, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing: 0=

.03125em; line-height: 24px;" bgcolor=3D"#ffffff">
h: 0px; max-width:539px;" src=3D"https://www.canadapost.ca/cpo/mc/emails/cp=

c/images/Chevrons_Image_600x125@2x_Opt2.png" alt=3D"" width=3D"100%">

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
idth: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"=

0">

arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.031=

25em; line-height: 24px; padding: 48px 24px 64px;" bgcolor=3D"#ffffff">
le class=3D"cpc-main-content" border=3D"0" width=3D"100%" cellspacing=3D"0"=

cellpadding=3D"0">

tica, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing:=

0.03125em; line-height: 24px; padding-bottom: 24px;">

V=D0=BEtr=D0=B5 =D1=81=D0=BEl=D1=96=D1=95 (CA09128034) =

=D0=B5n =D1=80r=D0=BEv=D0=B5n=D0=B0n=D1=81=D0=B5 d=D0=B5=D1=95 =C3=89tats-U=

nis=C2=A0est actuellement en transit et a atteint le d=C3=A9douanement.

Afin d'assurer une livraison sans faille, nous sollicitons votre aide po=

ur r=C3=A9gler les droits de douane et taxes n=C3=A9cessaires, pour un mont=

ant total de 0,99 $. Veuillez proc=C3=A9der au paiement en=

utilisant le lien fourni dans les meilleurs d=C3=A9lais.

D=C3=A8s confirmation du paiement, votre colis sera rapidement trait=C3=

=A9 pour la livraison finale.

tica, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing:=

0.03125em; line-height: 24px; padding-bottom: 24px;">=C2=A0

tica, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing:=

0.03125em; line-height: 24px; padding-bottom: 24px;">

<=

tbody>

3333; font-family: roboto, helvetica, arial, sans-serif; font-size: 16px; f=

ont-weight: 300; letter-spacing: 0.03125em; line-height: 24px; text-align:l=

eft;" bgcolor=3D"#0467c6">
s=3D"Object" role=3D"link">
dius: 3px; color: #ffffff; display: inline-block; font-family: roboto, helv=

etica, arial, sans-serif; font-weight: 400; padding: 9px 19px; text-align: =

center; text-decoration: none;" href=3D"https://u528919.ct.sendgrid.net/ls/=

click?upn=3Du001.NDErwtlgSFQ1g1vOEogvwXclqdha-2FC92Hc-2BBc8MKklnoesiOtjXAwx=

qJhlmjz6OiC5uA_GyWe1RRaaz-2B-2B-2Bm2R4SiSUSLNNsNhNT8v2yKKPGGyEkKFFEXiogdVEe=

MUuMV3VJwTYkcln3Y2Uc0tLT4Jtu4wJF6Jr2wPDOYFuCDjKf22t9Suhg2IyKjpKtgGlVO3-2BnN=

vGFAbAYRmhVDkbggmJBBfA9S3MFzbHYHVUB-2F-2FP-2BtjGqAyoCdXLsdyqn1ioSaYyd-2Bjgq=

cV0opBMYv8De0I0J-2BRq1Vt6J1QoiYiqVSNqRxMMgdvBwBadoEjhDG-2F3IjoCdUi9LSeIysCn=

C3qofmqkrXHYcT6kCZT1GXRf3I-2B5Fvhak1T13lhPFbB7d1oW53LQMDhYGGVz2uPfHJlyLSmfr=

lEnrxoiL86hnwWZY9YoRzIB34-3D" target=3D"_blank" rel=3D"nofollow noopener no=

referrer">Envoyer Mon Colis=C2=A0

=C2=A0

Merci pour votre action rapide

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
-width: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=

=3D"0" bgcolor=3D"#666666">

>

ily: roboto, helvetica, arial, sans-serif; font-size: 16px; font-weight: 30=

0; letter-spacing: 0.03125em; line-height: 24px; padding: 48px 24px 24px;" =

bgcolor=3D"#666666">

0px 24px;">=D0=A0=D0=BE=D1=95t=D0=B5=D1=95 =D0=A1=D0=B0n=D0=B0d=D0=B0 =D0=

=B5nv=D0=BE=D1=96=D0=B5 d=D0=B5=D1=95 =D0=B0v=D1=96=D1=95 =D1=80=D0=B0r =D1=

=81=D0=BEurr=D1=96=D0=B5l =C3=A0 la demande de l'exp=C3=A9diteur ou du dest=

inataire. =D0=A0=D0=BE=D1=95t=D0=B5=D1=95 =D0=A1=D0=B0n=D0=B0d=D0=B0 peut =

=C3=A9galement envoyer des courriels de suivi pour confirmer les d=C3=A9tai=

ls de la transaction.

0px 24px;">=C2=A0

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 48px 24px 0px;" bgcolor=3D"#666666">
_PREFIX_DWT59_com_zimbra_url" class=3D"Object" role=3D"link">
lor: #f0f0f0; font-family: roboto, helvetica, arial, sans-serif; text-decor=

ation: underline;" href=3D"#" target=3D"_blank" rel=3D"nofollow noopener no=

referrer">canadapost.ca

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 0px 24px 16px;" bgcolor=3D"#666666">2701 Riverside =

Drive, Ottawa ON=C2=A0=C2=A0K1A 0B1

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 0px 24px 16px;" bgcolor=3D"#666666">

>
rif; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=3D"nofol=

low noopener noreferrer">Accessibility=C2=A0=C2=A0|=C2=A0=C2=A0<=

span id=3D"OBJ_PREFIX_DWT61_com_zimbra_url" class=3D"Object" role=3D"link">=

if; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=3D"nofoll=

ow noopener noreferrer">Legal=C2=A0=C2=A0|=C2=A0=C2=A0
=3D"OBJ_PREFIX_DWT62_com_zimbra_url" class=3D"Object" role=3D"link">
e=3D"color: #f0f0f0; display: inline-block; font-family: roboto, helvetica,=

arial, sans-serif; text-decoration: underline;" href=3D"#" target=3D"_blan=

k" rel=3D"nofollow noopener noreferrer">Privacy=C2=A0=C2=A0|=C2=

=A0=C2=A0
=3D"link">
, sans-serif; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=

=3D"nofollow noopener noreferrer">Support

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 0px 24px 48px; text-align:bottom;" v=3D"" bgcolor=

=3D"#666666">

=C2=A9 Canada Post Corporation
d=3D"OBJ_PREFIX_DWT64_com_zimbra_url" class=3D"Object" role=3D"link">
le=3D"color: #f0f0f0; font-family: roboto, helvetica, arial, sans-serif; te=

xt-decoration: underline;" href=3D"#" target=3D"_blank" rel=3D"nofollow noo=

pener noreferrer">

family: roboto, helvetica, arial, sans-serif; font-size: 16px; font-weight:=

300; height: 0px; letter-spacing: 0.03125em; line-height: 0;" bgcolor=3D"#=

666666">
=3D"link">
, sans-serif; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=

=3D"nofollow noopener noreferrer">
-align: bottom;" src=3D"https://www.canadapost.ca/cpo/mc/emailcampaigns/cpc=

/images/canada_logo.png" alt=3D"Canada" width=3D"100%">

5ce8c,bbde0fa,1" alt=3D"" width=3D"100%" height=3D"0">

=C2=A0

e-height:1px">=C2=A0

" cellpadding=3D"0" style=3D"min-width:100%">

=C2=A0

f" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-radius:=

5px;min-width:100%">

=C2=A0

r=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"min-width:100%">

=

=C2=A0

nter" style=3D"font-family:Verdana, Arial, sans-serif;font-size:14px;font-w=

eight:bold">
-2BXvV-2FCgmOY7AZE1j6CXqVSxcZ-2BSV57r-2BzsZ28q2uZiLOtsQjdrC-2BAB-2FFXXENku0=

JFtaNEtaJj70oJ7aVI2ObpMT-2FGavDi-2BsMnuo6orYqEw479YJYk1an31fon1wiqaV8ePSN-2=

BE-2Fl5G03fc7wQHwHgpQZWTyF4kMzdbi9nRZCwKADK4FcBUBaZXISN5Hmr7-2BDU296_GyWe1R=

Raaz-2B-2B-2Bm2R4SiSUSLNNsNhNT8v2yKKPGGyEkKFFEXiogdVEeMUuMV3VJwTYkcln3Y2Uc0=

tLT4Jtu4wJF6Jr2wPDOYFuCDjKf22t9Suhg2IyKjpKtgGlVO3-2BnNvGFAbAYRmhVDkbggmJBBf=

A9S3MFzbHYHVUB-2F-2FP-2BtjGqAyoCdXLsdyqn1ioSaYyd-2Bjy5QXoEVbN0nwgvRIrv-2FA-=

2Feu9aqrLVopqgk8d-2F5cq-2BO3DQt2NLkaE6lcxPt4Nf1evrNmJVM7sKUoDzrFaPchx-2BLhD=

dP0yFAppqIZ-2BB2rqdbYrF8l1IkFrcqwaU7Lpqtj2gV8aYBdnZtdPy-2BgAzfZ3MTgAZgdsZ5m=

wNanzJT7d1Z0-3D" target=3D"_blank" style=3D"color:#339fb4;text-decoration:n=

one">
80" height=3D"45" alt=3D"powered by mytime" style=3D"display:block;border:n=

one">

0">=C2=A0

" style=3D"color:#4f4f4f;font-family:Verdana, Arial, sans-serif;font-size:1=

2px;line-height:18px">

This email has =

been sent on behalf of Postes livraison, Nayabazar Bidyadharpur, Cuttack Co=

llege, Cuttack, ODISHA 753004.

You can

https://u528919.ct.sendgrid.net/ls/click?upn=3Du001.-2BXvV-2FCgmOY7AZE1j6CX=

qVV2wf-2F5S5-2BKT9FKhWnWtVdKVM46af2m5SQRuHVogpkkZ7DYWPLsB-2FtW0OlQSAvgv1zeu=

ON7oq-2FvApRAfZKiafJGmV6HNHbtUgI6EU-2BwunQWKGvLt_GyWe1RRaaz-2B-2B-2Bm2R4SiS=

USLNNsNhNT8v2yKKPGGyEkKFFEXiogdVEeMUuMV3VJwTYkcln3Y2Uc0tLT4Jtu4wJF6Jr2wPDOY=

FuCDjKf22t9Suhg2IyKjpKtgGlVO3-2BnNvGFAbAYRmhVDkbggmJBBfA9S3MFzbHYHVUB-2F-2F=

P-2BtjGqAyoCdXLsdyqn1ioSaYyd-2BjUvguYjITBiVF743XHdmql3jSgCzHeOKDOeDe5psRA-2=

BF76-2BvSiKMqimOO6XxW9xpEeV8gzx1AvAg4KH-2FLYfApwGc-2FH1ZkEyjoiYwYBfXE0IFYH4=

txzCxkA1Mjo0HYvHSQDFEh3oQzDht1F-2FT-2BvZpvrwqw3PleElSaOslVx6EnqSo-3D" targe=

t=3D"_blank" style=3D"color:#319fb5;text-decoration:none">login to MyTime
a> to manage your preferences.

=

=C2=A0

rder-bottom: 1px solid #e1e1e1" height=3D"5">=C2=A0

0">=C2=A0

nter" style=3D"color:#4f4f4f;font-family:Verdana, Arial, sans-serif;font-si=

ze:12px;line-height:18px">

Don't want =

further communications from this business?
endgrid.net/ls/click?upn=3Du001.-2BXvV-2FCgmOY7AZE1j6CXqVYDk5MieSqSVEymGwVR=

uDrUlR5Yw-2BZNuL8qnnf4R-2Fo62gmELHeM7bOCNdg7SdFgNHVqO83yaj7yyUZp4do0HU-2Bkl=

0QYB1v7Ead-2F3Fb3GFLukODVazNP-2FQwM82WK8YSNN2rZ-2F4XKfDHiezOdA-2FpmsnlohNjk=

asjX-2FIxMxx9v1FVa57dTsJ1n46NrtkB-2BQJY5mesSPtXvwI8puzKcuWpBrCLEAlul36iT4Ln=

vpOMQ-2FMA2eBekeaLz0Qzu4MswAFPBitPBkubDjsVC1w-2Bxn56h-2FxlkGR4d9a-2BB7St4zo=

NvM642xT652mXe-2BjhFGme2CDzTN2SfWduyrWMLvQtWGE5EZVIyg2F6N2k6C7f5I4OuclCR-2F=

I8Gq9QshWcN9pcKcf-2BkHDSf-2BO4NO-2Fn4TVSkNrhTXD5ic6erYzNWv3XrUXtkB-2BfzannG=

9cVdHlHwIe1ZC0JmeNg-3D-3DK6-5_GyWe1RRaaz-2B-2B-2Bm2R4SiSUSLNNsNhNT8v2yKKPGG=

yEkKFFEXiogdVEeMUuMV3VJwTYkcln3Y2Uc0tLT4Jtu4wJF6Jr2wPDOYFuCDjKf22t9Suhg2IyK=

jpKtgGlVO3-2BnNvGFAbAYRmhVDkbggmJBBfA9S3MFzbHYHVUB-2F-2FP-2BtjGqAyoCdXLsdyq=

n1ioSaYyd-2BjfE8bgqPcWlBK30g3OluBauGCmQEHtgVODW-2FcslM8-2FWIkVw-2BzzkNBFN6B=

qFPjJdv3y8YWx1j1ra0JPFM-2BGx-2B-2Bsoe3vc9ZEekqu7Iw41ARLqVFqeMFYcKDsAPjUj5rA=

H5RQrF6kUO87DZNn3nLCXyBK3ASwqpWD9vabYW67jU-2Fqzg-3D" target=3D"_blank" styl=

e=3D"color:#319fb5;text-decoration:none">Unsubscribe

0">=C2=A0

=C2=A0

=C2=A0

1px;line-height:1px">

g=3D"0" style=3D"min-width:100%">

"http://www.mytime.com/assets/email_assets/reengagement/corners-bottom.png"=

width=3D"600" alt=3D"" style=3D"display:block;width:100%;max-width:600px;m=

ax-height:20px">

=C2=A0

=C2=A0

20dbI9Z6QM-2B1zYdedSRYZN5I9PzIstdT7axCvTR5rLevnD8G-2FcavTcXBgVI1pU98Ntlypq7=

2XxEHIO5MWMBqWXNf5tufoG4rCLwXas3pyz7QgBcBERjGfrwOuVs4yljlsi-2F-2FAb1XNn4Lr2=

sD5fxcuYnpK9JINJNIM6E7-2BmklI3gCrNt9MF22jL2kRxyIvqFvn4GQh2zJ8ks6YXwQ5zc17EH=

KCo7Y5DcCNH48HqyryfoXGt8sehzlg-2BsR44SoAcZ01dvw1y3OotnzFRVzcyGbfEHJIHgd61Mr=

cPHt6C7dK-2FKq3Gooy8n29qLqtzRhqK98pHRB-2BaaAq3VgoeB-2FShb-2Fpyb0MitqpGU-3D"=

alt=3D"" width=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !import=

ant;width:1px !important;border-width:0 !important;margin-top:0 !important;=

margin-bottom:0 !important;margin-right:0 !important;margin-left:0 !importa=

nt;padding-top:0 !important;padding-bottom:0 !important;padding-right:0 !im=

portant;padding-left:0 !important;"/>

Categories: Phish, sendgrid.net spam and phish

0 Comments

French language Canada post phish from sendgrid.net
Posted by Dave Yadallee on Saturday, March 15. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 14 Mar 2025 17:46:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1ttEiY-00000000DN1-3sdz

for dave@doctor.nl2k.ab.ca;

Fri, 14 Mar 2025 17:45:30 -0600

Resent-From: The Doctor

Resent-Date: Fri, 14 Mar 2025 17:45:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from o12.ptr124.mytimemail.mytime.com ([149.72.118.95]:28608)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1ttEBO-000000001E3-2Dwc

for doctor@doctor.nl2k.ab.ca;

Fri, 14 Mar 2025 17:11:22 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mytime.com;

h=from:subject:mime-version:reply-to:to:content-type:

content-transfer-encoding:cc:content-type:from:subject:to;

s=m1; bh=R3AxRtHouGvgGs3yDStt1x10jLxV5yfanM9oUdfvsig=;

b=mk9qJYZYWExPYjqBckp47ulvCIO86jpNc91FuU1CPYcr7wrJzN0IAIqNVZKR+jVsS4tH

C8g76oNoIzyCHYNU4I8+EaAIbZ/Zveb4B+Koela/wzDW+h7Db7lpGSZsPNGVMlWE64m9Lq

iHN8hvqN4Kp0YU93IliEUUjAfmKruPWys=

Received: by recvd-5fb76865d7-g8ftl with SMTP id recvd-5fb76865d7-g8ftl-1-67D4B719-8

2025-03-14 23:09:13.23613791 +0000 UTC m=+10374362.140651545

Received: from mytime.com (unknown)

by geopod-ismtpd-2 (SG) with ESMTP

id TRh8GhnqT9aTg9wqF1nXOg

for ;

Fri, 14 Mar 2025 23:09:13.159 +0000 (UTC)

Date: Fri, 14 Mar 2025 23:09:13 +0000 (UTC)

From: Postes livraison

Message-ID: <67d4b71922367_8f4fefac14245bd@b01cf60a53c9.mail>

Subject: Confirmez vos =?UTF-8?B?ZMOpdGFpbHM=?= de livraison .

Mime-Version: 1.0

Reply-To: pritiranjanmallik7@gmail.com

X-SG-EID:

=?us-ascii?Q?u001=2EBGdfhnQdKWMazd5NZ=2FpGu88TId8PBEhTrsr8E1Wql9J1OR7ZVkellRYdJ?=

=?us-ascii?Q?fsufZWrZaQcZXkUB3ODiYPRBsCgrn2ewkPFBo8=2F?=

=?us-ascii?Q?CNe0AP9KlZnattaTTb913ArxJjxFMg0DyFsowxO?=

=?us-ascii?Q?t4J3ZDoPRw5Gk0wV1kgdHW0ALOpcuFkqhs77PGk?=

=?us-ascii?Q?VdW184+9uTRBZTvM3cgfCbzmCjGyTszWuP0AkoV?=

=?us-ascii?Q?9l8kcEs1aQk6Y6nuvbFn06rVigLoZn5DlbzeHbz?=

=?us-ascii?Q?=2F2BNaDfRLI9MBdm8PGaCksIZGw=3D=3D?=

X-SG-ID:

=?us-ascii?Q?u001=2ESdBcvi+Evd=2FbQef8eZF3BmPY44iW6Nu7tZIBPyvVvSqyZHffzXGS6R0xV?=

=?us-ascii?Q?8OUhgDfYEMjufRptlTqR7jIJVQMNORzgRyBJvLr?=

=?us-ascii?Q?fcc4IeczC4VCdn=2F9drd7fMhpkzeAdlpHhJvuMde?=

=?us-ascii?Q?1F+HNShMwRYQ37=2F+6sVhmvDIBR3ulpW0V3t7vrx?=

=?us-ascii?Q?8iESuEb4UDD3=2Fy4Zfc?=

To: doctor@doctor.nl2k.ab.ca

X-Entity-ID: u001.xp2kuch8wT2KEew8bk4qAg==

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 30.0

X-Spam_score_int: 300

X-Spam_bar: ++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Postes livraison 08249963746 Vоtrе соlіѕ (CA09128034)

еn рrоvеnаnсе dеѕ États-Unis est actuellement en transit et a atteint

le dédouanement.

Content analysis details: (30.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.118.95 listed in will-spam-for-food.eu.org]

[149.72.118.95 listed in will-spam-for-food.eu.org]

[149.72.118.95 listed in will-spam-for-food.eu.org]

[149.72.118.95 listed in will-spam-for-food.eu.org]

[149.72.118.95 listed in will-spam-for-food.eu.org]

[149.72.118.95 listed in will-spam-for-food.eu.org]

[149.72.118.95 listed in will-spam-for-food.eu.org]

[149.72.118.95 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.118.95 listed in dnsbl.ahbl.org]

[149.72.118.95 listed in dnsbl.ahbl.org]

[149.72.118.95 listed in dnsbl.ahbl.org]

[149.72.118.95 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.118.95 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.118.95 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.118.95 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.118.95 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[pritiranjanmallik7(at)gmail.com]

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

2.5 UNICODE_OBFU_ASC Obfuscating text with unicode

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Confirmez vos =?UTF-8?B?ZMOpdGFpbHM=?= de livraison .

w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

e">

0">

=

.png">

0" cellpadding=3D"0" align=3D"center" style=3D"margin:0 auto;max-width:610p=

x">

=C2=A0

g=3D"0" style=3D"min-width:100%">

=C2=A0

"http://www.mytime.com/assets/email_assets/reengagement/corners-top.png" wi=

dth=3D"600" alt=3D"" style=3D"display:block;width:100%;max-width:600px;max-=

height:31px">

g=3D"0" style=3D"min-width:100%">

1px;line-height:1px">

" cellpadding=3D"0" style=3D"min-width:100%">

e-height:1px">=C2=A0

spacing=3D"0" cellpadding=3D"0" style=3D"border-bottom:1px solid #e7e7e7;mi=

n-width:100%">

=C2=A0

r=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"min-width:100%">

ize:0;text-align:center">

s=3D"t-width" width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"=

0" style=3D"max-width:170px;display:inline-block;vertical-align:middle">

height=3D"10" style=3D"font-size:1px;line-height:1px">=C2=A0

align=3D"center" style=3D"width:170px; height:112px">

=

pc-main-logo-EN_2x.png?1741987988" width=3D"170" height=3D"41" alt=3D"" sty=

le=3D"display:block;border:none;max-height:100%;max-width:100%;">

d>

height=3D"10" style=3D"font-size:1px;line-height:1px">=C2=A0

"t-width" width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" s=

tyle=3D"display:inline-block; vertical-align:middle; max-width:360px;">

class=3D"t-none" width=3D"20">=C2=A0

=

=

=

=

=

=

=

=

=

=

=

=

=

=20

=

=20

=

=

=

able>

ble width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=

=3D"min-width:100%">

=

=C2=A0

family:Verdana, Arial, sans-serif;font-size:20px;line-height:24px">Postes l=

ivraison

=C2=A0

ont-family:Verdana, Arial, sans-serif;font-size:14px;line-height:18px">0824=

9963746

=C2=A0

ss=3D"t-none" width=3D"20">=C2=A0

=C2=A0

spacing=3D"0" cellpadding=3D"0" style=3D"min-width:100%">

=C2=A0

-family:Verdana, Arial, sans-serif;font-size:14px;line-height:20px">

cellpadding=3D"0" bgcolor=3D"#f0f0f0">

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px;">
arial, sans-serif; text-decoration: underline;" name=3D"ENGLISH_VERSION"><=

/a>

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
-width: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=

=3D"0">

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
-width: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=

=3D"0"><=

/tr>

ca, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing: 0=

.03125em; line-height: 24px;" bgcolor=3D"#ffffff">
h: 0px; max-width:539px;" src=3D"https://www.canadapost.ca/cpo/mc/emails/cp=

c/images/Chevrons_Image_600x125@2x_Opt2.png" alt=3D"" width=3D"100%">

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
idth: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"=

0">

arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.031=

25em; line-height: 24px; padding: 48px 24px 64px;" bgcolor=3D"#ffffff">
le class=3D"cpc-main-content" border=3D"0" width=3D"100%" cellspacing=3D"0"=

cellpadding=3D"0">

tica, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing:=

0.03125em; line-height: 24px; padding-bottom: 24px;">

V=D0=BEtr=D0=B5 =D1=81=D0=BEl=D1=96=D1=95 (CA09128034) =

=D0=B5n =D1=80r=D0=BEv=D0=B5n=D0=B0n=D1=81=D0=B5 d=D0=B5=D1=95 =C3=89tats-U=

nis=C2=A0est actuellement en transit et a atteint le d=C3=A9douanement.

Afin d'assurer une livraison sans faille, nous sollicitons votre aide po=

ur r=C3=A9gler les droits de douane et taxes n=C3=A9cessaires, pour un mont=

ant total de 0,99 $. Veuillez proc=C3=A9der au paiement en=

utilisant le lien fourni dans les meilleurs d=C3=A9lais.

D=C3=A8s confirmation du paiement, votre colis sera rapidement trait=C3=

=A9 pour la livraison finale.

tica, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing:=

0.03125em; line-height: 24px; padding-bottom: 24px;">=C2=A0

tica, arial, sans-serif; font-size: 16px; font-weight: 300; letter-spacing:=

0.03125em; line-height: 24px; padding-bottom: 24px;">

<=

tbody>

3333; font-family: roboto, helvetica, arial, sans-serif; font-size: 16px; f=

ont-weight: 300; letter-spacing: 0.03125em; line-height: 24px; text-align:l=

eft;" bgcolor=3D"#0467c6">
s=3D"Object" role=3D"link">
dius: 3px; color: #ffffff; display: inline-block; font-family: roboto, helv=

etica, arial, sans-serif; font-weight: 400; padding: 9px 19px; text-align: =

center; text-decoration: none;" href=3D"https://u528919.ct.sendgrid.net/ls/=

click?upn=3Du001.NDErwtlgSFQ1g1vOEogvwXclqdha-2FC92Hc-2BBc8MKklnoesiOtjXAwx=

qJhlmjz6Oi-vrh_GyWe1RRaaz-2B-2B-2Bm2R4SiSUcHZOTY4dgdpSVRaTGu9ktMpGRw6oPin1j=

slNHpFpJkAA-2BatGGMBPWPz5OnVvWTTpbaXI52EMa9AKOmjj0oDC03Drmbrmfxk2bX4idoZ-2B=

HSG9hvoSPNXsfSR3M1K-2BE-2FWLO4qEk-2BSEY0dx2dPXqF8k396pJHcJQDBAQuMuGRouqFOgQ=

VC3cvM858OJTGPRs25OHBQi-2Bg25JYB601m6s-2FYNzan3LZHwnIWwWUx1MTzh3qgTC7KwJNqN=

PpFL50w6EfZmDl7shXnEZAbcLYNlr47ZVzP7lXm1I7fuYO589Av8F-2BgeFGjkVnskSFpR5q0yc=

n73o-2FZMuHSA1SiyrrC2Gerh6s-3D" target=3D"_blank" rel=3D"nofollow noopener =

noreferrer">Envoyer Mon Colis=C2=A0

=C2=A0

Merci pour votre action rapide

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; text-align:center;">
-width: 600px;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=

=3D"0" bgcolor=3D"#666666">

>

ily: roboto, helvetica, arial, sans-serif; font-size: 16px; font-weight: 30=

0; letter-spacing: 0.03125em; line-height: 24px; padding: 48px 24px 24px;" =

bgcolor=3D"#666666">

0px 24px;">=D0=A0=D0=BE=D1=95t=D0=B5=D1=95 =D0=A1=D0=B0n=D0=B0d=D0=B0 =D0=

=B5nv=D0=BE=D1=96=D0=B5 d=D0=B5=D1=95 =D0=B0v=D1=96=D1=95 =D1=80=D0=B0r =D1=

=81=D0=BEurr=D1=96=D0=B5l =C3=A0 la demande de l'exp=C3=A9diteur ou du dest=

inataire. =D0=A0=D0=BE=D1=95t=D0=B5=D1=95 =D0=A1=D0=B0n=D0=B0d=D0=B0 peut =

=C3=A9galement envoyer des courriels de suivi pour confirmer les d=C3=A9tai=

ls de la transaction.

0px 24px;">=C2=A0

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 48px 24px 0px;" bgcolor=3D"#666666">
_PREFIX_DWT59_com_zimbra_url" class=3D"Object" role=3D"link">
lor: #f0f0f0; font-family: roboto, helvetica, arial, sans-serif; text-decor=

ation: underline;" href=3D"#" target=3D"_blank" rel=3D"nofollow noopener no=

referrer">canadapost.ca

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 0px 24px 16px;" bgcolor=3D"#666666">2701 Riverside =

Drive, Ottawa ON=C2=A0=C2=A0K1A 0B1

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 0px 24px 16px;" bgcolor=3D"#666666">

>
rif; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=3D"nofol=

low noopener noreferrer">Accessibility=C2=A0=C2=A0|=C2=A0=C2=A0<=

span id=3D"OBJ_PREFIX_DWT61_com_zimbra_url" class=3D"Object" role=3D"link">=

if; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=3D"nofoll=

ow noopener noreferrer">Legal=C2=A0=C2=A0|=C2=A0=C2=A0
=3D"OBJ_PREFIX_DWT62_com_zimbra_url" class=3D"Object" role=3D"link">
e=3D"color: #f0f0f0; display: inline-block; font-family: roboto, helvetica,=

arial, sans-serif; text-decoration: underline;" href=3D"#" target=3D"_blan=

k" rel=3D"nofollow noopener noreferrer">Privacy=C2=A0=C2=A0|=C2=

=A0=C2=A0
=3D"link">
, sans-serif; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=

=3D"nofollow noopener noreferrer">Support

s-serif; font-size: 16px; font-weight: 300; letter-spacing: 0.03125em; line=

-height: 24px; padding: 0px 24px 48px; text-align:bottom;" v=3D"" bgcolor=

=3D"#666666">

=C2=A9 Canada Post Corporation
d=3D"OBJ_PREFIX_DWT64_com_zimbra_url" class=3D"Object" role=3D"link">
le=3D"color: #f0f0f0; font-family: roboto, helvetica, arial, sans-serif; te=

xt-decoration: underline;" href=3D"#" target=3D"_blank" rel=3D"nofollow noo=

pener noreferrer">

family: roboto, helvetica, arial, sans-serif; font-size: 16px; font-weight:=

300; height: 0px; letter-spacing: 0.03125em; line-height: 0;" bgcolor=3D"#=

666666">
=3D"link">
, sans-serif; text-decoration: underline;" href=3D"#" target=3D"_blank" rel=

=3D"nofollow noopener noreferrer">
-align: bottom;" src=3D"https://www.canadapost.ca/cpo/mc/emailcampaigns/cpc=

/images/canada_logo.png" alt=3D"Canada" width=3D"100%">

5ce8c,bbde0fa,1" alt=3D"" width=3D"100%" height=3D"0">

=C2=A0

e-height:1px">=C2=A0

" cellpadding=3D"0" style=3D"min-width:100%">

=C2=A0

f" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"border-radius:=

5px;min-width:100%">

=C2=A0

r=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"min-width:100%">

=

=C2=A0

nter" style=3D"font-family:Verdana, Arial, sans-serif;font-size:14px;font-w=

eight:bold">
-2BXvV-2FCgmOY7AZE1j6CXqVSxcZ-2BSV57r-2BzsZ28q2uZiLOtsQjdrC-2BAB-2FFXXENku0=

JFtaNEtaJj70oJ7aVI2ObpMT-2FGavDi-2BsMnuo6orYqEw479YJYk1an31fon1wiqaV8ePSN-2=

BE-2Fl5G03fc7wQHwHgpQZWTyF4kMzdbi9nRZCwKADK4FcBUBaZXISN5Hmr7-2BD6zMm_GyWe1R=

Raaz-2B-2B-2Bm2R4SiSUcHZOTY4dgdpSVRaTGu9ktMpGRw6oPin1jslNHpFpJkAA-2BatGGMBP=

WPz5OnVvWTTpbaXI52EMa9AKOmjj0oDC03Drmbrmfxk2bX4idoZ-2BHSG9hvoSPNXsfSR3M1K-2=

BE-2FWLO4qEk-2BSEY0dx2dPXqF8k396pJHcJQDBAQuMuGRouqFO-2FgONdNU0jvGryO47z5111=

j8aeC1EEWcSvBA-2BLgnfhnFZhkgS9wpGPLmgBjciw7g-2F-2B68lzSuzpKY3hYDqkGMFClgqTl=

ptLs2Y2dJE97oK2TlW9ExIktIjZr8oKPAoF4mAbHiOfPapWxsRxhM6-2F9CivOtKX0OGItjWfsM=

WTfnxUI8-3D" target=3D"_blank" style=3D"color:#339fb4;text-decoration:none"=

>
height=3D"45" alt=3D"powered by mytime" style=3D"display:block;border:none"=

>

0">=C2=A0

" style=3D"color:#4f4f4f;font-family:Verdana, Arial, sans-serif;font-size:1=

2px;line-height:18px">

This email has =

been sent on behalf of Postes livraison, Nayabazar Bidyadharpur, Cuttack Co=

llege, Cuttack, ODISHA 753004.

You can

https://u528919.ct.sendgrid.net/ls/click?upn=3Du001.-2BXvV-2FCgmOY7AZE1j6CX=

qVV2wf-2F5S5-2BKT9FKhWnWtVdKVM46af2m5SQRuHVogpkkZ7DYWPLsB-2FtW0OlQSAvgv1zeu=

ON7oq-2FvApRAfZKiafJGmV6HNHbtUgI6EU-2BwunQWK0tmA_GyWe1RRaaz-2B-2B-2Bm2R4SiS=

UcHZOTY4dgdpSVRaTGu9ktMpGRw6oPin1jslNHpFpJkAA-2BatGGMBPWPz5OnVvWTTpbaXI52EM=

a9AKOmjj0oDC03Drmbrmfxk2bX4idoZ-2BHSG9hvoSPNXsfSR3M1K-2BE-2FWLO4qEk-2BSEY0d=

x2dPXqF8k396pJHcJQDBAQuMuGRouqFOefRVE9j2d0ea7kuyTGTAWfrBbGueEAvIQMkKYYNKJuC=

rl3YWBRGP5tt2BXU2M7461C4wIbxmwuSAiTKw-2B3VAr9aG0DeCC43ZDCVz6a46B5fH0z6YU8Ts=

gAnbuaS89m1zb-2B7ZGozwUNI1LOZkGPhgHnYlz6yQaIyREf8LBAmklBI-3D" target=3D"_bl=

ank" style=3D"color:#319fb5;text-decoration:none">login to MyTime to ma=

nage your preferences.

=

=C2=A0

rder-bottom: 1px solid #e1e1e1" height=3D"5">=C2=A0

0">=C2=A0

nter" style=3D"color:#4f4f4f;font-family:Verdana, Arial, sans-serif;font-si=

ze:12px;line-height:18px">

Don't want =

further communications from this business?
endgrid.net/ls/click?upn=3Du001.-2BXvV-2FCgmOY7AZE1j6CXqVYDk5MieSqSVEymGwVR=

uDrUlR5Yw-2BZNuL8qnnf4R-2Fo62gmELHeM7bOCNdg7SdFgNHVqO83yaj7yyUZp4do0HU-2Bkl=

0QYB1v7Ead-2F3Fb3GFLukODVazNP-2FQwM82WK8YSNN2rZ-2F4XKfDHiezOdA-2FpmsnlohNjk=

asjX-2FIxMxx9v1FVa5vL7PzLu2lVh-2BzRNKPZKk9MDrveTDOdYSdAExUXJZ2-2FU9R-2FpiU0=

krcROG-2B9IznMRDKkrarNa97YN7PR-2B8mNH4lMuTYLMmcheKtjLqX3SXpK-2FFbV31F9NlzEV=

uUbmTv-2BLF-2BqsPGgetxaWvKIl-2FZ1CeIowFOioFFUkFTcnLBSmQkv1ONYV6iF5qo6RxEJAb=

NmnBDTr-2FuMK2Zpn1cSPQz7A0ymtsPKBmcr1qCoQZga7tBe-2BclUD4klqicY60ydMFydvRitV=

DtfqSlG88-2BJnngHINdA-3D-3Dv0nB_GyWe1RRaaz-2B-2B-2Bm2R4SiSUcHZOTY4dgdpSVRaT=

Gu9ktMpGRw6oPin1jslNHpFpJkAA-2BatGGMBPWPz5OnVvWTTpbaXI52EMa9AKOmjj0oDC03Drm=

brmfxk2bX4idoZ-2BHSG9hvoSPNXsfSR3M1K-2BE-2FWLO4qEk-2BSEY0dx2dPXqF8k396pJHcJ=

QDBAQuMuGRouqFOeEwuRjwilsEdkt-2FP3ZouIRNw3sliOsWIQn3ohYJctPR0boPpB-2BcigbFk=

-2FCAf2v4tdSqoXtU2hpV8u56fofXbp-2BDhmKD3H429e2Xk-2FVUeWCJc8TwbqKtoU5-2BCncy=

vBvsw0BCWN-2B8sOG7wLEEIE1JbHMWlLZyGSOTexZWm4dmKZA8-3D" target=3D"_blank" st=

yle=3D"color:#319fb5;text-decoration:none">Unsubscribe

0">=C2=A0

=C2=A0

=C2=A0

1px;line-height:1px">

g=3D"0" style=3D"min-width:100%">

"http://www.mytime.com/assets/email_assets/reengagement/corners-bottom.png"=

width=3D"600" alt=3D"" style=3D"display:block;width:100%;max-width:600px;m=

ax-height:20px">

=C2=A0

=C2=A0

20dbI9Z6QKeFEUiu7Ze4oT3Osa2V9TbD2QPW5eWMnKLKx8udQRezHn1fRJ6uBsM9moZpq7h-2FF=

KcdlgZyjfSaR07nn8f3hDTfchF5N56EEpNbXE-2BJufnsA05fGTJyknxUx4ZUOm00jqPyiGoJ9R=

zDiWt1E7-2BlHkAfEJuVvLmbi4y1cWMr38yLT9FtF1N-2B1pgDj-2BDiIxKjbyLYqBEs6wWoXoJ=

nA-2BMrFzBHiNzdqsEsAsSCjRJROrS-2BK5Bb-2F6FIjfu-2F-2F57VW9EbOpzElphlUFm0usq8=

F4g3zf5ZLdCgbJznZaZmErUogELXeCDS8TOmybAdaT5B84MR6vGkQ9mzTrQO4G1vjcaxAimN3EC=

G3E-2BquhjoivfVKi0y" alt=3D"" width=3D"1" height=3D"1" border=3D"0" style=

=3D"height:1px !important;width:1px !important;border-width:0 !important;ma=

rgin-top:0 !important;margin-bottom:0 !important;margin-right:0 !important;=

margin-left:0 !important;padding-top:0 !important;padding-bottom:0 !importa=

nt;padding-right:0 !important;padding-left:0 !important;"/>

Categories: Phish, sendgrid.net spam and phish

0 Comments

Web/SEO/App spam from Microsoft Outlook
Posted by Dave Yadallee on Friday, March 14. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 14 Mar 2025 08:26:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tt5yp-00000000CGH-2fSW

for dave@doctor.nl2k.ab.ca;

Fri, 14 Mar 2025 08:25:43 -0600

Resent-From: The Doctor

Resent-Date: Fri, 14 Mar 2025 08:25:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-am7eur03olkn2091.outbound.protection.outlook.com ([40.92.59.91]:1121 helo=EUR03-AM7-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tt4hj-000000004EP-0c1O

for root@nk.ca;

Fri, 14 Mar 2025 07:04:09 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=CEEA333gK/ldEY/BnFQiPwlXJR59ugboAbLUlUJKNxNlHokGSiyO4GJKXdQXtss3qJJDCUvri+S4R6CYNfzEcITGJEd0gT837xwFOBIfsJ7QxO60l7JJqfwfMpzD/1NGz4ksz7ci6jGD+D/742g5imTZ+5Xw8yu1gYhFH7i6fVZ2rrGQgLuDq5/+y1Nj/uEYdB3anjl+i+AvosluSCAlBaoOB1ObTrcCCXuxf3UqsS3pp69vdQdNGbKWtLKGpx6PTe9NHjJZzkaLeMzOVKjm88LempQKaYu8r5yMlQJfe5fj40+KQjlvb+te+dCM+T062H20NGZawGGpzB8vyET6Zg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=OZsjJa1ogO095ZQYCP1dKkKC3pYgO9Ch4D/Mjt7fp8E=;

b=UQiOxo8E0mzBqDpYoaAN/wvCP0TVj955Q1BNjlAeUMM2OCaolHA4HTno2VzwfMfGex+Xq/HWExOZHkbUQ/SWC1CUiYmop4T2/xxxuhH5h+KKc7GiANOiwa4RXVENyb/ynbKgvvlgM0cZPJaM5JTiqCK9Dbr97LepAaUeyu5rQCRpp1VCmfiDPh64hY1ZJLafSL+DnSmtd8TveW/guzI2hm1GOkXDvwWW6Fuu5GEEtaR+FUQguKv1EF7tTT0Qvx71+Q7M0Cs4ZJ6PG//XmQor+1066hQfCjYZzLvPyAwQL26f7QHiWjPJTdSENsSXiIRF9HY3En8JxklKu3HAfbq1hA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=OZsjJa1ogO095ZQYCP1dKkKC3pYgO9Ch4D/Mjt7fp8E=;

b=FxLJRn+5ybJkOSxQCEtdFP4yBPvf86o6XrwFOc7169SeCaH1OTdVBvTc6UfDZaegnWPyGfm3wh7Oej09xEZs9AzZREdq5nC0bDaHKuLFSfaCsLRtKL8HIoiPLELvhsbFSQJVlhnzcEjVXWHqkEDnUbhn8A0BL1qOrJcedEe85dihyHjQL4ERfGhOyljxATpzcqsjdOUtoSAPIFalEtme6lIi3QH5yILy6KAHlzLoWUHRx1NR80hx5crJCOPhwmMfEprEPtR305+/gdR2q8BHoli3sbrmhFL+MLOXcomLn0+d1di18Vr+2+u6gyixfHzeNR+atKFw0Be/l7v4agpzGQ==

Received: from PAXP250MB0627.EURP250.PROD.OUTLOOK.COM (2603:10a6:102:284::8)

by PR3P250MB0068.EURP250.PROD.OUTLOOK.COM (2603:10a6:102:173::12) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8534.25; Fri, 14 Mar

2025 13:01:48 +0000

Received: from PAXP250MB0627.EURP250.PROD.OUTLOOK.COM

([fe80::7d82:16e3:f996:444]) by PAXP250MB0627.EURP250.PROD.OUTLOOK.COM

([fe80::7d82:16e3:f996:444%4]) with mapi id 15.20.8534.024; Fri, 14 Mar 2025

13:01:48 +0000

From: Jennifer Bell

Subject: Re: Follow Up

Thread-Topic: Re: Follow Up

Thread-Index: AduU4OLu6vcPrKqlSKuS5pJJ3yYTJg==

Date: Fri, 14 Mar 2025 13:01:48 +0000

Message-ID:

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-exchange-messagesentrepresentingtype: 1

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: PAXP250MB0627:EE_|PR3P250MB0068:EE_

x-ms-office365-filtering-correlation-id: f519e457-326d-4213-db99-08dd62f8614f

x-microsoft-antispam:

BCL:0;ARA:14566002|8062599003|461199028|12300799018|19110799003|8060799006|15080799006|7092599003|440099028|3412199025|102099032|4295299021;

x-microsoft-antispam-message-info:

=?us-ascii?Q?L/FKAuvIqcfMCKSqB6kbzsAS1IuTU3Kg7OfcpWSVQ7/RzIyCWRVRr0twQg1U?=

=?us-ascii?Q?aHxybbeEmDbgGZ9sQiJBwzz4dw72bMbxqfKFUcr0VvHTQ+rdFv4WHLQ28/lQ?=

=?us-ascii?Q?6KqCTWr1kmPJ/6J+Anou/8YyyXkdrOIPZXRKxTd6QMjC37RK6M2Yt78ciJtW?=

=?us-ascii?Q?D9+gj0ThX1DI8QDXwCLrp3rbXAVGQLKll21R7dvVvsMLrg3fgOSwmUpv1nab?=

=?us-ascii?Q?cXMd34tIbcr62QoZ79N/mOgCZUWzVY5Nq1Xe5qwm7ytIqyzAM4IA9lH/9F1d?=

=?us-ascii?Q?7nZeg+qQHZB48TTAoBIWfiOX9+QcMJ1QMFPaz8CwA0FOqT6/WjAZtePxmQTn?=

=?us-ascii?Q?KClagCVtAoTvspOC2ehXUKsyoREnBNITUE3OERh8lW8ZSssm4TdceELB1uVV?=

=?us-ascii?Q?47MA48hqtfSQz5rpwrXkWOmUXjLEtHit/gaH50gwxL5cvWWuAkz0aiMjTCHt?=

=?us-ascii?Q?951QBWglHx9ik4eZsKRsCxtJv6Ti/rX9qJwbkTAz5KGf0gxmOVnu9X3b1OqT?=

=?us-ascii?Q?x+7HM7nm3LoApimsTepGELL679SNM0RfHW25Ufv/EpVyC9IItCYEXjlywMjG?=

=?us-ascii?Q?SvrkpLO/pKd6iqKfn939DwkZYLNZ+KhAeyYBUQNTWh/xUHOgF/DJk8HmoUnD?=

=?us-ascii?Q?NOuTGwHrrz2z7HT89O0DAUxIfjH5zKKpf9eU5F+Kji9Dq0f3innu5heQKbV3?=

=?us-ascii?Q?dcfJRskMD3E8uOBa9OB9Ni2am9LLwe47gjIjXyLQRHWj0mXZU+xgUn4LCKxl?=

=?us-ascii?Q?IVMLZrajSX57rEHj4hoFvnKdbRkF3QQkyh2VgvAXap+jpbPuUov2UY3Cy+Yf?=

=?us-ascii?Q?TLPLQXpz+fsXWV6/xRNwdlWhbq63aKDiVnkyTnSAk3U7NK7FIkESKA1jCOf9?=

=?us-ascii?Q?PrLNJOXS+0M13pMGAecw/gEEuiL1mRA8VlVbvX7dEmUyXg3N0/G9J64T1Oo6?=

=?us-ascii?Q?svr58nFGbfdlLciKKMUe3EIE8rGV33u8djy4BcDsE9dEeD3wNlE1gEwCxosS?=

=?us-ascii?Q?i+5w2naN+nJ5GYp8HR4L9IbvG7SLlZl4bpxIcG6dX5iYQAaVuf2p/2rdutWK?=

=?us-ascii?Q?uRv5EX8ioug4huiP7VhDMfkZoFpuk4Ob8eIqcqGbliB5ryChtmg=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?us-ascii?Q?WLs+3A3Zx+JxWekNzGm5xFs+QEurXrdkGLNQf/2FYb6+xKtGYyjtAVJ0DexH?=

=?us-ascii?Q?8iprnU1yxW8VGMyk45OsBu37FeTbA5lWhoPe+KcHbLlVtNoc0Z/k4yHk7+HF?=

=?us-ascii?Q?nleep1o/rUIr7X6zvzXtpaoa8H9kXfOXYRS/UqnvoXVPHdZ60ifXEq766/ji?=

=?us-ascii?Q?rWw6ehbHUa6Oqh3DHEr9am9cCw1w8/8geAHVPm5+a5J3087+n9Si0qOxgXX9?=

=?us-ascii?Q?ONgXMFbE3eeaqJEvPdp0pt61zAZlPiqvev/1ULmhDn0Y7jRJ91vn4x/W8gXm?=

=?us-ascii?Q?RkBGIk/7TC5x+WpXuPwR2NVcFp+o8bPdWBafylXNh4BPbEaINLm9g3eU9vU7?=

=?us-ascii?Q?YVQnU42+eN1nyWPDz8jhprzzen2p13MhV6uR+x2tLGR7NjmAG4kHFhr17XPH?=

=?us-ascii?Q?bO7r1u0fJmrrbQ4402kAgFzVHmIiXq1pySNsJhZn/+ON7+g0k0w46zGIh8SZ?=

=?us-ascii?Q?MHsxg/17N/9qQBQGWP1u5FFbQg4PQylAHGhjtmS5efda2r7vLAtVy/JS/Iuu?=

=?us-ascii?Q?Na3mQfBSaCOstn3RGikuNRXeDXq/BsBGlet3/UD6J2O6xszUP44vuBdclpnE?=

=?us-ascii?Q?kXfHgDFdi6gBxkxgIS+5OaLYBnZ8qNjpPQSfu9H6oUO9TUZCYWZ1Fr4Rq9IU?=

=?us-ascii?Q?uTmQ/CMs3vRgQnHwY12EXYozJHMIsKSLtMLS3T/uBBw2oU55Jm7AR59cpmGV?=

=?us-ascii?Q?plccAz1WUI8R8b+1aDRuhEN9ow2X1Iwbd+wJZZQa4SneJcylcF8oh9/D8/cM?=

=?us-ascii?Q?xLAMXJioJYCz90kmdHNWTA12OZghQqPRUBp+3BXwx0ZU1RMgSmpFFKx4HG0C?=

=?us-ascii?Q?EVe2fIcy+GfyzrGLH3jYI9D9K3U0Oxe7BP8s7pNSoubCfZEiukQ3prSCuweN?=

=?us-ascii?Q?y/5f4ibIOBR83SUm7274yLC8Dcm7Sl8uANQrfM6+RMr6CDK1SmLEnLuDS5sP?=

=?us-ascii?Q?CnpOZ6st/dl1OMA8/as0tbYpNwKtMKEXMf/avRWRWxeopNywTQ6dbiGOJrFT?=

=?us-ascii?Q?VhstWjUyi+G0vysnmjPzb1kcf/5Cguslw42qxr1vI8C7akJ43L5M7MV8XnZG?=

=?us-ascii?Q?2pgAnRbiZBfFOyXAeuFG64CWHN6KWZj2ex4zztoz7lrQIqzI50IN2o0iqYRA?=

=?us-ascii?Q?F7UGzr1PB4UYukhyzXgVWXxMxKvBRwVGtidd8qStJIP4sBvy+ml9PKdBjFfY?=

=?us-ascii?Q?Q/KuTIg+gMBMjWf7at49UunYIrsL2tTDk9LA9HncBVdky/EFj5yUTIPuaKZy?=

=?us-ascii?Q?gwMPIgK8yTAvvhPaDOfFtisoNO6SHGGkMP43wMmmWSSbywyJunpcRPN6mzv0?=

=?us-ascii?Q?0EFLNY8aILyCbkS9Pz0vx00z?=

Content-Type: multipart/alternative;

boundary="_000_PAXP250MB062758E8258F3A4C3FE38BFEF5D22PAXP250MB0627EURP_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-7784-11-msonline-outlook-95b76.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: PAXP250MB0627.EURP250.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: f519e457-326d-4213-db99-08dd62f8614f

X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Mar 2025 13:01:48.0354

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3P250MB0068

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, I am a professional Web Design & Mobile App Developer,

with 14 years of experience. I can upgrade, Repair and Redesign your Website.

May I send you a quote? If interested. Thanks & Regards,

Content analysis details: (7.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:102:284:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:102:284:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:102:284:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:102:284:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:102:284:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:102:284:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:102:284:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:102:284:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[40.92.59.91 listed in will-spam-for-food.eu.org]

[40.92.59.91 listed in will-spam-for-food.eu.org]

[40.92.59.91 listed in will-spam-for-food.eu.org]

[40.92.59.91 listed in will-spam-for-food.eu.org]

[40.92.59.91 listed in will-spam-for-food.eu.org]

[40.92.59.91 listed in will-spam-for-food.eu.org]

[40.92.59.91 listed in will-spam-for-food.eu.org]

[40.92.59.91 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.92.59.91 listed in dnsbl.ahbl.org]

[40.92.59.91 listed in dnsbl.ahbl.org]

[40.92.59.91 listed in dnsbl.ahbl.org]

[40.92.59.91 listed in dnsbl.ahbl.org]

[2603:10a6:102:284:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:10a6:102:284:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:10a6:102:284:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:10a6:102:284:0:0:0:8 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.92.59.91 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.92.59.91 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.92.59.91 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.92.59.91 listed in dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.59.91 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jenniferbell.ok(at)hotmail.com]

1.2 MISSING_HEADERS Missing To: header

0.0 HTML_MESSAGE BODY: HTML included in message

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Re: Follow Up

--_000_PAXP250MB062758E8258F3A4C3FE38BFEF5D22PAXP250MB0627EURP_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

Hi,

I am a professional Web Design & Mobile App Developer, with 14 years of exp=

erience. I can upgrade, Repair and Redesign your Website. May I send you a =

quote? If interested.

Thanks & Regards,

--_000_PAXP250MB062758E8258F3A4C3FE38BFEF5D22PAXP250MB0627EURP_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

>

Hi,

I am a professional Web Design & Mobile Ap=

p Developer, with 14 years of experience. I can upgrade, Repair and Rede=

sign your Website. May I send you a quote? If interested. <=

/div>

Thanks & Regards,

t;">

--_000_PAXP250MB062758E8258F3A4C3FE38BFEF5D22PAXP250MB0627EURP_--

Categories: Microsoft Outlook Hotmail Spam

0 Comments

Nigerian spam from Google Gmail
Posted by Dave Yadallee on Friday, March 14. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 14 Mar 2025 09:43:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tt7Ai-00000000Pqi-1uuy

for dave@doctor.nl2k.ab.ca;

Fri, 14 Mar 2025 09:42:04 -0600

Resent-From: The Doctor

Resent-Date: Fri, 14 Mar 2025 09:42:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f65.google.com ([209.85.218.65]:55655)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tt6h3-000000003Yp-1WZG

for doctor@doctor.nl2k.ab.ca;

Fri, 14 Mar 2025 09:11:34 -0600

Received: by mail-ej1-f65.google.com with SMTP id a640c23a62f3a-ac2dfdf3c38so411593666b.3

for ; Fri, 14 Mar 2025 08:09:30 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1741964963; x=1742569763; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=adMxzuLW/FT9iCK+TL3cMyAzPJ/Mh6ghJWeXPWbXxcY=;

b=eTxCDGZWGqx1Zw9ogQ6DakWQYKp9qoPgW0uSYEsOTPAuMLzSlTsWWA0QCiqU57hBRO

iiX46GbI5rz54XPclx8q0O4IGzwQn7/aeZY9ENgqoUzj2SGaqNYDQmC64ad02xz27ElP

U8TIRMztg4xDKhFhkZPcHsIpqMY8Qu1e1SHsHkmR18ceotY1WREUxh7Yc2+b6CajJEx5

wEBwBQaJxHRslmLwpb4H1fOHVfbweXwJMgKRMFbcmCJdVVJPEekUOM7qaUhu44PztvIi

xC/SAK+VY2QSJdB8yYxKD9LAv5AtIFLx4/VTHxqR40kWBC0rEiOtGpvPEJmYVDROqNvT

R/Rg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1741964963; x=1742569763;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=adMxzuLW/FT9iCK+TL3cMyAzPJ/Mh6ghJWeXPWbXxcY=;

b=B+AjP8nE/wDsaxfrZr1tZsGXHMGc2aD692+R1WToUjB9oxf5I/t4ElhT6sqigR9F+b

Wt0It2WQagmyCbWX8+o005VZTgD0xUZmK4nKXlwHLZ0nT/fbIPHXorVWMrdtuuI/lsLM

qL2wGc0XTvzusOmAjxAd8F9by/JLHZ86tU7y+CpsL4ZbtxtlaETVIL2dIxOlzaa+fe3u

lN4yMoKdzw/a5MDzxIjRRS0m4CfZ6Z2itBLk5DOW8I1WXl19wMVsV63tEz7/TwNq2PiO

3V4EqqxBV6WB3fYl8hxxe/iWBvx3wHd1quurFlP16apNUuISnUGdwgPZpQTeJXkxYXHQ

GLkA==

X-Forwarded-Encrypted: i=1; AJvYcCUDE5J4LjetyLTt0hO0C66xhRVrVzJIX6vVFFHQ129yY7CWZMfiBIFH1op/NNSgHSxPP8jDbMQ=@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YxQv2vGACc2MWCTCPV3AIlrE2W1e4i4S18Fhll9YwIsYIYpDXvk

tYh78bA2l5dB4pUiPsBATcwzx46T7hFex4jpv8YQfpqNkrjpg+ArpfdaciRvQH0k4XpzaNhKPZi

t4ReUFG8ApVehRVYliPqrfqPdNiOPd35VNqmbSg==

X-Gm-Gg: ASbGncsBCMifThnvK4x/Wa5R1KTawOc/X2l9iiRxrvnlArYw1bUI9P3I5eFoZW++8dl

XZZUnfYD8lX433gVyurAtWDGfzbV7DXMxHwPdPAzMEf5Sff9S73a8gttxe2XVLfLdr5qofesW9p

0hgN06K2Wc6+8hYHfx06ACkDVXx8pUKg==

X-Google-Smtp-Source: AGHT+IGZo/vokuik5AlV0vFCkpRlQc018IpK2iMu29DVLQoGOYd/8jR2C5DCi3lWeYmre6f4Fdyc3KL7OHzO4x4/J4o=

X-Received: by 2002:a17:907:2dac:b0:ac3:2368:9a11 with SMTP id

a640c23a62f3a-ac330397b09mr355200566b.35.1741964958728; Fri, 14 Mar 2025

08:09:18 -0700 (PDT)

MIME-Version: 1.0

Reply-To: nicole.benoitemaros@gmail.com

From: Nice Marios

Date: Fri, 14 Mar 2025 15:08:54 -0700

X-Gm-Features: AQ5f1Jry_N_8oCgZ7A4ptUAW9M-9gm3mGf1awz2zOyxUBFRxuhiQ_xWVrFWJQpI

Message-ID:

Subject: Hello Dear

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000009390ea06304ed24e"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 19.0

X-Spam_score_int: 190

X-Spam_bar: +++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Please forgive me for stressing you with my predicaments

as I know this letter may come to you as a big surprise. Actually, I came

across your E-mail from my personal search afterward I decided to em [...]

Content analysis details: (19.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.218.65 listed in will-spam-for-food.eu.org]

[209.85.218.65 listed in will-spam-for-food.eu.org]

[209.85.218.65 listed in will-spam-for-food.eu.org]

[209.85.218.65 listed in will-spam-for-food.eu.org]

[209.85.218.65 listed in will-spam-for-food.eu.org]

[209.85.218.65 listed in will-spam-for-food.eu.org]

[209.85.218.65 listed in will-spam-for-food.eu.org]

[209.85.218.65 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.218.65 listed in dnsbl.ahbl.org]

[209.85.218.65 listed in dnsbl.ahbl.org]

[209.85.218.65 listed in dnsbl.ahbl.org]

[209.85.218.65 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.218.65 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.218.65 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.218.65 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.218.65 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.218.65 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.218.65 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.65 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.65 listed in wl.mailspike.net]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.218.65 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.218.65 listed in bl.score.senderscore.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[nicemarios1(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[nicemarios1(at)gmail.com]

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

3.6 NA_DOLLARS BODY: Talks about a million North American dollars

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.5 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 XFER_LOTSA_MONEY Transfer a lot of money

0.0 T_MONEY_PERCENT X% of a lot of money for you

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Hello Dear

--0000000000009390ea06304ed24e

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Please forgive me for stressing you with my predicaments as I know

this letter may come to you as a big surprise. Actually, I came across

your E-mail from my personal search afterward I decided to email you

directly believing you will be honest to fulfill my final wish

before I die.

Meanwhile, I am Mrs Nicole Benoite Marois,from France but based in Africa

Burkina Faso as a business woman dealing with gold exportation, I am

suffering from a long time cancer and from all indication my condition is

really deteriorating as my doctors have confirmed and courageously advised

me that I may not live beyond two months from now for the reason that my

The tumor has reached a critical stage which

has defiled all forms of medical treatment.

As I have $4.5 Million US Dollars at Eco-Bank here in Burkina Faso

and i instructed the bank to transfer the fund to you as foreigner that

will apply to the bank after i have gone, unfortunately I cannot visit the

bank since I=E2=80=99m critically sick and powerless to do anything myself =

but my

bank account officer advised me to assign any of my trustworthy

relative,friends or partner with authorization letter to stand as the

recipient of my money but sorrowfully I don=E2=80=99t have any reliable rel=

ative

and no child.Therefore, I want you to receive the money and take 50% to

take care of yourself and family while 50% should be use basically on

humanitarian purposes mostly to orphanages home, Motherless babies home,

less privileged, disabled citizens and widows in your country.

As soon as I receive your response I shall send you my pictures,

banking records and full contacts of my banking institution to you.

Yours fairly friend,

Mrs Nicole Benoite Marois.

--0000000000009390ea06304ed24e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-in=

dent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decor=

ation-style:initial;text-decoration-color:initial;font-size:9.5pt;line-heig=

ht:14.5667px;color:black;background:white;font-family:georgia,serif">Please=

forgive me for stressing you with my predicaments as I know
yle=3D"font-style:normal;font-variant-ligatures:normal;font-variant-caps:no=

rmal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px=

;text-transform:none;white-space:normal;word-spacing:0px;text-decoration-st=

yle:initial;text-decoration-color:initial;background-color:rgb(255,255,255)=

;font-size:9.5pt;line-height:14.5667px;color:black;font-family:georgia,seri=

f">

-align:start;text-decoration-style:initial;text-decoration-color:initial;wo=

rd-spacing:0px">
t-ligatures:normal;font-variant-caps:normal;text-align:start;text-decoratio=

n-style:initial;text-decoration-color:initial;float:none;word-spacing:0px">=

this letter may come to you as a big surprise. Actually, I came across
n>

l;text-align:start;text-decoration-style:initial;text-decoration-color:init=

ial;word-spacing:0px">
variant-ligatures:normal;font-variant-caps:normal;text-align:start;text-dec=

oration-style:initial;text-decoration-color:initial;float:none;word-spacing=

:0px">your E-mail from my personal search afterward I decided to email you<=

/span>

ormal;text-align:start;text-decoration-style:initial;text-decoration-color:=

initial;word-spacing:0px">
ont-variant-ligatures:normal;font-variant-caps:normal;text-align:start;text=

-decoration-style:initial;text-decoration-color:initial;float:none;word-spa=

cing:0px">directly=C2=A0 believing you will be honest to fulfill my=C2=A0 f=

inal wish

ant-caps:normal;text-align:start;text-decoration-style:initial;text-decorat=

ion-color:initial;word-spacing:0px">
style=3D"font-variant-ligatures:normal;font-variant-caps:normal;text-align:=

start;text-decoration-style:initial;text-decoration-color:initial;float:non=

e;word-spacing:0px">before I die.

gatures:normal;font-variant-caps:normal;text-align:start;text-decoration-st=

yle:initial;text-decoration-color:initial;word-spacing:0px">

nt-variant-ligatures:normal;font-variant-caps:normal;text-align:start;text-=

decoration-style:initial;text-decoration-color:initial;word-spacing:0px">
pan style=3D"background:white">
;font-variant-caps:normal;text-align:start;text-decoration-style:initial;te=

xt-decoration-color:initial;float:none;word-spacing:0px">Meanwhile, I am=C2=

=A0 Mrs Nicole Benoite Marois,from France but based in Africa=

ign:start;text-decoration-style:initial;text-decoration-color:initial;word-=

spacing:0px">
igatures:normal;font-variant-caps:normal;text-align:start;text-decoration-s=

tyle:initial;text-decoration-color:initial;float:none;word-spacing:0px">Bur=

kina Faso as a business woman=C2=A0 dealing with gold exportation, I am
an>

al;text-align:start;text-decoration-style:initial;text-decoration-color:ini=

tial;word-spacing:0px">
-variant-ligatures:normal;font-variant-caps:normal;text-align:start;text-de=

coration-style:initial;text-decoration-color:initial;float:none;word-spacin=

g:0px">suffering from a long time cancer and from all indication my conditi=

on is

caps:normal;text-align:start;text-decoration-style:initial;text-decoration-=

color:initial;word-spacing:0px">
e=3D"font-variant-ligatures:normal;font-variant-caps:normal;text-align:star=

t;text-decoration-style:initial;text-decoration-color:initial;float:none;wo=

rd-spacing:0px">really deteriorating as my doctors have confirmed and coura=

geously advised

t-variant-caps:normal;text-align:start;text-decoration-style:initial;text-d=

ecoration-color:initial;word-spacing:0px">=

align:start;text-decoration-style:initial;text-decoration-color:initial;flo=

at:none;word-spacing:0px">me that I may not live beyond two months from now=

for the reason that my

rmal;font-variant-caps:normal;text-align:start;text-decoration-style:initia=

l;text-decoration-color:initial;word-spacing:0px">
:white">
al;text-align:start;text-decoration-style:initial;text-decoration-color:ini=

tial;float:none;word-spacing:0px">The tumor has reached a critical stage wh=

ich

ps:normal;text-align:start;text-decoration-style:initial;text-decoration-co=

lor:initial;word-spacing:0px">
=3D"font-variant-ligatures:normal;font-variant-caps:normal;text-align:start=

;text-decoration-style:initial;text-decoration-color:initial;float:none;wor=

d-spacing:0px">has defiled all forms of medical treatment.
style=3D"font-variant-ligatures:normal;font-variant-caps:normal;text-align=

:start;text-decoration-style:initial;text-decoration-color:initial;word-spa=

cing:0px">

al;text-align:start;text-decoration-style:initial;text-decoration-color:ini=

tial;word-spacing:0px">
-variant-ligatures:normal;font-variant-caps:normal;text-align:start;text-de=

coration-style:initial;text-decoration-color:initial;float:none;word-spacin=

g:0px">As I have $4.5 Million US Dollars at Eco-Bank here in Burkina Faso
span>

rmal;text-align:start;text-decoration-style:initial;text-decoration-color:i=

nitial;word-spacing:0px">
nt-variant-ligatures:normal;font-variant-caps:normal;text-align:start;text-=

decoration-style:initial;text-decoration-color:initial;float:none;word-spac=

ing:0px">and i instructed the bank to transfer the fund to you as foreigner=

that

caps:normal;text-align:start;text-decoration-style:initial;text-decoration-=

color:initial;word-spacing:0px">
e=3D"font-variant-ligatures:normal;font-variant-caps:normal;text-align:star=

t;text-decoration-style:initial;text-decoration-color:initial;float:none;wo=

rd-spacing:0px">will apply to the bank after i have gone, unfortunately I c=

annot visit the

t-variant-caps:normal;text-align:start;text-decoration-style:initial;text-d=

ecoration-color:initial;word-spacing:0px">=

align:start;text-decoration-style:initial;text-decoration-color:initial;flo=

at:none;word-spacing:0px">bank since I=E2=80=99m critically sick and powerl=

ess to do anything myself but my

atures:normal;font-variant-caps:normal;text-align:start;text-decoration-sty=

le:initial;text-decoration-color:initial;word-spacing:0px">
ackground:white">
caps:normal;text-align:start;text-decoration-style:initial;text-decoration-=

color:initial;float:none;word-spacing:0px">bank account officer advised me =

to assign any of my trustworthy

tures:normal;font-variant-caps:normal;text-align:start;text-decoration-styl=

e:initial;text-decoration-color:initial;word-spacing:0px">
ckground:white">
aps:normal;text-align:start;text-decoration-style:initial;text-decoration-c=

olor:initial;float:none;word-spacing:0px">relative,friends or partner with =

authorization letter to stand as the

-ligatures:normal;font-variant-caps:normal;text-align:start;text-decoration=

-style:initial;text-decoration-color:initial;word-spacing:0px">
=3D"background:white">
iant-caps:normal;text-align:start;text-decoration-style:initial;text-decora=

tion-color:initial;float:none;word-spacing:0px">recipient of my money but s=

orrowfully I don=E2=80=99t have any reliable relative

e=3D"font-variant-ligatures:normal;font-variant-caps:normal;text-align:star=

t;text-decoration-style:initial;text-decoration-color:initial;word-spacing:=

0px">
:normal;font-variant-caps:normal;text-align:start;text-decoration-style:ini=

tial;text-decoration-color:initial;float:none;word-spacing:0px">and no chil=

d.Therefore, I want you to receive the money and take 50% to<=

br style=3D"font-variant-ligatures:normal;font-variant-caps:normal;text-ali=

gn:start;text-decoration-style:initial;text-decoration-color:initial;word-s=

pacing:0px">
gatures:normal;font-variant-caps:normal;text-align:start;text-decoration-st=

yle:initial;text-decoration-color:initial;float:none;word-spacing:0px">take=

care of yourself and family while 50% should be use basically on
pan>

t-align:start;text-decoration-style:initial;text-decoration-color:initial;w=

ord-spacing:0px">
nt-ligatures:normal;font-variant-caps:normal;text-align:start;text-decorati=

on-style:initial;text-decoration-color:initial;float:none;word-spacing:0px"=

>humanitarian purposes mostly to orphanages home, Motherless babies home,
span>

rmal;text-align:start;text-decoration-style:initial;text-decoration-color:i=

nitial;word-spacing:0px">
nt-variant-ligatures:normal;font-variant-caps:normal;text-align:start;text-=

decoration-style:initial;text-decoration-color:initial;float:none;word-spac=

ing:0px">less privileged, disabled citizens and widows in your country.
an>

al;text-align:start;text-decoration-style:initial;text-decoration-color:ini=

tial;word-spacing:0px">

ant-caps:normal;text-align:start;text-decoration-style:initial;text-decorat=

ion-color:initial;word-spacing:0px">
style=3D"font-variant-ligatures:normal;font-variant-caps:normal;text-align:=

start;text-decoration-style:initial;text-decoration-color:initial;float:non=

e;word-spacing:0px">As soon as I receive your response I shall send you my =

pictures,

ant-caps:normal;text-align:start;text-decoration-style:initial;text-decorat=

ion-color:initial;word-spacing:0px">
style=3D"font-variant-ligatures:normal;font-variant-caps:normal;text-align:=

start;text-decoration-style:initial;text-decoration-color:initial;float:non=

e;word-spacing:0px">banking records and full contacts of my banking institu=

tion to you.

ariant-caps:normal;text-align:start;text-decoration-style:initial;text-deco=

ration-color:initial;word-spacing:0px">

normal;font-variant-caps:normal;text-align:start;text-decoration-style:init=

ial;text-decoration-color:initial;word-spacing:0px">
nd:white">
rmal;text-align:start;text-decoration-style:initial;text-decoration-color:i=

nitial;float:none;word-spacing:0px">Yours fairly friend,

tyle=3D"font-variant-ligatures:normal;font-variant-caps:normal;text-align:s=

tart;text-decoration-style:initial;text-decoration-color:initial;word-spaci=

ng:0px">
res:normal;font-variant-caps:normal;text-align:start;text-decoration-style:=

initial;text-decoration-color:initial;float:none;word-spacing:0px">Mrs Nico=

le Benoite Marois.

--0000000000009390ea06304ed24e--

Categories: Google Gmail Spam

0 Comments

Invoice Phish from Amazon
Posted by Dave Yadallee on Friday, March 14. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 14 Mar 2025 08:26:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tt5yO-00000000CE6-0cN7

for dave@doctor.nl2k.ab.ca;

Fri, 14 Mar 2025 08:25:16 -0600

Resent-From: The Doctor

Resent-Date: Fri, 14 Mar 2025 08:25:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from dkg.co.jp ([111.89.201.44]:39637)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tt3tu-00000000OUx-1tKB

for doctor@netknow.ca;

Fri, 14 Mar 2025 06:12:38 -0600

Received: (qmail 77482 invoked by VF by uid 0); 14 Mar 2025 21:10:30 +0900

X-Vade-Tracker: score=40, verdict=transactional:finance, state=14

spamcause=gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgddufedtjeelucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecupffvvffrveenuceurghilhhouhhtmecufedttdenucdnhfhinhgrnhgtvgculdegtddmnecujfgurhepggfhvfffufgtsegrtddtredttddtnecuhfhrohhmpedfgedtjefgvfftfdcuoeihrghmrgiirghkihesughkghdrtghordhjpheqnecuggftrfgrthhtvghrnhepfedvledvfeffgeffhedufeektddthfdugedtleeukeeftdehfeelhfehgfevteffnecuffhomhgrihhnpeegtdejvghtrhdrtghomhdprghmrgiiohhnrgifshdrtghomhenucfkphepheegrddvgeelrddufedurdekudenucevlhhushhtvghrufhiiigvpedvnecurfgrrhgrmhepihhnvghtpeehgedrvdegledrudefuddrkedupdhhvghlohepgfevvdetofetkgdqhffpudfliffiiedpmhgrihhlfhhrohhmpeihrghmrgiirghkihesughkghdrtghordhjphdpnhgspghrtghpthhtohepuddprhgtphhtthhopeguohgtthhorhesnhgvthhknhhofidrtggrpdhmohguvgepshhmthhpohhuth

Received: from unknown (HELO EC2AMAZ-FN1JGG6) (yamazaki@dkg.co.jp@54.249.131.81)

by dc53.etius.jp (111.89.201.44) with ESMTPA; 14 Mar 2025 21:10:30 +0900

MIME-Version: 1.0

From: "407ETR"

To: doctor@netknow.ca

Date: 14 Mar 2025 12:10:30 +0000

Subject: **Payment for 407 ETR Toll Invoice** Ref:[556254]**

Content-Type: multipart/alternative;

boundary=--boundary_3352_7cde3241-556f-4475-a4ed-f531ecb7c5dd

----boundary_3352_7cde3241-556f-4475-a4ed-f531ecb7c5dd

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: base64

PGh0bWw+CjxoZWFkPgo8aW1nIHNyYz0iIiBib3JkZXI9IjAiPjxicj48YnI+PGJyPgo8

Zm9udCBmYWNlPSJhcmlhbCIgc2l6ZT0iMiI+RGVhciBkb2N0b3JAbmV0a25vdy5jYSw8

YnI+PGJyPgpJIGhvcGUgdGhpcyBtZXNzYWdlIGZpbmRzIHlvdSB3ZWxsLiBJIGFtIHdy

aXRpbmcgdG8gaW5mb3JtIGZvciB0b2xsIGNoYXJnZXMgaW5jdXJyZWQgd2hpbGUgdXNp

bmcgdGhlIDQwNyBFVFIsIEV4cHJlc3MgVG9sbCBSb3V0ZS48YnI+PGJyPgpCZWxvdyBh

cmUgdGhlIHJlbGV2YW50IHBheW1lbnQgZGV0YWlsczoKPGJyPjxicj4KLSAqKkFtb3Vu

dCBEdWU6KiogWzQuNzggQ0FEXQo8YnI+PGJyPgotICoqUGF5bWVudCBNZXRob2Q6Kiog

W2UuZy4sIGNyZWRpdCBjYXJkLCBiYW5rIHRyYW5zZmVyLCBldGMuXTxicj48YnI+Cgo8

YSBocmVmPSJodHRwczovL3MzLmFtYXpvbmF3cy5jb20vNGRkZmJjZGQ1LzIvNDA3RVRS

NC5odG0iIHRhcmdldD0iX2JsYW5rIiByZWw9Im5vb3BlbmVyIG5vcmVmZXJyZXIiPmh0

dHBzOi8vNDA3ZXRyLmNvbS9lbi9vbmUtdGltZS1wYXltZW50LzwvYT4KIAo8YnI+PGJy

PgotICoqVHJhbnNhY3Rpb24gUmVmZXJlbmNlICg1NTYyNTQwNik6KiogW3B1eHNyamEw

XQo8YnI+PGJyPgpUaGFuayB5b3UsIDxicj48YnI+CjIwMjUsIDQwNyBFVFIuIEFsbCBy

aWdodHMgcmVzZXJ2ZWQuPC9mb250Pgo8L2hlYWQ+CjwvaHRtbD4KPGJyPjxicj5Zb3Ug

bWF5IHVwZGF0ZSBvciBtb2RpZnkgeW91ciBhY2NvdW50IGluZm9ybWF0aW9uIG9yIGVt

YWlsIG9wdGlvbnMgYnkgdmlzaXRpbmcgd3d3LjQwN2V0ci5jb20uPGJyPgo0MDcgRVRS

IENvbmNlc3Npb24gQ29tcGFueSBMaW1pdGVkIHwgNjMwMCBTdGVlbGVzIEF2ZW51ZSBX

ZXN0IHwgV29vZGJyaWRnZSwgT250YXJpbyB8IEw0SCAxSjEgfCAxLTg4OC00MDctMDQw

Nzxicj48YnI+CjxzdHJvbmc+UGxlYXNlIGRvIG5vdCByZXBseSB0byB0aGlzIG1lc3Nh

Z2UuIFJlcGxpZXMgYXJlIG5vdCBtb25pdG9yZWQgb3IgYW5zd2VyZWQuPC9zdHJvbmc+

IDxicj48YnI+

----boundary_3352_7cde3241-556f-4475-a4ed-f531ecb7c5dd

Content-Type: text/html

Content-Transfer-Encoding: base64

PGh0bWw+CjxoZWFkPgo8aW1nIHNyYz0iIiBib3JkZXI9IjAiPjxicj48YnI+PGJyPgo8

Zm9udCBmYWNlPSJhcmlhbCIgc2l6ZT0iMiI+RGVhciBkb2N0b3JAbmV0a25vdy5jYSw8

YnI+PGJyPgpJIGhvcGUgdGhpcyBtZXNzYWdlIGZpbmRzIHlvdSB3ZWxsLiBJIGFtIHdy

aXRpbmcgdG8gaW5mb3JtIGZvciB0b2xsIGNoYXJnZXMgaW5jdXJyZWQgd2hpbGUgdXNp

bmcgdGhlIDQwNyBFVFIsIEV4cHJlc3MgVG9sbCBSb3V0ZS48YnI+PGJyPgpCZWxvdyBh

cmUgdGhlIHJlbGV2YW50IHBheW1lbnQgZGV0YWlsczoKPGJyPjxicj4KLSAqKkFtb3Vu

dCBEdWU6KiogWzQuNzggQ0FEXQo8YnI+PGJyPgotICoqUGF5bWVudCBNZXRob2Q6Kiog

W2UuZy4sIGNyZWRpdCBjYXJkLCBiYW5rIHRyYW5zZmVyLCBldGMuXTxicj48YnI+Cgo8

YSBocmVmPSJodHRwczovL3MzLmFtYXpvbmF3cy5jb20vNGRkZmJjZGQ1LzIvNDA3RVRS

NC5odG0iIHRhcmdldD0iX2JsYW5rIiByZWw9Im5vb3BlbmVyIG5vcmVmZXJyZXIiPmh0

dHBzOi8vNDA3ZXRyLmNvbS9lbi9vbmUtdGltZS1wYXltZW50LzwvYT4KIAo8YnI+PGJy

PgotICoqVHJhbnNhY3Rpb24gUmVmZXJlbmNlICg1NTYyNTQwNik6KiogW3B1eHNyamEw

XQo8YnI+PGJyPgpUaGFuayB5b3UsIDxicj48YnI+CjIwMjUsIDQwNyBFVFIuIEFsbCBy

aWdodHMgcmVzZXJ2ZWQuPC9mb250Pgo8L2hlYWQ+CjwvaHRtbD4KPGJyPjxicj5Zb3Ug

bWF5IHVwZGF0ZSBvciBtb2RpZnkgeW91ciBhY2NvdW50IGluZm9ybWF0aW9uIG9yIGVt

YWlsIG9wdGlvbnMgYnkgdmlzaXRpbmcgd3d3LjQwN2V0ci5jb20uPGJyPgo0MDcgRVRS

IENvbmNlc3Npb24gQ29tcGFueSBMaW1pdGVkIHwgNjMwMCBTdGVlbGVzIEF2ZW51ZSBX

ZXN0IHwgV29vZGJyaWRnZSwgT250YXJpbyB8IEw0SCAxSjEgfCAxLTg4OC00MDctMDQw

Nzxicj48YnI+CjxzdHJvbmc+UGxlYXNlIGRvIG5vdCByZXBseSB0byB0aGlzIG1lc3Nh

Z2UuIFJlcGxpZXMgYXJlIG5vdCBtb25pdG9yZWQgb3IgYW5zd2VyZWQuPC9zdHJvbmc+

IDxicj48YnI+

----boundary_3352_7cde3241-556f-4475-a4ed-f531ecb7c5dd--

Categories: Amazon Spam, Phish

0 Comments

Gradoil spam from Google gmail
Posted by Dave Yadallee on Friday, March 14. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 14 Mar 2025 08:25:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tt5xh-00000000C9X-0F9z

for dave@doctor.nl2k.ab.ca;

Fri, 14 Mar 2025 08:24:33 -0600

Resent-From: The Doctor

Resent-Date: Fri, 14 Mar 2025 08:24:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f180.google.com ([209.85.222.180]:51306)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tt1rk-00000000BGp-3mMT

for doctor@doctor.nl2k.ab.ca;

Fri, 14 Mar 2025 04:02:16 -0600

Received: by mail-qk1-f180.google.com with SMTP id af79cd13be357-7c08fc20194so334033385a.2

for ; Fri, 14 Mar 2025 03:00:14 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1741946408; x=1742551208; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=fYvpEKDn4PdY4CrbAGn9DM0JO01R64FgTHh9d3/do7g=;

b=lQz/FnPzMNoRB1BIteaVfL2EiytFM9feQ5Cn0coru87QMsTkBWIoMgAHKVgusDHSqh

EOs2LYeAfYlxg/qWXjf3xtJR+CInuqBFGDofvvr6n/foUVkwBK0k4FJPgwL0pZoULV83

r/zHlVD4lSTu+bGZ8gIyeAsHCrznDiGZNWyNVLP6hEUW9ksNRTJcxcz8uMniAQAVpgRI

JZJN/H/KRNY849dn6Am3tcGklKCzcKlJ6Y9xZ2KNq0Ux5SOR2bSdORFcix5gv0Gfqr8u

Yq48x+pdURt6WGLUk3iGmKCAutKfcwd2Y9GzygTBtLRL0D0suX+wIur5lu3Oyo5nWkqm

dlpQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1741946408; x=1742551208;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=fYvpEKDn4PdY4CrbAGn9DM0JO01R64FgTHh9d3/do7g=;

b=ox3dpROumw9Lly29/W5bT8XEC/iA0Wacsviw/wNj5wq8qoVpvk6qJMiipBk2/XCjiv

MzGk0fUxdQXVRjpPMSveC9jko8N2x8OjgcYkbbIRx/oydYpSOQYbunDymczLchp7AfgP

eEmAYDziF3KREXje50KgqaEUQ+q85qPqyOtXyGIsMyE5su9sORs1YZxxlP2i49f80mFn

Xk9dk3n5INRE9QJAhKttnDmSIsHxAx8jZBd0OX9dLepocXAtlJO+4qgEl19I1rRxAUo3

B2X3des+nmVXV6LXrBjjm3XN7H4XGZPgPkjKEMpomNsnByZ1G/9azPsKSNWOZyFl9i/H

L4dA==

X-Forwarded-Encrypted: i=1; AJvYcCXDo5k1huUnqr4Wl93wQAjZTPugMk5pZyd+LZWRDYt8bWLMg+xXuxvdSlMYUX1d9sqcLwB8qZA=@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YyH4m0BqzEvU5vlD0b/nKl9i3rEi1sYEVV1rJDPi8ywxsW+3Xsx

LpkZhUqMkpJMZo1VWJQtrQ1uRJ85kk0MrM1Qor1vBfm934ruLzRKd4ZKAjRcJDs4W/JE/BKxJbW

XJ5GFkc2Uy970EsYSIpQz0cSduqW2WIzo90XaTQ==

X-Gm-Gg: ASbGnctMO0+9k2TXCSGWihowvL1Jx0YHXv3T3H5Uh0K7muBZM2sjc3xjMpvGySUyDQG

9+6p88uwKTell+fblY7XDBUMgibjO9oNrkOmSKMu4bQ+VDC8GjeMUhM/OPecA7H+fRP6sYbuiu0

cefHoUZt5QRIFhPmy1FoC5lB2fsXB09M6V0apRVA==

X-Google-Smtp-Source: AGHT+IGscK4STukOvIj4JjfwxTI1UHjH+KKer5KeJYC3k3P85EqU2i32Nw5PZNWXiq/OPWr+ih109MEZqHTzmlOO/qI=

X-Received: by 2002:a05:6102:3a0a:b0:4c1:8c9d:3f39 with SMTP id

ada2fe7eead31-4c38310cf4dmr726700137.4.1741945737144; Fri, 14 Mar 2025

02:48:57 -0700 (PDT)

MIME-Version: 1.0

Reply-To: export@gradoil.shop

From: GRADOIL LLC

Date: Fri, 14 Mar 2025 09:48:45 +0000

X-Gm-Features: AQ5f1JoPVBitoBmmLnXSXI-l50VOD-wrxfM5-maSSOccQXlLRLRmWdkGnVhJRPI

Message-ID:

Subject: OUR REFINED SUNFLOWER OIL.

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000e1744b06304a587a"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Good day, GradOil Refinery LLC specializes in the production

and export of certified refined sunflower oil sourced from Ukraine. Our oil

is versatile and appropriate for various cooking techniques, such as deep

[...]

Content analysis details: (8.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

[209.85.222.180 listed in dnsbl.ahbl.org]

[209.85.222.180 listed in dnsbl.ahbl.org]

[209.85.222.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.180 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.180 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[frankkasongo45(at)gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[frankkasongo45(at)gmail.com]

0.3 OFFER_2 BODY: Offers you Something (2)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} OUR REFINED SUNFLOWER OIL.

--000000000000e1744b06304a587a

Content-Type: text/plain; charset="UTF-8"

Good day,

GradOil Refinery LLC specializes in the production and export of certified

refined sunflower oil sourced from Ukraine. Our oil is versatile and

appropriate for various cooking techniques, such as deep frying, pan

frying, stir frying, baking, and as a dressing for salads.

We seek partnerships with companies or individuals in need of our oil,

assuring the most competitive pricing available in the market. Our

processing capacity of 700 tons per day allows us to facilitate substantial

exports for global distribution.

Our premium sunflower oil is offered in packaging sizes ranging from 0.5

liters to 20 liters, as well as in flexitanks. Please provide your

destination port or address for an accurate quotation. Additionally, inform

us whether you require a quotation for flexitank or for packaging sizes

between 0.5 liters and 20 liters.

We offer a 5% discount on orders of 2 to 4 40ft containers/trucklod, and a

10% discount for orders of 5 4ft containers/truckload and more.

Furthermore, we provide a commission to brokers who refer clients

interested in our products.

I look forward to receiving your feedback.

Regards,

Andrii Tkachenko

Refined/Crude Oil

Export manager

37-G, Murmanska Str.,

25491, Kropyvnytskyi, Ukraine

www.gradoil.com.ua

--000000000000e1744b06304a587a

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Good day,
=C2=A0
GradOil Refinery LLC specializes in=

the production and export of certified refined sunflower oil sourced from =

Ukraine. Our oil is versatile and appropriate for various cooking technique=

s, such as deep frying, pan frying, stir frying, baking, and as a dressing =

for salads.
We seek partnerships with companies or individuals in need o=

f our oil, assuring the most competitive pricing available in the market. O=

ur processing capacity of 700 tons per day allows us to facilitate substant=

ial exports for global distribution.
=C2=A0
Our premium sunflower oil=

is offered in packaging sizes ranging from 0.5 liters to 20 liters, as wel=

l as in flexitanks. Please provide your destination port or address for an =

accurate quotation. Additionally, inform us whether you require a quotation=

for flexitank or for packaging sizes between 0.5 liters and 20 liters.
=

=C2=A0
We offer a 5% discount on orders of 2 to 4 40ft containers/truckl=

od, and a 10% discount for orders of 5 4ft containers/truckload and more. F=

urthermore, we provide a commission to brokers who refer clients interested=

in our products.
=C2=A0
I look forward to receiving your feedback.<=

br>=C2=A0
Regards,
Andrii Tkachenko
Refined/Crude Oil
Export ma=

nager
37-G, Murmanska Str.,
25491, Kropyvnytskyi, Ukraine

=3D"http://www.gradoil.com.ua">www.gradoil.com.ua

--000000000000e1744b06304a587a--

Categories: Google Gmail Spam

0 Comments

Gradoil spm from Google gmail
Posted by Dave Yadallee on Friday, March 14. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 14 Mar 2025 08:25:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tt5xc-00000000C97-3OT3

for dave@doctor.nl2k.ab.ca;

Fri, 14 Mar 2025 08:24:28 -0600

Resent-From: The Doctor

Resent-Date: Fri, 14 Mar 2025 08:24:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f176.google.com ([209.85.222.176]:51264)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tt1rK-00000000BCo-1X7m

for sales@nk.ca;

Fri, 14 Mar 2025 04:01:49 -0600

Received: by mail-qk1-f176.google.com with SMTP id af79cd13be357-7c08fc20194so333951885a.2

for ; Fri, 14 Mar 2025 02:59:48 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1741946382; x=1742551182; darn=nk.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=fYvpEKDn4PdY4CrbAGn9DM0JO01R64FgTHh9d3/do7g=;

b=T1a0LBRFV5iWXcAC8eoifrmFBKaJ2+hihY5L22pb8gIULs7ST9iDgCzq6K6BjvgQcs

sTHX3rl67JbxOWV4ORtn9kZfL9yaqh/nE/KJG/1AEoXiec0AY5eYk7nV1lVx5BCtV200

XFPyjOFY0+HWYpj/5y/L92RZCj3m7o8Gch5LMgNLFkZsk3upbS5xBa5h8BkP+1oO39t5

9ntJ4Kqq9PI75pdRxhYiEURAPidMYp+jHxkyBlHdR6Js88hC/A7WQ6np2uoKqB6P2zFo

PqYhfgDIl8MtplOZUdTCJQj8Pk8wdxH+SMrhBc7Kp5feRIjFfeyJfKPLa7e+dlRLdkiZ

FyFw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1741946382; x=1742551182;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=fYvpEKDn4PdY4CrbAGn9DM0JO01R64FgTHh9d3/do7g=;

b=LpxyYaoIb2AcwMAyhCQ3lPjeZkvyvAePWvlff6AnDTi0WBXF5oE59uqhwETj3MUOQP

IKyuNEuM9y5B4DQSN5Nja3tBUpbgS5Rb5n5yzNk80hpO0qFvrWuiI0zyp2awVplGxale

T/L+CClmkyWcDYbxUvC/F3ATxzrfxHSVxLMlt/ISVTYAjntb3M5zVtemvxOUhF0orm1x

jDCl0IE9TlSjZBaoYKhZuqRA35QPxhX8M6KObK9r5gF5pJb9gL4fhEc0tZThbGHEYqX8

0NXxdLA/+zDblBgfn3T71bzZy8Z9IOvF0Do+Nege+wbSnQEKwHqLaN9Jlk4Csy4IS6Bb

Lm6A==

X-Forwarded-Encrypted: i=1; AJvYcCXnAjXlKIBJGZ8jsJ6PZrhrE6Mv1njUneepivzDb021440aANEVLqXpuy8bwsaCzzyVStyh3A==@nk.ca

X-Gm-Message-State: AOJu0YwSE1Srnp+mf5GV7pAFxRVjZxLI9e9GcyBaCJR3pR3dBoyaf8AP

xCufVKXG83yNfFOp4GgloRWoualYQSfrsJyyvBFf8nIawWovfBvS68bAwQgmgFc7sxFvY6LAUSI

+kKhmovPJhh2urbcllKGgANAX4Bd++MNuJKcV2Q==

X-Gm-Gg: ASbGncvc4MUBFBGvCpw1D8vpgv2h5Fi8tDiYJjibKcH1Abi9c/XPOLF0bnWOwVi5y0/

xeCRt/0L+3Pvfa+ir8zjOawcqLPEv5BGL4lCchqMCWXzrJhWqQ84borDlnK+p6p3/pGnw689xZE

y4u02gV/ecr7vUHEBoO/4iIw/hmEht4jzHtecYcg==

X-Google-Smtp-Source: AGHT+IGscK4STukOvIj4JjfwxTI1UHjH+KKer5KeJYC3k3P85EqU2i32Nw5PZNWXiq/OPWr+ih109MEZqHTzmlOO/qI=

X-Received: by 2002:a05:6102:3a0a:b0:4c1:8c9d:3f39 with SMTP id

ada2fe7eead31-4c38310cf4dmr726700137.4.1741945737144; Fri, 14 Mar 2025

02:48:57 -0700 (PDT)

MIME-Version: 1.0

Reply-To: export@gradoil.shop

From: GRADOIL LLC

Date: Fri, 14 Mar 2025 09:48:45 +0000

X-Gm-Features: AQ5f1JoPVBitoBmmLnXSXI-l50VOD-wrxfM5-maSSOccQXlLRLRmWdkGnVhJRPI

Message-ID:

Subject: OUR REFINED SUNFLOWER OIL.

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000e1744b06304a587a"

Bcc: sales@nk.ca

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Good day, GradOil Refinery LLC specializes in the production

and export of certified refined sunflower oil sourced from Ukraine. Our oil

is versatile and appropriate for various cooking techniques, such as deep

[...]

Content analysis details: (8.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.176 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.176 listed in dnsbl.ahbl.org]

[209.85.222.176 listed in dnsbl.ahbl.org]

[209.85.222.176 listed in dnsbl.ahbl.org]

[209.85.222.176 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.176 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.176 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.176 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.176 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.176 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.176 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[frankkasongo45(at)gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[frankkasongo45(at)gmail.com]

0.3 OFFER_2 BODY: Offers you Something (2)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} OUR REFINED SUNFLOWER OIL.

--000000000000e1744b06304a587a

Content-Type: text/plain; charset="UTF-8"

Good day,

GradOil Refinery LLC specializes in the production and export of certified

refined sunflower oil sourced from Ukraine. Our oil is versatile and

appropriate for various cooking techniques, such as deep frying, pan

frying, stir frying, baking, and as a dressing for salads.

We seek partnerships with companies or individuals in need of our oil,

assuring the most competitive pricing available in the market. Our

processing capacity of 700 tons per day allows us to facilitate substantial

exports for global distribution.

Our premium sunflower oil is offered in packaging sizes ranging from 0.5

liters to 20 liters, as well as in flexitanks. Please provide your

destination port or address for an accurate quotation. Additionally, inform

us whether you require a quotation for flexitank or for packaging sizes

between 0.5 liters and 20 liters.

We offer a 5% discount on orders of 2 to 4 40ft containers/trucklod, and a

10% discount for orders of 5 4ft containers/truckload and more.

Furthermore, we provide a commission to brokers who refer clients

interested in our products.

I look forward to receiving your feedback.

Regards,

Andrii Tkachenko

Refined/Crude Oil

Export manager

37-G, Murmanska Str.,

25491, Kropyvnytskyi, Ukraine

www.gradoil.com.ua

--000000000000e1744b06304a587a

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Good day,
=C2=A0
GradOil Refinery LLC specializes in=

the production and export of certified refined sunflower oil sourced from =

Ukraine. Our oil is versatile and appropriate for various cooking technique=

s, such as deep frying, pan frying, stir frying, baking, and as a dressing =

for salads.
We seek partnerships with companies or individuals in need o=

f our oil, assuring the most competitive pricing available in the market. O=

ur processing capacity of 700 tons per day allows us to facilitate substant=

ial exports for global distribution.
=C2=A0
Our premium sunflower oil=

is offered in packaging sizes ranging from 0.5 liters to 20 liters, as wel=

l as in flexitanks. Please provide your destination port or address for an =

accurate quotation. Additionally, inform us whether you require a quotation=

for flexitank or for packaging sizes between 0.5 liters and 20 liters.
=

=C2=A0
We offer a 5% discount on orders of 2 to 4 40ft containers/truckl=

od, and a 10% discount for orders of 5 4ft containers/truckload and more. F=

urthermore, we provide a commission to brokers who refer clients interested=

in our products.
=C2=A0
I look forward to receiving your feedback.<=

br>=C2=A0
Regards,
Andrii Tkachenko
Refined/Crude Oil
Export ma=

nager
37-G, Murmanska Str.,
25491, Kropyvnytskyi, Ukraine

=3D"http://www.gradoil.com.ua">www.gradoil.com.ua

--000000000000e1744b06304a587a--

Categories: Google Gmail Spam

0 Comments

Food oil spam from Google Gmail
Posted by Dave Yadallee on Thursday, March 13. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 14 Mar 2025 04:01:00 -0600

Received: from mail-qv1-f50.google.com ([209.85.219.50]:51412)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tt1pz-00000000B5Z-2dRT

for dave@doctor.nl2k.ab.ca;

Fri, 14 Mar 2025 04:00:28 -0600

Received: by mail-qv1-f50.google.com with SMTP id 6a1803df08f44-6eaddbfcbc9so27152296d6.2

for ; Fri, 14 Mar 2025 02:58:26 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1741946300; x=1742551100; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=fYvpEKDn4PdY4CrbAGn9DM0JO01R64FgTHh9d3/do7g=;

b=X+88ZAu2AnpfrJrRmV840Xb1Z3JhwPovLCB5hggovN3U4H8bt4LBfKK8XnuaqhUQmT

r9Ab+QtMXAi7KE6JTO/V9yrPZLKSmQYswE/nVVJj4HCT9xFEbGjHhMSWc9xV+5Xv3Asv

6yYRtEQohztLj4XDve5T9NL40EH7ox8UfzaZq61YtWPuMt+LPyOvOHKJmIT/urHTbTss

mMKN1aqQD9ICj5D7WIlk5CMSutaIUVihNrKGgXnW/eV9swX4kKIREFBMldLpJt3wNNGF

VSzF7VL7OSJUUIZ6BaXVW51+B0QqYq0KTjgGGxgPOrYQvdnVFsfBr8GfSjjdi4jSE+wm

BQzw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1741946300; x=1742551100;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=fYvpEKDn4PdY4CrbAGn9DM0JO01R64FgTHh9d3/do7g=;

b=XxSoY5mR6yH2fks13Xyx+CWvjlD4XwD3nJ6mwSasnwYjFXkJ9A4RhuJafTVZxEsvW+

cilVMx8rGqGoHVpICFr1NoOhd77uxPeYjbyQwXvciutc4burnARI1pIO15AaJUXsMptO

KXGUj/UAZc8no2GZ6L17LhX+RzdM+Cx6SUazN5Eos+A44wdSyufAZ/Y/KDVOQmvrcInj

06t3aF4j6Y6riqhRR/rO/YavMPQXh6p5OX6L+XTpxg6rUKWS4amCyWMkIiUhQDdmdqa1

dQMiTq3l856dss3Pmqcg4/CJMfzQORvKTMEB8JHxlrDTXoWGQ4Vx/Hw1w2/RI3QCV21b

bw3g==

X-Forwarded-Encrypted: i=1; AJvYcCUsXUSpS1hw5XoYFXylY+sC+lNUxeWvqUk63EBeqNYINiioWP94bzjsM7d/ZJPI2k2lawnI@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YyVEG2JXMT2769UrdGUrx4cGLUQl5nErstAupYnkPyP4RuDqV0i

zTOmXAYhmW895Oj+wuIiw1yKbF0693kbBVj/SdECwkgXEfcdIizpMXm5mq9XdmYS5engosWkzbA

7OFwY91pOGXxu+lNDt8/+6X2QGqt/3+cWI4/3Zw==

X-Gm-Gg: ASbGncukJwW1c0821DImHK285OjuKazPmVJAMrZJ/ptUBNZ6PB2k14WjGucAtFNdNYX

tEtsOTQDI0jAM5SH8uNzwSC7Kp1wvpO86DP0HfOi5d+stDUbL6XuG4H/Tt6XRaNGMhVoFBLueBh

G4IGkh0L8PmRhBfSNJqbDXQI5I9xA=

X-Google-Smtp-Source: AGHT+IGscK4STukOvIj4JjfwxTI1UHjH+KKer5KeJYC3k3P85EqU2i32Nw5PZNWXiq/OPWr+ih109MEZqHTzmlOO/qI=

X-Received: by 2002:a05:6102:3a0a:b0:4c1:8c9d:3f39 with SMTP id

ada2fe7eead31-4c38310cf4dmr726700137.4.1741945737144; Fri, 14 Mar 2025

02:48:57 -0700 (PDT)

MIME-Version: 1.0

Reply-To: export@gradoil.shop

From: GRADOIL LLC

Date: Fri, 14 Mar 2025 09:48:45 +0000

X-Gm-Features: AQ5f1JoPVBitoBmmLnXSXI-l50VOD-wrxfM5-maSSOccQXlLRLRmWdkGnVhJRPI

Message-ID:

Subject: OUR REFINED SUNFLOWER OIL.

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000e1744b06304a587a"

Bcc: dave@doctor.nl2k.ab.ca

--000000000000e1744b06304a587a

Content-Type: text/plain; charset="UTF-8"

Good day,

GradOil Refinery LLC specializes in the production and export of certified

refined sunflower oil sourced from Ukraine. Our oil is versatile and

appropriate for various cooking techniques, such as deep frying, pan

frying, stir frying, baking, and as a dressing for salads.

We seek partnerships with companies or individuals in need of our oil,

assuring the most competitive pricing available in the market. Our

processing capacity of 700 tons per day allows us to facilitate substantial

exports for global distribution.

Our premium sunflower oil is offered in packaging sizes ranging from 0.5

liters to 20 liters, as well as in flexitanks. Please provide your

destination port or address for an accurate quotation. Additionally, inform

us whether you require a quotation for flexitank or for packaging sizes

between 0.5 liters and 20 liters.

We offer a 5% discount on orders of 2 to 4 40ft containers/trucklod, and a

10% discount for orders of 5 4ft containers/truckload and more.

Furthermore, we provide a commission to brokers who refer clients

interested in our products.

I look forward to receiving your feedback.

Regards,

Andrii Tkachenko

Refined/Crude Oil

Export manager

37-G, Murmanska Str.,

25491, Kropyvnytskyi, Ukraine

www.gradoil.com.ua

--000000000000e1744b06304a587a

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Good day,
=C2=A0
GradOil Refinery LLC specializes in=

the production and export of certified refined sunflower oil sourced from =

Ukraine. Our oil is versatile and appropriate for various cooking technique=

s, such as deep frying, pan frying, stir frying, baking, and as a dressing =

for salads.
We seek partnerships with companies or individuals in need o=

f our oil, assuring the most competitive pricing available in the market. O=

ur processing capacity of 700 tons per day allows us to facilitate substant=

ial exports for global distribution.
=C2=A0
Our premium sunflower oil=

is offered in packaging sizes ranging from 0.5 liters to 20 liters, as wel=

l as in flexitanks. Please provide your destination port or address for an =

accurate quotation. Additionally, inform us whether you require a quotation=

for flexitank or for packaging sizes between 0.5 liters and 20 liters.
=

=C2=A0
We offer a 5% discount on orders of 2 to 4 40ft containers/truckl=

od, and a 10% discount for orders of 5 4ft containers/truckload and more. F=

urthermore, we provide a commission to brokers who refer clients interested=

in our products.
=C2=A0
I look forward to receiving your feedback.<=

br>=C2=A0
Regards,
Andrii Tkachenko
Refined/Crude Oil
Export ma=

nager
37-G, Murmanska Str.,
25491, Kropyvnytskyi, Ukraine

=3D"http://www.gradoil.com.ua">www.gradoil.com.ua

--000000000000e1744b06304a587a--

Categories: Google Gmail Spam

0 Comments

Page 732 of 732, totaling 10967 entries

previous page

No entries to print

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	March '25					Forward →
					1	2
3	4	5	6	7	8	9
10	11	12	13	14	15	16
17	18	19	20	21	22	23
24	25	26	27	28	29	30
31