NetKnow Corporate Blog

Web/SEO/App spam from Google Gmail

Posted by Dave Yadallee on Monday, March 31. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 31 Mar 2025 14:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1tzLYI-00000000IVI-3E2I

for dave@doctor.nl2k.ab.ca;

Mon, 31 Mar 2025 14:16:10 -0600

Resent-From: The Doctor

Resent-Date: Mon, 31 Mar 2025 14:16:10 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f169.google.com ([209.85.214.169]:48451)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1tzJj6-00000000Iaq-2uxD

for root@nk.ca;

Mon, 31 Mar 2025 12:19:22 -0600

Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-224019ad9edso5733175ad.1

for ; Mon, 31 Mar 2025 11:17:18 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1743445032; x=1744049832; darn=nk.ca;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=OwHjxamQxsmGhErfXA03h6UAzUTgFUMfj4OOHOKxou4=;

b=TwgzAb/Y2/hlsB0i/PFsZN4w2biDItIK3eGcV2pSydsnoZ9/tDMKj8jBXYwXLI/YT+

XPEeyA+aPKVpm9XZ5kXfENYYlYwLV9A1QahJx+5+50TIr1P++LTvyfAMUORFMoy/YahA

WSZKxFXI//bgrjaHMZALlu6R0iy61NwwMlBnOsmgsEZzK5noPIeqRgx1fYWuj/irWvHL

33k3TdEeaIp7pawkgPb7arck57DKGSXNmvQpEVPOt7EU4QxG9+BAyXqntg7EgoZ1w4KG

f/3sFK4GDv+1PgfTN6NsHcFM9Y8Eb+4xUT12xrrnwQQWTjbGFtqd3Gxt9tMJv7XNu9EP

4c7Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1743445032; x=1744049832;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=OwHjxamQxsmGhErfXA03h6UAzUTgFUMfj4OOHOKxou4=;

b=Hzft0Iyz6pe1y94fT/I+goeMzY6kuQ8l06dZHjafvDfObOa9mM4sEwYRTvUxN7sZEs

7Y430PVw4ty8NnmYFT4Ww2m8Onv6tcahsX7Hkwp9OuwDp277xzJiE6v1WmsR/7zg57fO

H67IpotUFXK+qY9PRmhzTcQMdHae5VDaGH1r7bwlzkRlaoMaMkXIaiAvDHevAJSSnjQq

vi0HYosEvDs8A3hvV84ddQJcD2wBz0Zey1zT4lOwYigbDYsG9VXTu7Rl80jTJ9HjsyWd

MPkYSl0OxPsgBAL0a3lrftMCe0VisumkkdupsmZbogkIfDpAvZdfpuM4n0dbA1uKi1DL

K21w==

X-Gm-Message-State: AOJu0YzNkxgUO4fTC/xEdaZBrkABVq6DP5XCo+4zeybAiFNH/Si4l2du

Rdk4AN+/J87YOzBaBFr77Kl2zHTwAtdItkrTpPUEX4ZYHnsQEXp6ROK3ww==

X-Gm-Gg: ASbGncueD+ZbvX09nwm7oRXVgL2wJdMEa/lcR8PYXuKL+sjgcaWlw0vLLETqe6zeuGq

Ja/R1QDakczcNFKj+mxmM+LkGKI/S8V2z9teNMH2lYDfDYGOo7JvYSaXrZOYu3vepD1eN2CX7aO

9d/Cm4gfYUiGcFVAJK3cdIUrFKpSPTtkIF7fV6yXakgmInxxBkALP7bS6isr5oNRVvV0WWXNwoT

noZl7lQhQeDKO0JqO+qqB/13L78oBgaxfw9xtubdWkiVVoYwMCyO+hn3J/IOs1djrb1FsfxSVyF

Unh8lXAlDBhfY8f+6Cdm1L3w8ilncueynVbaj55AkTycuRbrpKKW77LyE+4A

X-Google-Smtp-Source: AGHT+IHZSmd06tPodJbWtN8Ju2MZGaiSA+T8JsKziD9P+DpqIVEDzyBD+mKXfoUJXNVWJUzqyW6Uzg==

X-Received: by 2002:a05:6a20:6f8f:b0:1fe:90c5:7cfd with SMTP id adf61e73a8af0-2009f609361mr15145438637.16.1743445032269;

Mon, 31 Mar 2025 11:17:12 -0700 (PDT)

Received: from DESKTOP5K6VSPA ([2401:4900:a055:c27b:31eb:27c:8f2e:1be6])

by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-af93b6db0b4sm6624265a12.38.2025.03.31.11.17.10

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Mon, 31 Mar 2025 11:17:11 -0700 (PDT)

From: Patmon

X-Google-Original-From: "Patmon"

To:

Subject: Re: E-commerce shopping apps !!

Date: Mon, 31 Mar 2025 23:46:16 +0530

Message-ID: <345a01dba269$1f14bc40$5d3e34c0$@com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_345B_01DBA297.38CCF840"

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: AduiaOi5ZE2z64INRguZXmbRAaXI9Q==

Content-Language: en-us

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi,root@nk.ca Are you looking for web design and mobile app

development services (such as an upgrade, repair, or redesign)? Please share

your thoughts and concerns with availability so we can schedule a chat to

discuss further.

Content analysis details: (5.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2401:4900:a055:c27b:31eb:27c:8f2e:1be6 listed in]

[will-spam-for-food.eu.org]

[2401:4900:a055:c27b:31eb:27c:8f2e:1be6 listed in]

[will-spam-for-food.eu.org]

[2401:4900:a055:c27b:31eb:27c:8f2e:1be6 listed in]

[will-spam-for-food.eu.org]

[2401:4900:a055:c27b:31eb:27c:8f2e:1be6 listed in]

[will-spam-for-food.eu.org]

[2401:4900:a055:c27b:31eb:27c:8f2e:1be6 listed in]

[will-spam-for-food.eu.org]

[2401:4900:a055:c27b:31eb:27c:8f2e:1be6 listed in]

[will-spam-for-food.eu.org]

[2401:4900:a055:c27b:31eb:27c:8f2e:1be6 listed in]

[will-spam-for-food.eu.org]

[2401:4900:a055:c27b:31eb:27c:8f2e:1be6 listed in]

[will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

[209.85.214.169 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.169 listed in dnsbl.ahbl.org]

[209.85.214.169 listed in dnsbl.ahbl.org]

[209.85.214.169 listed in dnsbl.ahbl.org]

[209.85.214.169 listed in dnsbl.ahbl.org]

[2401:4900:a055:c27b:31eb:27c:8f2e:1be6 listed in]

[dnsbl.ahbl.org]

[2401:4900:a055:c27b:31eb:27c:8f2e:1be6 listed in]

[dnsbl.ahbl.org]

[2401:4900:a055:c27b:31eb:27c:8f2e:1be6 listed in]

[dnsbl.ahbl.org]

[2401:4900:a055:c27b:31eb:27c:8f2e:1be6 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.169 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.169 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.169 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.169 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.169 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.169 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[patnowak358(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[patnowak358(at)gmail.com]

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Re: E-commerce shopping apps !!

This is a multipart message in MIME format.

------=_NextPart_000_345B_01DBA297.38CCF840

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit

Hi,root@nk.ca

Are you looking for web design and mobile app development services (such as

an upgrade, repair, or redesign)?

Please share your thoughts and concerns with availability so we can schedule

a chat to discuss further.

Thanks,

Patmon,

------=_NextPart_000_345B_01DBA297.38CCF840

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">

charset=3Dus-ascii">

Hi,root@nk.ca

Are you looking for web design and mobile app =

development

services (such as an upgrade, repair, or redesign)?

Please share your thoughts and concerns with =

availability so

we can schedule a chat to discuss further.

Thanks,

Patmon,

------=_NextPart_000_345B_01DBA297.38CCF840--

Web/SEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on Monday, March 31. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 31 Mar 2025 09:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1tzHC7-00000000G2U-3Hct

for dave@doctor.nl2k.ab.ca;

Mon, 31 Mar 2025 09:36:59 -0600

Resent-From: The Doctor

Resent-Date: Mon, 31 Mar 2025 09:36:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastasiaazolkn19011035.outbound.protection.outlook.com ([52.103.64.35]:51554 helo=HK3PR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1tzGQ6-000000005ZY-0ywE

for MAILER-DAEMON@doctor.nl2k.ab.ca;

Mon, 31 Mar 2025 08:47:33 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=UvTTaHn4kVa9EYI6DJas96NZLdriQLYbNgemWUOxB6vxcSLgJZuPJhMdzxqAnJXVt4HirHc3Lf4H9/1lHzl/a9W7EM7UHB9GSi+4rMo/tHHCfQwevOZcIBy0/UkpRBujdOPDJfEzi4pcHVa5bckK0GQnONShYy4jhzT0AFqZiFkhCDv8gCCirSUmWELOQL/S07Z9Zzti5ZlXulZeI1pxkfuDRPLh/JHSXWVbKR7y/gdVXqojSHPwsKclNz6WAXtYOca1VpyAeHkbfP9ksuCiSKhyS0ouaYHzVpBUEEBbjdTUoWQsoHw7hSPyozOgpWX+9txOGPFx063VLsKRhddDYg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=bPPNfCDThnBJ7J6rFrx5OcnYJsbsxTrJk/QVf5oC/X4=;

b=WoZvDf/xB2/+uxhGg+0DPtIrfcibs2VXwKZHXflbIPpcIoKSuIbWWbpUdK2fw8Ng01iR4smYpW2gnsMFO0agfW/WzT9Giqa/Z/4TuKwJiAUYpAi9jDRVIVI8X5QEUoe+pp3gVqp4aTL/CN3anrwZcSP13mRxW2hqQbYB9BuT8qumJsBXK5hvlqTna1r3n57PsCCknnR6eoRxIdwfhxkIXseCsz0zT0T8vn2h2qZEtoZL4xIlIoAmMAVzkIyEQV5kOSxYJMrc7TIANM6cC1ThTOOvgdxvcTRARKxBGDx4JRz8OpzSLWJ0LQSZEqRk5/ROYAHxAc1q1Wq1Ah0OQzd32Q==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=bPPNfCDThnBJ7J6rFrx5OcnYJsbsxTrJk/QVf5oC/X4=;

b=W2A3mXR4/34HbEounIZZbDMUj9hp+DrQa9yQ/x11QnrmLFnKziBCHmTDIG8h7KnQy45xLr0Hf6mdnd4QbVSn5DlupasBkIqgPV7/ODHa7hf6go1nFCkleIFjPi633xnU3eCXV1d97IWLh8n0m4WXWTELUw80OP27KmJnDaVWBdKNoA2OP6D1tynrCaUa1ajvgkMdZIdOdFcrk9GYsHtrQE6PjwYFGPgUGJXKeXnPI+pnME12CIQlIRMYr774GPX7U7GTb/JStoV4x7+v4CIq36yy+82ifq6IanxoLFWeA91u9A4gKS4nhRI21Qu/HCdDCxiLL6xLdYqygcZpxvELlw==

Received: from SI2PR04MB6619.apcprd04.prod.outlook.com (2603:1096:4:1fe::7) by

PUZPR04MB6820.apcprd04.prod.outlook.com (2603:1096:301:113::16) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8583.33; Mon, 31 Mar

2025 14:44:47 +0000

Received: from SI2PR04MB6619.apcprd04.prod.outlook.com

([fe80::b603:7b68:9e2f:c91d]) by SI2PR04MB6619.apcprd04.prod.outlook.com

([fe80::b603:7b68:9e2f:c91d%6]) with mapi id 15.20.8583.036; Mon, 31 Mar 2025

14:44:47 +0000

From: Sameer Rastogi

To: Sameer Rastogi

Subject: Fw: YES

Thread-Topic: YES

Thread-Index: AQHbn/lVIEVo3lhtfUKlwTJ51bf67LONVak8

Date: Mon, 31 Mar 2025 14:44:46 +0000

Message-ID:

References:

In-Reply-To:

Accept-Language: en-US, en-IN

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SI2PR04MB6619:EE_|PUZPR04MB6820:EE_

x-ms-office365-filtering-correlation-id: 53de4f61-35d0-4a6b-206c-08dd70629502

x-microsoft-antispam:

BCL:0;ARA:14566002|15080799006|461199028|15030799003|8062599003|8060799006|19110799003|102099032|3412199025|440099028|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?tG7Fi555jH/Alu8iNLrmPpyIlSydKGIdqcH2EZQbSFB3SS+W8aoN0EPHsI?=

=?iso-8859-1?Q?uSlVnJl60ihLQjg8/3U7vZEfwZkPpA1iyPZOk164veAa/V6ondZUMMHStE?=

=?iso-8859-1?Q?w0yyeM04vrVXc9/W0F1oUQN+EoZrtfE11SmgqhVXmsX06dvCvAQ1CBaF2S?=

=?iso-8859-1?Q?976sJD2+RDMeqPdHUzfgpNQi+H3eha1XCNRdlJhHOWo3xGjOlUSiweTamy?=

=?iso-8859-1?Q?GgQ+NyZ2jWBmRx1gF5vIG0hILBuwb9icugU9uGo8yv5km5wW9VWzMYqLCZ?=

=?iso-8859-1?Q?gGVfYxl/w9oyEPFffyCHZ3NnzihY64FNDi69INz9vtcZo3btnuCZxrhCUF?=

=?iso-8859-1?Q?AU/AuigSOyGUDPJb87ne/GaCHyDHL3YN69X3k3HJV3PO9W2saIyunLicKK?=

=?iso-8859-1?Q?De7LLB1ygTRlabFHhpaXp9a4rnG/+RR1LWmNOQaTjg6XBUFF6b3EEZEceL?=

=?iso-8859-1?Q?/gO0llTo5Y/LcXHNTpIAi7JqjaI+d8Lt2VOxaxzCyg98yZ7//ukNU5VgsY?=

=?iso-8859-1?Q?i3dbG7H9Sfqv0PkRAs5UOQZSQuS+u6aGEPJKl9aqDC0DqrvCOZc5sUPgF4?=

=?iso-8859-1?Q?LGM/dWh1ubjiJuVIxx420vc3ZhddHaxazSqpzglTjFSBkWY/RD3suz9tch?=

=?iso-8859-1?Q?AIjeq+EZ8n1YL6zeKy8Ogic88cyw+RpcphZKcYzVZHC6f1bntoBu+y/LUL?=

=?iso-8859-1?Q?BfChBNE5SDarEuIml/yqZemZMo8KycMNpfmT7Cr9q/YSbybt4VrRjrMBLy?=

=?iso-8859-1?Q?8Cje+a+P/X7hs5oo0L09cYAUIGGLx/Rbyj98kh3uYciahKwi+zUi3IJMFe?=

=?iso-8859-1?Q?WeGbgUQ7xhxLKovKxb8YriSVhXb2IVuVKaKfMm6f+cVwfUTqIBGu4rpyB2?=

=?iso-8859-1?Q?4G424nlj5HenqSXpV3M+nIbgZq+m5+hEmK/LibrakftN+ouhhHsw0uKKWa?=

=?iso-8859-1?Q?uGyFQeh+chTLGiHy+cLqpFc0VFkuCGj/WgHuKJvEkB38fN+uTK0Gr8Apr/?=

=?iso-8859-1?Q?44TxndA7FiF8XGuBrrhRvJBg0p17KBOAiswRwI0Lu60VbvldzcvaAi8r4c?=

=?iso-8859-1?Q?J5Q3X+SMTf9+EFQbZ3fcQJLbvLIUoFaQLxjlSh6gtipV33JaWpbFFj7VLO?=

=?iso-8859-1?Q?Ls1Gmq2WDMy9wGdUtbdWvAfFEJ6o52lpwcNx+aJgziS+/O6vIDuYwIP33v?=

=?iso-8859-1?Q?gRMg0qtmnv1cGQ=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?OiKzpSi4XTzYg76wJ2WSRW8+2BmDa/2syFBMeQbodosKdXJMD+l6mywYxN?=

=?iso-8859-1?Q?6seqFmml7yXHKOahHXC87NAej4S0IboKOha1YJOPLxpGFfH2UrCNhR5iZJ?=

=?iso-8859-1?Q?XJeetbhwdyHd16EzT+TvFTD+7cJj5jWjjkzej5aoxr96QKgcaFNG2tSxdS?=

=?iso-8859-1?Q?92m4tGlL2Kqh2WgFPfYua1jovZr2soA7GmgkdgMy455xyqrbjI9TPOuEwF?=

=?iso-8859-1?Q?3QrHHL941ZmIinauGhWjQ2U61nKiQZdDBVdd2NkwZcoETCDEjGzHzsaFr/?=

=?iso-8859-1?Q?MvHiKrrLLtkL39Os909Z965t9Y229zrG8aD7fXLPDj7VHlMOYm/WAwQzAM?=

=?iso-8859-1?Q?AXElx5gAUJTK/IGr8pVuyydg+hfdAIUMau9j27SpiNU5KAEBWjdDfV0+VH?=

=?iso-8859-1?Q?BClvqqb2fw9CkkzSSaj7mIionkNUQEe68W/5Z0u0dK97c0WYwq0/kfFKoc?=

=?iso-8859-1?Q?6pOcGat0VIeu8oS9RI4Q4kBbRejAtxohv10X+bsXBbKP+d2O3YCA1VRiw4?=

=?iso-8859-1?Q?JwTRXghC8IiBDYEPcz1rQp4xKqQiV1/B9izfwxbzkqCgTOIpk9luKXpl0Y?=

=?iso-8859-1?Q?3OgIZyn5K6lytEHNwgfrmuiwCeFiN9tALn121vwNzgT4/j/QC2Dj41VF8+?=

=?iso-8859-1?Q?bqTXtGeKy7JOzm+W1OnfdJe25MH1InbbeRzibMGAm4f/hzORhRIqU6Lllh?=

=?iso-8859-1?Q?c42AhgWmv36TpuYXWbhVsFLogEmy68CM4soX5vPTiYCAs00nNVH+nTIrpv?=

=?iso-8859-1?Q?1MvCeYYvmAjPxd1by2Yt/v7bmPWz+nrOUok8+FEmdll3tEKbTyYJG0fH23?=

=?iso-8859-1?Q?aqE7ZIs14Q1t+t1EzPLH3UAaunnXN+ETTGhE75Tt8IDTprQuOWGb/bZsNS?=

=?iso-8859-1?Q?Sc9qRW2nzX+rElEbw+0O2gbbvRakeF4RMgg5BkMbHakmRxG9iFg9Ex8UaM?=

=?iso-8859-1?Q?PmMKXJP+N1RN1o6OznC5oL3DOr0KcjREr7LFfQ2+snvs678k5LyREmk2eq?=

=?iso-8859-1?Q?EABkaD2T/slC9t21MfFs61RtMaE9JfJ7aUN1ZN3XkD7JMd8uwkfj64+idW?=

=?iso-8859-1?Q?kTyrqOes1S6fqDghGmCnWgSaYYRbppy4phY6bvxdfDp6t/audqaDHmxWsA?=

=?iso-8859-1?Q?J0DKIcPpe/i6eYk1HdQ1b4KPirRyWQSSYngQAC7utjIUPK9QaoDB0a/+Yp?=

=?iso-8859-1?Q?W4niuA9+pPy1zLXNIX4kYY7sAa1DwPL3NJSwalDkIgtfY3cZceoQr7cTjO?=

=?iso-8859-1?Q?9P7u/mHic0pejBWIzP30tn6oc5V1FxB2iJeeo1hQZvEFMTpeUmSoRi9hj7?=

=?iso-8859-1?Q?eTTo0CYHviy6Bs4lzyEafr5kuEeQRD1VuNDgcQY9vY9beWR/K5Zt6bmEsk?=

=?iso-8859-1?Q?n8FBHDQWGe?=

Content-Type: multipart/alternative;

boundary="_000_SI2PR04MB66190DD043197C7F4491FFE196AD2SI2PR04MB6619apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SI2PR04MB6619.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 53de4f61-35d0-4a6b-206c-08dd70629502

X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Mar 2025 14:44:46.3581

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PUZPR04MB6820

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, I can help bring your website to the first page of Google.

If you were on page #1, you'd get so many new customers every day.

Content analysis details: (5.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:4:1fe:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:1fe:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:1fe:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:1fe:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:1fe:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:1fe:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:1fe:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:1096:4:1fe:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[52.103.64.35 listed in will-spam-for-food.eu.org]

[52.103.64.35 listed in will-spam-for-food.eu.org]

[52.103.64.35 listed in will-spam-for-food.eu.org]

[52.103.64.35 listed in will-spam-for-food.eu.org]

[52.103.64.35 listed in will-spam-for-food.eu.org]

[52.103.64.35 listed in will-spam-for-food.eu.org]

[52.103.64.35 listed in will-spam-for-food.eu.org]

[52.103.64.35 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.64.35 listed in dnsbl.ahbl.org]

[52.103.64.35 listed in dnsbl.ahbl.org]

[52.103.64.35 listed in dnsbl.ahbl.org]

[52.103.64.35 listed in dnsbl.ahbl.org]

[2603:1096:4:1fe:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:1096:4:1fe:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:1096:4:1fe:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:1096:4:1fe:0:0:0:7 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.64.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.64.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.64.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.64.35 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.64.35 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.64.35 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[sameerrastogi112(at)outlook.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[sameerrastogi112(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Fw: YES

--_000_SI2PR04MB66190DD043197C7F4491FFE196AD2SI2PR04MB6619apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Hi,

I can help bring your website to the first page of Google.

If you were on page #1, you'd get so many new customers every day.

May I send you the price list.

Regards,

--_000_SI2PR04MB66190DD043197C7F4491FFE196AD2SI2PR04MB6619apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

1">

margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=

alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hi,

margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=

alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

xt-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_=

MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(=

0, 0, 0);">

I can help bring your website to the first page of Google.

xt-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_=

MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(=

0, 0, 0);">

xt-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_=

MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(=

0, 0, 0);">

If you were on page #1, you'd get so many new customers every day.

xt-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_=

MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(=

0, 0, 0);">

xt-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_=

MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(=

0, 0, 0);">

May I send you the price list.

xt-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_=

MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(=

0, 0, 0);">

xt-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_=

MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(=

0, 0, 0);">

Regards,

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

--_000_SI2PR04MB66190DD043197C7F4491FFE196AD2SI2PR04MB6619apcp_--

Docusign phish

Posted by Dave Yadallee on Monday, March 31. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 31 Mar 2025 07:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1tzFIs-00000000Hb1-07Q4

for dave@doctor.nl2k.ab.ca;

Mon, 31 Mar 2025 07:35:50 -0600

Resent-From: The Doctor

Resent-Date: Mon, 31 Mar 2025 07:35:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [37.221.66.77] (port=65403 helo=mailhost.joysnug.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1tzEaS-00000000KLB-12AE

for doctor@nl2k.ca;

Mon, 31 Mar 2025 06:50:04 -0600

From: DocuSign via DocuSign

To: doctor@nl2k.ca

Subject: Completed: Complete with DocuSign: Draft Authorization Request No.#3089 _CL Rep Letter 3/31/2025 5:49:47 a.m.

Date: 31 Mar 2025 05:49:47 -0700

Message-ID: <20250331054947.9827C0CFA644B4F7@nl2k.ca>

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0012_DB95F83E.208C0A36"

X-Spam_score: 21.0

X-Spam_score_int: 210

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Stephanie Perez sent you a document to view and complete.

VIEW DOCUMENT doctor@nl2k.ca Please sign this form to authorize ATB Financial

to submit a ACH payment approval on your behalf.

Content analysis details: (21.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[37.221.66.77 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[37.221.66.77 listed in dnsbl.ahbl.org]

[37.221.66.77 listed in dnsbl.ahbl.org]

[37.221.66.77 listed in dnsbl.ahbl.org]

[37.221.66.77 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[37.221.66.77 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[37.221.66.77 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[37.221.66.77 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[37.221.66.77 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[37.221.66.77 listed in zen.spamhaus.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: vgmedia.in]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[37.221.66.77 listed in sa-accredit.habeas.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[37.221.66.77 listed in sa-trusted.bondedsender.org]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[37.221.66.77 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[37.221.66.77 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=doctor%40nl2k.ca;ip=37.221.66.77;r=doctor.nl2k.ab.ca]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.3 LONGWORD BODY: Uses overlong words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.6 TO_EQ_FM_DOM_HTML_IMG To domain == From domain and HTML image link

0.0 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF

failed

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

0.0 TO_EQ_FM_SPF_FAIL To == From and external SPF failed

1.8 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

Subject: {SPAM?} Completed: Complete with DocuSign: Draft Authorization Request No.#3089 _CL Rep Letter 3/31/2025 5:49:47 a.m.

------=_NextPart_000_0012_DB95F83E.208C0A36

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

Since I last reached out, there have been significant shifts in your energy=

field.

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

Something rare is unfolding=97an event that happens only once every 19 year=

s.

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

The energy surrounding your Aries field has intensified in a way that stand=

s out.

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

This isn=92t something I can fully explain in an email-
32076-k4xe1zg15i-py4tlij4g.hop.clickbank.net/" target=3D"_blank" id=3D"OWAe=

2427976-e2e0-59ca-b026-c576633de602" class=3D"x_x_OWAAutoLink" title=3D"htt=

ps://32076-k4xe1zg15i-py4tlij4g.hop.clickbank.net/" rel=3D"noopener norefer=

rer" data-auth=3D"NotApplicable" data-linkindex=3D"0" style=3D"margin: 0px;=

">

you need to access your personalized reading to uncover the full message wa=

iting for you.

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

Your guides are still holding the doorway open=85but not for long! (They=92=

re urging you to listen now.)

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

I truly hope you take this opportunity to hear what they have to say. You w=

ere meant to receive this at exactly this moment.

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

I=92d love to hear your thoughts.

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

Let me know if this resonates with you=97I=92d love to hear your thoughts.<=

/div>

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

With light and clarity,

background-color: rgb(255, 255, 255); margin: 0px; font-family: Aptos, Apto=

s_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-s=

ize: 12pt; color: rgb(0, 0, 0);">

Marry Clair

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

--_000_OSQPR01MB6503A6A6F43564DEF46E9854E8A22OSQPR01MB6503apcp_--

Nigerian spam from Google Gmail

Posted by Dave Yadallee on Monday, March 31. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 31 Mar 2025 00:50:00 -0600

Received: from mail-ed1-f66.google.com ([209.85.208.66]:50602)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1tz8xE-0000000072z-2Y0a

for dave@doctor.nl2k.ab.ca;

Mon, 31 Mar 2025 00:49:14 -0600

Received: by mail-ed1-f66.google.com with SMTP id 4fb4d7f45d1cf-5e535e6739bso6699709a12.1

for ; Sun, 30 Mar 2025 23:47:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1743403622; x=1744008422; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=wMaNly59es4JuaaqY2iyDVrUxl0wIsBr65La2ivC5Jk=;

b=GgHOtW8vUbwdfIFKRGCZ+NEttK+FB1I6Z/8q78zMqVwsm5t2SJ+gbf+VeY4aJf3cbk

TZxTqwEmhT339UFq8ZjBAX6EOcOSyJAJ8z/5VRT3mYOvOHrPfHm0yLCaxVAfF5c6Tw/M

dyhzRHkapGSG1LHAi60enC3ZNdIBXF6EH9CrcYHMVitz8yZFJ0UvJEHgJ9nXXGkOgNtZ

EKFF/i32h+uQ8gxjkJV988N4VOAtQUibNwrSQj9hOQj3qtjUobQw8sSV1Oo8BDECDWfx

7PbZA9oCbVEMTZZJbJp/AXH1Zsg66UllG0IbsjKKHiW1bR5CRPfRltqBAcJUSIxOD7HD

bi0g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1743403622; x=1744008422;

h=to:subject:message-id:date:from:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=wMaNly59es4JuaaqY2iyDVrUxl0wIsBr65La2ivC5Jk=;

b=GOfxLCetxEY9+/lAW/vApqjtT7y47d+xxGZgMQMl2Oyw9JucLbgAChWWjF7K76SxdL

78pBWR3Vvu6/rDGUKBdgG+ug4/uNPwiZYzwXqRCkIztRc21XEImYuLaVgWryWjdicG6m

bYs/DWMeCBSs6yIUkJI/wWq7H4LkMFVJJniaJo3DBi3i+PYBCS0sR1Gx0nTnJ+QqgsjT

qVFsEs12UbynPMMjr9OTKvg93zuxUrRGQWZ2r0ypJjUL5PME5wO+iRKY4/MrAkgC+HDY

G6iwxy1oPCBxz5wmUKH7tkBn/fjjkAcnbkvSh1IBPzQkhy2A8AAxBSpjWAAWPcfNb7gG

PqQA==

X-Forwarded-Encrypted: i=1; AJvYcCXIClJ/lpJwx33cW4cJ86oZ6DIcy6VVYE4Jk9qSUZpjjodChiyYjJc8FgRx1zRPW0fic2yY@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YzhUN/B5hzP4mDeQDtlnKDKA92e7xAgKtaPHn8F77A7UcnYLSSM

r5W43Gou499fj1MVnAbe1UvZD1RJcSWQdz1fSp1tkKXr6eeT4hHtw7yZDlH2ZW+7r0LJ8xRcoaK

uFtZdWiysrV1hNlm7BZ8JqlUu58k=

X-Gm-Gg: ASbGncva0/WjGyS9B41Xy08dlmPvkNijXu/FkxEy0J121Kr2Q2A4Clb9jZtv4bvKvh5

PP8xvXhZBqg1o5DB6GTCTkvWs2RsFJqWCpKkhA8Y3KCeF9Ndkh5Y7pkzQxKFsNdFT6PUdm6ua/X

zoqJOV8YbghoymSQRWYuh9p7Kscw==

X-Google-Smtp-Source: AGHT+IHU9aoG7MefWtYKuQtQhrLILHNP9HrlQkZFGPeLLIzN7aFXazY1r/qvrBoo2dbLK1flkpnvklw/uIEs0yGa9Tg=

X-Received: by 2002:a05:6402:50cd:b0:5e4:be64:b562 with SMTP id

4fb4d7f45d1cf-5edfcc04febmr5307127a12.1.1743403622201; Sun, 30 Mar 2025

23:47:02 -0700 (PDT)

MIME-Version: 1.0

Reply-To: wellensteink147@gmail.com

From: Kristine Wellenstein

Date: Mon, 31 Mar 2025 07:46:49 +0100

X-Gm-Features: AQ5f1JoirCRdCRqUx2RvaPBO3Roq9GzMt6w6kgu2IG99eyT_Dj0UVxv8eNS7yTU

Message-ID:

Subject: Donation

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000009a055c06319dc968"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: -- Hello, I am Mrs. Kristine Wellenstein and my foundation

is donating ($2.5 million dollars) to you. Get back to us for further details.

Best Regards, Mrs. Kristine Wellenstein.

Content analysis details: (10.9 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.208.66 listed in will-spam-for-food.eu.org]

[209.85.208.66 listed in will-spam-for-food.eu.org]

[209.85.208.66 listed in will-spam-for-food.eu.org]

[209.85.208.66 listed in will-spam-for-food.eu.org]

[209.85.208.66 listed in will-spam-for-food.eu.org]

[209.85.208.66 listed in will-spam-for-food.eu.org]

[209.85.208.66 listed in will-spam-for-food.eu.org]

[209.85.208.66 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.66 listed in dnsbl.ahbl.org]

[209.85.208.66 listed in dnsbl.ahbl.org]

[209.85.208.66 listed in dnsbl.ahbl.org]

[209.85.208.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.66 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.66 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.66 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.208.66 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.208.66 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.66 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.66 listed in wl.mailspike.net]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.208.66 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.66 listed in bl.score.senderscore.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[a0938309808(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[a0938309808(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[wellensteink147(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.5 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Donation

--0000000000009a055c06319dc968

Content-Type: text/plain; charset="UTF-8"

--

Hello,

I am Mrs. Kristine Wellenstein and my foundation is donating ($2.5 million

dollars) to

you. Get back to us for further details.

Best Regards,

Mrs. Kristine Wellenstein.

--0000000000009a055c06319dc968

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

"gmail_signature_prefix">--

ature" data-smartmail=3D"gmail_signature">

Hello,
>

I am Mrs. Kristine Wellenstein and my foundation is do=

nating ($2.5 million dollars) to

you. Get back to us for further =

details.

Best Regards,

Mrs. Kristine Wel=

lenstein.

--0000000000009a055c06319dc968--

Spirit guide spam from Microsofot Outlook

Posted by Dave Yadallee on Monday, March 31. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 30 Mar 2025 16:48:00 -0600

Received: from mail-sg2apc01olkn2058.outbound.protection.outlook.com ([40.92.53.58]:56638 helo=APC01-SG2-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1tz1RD-00000000AEh-3wCv;

Sun, 30 Mar 2025 16:47:41 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=ewwgRD2hK5UISdBCLFOwJ69ufEtO2WEU1YLGj6Fd6piRm5oJIEbyL1ociahUDS5G4lIgtICkIx7hTBI437R7WwrYhJjFdCj0Cq46xZzAzOZyGLaFDVd24O0Gq+5ho8hREcrwV+EtQg5umYRROZYfnidLlzhfPk1nC6qbaOLkU8jfL4d84UZSCYpHBdVdaI5G76nt9s35SkrOPhMAkQ5S+dM069Mqpt4mhqcS+WcuAkJZtaMEy5MMXcaxColzh6JnM/v0X8K1S1SEMR2pGkGs1mm18+O7/4T2uYJKh2fsMCePDnJctTqe6tTFUgVDCtQ5bPTq0j1cEOegZ5WVU+MfDQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=aOrhhPLPb6XB83GAINoSKANanWG1gAr7PM1c5cKw/oM=;

b=br12J1TziVjFlTTpFIvJ4aGTHjMwGmQ5+H41zLNRrOSPJKASkBhiojnxkfQyaFTROYd3kFv8HP9xvpTBKumkq4iWewRM2P4gRrZEoyeXvWiebYAeJ/SmDHx8t3AY6YFxoLP6JcLyKe5+4mT9KrC6rwQapSj2wv8OytPgoMt3+D7tYDWOly9HICJq36+5hhntkpbz3PmCBRHXlnVbyExsxwvQmGXP+7Rxk6JPxjOVObSYWAZX30qNFSjDgQ1v8F3Jr6mcsQYwQp11Q3+CJMAIu6L+rZMGkk1La7nmeJIT7AVU/pGZSRXbuBuhezWIhcoiRA34ora1yXsdfOAPLt1SpQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=aOrhhPLPb6XB83GAINoSKANanWG1gAr7PM1c5cKw/oM=;

b=I17RPAzfuD+HFoV8ZIa+9xNjkLcZn4OhCxQKPhOEVm5C4VgxNO7ZunEoD9JBJhrT/ICjMEwpNVZJJhoYghWhP7LdyZ69/9VZ2ZAVbN3j2U+2LJF8YOJK1mLIjtFSwkm03sY6W9im9pIaHpGVZBUljGZMl++k8OtlA0mMwrlLlceR6t+nqsbAjbqzELs0rqw9ZugQjEhF1lKJg0bqsuIoRxxBohQvdhq00gM1b3PXI6emP6vopEWlQzF0dj2nDYmAVbkcQslrSt1YKTzaJRhW4KWCt71ofHkM0d7mYAtyBLOmuRLjXIY1mAnpkJUKR0x9zLe1LX+PvVE1pmOJa0Thlg==

Received: from OSQPR01MB6503.apcprd01.prod.exchangelabs.com

(2603:1096:604:280::10) by SEZPR01MB5294.apcprd01.prod.exchangelabs.com

(2603:1096:101:eb::7) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8534.44; Sun, 30 Mar

2025 22:44:53 +0000

Received: from OSQPR01MB6503.apcprd01.prod.exchangelabs.com

([fe80::7a37:d176:30c8:5542]) by OSQPR01MB6503.apcprd01.prod.exchangelabs.com

([fe80::7a37:d176:30c8:5542%3]) with mapi id 15.20.8534.048; Sun, 30 Mar 2025

22:44:53 +0000

From: Henry Smith

Subject:

=?Windows-1252?Q?Your_Spirit_Guides_Are_Trying_to_Reach_You_=96_Again!?=

Thread-Topic:

=?Windows-1252?Q?Your_Spirit_Guides_Are_Trying_to_Reach_You_=96_Again!?=

Thread-Index: AQHbocVDRHhWZ/RpaEC/sWi0jsti2A==

Date: Sun, 30 Mar 2025 22:44:52 +0000

Message-ID:

Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-exchange-messagesentrepresentingtype: 1

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: OSQPR01MB6503:EE_|SEZPR01MB5294:EE_

x-ms-office365-filtering-correlation-id: 29102eb3-5c8f-4e48-26c6-08dd6fdc7c40

x-microsoft-antispam:

BCL:0;ARA:14566002|15080799006|9400799030|461199028|7071999006|12050799009|8060799006|15030799003|8062599003|19110799003|102099032|1602099012|10035399004|4302099013|440099028|3412199025;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?t37uhyYncvMUhD2ZKTb42gmvxcpo5lr9f6f58ia9JZuL6rKcmfk/ksW/?=

=?Windows-1252?Q?0E4kEuS6JAdQq4jUzafvqOxhmcdZrBk7JQpNREqoeAXmpZyaBLQRj47D?=

=?Windows-1252?Q?NJT0ddqqw3bPq0PH0nGp3Hyey6uuMYWq6wXIY+VoF8/E0UOBdGuNhIj1?=

=?Windows-1252?Q?JW+X+plwtAfP2gR/P8VvRFkOEmX9Re3hTxLCfcitHglDt8AiMMAEn3fI?=

=?Windows-1252?Q?b1fMEy/eohCDXIBnJ/DF0OUanyXAthOlK1lK86UtFzsZ1Ct7vrW+3dYY?=

=?Windows-1252?Q?hcxRQROq/RiTNASMuB3hZKbtpxsSKh3LoefnHFUVGYVHPR3Yf+XQg+yP?=

=?Windows-1252?Q?NhRDqKzLtH6X6f76RUmlW/RknD+5S5qKYCDmGDreAhIi6EfJbSqYPF2d?=

=?Windows-1252?Q?LoqvoVUsoYr21tE0oazprV4DAfvZHObBVfxHnkgQ9z8Z4f+43yMurULu?=

=?Windows-1252?Q?NXePJdlcBTbjV0A2fiDtmnHTPHq1H35GJtKRm7NI3MEBZtfqQvplrgeY?=

=?Windows-1252?Q?pFFcXPsq3hGxXZfAKDYlBvgL0U8OB8/D9ahmNCDI8Mfy76g/QzFChQJQ?=

=?Windows-1252?Q?cxQl/D5bqG8mBtDafgXpz6iYYeie5SqUxAGFDQarPxguIfSxLOIVE7ZO?=

=?Windows-1252?Q?28iXnjm9cnQpGR/VFKGSeFvyRxotD4AP+N6hMuKvAuiy+2Jp2f1Yoyw4?=

=?Windows-1252?Q?t7ZX4FSlP1XWCbo9K36nbjOxAR/x1M3rFnE25SzzieiKmVAxJukTriJb?=

=?Windows-1252?Q?juP6nMsCtNZHrktIRkQplAFGQv1tcCBDabq+sd3YvRozp0NC7l11w78k?=

=?Windows-1252?Q?5xG6uuLX5iDoBJ2XfGIDD988+BHnTD1gUiAqIVMBEEBoEfVacfwCym/m?=

=?Windows-1252?Q?KDOR7xor5gBRKyvxC3NhnaVnAa5vchlCRxR13J+QoOHMqogUVaLqIyi0?=

=?Windows-1252?Q?bAjWfzfk7r5fQKuFsSf1hSqg1qfzy4LDXc+zK/DqZzTpqhGO2VaNs+NA?=

=?Windows-1252?Q?//SKylhD94VrEKJbO3dBnwF2F1bYo4wyvx53IotcdoxUShHsivX/KnrG?=

=?Windows-1252?Q?CyBUegbGTGFNBQ2ttRivwIxdW1O1QBypkrmf1jGe3Y6Xkm4JNUQ0Nkov?=

=?Windows-1252?Q?MMblBdQ1EttmrXNqhsdiW45Xfg8iJop0w8wHgd924Ma87Q2rv+NyYaL1?=

=?Windows-1252?Q?kxQoOZdF0nBeRrsBtyNSj6kaoUH+8b2v2IrxtOoziM/GkHuXC8jZKVvx?=

=?Windows-1252?Q?4Gs2cqoDqLe5bjy1b2EFYnwrR4lytZROZMW4XuSY1q29H3mSJhEzTy7a?=

=?Windows-1252?Q?mcdSd2hfQ9gojcRGHU6W1ZDOWLLkYUD58nxlP+Na3/qyR2/Hjte+tgVg?=

=?Windows-1252?Q?ZODawAUNKirpcxvK+iVzboviYhLbDTOYt71Udnua5rpq/wXeEevIY2cD?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?YCLBmwbJu4cvQNVQX658XfpkW3RnwectJsKQgUy7+fiRk9frVmHHnQNu?=

=?Windows-1252?Q?t1fT9Aio8D8XcBQkKuG8g5z2MSAqyCGdUic8luQxQhnytZ/uOM6q7BaV?=

=?Windows-1252?Q?txR83cP3o4r4HYrL7NUSlHQAIP0qlLJORry7mNIGeW/o8x3jat47nqFT?=

=?Windows-1252?Q?Ho+0CMMH7M/Vy8g9WS3y+7Zz6qCY0c+P9z+gCi+iuHVpRwWLXEU32Y7t?=

=?Windows-1252?Q?ZSVsLLfblsV106LRENreI42LLstZwKboRmhQLodbFxsu12TbNbrxX/L3?=

=?Windows-1252?Q?wXhWcgvHlNUWQXnwwUeoGsHsW5wEmOI8ZivfDML+GsFrJOlZSqbv4Kbh?=

=?Windows-1252?Q?MNysmi6NRZ5Y6iibREbaS5X49KgNZgY6J9xBBe2k5CMx2iGPJb/yN3z+?=

=?Windows-1252?Q?OvrZH3nUTEatSe3qqBTMV3hAZBLtPzmO7n2xM3z7RX/pt0wacdQaSPgb?=

=?Windows-1252?Q?Sd3RfWd371AhA19jw3wstdbJOHnDSIvmLpQ8OjBKCEDNeIjPnpiccVG0?=

=?Windows-1252?Q?me1uftbA0/B++x5EhqiAw7Qi5Gr/5bSANZxjSL0OjnNt7bnmoeQLqovs?=

=?Windows-1252?Q?6uwR4O5IIIBrXABRxQr/HLLPZJThhVfMGmchGcb45ZNKvABTki2lJVhR?=

=?Windows-1252?Q?ShOMkVwTc9j3OrBUlKy7ta3iD6X2KMpn7MGAMghBEZaBQxpzOcM8DU8o?=

=?Windows-1252?Q?OiqAoMZ0n0pGQ0Sk+Pj+Dg14pzbR6NARgsc3WOIqVHJqHKhHMd5hWWVq?=

=?Windows-1252?Q?Cf0ARu1ggm0dwOltKV7P1CNkpOdLwAlQf4gv9P8pKdhJ+7mtKfoVt22Q?=

=?Windows-1252?Q?5Ylxs/ElNnR6x8xP54T+fepNiFzbLXJiV9dCKUO9EEhTDrjrlJsN7jDf?=

=?Windows-1252?Q?gk7v1eLB0EYVxTAS7rNg5Zfc1a3f5ADs8iBO8N6bCIBo5AwhDWMYX9Cn?=

=?Windows-1252?Q?L1x0MdLt+BeYmpqRlaWiqaU9wAzZwKEC9IXFBARCcWSIsk7B+hPQer5e?=

=?Windows-1252?Q?mAQmMOIL86haFrfjTcX1h/05BA+XKi3LE9s1MFC3hTn4ec43Ex3eajOW?=

=?Windows-1252?Q?T+qfUT9fD0hgJiLD0jeBIUVkrKGlLWupuJgSIi0wPfl/GJhrIFjpwvwn?=

=?Windows-1252?Q?I4UDp9G13kJLsu6ACPa1JocYg1iWo8mwO8PLhoBfHZxJ5r2EFTIHW0nA?=

=?Windows-1252?Q?t2Pvt4LY5lbAXxYI61hyAY+y0tu/l8HoEaDuAbmezoEBqM3YYFoBjbj2?=

=?Windows-1252?Q?d4Q3ttVGbngob8Go6ehQQU1q9pVqr2qiLTrqgdxIy5ZKH1vmgyd1pGC3?=

=?Windows-1252?Q?eX1C2q7aeSD6EijPquHoOnDgbuyJ/Hg75OQmN9/0X/Ic3Tz+0rCQ6TPk?=

=?Windows-1252?Q?H4VlWJd2NI3qeehmqvvHMnoyQdQnQW+wdoubu6Ac8o9fyxlSl6DaXyYd?=

=?Windows-1252?Q?VjQXVNN75ksZKHSIe4rtXA=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_OSQPR01MB6503A6A6F43564DEF46E9854E8A22OSQPR01MB6503apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: OSQPR01MB6503.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 29102eb3-5c8f-4e48-26c6-08dd6fdc7c40

X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Mar 2025 22:44:52.4392

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEZPR01MB5294

X-Spam_score: 10.3

X-Spam_score_int: 103

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Since I last reached out, there have been significant shifts

in your energy field. Something rare is unfoldingâ€”an event that happens

only once every 19 years. The energy surrounding your Aries field has intensified

in a way that stands out.

Content analysis details: (10.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:604:280:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:604:280:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:604:280:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:604:280:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:604:280:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:604:280:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:604:280:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[2603:1096:604:280:0:0:0:10 listed in]

[will-spam-for-food.eu.org]

[40.92.53.58 listed in will-spam-for-food.eu.org]

[40.92.53.58 listed in will-spam-for-food.eu.org]

[40.92.53.58 listed in will-spam-for-food.eu.org]

[40.92.53.58 listed in will-spam-for-food.eu.org]

[40.92.53.58 listed in will-spam-for-food.eu.org]

[40.92.53.58 listed in will-spam-for-food.eu.org]

[40.92.53.58 listed in will-spam-for-food.eu.org]

[40.92.53.58 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.92.53.58 listed in dnsbl.ahbl.org]

[40.92.53.58 listed in dnsbl.ahbl.org]

[40.92.53.58 listed in dnsbl.ahbl.org]

[40.92.53.58 listed in dnsbl.ahbl.org]

[2603:1096:604:280:0:0:0:10 listed in]

[dnsbl.ahbl.org]

[2603:1096:604:280:0:0:0:10 listed in]

[dnsbl.ahbl.org]

[2603:1096:604:280:0:0:0:10 listed in]

[dnsbl.ahbl.org]

[2603:1096:604:280:0:0:0:10 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.92.53.58 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.92.53.58 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.92.53.58 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.92.53.58 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.92.53.58 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.92.53.58 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[outlook_d1f1eeab4713f00d(at)outlook.com]

1.2 MISSING_HEADERS Missing To: header

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

1.0 IMPRO_URI_2 No description available.

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?}

=?Windows-1252?Q?Your_Spirit_Guides_Are_Trying_to_Reach_You_=96_Again!?=

--_000_OSQPR01MB6503A6A6F43564DEF46E9854E8A22OSQPR01MB6503apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable

Since I last reached out, there have been significant shifts in your energy=

field.

Something rare is unfolding=97an event that happens only once every 19 year=

s.

The energy surrounding your Aries field has intensified in a way that stand=

s out.

This isn=92t something I can fully explain in an email- you need to access =

your personalized reading to uncover the full message waiting for you.
s://32076-k4xe1zg15i-py4tlij4g.hop.clickbank.net/>

Your guides are still holding the doorway open=85but not for long! (They=92=

re urging you to listen now.)

I truly hope you take this opportunity to hear what they have to say. You w=

ere meant to receive this at exactly this moment.

I=92d love to hear your thoughts.

Let me know if this resonates with you=97I=92d love to hear your thoughts.

With light and clarity,

Marry Clair

--_000_OSQPR01MB6503A6A6F43564DEF46E9854E8A22OSQPR01MB6503apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable

252">