Costco phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 09 Mar 2025 12:26:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1trLLb-000000005xP-3Num

for dave@doctor.nl2k.ab.ca;

Sun, 09 Mar 2025 12:25:59 -0600

Resent-From: The Doctor

Resent-Date: Sun, 9 Mar 2025 12:25:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [217.145.79.108] (port=34175 helo=thepiratebay.la)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))

id 1trKx9-0000000041E-3rSe

for doctor@nk.ca;

Sun, 09 Mar 2025 12:00:48 -0600

Date: Sun, 09 Mar 2025 13:55:34 -0400

From: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

Reply-To: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

To: doctor@nk.ca

Message-ID:

Subject: =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.SE2ijkVpRKlaMPzMFD8kT1Lbmv6ayiWE.localhost.doctor>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@wiki.lat

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 31.9

X-Spam_score_int: 319

X-Spam_bar: +++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  YOUR EXPERIENCE IS VERY IMPORTANT Your opinion is important

to us



Content analysis details: (31.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[217.145.79.108 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.145.79.108 listed in will-spam-for-food.eu.org]

[217.145.79.108 listed in will-spam-for-food.eu.org]

[217.145.79.108 listed in will-spam-for-food.eu.org]

[217.145.79.108 listed in will-spam-for-food.eu.org]

[217.145.79.108 listed in will-spam-for-food.eu.org]

[217.145.79.108 listed in will-spam-for-food.eu.org]

[217.145.79.108 listed in will-spam-for-food.eu.org]

[217.145.79.108 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[217.145.79.108 listed in dnsbl.ahbl.org]

[217.145.79.108 listed in dnsbl.ahbl.org]

[217.145.79.108 listed in dnsbl.ahbl.org]

[217.145.79.108 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[217.145.79.108 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[217.145.79.108 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[217.145.79.108 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[217.145.79.108 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[217.145.79.108 listed in zen.spamhaus.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ools.us]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=thepiratebay.la;ip=217.145.79.108;r=doctor.nl2k.ab.ca]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.1 TW_AQ BODY: Odd Letter Triples with AQ

0.1 TW_QY BODY: Odd Letter Triples with QY

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

Subject: {SPAM?} =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=














































YOUR EXPERIENCE IS VERY IMPORTANT

Your opinion is important to us

We want to offer you a unique opportunity to get a Wagyu Steak Box! To claim, simply take this short survey about your Costco.




START INVESTIGATION













































































Do you no longer want to receive these emails? Unsubscribe.










Costco phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 09 Mar 2025 12:26:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1trLLT-000000005wi-3mPB

for dave@doctor.nl2k.ab.ca;

Sun, 09 Mar 2025 12:25:51 -0600

Resent-From: The Doctor

Resent-Date: Sun, 9 Mar 2025 12:25:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [217.145.79.222] (port=39439 helo=realtor.ca)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))

id 1trKqP-00000000Csa-1zbE

for doctor@nl2k.ab.ca;

Sun, 09 Mar 2025 11:53:55 -0600

Date: Sun, 09 Mar 2025 13:50:22 -0400

From: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

Reply-To: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

To: doctor@nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.OmvPDZWRVSXN239Dm02a5j555fMKPjLv.localhost.doctor>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@wiki.lat

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 26.9

X-Spam_score_int: 269

X-Spam_bar: ++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  YOUR EXPERIENCE IS VERY IMPORTANT Your opinion is important

to us



Content analysis details: (26.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.145.79.222 listed in will-spam-for-food.eu.org]

[217.145.79.222 listed in will-spam-for-food.eu.org]

[217.145.79.222 listed in will-spam-for-food.eu.org]

[217.145.79.222 listed in will-spam-for-food.eu.org]

[217.145.79.222 listed in will-spam-for-food.eu.org]

[217.145.79.222 listed in will-spam-for-food.eu.org]

[217.145.79.222 listed in will-spam-for-food.eu.org]

[217.145.79.222 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[217.145.79.222 listed in dnsbl.ahbl.org]

[217.145.79.222 listed in dnsbl.ahbl.org]

[217.145.79.222 listed in dnsbl.ahbl.org]

[217.145.79.222 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[217.145.79.222 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[217.145.79.222 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[217.145.79.222 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[217.145.79.222 listed in dnsbl.ahbl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ools.us]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=realtor.ca;ip=217.145.79.222;r=doctor.nl2k.ab.ca]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.1 TW_AQ BODY: Odd Letter Triples with AQ

0.1 TW_QY BODY: Odd Letter Triples with QY

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

Subject: {SPAM?} =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=














































YOUR EXPERIENCE IS VERY IMPORTANT

Your opinion is important to us

We want to offer you a unique opportunity to get a Wagyu Steak Box! To claim, simply take this short survey about your Costco.




START INVESTIGATION













































































Do you no longer want to receive these emails? Unsubscribe.










Costco phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 09 Mar 2025 12:26:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1trLLP-000000005wO-2LQp

for dave@doctor.nl2k.ab.ca;

Sun, 09 Mar 2025 12:25:47 -0600

Resent-From: The Doctor

Resent-Date: Sun, 9 Mar 2025 12:25:47 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [217.145.79.138] (port=43921 helo=canada.ca)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))

id 1trKqP-00000000Csc-21lR

for sales@nk.ca;

Sun, 09 Mar 2025 11:53:54 -0600

Date: Sun, 09 Mar 2025 13:50:22 -0400

From: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

Reply-To: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

To: sales@nk.ca

Message-ID:

Subject: =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.ieevFVubkIHHh4y1v2ktna5Xy411efec.localhost.sales>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@wiki.lat

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 26.9

X-Spam_score_int: 269

X-Spam_bar: ++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  YOUR EXPERIENCE IS VERY IMPORTANT Your opinion is important

to us



Content analysis details: (26.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.145.79.138 listed in will-spam-for-food.eu.org]

[217.145.79.138 listed in will-spam-for-food.eu.org]

[217.145.79.138 listed in will-spam-for-food.eu.org]

[217.145.79.138 listed in will-spam-for-food.eu.org]

[217.145.79.138 listed in will-spam-for-food.eu.org]

[217.145.79.138 listed in will-spam-for-food.eu.org]

[217.145.79.138 listed in will-spam-for-food.eu.org]

[217.145.79.138 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[217.145.79.138 listed in dnsbl.ahbl.org]

[217.145.79.138 listed in dnsbl.ahbl.org]

[217.145.79.138 listed in dnsbl.ahbl.org]

[217.145.79.138 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[217.145.79.138 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[217.145.79.138 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[217.145.79.138 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[217.145.79.138 listed in dnsbl.ahbl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ools.us]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=canada.ca;ip=217.145.79.138;r=doctor.nl2k.ab.ca]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.1 TW_AQ BODY: Odd Letter Triples with AQ

0.1 TW_QY BODY: Odd Letter Triples with QY

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

Subject: {SPAM?} =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=














































YOUR EXPERIENCE IS VERY IMPORTANT

Your opinion is important to us

We want to offer you a unique opportunity to get a Wagyu Steak Box! To claim, simply take this short survey about your Costco.




START INVESTIGATION













































































Do you no longer want to receive these emails? Unsubscribe.










Costco phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 09 Mar 2025 12:26:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1trLLK-000000005vy-35FT

for dave@doctor.nl2k.ab.ca;

Sun, 09 Mar 2025 12:25:42 -0600

Resent-From: The Doctor

Resent-Date: Sun, 9 Mar 2025 12:25:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [217.145.79.59] (port=50487 helo=haber7.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))

id 1trKqP-00000000CsY-21i1

for root@nk.ca;

Sun, 09 Mar 2025 11:53:52 -0600

Date: Sun, 09 Mar 2025 13:50:22 -0400

From: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

Reply-To: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

To: root@nk.ca

Message-ID:

Subject: =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.uBEEzG2nDBwwQj5yPGW2DCiGrCU3QR0h.localhost.root>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@wiki.lat

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 27.7

X-Spam_score_int: 277

X-Spam_bar: +++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  YOUR EXPERIENCE IS VERY IMPORTANT Your opinion is important

to us



Content analysis details: (27.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.145.79.59 listed in will-spam-for-food.eu.org]

[217.145.79.59 listed in will-spam-for-food.eu.org]

[217.145.79.59 listed in will-spam-for-food.eu.org]

[217.145.79.59 listed in will-spam-for-food.eu.org]

[217.145.79.59 listed in will-spam-for-food.eu.org]

[217.145.79.59 listed in will-spam-for-food.eu.org]

[217.145.79.59 listed in will-spam-for-food.eu.org]

[217.145.79.59 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[217.145.79.59 listed in dnsbl.ahbl.org]

[217.145.79.59 listed in dnsbl.ahbl.org]

[217.145.79.59 listed in dnsbl.ahbl.org]

[217.145.79.59 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[217.145.79.59 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[217.145.79.59 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[217.145.79.59 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[217.145.79.59 listed in dnsbl.ahbl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ools.us]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.1 TW_AQ BODY: Odd Letter Triples with AQ

0.1 TW_QY BODY: Odd Letter Triples with QY

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

Subject: {SPAM?} =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=














































YOUR EXPERIENCE IS VERY IMPORTANT

Your opinion is important to us

We want to offer you a unique opportunity to get a Wagyu Steak Box! To claim, simply take this short survey about your Costco.




START INVESTIGATION













































































Do you no longer want to receive these emails? Unsubscribe.










Costco phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 09 Mar 2025 12:26:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1trLL7-000000005uh-0LAz

for dave@doctor.nl2k.ab.ca;

Sun, 09 Mar 2025 12:25:29 -0600

Resent-From: The Doctor

Resent-Date: Sun, 9 Mar 2025 12:25:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [217.145.79.138] (port=55619 helo=canada.ca)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))

id 1trKqP-00000000CsV-21nu

for root@doctor.nl2k.ab.ca;

Sun, 09 Mar 2025 11:53:54 -0600

Date: Sun, 09 Mar 2025 13:50:22 -0400

From: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

Reply-To: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

To: root@doctor.nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.SBapahnQ8dtiHb984IhHAw9tG5TsquVZ.localhost.root>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@wiki.lat

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 26.9

X-Spam_score_int: 269

X-Spam_bar: ++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  YOUR EXPERIENCE IS VERY IMPORTANT Your opinion is important

to us



Content analysis details: (26.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.145.79.138 listed in will-spam-for-food.eu.org]

[217.145.79.138 listed in will-spam-for-food.eu.org]

[217.145.79.138 listed in will-spam-for-food.eu.org]

[217.145.79.138 listed in will-spam-for-food.eu.org]

[217.145.79.138 listed in will-spam-for-food.eu.org]

[217.145.79.138 listed in will-spam-for-food.eu.org]

[217.145.79.138 listed in will-spam-for-food.eu.org]

[217.145.79.138 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[217.145.79.138 listed in dnsbl.ahbl.org]

[217.145.79.138 listed in dnsbl.ahbl.org]

[217.145.79.138 listed in dnsbl.ahbl.org]

[217.145.79.138 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[217.145.79.138 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[217.145.79.138 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[217.145.79.138 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[217.145.79.138 listed in dnsbl.ahbl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ools.us]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=canada.ca;ip=217.145.79.138;r=doctor.nl2k.ab.ca]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.1 TW_AQ BODY: Odd Letter Triples with AQ

0.1 TW_QY BODY: Odd Letter Triples with QY

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

Subject: {SPAM?} =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=














































YOUR EXPERIENCE IS VERY IMPORTANT

Your opinion is important to us

We want to offer you a unique opportunity to get a Wagyu Steak Box! To claim, simply take this short survey about your Costco.




START INVESTIGATION













































































Do you no longer want to receive these emails? Unsubscribe.










Costco phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 09 Mar 2025 12:26:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1trLL0-000000005uI-45VP

for dave@doctor.nl2k.ab.ca;

Sun, 09 Mar 2025 12:25:22 -0600

Resent-From: The Doctor

Resent-Date: Sun, 9 Mar 2025 12:25:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [217.145.79.108] (port=45095 helo=thepiratebay.la)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))

id 1trKqP-00000000Cse-23pD

for doctor@netknow.ca;

Sun, 09 Mar 2025 11:53:56 -0600

Date: Sun, 09 Mar 2025 13:50:22 -0400

From: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

Reply-To: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

To: doctor@netknow.ca

Message-ID:

Subject: =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.TFhWAEmB7P63DqSPCGvZDXQFOuie8dcH.localhost.doctor>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@wiki.lat

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 26.9

X-Spam_score_int: 269

X-Spam_bar: ++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  YOUR EXPERIENCE IS VERY IMPORTANT Your opinion is important

to us



Content analysis details: (26.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.145.79.108 listed in will-spam-for-food.eu.org]

[217.145.79.108 listed in will-spam-for-food.eu.org]

[217.145.79.108 listed in will-spam-for-food.eu.org]

[217.145.79.108 listed in will-spam-for-food.eu.org]

[217.145.79.108 listed in will-spam-for-food.eu.org]

[217.145.79.108 listed in will-spam-for-food.eu.org]

[217.145.79.108 listed in will-spam-for-food.eu.org]

[217.145.79.108 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[217.145.79.108 listed in dnsbl.ahbl.org]

[217.145.79.108 listed in dnsbl.ahbl.org]

[217.145.79.108 listed in dnsbl.ahbl.org]

[217.145.79.108 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[217.145.79.108 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[217.145.79.108 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[217.145.79.108 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[217.145.79.108 listed in dnsbl.ahbl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ools.us]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=thepiratebay.la;ip=217.145.79.108;r=doctor.nl2k.ab.ca]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.1 TW_AQ BODY: Odd Letter Triples with AQ

0.1 TW_QY BODY: Odd Letter Triples with QY

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

Subject: {SPAM?} =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=














































YOUR EXPERIENCE IS VERY IMPORTANT

Your opinion is important to us

We want to offer you a unique opportunity to get a Wagyu Steak Box! To claim, simply take this short survey about your Costco.




START INVESTIGATION













































































Do you no longer want to receive these emails? Unsubscribe.










Costco phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 09 Mar 2025 12:26:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1trLLF-000000005vR-12H7

for dave@doctor.nl2k.ab.ca;

Sun, 09 Mar 2025 12:25:37 -0600

Resent-From: The Doctor

Resent-Date: Sun, 9 Mar 2025 12:25:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [217.145.79.195] (port=38569 helo=douyutv.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))

id 1trKqN-00000000CsX-0BuB

for bin@nl2k.ab.ca;

Sun, 09 Mar 2025 11:53:52 -0600

Date: Sun, 09 Mar 2025 13:50:22 -0400

From: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

Reply-To: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

To: bin@nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.khPQ6sGvfauUE37AknWD1kaYy1w0CV16.localhost.bin>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@wiki.lat

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 23.1

X-Spam_score_int: 231

X-Spam_bar: +++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  YOUR EXPERIENCE IS VERY IMPORTANT Your opinion is important

to us



Content analysis details: (23.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.145.79.195 listed in will-spam-for-food.eu.org]

[217.145.79.195 listed in will-spam-for-food.eu.org]

[217.145.79.195 listed in will-spam-for-food.eu.org]

[217.145.79.195 listed in will-spam-for-food.eu.org]

[217.145.79.195 listed in will-spam-for-food.eu.org]

[217.145.79.195 listed in will-spam-for-food.eu.org]

[217.145.79.195 listed in will-spam-for-food.eu.org]

[217.145.79.195 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[217.145.79.195 listed in dnsbl.ahbl.org]

[217.145.79.195 listed in dnsbl.ahbl.org]

[217.145.79.195 listed in dnsbl.ahbl.org]

[217.145.79.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[217.145.79.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[217.145.79.195 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[217.145.79.195 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[217.145.79.195 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[217.145.79.195 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[217.145.79.195 listed in sa-trusted.bondedsender.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ools.us]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[217.145.79.195 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[217.145.79.195 listed in bl.score.senderscore.com]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.1 TW_AQ BODY: Odd Letter Triples with AQ

0.1 TW_QY BODY: Odd Letter Triples with QY

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

Subject: {SPAM?} =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=














































YOUR EXPERIENCE IS VERY IMPORTANT

Your opinion is important to us

We want to offer you a unique opportunity to get a Wagyu Steak Box! To claim, simply take this short survey about your Costco.




START INVESTIGATION













































































Do you no longer want to receive these emails? Unsubscribe.










Costco phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 09 Mar 2025 12:26:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1trLLX-000000005x7-3aO9

for dave@doctor.nl2k.ab.ca;

Sun, 09 Mar 2025 12:25:55 -0600

Resent-From: The Doctor

Resent-Date: Sun, 9 Mar 2025 12:25:55 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [217.145.79.222] (port=40533 helo=realtor.ca)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))

id 1trKqP-00000000CsZ-1zeQ

for www@nl2k.ab.ca;

Sun, 09 Mar 2025 11:53:55 -0600

Date: Sun, 09 Mar 2025 13:50:22 -0400

From: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

Reply-To: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

To: www@nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.3oXLl4zXFCDm4IDikQ5DeeioQvVsQwn7.localhost.www>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@wiki.lat

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 23.1

X-Spam_score_int: 231

X-Spam_bar: +++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  YOUR EXPERIENCE IS VERY IMPORTANT Your opinion is important

to us



Content analysis details: (23.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.145.79.222 listed in will-spam-for-food.eu.org]

[217.145.79.222 listed in will-spam-for-food.eu.org]

[217.145.79.222 listed in will-spam-for-food.eu.org]

[217.145.79.222 listed in will-spam-for-food.eu.org]

[217.145.79.222 listed in will-spam-for-food.eu.org]

[217.145.79.222 listed in will-spam-for-food.eu.org]

[217.145.79.222 listed in will-spam-for-food.eu.org]

[217.145.79.222 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[217.145.79.222 listed in dnsbl.ahbl.org]

[217.145.79.222 listed in dnsbl.ahbl.org]

[217.145.79.222 listed in dnsbl.ahbl.org]

[217.145.79.222 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[217.145.79.222 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[217.145.79.222 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[217.145.79.222 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[217.145.79.222 listed in dnsbl.ahbl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ools.us]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[217.145.79.222 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[217.145.79.222 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[217.145.79.222 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[217.145.79.222 listed in bl.score.senderscore.com]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=realtor.ca;ip=217.145.79.222;r=doctor.nl2k.ab.ca]

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.1 TW_AQ BODY: Odd Letter Triples with AQ

0.1 TW_QY BODY: Odd Letter Triples with QY

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

Subject: {SPAM?} =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=














































YOUR EXPERIENCE IS VERY IMPORTANT

Your opinion is important to us

We want to offer you a unique opportunity to get a Wagyu Steak Box! To claim, simply take this short survey about your Costco.




START INVESTIGATION













































































Do you no longer want to receive these emails? Unsubscribe.










Costco phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 09 Mar 2025 12:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1trLlv-000000008DZ-3Ng1

for dave@doctor.nl2k.ab.ca;

Sun, 09 Mar 2025 12:53:11 -0600

Resent-From: The Doctor

Resent-Date: Sun, 9 Mar 2025 12:53:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [217.145.79.10] (port=36387 helo=shopee.ph)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))

id 1trLRM-000000006R3-2wqU

for doctor@doctor.nl2k.ab.ca;

Sun, 09 Mar 2025 12:32:02 -0600

Date: Sun, 09 Mar 2025 14:04:14 -0400

From: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

Reply-To: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

To: doctor@doctor.nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.vr4rvYkrkYRzTB60FOfqGgRvu1TXiOGU.localhost.doctor>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@wiki.lat

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 29.1

X-Spam_score_int: 291

X-Spam_bar: +++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  YOUR EXPERIENCE IS VERY IMPORTANT Your opinion is important

to us



Content analysis details: (29.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[217.145.79.10 listed in sbl-xbl.spamhaus.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.145.79.10 listed in will-spam-for-food.eu.org]

[217.145.79.10 listed in will-spam-for-food.eu.org]

[217.145.79.10 listed in will-spam-for-food.eu.org]

[217.145.79.10 listed in will-spam-for-food.eu.org]

[217.145.79.10 listed in will-spam-for-food.eu.org]

[217.145.79.10 listed in will-spam-for-food.eu.org]

[217.145.79.10 listed in will-spam-for-food.eu.org]

[217.145.79.10 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[217.145.79.10 listed in dnsbl.ahbl.org]

[217.145.79.10 listed in dnsbl.ahbl.org]

[217.145.79.10 listed in dnsbl.ahbl.org]

[217.145.79.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[217.145.79.10 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[217.145.79.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[217.145.79.10 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[217.145.79.10 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[217.145.79.10 listed in zen.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[217.145.79.10 listed in sa-trusted.bondedsender.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[217.145.79.10 listed in sa-accredit.habeas.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ools.us]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[217.145.79.10 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[217.145.79.10 listed in bl.score.senderscore.com]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.1 TW_AQ BODY: Odd Letter Triples with AQ

0.1 TW_QY BODY: Odd Letter Triples with QY

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

Subject: {SPAM?} =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=














































YOUR EXPERIENCE IS VERY IMPORTANT

Your opinion is important to us

We want to offer you a unique opportunity to get a Wagyu Steak Box! To claim, simply take this short survey about your Costco.




START INVESTIGATION













































































Do you no longer want to receive these emails? Unsubscribe.










Costco phish

Posted by Dave Yadallee on
Return-path: <>

Envelope-to: dave@nl2k.ab.ca

Delivery-date: Sun, 09 Mar 2025 11:54:00 -0600

Received: from [217.145.79.10] (port=57709 helo=shopee.ph)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))

id 1trKqP-00000000Csd-23yq

for dave@nl2k.ab.ca;

Sun, 09 Mar 2025 11:53:57 -0600

Date: Sun, 09 Mar 2025 13:50:22 -0400

From: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

Reply-To: =?UTF-8?B?Q29tbXVuaWNhdGlvbi1mcm9tLkNvc3Rjbw==?=

To: dave@nl2k.ab.ca

Message-ID:

Subject: =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.UERoYJTW6g3iYBmpF1oCTm9BumJmZa4Y.localhost.dave>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@wiki.lat

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 27.7

X-Spam_score_int: 277

X-Spam_bar: +++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  YOUR EXPERIENCE IS VERY IMPORTANT Your opinion is important

to us



Content analysis details: (27.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.145.79.10 listed in will-spam-for-food.eu.org]

[217.145.79.10 listed in will-spam-for-food.eu.org]

[217.145.79.10 listed in will-spam-for-food.eu.org]

[217.145.79.10 listed in will-spam-for-food.eu.org]

[217.145.79.10 listed in will-spam-for-food.eu.org]

[217.145.79.10 listed in will-spam-for-food.eu.org]

[217.145.79.10 listed in will-spam-for-food.eu.org]

[217.145.79.10 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[217.145.79.10 listed in dnsbl.ahbl.org]

[217.145.79.10 listed in dnsbl.ahbl.org]

[217.145.79.10 listed in dnsbl.ahbl.org]

[217.145.79.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[217.145.79.10 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[217.145.79.10 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[217.145.79.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[217.145.79.10 listed in dnsbl.ahbl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ools.us]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.1 TW_AQ BODY: Odd Letter Triples with AQ

0.1 TW_QY BODY: Odd Letter Triples with QY

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 LONGLN_LOW_CONTRAST Excessively long line + hidden text

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

Subject: {SPAM?} =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zLi53aXRoIHRoZSBXYXF5dSBTdGVhay1Cb3g=?=














































YOUR EXPERIENCE IS VERY IMPORTANT

Your opinion is important to us

We want to offer you a unique opportunity to get a Wagyu Steak Box! To claim, simply take this short survey about your Costco.




START INVESTIGATION













































































Do you no longer want to receive these emails? Unsubscribe.










Prosperity spam from Microsoft outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 09 Mar 2025 10:55:00 -0600

Received: from mail-eastasiaazolkn19011027.outbound.protection.outlook.com ([52.103.64.27]:63449 helo=HK3PR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1trJv6-000000007wS-3sVx;

Sun, 09 Mar 2025 10:54:38 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=UpMUvZIMDu1gpY+cxHvAPsFsh5MZAaoNeJne3mmRCFehizejxHcDlCzOLutpbrUL/K7T2p92XvcI6FGNaViW9kxgcDFF+hWUr4mP5Uqg7CKqsSUfS3Ff3xDPct9szaF4esKJ0Ab/zJ9Pumm6s5h3vtM6K8iIj9M1gciWBX//mlVKtVDDzLXrwf5wJRZSIh3aFHdTH/Bpm8u8XXc1IBNP37jhBBTJlq5lh8Jbvmx9b48OfIHW2vBXhxpyAdieRo+VVmJzQhqZWuqeMajAN3hELnmu8ESy+DROnb++Dnt8c+P1pYk4x5RmJDK35BFHcJb2esle5uVV9Gi3DhylG7WQDQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=AEpkxPZ2CvpALIIs+qfj3So0M6y5KwwgFOXTUm4MNLE=;

b=CNp2YCp5VMRxzFEEuylUjfepCR6+crOv9w+fOFdS2Y/w6Wx1ULbl8O+QhsqMzsmIRTvYIdaLWE2Bbn0B47yHTqFPuMs8US0j9E7yM/ElFt57By1wBk73qwr84+o1zuVAWx7LqgbZcXgoGnnGlY7qQHqO+TYfM60t74s5DsqOzmjNZun/qZc9QjdQ3KLEwod3Zw0OAFi6UZsf0n3WByi561082OI3yMTy4ck8T7+pGtPc9FYhukNHEaxZR6cRl0Sqz46dzkKpK9Jah/HDUsVvcSkYBEjHYExc5z2bP0e2lktCo0yxUU8/VJL6TZJnGvXUWZDfTIYTfIUJwPcbxUKNuQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=AEpkxPZ2CvpALIIs+qfj3So0M6y5KwwgFOXTUm4MNLE=;

b=meJgLj9+AmtGDHuHqcHBKBehXeawELsW46QD4jwJBPusRmu1ngSPTZAlMWpz7i1XCS+WgFQh8cRMKgKFnWGb2wRGYjk6qcqEVuwINKtjSLPJ2/QQHHiCbiLo8NaBatU4jNdJJ15Soj/8zptcnH7+heXVqI94Dl0yscDo2Zz0X06aq4Pwk6IQPua92wudazOqODxwFnIod9OihR+UUuv8sBR8eiDAeV5K5FBfOw6NT8Cipdq5+qEDSihEs5cusnFrbEvXnkHDGr+7TGuD3KJNUa9vxTdSChFTeMXpzQyCHmKKrlMP6fhPI8pRhBRlMk+/+UOvjZv58A8BMESMGj4eqw==

Received: from KL1PR0601MB5821.apcprd06.prod.outlook.com (2603:1096:820:b4::9)

by SEZPR06MB5392.apcprd06.prod.outlook.com (2603:1096:101:67::13) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8511.26; Sun, 9 Mar

2025 16:51:55 +0000

Received: from KL1PR0601MB5821.apcprd06.prod.outlook.com

([fe80::59aa:609b:9368:a9cd]) by KL1PR0601MB5821.apcprd06.prod.outlook.com

([fe80::59aa:609b:9368:a9cd%6]) with mapi id 15.20.8511.025; Sun, 9 Mar 2025

16:51:55 +0000

From: Naoh Denver

Subject: Discover the exciting new opportunities unfolding for you!

Thread-Topic: Discover the exciting new opportunities unfolding for you!

Thread-Index: AQHbkRN9hPK8zVzbNU24lkHjatmdGA==

Date: Sun, 9 Mar 2025 16:51:54 +0000

Message-ID:



Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-exchange-messagesentrepresentingtype: 1

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: KL1PR0601MB5821:EE_|SEZPR06MB5392:EE_

x-ms-office365-filtering-correlation-id: 5bf532ca-103f-4819-b1ca-08dd5f2ab275

x-microsoft-antispam:

BCL:0;ARA:14566002|19110799003|12050799009|9400799030|15030799003|8062599003|15080799006|461199028|8060799006|10035399004|102099032|440099028|4302099013|3412199025|1602099012;

x-microsoft-antispam-message-info:

=?utf-8?B?QzdFMmpibWZoUWxSb1R6WllqbUlqbHFGT3JrVllOOGtWMTQ2a1JjVExrU0dh?=

=?utf-8?B?WWNHRHc4QVVwcGpUVEV2YlpKazNyZWJ1a3dvdWM4TUNOT0pMWXdrKzJZc1F4?=

=?utf-8?B?VWh6VjkrR3FkSXNCU2lqN2VnL3pIUm9ibTZFYURPQnVYalZyMkZNeTVYUFB4?=

=?utf-8?B?dE5nRVpuamdPTFB2VEVWY3BWVlJnZ2tHdmhWRXkzRnlQT0swN25lTW5iWXNH?=

=?utf-8?B?Ry94Z2xkUnQ5SWpLUzVzNzM0TWlpa3I5TTlqa2gvWnZ3YkhRckVqN2ZUN2pO?=

=?utf-8?B?VjA1SWlSbUJXWlBpK2Fyc082dXB0YjNwNVkwdnZkUlE1T3l1eVc1UFZHOFdl?=

=?utf-8?B?RWlRUmtDWU9tMy9BcWhoQmxEcEs5V281d2JLeTI4SXZCSTFtd2ZacUowYzlD?=

=?utf-8?B?WXdLN0pab0szWHBHVWd4ZVpqSlE1MnhBSFh3YkozcjI5UEg0Vk9TbWQ2ODlv?=

=?utf-8?B?MzFyOGg5VGJ1cEllMmgyK1h1TnZjMHozSE1wSGxvNHA3Q2lHbjUvZHozOFAx?=

=?utf-8?B?dEhzNGROTTJzTzE4bXdXUzR5NlFCRFhBM1UxMk1YVGNQdzR2bU9TSjVPdVFY?=

=?utf-8?B?MmlFV3RtTWZSdEE5VmtrV0pNZFJ5YlYrTlFqMjVkMXpYZ01MNlg5aE9KTzc2?=

=?utf-8?B?NjNmTERHTnNmeW84bjkvL3RGVFpEQVE1ZzZKOW9FTUpVTzBFaHVNTWN6VUN6?=

=?utf-8?B?dENVTE1IdElJTWhpSkpMSnMvanVlb2JNZHJDR3AxWWZZYThqMUxicHREOUFo?=

=?utf-8?B?bzhNWnZlczBhRE91bXFKcW9kMUZoVjkrWkpjV0FZZXlTTldiVlh3dVJYUlow?=

=?utf-8?B?Nk9YMGx0REYrM0FJalgrY2FTNm95Z0dhdDA3bkF4VzVTSWFqc05WR2VkLzNv?=

=?utf-8?B?enp0N0VUSk5IYStkOE1tdUdJbkVKSCt2RzBlMTJ1WkFoZXBtMXJFRlNkVERw?=

=?utf-8?B?YW1rVHdiSEY2T2ZFWGhYQmszdk1HZTgwYmhvM1pzbTl1bmIwT2w5bFRNN1BW?=

=?utf-8?B?ZmhUdjhVeFo1Q0h6NnlidWNLRjhtT0RpS090Q0ZDaU5laDIvcmFWMTYvSFk2?=

=?utf-8?B?OE1QZXczdDUxK0RhTXhxc2NCQkxaSFZ5Y1Y5U1pxNlZFN280SGxsbE5LVENw?=

=?utf-8?B?MjZEYWlIZmNiZGg5aVRYQXBwT2hXeVowNENHbWhrdWRwdnVyZkdPcUZuUWdB?=

=?utf-8?B?Wi9HZmxtR2xVNWtIdTFmYlk5b3g1V1RUZ2JGZSt5aXlYcU5Mc21TZDlkQ1hq?=

=?utf-8?B?aytkVUFSbWlwWkJJNmRiai9oYVpHRmZLcGI4QWx0bzhUWUNqU3FlUUtFQVp1?=

=?utf-8?B?SGtIaG1OaU50NlpzNGVZQ0hQR1MrbnE4NkJJRzFidXhyaVp6RnRETGg0alFD?=

=?utf-8?B?YXBIM1VhbjBtdi8rOXJjdUp3VVEzRHBDMnVaeWhvamQzS2NyNUg3RWZJelZ4?=

=?utf-8?B?VEpCL1F1WStjRmdRVVhmejF0QmhGUndRNTZML2lnRHpPK3U5YnVBQWxRUldC?=

=?utf-8?B?ZFFCL1pCR0xnTzR2VWxndlIxQ1RNQ1JQMTRJbWplNEVNZTEvNWZwU09PTENM?=

=?utf-8?B?YWJTL0cxOUNFUzdmWHhBa3RrakNhSG5ML2JjNTJLTEJNc1JEOSsydU1naVpT?=

=?utf-8?B?Sy9wVk9tZnNzckhoU3FGeWhYdng0ZUhxUFozeXB6eW1va2Y3bjZFamZvb3Uw?=

=?utf-8?Q?CKd7+1SBfTtLWy1jC+Uw?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?utf-8?B?c3ZHcnZ5MDJZT0RCL2srWmV5Z3V1R21HMzF1cmpzWERhYUhpZ240d1dXaWxs?=

=?utf-8?B?c1Vtb25hTXRWZ1BOQVpjVll5SHBBbjdtL2xnbFpvOE9iTHJvZlRTNkxmRno2?=

=?utf-8?B?eWNJd0RnSGJhNTd4QUN2ZEFKaTFObGt0cmxaNWhSczVVSVVxclFzSDZLZXVq?=

=?utf-8?B?ajJSTFhGYkx0eFRBaGFMQStSUGoyRTF5ZlJKQ1FwY1BRY3NwQkdpTytCU3U5?=

=?utf-8?B?NEJOQTVmbmQzKzNveHZ1dDNOVmJDSDZVT3g3cHVsL2F0S3JJSmJKL0Z0S0da?=

=?utf-8?B?UGNkeis4VThRSjlOQzlxRWxhSDVCVVhrbGVJVzg3ZXZ4d0tpM0diR2M3d3hC?=

=?utf-8?B?UDUxTjEveEd0eXNrdk1FeGdPeWJNYUZDQTIzNjhBanpDSm1yN3orV1JobGhL?=

=?utf-8?B?NHAyTTE4N1pnc0Nuc1BvNld0c3VuVGJJZUNFVDZLano0MHJKSit2MTgvRkRR?=

=?utf-8?B?WFVEeUhsSWJZQ0xYWW84M0lRL1kwWUVHbFlQbTVyS2VxQnNvOHB1TEtqVGlx?=

=?utf-8?B?K2tQdUgrblRlODEvaUpKeDNKeFQrakVCUDJwVXRuemJXUzNOeU56NjlOYnFW?=

=?utf-8?B?YnMrQ2t6Zy8zMFBOeGNOc0ZRZGlZcVozTkhZTk5jZXRUcENwQUljS01TanBm?=

=?utf-8?B?amxPVzhUMWlnY3diaXg5VEdDWXpkR0lLVkQ0MVVhYm94ejR0YzEzNTlobHFx?=

=?utf-8?B?WjZhR2d4amN3cG94Nm1rRnNBZmNLa1hNa0JjUGlEdThURVFHQ3doYlpXaUZ2?=

=?utf-8?B?aUZOK29HakNFYVhJTlQ1Q0FFZmVKUmZkTDFSampMRlpsMEtNYUVlaHQrT2xx?=

=?utf-8?B?TW9mNDhiOWtzV1RGazdrNVNxRld4REFRTlFKMUpWNjdjNVhGdzEyWHBlVTJV?=

=?utf-8?B?ZmI2azNGbUo0K1ZDYnhMWTJZYmUxUzdJR0VrL05iOTN5M2dxT2YwWEdwMk9B?=

=?utf-8?B?Rk5LOTg4MmFEUStKU1BhdUFNNGpTeHp3YVNGZWY5VlordjJyMkhpZElUUVBa?=

=?utf-8?B?ZkViakZvcEVMb1V3L2dnMnR3R2R4clFHb2dqZHVkU09nSENocFJOZlRSOFZy?=

=?utf-8?B?MWRkTmM4bUR4VEhZVFd4QmNKcGltYlhaR1d5LzhHOEtXZ0dXRWZKN0E2NmJY?=

=?utf-8?B?RHliVXJtMXA2MFoyNElIVFJ4ZXRGUmh4SjVlZjg2RDZGR1hJMStPMnkxYXZG?=

=?utf-8?B?QXI0a2NpdHQwclpEQjVNa3BGQlgwWTZPWWhVbHp1T3pMTXVqWkFxSllQd0da?=

=?utf-8?B?b0ZKSzFxb3drWnlKR2tMbTVVR2lYK2wrVjlhdWxuYlBSNndySUg5SUxEZThG?=

=?utf-8?B?cnhJRlNiMDBSbDNyVk9sdlYwcXBzYWZueVNOd3k3dHVTN1hjUm0vSnR6YW1B?=

=?utf-8?B?eXhMemRrQUk2TjZXeEk5ejAzRFdWSWlpYmVEWkpaaHc1ZitZUXgycHRod2g2?=

=?utf-8?B?UkJhbCt5N0NWU3F4dVc5SGh4VXIrMHUrbVJDZGk0TTZsNC8ra0xPSEVpRnI2?=

=?utf-8?B?Z0FTMlVmajN5dHdrbHg0bU1iTFk3dXRuR0NhVEhxb05yaE5jQTRKdE9QY1po?=

=?utf-8?B?ZmVEUHpZeVlFRWpkWUh1UUtONEladkFaUXFzY3hGL0paNk9vclpXbWJRVzlx?=

=?utf-8?B?MU1YK1JwT2ErMXR0Y0JqNHNMcDJEV0VrQ0x1UnJzbFhwRlFVclFyRlg5SDdZ?=

=?utf-8?B?T1czL0loUGVJYTF6cmwxY1Iyamt5eGRaeWlKZWdRNnYxbUFyTWhwVktnTThC?=

=?utf-8?B?amt4bVNUZ0xHcURwVXRhZjNOR2RYVzZseUJIUWJ1Z0tkdHpZTzlXQ1ByWENL?=

=?utf-8?B?bzJVaGxiZjdrTFMvVFVBUT09?=

Content-Type: multipart/alternative;

boundary="_000_KL1PR0601MB58219F5F5AF2CDDCD2079C2FBBD72KL1PR0601MB5821_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: KL1PR0601MB5821.apcprd06.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 5bf532ca-103f-4819-b1ca-08dd5f2ab275

X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Mar 2025 16:51:54.3501

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEZPR06MB5392

X-Spam_score: 15.3

X-Spam_score_int: 153

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: I just got a message from my friend Sarah, and it’s about

you. She sees a big shift coming in your life—one that could open new doors

if you’re prepared. The timing is crucial, and you have a rare window to

make the most of it.



Content analysis details: (15.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:820:b4:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[2603:1096:820:b4:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[2603:1096:820:b4:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[2603:1096:820:b4:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[2603:1096:820:b4:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[2603:1096:820:b4:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[2603:1096:820:b4:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[2603:1096:820:b4:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

[52.103.64.27 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.64.27 listed in dnsbl.ahbl.org]

[52.103.64.27 listed in dnsbl.ahbl.org]

[52.103.64.27 listed in dnsbl.ahbl.org]

[52.103.64.27 listed in dnsbl.ahbl.org]

[2603:1096:820:b4:0:0:0:9 listed in]

[dnsbl.ahbl.org]

[2603:1096:820:b4:0:0:0:9 listed in]

[dnsbl.ahbl.org]

[2603:1096:820:b4:0:0:0:9 listed in]

[dnsbl.ahbl.org]

[2603:1096:820:b4:0:0:0:9 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.64.27 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.64.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.64.27 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.64.27 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.64.27 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.64.27 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[outlook_8fc62abb870234ab(at)outlook.com]

1.2 MISSING_HEADERS Missing To: header

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

1.0 IMPRO_URI_2 No description available.

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} Discover the exciting new opportunities unfolding for you!



--_000_KL1PR0601MB58219F5F5AF2CDDCD2079C2FBBD72KL1PR0601MB5821_

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: base64



SSBqdXN0IGdvdCBhIG1lc3NhZ2UgZnJvbSBteSBmcmllbmQgU2FyYWgsIGFuZCBpdOKAmXMgYWJv

dXQgeW91Lg0KDQpTaGUgc2VlcyBhIGJpZyBzaGlmdCBjb21pbmcgaW4geW91ciBsaWZl4oCUb25l

IHRoYXQgY291bGQgb3BlbiBuZXcgZG9vcnMgaWYgeW914oCZcmUgcHJlcGFyZWQuIFRoZSB0aW1p

bmcgaXMgY3J1Y2lhbCwgYW5kIHlvdSBoYXZlIGEgcmFyZSB3aW5kb3cgdG8gbWFrZSB0aGUgbW9z

dCBvZiBpdC4NCg0KVGhhdOKAmXMgd2h5IFNhcmFoIHB1dCB0b2dldGhlciBhIHBlcnNvbmFsaXpl

ZCBFYXN0ZXJuIGFzdHJvbG9neSByZWFkaW5nIGZvciB5b3U8aHR0cHM6Ly80ZjMxMGNvLWxnZHhi

cWN5d2swanAxcG9iaC5ob3AuY2xpY2tiYW5rLm5ldC8/JnRyYWZmaWNfc291cmNlPWVtYWlsJnRy

YWZmaWNfdHlwZT1lbWFpbD4uIEl0IGNvdmVyczoNCg0K4pyFIFdoYXQgdGhpcyB0cmFuc2l0aW9u

IG1lYW5zIGZvciB5b3UNCuKchSBUaGUga2V5IHN0ZXBzIHRvIG5hdmlnYXRlIHRoaXMgcGVyaW9k

IHNtb290aGx5DQrinIUgSG93IHRvIGFsaWduIHdpdGggdGhpcyBlbmVyZ3kgZm9yIHN1Y2Nlc3MN

Cg0KT3Bwb3J0dW5pdGllcyBsaWtlIHRoaXMgZG9u4oCZdCB3YWl0LiBJZiB5b3Ugd2FudCB0byBi

ZSByZWFkeSwgbm934oCZcyB0aGUgdGltZSB0byBnZXQgeW91ciByZWFkaW5nLg0KDQrwn5GJIENs

YWltIFlvdXIgUGVyc29uYWxpemVkIFJlYWRpbmc8aHR0cHM6Ly80ZjMxMGNvLWxnZHhicWN5d2sw

anAxcG9iaC5ob3AuY2xpY2tiYW5rLm5ldC8/JnRyYWZmaWNfc291cmNlPWVtYWlsJnRyYWZmaWNf

dHlwZT1lbWFpbD4NCg0KWW91ciBmdXR1cmUgaXMgdW5mb2xkaW5n4oCUYXJlIHlvdSByZWFkeSBm

b3IgaXQ/DQoNCllvdXIgam91cm5leSBpcyB1bmZvbGRpbmcsDQpNYXJyeSBDbGFpcg0KDQo=



--_000_KL1PR0601MB58219F5F5AF2CDDCD2079C2FBBD72KL1PR0601MB5821_

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: base64



PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i

dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyIgc3R5bGU9

ImRpc3BsYXk6bm9uZTsiPiBQIHttYXJnaW4tdG9wOjA7bWFyZ2luLWJvdHRvbTowO30gPC9zdHls

ZT4NCjwvaGVhZD4NCjxib2R5IGRpcj0ibHRyIj4NCjxkaXYgY2xhc3M9ImVsZW1lbnRUb1Byb29m

IiBzdHlsZT0idGV4dC1hbGlnbjogbGVmdDsgdGV4dC1pbmRlbnQ6IDBweDsgYmFja2dyb3VuZC1j

b2xvcjogcmdiKDI1NSwgMjU1LCAyNTUpOyBtYXJnaW46IDBweDsgZm9udC1mYW1pbHk6IEFwdG9z

LCBBcHRvc19FbWJlZGRlZEZvbnQsIEFwdG9zX01TRm9udFNlcnZpY2UsIENhbGlicmksIEhlbHZl

dGljYSwgc2Fucy1zZXJpZiwgc2VyaWYsIEVtb2ppRm9udDsgZm9udC1zaXplOiAxMnB0OyBjb2xv

cjogcmdiKDAsIDAsIDApOyI+DQpJIGp1c3QgZ290IGEgbWVzc2FnZSBmcm9tIG15IGZyaWVuZCBT

YXJhaCwgYW5kIGl04oCZcyBhYm91dCB5b3UuPC9kaXY+DQo8ZGl2IGNsYXNzPSJlbGVtZW50VG9Q

cm9vZiIgc3R5bGU9InRleHQtYWxpZ246IGxlZnQ7IHRleHQtaW5kZW50OiAwcHg7IGJhY2tncm91

bmQtY29sb3I6IHJnYigyNTUsIDI1NSwgMjU1KTsgbWFyZ2luOiAwcHg7IGZvbnQtZmFtaWx5OiBB

cHRvcywgQXB0b3NfRW1iZWRkZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBDYWxpYnJpLCBI

ZWx2ZXRpY2EsIHNhbnMtc2VyaWYsIHNlcmlmLCBFbW9qaUZvbnQ7IGZvbnQtc2l6ZTogMTJwdDsg

Y29sb3I6IHJnYigwLCAwLCAwKTsiPg0KPGJyPg0KPC9kaXY+DQo8ZGl2IGNsYXNzPSJlbGVtZW50

VG9Qcm9vZiIgc3R5bGU9InRleHQtYWxpZ246IGxlZnQ7IHRleHQtaW5kZW50OiAwcHg7IGJhY2tn

cm91bmQtY29sb3I6IHJnYigyNTUsIDI1NSwgMjU1KTsgbWFyZ2luOiAwcHg7IGZvbnQtZmFtaWx5

OiBBcHRvcywgQXB0b3NfRW1iZWRkZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBDYWxpYnJp

LCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWYsIHNlcmlmLCBFbW9qaUZvbnQ7IGZvbnQtc2l6ZTogMTJw

dDsgY29sb3I6IHJnYigwLCAwLCAwKTsiPg0KU2hlIHNlZXMgYSBiaWcgc2hpZnQgY29taW5nIGlu

IHlvdXIgbGlmZeKAlG9uZSB0aGF0IGNvdWxkIG9wZW4gbmV3IGRvb3JzIGlmIHlvdeKAmXJlIHBy

ZXBhcmVkLiBUaGUgdGltaW5nIGlzIGNydWNpYWwsIGFuZCB5b3UgaGF2ZSBhIHJhcmUgd2luZG93

IHRvIG1ha2UgdGhlIG1vc3Qgb2YgaXQuPC9kaXY+DQo8ZGl2IGNsYXNzPSJlbGVtZW50VG9Qcm9v

ZiIgc3R5bGU9InRleHQtYWxpZ246IGxlZnQ7IHRleHQtaW5kZW50OiAwcHg7IGJhY2tncm91bmQt

Y29sb3I6IHJnYigyNTUsIDI1NSwgMjU1KTsgbWFyZ2luOiAwcHg7IGZvbnQtZmFtaWx5OiBBcHRv

cywgQXB0b3NfRW1iZWRkZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBDYWxpYnJpLCBIZWx2

ZXRpY2EsIHNhbnMtc2VyaWYsIHNlcmlmLCBFbW9qaUZvbnQ7IGZvbnQtc2l6ZTogMTJwdDsgY29s

b3I6IHJnYigwLCAwLCAwKTsiPg0KPGJyPg0KPC9kaXY+DQo8ZGl2IGNsYXNzPSJlbGVtZW50VG9Q

cm9vZiIgc3R5bGU9InRleHQtYWxpZ246IGxlZnQ7IHRleHQtaW5kZW50OiAwcHg7IGJhY2tncm91

bmQtY29sb3I6IHJnYigyNTUsIDI1NSwgMjU1KTsgbWFyZ2luOiAwcHg7IGZvbnQtZmFtaWx5OiBB

cHRvcywgQXB0b3NfRW1iZWRkZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBDYWxpYnJpLCBI

ZWx2ZXRpY2EsIHNhbnMtc2VyaWYsIHNlcmlmLCBFbW9qaUZvbnQ7IGZvbnQtc2l6ZTogMTJwdDsg

Y29sb3I6IHJnYigwLCAwLCAwKTsiPg0KVGhhdOKAmXMgd2h5IDxhIGhyZWY9Imh0dHBzOi8vNGYz

MTBjby1sZ2R4YnFjeXdrMGpwMXBvYmguaG9wLmNsaWNrYmFuay5uZXQvPyZhbXA7dHJhZmZpY19z

b3VyY2U9ZW1haWwmYW1wO3RyYWZmaWNfdHlwZT1lbWFpbCIgdGFyZ2V0PSJfYmxhbmsiIGlkPSJP

V0E2YWUxNTcxOS1iZjc0LWY3YjItYWNhMS0zNjI0YjlkYjJiZWYiIGNsYXNzPSJ4X09XQUF1dG9M

aW5rIiB0aXRsZT0iaHR0cHM6Ly80ZjMxMGNvLWxnZHhicWN5d2swanAxcG9iaC5ob3AuY2xpY2ti

YW5rLm5ldC8/JmFtcDt0cmFmZmljX3NvdXJjZT1lbWFpbCZhbXA7dHJhZmZpY190eXBlPWVtYWls

IiByZWw9Im5vb3BlbmVyIG5vcmVmZXJyZXIiIGRhdGEtbGlua2luZGV4PSIwIiBkYXRhLWF1dGg9

Ik5vdEFwcGxpY2FibGUiIHN0eWxlPSJtYXJnaW46IDBweDsiPg0KU2FyYWggcHV0IHRvZ2V0aGVy

IGEgcGVyc29uYWxpemVkIEVhc3Rlcm4gYXN0cm9sb2d5IHJlYWRpbmcgZm9yIHlvdTwvYT4uIEl0

IGNvdmVyczo8L2Rpdj4NCjxkaXYgY2xhc3M9ImVsZW1lbnRUb1Byb29mIiBzdHlsZT0idGV4dC1h

bGlnbjogbGVmdDsgdGV4dC1pbmRlbnQ6IDBweDsgYmFja2dyb3VuZC1jb2xvcjogcmdiKDI1NSwg

MjU1LCAyNTUpOyBtYXJnaW46IDBweDsgZm9udC1mYW1pbHk6IEFwdG9zLCBBcHRvc19FbWJlZGRl

ZEZvbnQsIEFwdG9zX01TRm9udFNlcnZpY2UsIENhbGlicmksIEhlbHZldGljYSwgc2Fucy1zZXJp

Ziwgc2VyaWYsIEVtb2ppRm9udDsgZm9udC1zaXplOiAxMnB0OyBjb2xvcjogcmdiKDAsIDAsIDAp

OyI+DQo8YnI+DQo8L2Rpdj4NCjxkaXYgY2xhc3M9ImVsZW1lbnRUb1Byb29mIiBzdHlsZT0idGV4

dC1hbGlnbjogbGVmdDsgdGV4dC1pbmRlbnQ6IDBweDsgYmFja2dyb3VuZC1jb2xvcjogcmdiKDI1

NSwgMjU1LCAyNTUpOyBtYXJnaW46IDBweDsgZm9udC1mYW1pbHk6IEFwdG9zLCBBcHRvc19FbWJl

ZGRlZEZvbnQsIEFwdG9zX01TRm9udFNlcnZpY2UsIENhbGlicmksIEhlbHZldGljYSwgc2Fucy1z

ZXJpZiwgc2VyaWYsIEVtb2ppRm9udDsgZm9udC1zaXplOiAxMnB0OyBjb2xvcjogcmdiKDAsIDAs

IDApOyI+DQrinIUgV2hhdCB0aGlzIHRyYW5zaXRpb24gbWVhbnMgZm9yIHlvdTwvZGl2Pg0KPGRp

diBjbGFzcz0iZWxlbWVudFRvUHJvb2YiIHN0eWxlPSJ0ZXh0LWFsaWduOiBsZWZ0OyB0ZXh0LWlu

ZGVudDogMHB4OyBiYWNrZ3JvdW5kLWNvbG9yOiByZ2IoMjU1LCAyNTUsIDI1NSk7IG1hcmdpbjog

MHB4OyBmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3NfTVNGb250

U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmLCBzZXJpZiwgRW1vamlGb250

OyBmb250LXNpemU6IDEycHQ7IGNvbG9yOiByZ2IoMCwgMCwgMCk7Ij4NCuKchSBUaGUga2V5IHN0

ZXBzIHRvIG5hdmlnYXRlIHRoaXMgcGVyaW9kIHNtb290aGx5PC9kaXY+DQo8ZGl2IGNsYXNzPSJl

bGVtZW50VG9Qcm9vZiIgc3R5bGU9InRleHQtYWxpZ246IGxlZnQ7IHRleHQtaW5kZW50OiAwcHg7

IGJhY2tncm91bmQtY29sb3I6IHJnYigyNTUsIDI1NSwgMjU1KTsgbWFyZ2luOiAwcHg7IGZvbnQt

ZmFtaWx5OiBBcHRvcywgQXB0b3NfRW1iZWRkZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBD

YWxpYnJpLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWYsIHNlcmlmLCBFbW9qaUZvbnQ7IGZvbnQtc2l6

ZTogMTJwdDsgY29sb3I6IHJnYigwLCAwLCAwKTsiPg0K4pyFIEhvdyB0byBhbGlnbiB3aXRoIHRo

aXMgZW5lcmd5IGZvciBzdWNjZXNzPC9kaXY+DQo8ZGl2IGNsYXNzPSJlbGVtZW50VG9Qcm9vZiIg

c3R5bGU9InRleHQtYWxpZ246IGxlZnQ7IHRleHQtaW5kZW50OiAwcHg7IGJhY2tncm91bmQtY29s

b3I6IHJnYigyNTUsIDI1NSwgMjU1KTsgbWFyZ2luOiAwcHg7IGZvbnQtZmFtaWx5OiBBcHRvcywg

QXB0b3NfRW1iZWRkZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBDYWxpYnJpLCBIZWx2ZXRp

Y2EsIHNhbnMtc2VyaWYsIHNlcmlmLCBFbW9qaUZvbnQ7IGZvbnQtc2l6ZTogMTJwdDsgY29sb3I6

IHJnYigwLCAwLCAwKTsiPg0KPGJyPg0KPC9kaXY+DQo8ZGl2IGNsYXNzPSJlbGVtZW50VG9Qcm9v

ZiIgc3R5bGU9InRleHQtYWxpZ246IGxlZnQ7IHRleHQtaW5kZW50OiAwcHg7IGJhY2tncm91bmQt

Y29sb3I6IHJnYigyNTUsIDI1NSwgMjU1KTsgbWFyZ2luOiAwcHg7IGZvbnQtZmFtaWx5OiBBcHRv

cywgQXB0b3NfRW1iZWRkZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBDYWxpYnJpLCBIZWx2

ZXRpY2EsIHNhbnMtc2VyaWYsIHNlcmlmLCBFbW9qaUZvbnQ7IGZvbnQtc2l6ZTogMTJwdDsgY29s

b3I6IHJnYigwLCAwLCAwKTsiPg0KT3Bwb3J0dW5pdGllcyBsaWtlIHRoaXMgZG9u4oCZdCB3YWl0

LiBJZiB5b3Ugd2FudCB0byBiZSByZWFkeSwgbm934oCZcyB0aGUgdGltZSB0byBnZXQgeW91ciBy

ZWFkaW5nLjwvZGl2Pg0KPGRpdiBjbGFzcz0iZWxlbWVudFRvUHJvb2YiIHN0eWxlPSJ0ZXh0LWFs

aWduOiBsZWZ0OyB0ZXh0LWluZGVudDogMHB4OyBiYWNrZ3JvdW5kLWNvbG9yOiByZ2IoMjU1LCAy

NTUsIDI1NSk7IG1hcmdpbjogMHB4OyBmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVk

Rm9udCwgQXB0b3NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlm

LCBzZXJpZiwgRW1vamlGb250OyBmb250LXNpemU6IDEycHQ7IGNvbG9yOiByZ2IoMCwgMCwgMCk7

Ij4NCjxicj4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0iZWxlbWVudFRvUHJvb2YiIHN0eWxlPSJ0ZXh0

LWFsaWduOiBsZWZ0OyB0ZXh0LWluZGVudDogMHB4OyBiYWNrZ3JvdW5kLWNvbG9yOiByZ2IoMjU1

LCAyNTUsIDI1NSk7IG1hcmdpbjogMHB4OyBmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVk

ZGVkRm9udCwgQXB0b3NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNl

cmlmLCBzZXJpZiwgRW1vamlGb250OyBmb250LXNpemU6IDEycHQ7IGNvbG9yOiByZ2IoMCwgMCwg

MCk7Ij4NCvCfkYkgPGEgaHJlZj0iaHR0cHM6Ly80ZjMxMGNvLWxnZHhicWN5d2swanAxcG9iaC5o

b3AuY2xpY2tiYW5rLm5ldC8/JmFtcDt0cmFmZmljX3NvdXJjZT1lbWFpbCZhbXA7dHJhZmZpY190

eXBlPWVtYWlsIiB0YXJnZXQ9Il9ibGFuayIgaWQ9Ik9XQWVhYTEzYTRjLTA5Y2YtYmI1Ny00M2Jh

LTJmNWQ0YjAyNzRmYiIgY2xhc3M9InhfT1dBQXV0b0xpbmsiIHRpdGxlPSJodHRwczovLzRmMzEw

Y28tbGdkeGJxY3l3azBqcDFwb2JoLmhvcC5jbGlja2JhbmsubmV0Lz8mYW1wO3RyYWZmaWNfc291

cmNlPWVtYWlsJmFtcDt0cmFmZmljX3R5cGU9ZW1haWwiIHJlbD0ibm9vcGVuZXIgbm9yZWZlcnJl

ciIgZGF0YS1saW5raW5kZXg9IjEiIGRhdGEtYXV0aD0iTm90QXBwbGljYWJsZSIgc3R5bGU9Im1h

cmdpbjogMHB4OyI+DQpDbGFpbSBZb3VyIFBlcnNvbmFsaXplZCBSZWFkaW5nPC9hPjwvZGl2Pg0K

PGRpdiBjbGFzcz0iZWxlbWVudFRvUHJvb2YiIHN0eWxlPSJ0ZXh0LWFsaWduOiBsZWZ0OyB0ZXh0

LWluZGVudDogMHB4OyBiYWNrZ3JvdW5kLWNvbG9yOiByZ2IoMjU1LCAyNTUsIDI1NSk7IG1hcmdp

bjogMHB4OyBmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3NfTVNG

b250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmLCBzZXJpZiwgRW1vamlG

b250OyBmb250LXNpemU6IDEycHQ7IGNvbG9yOiByZ2IoMCwgMCwgMCk7Ij4NCjxicj4NCjwvZGl2

Pg0KPGRpdiBjbGFzcz0iZWxlbWVudFRvUHJvb2YiIHN0eWxlPSJ0ZXh0LWFsaWduOiBsZWZ0OyB0

ZXh0LWluZGVudDogMHB4OyBiYWNrZ3JvdW5kLWNvbG9yOiByZ2IoMjU1LCAyNTUsIDI1NSk7IG1h

cmdpbjogMHB4OyBmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3Nf

TVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmLCBzZXJpZiwgRW1v

amlGb250OyBmb250LXNpemU6IDEycHQ7IGNvbG9yOiByZ2IoMCwgMCwgMCk7Ij4NCllvdXIgZnV0

dXJlIGlzIHVuZm9sZGluZ+KAlGFyZSB5b3UgcmVhZHkgZm9yIGl0PzwvZGl2Pg0KPGRpdiBjbGFz

cz0iZWxlbWVudFRvUHJvb2YiIHN0eWxlPSJ0ZXh0LWFsaWduOiBsZWZ0OyB0ZXh0LWluZGVudDog

MHB4OyBiYWNrZ3JvdW5kLWNvbG9yOiByZ2IoMjU1LCAyNTUsIDI1NSk7IG1hcmdpbjogMHB4OyBm

b250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3NfTVNGb250U2Vydmlj

ZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmLCBzZXJpZiwgRW1vamlGb250OyBmb250

LXNpemU6IDEycHQ7IGNvbG9yOiByZ2IoMCwgMCwgMCk7Ij4NCjxicj4NCjwvZGl2Pg0KPGRpdiBj

bGFzcz0iZWxlbWVudFRvUHJvb2YiIHN0eWxlPSJ0ZXh0LWFsaWduOiBsZWZ0OyB0ZXh0LWluZGVu

dDogMHB4OyBiYWNrZ3JvdW5kLWNvbG9yOiByZ2IoMjU1LCAyNTUsIDI1NSk7IG1hcmdpbjogMHB4

OyBmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3NfTVNGb250U2Vy

dmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmLCBzZXJpZiwgRW1vamlGb250OyBm

b250LXNpemU6IDEycHQ7IGNvbG9yOiByZ2IoMCwgMCwgMCk7Ij4NCllvdXIgam91cm5leSBpcyB1

bmZvbGRpbmcsPC9kaXY+DQo8ZGl2IGNsYXNzPSJlbGVtZW50VG9Qcm9vZiIgc3R5bGU9InRleHQt

YWxpZ246IGxlZnQ7IHRleHQtaW5kZW50OiAwcHg7IGJhY2tncm91bmQtY29sb3I6IHJnYigyNTUs

IDI1NSwgMjU1KTsgbWFyZ2luOiAwcHg7IGZvbnQtZmFtaWx5OiBBcHRvcywgQXB0b3NfRW1iZWRk

ZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBDYWxpYnJpLCBIZWx2ZXRpY2EsIHNhbnMtc2Vy

aWYsIHNlcmlmLCBFbW9qaUZvbnQ7IGZvbnQtc2l6ZTogMTJwdDsgY29sb3I6IHJnYigwLCAwLCAw

KTsiPg0KTWFycnkgQ2xhaXI8L2Rpdj4NCjxkaXYgY2xhc3M9ImVsZW1lbnRUb1Byb29mIiBzdHls

ZT0iZm9udC1mYW1pbHk6IEFwdG9zLCBBcHRvc19FbWJlZGRlZEZvbnQsIEFwdG9zX01TRm9udFNl

cnZpY2UsIENhbGlicmksIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxMnB0OyBj

b2xvcjogcmdiKDAsIDAsIDApOyI+DQo8YnI+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg==



--_000_KL1PR0601MB58219F5F5AF2CDDCD2079C2FBBD72KL1PR0601MB5821_--

Web/SEo/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 08 Mar 2025 06:32:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tquGw-00000000HHV-1R4O

for dave@doctor.nl2k.ab.ca;

Sat, 08 Mar 2025 06:31:22 -0700

Resent-From: The Doctor

Resent-Date: Sat, 8 Mar 2025 06:31:22 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f80.google.com ([209.85.216.80]:38881)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.1 (FreeBSD))

(envelope-from <7mar2+bncBCXPFL4PYMNBBXEFWC7AMGQEAHSBRRI@weballen.top>)

id 1tqpnK-0000000021W-1MTS

for sales@nk.ca;

Sat, 08 Mar 2025 01:44:36 -0700

Received: by mail-pj1-f80.google.com with SMTP id 98e67ed59e1d1-2fe8a5c5410sf919334a91.3

for ; Sat, 08 Mar 2025 00:42:36 -0800 (PST)

ARC-Seal: i=2; a=rsa-sha256; t=1741423350; cv=pass;

d=google.com; s=arc-20240605;

b=WNOKaymmE1RIEHSJdVjJMhpSAa8598DhLhG/DksHI/ISOagnLI8EW0HFt9GZXzphQP

JMtQ8aQ9PtustbGAZ+4JtdF+Y6wBLirJN9zrn7voIll2m2sJksnxzzhR3hdaiYihWDNy

/SjKTqNn1BZjAnqfJ6eupxT0PqxtNfN5aQBVhEDEOPvPsQzldhZUlJj/bbm46ESRs/BV

7Inbob+eqGgyHQIAxm0rEIYa7KmVSCCwqXUeFfpESHgOfpzhdGFUX+MhPGuZftcrpKNs

oN0XcW1T437sFe1WaKYuyvluB+XifTeqNO8OaulkAfMYJZ69vy+ua0Bo9WR0mfGx7GKm

Q7hA==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=list-unsubscribe:list-archive:list-help:list-post:list-id

:mailing-list:precedence:to:subject:message-id:date:from

:mime-version:dkim-signature;

bh=piFFaIQEay2BzbsykAG16AdkOfPNOOdHxkhXJllVJC8=;

fh=v2WSFS3W45MvW5eqURinYfxs9bqenjZoU9cETBivatQ=;

b=gMumeuye2NFXnIL+sP5V3hZjskYA7qoXRe4L/xaOKwRTCfd8tCKnIw30M4zLSfUqYn

+NpEom2/XFMTnJHvyDIRrj3kHO61+01dLEXqDquKBu5uNgqI1vy/MU1jOUhR0AMwpQIZ

ZVpo3re7KoyiHXHfePEO0nTvpIiEdjOpfvOrytDzvsQIxYkB0OI7s3OOkEWhThtTNPiR

TdZtWoh314z6Y5qttCqBvZHpIsLhxophJlv6r9K05tsqds/c1mQ2DxB1uEOxKhT4vxHF

z3J2zaDf7RHcBz9z3t9KfzR3LbOgWaqgsnJcJ9g2bITEzv/Y0BX5VzwRlnNYI58TTLps

TXYg==;

darn=nk.ca

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20230601 header.b=WTyZGOB3;

spf=pass (google.com: domain of ginnamarkus968@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=ginnamarkus968@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=pass header.i=@weballen.top

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=weballen-top.20230601.gappssmtp.com; s=20230601; t=1741423350; x=1742028150; darn=nk.ca;

h=list-unsubscribe:list-archive:list-help:list-post:list-id

:mailing-list:precedence:x-original-authentication-results

:x-original-sender:to:subject:message-id:date:from:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=piFFaIQEay2BzbsykAG16AdkOfPNOOdHxkhXJllVJC8=;

b=Snzqvf6OYgTPmKygAljgEpuLetjY4STTIIhW6nKfNRLuF5uHkvO0tK+QD/uXPV3JJX

12tjxuerdLKgaMqq1j+eNp5shk3fxl3tXGQPs7peHGw60jWdxqrQyduaE2fHXSn0lucP

ZkqsbVaSDuDSzq4nj+1JfnsjXou0towiRYzy95qLZU2bld9zymhoLa9q4hJn9Fiefs8o

aSUYDPP1IEmeRaDaMe8+UqD1SR08E1+odvDYJEbCAA0RXpVv4m+f1vq/JH6BG1ocPAId

gqK4czNt4ZGg4dXFao8F0cWXCq6tOv+uwpsClOPQ5Fm3ny1AZYMAfmAg4yuu8yL0u41b

3wgQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1741423350; x=1742028150;

h=list-unsubscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence

:x-original-authentication-results:x-original-sender:to:subject

:message-id:date:from:mime-version:x-beenthere:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=piFFaIQEay2BzbsykAG16AdkOfPNOOdHxkhXJllVJC8=;

b=Ea9i5WUUYrphMY76m+vIvyHrXv1QusqsMLiRzMFJlG2UIQvFJeXR7a87F7RY8I7//r

DhJuKuRJFlLSQffMB7O9pcpJgyJE0bXkPSBn/+t4A5QYAq0enZMEPYnROsCIrShioSSl

csKWruPvCqumVeW2ehpoA+aqJ+j2BUKJN5RAlmW2U1xGE3QKIQWVCE3sYTPb3TAG4PMW

5FYddY9hKY6KQ2iisJ6/qsKZimq6x4ajzErmmmGEPudqhavoeo9/6CubCneyBsipKaOo

IE/FHRdl9HngS6OUd7fnWJEzS7Eu2G6xP8j42qGv1sjLQkhEIWKNd0RRtIPgKP38Rd+k

zc0g==

X-Forwarded-Encrypted: i=2; AJvYcCUOZ6YoOb0qnFt989QSIn32IgmpJAhOhpZ4Iakqz+IbJRt6PZm3Zlxn6UBEqZMNo+sMY6svsw==@nk.ca

X-Gm-Message-State: AOJu0YwmEaNFsUexBi/MN06a4MXtA794fsggztF9m1mq6DDtWjL7uotS

TquzhtcZ9+5QDUG0vfebcCybWMhjbxQxZSCZG459RJtIi4Z5E39jw3rHxGT4Ce8=

X-Google-Smtp-Source: AGHT+IHjuR3GB97t9DT3TrMkmDUHqG5ZINMfBWFLK/dktk1vw7iyFFNC/CvPFKrxpSmK++5zRoRSAA==

X-Received: by 2002:a05:6a00:2e97:b0:736:6ecd:8e39 with SMTP id d2e1a72fcca58-736becaf4famr1334515b3a.2.1741423349829;

Sat, 08 Mar 2025 00:42:29 -0800 (PST)

X-BeenThere: 7mar2@weballen.top; h=Adn5yVGmMe8v9crpDdVoNcNzym9KmrVDZtah+rHn4h/YIajkjA==

Received: by 2002:a05:6a00:8301:b0:725:e3f6:b149 with SMTP id

d2e1a72fcca58-736949bf7d4ls2500221b3a.1.-pod-prod-02-us; Sat, 08 Mar 2025

00:42:04 -0800 (PST)

X-Forwarded-Encrypted: i=2; AJvYcCUtEleTNZNn7wSQFdDvG9XWJizEca3SSPZelKvW1WjVvG5y57k2fxUJQPo9CQTqpwzZGaHvqQ==@weballen.top

X-Received: by 2002:a05:6a21:6d97:b0:1f3:269c:6706 with SMTP id adf61e73a8af0-1f544ad7016mr11261421637.8.1741423323738;

Sat, 08 Mar 2025 00:42:03 -0800 (PST)

ARC-Seal: i=1; a=rsa-sha256; t=1741423323; cv=none;

d=google.com; s=arc-20240605;

b=VsQzYMnSNknnP1b8dDwWf8ueg9JpL6ekRZlFvWSz9lSFMK9J+/Zscb4aZbecjXHoXQ

C4cdMQVjNhPrduWbEoJjWnZ25dnwBlj1Xakt+A1jKNMBGfRVrohWznMCNFnuB2/w4WlJ

Wt1L4+wCHWu3QRIT047ah6DzFC9KtbgGURQwKMvz3o4VoGMUcesj83gZI06Om1TI/NZT

u3kLg35/yB+0HAeOmWjOXT2S+0dbexPjqQXoYpIwziRkUb3M7mJGSdllfjLtX9TpTQnd

9P0zdCetyzzZvnSLfrmFokW0FD9jj5zE45x52XSnBynJWx/kmGbHMvNN6Cb5DdZQnRtT

yxlw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=piFFaIQEay2BzbsykAG16AdkOfPNOOdHxkhXJllVJC8=;

fh=vmS5w8pt5Jg8tHVjEpwJdIaEZrpTzhHFb79e0nZH4uQ=;

b=IGDS0+i3Ms/d7dahQuG38r5jr81yIR4C8uOFYlOXeJDfsf0h/YOvs4Ynf1DKZJoBF0

uT2nLUx1L90QlnloGECcuGIx+Y4m/zHgv3lIKZmx1TpeXXeLbJNgha9B0mOnMu4zEASq

Kd636YDauJtOKKgKQb7uNtricztxuGkXu1CwUHnReFzJ97W8y4d9PBhVeMslSj2iXG6r

kZy9yG2zXLFUQHhLH29kSNAKQ8+DzdZ+Nv+3azdysU3xQbhKshUSqikmQu9F9XjeNYws

qADgemeAVdAxM90HJVZMVVobLwoSTP/EQXlOu/8k47V+2uadCAXvFcrWYhzIxGiPMbvB

ZW+Q==;

dara=google.com

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20230601 header.b=WTyZGOB3;

spf=pass (google.com: domain of ginnamarkus968@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=ginnamarkus968@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=pass header.i=@weballen.top

Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])

by mx.google.com with SMTPS id 41be03b00d2f7-af281092afesor2460190a12.1.2025.03.08.00.42.03

for <7mar2@weballen.top>

(Google Transport Security);

Sat, 08 Mar 2025 00:42:03 -0800 (PST)

Received-SPF: pass (google.com: domain of ginnamarkus968@gmail.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;

X-Forwarded-Encrypted: i=1; AJvYcCX7cbQ6dQSZPvDsRr8HmEso5wWGQANf//JDJkrMH+5HqvuS4lM85IczbqozB4LSpLgGZVZenA==@weballen.top

X-Gm-Gg: ASbGncuveWlq9nuBKTldoUZFDInu/TE7gkozA4lNCVaznU6+hY9W2vmyVnnTLgSd9P6

4NC4PxMemIbh6IbijPsKtkLrSR6WKok4M7o0h8f/Zz48UjROmuByW00ZzUl7ZFmMFNKFi2zVoFQ

CQ2Gqe/qOzmh+mdrbNFI/15Y6oZd01Q9e+q9Nf+ZsM6ODes0L8cMG+6AGPlkgM

X-Received: by 2002:a17:90b:4c8f:b0:2fe:8902:9ecd with SMTP id

98e67ed59e1d1-2ff7ce61e9bmr9602281a91.1.1741423322988; Sat, 08 Mar 2025

00:42:02 -0800 (PST)

MIME-Version: 1.0

From: Gianna Markus

Date: Sat, 8 Mar 2025 14:11:51 +0530

X-Gm-Features: AQ5f1JoILtv3ajpkD_Y2Udr7uMZgA-JeXiMLXSB41BxVj_vDZmG-XPrdMS7RV08

Message-ID:

Subject: Custom software development...!!!

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000920adf062fd0b60b"

Bcc: 7mar2@weballen.top

X-Original-Sender: ginnamarkus968@gmail.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@gmail.com header.s=20230601 header.b=WTyZGOB3; spf=pass

(google.com: domain of ginnamarkus968@gmail.com designates 209.85.220.41 as

permitted sender) smtp.mailfrom=ginnamarkus968@gmail.com; dmarc=pass

(p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com; dara=pass header.i=@weballen.top

Precedence: list

Mailing-list: list 7mar2@weballen.top; contact 7mar2+owners@weballen.top

List-ID: <7mar2.weballen.top>

X-Spam-Checked-In-Group: 7mar2@weballen.top

X-Google-Group-Id: 332912648134

List-Post: ,

List-Help: ,



List-Archive:

List-Unsubscribe: ,



X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Do you need help with your ongoing or any new Project

in the following? *Followed are our key services*-



Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

[209.85.216.80 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.80 listed in dnsbl.ahbl.org]

[209.85.216.80 listed in dnsbl.ahbl.org]

[209.85.216.80 listed in dnsbl.ahbl.org]

[209.85.216.80 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.80 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.80 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.80 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.80 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.80 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.80 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ginnamarkus968(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 FROM_SUSPICIOUS_NTLD From abused NTLD

Subject: {SPAM?} Custom software development...!!!



--000000000000920adf062fd0b60b

Content-Type: text/plain; charset="UTF-8"



Hello,



Do you need help with your ongoing or any new Project in the following?



Followed are our key services*-



 Mobile app development (iOS and Android)







 Custom software development*



Let me know if you need help with the above services and would be happy to

discuss over a no-obligation consultation on how you may plan your project

and how we may help.



Look forward to your reply.



Thanks & Regards

Gianna



--000000000000920adf062fd0b60b

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




t;font-family:"Times New Roman","serif"">
"font-size:11pt;font-family:Calibri,"sans-serif"">Hello,=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=

=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=

=C2=A0
erif"">


5pt;background-size:initial;font-size:12pt;font-family:"Times New Roma=

n","serif"">
yle=3D"font-size:11pt;font-family:Calibri,"sans-serif";color:blac=

k">Do you need help with your ongoing or any new Project in the following?<=

/span>
erif"">


5pt;background-size:initial;font-size:12pt;font-family:"Times New Roma=

n","serif"">
style=3D"font-size:11pt;font-family:Calibri,"sans-serif";color:b=

lack">Followed are our key services
ze:11pt;font-family:Calibri,"sans-serif";color:black">-
an style=3D"font-size:10pt;font-family:Verdana,"sans-serif"">
an>


:0cm;margin-left:0cm;font-size:12pt;font-family:"Times New Roman"=

,"serif"">
=3D"font-size:11pt;font-family:Calibri,"sans-serif";color:black">=

=C2=A0=C2=A0=C2=A0=C2=A0 Mobile app development (iOS and Android)
>
quot;">


ackground-size:initial;font-size:12pt;font-family:"Times New Roman&quo=

t;,"serif"">
e=3D"font-size:11pt;font-family:Calibri,"sans-serif";color:black"=

>=C2=A0=C2=A0=C2=A0 =C2=A0Custom software development


pan>
;">


round-size:initial;font-size:12pt;font-family:"Times New Roman",&=

quot;serif"">
nt-size:11pt;font-family:Calibri,"sans-serif";color:black">Let me=

know if you need help with the above services and would be happy to discus=

s over a no-obligation consultation on how you may plan your project and ho=

w we may help.=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=

=C2=A0=C2=A0=C2=A0
erdana,"sans-serif"">


pt;line-height:11.75pt;background-size:initial;font-size:12pt;font-family:&=

quot;Times New Roman","serif"">
e:initial">
if";color:black">Look forward to your reply.
=3D"font-size:10pt;font-family:Verdana,"sans-serif"">

<=

p style=3D"margin-right:0cm;margin-left:0cm">
rif">Thanks & Regards
t>
"font-size:13.3333px">

"sans-serif";font-size:11pt">Gianna





--000000000000920adf062fd0b60b--

Fedex phish from Google Cloud

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 08 Mar 2025 06:31:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tquGX-00000000FnT-0Msp

for dave@doctor.nl2k.ab.ca;

Sat, 08 Mar 2025 06:30:57 -0700

Resent-From: The Doctor

Resent-Date: Sat, 8 Mar 2025 06:30:57 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 83.251.106.34.bc.googleusercontent.com ([34.106.251.83]:38162 helo=localhost)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqosf-00000000Mgr-3xHX

for doctor@nk.ca;

Sat, 08 Mar 2025 00:46:04 -0700

Received: by localhost (Postfix, from userid 0)

id 471FC224AAC; Sat, 8 Mar 2025 07:43:57 +0000 (UTC)

To: doctor@nk.ca

From: noreply@FedEx.com

Subject: FedEx Delivery Waiting

MIME-Version: 1.0

Content-Type: text/html

Message-Id: <20250308074357.471FC224AAC@localhost>

Date: Sat, 8 Mar 2025 07:43:57 +0000 (UTC)

X-Spam_score: 15.6

X-Spam_score_int: 156

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: International Priority® FedEx informs you that your shipment

169###340 is still waiting for instructions from you.



Content analysis details: (15.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.106.251.83 listed in will-spam-for-food.eu.org]

[34.106.251.83 listed in will-spam-for-food.eu.org]

[34.106.251.83 listed in will-spam-for-food.eu.org]

[34.106.251.83 listed in will-spam-for-food.eu.org]

[34.106.251.83 listed in will-spam-for-food.eu.org]

[34.106.251.83 listed in will-spam-for-food.eu.org]

[34.106.251.83 listed in will-spam-for-food.eu.org]

[34.106.251.83 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.106.251.83 listed in dnsbl.ahbl.org]

[34.106.251.83 listed in dnsbl.ahbl.org]

[34.106.251.83 listed in dnsbl.ahbl.org]

[34.106.251.83 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.106.251.83 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.106.251.83 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.106.251.83 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.106.251.83 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[34.106.251.83 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[34.106.251.83 listed in sbl-xbl.spamhaus.org]

0.0 TVD_RCVD_IP Message was received from an IP address

3.6 HELO_LOCALHOST No description available.

0.0 FSL_HELO_NON_FQDN_1 No description available.

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 DYN_RDNS_SHORT_HELO_HTML Sent by dynamic rDNS, short HELO, and HTML

Subject: {SPAM?} FedEx Delivery Waiting

























International Priority®




FedEx informs you that your shipment 169###340 is still waiting for instructions from you.



Delivery option : International Priority®

Fees to pay :  79 USD.








This link will expire in 24 hours.






© 2025 FedEx Inc. All rights reserved.

this email was sent automatically please do not reply.


 












nk.ca credential phising from hostzealot.com

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 10:50:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqbpa-00000000FXw-1ZDv

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 10:49:54 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 10:49:54 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [79.141.162.46] (port=51204 helo=mail0.henutepsa.ooguy.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqaSn-00000000O5r-3WOw

for doctor@nl2k.ab.ca;

Fri, 07 Mar 2025 09:22:22 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=henutepsa.ooguy.com;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:

Content-Transfer-Encoding; i=info@henutepsa.ooguy.com;

bh=AkRPadb3WTz274LGfbsKqLvqBd2gBUOZBQzNpyE9Ic8=;

b=GjjZe97C2QJLR6afWV6IgIrMF3Ll1CXTo/Q2nvGOOVumAxrcWyDIUJ8BOa2495otRhxkit+nUtIO

NoxkzFqtb3gdcolSFzRpY2WjtJHGEeGC3F2kUavTTSccl883dzdOmsMibxkurhypTG3jogx0/LJC

Ofk90QI+J3NY6GiI1Dg=

From: " nl2k.ab.ca "< info@henutepsa.ooguy.com>

To: doctor@nl2k.ab.ca

Subject: =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=

Date: 7 Mar 2025 08:20:21 -0800

Message-ID: <20250307082021.24E36A420FD4ECAD@henutepsa.ooguy.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.4

X-Spam_score_int: 134

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Password Expiration Notice Password Expiration Alert



Content analysis details: (13.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 FROMSPACE Idiosyncratic "From" header format

2.7 FROM_WSP_LEAD Leading whitespace after '<' in From header field

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 FROM_MISSPACED From: missing whitespace

Subject: {SPAM?} =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=














=3D1.0">

Password Expiration Notice






background-color: #f4f4f4;

margin: 0;

padding: 0;

color: #333333">


margin: 40px auto;

background-color: #ffffff;

padding: 40px;

border-radius: 8px;

box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1)" class=3D"email-conta=

iner">


color: #2c3e50;

margin-bottom: 20px;

text-align: center;

border-bottom: 2px solid #3498db;

padding-bottom: 10px">Password Expiration Alert




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Dear doctor,




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">We are writing to inform you that your current =

password for the mailbox doctor@nl2k.ab.ca has expired.
p>


border-left: 4px solid #3498db;

padding: 15px;

margin-bottom: 20px" class=3D"highlight">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; color: #e74c3c;

font-weight: bold" class=3D"warning-text">Important: Failure to=

update your password will result in temporary loss of access to your =

mailbox. We strongly recommend taking action promptly to avoid any interrup=

tions to your service.






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">However, it is advised to continue using y=

our current password. To continue using current password, please click the =

button below:






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Thank you for your prompt attention to this mat=

ter.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Best regards,
The nl2k.ab.ca Team






color: #7f8c8d;

text-align: center;

margin-top: 40px;

padding-top: 20px;

border-top: 1px solid #ecf0f1" class=3D"footer">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">© 2025 nl2k.ab.ca. All righ=

ts reserved.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">Privacy Policy=

| Terms of Service | Contact Support
p>





nk.ca credential phising from hostzealot.com

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 07 Mar 2025 10:50:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqbpW-00000000FXh-33AP

for dave@doctor.nl2k.ab.ca;

Fri, 07 Mar 2025 10:49:50 -0700

Resent-From: The Doctor

Resent-Date: Fri, 7 Mar 2025 10:49:50 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [79.141.162.46] (port=59309 helo=mail0.henutepsa.ooguy.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.1 (FreeBSD))

(envelope-from )

id 1tqaSx-00000000O5p-2d3a

for doctor@nk.ca;

Fri, 07 Mar 2025 09:22:31 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=henutepsa.ooguy.com;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:

Content-Transfer-Encoding; i=info@henutepsa.ooguy.com;

bh=ME/ig4A1LB96hSEahz3HXwCUgOt1PegSWj+TCwm3YLA=;

b=Q1+DGJY1ZMsYB6dCTiKMXFwJ2fPVV/+r54nMEvQk1apnOKBEPfkn7p9t2QVIOsqKeZ9ZbJxnHKCQ

fPTs2hNRlOrSgb3s9AyrVtlTXuCPpaq5DtTtnC15SuGls4ONQvgXgJavT9T72WL6cokcjpUyXpFs

F46TKBne0/jdtapCMJU=

From: " nk.ca "< info@henutepsa.ooguy.com>

To: doctor@nk.ca

Subject: =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=

Date: 7 Mar 2025 08:20:21 -0800

Message-ID: <20250307082021.F002D008A2E9DB2B@henutepsa.ooguy.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.4

X-Spam_score_int: 134

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Password Expiration Notice Password Expiration Alert



Content analysis details: (13.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

[79.141.162.46 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

[79.141.162.46 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[79.141.162.46 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 FROMSPACE Idiosyncratic "From" header format

2.7 FROM_WSP_LEAD Leading whitespace after '<' in From header field

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FROM_MISSPACED From: missing whitespace

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} =?UTF-8?B?VXJnZW50OiBZb3VyIEVtYWlsIFBhc3N3b3JkIEhhcyBFeHBpcmVkIOKAkyBUYWtlIEFjdGlvbiBUb2RheQ==?=














=3D1.0">

Password Expiration Notice






background-color: #f4f4f4;

margin: 0;

padding: 0;

color: #333333">


margin: 40px auto;

background-color: #ffffff;

padding: 40px;

border-radius: 8px;

box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1)" class=3D"email-conta=

iner">


color: #2c3e50;

margin-bottom: 20px;

text-align: center;

border-bottom: 2px solid #3498db;

padding-bottom: 10px">Password Expiration Alert




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Dear doctor,




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">We are writing to inform you that your current =

password for the mailbox doctor@nk.ca has expired.




border-left: 4px solid #3498db;

padding: 15px;

margin-bottom: 20px" class=3D"highlight">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; color: #e74c3c;

font-weight: bold" class=3D"warning-text">Important: Failure to=

update your password will result in temporary loss of access to your =

mailbox. We strongly recommend taking action promptly to avoid any interrup=

tions to your service.






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">However, it is advised to continue using y=

our current password. To continue using current password, please click the =

button below:






line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Thank you for your prompt attention to this mat=

ter.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e">Best regards,
The nk.ca Team






color: #7f8c8d;

text-align: center;

margin-top: 40px;

padding-top: 20px;

border-top: 1px solid #ecf0f1" class=3D"footer">


line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">© 2025 nk.ca. All rights re=

served.




line-height: 1.6;

margin-bottom: 20px;

color: #34495e; margin: 5px 0">Privacy Policy=

| Terms of Service | Contact Support
p>