Nigerian spam from Google Gmail part 4

Posted by Dave Yadallee on

v>

font-size:small;font-style:normal;font-weight:400;letter-spacing:normal;tex=

t-align:start;text-indent:0px;text-transform:none;white-space:normal;word-s=

pacing:0px;background-color:rgb(255,255,255)">
<=

/font>

ans-serif;font-size:small;font-style:normal;font-weight:400;letter-spacing:=

normal;text-align:start;text-indent:0px;text-transform:none;white-space:nor=

mal;word-spacing:0px;background-color:rgb(255,255,255)">
222">He could be reached at: E-mail:=C2=A0
r@gmail.com" style=3D"color:rgb(17,85,204)" target=3D"_blank">robertanderso=

nmr@gmail.com

:Arial,Helvetica,sans-serif;font-size:small;font-style:normal;font-weight:4=

00;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:no=

ne;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255)"><=

font color=3D"#222222">

ont-family:Arial,Helvetica,sans-serif;font-size:small;font-style:normal;fon=

t-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-tr=

ansform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,2=

55,255)">NOTE: Do not be shy to indicate the amount=

you have in hands (no proper-amount is so small to trigger installments-pa=

yment base on our discussion with the Bank) so that the first payment will =

move to your account for you to confirm the existence of the fund before yo=

ur proceed for the balance.

ont-family:Arial,Helvetica,sans-serif;font-size:small;font-style:normal;fon=

t-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-tr=

ansform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,2=

55,255)">

4,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-style:=

normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0=

px;text-transform:none;white-space:normal;word-spacing:0px;background-color=

:rgb(255,255,255)">All communications consign This =

your trust fund should be on Email and SMS only for record purpose Anticipa=

ting your immediate and prompt response. Banking with Federal Reserve Bank-=

USA certainly opens several doors for you. Thank you for banking with us.
font>

ns-serif;font-size:small;font-style:normal;font-weight:400;letter-spacing:n=

ormal;text-align:start;text-indent:0px;text-transform:none;white-space:norm=

al;word-spacing:0px;background-color:rgb(255,255,255)">
22">

lvetica,sans-serif;font-size:small;font-style:normal;font-weight:400;letter=

-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-=

space:normal;word-spacing:0px;background-color:rgb(255,255,255)">
r=3D"#222222">we looking forward to your positive cooperation fairly soon. =

to enable us give you.

amily:Arial,Helvetica,sans-serif;font-size:small;font-style:normal;font-wei=

ght:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transfo=

rm:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,25=

5)">

34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-style:norma=

l;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;te=

xt-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(=

255,255,255)">Thanks

r:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font=

-style:normal;font-weight:400;letter-spacing:normal;text-align:start;text-i=

ndent:0px;text-transform:none;white-space:normal;word-spacing:0px;backgroun=

d-color:rgb(255,255,255)">President and Chief Execu=

tive Officer

l,Helvetica,sans-serif;font-size:small;font-style:normal;font-weight:400;le=

tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=

ite-space:normal;word-spacing:0px;background-color:rgb(255,255,255)">
color=3D"#222222">Federal Reserve Bank of New York.

>



--00000000000047d1ef064980289d--

Nigerian spam from Google Gmail Part 2

Posted by Dave Yadallee on
--00000000000047d1ef064980289d

Content-Type: text/plain; charset="UTF-8"



Federal Reserve Bank-USA

Address: 33 Liberty Street, New York, NY USA.





Dear Beneficiary,



We write in regards to your delayed Contract/Inheritance Funds in the sum

of ( $11,000,000.00 USD Eleven Million United States Dollars ) which you

are yet to receive as a result of your inability to raise the required

fee(s) to conclude your Transaction. The United Nations has decided to

proffer a solution that will make it easier for all the Beneficiaries to

receive their Funds. We understood that some Fees are required in order

process and Transfer your Funds into your Account. We are also aware that

most Beneficiaries do not have these required fees.



We have therefore deliberated with the Bank in charge of this payment to

allow Beneficiaries the privilege of receiving their Funds in two (2) or

three (3) installments. In this case, Beneficiaries will no longer be

required to pay the fee at once but part of it depending on the number of

installments such Beneficiary will like his/her Funds to be released to

him/her.



Write the Bank and request that you want your fund to be transferred to

your account by installments payment, so that once the first payments

enters into your account you can then use money from there to facilitate

the transfer of the remaining balance, once the first installments enters

into your account withdrawal from your account to Federal Reserve Bank of

New York Online transfer procedure.



The Federal Reserve Bank which is now in charge of your Payment has agreed

to give the Beneficiaries the option of receiving their Funds at once, in

two or three installments. Therefore, you should send him your full Name

and telephone number/your correct mailing address. This will help the

beneficiaries to pay part of the fee and receive part of their Funds with

which such beneficiary can upset the remaining fee and receive his/her

complete Funds.



To break this down: ($25) fee will facilitate the release of One Million

United States Dollars (US$1,000,000.00) only. ($100) fee will facilitate

the release of Two Million United States Dollars (US$2,000,000.00) only.

($250) fee which is the total fee will facilitate the release of your Full

Contract/inheritance Funds in the sum of ( $11,000,000.00 USD Eleven

Million United States Dollars). However, Feel free to inform us how much

you can raise should you cannot afford any of the above-Mentioned

installment so as for us to talk to the Bank to know how much out of your

Funds they could release to you with the amount you can come up with.



Just go ahead an buy Gift card iTunes Gift Card or Steam Wallet Card today

then scratch the cards scan and send me the copies here, that is if you

can't be able to send the money through WU or MG. So make it fast so that

your Transfer your Funds into your Account. to you within 24hours without

any more delaying.



This is the best the United Nations can do for you and you are advised to

take advantage of this opportunity. Kindly, contact Mr.Robert Anderson. at

the Federal Reserve Bank of New York. to indicate your preferred option.



He could be reached at: E-mail: robertandersonmr@gmail.com



NOTE: Do not be shy to indicate the amount you have in hands (no

proper-amount is so small to trigger installments-payment base on our

discussion with the Bank) so that the first payment will move to your

account for you to confirm the existence of the fund before your proceed

for the balance.



All communications consign This your trust fund should be on Email and SMS

only for record purpose Anticipating your immediate and prompt response.

Banking with Federal Reserve Bank-USA certainly opens several doors for

you. Thank you for banking with us.



we looking forward to your positive cooperation fairly soon. to enable us

give you.



Thanks

President and Chief Executive Officer

Federal Reserve Bank of New York.



--00000000000047d1ef064980289d

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv style=3D"color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font=

-size:small;font-style:normal;font-weight:400;letter-spacing:normal;text-al=

ign:start;text-indent:0px;text-transform:none;white-space:normal;word-spaci=

ng:0px;background-color:rgb(255,255,255)">Federal R=

eserve Bank-USA

rial,Helvetica,sans-serif;font-size:small;font-style:normal;font-weight:400=

;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none=

;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255)">
nt color=3D"#222222">Address: 33 Liberty Street, New York, NY USA.
div>

f;font-size:small;font-style:normal;font-weight:400;letter-spacing:normal;t=

ext-align:start;text-indent:0px;text-transform:none;white-space:normal;word=

-spacing:0px;background-color:rgb(255,255,255)">

or:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;fon=

t-style:normal;font-weight:400;letter-spacing:normal;text-align:start;text-=

indent:0px;text-transform:none;white-space:normal;word-spacing:0px;backgrou=

nd-color:rgb(255,255,255)">

yle=3D"color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size=

:small;font-style:normal;font-weight:400;letter-spacing:normal;text-align:s=

tart;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0p=

x;background-color:rgb(255,255,255)">Dear Beneficia=

ry,

ca,sans-serif;font-size:small;font-style:normal;font-weight:400;letter-spac=

ing:normal;text-align:start;text-indent:0px;text-transform:none;white-space=

:normal;word-spacing:0px;background-color:rgb(255,255,255)">
#222222">

al,Helvetica,sans-serif;font-size:small;font-style:normal;font-weight:400;l=

etter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;w=

hite-space:normal;word-spacing:0px;background-color:rgb(255,255,255)">
color=3D"#222222">We write in regards to your delayed Contract/Inheritance=

Funds in the sum of ( $11,000,000.00 USD Eleven Million United States Doll=

ars ) which you are yet to receive as a result of your inability to raise t=

he required fee(s) to conclude your Transaction. The United Nations has dec=

ided to proffer a solution that will make it easier for all the Beneficiari=

es to receive their Funds. We understood that some Fees are required in ord=

er process and Transfer your Funds into your Account. We are also aware tha=

t most Beneficiaries do not have these required fees.

e=3D"color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:s=

mall;font-style:normal;font-weight:400;letter-spacing:normal;text-align:sta=

rt;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;=

background-color:rgb(255,255,255)">

>

ont-size:small;font-style:normal;font-weight:400;letter-spacing:normal;text=

-align:start;text-indent:0px;text-transform:none;white-space:normal;word-sp=

acing:0px;background-color:rgb(255,255,255)">We hav=

e therefore deliberated with the Bank in charge of this payment to allow Be=

neficiaries the privilege of receiving their Funds in two (2) or three (3) =

installments. In this case, Beneficiaries will no longer be required to pay=

Nigerian spam from Google Gmail Part 3

Posted by Dave Yadallee on
the fee at once but part of it depending on the number of installments suc=

h Beneficiary will like his/her Funds to be released to him/her.
v>

font-size:small;font-style:normal;font-weight:400;letter-spacing:normal;tex=

t-align:start;text-indent:0px;text-transform:none;white-space:normal;word-s=

pacing:0px;background-color:rgb(255,255,255)">
<=

/font>

ans-serif;font-size:small;font-style:normal;font-weight:400;letter-spacing:=

normal;text-align:start;text-indent:0px;text-transform:none;white-space:nor=

mal;word-spacing:0px;background-color:rgb(255,255,255)">
222">Write the Bank and request that you want your fund to be transferred t=

o your account by installments payment, so that once the first payments ent=

ers into your account you can then use money from there to facilitate the t=

ransfer of the remaining balance, once the first installments enters into y=

our account withdrawal from your account to Federal Reserve Bank of New Yor=

k Online transfer procedure.

font-family:Arial,Helvetica,sans-serif;font-size:small;font-style:normal;fo=

nt-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-t=

ransform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,=

255,255)">

34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-style=

:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:=

0px;text-transform:none;white-space:normal;word-spacing:0px;background-colo=

r:rgb(255,255,255)">The Federal Reserve Bank which =

is now in charge of your Payment has agreed to give the Beneficiaries the o=

ption of receiving their Funds at once, in two or three installments. There=

fore, you should send him your full Name and telephone number/your correct =

mailing address. This will help the beneficiaries to pay part of the fee an=

d receive part of their Funds with which such beneficiary can upset the rem=

aining fee and receive his/her complete Funds.

lor:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;fo=

nt-style:normal;font-weight:400;letter-spacing:normal;text-align:start;text=

-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;backgro=

und-color:rgb(255,255,255)">

tyle=3D"color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-siz=

e:small;font-style:normal;font-weight:400;letter-spacing:normal;text-align:=

start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0=

px;background-color:rgb(255,255,255)">To break this=

down: ($25) fee will facilitate the release of One Million United States D=

ollars (US$1,000,000.00) only. ($100) fee will facilitate the release of Tw=

o Million United States Dollars (US$2,000,000.00) only. ($250) fee which is=

the total fee will facilitate the release of your Full Contract/inheritanc=

e Funds in the sum of ( $11,000,000.00 USD Eleven Million United States Dol=

lars). However, Feel free to inform us how much you can raise should you ca=

nnot afford any of the above-Mentioned installment so as for us to talk to =

the Bank to know how much out of your Funds they could release to you with =

the amount you can come up with.

34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-style:norma=

l;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;te=

xt-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(=

255,255,255)">

rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-s=

tyle:normal;font-weight:400;letter-spacing:normal;text-align:start;text-ind=

ent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-=

color:rgb(255,255,255)">Just go ahead an buy Gift c=

ard iTunes Gift Card or Steam Wallet Card today then scratch the cards scan=

and send me the copies here, that is if you can't be able to send the =

money through WU or MG. So make it fast so that your Transfer your Funds in=

to your Account. to you within 24hours without any more delaying.
iv>

;font-size:small;font-style:normal;font-weight:400;letter-spacing:normal;te=

xt-align:start;text-indent:0px;text-transform:none;white-space:normal;word-=

spacing:0px;background-color:rgb(255,255,255)">
=


sans-serif;font-size:small;font-style:normal;font-weight:400;letter-spacing=

:normal;text-align:start;text-indent:0px;text-transform:none;white-space:no=

rmal;word-spacing:0px;background-color:rgb(255,255,255)">
2222">This is the best the United Nations can do for you and you are advise=

d to take advantage of this opportunity. Kindly, contact
=3D"#222222">Mr.Robert Anderson. at the Fede=

ral Reserve Bank of New York. to indicate your preferred option.

Nigerian spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 29 Jan 2026 04:28:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vlQBV-00000000GHh-0smw

for dave@doctor.nl2k.ab.ca;

Thu, 29 Jan 2026 04:27:37 -0700

Resent-From: The Doctor

Resent-Date: Thu, 29 Jan 2026 04:27:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f173.google.com ([209.85.128.173]:45241)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vlKcw-00000000Ctj-3uGk

for doctor@doctor.nl2k.ab.ca;

Wed, 28 Jan 2026 22:31:48 -0700

Received: by mail-yw1-f173.google.com with SMTP id 00721157ae682-79492a2a57bso3749007b3.2

for ; Wed, 28 Jan 2026 21:30:47 -0800 (PST)

ARC-Seal: i=1; a=rsa-sha256; t=1769664641; cv=none;

d=google.com; s=arc-20240605;

b=fRPI8oYw3FzS0AGdLpDeuP1F6bloZrFuoc9HCoKtdTwKjZUiTekoz11gLnqCFuBbF7

dByDDswYPkGSoDdNzDZhVh9q1C8UvEVHCZ6NpUNgfYIqJKYDMn/u9tX+JmZxAZjBobUk

moejkhN6yjE6i2XQQ8StdNlWR3uWEJenElCXQTfPCSsndRG2WqL8+Vc273gnVnr7Tzox

54yAW4ja+CICR5ogSAld2Ue21D91jgDqZi+dU6SMZ1Slg809RaCufZKwAUH5fohh7Mzn

WnlFcPa9Q1CjaH/eBFw5/oTRm14XMPC4ysSqyd6QERIyhVdbmNPTBvyE437ZnWB+g5El

fKzQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=hXFmrtKmE+1xB2tCCkZs4uQLRGAZYfMf4Nd6D8e4AN8=;

fh=KtqdaEGiwTrR0+Q7LLR92F9I6LUWj3WMGbxs7iIg+UE=;

b=kDdY9zOlQ2lBsgDhCG9zakh5khJiPdXQdF8yCjhK662U0VgsKtJKAzy1wBQtsoW0mT

xASiWt74XdriioCjdXcrGJJaBRDlek3yZ3HygxjAklrzOnCGXkbffKdbE16V5zVm9NEp

xi4K+QJQAkbmYkfiPXKVYep8NWap9cgYMJw0KalFr+IxHRfPLXu2trttxLvhSCdtIQnj

K1GIzT0gBYDNpCh+i8vNJbzksccVyA55P0qBaQr3h39KDfuPwlPzM4+FsEjRWLESECMN

ckwU6uySG4+gpJk4ZWlHEWSAnIRuIUijK/n2m5pBv7Q2UeLm2BhtCqbHov2CduXGB86M

L5kw==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1769664641; x=1770269441; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=hXFmrtKmE+1xB2tCCkZs4uQLRGAZYfMf4Nd6D8e4AN8=;

b=WXiKchRP5v9rNJM4gjGr78tmFxHiUCYmeV5DtsrBQNWi5uetdQ8udcRbW0yHxliXNc

8HnjnUKMQRexqxgRe9foG4iguP8KPahoRPnvR0FCd8mnakFMlEGpkAamVr4QVSoJmp13

GcTR0O/+2rsRN5ZPm/gjKboFx8D4p3lKzstMv+cdiKszNLdoUhL4zXvMKXBTmOmwY+wM

6nwppSpTf0Jd9Cj6hsjLXR+tR6sHpcNzrg2ZtjIB5vCV8OV+tQ7+jYce0BPdwZUKRLrS

JDPTaQCVNvh7cUHNDnCrERDxc7MLXmeTuQqfawNxw8FHOagxuDROkhewGfXUMvRQ00cD

EBkA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1769664641; x=1770269441;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=hXFmrtKmE+1xB2tCCkZs4uQLRGAZYfMf4Nd6D8e4AN8=;

b=L+XK1aYO8mYdukEpUL0HzdclDHvw+hdk+AIx7lPKN/Io2dgqdoTClsUJU8Y8Vo0VNp

fchCI7nv+aO2p3wnQ4WMAFxh/OJC8dqdPhjGHXkFEn/Gl0m6gq8kZK2xNaWFx+CspUNL

KWhVewM1sEZ/dwiHr384AlCWLYhhXGqSiCQzrgYtqmWfoqhK70cdIsMCQ42k7NACw+KV

aWHs0AVqS5QV6SXdsQHDufL2dVPCabu0r1g83i9FTaAtMMfuYY5QboeCN6bazXkwiorG

X3rgHqPYMt/vZI5Gu0Ewcctck0G25miISncx/xqpG8HHSgxB1+oSL3JsUrRxdLmNsxrn

nlwg==

X-Forwarded-Encrypted: i=1; AJvYcCV+e7f53Vhuat14upWudfrbexTuG7ItgJNQLrcBpeOXa3WclTy0PMgIjKJscgSInGE8m3pD+GM=@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YxqFCpFJVMsvfv/Awig4T8mRUeJI3E9uLvNfXTMKF+HvJEHo3DE

heahNCl+o5vZL0H1CLC2IyS9Qa7i2DuQbnGjZSrpcjkHefaCnq3ygnW3AInLRlodbIreW2xmpPL

tZLpbgA5aDrEpvBxzBWBlFHZrZGaolrE=

X-Gm-Gg: AZuq6aJZh7op6sUwvLidU7Adg3cf6lSDvyCwWG8wg6zT1Q0jA4r/wbqlByMXR5ibZ7k

oBQz7Q0eFWS0LOROUbSI7/AEDA/gMlYjXHl6u1Btbkp+7Dn5wqAw1/4iPFXJws0ijrwyFtq+Ygn

IxhrNVW+cdUyc4XW7li8caRqGMJJAmg8DKRecm8Tis7SSG126AsGQePbj1yzdlvw/stp55fevcL

+BgwGdJVyJWDzmPWsDXbrz34U8N9UwJwK1uouwSDsYoff8w8i6CtlCDKeoCRH1b/c9bBsO/BvmJ

ch3b/7XxW+7xXI1ap0K6qIk68b+trGTiDOJ1YXTijoHURBoUUNSv5w8cMSKfLMys0l1ydkj50Io

R28kKziaM+WMtfVq3VA==

X-Received: by 2002:a05:690c:ed3:b0:794:84ee:9aa5 with SMTP id

00721157ae682-79484eeacf4mr38846117b3.47.1769664640699; Wed, 28 Jan 2026

21:30:40 -0800 (PST)

MIME-Version: 1.0

Reply-To: robertandersonmr@gmail.com

From: Federal Reserve

Date: Thu, 29 Jan 2026 05:32:27 +0000

X-Gm-Features: AZwV_Qh5e8IluMwYP-rw--UmC48zuz2Os_ed2lVJaQNN39Mcuf8PdSm_FHiL_uA

Message-ID:

Subject: Dear Beneficiary,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000047d1ef064980289d"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 29.0

X-Spam_score_int: 290

X-Spam_bar: +++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Federal Reserve Bank-USA Address: 33 Liberty Street, New York,

NY USA. Dear Beneficiary, We write in regards to your delayed Contract/Inheritance

Funds in the sum of ( $11,000,000.00 USD Eleven Million United States Dollars

) which you are yet to receive as a result of your inability to r [...]



Content analysis details: (29.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.173 listed in will-spam-for-food.eu.org]

[209.85.128.173 listed in will-spam-for-food.eu.org]

[209.85.128.173 listed in will-spam-for-food.eu.org]

[209.85.128.173 listed in will-spam-for-food.eu.org]

[209.85.128.173 listed in will-spam-for-food.eu.org]

[209.85.128.173 listed in will-spam-for-food.eu.org]

[209.85.128.173 listed in will-spam-for-food.eu.org]

[209.85.128.173 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.173 listed in dnsbl.ahbl.org]

[209.85.128.173 listed in dnsbl.ahbl.org]

[209.85.128.173 listed in dnsbl.ahbl.org]

[209.85.128.173 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.173 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.173 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.173 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.173 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.173 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.128.173 listed in sa-trusted.bondedsender.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.128.173 listed in sa-accredit.habeas.com]

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.173 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.173 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.128.173 listed in bl.score.senderscore.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[lilysmorg1414(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[lilysmorg1414(at)gmail.com]

2.5 MILLION_USD BODY: Talks about millions of dollars

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

3.6 NA_DOLLARS BODY: Talks about a million North American dollars

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.0 TVD_PH_BODY_META No description available.

1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to

3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

Subject: {SPAM?} Dear Beneficiary,

Investment spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 29 Jan 2026 04:27:04 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vlQAK-00000000GBb-198B

for dave@doctor.nl2k.ab.ca;

Thu, 29 Jan 2026 04:26:24 -0700

Resent-From: The Doctor

Resent-Date: Thu, 29 Jan 2026 04:26:24 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f68.google.com ([209.85.210.68]:46169)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vlHZy-00000000MKL-2NOj

for sales@nk.ca;

Wed, 28 Jan 2026 19:16:33 -0700

Received: by mail-ot1-f68.google.com with SMTP id 46e09a7af769-7cfccba483eso176593a34.0

for ; Wed, 28 Jan 2026 18:15:31 -0800 (PST)

ARC-Seal: i=1; a=rsa-sha256; t=1769652925; cv=none;

d=google.com; s=arc-20240605;

b=BHktfPi5kpRyAyov7msB9MGWbwQeqvtk3AivJmcD2JTmZEXOdnw6bKBZPW8rhyAy3I

tw0z81GgXzRLMIkCLY8WYJ0fTQTiBS2rwTVq4pkBCsxNrL8CLx/EwWJs8PuslRnY4qhG

zK/DP690/C7gAEg8ELwmrAjUH1NkcN6iZEfBbDFmMxSduP8uSlGo+rFyKaCQCNdMiKhD

7RsNJkvu5mMssOOP59DNwo4oIAEHqf1AQvtrgInUC1PR1t31l0OOfa+eeHhQPYA3ftze

5z1AxYzn40HLT7jVAabs4fdq+q/1w0sHBwSeQsEN5RiILejow+b8Dl23kZfaXL/9diwT

GSoQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=Y+kOx7/23d1ChM6tZunPmarKYfpqfqXWkv1cW9anraU=;

fh=jI+eMTgn8taZ6NmrZHPMIfVN7NAsYxbX4HPlYtb0TH0=;

b=LneTQjG9ZggZ3cJHbIZ1z0ehPjJGkPT4At8Yfd/j2Nz5NbcrfB8eojm/B3hlq3ur3Z

JpqpLetQp54dYXrdCvg9ROLMgesaXIEIyEXIlT1Wh+Kamlcin+gPDt8nEVdTGPOVyLE9

aQmJDlDcLUweVuQecgSWwyCgMWbrcMKMe70l5QJWHei9pNau03DEd6+o6GbLO+DX+bFf

OHI12mS+QQ+aQQ9ZuxiXPnESOw+T1Ii1W7hgxCJSq4yFbXluu8ZHfB8FFsBxyGcWQQuR

1EzQHovoskk4uTV2pLiQOTFBWN97Xh492QIShuVo/ior0T26tYH7EbbKWexinM0cz2/c

3+RA==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1769652925; x=1770257725; darn=nk.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=Y+kOx7/23d1ChM6tZunPmarKYfpqfqXWkv1cW9anraU=;

b=j8EJ6q4yvoNbHjr92lnuppuBW/LBzWkb+SNYX0ImBBFpuuBGakhBsUU/MUBgttarit

CfQeBDfh5bFKSnjz7TejtXzfraTXAi5ZuaX5zmIZEhs4/m5h4apUV/QE6YXVL27pYYh6

3s0uP1HQs2YiQZB8PW5DmqG/KSQDWD+5WfLpzq0hPZh/9mVJLKhutFHcs+CyrIx/19Yt

maDLS0AWqumUW8AbGxl6OkyBbqF3GUInfGAG4QP1ao021e72iO4Hpm+opF6WuV1wpaR9

Nr4eFV3YEj3Rv621qQu0SYOx/+0FciGJietGXy34HGlxn+8iNIbvnjcf6iqtW2ksxU9M

kkLQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1769652925; x=1770257725;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Y+kOx7/23d1ChM6tZunPmarKYfpqfqXWkv1cW9anraU=;

b=osAz7K99rT6jxAf0rwzykjFX5wVb3zvw847uGPcCVnL0QEmQUEL68XwSumKFKUzRJt

8PDCjs6VrLaWy5wwonLwIp7yagXrvYSACadA30dtAaK4fUsMwiqdWDyXYARdCxcGgf5I

b/K68nnlNarFOpSkAu4VOPwDiRFUm3HePT3MKfoPLsCbjOTqcRsMGdtUkF12zgxHH7Av

9bRTtwyh0UqsO3j6LCOVfwyd2eLJZ0duBix5ZNbSJzZzLhAhdIAnzhXTvDjv2SBEuPdx

iTkGli177OWWc4T2qpObDx6MprnEiz+dvjI1libfDeda+erAZnf/ygMIZv60h5R3GXeT

vY8g==

X-Forwarded-Encrypted: i=1; AJvYcCVV5oD0oxj0iAst120qSansziFylf48jkQd/4sJH0TOJoWycmtnQ6bclqBW6by3tKn1kfMv3Q==@nk.ca

X-Gm-Message-State: AOJu0YzwVtV0FSX9SDHuIHoI7oGp1/Bi+AgO8ZbfF1YTyN5YO4Vpgi8b

hKPMYNeMA7aGxC6Kt55L4xUYhck5vjVEokdmeIUtrm/3Rg+TstMrd4YOEMwsyh7m73bqLCAd/R7

5FH7IwWVx1lmcVDnz7B4++d1BMEhs1jw=

X-Gm-Gg: AZuq6aJLVrFO1uSCjLWiopLVneHCnzOieXpK0PX45ImtNtlmabzGv4mdi7ROi83RIPw

qMp6P7arAlEgz8IGYo4x2471WETsJDNoMAIjuc3J8FUsXebXfAN+tAJWmxlFvr8ObrgMHk3B7hv

REqD+uAAbn5m/GY9gNkAgIItQXIgIfXGY0PXMeN35vbllP65gWuilTirP1mH5Mb/+dgDCgnOQok

KDHKzoAYoreiluQ0uflXZo5tEqfOuSHkigRee4nDjaS903RO0GE8jIvgDcDyYxZflUro7ts6hnM

kwb1wC7RVZ2Gxw69Q+cIMTMH9TLbchP4a6nTPUIZWipL

X-Received: by 2002:a05:6820:4b04:b0:659:9a49:90b9 with SMTP id

006d021491bc7-662f20ce1camr3760964eaf.56.1769652925159; Wed, 28 Jan 2026

18:15:25 -0800 (PST)

MIME-Version: 1.0

Reply-To: pungip94@gmail.com

From: Pungi Paolo

Date: Thu, 29 Jan 2026 03:14:36 +0100

X-Gm-Features: AZwV_QgsIO3BKGCu3RskjhqqLx9hu0RAU2OwDJfl5aITP4bZicufmgU8La3_k5U

Message-ID:

Subject: Collaborate with Us

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000fae0e106497d6d83"

Bcc: sales@nk.ca

X-Spam_score: 15.5

X-Spam_score_int: 155

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: We are senior consultants representing a network of reputable

investors from the Gulf region. Our investors are actively seeking opportunities

to expand their portfolios and are prepared to commit a m [...]



Content analysis details: (15.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.68 listed in will-spam-for-food.eu.org]

[209.85.210.68 listed in will-spam-for-food.eu.org]

[209.85.210.68 listed in will-spam-for-food.eu.org]

[209.85.210.68 listed in will-spam-for-food.eu.org]

[209.85.210.68 listed in will-spam-for-food.eu.org]

[209.85.210.68 listed in will-spam-for-food.eu.org]

[209.85.210.68 listed in will-spam-for-food.eu.org]

[209.85.210.68 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.68 listed in dnsbl.ahbl.org]

[209.85.210.68 listed in dnsbl.ahbl.org]

[209.85.210.68 listed in dnsbl.ahbl.org]

[209.85.210.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.68 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.68 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.68 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.68 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[anitaamira793(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[pungip94(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[anitaamira793(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 T_MONEY_PERCENT X% of a lot of money for you

Subject: {SPAM?} Collaborate with Us



--000000000000fae0e106497d6d83

Content-Type: text/plain; charset="UTF-8"



We are senior consultants representing a network of reputable investors

from the Gulf region. Our investors are actively seeking opportunities to

expand their portfolios and are prepared to commit a minimum of $10

million, depending on the scale and viability of the project.



Funding can be provided either as a loan at a 2% annual interest rate or

through a joint venture partnership based on a 50/50 annual net

profit-sharing arrangement.



Should you be interested in exploring this proposal further, we would be

pleased to engage in a detailed discussion through any communication

channel you consider most suitable.



Best regards,



Mr. Pungi



--000000000000fae0e106497d6d83

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



We are senior consultants representing a network of reputa=

ble investors from the Gulf region. Our investors are actively seeking oppo=

rtunities to expand their portfolios and are prepared to commit a minimum o=

f $10 million, depending on the scale and viability of the project.

=

Funding can be provided either as a loan at a 2% annual interest rate =

or through a joint venture partnership based on a 50/50 annual net profit-s=

haring arrangement.

Should you be interested in exploring this =

proposal further, we would be pleased to engage in a detailed discussion th=

rough any communication channel you consider most suitable.

Bes=

t regards,

Mr. Pungi




--000000000000fae0e106497d6d83--

McAfee Phish from Google Gmail Part 4

Posted by Dave Yadallee on













/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Dennard Robinson: Transaction XTCG17606 =E2=80=93 Confirmation Ver=

ified"/>
a.org/Event">
entScheduled"/>
hema.org/Organization">
>
fIYHZ04Di0wO"/>
ine-height: 1px; height: 0; max-height: 0; width: 0; max-width: 0; opacity:=

0; overflow: hidden;" itemprop=3D"name">Transaction XTCG17606 =E2=80=93 Co=

nfirmation Verified
0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:=

100%;" class=3D"body-container">
e>

--000000000000787d9f0649762bd2--

McAfee Phish from Google Gmail Part 3

Posted by Dave Yadallee on


=20



=20



=20



=20



McAfee Phish from Google Gmail Part 2

Posted by Dave Yadallee on
















McAfee Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 28 Jan 2026 16:44:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vlFBe-0000000073A-17zM

for dave@doctor.nl2k.ab.ca;

Wed, 28 Jan 2026 16:43:02 -0700

Resent-From: The Doctor

Resent-Date: Wed, 28 Jan 2026 16:43:02 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f74.google.com ([209.85.210.74]:41757)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vl9T1-000000002iQ-1oqI

for doctor@nl2k.ab.ca;

Wed, 28 Jan 2026 10:36:45 -0700

Received: by mail-ot1-f74.google.com with SMTP id 46e09a7af769-7cfd866fbefso35737a34.3

for ; Wed, 28 Jan 2026 09:35:50 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1769621744; x=1770226544; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=gZjCv9U9wxr/GEIGEb4Nc0FoRbZOYEunAuzzSz4UrI0=;

b=DUVJFK8yaP9RBj8AdIUHVDz3HbvdYGzg+J2yC0fl+g/PDNRTbwrgZUm4EPSDN+6aSA

yYQL2IRHCIF8axJcFhuoBfddET8FmF0KMe6cAkE6YT09D3aehrkCOe+nT04QIID/YTHQ

8ojsl/qlq63Mbx4EQpPZKqAYbFFWTDOLHfUtBvUYAmuLYjvTc5ukHXUXccI0lJI+lh59

B3obg5nVch8MeMkLih7F8EMEwoSuxBZ1vz7cIVVN+Q5ZEZFunYGGA283Br/m/2tu7DDQ

6T+V241fHVfwimyta1nWPV8ozzM9kAAbz84g6Le111ogpLvqckQMvfPbv0J6s5lGUj/z

stEw==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=joyhoba-org.20230601.gappssmtp.com; s=20230601; t=1769621744; x=1770226544; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=gZjCv9U9wxr/GEIGEb4Nc0FoRbZOYEunAuzzSz4UrI0=;

b=mesCoTjJPTK/963m9KO8jLYQLlvuSdQnRKkRLb++Jncm+BsdO1EoPZWXJtZoXM4Dvp

lvZkt+9VSt3JKaPP8VVt22pQoRdAAWoembwlwzUmU2ILptgROszWAzIOmDldwsri6fHt

8WpOJN5iSdeIL7Xna13P3sEpuOCBPyBgYAcCPBgLU44gzuR8BumaZ+SNoijpVsb6QUvN

Kp2TPhRWsv6RPFhvCTInw3q7E/3RVUPESnrsKCABh/QRARA1GDafSxsOc2zlMaPE7a42

dFryOxoQ6BewQ50Kxlbkumlf8WYJ7MlBjiw4lX+zeEFhukauxTdk0rDEchIEyqwKDV3V

0e8Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1769621744; x=1770226544;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=gZjCv9U9wxr/GEIGEb4Nc0FoRbZOYEunAuzzSz4UrI0=;

b=FunapM6drURZnfNDPHiW7fOJ+F3vzlxWsooq9MC387CXS4ztHSW9OA86Qcq6rWhVRi

y35Qcev0DUW2SC8vDZ5c55e0Y6dHDT/ROCPMEIWEFvUYVotuSby7HsX9M1G+bOyYxFYD

9SmZOQWBEsZlcz2CazG59H+X6uxkUiHzeaDFDO+eOVaVUQvROe83S6Ne+Z01EbxcRzNt

yOt2ARvupAtoc6uv+7/IzCEZp1Jjj4uh9wOYThjCm67rQPp91LJUdGsPcXfXmsdytV9J

fXyuaOrzl/aMyv49Rv7B1vA4jNHn5egLXH8Ymz+6YfBPqt+LWSw84fRsreyG9aObwXYb

ZhNA==

X-Forwarded-Encrypted: i=1; AJvYcCUObUlGqrlieqib284vCKwhp1PFQny7tSdRo11gBPu/ZVZdpNXmtJBmCDOB6JPF2fxi089IG+0=@nl2k.ab.ca

X-Gm-Message-State: AOJu0YxiAiNnpUUiJ+AUFMn9ws1Qgq8OyjTJUQ5mRI1/oJc+1LvkE0gw

yJ2vBAAAhgAAk6mxFKZydMLE4w5Ed9yt5N8rEOsoL9d2a1/SczlEeh4e6sszNYW0oYE9Dzz6T+A

DbSaERYVZCAvPqhnrGqfPtdy5XoZHSRByQ8y1Jez5QuRFnA==

MIME-Version: 1.0

X-Received: by 2002:a05:6830:929:b0:7cf:d117:60f1 with SMTP id

46e09a7af769-7d1957258afmt497137a34.3.1769621744198; Wed, 28 Jan 2026

09:35:44 -0800 (PST)

Reply-To: Dennard Robinson

Sender: Google Calendar

Message-ID:

Date: Wed, 28 Jan 2026 17:35:44 +0000

Subject: Transaction XTCG17606 - Confirmation Verified

From: Dennard Robinson

Content-Type: multipart/alternative; boundary="000000000000787d9f0649762bd2"

X-Spam_score: 16.5

X-Spam_score_int: 165

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Transaction XTCG17606 – Confirmation Verified Transaction

XTCG17606 – Confirmation Verified Thursday Jan 29, 2026 ⋅ 12:35am Central

Time - Chicago McAfeeThank you,This notice is to confirm that your McAfee

subscription will continue with automatic billing enabled. A charge of USD440.88

is planned for your upcoming 36 Months subscription period.I [...]



Content analysis details: (16.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.74 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[209.85.210.74 listed in psbl.surriel.com]

1.2 MISSING_HEADERS Missing To: header

0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.74 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.9 REPLYTO_WITHOUT_TO_CC No description available.

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Transaction XTCG17606 - Confirmation Verified



--000000000000787d9f0649762bd2

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



VHJhbnNhY3Rpb24gWFRDRzE3NjA2IOKAkyBDb25maXJtYXRpb24gVmVyaWZpZWQNCg0KVHJhbnNh

Y3Rpb24gWFRDRzE3NjA2IOKAkyBDb25maXJtYXRpb24gVmVyaWZpZWQNClRodXJzZGF5IEphbiAy

OSwgMjAyNiDii4UgMTI6MzVhbQ0KQ2VudHJhbCBUaW1lIC0gQ2hpY2Fnbw0KDQoNCg0KTWNBZmVl

VGhhbmsgeW91LFRoaXMgbm90aWNlIGlzIHRvIGNvbmZpcm0gdGhhdCB5b3VyIE1jQWZlZSBzdWJz

Y3JpcHRpb24gIA0Kd2lsbCBjb250aW51ZSB3aXRoIGF1dG9tYXRpYyBiaWxsaW5nIGVuYWJsZWQu

IEEgY2hhcmdlIG9mIFVTRDQ0MC44OCBpcyAgDQpwbGFubmVkIGZvciB5b3VyIHVwY29taW5nIDM2

IE1vbnRocyBzdWJzY3JpcHRpb24gcGVyaW9kLklmIHlvdSB3aXNoIHRvICANCnJldmlldywgdXBk

YXRlLCBvciBjYW5jZWwgeW91ciBzdWJzY3JpcHRpb24sIHBsZWFzZSBjb250YWN0IHsgMS04NjUt

ICANCjIzMC01MzM1IH0uU3Vic2NyaXB0aW9uIENvbmZpcm1hdGlvbiBOb3RpY2VUcmFuc2FjdGlv

biByZWNlaXB0OiAgDQpRR1YtMzg4MTg2MzEwVHJhbnNhY3Rpb24gRGF0ZTogVGh1cnNkYXksIDI5

IEphbnVhcnkgMjAyNlBsYW46IEZ1bGwgIA0KTWVtYmVyc2hpcCAmbmRhc2g7IDBlNzQ4ZDUyLTc1

MGQtNDhkMi1iOWQwLWVhNmYwMjdkYzFmNFN1YnNjcmlwdGlvbiBUZXJtOiAgDQozNiBNb250aHNU

b3RhbCBBbW91bnQ6IFVTRDQ0MC44OEZvciBmdXJ0aGVyIGFzc2lzdGFuY2UsIHBsZWFzZSBjb250

YWN0ICANCjEtODU5LSAyMjItNTI0NS5UaGFua2Z1bGx5LCxNY0FmZWUsIEluYy4NCg0KT3JnYW5p

emVyDQpEZW5uYXJkIFJvYmluc29uDQptaXNjb3ltZWxvZHlqb3lAam95aG9iYS5vcmcNCg0KR3Vl

c3RzDQooR3Vlc3QgbGlzdCBoYXMgYmVlbiBoaWRkZW4gYXQgb3JnYW5pemVyJ3MgcmVxdWVzdCkN

Cg0K

--000000000000787d9f0649762bd2

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

=3D"left">
 
>
dding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=

=3D"width:100%;" class=3D"">

eft">


p=3D"description">Transaction XTCG17606 =E2=80=93 Confirmation Verified

=


spacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" =

class=3D"">

: 8px; direction: rtl; font-size: 0; padding: 24px 32px; text-align: left; =

vertical-align: top;" class=3D"main-container-inner">

direction: ltr; display: inline-block; vertical-align: top; width: 100%;ove=

rflow: hidden; word-wrap: break-word;">
" cellspacing=3D"0" role=3D"presentation" width=3D"100%" class=3D"main-colu=

mn-table-ltr" style=3D"padding-right: 32px; padding-left: 0;;table-layout: =

fixed;">

l-align:top;">
=3D"presentation" width=3D"100%" style=3D"table-layout: fixed;">

le=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word;;p=

adding-bottom:2px;">

o, sans-serif;font-weight: 400; font-size: 22px; line-height: 28px;color: #=

3c4043; text-decoration: none;" class=3D"primary-text" role=3D"presentation=

">Transaction XTCG17606 =E2=80=93 Confirmation Veri=

fied

align: left; word-break: break-word;;padding-bottom:24px;">

nt-family: Roboto, sans-serif;font-style: normal; font-weight: 400; font-si=

ze: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-dec=

oration: none;" class=3D"primary-text" role=3D"presentation">
den=3D"true">=

Thursday Jan 29, 2026 =E2=8B=85 12:35am (Central Time - Chicago)
n>

ft; word-break: break-word;;padding-bottom:24px;">

: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px;=

line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: =

none;" class=3D"primary-text" role=3D"presentation">

McAfee

T=

hank you,

This notice is to confirm that your McAfee subscription wil=

l continue with automatic billing enabled. A charge of USD440.88 is planned=

for your upcoming 36 Months subscription period.

If you wish to revi=

ew, update, or cancel your subscription, please contact { 1-865- 230-5335 }=

.

Subscription Confirmation Notice
Transaction receipt: QGV-388186=

310
Transaction Date: Thursday, 29 January 2026
Plan: Full Membership=

=E2=80=93 0e748d52-750d-48d2-b9d0-ea6f027dc1f4
Subscription Term: 36 Mo=

nths
Total Amount: USD440.88

For further assistance, please contac=

t 1-859- 222-5245.

Thankfully,,
McAfee, Inc.


rop=3D"description" content=3D"McAfeeThank you,This notice is to confirm th=

at your McAfee subscription will continue with automatic billing enabled. A=

charge of USD440.88 is planned for your upcoming 36 Months subscription pe=

riod.If you wish to review, update, or cancel your subscription, please con=

tact { 1-865- 230-5335 }.Subscription Confirmation NoticeTransaction receip=

t: QGV-388186310Transaction Date: Thursday, 29 January 2026Plan: Full Membe=

rship &ndash; 0e748d52-750d-48d2-b9d0-ea6f027dc1f4Subscription Term: 36=

MonthsTotal Amount: USD440.88For further assistance, please contact 1-859-=

222-5245.Thankfully,,McAfee, Inc."/>

size: 0; padding: 0; text-align: left; word-break: break-word;;padding-bott=

om:24px;">

font-weight: 400; font-size: 14px; line-height: 20px; letter-spacing: 0.2p=

x;color: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D"pr=

esentation">
"presentation" style=3D"padding-bottom: 4px;">


text" style=3D"font-size: 14px;color: #3c4043; text-decoration: none;font-w=

eight: 700;-webkit-font-smoothing: antialiased;margin: 0; padding: 0;">Gues=

ts

(Guest list has been hidden at organizer's request=

)


AAA Member Benefits




Hello , Today's Winner is doctor.

We would like offer you a unique opportunity to receive your exclusive reward of up Car Emergency Kit

To Claim simply take this short survey about your experience with us



Congratulation AAA Subscriber!






hurry up ! Your Reward is Ready




Your account information :




Customer:

doctor


Email:

doctor@doctor.nl2k.ab.ca


Reward:



Car Emergency Kit




Claim Reward Now




AAA Team

















If you no longer wish to receive these emails, you may unsubscribe by clicking here


115 E 23rd St New York, NY, US 10010













AAA Emergency Kit Phish Part 2

Posted by Dave Yadallee on




















Stocksy Email





































AAA Member Benefits




Hello , Today's Winner is root.

We would like offer you a unique opportunity to receive your exclusive reward of up Car Emergency Kit

To Claim simply take this short survey about your experience with us



Congratulation AAA Subscriber!






hurry up ! Your Reward is Ready




Your account information :




Customer:

root


Email:

root@nk.ca


Reward:



Car Emergency Kit




Claim Reward Now




AAA Team

















If you no longer wish to receive these emails, you may unsubscribe by clicking here


115 E 23rd St New York, NY, US 10010













AAA Emergency Kit Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 28 Jan 2026 10:04:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vl8x5-00000000Pe1-2xPx

for dave@doctor.nl2k.ab.ca;

Wed, 28 Jan 2026 10:03:35 -0700

Resent-From: The Doctor

Resent-Date: Wed, 28 Jan 2026 10:03:35 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [89.185.81.110] (port=37259 helo=maxdulsin.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

id 1vl8Ix-00000000KHQ-1iHP

for doctor@doctor.nl2k.ab.ca;

Wed, 28 Jan 2026 09:22:15 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=doctor.nl2k.ab.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version; i=doctor@doctor.nl2k.ab.ca;

bh=Z89krY6r4lk3OWZbrATP6aZnnE0=;

b=M7rUjur31DiezMT2x9TZPIQDBjwaqv88jeZu89VdJ/Motsllu29LO6nuQJAF3UMU8I6/31qjgw1S

ajl0Ad2pVjEq9xV1yfxD78/T8z9VB5waeKoTX/ibVKK+/IsrEHDQt15oJo2Z6BMAy4vcC3s60SIk

x6ErXNWtaeUhBdXlfxU=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=doctor.nl2k.ab.ca;

b=Wssa07VOm8Oq6P7OPTi1LXEXzA7s18U5tEI7gQ6V1t/RwXqnDx4UyauzcsV5pr/ngd+tdH+iICeY

j5UaaE+BZm0h3cFlS19moaDE7yggRxzs5twq0pCpV/W9qPizSD0imXBDMqwr0RVumUO/FhT78gEh

sBq7bbUzxPpzp4V9Eh4=;

Date: Wed, 28 Jan 2026 16:21:20 +0000

To: doctor@doctor.nl2k.ab.ca

From: AAA

Subject: Final notice coming for Car Emergency Kit Reward

Content-Type: text/html

Mime-Version: 1.0

X-Spam_score: 21.6

X-Spam_score_int: 216

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Stocksy Email AAA Member Benefits Hello , Today's Winner

is doctor.



Content analysis details: (21.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[89.185.81.110 listed in will-spam-for-food.eu.org]

[89.185.81.110 listed in will-spam-for-food.eu.org]

[89.185.81.110 listed in will-spam-for-food.eu.org]

[89.185.81.110 listed in will-spam-for-food.eu.org]

[89.185.81.110 listed in will-spam-for-food.eu.org]

[89.185.81.110 listed in will-spam-for-food.eu.org]

[89.185.81.110 listed in will-spam-for-food.eu.org]

[89.185.81.110 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[89.185.81.110 listed in dnsbl.ahbl.org]

[89.185.81.110 listed in dnsbl.ahbl.org]

[89.185.81.110 listed in dnsbl.ahbl.org]

[89.185.81.110 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[89.185.81.110 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[89.185.81.110 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[89.185.81.110 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[89.185.81.110 listed in dnsbl.ahbl.org]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

2.4 HTML_OBFUSCATE_20_30 BODY: Message is 20% to 30% HTML obfuscation

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

3.5 HTML_TAG_BALANCE_CENTER Malformatted HTML

3.6 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

2.5 HTML_SINGLET_MANY Many single-letter HTML format blocks

0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

1.4 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

Subject: {SPAM?} Final notice coming for Car Emergency Kit Reward

AAA Emergency Kit Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 28 Jan 2026 10:04:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vl8wt-00000000PcJ-28X8

for dave@doctor.nl2k.ab.ca;

Wed, 28 Jan 2026 10:03:23 -0700

Resent-From: The Doctor

Resent-Date: Wed, 28 Jan 2026 10:03:23 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [87.120.219.235] (port=45725 helo=aryanaluk.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

id 1vl8Ii-00000000KGK-3GQJ

for root@nk.ca;

Wed, 28 Jan 2026 09:22:00 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nk.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version; i=root@nk.ca;

bh=sIh9AjPvqOBOYY9zWuk/eYmdUYs=;

b=YnXht4bDeWcOowptXukzJdP+lt6f4nuRHxyDqODM1mPwoeTqJ69oQIBF/Wnmwd+ba/np3csyD8Fa

l1B56FBS6lw50+Gpn7k9J5diW0c2FgO5Bw7yy5rmjeIaTwroSGj4YeV9BOO/R4zbnswthRcTYcZf

mWLbZQbznt9cz8Nu4l0=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nk.ca;

b=OylDquPN+aKfMq40etzrYw1ucf8jvsMVFIpYctz4fIE7gMTTQ2wGpyFScGXZS8zvVkmNfKhLvlTP

jEfjIDWxyZf46fUUcEQZJeM+Bv3M33JaRvdu+V1ydJrao88BB5UNIhXLm1Y04yULC0WCkg16QrnF

R8w8DxLV06trRh73Yzg=;

Date: Wed, 28 Jan 2026 16:21:03 +0000

To: root@nk.ca

From: AAA

Subject: Final notice coming for Car Emergency Kit Reward

Content-Type: text/html

Mime-Version: 1.0

X-Spam_score: 21.4

X-Spam_score_int: 214

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Stocksy Email AAA Member Benefits Hello , Today's Winner

is root.



Content analysis details: (21.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[87.120.219.235 listed in will-spam-for-food.eu.org]

[87.120.219.235 listed in will-spam-for-food.eu.org]

[87.120.219.235 listed in will-spam-for-food.eu.org]

[87.120.219.235 listed in will-spam-for-food.eu.org]

[87.120.219.235 listed in will-spam-for-food.eu.org]

[87.120.219.235 listed in will-spam-for-food.eu.org]

[87.120.219.235 listed in will-spam-for-food.eu.org]

[87.120.219.235 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[87.120.219.235 listed in dnsbl.ahbl.org]

[87.120.219.235 listed in dnsbl.ahbl.org]

[87.120.219.235 listed in dnsbl.ahbl.org]

[87.120.219.235 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[87.120.219.235 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[87.120.219.235 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[87.120.219.235 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[87.120.219.235 listed in dnsbl.ahbl.org]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

2.4 HTML_OBFUSCATE_20_30 BODY: Message is 20% to 30% HTML obfuscation

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.5 HTML_TAG_BALANCE_CENTER Malformatted HTML

2.5 HTML_SINGLET_MANY Many single-letter HTML format blocks

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

3.6 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

1.4 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX

Subject: {SPAM?} Final notice coming for Car Emergency Kit Reward

AAA Emergency Kit Phish Part 2

Posted by Dave Yadallee on




















Stocksy Email





































AAA Member Benefits




Hello , Today's Winner is doctor.

We would like offer you a unique opportunity to receive your exclusive reward of up Car Emergency Kit

To Claim simply take this short survey about your experience with us



Congratulation AAA Subscriber!






hurry up ! Your Reward is Ready




Your account information :




Customer:

doctor


Email:

doctor@nl2k.ab.ca


Reward:



Car Emergency Kit




Claim Reward Now




AAA Team

















If you no longer wish to receive these emails, you may unsubscribe by clicking here


115 E 23rd St New York, NY, US 10010













AAA Emergency Kit Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 28 Jan 2026 10:04:10 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vl8wm-00000000Pb9-344Q

for dave@doctor.nl2k.ab.ca;

Wed, 28 Jan 2026 10:03:16 -0700

Resent-From: The Doctor

Resent-Date: Wed, 28 Jan 2026 10:03:16 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [89.185.81.110] (port=47751 helo=maxdulsin.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

id 1vl8Ib-00000000KEt-3HGZ

for doctor@nl2k.ab.ca;

Wed, 28 Jan 2026 09:21:54 -0700

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nl2k.ab.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version; i=doctor@nl2k.ab.ca;

bh=dvChNaXys5enYm8YiS7ZibX8sSg=;

b=YkInBBrT6a4F4aqqN6j6JbPsrYogHvJZltTZ+/OlIjWNh2YYOBy4k/JUJjI81JJ52e9/fPfSHA39

GaPEtshATMsk1UgGzUTbMCyWL3kC4eP/s+yVtit3jROR5rf4Q7UxrzIGSAzOwHGO5DmR/FkCZueA

29qqdesY2Hcn9JjQkqg=

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nl2k.ab.ca;

b=2SsbFRwoSpPsArlj1BSrG1fJb2DevYaKG67ErQUkJxzydUaUxtX/MdxMBhQVrxBNzHg9b6KBYHME

dqtxbP0YXvc6mL3Tixfwfc2DUUgJhlMwaQL5irlSI2VwzSzW80O+9Bi8vs6vNS7Iu0P5+jzZon8A

IXjPARE5M7zqXQS/Cos=;

Date: Wed, 28 Jan 2026 16:20:54 +0000

To: doctor@nl2k.ab.ca

From: AAA

Subject: Final notice coming for Car Emergency Kit Reward

Content-Type: text/html

Mime-Version: 1.0

X-Spam_score: 21.6

X-Spam_score_int: 216

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Stocksy Email AAA Member Benefits Hello , Today's Winner

is doctor.



Content analysis details: (21.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[89.185.81.110 listed in will-spam-for-food.eu.org]

[89.185.81.110 listed in will-spam-for-food.eu.org]

[89.185.81.110 listed in will-spam-for-food.eu.org]

[89.185.81.110 listed in will-spam-for-food.eu.org]

[89.185.81.110 listed in will-spam-for-food.eu.org]

[89.185.81.110 listed in will-spam-for-food.eu.org]

[89.185.81.110 listed in will-spam-for-food.eu.org]

[89.185.81.110 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[89.185.81.110 listed in dnsbl.ahbl.org]

[89.185.81.110 listed in dnsbl.ahbl.org]

[89.185.81.110 listed in dnsbl.ahbl.org]

[89.185.81.110 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[89.185.81.110 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[89.185.81.110 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[89.185.81.110 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[89.185.81.110 listed in dnsbl.ahbl.org]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

2.4 HTML_OBFUSCATE_20_30 BODY: Message is 20% to 30% HTML obfuscation

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.5 HTML_TAG_BALANCE_CENTER Malformatted HTML

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 HTML_SINGLET_MANY Many single-letter HTML format blocks

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.0 T_STY_INVIS_DIRECT HTML hidden text + direct-to-MX

3.6 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

1.4 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

Subject: {SPAM?} Final notice coming for Car Emergency Kit Reward