Web/SEO/App Spam from Microsoft Outlook

Posted by Dave Yadallee on Monday, October 6. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 06 Oct 2025 14:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5rvD-00000000OHH-3A9H

for dave@doctor.nl2k.ab.ca;

Mon, 06 Oct 2025 14:35:03 -0600

Resent-From: The Doctor

Resent-Date: Mon, 6 Oct 2025 14:35:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastus2azolkn19010003.outbound.protection.outlook.com ([52.103.12.3]:54714 helo=BN1PR04CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5pbb-000000000pL-1UB1;

Mon, 06 Oct 2025 12:06:49 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=MzQtYHskh3G3VMlEz/E9ZNMwhfXaPWwb1d0FC0/zeqLf7Pxp7p7YB09USMsQ1LFlhd0X6YTbQTOYh5CzWdYleffFD0X4SJgf61llGWKHbachPne3UtO8ag35SZ9u+0BUMVYG3iKn/uyxfZxRdfG39oW0zbC7PUSwcpmTHjyXUS8jRW3wJgFnNW0r//m5W9sMCbxK2GUrev74NBkWASoMU37Tf55RobXBeTSde5/g/MzptC4HUkeGnhXL+3L30qLXwlutuE2ti9VxQSvlcgsn9qCJlMrfhmI9dieRD4+PZI1CJ/A/0bGZt/TtKPq+yfy6dsc1/251DRQAUDsIqep0dA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=jxd3NzRDdYO+s0g/HFnAtkGmimCHP8DX8VEDaksHwn0=;

b=aQdHc8lPPZNtrJzaNn2QozPQRLi0Ef2BfKkweNvwg3dVO47SCd66tMAbz6hRwzPSzaSbyFvdspMXY45HazYoQK9Qpr5BCohZ1h2T7wmGAEqZ1mLLhiFPKmrugU00dSTeWPYP0p9rbEKFvfPGC7xhNm+dqFRLyrpDVkSaxP2GhLhROlTabiroNsqsdwnfWzjohgvw9SybuGJkXPP4FMf8Dtn5rExPN362Q6EAqYxQMlV/E11YQrbJfwN+wMrvwwgWDKzgaprmjFZfDoYPHjg+YPtl4UeWrW8QsrkMM4iQqiNOzJuqQuzw+c+MWDQcEOu/6R2B+0yae/lZMLvqpakZug==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=jxd3NzRDdYO+s0g/HFnAtkGmimCHP8DX8VEDaksHwn0=;

b=ZoB8a6qVcYtfC4j7v5EaBMZ0Uk1Nxa6aQTRnjS7QWapdM+GPzLHETRqXWUPy2a6saCWi6ShdWfLtxxwYDR6VQog8zkdpZq0XsS962Hj7qU2BZP3+dHTT9IAhlN9Kk5Tg/tV+lsB7XDbUH8CV9BZmbnfRVg46L/IkqTngKYm3UoSDUkNP8LEhwzKHx0cODbMgLNLyzYPTlNI8QuQvgFzWeUGZEnwgQ1cw15cQ+2nYxovSjzU9fnPWCK5lmXC8vJlQMVF9Jq7R1lwEPTUAXtLxzQ6xlbsYWTs8Nkd9XpQ6TSJLfXuUT51LrcS6KwKzRyPAGhMFpqYfKVNd3xGLCm5RIw==

Received: from BY5PR20MB3201.namprd20.prod.outlook.com (2603:10b6:a03:1fe::31)

by IA1PR20MB6504.namprd20.prod.outlook.com (2603:10b6:208:44f::7) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9182.20; Mon, 6 Oct

2025 18:05:24 +0000

Received: from BY5PR20MB3201.namprd20.prod.outlook.com

([fe80::b570:49ad:bb7e:29f9]) by BY5PR20MB3201.namprd20.prod.outlook.com

([fe80::b570:49ad:bb7e:29f9%6]) with mapi id 15.20.9182.017; Mon, 6 Oct 2025

18:05:24 +0000

From: Ritu Sharma

Subject: Modern Designer ?

Thread-Topic: Modern Designer ?

Thread-Index: AQHcNutchLyKZRsT2km8YgLcEfAHHw==

Date: Mon, 6 Oct 2025 18:05:24 +0000

Message-ID:

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: BY5PR20MB3201:EE_|IA1PR20MB6504:EE_

x-ms-office365-filtering-correlation-id: 4f873035-4278-47d9-ab0f-08de0502ec19

x-microsoft-antispam:

BCL:0;ARA:14566002|31061999003|461199028|8062599012|15030799006|15080799012|8060799015|19110799012|56899033|40105399003|51005399003|39105399003|41105399003|3412199025|440099028|39145399003|102099032|12091999003;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?j4YONrfMFg/ki+7awjJZ6pQHOEebVluPhqpAOqRXdBjZ3BcPoxkm3sSzaF?=

=?iso-8859-1?Q?fj/PUH6r8SPRxCIGYg0DQDFFDlGstXQnK9yc8p6YWCb4VYyunL15cDo5lH?=

=?iso-8859-1?Q?65e5BaJ+LYoBRrVBFCOHWWHjHKbr9gCixuN4AVSHeGQLpv3jyJXfEcpk0s?=

=?iso-8859-1?Q?23z6z6H4K8rLWvzu37G5yCvr9LYul2P1mLvFPn7qeTAri7bIGdWeHrNw7N?=

=?iso-8859-1?Q?N66nkg+rzJ9aB3h32uns9EHh1Py2yTKY7s5mBhQ3t4YYD5ofUNncBewFzE?=

=?iso-8859-1?Q?7zeAbK5Kf0fWfC4YenX7nAUMxLFV84YX6xKKPcLwHbigsC2WqfEmlvbUjF?=

=?iso-8859-1?Q?xU7ZEmTyY+49uA3Bf5ratJcf4DLepyUPBUeHJj84Mhx1p3BSIkRGArlxwf?=

=?iso-8859-1?Q?aQbkIPwHEPa4jEeUKbhTA6b6OefD7DbehoievZQtd2N+QdQPVJAtpVvGT+?=

=?iso-8859-1?Q?3b/osOGh3RGLRO127eybkCiToQTcwAMmMGZlNYXki60ve7Of4ergO2hAFC?=

=?iso-8859-1?Q?2O7pAkw+87pFtTNcIt3PLqLrnCdSPKWogdOl7oUCnpDae/1qAA4WmOicth?=

=?iso-8859-1?Q?ZxpVeQBcCF6QRoeZVtRCB0wa9LOADL10yOLZ0v32kA0/DgooUmXwk8gk3O?=

=?iso-8859-1?Q?tvxfYQUIQNQ2XA7GyCb/ain9nlXwOOB4/92i8L/Xwz2h5AS0+VmqoJiwqJ?=

=?iso-8859-1?Q?4xWSor8sCLgdGHp+4HKmPyPwWLgjlVCMirqqQmLvya8RZVr1A2wVUXNsya?=

=?iso-8859-1?Q?bPYjqPXLUllLULnrUaF6pLNFngkfx2IbHoHUAsCFYL4EbN8GREiShG/Ldw?=

=?iso-8859-1?Q?15GG2H9kQXE9+0NDd8nvEJ1DrYSiKSfh/K4Wt6XN0/wW1CpP3SYZuJCNZ9?=

=?iso-8859-1?Q?EA6PAMLrUVAZNa6wwH6TSRCEp0xpp/h6JmbMA5Yj+W0iNp21XPRVxpXxjc?=

=?iso-8859-1?Q?R/YpNNKskSqOZnWGz83Cwgjdn1+f4PhS6Fe8Wm6EaIXHK4FDXd8YGdIUF7?=

=?iso-8859-1?Q?3GLuMq0QGyPM1Cxb83vRvLBTonxG/Vk8xjD20dcb5G0KcIpVzJsh1S9tGM?=

=?iso-8859-1?Q?IaURfJeq7vwDru8Bj0byLTdjByfVwd3rHW7v6mRSxXqH12UIGprwzbQIL3?=

=?iso-8859-1?Q?NygQXLzbi6Jh7RZ8ay40833Dnrxo1hNn0N2ImryKwx2DokGbqmRC7KE4vY?=

=?iso-8859-1?Q?KzerKq3+d0wBHRHOyJSVShEi1rj4gDrchooW13yKvg/vJlo4z6GwaH3tdZ?=

=?iso-8859-1?Q?B0v9pdfl3iG2Knz5fg+b191iu4n55AW/Q+fb965dsHijVMoEp2XUMDtkt4?=

=?iso-8859-1?Q?ka7E3e0WH7R0nOYuHC13sSUt42m+l5tpykI09lYYbRyUZga/wDYeitO2zd?=

=?iso-8859-1?Q?5yca3BDGbcwtUQNOARKZPUFdAa5XmTtg=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?E7OmrWgaQxNZt2TkuhQ3FpE38LNu2trk+S5e6w7IGKOHUmgvj3EBaM8sTy?=

=?iso-8859-1?Q?VUTmwAmqnlniDQ6QcHUOnLkxhAR0UhYz+q8qlODm5w7Dsshe4/Ng204VX8?=

=?iso-8859-1?Q?hvmtx+ww+sJ8CabCje8fnAf/ujh8d5cWl8kKA1zZdblAV+xb3lWczlmQJG?=

=?iso-8859-1?Q?dKwBMkq6vyLdTZ4l5OjPHjKH/AVv16uscJWbd01no3R+DDjzbHN/h5AB31?=

=?iso-8859-1?Q?69ZFbI4j/wK9TBXmMPiw8grm7IlX7AHXwUK5adiGuiRKgyLEKAL2Z8N6/M?=

=?iso-8859-1?Q?FtytZ7m1TDtW1Af2sdqJR1M2IoUV3oowdEKAWuaM+seJLsBA4rLqPP4Nu+?=

=?iso-8859-1?Q?YGONZ5NfWgw83JICIb4+2QUhq4ObUU+Wg5awQtSaILANvKVucwFd3eMz3b?=

=?iso-8859-1?Q?9N1ueIdx+MlA4/7GvXb3g2Fst+HM3g+G3iLp0zQGNeBcK/IcCAS0txXZMs?=

=?iso-8859-1?Q?gJDayFTu7V6XcLRimIpgzvzdn7UKmXW34jKWSQbXCPZr4KTurMwkHOdja+?=

=?iso-8859-1?Q?NjnY8/2r7uvVQzQZv0NIHN+rc0KMlrd07rrdmfeHl/Gq8b1sqwM+D0h1Qg?=

=?iso-8859-1?Q?DzqmXHaE03PwoOpQ3iCndDXmCcvp2k8pFyv4mvoLtUSWfWxcqH1RAnB8CK?=

=?iso-8859-1?Q?Y64Kt0pmdqPNF/xWiMN0VDMuxrG5ZzfftfEdl29VJp4h9s5cWd7TkRg6Ix?=

=?iso-8859-1?Q?b3XlxO5Xw0+fdOu7uW/l5Hzbzp0GpLZZ7WO4hRyjDm4uBdXXg+NlbuP7LB?=

=?iso-8859-1?Q?nt6in4tAHoLc4/Sk+6nLPEU7t0NeNfoKBZdu6osVm/C0fRR23kDwI+SOB9?=

=?iso-8859-1?Q?ogVO+1BYbkpCUIIHT2Z6C+pC/bj3uWAZAaSgKsGsMZKKODF04CjRJTYMTJ?=

=?iso-8859-1?Q?qSs0JjR7U2txM9E3pE9Vk1YHM0BzdT7sLNuylcLUzB60MeV7WzXdCExYJH?=

=?iso-8859-1?Q?bTlzYi4upFo6E1sTOYQdF3wozpis0WaWMuHjjxrgmluHoXjziy0exdj7s7?=

=?iso-8859-1?Q?nWJRZroYz2QMw8FaGdU+EFtRv2l99un6nDbcOfLrN92DtrszFuL+q1LYWq?=

=?iso-8859-1?Q?kHNvVDpNdbz5gq3/4+E16GKtwha2moJOVJ+Wimt0K8j6QmPXM9AyFCT/cr?=

=?iso-8859-1?Q?bV7uDBVK2p96cf9XWRem9+tqOoEIaRuW/U/zD2ByLToDj7PaqTjYKQLGkN?=

=?iso-8859-1?Q?vudP4mEonuo4nOU1JkOjSebyKclmFOO7k5U++eqMbaZXbeMGcG/My/BIXI?=

=?iso-8859-1?Q?aXy8Wdkwt8WpyogTe4dh2fvKGvlNzw3ZXAOjml3UuJc65hea0jVDfVORV8?=

=?iso-8859-1?Q?9Y6Kxk7AR8MM3Yb5pgRDHGWWGntJ4vkNIx+Uiq6ti9nX+Nk=3D?=

Content-Type: multipart/alternative;

boundary="_000_BY5PR20MB32010FD00602BC1CB1DCC32EDDE3ABY5PR20MB3201namp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: BY5PR20MB3201.namprd20.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 4f873035-4278-47d9-ab0f-08de0502ec19

X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Oct 2025 18:05:24.2109

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR20MB6504

X-Spam_score: 7.5

X-Spam_score_int: 75

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello, Quick follow-up-could you reply to my last email? I

can send Web design pricing if you're interested. Thanks, From: Ritu Sharma

Sent: Thursday, September 11, 20 [...]

Content analysis details: (7.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.12.3 listed in dnsbl.ahbl.org]

[52.103.12.3 listed in dnsbl.ahbl.org]

[52.103.12.3 listed in dnsbl.ahbl.org]

[52.103.12.3 listed in dnsbl.ahbl.org]

[2603:10b6:a03:1fe:0:0:0:31 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:1fe:0:0:0:31 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:1fe:0:0:0:31 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:1fe:0:0:0:31 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.12.3 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.12.3 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.12.3 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.12.3 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10b6:a03:1fe:0:0:0:31 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1fe:0:0:0:31 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1fe:0:0:0:31 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1fe:0:0:0:31 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1fe:0:0:0:31 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1fe:0:0:0:31 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1fe:0:0:0:31 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1fe:0:0:0:31 listed in]

[will-spam-for-food.eu.org]

[52.103.12.3 listed in will-spam-for-food.eu.org]

[52.103.12.3 listed in will-spam-for-food.eu.org]

[52.103.12.3 listed in will-spam-for-food.eu.org]

[52.103.12.3 listed in will-spam-for-food.eu.org]

[52.103.12.3 listed in will-spam-for-food.eu.org]

[52.103.12.3 listed in will-spam-for-food.eu.org]

[52.103.12.3 listed in will-spam-for-food.eu.org]

[52.103.12.3 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.12.3 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.12.3 listed in list.dnswl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.0 ARC_VALID Message has a valid ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[ritu__sharma.1(at)outlook.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ritu__sharma.1(at)outlook.com]

1.2 MISSING_HEADERS Missing To: header

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

Subject: {SPAM?} Modern Designer ?

--_000_BY5PR20MB32010FD00602BC1CB1DCC32EDDE3ABY5PR20MB3201namp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Hello,

Quick follow-up-could you reply to my last email?

I can send Web design pricing if you're interested.

Thanks,

________________________________

From: Ritu Sharma

Sent: Thursday, September 11, 2025 4:27 PM

Subject: Modern Designer ?

Hello,

Greetings of the day!

I am a professional web Designer with over 12 years of web experience. I ma=

ke clean, creative designs done on time for a reasonable price.

I design new websites, web design and development, e-commerce platforms, ot=

her promotional related work.

If you are interested, then I can send you our Price list, company informat=

ion and an affordable quotation with the best offer.

Regards,

--_000_BY5PR20MB32010FD00602BC1CB1DCC32EDDE3ABY5PR20MB3201namp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

1">

Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; f=

ont-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Hello,

Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; f=

ont-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Quick follow-up-could you reply to my last email?

Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; f=

ont-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

I can send Web design pricing if you're interested.

Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; f=

ont-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Thanks,

11pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

From: Ritu Sharma

Sent: Thursday, September 11, 2025 4:27 PM

Subject: Modern Designer ?

_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">

t-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetic=

a, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToPro=

of">

Hello,

t-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetic=

a, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToPro=

of">

Greetings of the day!

t-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetic=

a, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToPro=

of">

I am a professional web Designer with over 12 years of web expe=

rience. I make clean, creative designs done on time for a reasonable price.=

t-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetic=

a, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToPro=

of">

I design new websites, web design and development, e-commerce platforms, ot=

her promotional related work.

t-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetic=

a, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToPro=

of">

If you are interested, then I can send you our Price list, company informat=

ion and an affordable quotation with the best offer.

t-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetic=

a, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToPro=

of">

Regards,

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

--_000_BY5PR20MB32010FD00602BC1CB1DCC32EDDE3ABY5PR20MB3201namp_--

Job Opportunity spam from Google Gmail

Posted by Dave Yadallee on Monday, October 6. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 06 Oct 2025 14:35:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5ruv-00000000ODh-0gx0

for dave@doctor.nl2k.ab.ca;

Mon, 06 Oct 2025 14:34:45 -0600

Resent-From: The Doctor

Resent-Date: Mon, 6 Oct 2025 14:34:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f175.google.com ([209.85.208.175]:52469)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5ovK-00000000JsJ-1FF5

for root@nk.ca;

Mon, 06 Oct 2025 11:23:06 -0600

Received: by mail-lj1-f175.google.com with SMTP id 38308e7fff4ca-36a6a3974fdso53601991fa.0

for ; Mon, 06 Oct 2025 10:22:11 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1759771324; x=1760376124; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=ANNYDeBxbBhdiU8c0QBZlPZCHfaRpgGRjr8kEyU5YYA=;

b=kfC0ksTwgptM3UpsXjQOAkTMyhAZAjCcoOeGB0P/Dm3ohjS1tiafkeGNwNJC/EOfuK

/ybrsyXMTuo4bY5/jVgy6PyApQ9WdMTRLSf8mwMJuOW8803lYeFg+hbl2M1ouPKvzVH8

qIAPBC/oA6PhM4BvN2DV6V0F2F6MPy+4a6hJHUPvnvCxhr+PdzGZ++vm5flg94xlmt29

4tIrplYkDhEcweTbieEynCSvXQZCidhKEYDmDCtJ3odH+kfmGbeahyfX7YYd8hQ0uElZ

+A4BftFdcaOmx4LEon7r92eZbbJ2Oaa2Oxv4grnbwYEcjnZg4xbmtRPWkhma89dO/KXr

9s2w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1759771324; x=1760376124;

h=to:subject:message-id:date:from:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=ANNYDeBxbBhdiU8c0QBZlPZCHfaRpgGRjr8kEyU5YYA=;

b=InT6UI0+0qMib1sOt9PoXMF6OsMDF4v6t1y2DqKMWza0fLp/TF0pPzj42zt8pwGhJz

55JJBDh4hnO+BcJXOKj+9ixv5l0yXS5JeX1iFFtp7xJNY8Mot0M5yDGBlDad6fR3Xmq1

d17Sk4n+930NXdJKi4u7y2rQ0rFvScm+pIlWqCUNcWO3ADmqayTRfOe4Sofu9hY7Uuwm

b4IjRdx2sMv07f99Nd/PS9ZaeWiRszNb4BqGIVKLVJW6QYTW2prJcseT2cw1PcwXNmUr

HkpcH/Jq8IfW/I5rdabJXqIMCQ5ugUCrg9+3c+IqeWxZCS3D65r8f74Ud3iOJ/5/9fk7

gGNg==

X-Gm-Message-State: AOJu0YxvaENpU8Rge4VlPIDa+uXJ2O3BbO/21V0Eb4A5jhcx0exDkZYP

rgufFOcq6H+NIk03m41nC5pFI9kLB8dH75GFtYwuEKEwq98Vy4iKFetrRt3pBJTCCj6Q7tuITCD

v63z/hI7M+wCPCe0wGEruLylzMa6RyWeNVtCjkEo=

X-Gm-Gg: ASbGnctiogAzLEpxDKAZwq0DtQQO53FI2rGf0LAyyD9eBMIgNH0GtxkGqkYk2Ugim66

ZC6Vakgo4kQtoRKmbJVss2sSqkkTzmw7k8t1Hj6oYGBIhDHnNDEzqCjLMFTE5NTozswV7V+Wmhk

S4CkYqxFbQSMAr1ZPumIZhx4s5YCpn7Ir1BsmHovriF6InAKw81ZjV25XOEGFPwzOeC30oM2Tj3

AjUsraVm1gi8UVBxNJGztgJ/ewJx3RUjPtKUj5p4KGF3Ss=

X-Google-Smtp-Source: AGHT+IGGAS+/umVrxiTgMpZfEI2tNPom4hLD6nD3CRikexUjtMNuBy5QKizMLZI4fyUu78+y3XiHEQehAwDJzSf6slg=

X-Received: by 2002:a05:651c:12c1:b0:368:c52f:fb64 with SMTP id

38308e7fff4ca-374c38852acmr34649811fa.34.1759771323699; Mon, 06 Oct 2025

10:22:03 -0700 (PDT)

MIME-Version: 1.0

From: Gary Slack

Date: Mon, 6 Oct 2025 18:21:51 +0100

X-Gm-Features: AS18NWCvdxoi5Qip9nNCxuPj9rAV7LLfVvP8zAywXXx7dPutwKWOEDnH_otYIPs

Message-ID:

Subject: Hello Dave Yadallee

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000a294ab064080b031"

--000000000000a294ab064080b031

Content-Type: text/plain; charset="UTF-8"

Hello Dave Yadallee

My name is Gary Slack, Reverse Mortgage Specialist and loan agent at Wymac

Capital Inc.

I found your contacts on the Linkedin professional network. MURACO MEDICAL

CO., LTD. is currently seeking an individual/company for the part-time

position of a representative in Canada/USA with great benefits and

attractive work hours. This opportunity allows for remote work, enabling

you to seamlessly integrate it with your existing job or daily commitments.

If interested, contact ANDREW COOPER ( andrew.cooper@muracomedical.com )

for more details and job description.

Best Regards,

Gary Slack

President at Longhorn Investments Inc.

MURACO MEDICAL CO., LTD.

Representative Required in CANADA/USA

--000000000000a294ab064080b031

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hello=C2=A0 Dave Yadallee

My name is

Gary Slack,=C2=A0

Reverse Mortgage Specialist and loan agent at Wymac Capital Inc.

I

found your contacts on the Linkedin professional network.=C2=A0MURACO=20

MEDICAL CO., LTD. is currently seeking an individual/company for the=20

part-time position of a representative in Canada/USA with great benefits

and attractive work hours. This opportunity allows for remote work,=20

enabling you to seamlessly integrate it with your existing job or daily=20

commitments.

If interested, contact

ANDREW COOPER

(=C2=A0
">andrew.cooper@muracomedical.com ) for more details and job descriptio=

n.

Best Regards,

Gary Slack
President at Longhorn Investments Inc.

MURACO MEDICAL CO., LTD.
Representative Required in CANADA/USA

--000000000000a294ab064080b031--

Credential phishing from Google Gmail

Posted by Dave Yadallee on Monday, October 6. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 06 Oct 2025 14:35:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5ruK-00000000O8T-3cIX

for dave@doctor.nl2k.ab.ca;

Mon, 06 Oct 2025 14:34:08 -0600

Resent-From: The Doctor

Resent-Date: Mon, 6 Oct 2025 14:34:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f197.google.com ([209.85.221.197]:57380)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5oAp-00000000CAK-3zFd

for doctor@nk.ca;

Mon, 06 Oct 2025 10:35:03 -0600

Received: by mail-vk1-f197.google.com with SMTP id 71dfb90a1353d-54a8d35ed64so7572727e0c.2

for ; Mon, 06 Oct 2025 09:34:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1759768443; x=1760373243; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=1y3fZu8F7mEIgRwyYd7HRsG1IDT82zMP05ooiWmXwPc=;

b=NjlNWe9cQAbiImGwj9n5ppFNM6j/nf0Poo4GQaJTfW5UTwIP6SQ/RLjDTy2fdjl1a4

43fdhbmxIjU0BSTiQ/G3WMtbFsBnBAnhnv3K4p0e4547C379Wg0qLvBRFjjM/0cjUBxk

ed7Iu1kWSDDHdVpJBPlnMb0T/sdH9dDiNY0MbTE34cZCTOVaZkS6XnvfbKS398RkkTSS

7OEKRXe7oj5ws8p0EvW36VqSUONbUfK2OWWQQ4qz+kUYTpWiGI9ZHxRyCwh8gk3wHcqK

rsqFNCVCSpbTUylVsqo2za6KQ1JxDBSZ8xSiA7dTEM7qDwBGTVM2Y+AAxRg/xN8fIElA

Pylw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1759768443; x=1760373243;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=1y3fZu8F7mEIgRwyYd7HRsG1IDT82zMP05ooiWmXwPc=;

b=hGHpPSmr7SXFaFSSDkC6g76SIjbCTZfBoiUjM0rVOnOqKEU503xFLetdIhA1lLRXfJ

cEpnx4jxHKSTcSjTPR7UErLBLn3NA+oc3hNBdvu9XA9qkGefcGyUXWIswWoxEmbHpG20

VT1EWiIGroSKXJlEzlsgUT2b9MgzH+PLgyUmsWbA9j3UUYJaIXh8i7ntK71PP7VF6UOF

x0jmVlAKG3x/m8Wkhb1vilHFnmCcIVUFsKRV5+apq1QGtbuuQI80ghzR4oit+Hh+JrLQ

X4Bn+vEWzQoWzyQTSwJxElrU9hZf2oPFUo/Z65dFU6yXyZDUsQx9r2IudNv9WP9E0Anp

1pPw==

X-Gm-Message-State: AOJu0YzV3wHpjhK1DnolKJqmS1S/7GQEkhukV55FEVvaAUc0gIaTwHC5

bDB0b57G6kgKHaP/UPkr/wxgUXKEFr/llfzsjI4q0AfQAynyDzzTIBVpNSfrmziQ+uBL6wdJU39

wMMPhlfbBrQ==

X-Google-Smtp-Source: AGHT+IElkWg7HLVfuHd+O/QLvg9YFmo+riaS+nSGTm+6cx+za5FPHHdcg2v+RG5S7trilvxIsZIbVQ3eFYNF5cA=

MIME-Version: 1.0

X-Received: by 2002:a05:6122:2025:b0:551:c3d0:acb8 with SMTP id

71dfb90a1353d-5524e8da8a9mr4563019e0c.6.1759768443471; Mon, 06 Oct 2025

09:34:03 -0700 (PDT)

Message-ID: <000000000000f5c65a0640800465@google.com>

Date: Mon, 06 Oct 2025 16:34:03 +0000

Subject: Reset your password for x02258-eva-02-1089159020573

From: noreply@x02258-eva-02-1089159020573.firebaseapp.com

To: doctor@nk.ca

Content-Type: multipart/alternative; boundary="000000000000f5c64e0640800462"

X-Spam_score: 5.4

X-Spam_score_int: 54

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello, Follow this link to reset your x02258-eva-02-1089159020573

password for your doctor@nk.ca account. https://x02258-eva-02-1089159020573.firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=T9hPfQ68bo1cL-vJhXT4EQ0VFN-TvY1BUajvhnTjttkAAAGZul95Yw&apiKey=AIzaSyBQuV_zuxDXIHzm72Beqvp4Kb9IkkzDuPA&lang

[...]

Content analysis details: (5.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.197 listed in list.dnswl.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

[209.85.221.197 listed in dnsbl.ahbl.org]

[209.85.221.197 listed in dnsbl.ahbl.org]

[209.85.221.197 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.221.197 listed in sa-trusted.bondedsender.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.221.197 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.197 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.221.197 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.221.197 listed in bl.score.senderscore.com]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible

phishing

Subject: {SPAM?} Reset your password for x02258-eva-02-1089159020573

--000000000000f5c64e0640800462

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Hello,

Follow this link to reset your x02258-eva-02-1089159020573 password for

your doctor@nk.ca account.

https://x02258-eva-02-1089159020573.firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=T9hPfQ68bo1cL-vJhXT4EQ0VFN-TvY1BUajvhnTjttkAAAGZul95Yw&apiKey=AIzaSyBQuV_zuxDXIHzm72Beqvp4Kb9IkkzDuPA&lang=en

If you didn't ask to reset your password, you can ignore this email.

Thanks,

Your x02258-eva-02-1089159020573 team

--000000000000f5c64e0640800462

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hello,

Follow this link to reset your x02258-eva-02-1089159020573 password for =

your doctor@nk.ca account.

ction?mode=3DresetPassword&oobCode=3DT9hPfQ68bo1cL-vJhXT4EQ0VFN-TvY1BUa=

jvhnTjttkAAAGZul95Yw&apiKey=3DAIzaSyBQuV_zuxDXIHzm72Beqvp4Kb9IkkzDuPA&a=

mp;lang=3Den'>https://x02258-eva-02-1089159020573.firebaseapp.com/__/auth/a=

ction?mode=3DresetPassword&oobCode=3DT9hPfQ68bo1cL-vJhXT4EQ0VFN-TvY1BUa=

jvhnTjttkAAAGZul95Yw&apiKey=3DAIzaSyBQuV_zuxDXIHzm72Beqvp4Kb9IkkzDuPA&a=

mp;lang=3Den

If you didn=E2=80=99t ask to reset your password, you can ignore this em=

ail.

Thanks,

Your x02258-eva-02-1089159020573 team

--000000000000f5c64e0640800462--

Credential phishing from Google Gmail

Posted by Dave Yadallee on Monday, October 6. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 06 Oct 2025 14:35:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5ruQ-00000000O9C-0bJP

for dave@doctor.nl2k.ab.ca;

Mon, 06 Oct 2025 14:34:14 -0600

Resent-From: The Doctor

Resent-Date: Mon, 6 Oct 2025 14:34:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f71.google.com ([209.85.222.71]:47272)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5oBb-00000000CGe-0QNw

for sales@nk.ca;

Mon, 06 Oct 2025 10:35:50 -0600

Received: by mail-ua1-f71.google.com with SMTP id a1e0cc1a2514c-8e2196b1f9eso7413900241.2

for ; Mon, 06 Oct 2025 09:34:56 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1759768490; x=1760373290; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=YYGjnH7lPFxRV6Zt5i+9bisLJ+zwpw5RdwKprfBs6EY=;

b=dt9cFlx/MeWzxn38gDD6spZzm0HPYWdcFrPHauogEOOgle5sY0ykbBsD6RDEL1X7dD

uxzxyKWBSpxpOaZz0+cquFFLiQu3XU8OcAKW6pyKGkHNRi6IeOs0Cw4HxTpwHzHbzfyJ

dCRk73tlrRZbAD2hrCWhMbXpMReoz78FCFn+7c0HX96n+nVh5lWiKLZH5hQSfHYNUHjx

TGgfnxaSe8IRocvJqaIGjalDcb3vF/BYn95vUZYLvcBMD67cmIH6g4zDeC3bB+3p12op

kwBrwP8DloNpPEbi6jQHNzT/+ib9AYq4rpWMLWkLLgXZ2t4SXD3ktVjes/FmixnxytoZ

jm8A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1759768490; x=1760373290;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=YYGjnH7lPFxRV6Zt5i+9bisLJ+zwpw5RdwKprfBs6EY=;

b=VJsTt1h4v6n2ZkpNdi+TZkb1Pf0Tx+0N8axLODe+KO2oWpqvhyIJGaJd0tjAFBkDco

GOY8ZOvAVrWo7StR9Y+ihJLVAOAOyaouW3lFVYjkrlJ8oSxqd+0RrEiLe9fM/tdtch++

Rw02MP0mOqtKL0+M8+jERFOJ4XXGX3dcIy65YNxnhD3s26B/wY3yIN5ve9OgYjYJDYoN

W1acDMvCkrEeunM1F4/fO+q1zVTN0V3Wnu5FsfNXKILrkLGpqSh0oZovML3ZfDiELTO7

6lwTh/5gPrgBSGlg6ViPwPpG1MiNHiKwcElneRjhpkylYjBXun+XBzPEFrSD3mocBwmh

HVmA==

X-Gm-Message-State: AOJu0Yzmmz3brnqiulQrtWIRU1c3VMyQb1ekvoexj5cnNIeMtPi3J92t

xPWIibbvOdke2M9fiFXs6YVea66Tqs6pOMhi4M5L61w6bxzFVVDzAgAGcVD8PQLTjIwPakGryKA

oFtwgKk2fMw==

X-Google-Smtp-Source: AGHT+IGD5RoApBeu7M/EjMTpnSf0ZrlBf8huELRkr8AKMhrY4LTMMSThjmZelqwWWjxuIznVli62cYO7EGwdANw=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:2909:b0:534:cfe0:f86c with SMTP id

ada2fe7eead31-5d41d03c5admr5182190137.15.1759768490519; Mon, 06 Oct 2025

09:34:50 -0700 (PDT)

Message-ID: <000000000000c3ab7f0640800762@google.com>

Date: Mon, 06 Oct 2025 16:34:50 +0000

Subject: Reset your password for x02278-eva-02-1089159020573

From: noreply@x02278-eva-02-1089159020573.firebaseapp.com

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000c3ab78064080075f"

X-Spam_score: 9.2

X-Spam_score_int: 92

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello, Follow this link to reset your x02278-eva-02-1089159020573

password for your sales@nk.ca account. https://x02278-eva-02-1089159020573.firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=KlaC6Lss2He1n1W2MpsaUSb-rN6WIoLvg4Q9MKf-VikAAAGZumAxNg&apiKey=AIzaSyCcAO5hKmRdrghBZ7wk1D0rlg_2sn2mNdY&lang

[...]

Content analysis details: (9.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.71 listed in list.dnswl.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.71 listed in wl.mailspike.net]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible

phishing

Subject: {SPAM?} Reset your password for x02278-eva-02-1089159020573

--000000000000c3ab78064080075f

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Hello,

Follow this link to reset your x02278-eva-02-1089159020573 password for

your sales@nk.ca account.

https://x02278-eva-02-1089159020573.firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=KlaC6Lss2He1n1W2MpsaUSb-rN6WIoLvg4Q9MKf-VikAAAGZumAxNg&apiKey=AIzaSyCcAO5hKmRdrghBZ7wk1D0rlg_2sn2mNdY&lang=en

If you didn't ask to reset your password, you can ignore this email.

Thanks,

Your x02278-eva-02-1089159020573 team

--000000000000c3ab78064080075f

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hello,

Follow this link to reset your x02278-eva-02-1089159020573 password for =

your sales@nk.ca account.

ction?mode=3DresetPassword&oobCode=3DKlaC6Lss2He1n1W2MpsaUSb-rN6WIoLvg4=

Q9MKf-VikAAAGZumAxNg&apiKey=3DAIzaSyCcAO5hKmRdrghBZ7wk1D0rlg_2sn2mNdY&a=

mp;lang=3Den'>https://x02278-eva-02-1089159020573.firebaseapp.com/__/auth/a=

ction?mode=3DresetPassword&oobCode=3DKlaC6Lss2He1n1W2MpsaUSb-rN6WIoLvg4=

Q9MKf-VikAAAGZumAxNg&apiKey=3DAIzaSyCcAO5hKmRdrghBZ7wk1D0rlg_2sn2mNdY&a=

mp;lang=3Den

If you didn=E2=80=99t ask to reset your password, you can ignore this em=

ail.

Thanks,

Your x02278-eva-02-1089159020573 team

--000000000000c3ab78064080075f--

Credential phishing from Google Gmail

Posted by Dave Yadallee on Monday, October 6. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 06 Oct 2025 14:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5ru9-00000000O65-2HVf

for dave@doctor.nl2k.ab.ca;

Mon, 06 Oct 2025 14:33:57 -0600

Resent-From: The Doctor

Resent-Date: Mon, 6 Oct 2025 14:33:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f71.google.com ([209.85.222.71]:42216)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5o5t-00000000BMf-0Ydj

for doctor@nl2k.ab.ca;

Mon, 06 Oct 2025 10:29:56 -0600

Received: by mail-ua1-f71.google.com with SMTP id a1e0cc1a2514c-90bceb0908eso7218428241.0

for ; Mon, 06 Oct 2025 09:29:02 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1759768136; x=1760372936; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=gAE4KaV6ZObpuAMYL7g2Wu6WAZS9CCRWGg+MENjnbKM=;

b=Aj/yVvEG8CUb9i3HNSOSUvHBJEdGb90qAHD55lkdmyPTSmN3rFsMUytsHBciqdEXJr

ckzVECWnXD1Ki5ES/AycGPUWYgM0PbYN2psNF1gBjGCFl4k8u5yEgoWhQjroi1tlGmxu

oqk8MNRVH8gaQOI9wY1VKpB62PSy6LlWUwQsAsGrOd9SD2DUX4cTajcPhingsUPv/fMF

dfGboHazyuU85zEkA8E/BqcPrLaRNEbLPWFP3nqh0U7sLgDiQceMSHJdtcN6hwdlzzkQ

3D871A6kUiqYd1SNcqYLLDoLCUXwhA7n/yVQVak1kdmCn2IIHr5i7dQ4qf/azSWwphdc

K/WA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1759768136; x=1760372936;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=gAE4KaV6ZObpuAMYL7g2Wu6WAZS9CCRWGg+MENjnbKM=;

b=ViCKL57QXTNzTAVypxLz6WTb5pVnAORQB6c/9+u4rLGvSrnfqIugFzz0ZlPa8wLmcu

3OcuSuKL0nnI9KvUCUSOW5PaaLwSKQQHEFhtB3O2sH+z7JRX7HuR09Lp1qeHZ3wq7w1r

mBX2LWPtZKS6x87eAswkutoflgJKPG8PiEwEkApq518qnC/yMjK7rTT1vPufCyfHrOCw

DWdvy3W2Dud78tfY8Tg6jkFYVRNf1i29yjB7SMN75JaawjxLxoD8YfuucV0gZZHyIrBP

rTpt8oKi9ZE1pVj3xNzWqc4FLjQwtYVgfVFCD68YwO+lUjksew9ZYK9/Ttkw2LL3eKRe

+R4Q==

X-Gm-Message-State: AOJu0YzmQFFLT6YqSND/yRrxufrWdUl3L02l3feiyQ6VhN2HlOKiTGj5

+0kVNRw9CgdGuZtTzUnZMlrDQY9bmQGjNla3aMyG+vl363p9rXLUoJe384YB+lfnlIMKozypeDS

JgpwLDMFNyw==

X-Google-Smtp-Source: AGHT+IFDP0vI+hd/1eQ/vgnyxmjDUUm6HhLHGVWSIhVdT/fDr4MUEdjLwLUBEQkuyn/G36x/2ezjhdZCFHKQqjo=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:3a14:b0:4e2:a235:24d1 with SMTP id

ada2fe7eead31-5d5d4cba04bmr142503137.4.1759768136660; Mon, 06 Oct 2025

09:28:56 -0700 (PDT)

Message-ID: <000000000000ac38c006407ff2c7@google.com>

Date: Mon, 06 Oct 2025 16:28:56 +0000

Subject: Reset your password for x02252-eva-02-1089159020573

From: noreply@x02252-eva-02-1089159020573.firebaseapp.com

To: doctor@nl2k.ab.ca

Content-Type: multipart/alternative; boundary="000000000000ac38b606407ff2c4"

X-Spam_score: 5.7

X-Spam_score_int: 57

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello, Follow this link to reset your x02252-eva-02-1089159020573

password for your doctor@nl2k.ab.ca account. https://x02252-eva-02-1089159020573.firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=DXNQZgeB-ZkX_OpC8OuRsVMAOSYC7G6nEbk1ajnUKBUAAAGZulrKrQ&apiKey=AIzaSyBTV7mBzR8PdXFY8ZtkXqwntCMiR7iDQEA&lang

[...]

Content analysis details: (5.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.71 listed in list.dnswl.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

[209.85.222.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.71 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

[209.85.222.71 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.222.71 listed in sa-trusted.bondedsender.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.222.71 listed in sa-accredit.habeas.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.71 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.71 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.222.71 listed in bl.score.senderscore.com]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.3 LONGWORD BODY: Uses overlong words

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

0.0 HTML_MESSAGE BODY: HTML included in message

3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible

phishing

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

Subject: {SPAM?} Reset your password for x02252-eva-02-1089159020573

--000000000000ac38b606407ff2c4

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Hello,

Follow this link to reset your x02252-eva-02-1089159020573 password for

your doctor@nl2k.ab.ca account.

https://x02252-eva-02-1089159020573.firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=DXNQZgeB-ZkX_OpC8OuRsVMAOSYC7G6nEbk1ajnUKBUAAAGZulrKrQ&apiKey=AIzaSyBTV7mBzR8PdXFY8ZtkXqwntCMiR7iDQEA&lang=en

If you didn't ask to reset your password, you can ignore this email.

Thanks,

Your x02252-eva-02-1089159020573 team

--000000000000ac38b606407ff2c4

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hello,

Follow this link to reset your x02252-eva-02-1089159020573 password for =

your doctor@nl2k.ab.ca account.

ction?mode=3DresetPassword&oobCode=3DDXNQZgeB-ZkX_OpC8OuRsVMAOSYC7G6nEb=

k1ajnUKBUAAAGZulrKrQ&apiKey=3DAIzaSyBTV7mBzR8PdXFY8ZtkXqwntCMiR7iDQEA&a=

mp;lang=3Den'>https://x02252-eva-02-1089159020573.firebaseapp.com/__/auth/a=

ction?mode=3DresetPassword&oobCode=3DDXNQZgeB-ZkX_OpC8OuRsVMAOSYC7G6nEb=

k1ajnUKBUAAAGZulrKrQ&apiKey=3DAIzaSyBTV7mBzR8PdXFY8ZtkXqwntCMiR7iDQEA&a=

mp;lang=3Den

If you didn=E2=80=99t ask to reset your password, you can ignore this em=

ail.

Thanks,

Your x02252-eva-02-1089159020573 team

--000000000000ac38b606407ff2c4--

Cloud credential phishing from Google Gmail

Posted by Dave Yadallee on Monday, October 6. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 06 Oct 2025 14:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5rtB-00000000NxJ-3cgS

for dave@doctor.nl2k.ab.ca;

Mon, 06 Oct 2025 14:32:57 -0600

Resent-From: The Doctor

Resent-Date: Mon, 6 Oct 2025 14:32:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f70.google.com ([209.85.217.70]:43334)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5muR-00000000PDP-1RAR

for support@nk.ca;

Mon, 06 Oct 2025 09:14:02 -0600

Received: by mail-vs1-f70.google.com with SMTP id ada2fe7eead31-5b431158f27so9833622137.1

for ; Mon, 06 Oct 2025 08:13:08 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1759763583; x=1760368383; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=OiOH5io2FHzTK4ziAPEuZZrkvq4hKw2WESJmINq7GX0=;

b=d5Tu9esiN9WBlLUsFOwNdO6z7Tb2XYnQgAvU2bHxTnGrOr5RXYZfs3TNVMcm1vUFWB

GpQk/T+06el7J7T/7J8NGWbZjpXLjj1hRRsu2sRy2mUoSlVkin2YMrnSMv/ElL6TyvLk

tEqhlxsd9+jFRUupXwkfdSZxd2qHuSp3AVELePUqXXdozpwqaXy7L2vammnHbhT4T6rq

uzhfQE89rsUfuw+kuwpbIQFUKu145upvyHsL4jM8J0aSrk7sl0zIbNCx9vL+Llch1vbl

FVBPfRDCHPw9TQXGz9xgC0YLzUOwHeBaXpVp1n00o3eIiT0Z8IvD7IVkZIeds33SfVJB

j2tQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1759763583; x=1760368383;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=OiOH5io2FHzTK4ziAPEuZZrkvq4hKw2WESJmINq7GX0=;

b=dnYORIHTCeIzllzAPgnRTv4kSRzjxTJk7rI3yDxBZqCuyH3u0fWaHWA2YZQZipPz7F

ymwQ/7mtbYtIRIbhRlFmXHjBqwolmwPFnA5iGIblQttRlOP5hjBGntYP6ylUTCsRax/7

K6P4eH3YCbDRa5E22TjYYd0B69UOftMnBfm5b2Vmo9TZxTwoFehJiyrXQzMuV9RjXm6i

Y/k5Ty8IPQsL0G2JXfFxsHVF5YXanPtQRvYwzlbA3ydeLV7K4MfpnEIhPWcHDdrMlkcZ

Hk6MoU+PrmdW48XSTEOnLc1JXU0Xr4R+EkZKKfub9AahKvHwwd8ruBzp9sF0s6HUQTqw

STBw==

X-Gm-Message-State: AOJu0YyEr03fxyZrfR9KNp+ClIINoHTj8UWHxQP5CaWWQm+rRpFdm1l9

upA7Zje/8gQkn92puzVN/wyoTjoHbgd9hhcSNyvNgis8aigAu84gw4yhXtb5/qqvRbZw3WlM3Wo

c4ZG65+Vjgw==

X-Google-Smtp-Source: AGHT+IF8aIaQNlJZMlGnkUs7qf6kgsmjK1ICg3p9dhfPnFXOhBLTdWtFgRvGvYyB5dZDLHIn4/1i4B2t83JlUgM=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:14a8:b0:52a:1104:3029 with SMTP id

ada2fe7eead31-5d41c17fc59mr5933612137.17.1759763582872; Mon, 06 Oct 2025

08:13:02 -0700 (PDT)

Message-ID: <0000000000003eedab06407ee329@google.com>

Date: Mon, 06 Oct 2025 15:13:02 +0000

Subject: =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Important_Update=3A_Your_Cloud_Storage_Is_Almos?=

=?UTF-8?Q?t_Full_=E2=80=93_Secure_Your_Files_Now?=

From: Cloud Notifications

To: support@nk.ca

Content-Type: multipart/alternative; boundary="0000000000003eeda306407ee326"

X-Spam_score: 10.2

X-Spam_score_int: 102

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Check Your Storage! Is It Reaching Full Capacity? Important

Alert Without sufficient storage, your new photos, videos, and documents

may no longer sync with the Cloud, and existing data may become inaccessible.

Content analysis details: (10.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

[209.85.217.70 listed in dnsbl.ahbl.org]

[209.85.217.70 listed in dnsbl.ahbl.org]

[209.85.217.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[209.85.217.70 listed in psbl.surriel.com]

2.1 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: cloudstorage-benachrichtigung6.eblink6.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.70 listed in wl.mailspike.net]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 HTML_MESSAGE BODY: HTML included in message

0.6 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

Subject: {SPAM?} =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Important_Update=3A_Your_Cloud_Storage_Is_Almos?=

=?UTF-8?Q?t_Full_=E2=80=93_Secure_Your_Files_Now?=

--0000000000003eeda306407ee326

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

Q2hlY2sgWW91ciBTdG9yYWdlISBJcyBJdCBSZWFjaGluZyBGdWxsIENhcGFjaXR5Pw0KDQoNCg0K

DQoNCkltcG9ydGFudCBBbGVydA0KDQoNCg0KDQpXaXRob3V0IHN1ZmZpY2llbnQgc3RvcmFnZSwg

eW91ciBuZXcgcGhvdG9zLCB2aWRlb3MsIGFuZCBkb2N1bWVudHMgbWF5IG5vICANCmxvbmdlciBz

eW5jIHdpdGggdGhlIENsb3VkLCBhbmQgZXhpc3RpbmcgZGF0YSBtYXkgYmVjb21lIGluYWNjZXNz

aWJsZS4NCg0KDQoNCkNvdW50IGRvd24NCg0KDQoNCkJhY2t1cCBEZXZpY2UNCg0KDQoNClZSIHNl

dA0KDQoNCg0KDQpSZWNvbW1lbmRhdGlvbg0KDQoNCg0KQmFjayB1cCBZb3VyIEltcG9ydGFudCBG

aWxlcyBhbmQgUGhvdG9zIFRvZGF5DQoNCg0KDQoNCkRvbid0IGxldCB5b3VyIENsb3VkIHN0b3Jh

Z2UgcmVhY2ggaXRzIG1heGltdW0gY2FwYWNpdHkuIFdlIHJlY29tbWVuZCB5b3UgIA0KY2hlY2sg

eW91ciBzdG9yYWdlIHNwYWNlIHRvIGVuc3VyZSBpdCBuZXZlciBiZWNvbWVzIGZ1bGwuIFRvIGF2

b2lkIGxvc3Mgb2YgIA0KaW1wb3J0YW50IGZpbGVzLCB5b3UgY2FuIGJvb3N0IHlvdXIgZGV2aWNl

J3Mgc3RvcmFnZSBzcGFjZSB3aXRoIGFuIGVuaGFuY2VkICANCnBsYW4uDQoNCg0KDQpHRVQgTU9S

RSBTVE9SQUdFIEhFUkUNCg0KDQoNCklmIHlvdSBwcmVmZXIgbm90IHRvIHJlY2VpdmUgZW1haWxz

IGxpa2UgdGhpcywgeW91IG1heSB1bnN1YnNjcmliZQ0KwqkgMjAyNS4gQWxsIHJpZ2h0cyByZXNl

cnZlZC4NCg0KDQoNCkZvbGxvdyB1cyBvbiBzb2NpYWwNCg0KDQoNCmZhY2Vib29rIHR3aXR0ZXIg

bGlua2VkaW4gaW5zdGFncmFtDQoNCg0KDQpUbyByZWNlaXZlIHRoZSBsYXRlc3QgZGVhbHMNCg0K

DQoNCg0K

--0000000000003eeda306407ee326

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

rn:schemas-microsoft-com:office:office" lang=3D"en">

0">

padding: 0; -webkit-text-size-adjust: none; text-size-adjust: none;">

cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace: 0pt; ms=

o-table-rspace: 0pt; background-color: #000000; background-size: auto; back=

ground-image: none; background-position: top left; background-repeat: no-re=

peat;">

lpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-l=

space: 0pt; mso-table-rspace: 0pt; background-color: #90e5ff;">

g=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace: =

0pt; mso-table-rspace: 0pt; border-radius: 0; color: #000000; width: 680px;=

margin: 0 auto;" width=3D"680">

; mso-table-rspace: 0pt; font-weight: 400; text-align: left; vertical-align=

: middle;">

ing=3D"10" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspac=

e: 0pt; mso-table-rspace: 0pt;">

Check You=

r Storage! Is It Reaching Full Capacity?

lpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-l=

space: 0pt; mso-table-rspace: 0pt; background-size: auto;">

g=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace: =

0pt; mso-table-rspace: 0pt; background-size: auto; color: #000000; width: 6=

80px; margin: 0 auto;" width=3D"680">

; mso-table-rspace: 0pt; font-weight: 400; text-align: left; padding-bottom=

: 5px; padding-top: 5px; vertical-align: middle;">

ont-size:1px;">

ing=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace=

: 0pt; mso-table-rspace: 0pt;">

Helvetica, sans-serif; font-size: 83px; font-weight: 700; letter-spacing: =

normal; line-height: 1.5; text-align: center; margin-top: 0; margin-bottom:=

0; mso-line-height-alt: 125px;">
=3D"word-break: break-word;">
ng6.eblink6.com/openurl?lid=3D6196488250851328&nid=3D6427073904902144&" tar=

get=3D"_blank" style=3D"text-decoration: none; color: #0cc5ff;" rel=3D"noop=

ener">
break-word; position: relative;" id=3D"c1d82565-23c9-4d12-ae7b-118610840a03=

" data-position=3D"20-0-1" data-qa=3D"tinyeditor-root-element">
=3D"tinyMce-placeholder" style=3D"word-break: break-word;">Important Alert<=

/span>

dding=3D"10" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lsp=

ace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">

s-serif;font-size:26px;font-weight:400;letter-spacing:0px;line-height:1.2;t=

ext-align:center;mso-line-height-alt:31px;">

blink6.com/openurl?lid=3D6196488250851328&nid=3D6427073904902144&" target=

=3D"_blank" style=3D"text-decoration: none; color: #ffffff;" rel=3D"noopene=

r">Without sufficient storage, your new photos, videos, and documents may n=

o longer sync with the Cloud, and existing data may become inaccessible.
>

g=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace: =

0pt; mso-table-rspace: 0pt;">

udstorage-benachrichtigung6.eblink6.com/openurl?lid=3D6196488250851328&nid=

=3D6427073904902144&" target=3D"_blank">

cloudfront.net/templates/default/8831/TimerBanner04-ezgif.com-resize__1_.gi=

f" style=3D"display: block; height: auto; border: 0; width: 100%;" width=3D=

"578" alt=3D"Count down" title=3D"Count down" height=3D"auto">

ng=3D"10" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace=

: 0pt; mso-table-rspace: 0pt;">

enachrichtigung6.eblink6.com/openurl?lid=3D6196488250851328&nid=3D642707390=

4902144&" target=3D"_blank" style=3D"color:#ffffff;text-decoration:none;"><=

!--[if mso]>

as-microsoft-com:office:word" href=3D"https://cloudstorage-benachrichtigun=

g6.eblink6.com/openurl?lid=3D6196488250851328&nid=3D6427073904902144&" sty=

le=3D"height:54px;width:186px;v-text-anchor:middle;" arcsize=3D"7%" fill=3D=

"false">

ze:22px">

border-bottom: 2px solid #ffffff; border-left: 2px solid #ffffff; border-ra=

dius: 4px; border-right: 2px solid #ffffff; border-top: 2px solid #ffffff; =

color: #ffffff; display: inline-block; font-family: Arial, Helvetica, sans-=

serif; font-size: 22px; font-weight: 400; mso-border-alt: none; padding-bot=

tom: 5px; padding-top: 5px; padding-left: 20px; padding-right: 20px; text-a=

lign: center; width: auto; word-break: keep-all; letter-spacing: normal;"><=

span style=3D"word-break: break-word; line-height: 44px;">Backup Device
an><=

/div>

ont-size:1px;">

g=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace: =

0pt; mso-table-rspace: 0pt;">

tigung6.eblink6.com/openurl?lid=3D6196488250851328&nid=3D6427073904902144&"=

target=3D"_blank">

rk-and-security-1-2/32/Network_and_Security_Cloud_Warning-512.png" style=3D=

"display: block; height: auto; border: 0; width: 100%;" width=3D"238" alt=

=3D"VR set" title=3D"VR set" height=3D"auto">

lpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-l=

space: 0pt; mso-table-rspace: 0pt; background-size: auto;">

g=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace: =

0pt; mso-table-rspace: 0pt; background-size: auto; border-radius: 0; color:=

#000000; width: 680px; margin: 0 auto;" width=3D"680">

; mso-table-rspace: 0pt; font-weight: 400; text-align: left; padding-bottom=

: 5px; padding-top: 5px; vertical-align: top;">

ont-size:1px;">

dding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspa=

ce: 0pt; mso-table-rspace: 0pt; word-break: break-word;">

ht:15px;padding-top:15px;">

s-serif;font-size:32px;font-weight:400;letter-spacing:0px;line-height:1.8;t=

ext-align:center;mso-line-height-alt:58px;">

blink6.com/openurl?lid=3D6196488250851328&nid=3D6427073904902144&" target=

=3D"_blank" style=3D"text-decoration: none; color: #0cc5ff;" rel=3D"noopene=

r">Recommendation

ing=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace=

: 0pt; mso-table-rspace: 0pt;">

:10px;text-align:center;width:100%;">

Helvetica, sans-serif; font-size: 71px; font-weight: 700; letter-spacing: =

normal; line-height: 1.2; text-align: center; margin-top: 0; margin-bottom:=

0; mso-line-height-alt: 85px;">
igung6.eblink6.com/openurl?lid=3D6196488250851328&nid=3D6427073904902144&" =

target=3D"_blank" style=3D"text-decoration: none; color: #ffffff;" rel=3D"n=

oopener">
k: break-word; position: relative;" id=3D"c4dfb215-2731-4a34-bf9c-bb54ddb99=

e0a" data-position=3D"30-0-2" data-qa=3D"tinyeditor-root-element">Back up Y=

our Important Files and Photos Today

dding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspa=

ce: 0pt; mso-table-rspace: 0pt; word-break: break-word;">

ght:10px;padding-top:10px;">

s-serif;font-size:23px;font-weight:400;letter-spacing:0px;line-height:1.8;t=

ext-align:center;mso-line-height-alt:41px;">

blink6.com/openurl?lid=3D6196488250851328&nid=3D6427073904902144&" target=

=3D"_blank" style=3D"text-decoration: none; color: #ffffff;" rel=3D"noopene=

r">
Don't let your Cloud storage reach its maximum capacity. We recommen=

d you check your storage space to ensure it never becomes full. To avoid lo=

ss of important files, you can boost your device's storage space with an en=

hanced plan.

dding=3D"15" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lsp=

ace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">

s-serif;font-size:17px;font-weight:400;letter-spacing:0px;line-height:1.2;t=

ext-align:center;mso-line-height-alt:20px;">

ng=3D"10" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace=

: 0pt; mso-table-rspace: 0pt;">

enachrichtigung6.eblink6.com/openurl?lid=3D6196488250851328&nid=3D642707390=

4902144&" target=3D"_blank" style=3D"color:#000000;text-decoration:none;"><=

!--[if mso]>

as-microsoft-com:office:word" href=3D"https://cloudstorage-benachrichtigun=

g6.eblink6.com/openurl?lid=3D6196488250851328&nid=3D6427073904902144&" sty=

le=3D"height:48px;width:296px;v-text-anchor:middle;" arcsize=3D"8%" fillcol=

or=3D"#0cc5ff">

ze:19px">

er-bottom: 1px solid #0cc5ff; border-left: 1px solid #0cc5ff; border-radius=

: 4px; border-right: 1px solid #0cc5ff; border-top: 1px solid #0cc5ff; colo=

r: #000000; display: inline-block; font-family: Arial, Helvetica, sans-seri=

f; font-size: 19px; font-weight: 400; mso-border-alt: none; padding-bottom:=

5px; padding-top: 5px; padding-left: 20px; padding-right: 20px; text-align=

: center; width: auto; word-break: keep-all; letter-spacing: normal;">
style=3D"word-break: break-word; line-height: 38px;">GET MORE STORAGE HERE=

<=

/a>

ont-size:1px;">

lpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-l=

space: 0pt; mso-table-rspace: 0pt;">

g=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace: =

0pt; mso-table-rspace: 0pt; border-radius: 0; color: #000000; width: 680px;=

margin: 0 auto;" width=3D"680">

le-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; =

padding-bottom: 5px; padding-top: 5px; vertical-align: middle;">

dding=3D"10" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lsp=

ace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">

s-serif;font-size:16px;font-weight:400;letter-spacing:0px;line-height:1.2;t=

ext-align:left;mso-line-height-alt:19px;">

cellpadding=3D"10" cellspacing=3D"0" role=3D"presentation" style=3D"mso-ta=

ble-lspace: 0pt; mso-table-rspace: 0pt;">

=3D"presentation" style=3D"mso-table-lspace: 0pt; mso-table-rspace: 0pt;">

dding=3D"10" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lsp=

ace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">

s-serif;font-size:14px;font-weight:400;letter-spacing:0px;line-height:1.5;t=

ext-align:left;mso-line-height-alt:21px;">

If you prefer not to receive emails like this, you =

may
olor: #6a6a71;" rel=3D"noopener">unsubscribe
=C2=A9 2025. All rights=

reserved.

ble-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left;=

padding-bottom: 5px; padding-top: 5px; vertical-align: middle;">

dding=3D"10" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lsp=

ace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">

s-serif;font-size:16px;font-weight:400;letter-spacing:0px;line-height:1.2;t=

ext-align:left;mso-line-height-alt:19px;">

Follow us on social

ng=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace:=

0pt; mso-table-rspace: 0pt;">

ght:10px;padding-top:15px;text-align:left;">

" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace: 0pt; m=

so-table-rspace: 0pt; display: inline-block;">

dding=3D"10" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lsp=

ace: 0pt; mso-table-rspace: 0pt; word-break: break-word;">

s-serif;font-size:16px;font-weight:400;letter-spacing:0px;line-height:1.2;t=

ext-align:left;mso-line-height-alt:19px;">

To receive the latest deals

--0000000000003eeda306407ee326--

Web/SEO/App Spam from Microsoft Outlook

Posted by Dave Yadallee on Monday, October 6. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 06 Oct 2025 14:35:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5rv2-00000000OEh-1a4n

for dave@doctor.nl2k.ab.ca;

Mon, 06 Oct 2025 14:34:52 -0600

Resent-From: The Doctor

Resent-Date: Mon, 6 Oct 2025 14:34:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japanwestazolkn19012059.outbound.protection.outlook.com ([52.103.66.59]:15092 helo=OS8PR02CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5oxk-00000000KG7-3AJU;

Mon, 06 Oct 2025 11:25:38 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=Yc3spccPS6dN8O0yZ4T8oxiFQN7cyGZQ2MT3gYCambvAlVepqi7HM06HFEw8DWOTqOLyZ+Ub/0/VfbHMuI3yiHjwA4DU8zGLjw/1RRDqaj7uWfcvmV7DwTQ61llQEQd2FpNWESAnWgZAFzFAaEBQeCOuIO8P1JM+Oaj4+/t1CmLraKRz9rGz0nMv+NDDyf832RDMI1SoYIOB39hEDg/oW68BqoRFuOn5JCsFWxCUp8JHWnPi/IlY0cEAii96D38BHX1T0cydpXki1RzI8ChaDI/3Q9lnmny+Ore5vDLV99MNFTlm+J5nqP8BadWJXGiNgHUgQDbZtoQsqF3hpNmHvA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=/X2ueM6Z+uvFH2uOHI7AeBezTliLneaOdwXkqazKG7w=;

b=ye01RVX5Z+Y/AVxlHZJU+p20cEbmM8LU1s+hXASBX83SfQJ7nK5iN+izHOuH6aTu17Hzw7Hum8XljcQwFWz/1mXelicaaxiTEz89q/eKEmOXrTAwLVo35GJdVo1kDdIGZ02J7INdruKjSixGqlRBPgHgFeSkWSa3nRd8ecvifZ2Km/PA5ZtAxqFR4vRGhZARukogEnh7EhjsaMGy4FHaAkfqWAr9rq96JZBhFuRsfeDY4ZIdoiIVdneavMAYcg3uuHDBdLbk22mmeR7tc6JgGQtYONJygX6rq4Jbh0u0d/Wwb4Cdd7U3iPKvuSIT5rJSu0UGONe+bivnWbtbcBGWXA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=/X2ueM6Z+uvFH2uOHI7AeBezTliLneaOdwXkqazKG7w=;

b=BjxscN3esEV+JK3Gpie1Jj/vRUZte9G+fTLZnSPpYAi/xxGLmSEOqtm6NWWQgoTCffdR2FC8bI438p2LLm1pjG1wNlhIenKMqSWU9IwJ+MROsccPGaJRPqkWATqRFQPXI/Yp3FX/uwosuGiNtSmHhWX4gDrp6V4AjitpARBDR5TY+o/fug5kBnvGXKj1A5u9n1EG+BYNxOS8GkbuODhVCuz1C/0+3v0nvb2jq+fIP3prqFTZaSOQ4j2rZkvYenoXAY4npK0GN6sGYQfQpKyX4qCiF7VdDQRdxbNGu6YffoFZRpfD4Mpk0VfEzFkscYHpJ5OSz93Sv2/xT3Ot64ffWA==

Received: from KU2PPFD50CD05E4.apcprd04.prod.outlook.com (2603:1096:d18::568)

by KL1PR04MB7584.apcprd04.prod.outlook.com (2603:1096:820:125::8) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9182.20; Mon, 6 Oct

2025 17:24:06 +0000

Received: from KU2PPFD50CD05E4.apcprd04.prod.outlook.com

([fe80::3e7a:be82:7616:befe]) by KU2PPFD50CD05E4.apcprd04.prod.outlook.com

([fe80::3e7a:be82:7616:befe%5]) with mapi id 15.20.9115.020; Mon, 6 Oct 2025

17:24:06 +0000

From: saloni kaur

To: saloni kaur

Subject: interested YES

Thread-Topic: interested YES

Thread-Index: AQHcNuYCXMDdPEej/UOUU3Y/AMnTTg==

Date: Mon, 6 Oct 2025 17:24:05 +0000

Message-ID:

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-exchange-messagesentrepresentingtype: 1

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: KU2PPFD50CD05E4:EE_|KL1PR04MB7584:EE_

x-ms-office365-filtering-correlation-id: e3542e3f-84b3-4dbd-3e32-08de04fd26e6

x-microsoft-antispam:

BCL:0;ARA:14566002|19110799012|461199028|31061999003|15030799006|8062599012|8060799015|15080799012|51015399003|40105399003|39105399003|3412199025|440099028|102099032|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?KjBkThViWyGhVf8doekyxB/LCjBlbarGvavIw599oPprpx0ZEG+SRN9Y?=

=?Windows-1252?Q?d4blztibQ6zrvaFz69iIBq7IF3C0w8ay+YC47do2R0Fpj9GJwnfC+ZOE?=

=?Windows-1252?Q?UbaFkOQDoUS358Bnaf6BRgzYYvG4srlNh3ZhX7gtPIU0TuwNojSm4Z1K?=

=?Windows-1252?Q?/XSOA8RHKb9Zgb5bSAp43pOGA5Ivuq1kuZGnFDog0EvBw7wsbc37/zSh?=

=?Windows-1252?Q?lONwktiku3S9Sq3rxR77DEeIUSNzgKcmLJ7quB9UjFIkXI4FRkL3iYlP?=

=?Windows-1252?Q?LCHNqdB4BNMbOT4JXUN/iJT2mji07OnLPZI5h8LqNOFaLOEKz9dGaWTr?=

=?Windows-1252?Q?QXeEsQ0ZAy+gQ4Y50MMe3e5oqetTwVvTXvoPKsi0TnBBQOMA5vRG1auD?=

=?Windows-1252?Q?QYWZjNRUuH4FUKBsw+bF8ikplPLKoD2ssAbN4IxphbPggg75tNMGD7do?=

=?Windows-1252?Q?0acqo2b6KZIVT4OWAjoN/Nj0pU1b3AfNQ810EHH26fKrovyDi2CVF3Il?=

=?Windows-1252?Q?UTphaAvPNUecYJ7E84d8KBu263IYzD/Z0i/Up2eZTr2bY+f8wPkXbDp/?=

=?Windows-1252?Q?QEqLM1MUvOhW31eTaX5O/2OcovoDce0BtzRTe/ymL6zomBqCnCkmH8ap?=

=?Windows-1252?Q?A1l+KVSQoL19Pb9L22nbcshXtAtJQ6NqtTQy8j2B+y0zPtBisoVNeSc9?=

=?Windows-1252?Q?czaEmfKLWw2RXfGdZtfZpfWfjr6I51djPtVBZDGnlF4JVxuJwR5MEhMD?=

=?Windows-1252?Q?phYA5Vz8E9fAqbW5XLyTxVSdlFyTGXg4CuITemC4FTKsDbF0t80i1Esd?=

=?Windows-1252?Q?gdogqiPjr5ulukGPd45kiVwIQQRSXLFa3nQ0/QProFv8WYg1jo/whorS?=

=?Windows-1252?Q?yg8IczvFztmwOw3ArqfRkrvW5KjcckGWHi7tUOTEKQ1wiFngyU6bpxFX?=

=?Windows-1252?Q?dYq319jZRIf/Skv+ewSVzgnePPYUNjCG9v1VPGUd5pqXlTw8+lSZ3SkN?=

=?Windows-1252?Q?F8rDS2n+GrgxiyARSZRKzHL7X4R0eD9d54QF1EHiz/j/4gzNDgTWOxUg?=

=?Windows-1252?Q?ck9VyHsF+Mf2jGqhSR13VUlp66IdNRZ8ImFWcaWMq36XLUOYMBNaBORH?=

=?Windows-1252?Q?0z1ukX/YWUmmrx3s/0sUsI9E5hW8yQ+nSQcTpbL4aOXVFZS4RufzgGBQ?=

=?Windows-1252?Q?nMie5jBzuk8g5OwkSwib5gZpFKZFtKpe7MejTFSe9X5vpNY2VQRrMb0I?=

=?Windows-1252?Q?2nC0j3F1fPxt+SNx/GjxgkQj2VJbp+fv6i0SZ88bq847GdP8/+z0BWRo?=

=?Windows-1252?Q?6Dxb1D9vVzHsPF0kl0oKLWlvB4H6p4K+yT3T563gZ5s7TACDDMPfNA0/?=

=?Windows-1252?Q?5aUC/OKe1LFWfg=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?U7Bhqee5iE6hSIJ1hpU3sKQ4EMfRSbdNk9S0rmpWq+65hv+qbtPGjGv3?=

=?Windows-1252?Q?qceLN8AiNgv9iSfYvQ9h7IJTTwZIVH+mIQxfnFxcITZq/2rKBxnu954W?=

=?Windows-1252?Q?Xv3pNv1t1kP1OYCqnMDqSehAkm52qKpAlN1pu8146Xufz4IQVG2hac98?=

=?Windows-1252?Q?ccr/roVSSBAGHEMBwebTFx3ATq1YN3/weiEbHCJtEnvOMQO4AVL0SIzf?=

=?Windows-1252?Q?pWluRhoQNBuQBO6xHolS+REksMP3dDAlQYT3HoFV/K2KTfAQc5Qhheew?=

=?Windows-1252?Q?nEjOMiZsv3CC8eB8L5twMYvwvrS451eZ5BmhYlBBCqnAJnEIW58So8E5?=

=?Windows-1252?Q?HhcIURIeCV8BPSd9xiQayKpImsBnWCj1Iw5L5ghYwaZntpoaMFJX1PTR?=

=?Windows-1252?Q?ogwr3zTLUklndi62HfiyoBRmYhCZ8cL62/8gn4dRSBwUfYEXA4xin9eJ?=

=?Windows-1252?Q?u1OoL3tSr9ueGLEYzPwOBOd9nJi4PXA61foyqXdRoDZiowh2nriZ7aak?=

=?Windows-1252?Q?BjwX4ZIAUkmJLfqIAWwQrq1SblHXByIKVBfFu9WnC1yPIKZX5E/Ckh7m?=

=?Windows-1252?Q?lKdqs6Rd5sH+bGrBpZBySSChLxaa9Lg03PxqYtWuk6p6ZHZR6ZvFjwH9?=

=?Windows-1252?Q?Ar2HX00M+hfUq82/sPB9yBp13zekedlLeE1WNTnU59+4VtqYtNr3lohK?=

=?Windows-1252?Q?V3sn3ki2wAKoJJX1ZyLn6l0lAvF/GXcrI+6rlGswvHFln7WUsqTIDcMp?=

=?Windows-1252?Q?dpS7xFvUcN/D1uOnMp7J3B0CAJyJkPUZ9e7dbVI3zBuGeOBMZqFDBsp0?=

=?Windows-1252?Q?A6bKxU+AT+lIHPxkZHYc/l+KfhUrE3dbrJSUExEXz9aEJwkKZlQKHYA9?=

=?Windows-1252?Q?wNL5IeeucpE/DrRJJI9vZwBxlJIhdrVJjC/xDF7bsrpzm5TM6Fay7O2n?=

=?Windows-1252?Q?c4wJ4Ve3eONP+jjx44W/+ORJTPLtYwV8yjPbL/SZiN0ruLzlGWDzuypD?=

=?Windows-1252?Q?/2cQwZWnBNUL3YokWDI7bFJKgRfbtmL0SpVrZWvdweUTeBZb3ASc6dfy?=

=?Windows-1252?Q?51H4C6HJP4/FCGq6UMwYDmPGtkkw00Q/QK9DCNHleKf6KHhYiR/hA67h?=

=?Windows-1252?Q?9AYC9WvLlG1NnsUocRoZ7egSVzh55M6GUy8ThB9ZBwEl17Pdj/U3h93p?=

=?Windows-1252?Q?4gV7J6p8Rod4txHn0DsSaSBdboPcj6k4lxc6hJ3LqkY8k1gSR0bRITLB?=

=?Windows-1252?Q?+UE1N37NXPnyo4bwbj2JuPH5YnOYbRGZHAJ99xq51m0lNueq0lfwNwcf?=

=?Windows-1252?Q?vffnfbelYzN7STVE1s6tWoAoSQ5sJ+1ppeBNGysRp0qoCsKbJ0cM6+El?=

=?Windows-1252?Q?U/Sv3N8gBkaKgC/90BPRSR5nJSMkQIHaX44=3D?=

Content-Type: multipart/alternative;

boundary="_000_KU2PPFD50CD05E47F8718B1C16C221B60E6C8E3AKU2PPFD50CD05E4_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: KU2PPFD50CD05E4.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: e3542e3f-84b3-4dbd-3e32-08de04fd26e6

X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Oct 2025 17:24:05.8913

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: KL1PR04MB7584

--_000_KU2PPFD50CD05E47F8718B1C16C221B60E6C8E3AKU2PPFD50CD05E4_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable

Hi there,

I checked your website and believe your business has great potential.

I=92d love to send you a SEO proposal to help improve your website and get=

it on the first page of Google.

May I send a quote .? if interested

Sincerely,

--_000_KU2PPFD50CD05E47F8718B1C16C221B60E6C8E3AKU2PPFD50CD05E4_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable

252">

, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class=3D"el=

ementToProof">

Hi there,

, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class=3D"el=

ementToProof">

I checked your website and believe your business has great potential.=

, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class=3D"el=

ementToProof">

I=92d love to send you a SEO proposal to help improve your website an=

d get it on the first page of Google.

, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class=3D"el=

ementToProof">

May I send a quote .? if interested

, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class=3D"el=

ementToProof">

Sincerely,

color: rgb(0, 0, 0);" class=3D"elementToProof">

--_000_KU2PPFD50CD05E47F8718B1C16C221B60E6C8E3AKU2PPFD50CD05E4_--

Cloud credential phishing from Google Gmail

Posted by Dave Yadallee on Monday, October 6. 2025

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 06 Oct 2025 14:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5rt1-00000000NvQ-2EF1

for dave@doctor.nl2k.ab.ca;

Mon, 06 Oct 2025 14:32:47 -0600

Resent-From: The Doctor

Resent-Date: Mon, 6 Oct 2025 14:32:47 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f69.google.com ([209.85.217.69]:56452)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1v5mor-00000000OFs-27Lu

for doctor@netknow.ca;

Mon, 06 Oct 2025 09:08:12 -0600

Received: by mail-vs1-f69.google.com with SMTP id ada2fe7eead31-59d4df51326so8144195137.0

for ; Mon, 06 Oct 2025 08:07:22 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1759763236; x=1760368036; darn=netknow.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=q43teUcZ12Y4bneMNvR2wllyKYg1rPClyMHvi/OQTDU=;

b=fK9TscfVOAv0+U7jep1szu4NDxJgkvdoFwhDKxm3YJukAj7T3OSe1iH1DO0nOZUwQL

g+zgEPZSQqE+pl7f6h9Z2a9WFzODagLsZ0wXnIk/i7mEPYNbproMWrpaL6N0jHDaKkIk

+IgJrQuh0lYXud9wu/MrAUDD2kAgVQQzNAg85vYo+/hlV7tUfkdyr53sXdMF94w0pbqb

rpcfhGyvC0/9C7CtUXW5Vsx8U057ZJJYWJyiU8C3A0/mFwMJknBEGDRuUfbXy7mRcCsb

eXQ51d6ObZAjRHkpPsAo8y/FT7z8dWAnjZSbIXiRiLDcfU1eydgPCnmtj5LXKakuRwnX

6ilw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1759763236; x=1760368036;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=q43teUcZ12Y4bneMNvR2wllyKYg1rPClyMHvi/OQTDU=;

b=ikjnIYFk5pOjJvKvLBSvAXK04Mj/JKq09317q/FMQLI9IIm5ISmo6MxTGj+zIxX4Hd

ud7UFAUpZ0UmzRYfdX9JfKK8h9GFuCFoNBUD0ZV4wUV4//IXs3sSIlFUvFqHX78HZnEl

9vQR07lehuDXxBblXyfBBe3izuNX/P4kCfLSMvveuzHLOCI8O7pDyldsctpqcBOW8Qta

nqCdkMS6sI0q9u3grNUpZBoxSzn6KGn3M5IYImBtIgc7caUS8OBUgE/GEk3WT2fzAmxv

T6vVE7NhLGKGbvvI3Lu2GEzqwD9tgO6TZXQ9lr1a7XCOKnXLW1rH2LbX4zsIFR0gmmpU

wIHA==

X-Gm-Message-State: AOJu0Yw2rmIsisXK3BQrolY++vjO+qoaWkwjtnm54hTEfxekFR2MNaBN

wZv5Jela9ixkF0TB9hs7Y2F7/ZAhXOrtU2x/4aPJNBPYFZLnxLMOALmnByOQ9MOmjaap+vrrSBl

O/BYhOnwFqw==

X-Google-Smtp-Source: AGHT+IEqrxp1DINv4cwKbG4Wbny6zDh+SA5rysztoEWPIyYJLCJRPbgBmUZ0Muk7pzc0D7vdNCh2/ShrpxfPK80=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:952:b0:529:bfd2:382a with SMTP id

ada2fe7eead31-5d41d1344bamr5166715137.32.1759763236243; Mon, 06 Oct 2025

08:07:16 -0700 (PDT)

Message-ID: <00000000000095cf3706407ece95@google.com>

Date: Mon, 06 Oct 2025 15:07:16 +0000

Subject: =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Important_Update=3A_Your_Cloud_Storage_Is_Almos?=

=?UTF-8?Q?t_Full_=E2=80=93_Secure_Your_Files_Now?=

From: Cloud Notifications

To: doctor@netknow.ca

Content-Type: multipart/alternative; boundary="00000000000095cf2d06407ece92"

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Check Your Storage! Is It Reaching Full Capacity? Important

Alert Without sufficient storage, your new photos, videos, and documents

may no longer sync with the Cloud, and existing data may become inaccessible.

Content analysis details: (7.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

[209.85.217.69 listed in dnsbl.ahbl.org]

[209.85.217.69 listed in dnsbl.ahbl.org]

[209.85.217.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.217.69 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

[209.85.217.69 listed in will-spam-for-food.eu.org]

2.1 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: cloudstorage-benachrichtigung6.eblink6.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.0 HTML_MESSAGE BODY: HTML included in message

0.6 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

Subject: {SPAM?} =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Important_Update=3A_Your_Cloud_Storage_Is_Almos?=

=?UTF-8?Q?t_Full_=E2=80=93_Secure_Your_Files_Now?=

--00000000000095cf2d06407ece92

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

Q2hlY2sgWW91ciBTdG9yYWdlISBJcyBJdCBSZWFjaGluZyBGdWxsIENhcGFjaXR5Pw0KDQoNCg0K

DQoNCkltcG9ydGFudCBBbGVydA0KDQoNCg0KDQpXaXRob3V0IHN1ZmZpY2llbnQgc3RvcmFnZSwg

eW91ciBuZXcgcGhvdG9zLCB2aWRlb3MsIGFuZCBkb2N1bWVudHMgbWF5IG5vICANCmxvbmdlciBz

eW5jIHdpdGggdGhlIENsb3VkLCBhbmQgZXhpc3RpbmcgZGF0YSBtYXkgYmVjb21lIGluYWNjZXNz

aWJsZS4NCg0KDQoNCkNvdW50IGRvd24NCg0KDQoNCkJhY2t1cCBEZXZpY2UNCg0KDQoNClZSIHNl

dA0KDQoNCg0KDQpSZWNvbW1lbmRhdGlvbg0KDQoNCg0KQmFjayB1cCBZb3VyIEltcG9ydGFudCBG

aWxlcyBhbmQgUGhvdG9zIFRvZGF5DQoNCg0KDQoNCkRvbid0IGxldCB5b3VyIENsb3VkIHN0b3Jh

Z2UgcmVhY2ggaXRzIG1heGltdW0gY2FwYWNpdHkuIFdlIHJlY29tbWVuZCB5b3UgIA0KY2hlY2sg

eW91ciBzdG9yYWdlIHNwYWNlIHRvIGVuc3VyZSBpdCBuZXZlciBiZWNvbWVzIGZ1bGwuIFRvIGF2

b2lkIGxvc3Mgb2YgIA0KaW1wb3J0YW50IGZpbGVzLCB5b3UgY2FuIGJvb3N0IHlvdXIgZGV2aWNl

J3Mgc3RvcmFnZSBzcGFjZSB3aXRoIGFuIGVuaGFuY2VkICANCnBsYW4uDQoNCg0KDQpHRVQgTU9S

RSBTVE9SQUdFIEhFUkUNCg0KDQoNCklmIHlvdSBwcmVmZXIgbm90IHRvIHJlY2VpdmUgZW1haWxz

IGxpa2UgdGhpcywgeW91IG1heSB1bnN1YnNjcmliZQ0KwqkgMjAyNS4gQWxsIHJpZ2h0cyByZXNl

cnZlZC4NCg0KDQoNCkZvbGxvdyB1cyBvbiBzb2NpYWwNCg0KDQoNCmZhY2Vib29rIHR3aXR0ZXIg

bGlua2VkaW4gaW5zdGFncmFtDQoNCg0KDQpUbyByZWNlaXZlIHRoZSBsYXRlc3QgZGVhbHMNCg0K

DQoNCg0K

--00000000000095cf2d06407ece92

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

rn:schemas-microsoft-com:office:office" lang=3D"en">

0">

padding: 0; -webkit-text-size-adjust: none; text-size-adjust: none;">

cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace: 0pt; ms=

o-table-rspace: 0pt; background-color: #000000; background-size: auto; back=

ground-image: none; background-position: top left; background-repeat: no-re=

peat;">