Web/SEO/App spam from Microsoft Outlook Part 3

Posted by Dave Yadallee on



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

Thank you!



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">







ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">











; color:rgb(0,0,0)">

From: kapial kumar <kapialkumsr.web@outlook.com>


Sent: Thursday, February 19, 2026 11:53 PM


Subject: Marketing Proposal and Pricing Details


 





ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

Hi,



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">







ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

Do you want more leads and online visibility?



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">







ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

We=92re specialists in SEO, PPC, Content Marketing, and Social Media cam=

paigns.



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">







ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

If interested, I can share a proposal with pricing.



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">







ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

Best,



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

Kapial



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">














--_000_SEZPR01MB7557DD9462EB9DFBF297F916EE0F2SEZPR01MB7557apcp_--

Web/SEO/App spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 May 2026 04:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQNOJ-00000000C9n-3OUj

for dave@doctor.nl2k.ab.ca;

Fri, 22 May 2026 04:46:07 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 May 2026 04:46:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japanwestazolkn19012056.outbound.protection.outlook.com ([52.103.66.56]:15962 helo=OS8PR02CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQIZh-00000000Bd8-2ZpH

for root@nk.ca;

Thu, 21 May 2026 23:37:44 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=Fq71Oz1MzpmWp/+UnKG6Nq++/qLlVp+B1fCpTyg4FzS1KkeK2Aim1QbUMJcLiDlwZc3dz/X1YeVref8rbNxxfWF4jx3sbtwz8kQ1lxqtwd5C8VUP03i9sjLxARre0hDRgzkB5QuDWQeXuiWiR9A5myYN3kk/HsdREWKcbMXNDeGVwcAsJq7EEZ4pRhdcjTIHZG/6neBElYGiUK4WNEo3QiPhDO20d6wv3wJAxlluaPzfyUoW2rqjndrMc1NQeXKtkBtYL+1GxrGs+zHvrQDmkYnHSPNkgZrXAmEwtfvKBBzCPRXDfleH0CjXmnVmBCnzemv89vEbACursDDVWz4g0g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=t0GcX6fUORxEAksv/r1T6T5jYVvy7QSAGc24gQr1V1Q=;

b=Va0mMz/PggoOoMaLADj4im9kaT2/bvBXWwwvOyrQMbpP0+NPoSFWrUSPcuQiW6buJOao3rR71ZxIhesxPbVzvs6X3A+1T52Xcj8bAQkxvaFVIk8Nc4NqZskerebfvCiojSOpnUclqqMlZ6CgxD0kd/zs8BviXy3UF+5B9dgjgE3Bbq/YlbI3cUyhdOrUiH/Jbt7+gNq0AHigXBJiBCFN1Hv1s8ibyKKFbX5x6vSywsJif0Bo992oHhrjufF20Y0F5AksB9UTtf6oCD2hCsgnd35r5qF+HCi8wiU9YANYnFtXLjQt73Rn8qeqImJB7XclljQS3DhTUBD0odYpYaKktQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=t0GcX6fUORxEAksv/r1T6T5jYVvy7QSAGc24gQr1V1Q=;

b=qOMwsJT5ifdnT/1vWIu+ifH8guyofyuANHcFP+pbBSW9W/ZsFSgQV5vD8SqqzG8JCWbPAU6I5iFkqf7XUtKXWJrSPA/UDILOUOU8HtbccUCrYD68ZZ7Gi22nEK2DwHqGzKAQTcpbyvxr2e9AmZ2U7IPeB+yktqLQGUQhU2mI9JCHuqQ3m0HfwS9gdykkeoH2AGC+LSLqqvs/uNh0M4ivwniW3lm8TTmNYqlvVc7xmHsYVfqKFB+53G7D/QfB3iBxJwTSHbq5AuIM8IkhMwmoaGLpCEELP3mqLUf75rLqGAD5qHwRGySkh7GAp6u41C02frXeVNDYwXONgpSQeuFRdQ==

Received: from SEZPR01MB7557.apcprd01.prod.exchangelabs.com

(2603:1096:101:29f::11) by KUZPR01MB7945.apcprd01.prod.exchangelabs.com

(2603:1096:d10:61::22) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.17; Fri, 22 May

2026 05:34:45 +0000

Received: from SEZPR01MB7557.apcprd01.prod.exchangelabs.com

([fe80::5b1b:767e:d52e:a80b]) by SEZPR01MB7557.apcprd01.prod.exchangelabs.com

([fe80::5b1b:767e:d52e:a80b%3]) with mapi id 15.21.0025.012; Fri, 22 May 2026

05:34:45 +0000

From: kapial kumar

Subject: Re: Marketing Proposal and Pricing Details

Thread-Topic: Marketing Proposal and Pricing Details

Thread-Index:

AQHcwQ2rNGXAdIXlFEqaPjZDVwTb/7XImiROgAeY6E6AAAHJhIADWSKQgAACfh+ARkNPcA==

Date: Fri, 22 May 2026 05:34:22 +0000

Message-ID:



References:





























In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SEZPR01MB7557:EE_|KUZPR01MB7945:EE_

x-ms-office365-filtering-correlation-id: 1211e765-6151-4689-8abe-08deb7c3d434

x-microsoft-antispam:

BCL:0;ARA:14566002|16051099003|55001999006|24021099003|8062599012|2604032031799003|19110799012|704163111799003|20031999006|8060799015|31061999003|24121999003|39105399006|37011999003|22091999003|7071999006|24071999003|15030799006|15080799012|31055399003|40105399003|43065399003|440099028|3412199025|102099032;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?0pQnrO7GKQnueuCqtYcHB2wFjIHTkDuyrg6rDT6DCCp/SHGK8XZoNwvb?=

=?Windows-1252?Q?ongYLZX3lre0rCca/H283Y6j1L5c+w9C47hHoU+LwU8VQSfTYR0c1B+B?=

=?Windows-1252?Q?CGilw0i8lCBQjW61gVD1QLGnnJPZNVz1mxUmIdhjTEgd3eriJ/NXX/4y?=

=?Windows-1252?Q?2ERfy1JveTNsFzUvtvVUY51fsiKscouNwVHKByt6Uf4MiGaFmMDNd53s?=

=?Windows-1252?Q?VSxPZMHYGdhXaklBOrn3QdPDSBtZI4JWd9umYi+EeVzrlQEbAqK/QtH1?=

=?Windows-1252?Q?8GOFE/6yYZ7yqsEeWXBNHCZYON5i03Ye9gPTgWcsKLHbgCkpOiv1zjAk?=

=?Windows-1252?Q?wmMrvADMppbEWyGAJgEiDM+dx/IgJ4Kny57MuWWGkUl76FLJQ3MRlbxB?=

=?Windows-1252?Q?Mo8/tH8jjTZllZP0MBWD4cmt4LS3nWTM4DAtFyYdue7d5zRKMKHiqrNS?=

=?Windows-1252?Q?/RQ/R6sYTMwm/0fPr0sO/i0ViuRWhmTUeaAuaY756Ufk2AxwRtSfTJeb?=

=?Windows-1252?Q?Hi3MkcpmDoTNmtQipaPqYrlieYSDxXw229oFXB2ypzOUhZ2ison5h1Hx?=

=?Windows-1252?Q?0fyKUb7OlAWqgx/85q7sDV1EbPu2ohT8uevnOXLjZkKvWuyAJkxWMogM?=

=?Windows-1252?Q?0RN7XUEwRW/AbYM2RTGiHjkQES6tJXWTj03ya+1jqJxGi/0eztrF2/hz?=

=?Windows-1252?Q?zoeUbsI+SNBU4HxxUblIJndkkPKuWvwHXGgxjm8uhYqela/WC+GDx0oD?=

=?Windows-1252?Q?ob19TKMMpShhjjSAVa/4vNO6JNM3jRpjTDeRLk1j6J9tfNZSZXqSDFne?=

=?Windows-1252?Q?vccccEFzRM6mlLdFQnHR/+Omp166/rowgDDsiKK96yDzjhrcc8snkuWo?=

=?Windows-1252?Q?oPcvCh5rTgWljeavUi9W3kySQ2Qfdh9Ilublh1FQSBbMGx6Q8ITC96cD?=

=?Windows-1252?Q?mEnGAB6KPiqIJ80LboyrzJJN1h+rMFfbBkbU+dGkJGro/TGrEO3YPFrp?=

=?Windows-1252?Q?SCGvjvzP0TWPR4EPDkIrxL4Z7h4RjTT/RIT5cIALzaWJiUyRLfZgS0CS?=

=?Windows-1252?Q?2Cy7Qd8TDTBS9rmtqOIG9DbXB2iXm2pbMnpGdJ0ex5NqxUqMK5oUyve1?=

=?Windows-1252?Q?GgI1AJERUgsghPlsdbPFDOU0r4F1sfF2QAI5t6uQA67ohJxXPrqWQ1M9?=

=?Windows-1252?Q?Wt9JqcnbAFIGtM7Aka5ULfPqeOKjTQEYOSpEHy/1BUGaESgwIXrdlK6Q?=

=?Windows-1252?Q?gJPHtotFn5nZd80xSSRRgsyMR68GKUttdmDeoy2EL0l57Elm2W3mLmPS?=

=?Windows-1252?Q?MgP4jIDJ7y5CD2uCwTr/H/Jsbgf2Z0rfACyn+4oKzTrL4meGVqPuzfzQ?=

=?Windows-1252?Q?Y+7LCu1mktvKDeM0UysTaBNiQRqzCDb09vzoWxhXHUpF1vbLZyTMsH0v?=

=?Windows-1252?Q?0jsa6Y7N+vE0zggsw/QXQuoZHysE99LqBz9hrbUM+2A=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?uTKRL6XZCz1MrsZdYRJjstF/d2lyb1SqWRT7iz0OsA8P1ehfstwTXacu?=

=?Windows-1252?Q?gonZ/24OMXcyafU+YFjBsd+eS9F++kicbad9R94x+tmTgLHmCMYETdr8?=

=?Windows-1252?Q?JdWKkxMlbeR3WjgJAC9Buj+nzQdAWGtShSW61VinSl5ZV5Vsut/beG25?=

=?Windows-1252?Q?z3EOLO9E+W/eyItF49IbKIN9EQdWOYSJRL5owrhdu6qG08LsRuADj7Bj?=

=?Windows-1252?Q?VdcBSXvHlEq5xtpTgmqSrfhIPI93P60S9gjZbXlz3JnXjqM3tMkRmCbV?=

=?Windows-1252?Q?IA2mQ59COkpfNh2LBTdCf2Ys0gMtSnh/SJ35CsX1lCDpz2WJvYpKY+2T?=

=?Windows-1252?Q?3vOcBCbGgNO6v5EPRHxKj18VIeiFzQrig6q1OXnKSSdc9I3q4QVGfysB?=

=?Windows-1252?Q?ezcOOmh+q+M0RewyuTXiS4hkOKShEwIhg06pQknVHF5G80WZpdx84GYx?=

=?Windows-1252?Q?UUEDkGloPxgBEMOUd390GRkxXM4S3onJhaTyvk+lgnMztGDIzj7rQdpF?=

=?Windows-1252?Q?fgiPIy5gDoqmZNaV1ShYqvMvYsKgypurQb+a9RaEOv10z5IkdoZnKnvX?=

=?Windows-1252?Q?fInwaPLfz1Wp4ag3PY9E+rbiVqsdUGu8RaJ4mTsZ9l8bMHfI37PIPU4t?=

=?Windows-1252?Q?5VQjb+Z7mjXRxUyDDwgt4jtPxti6GhiiEpwY04qIPLRDmYe6HIBBlweG?=

=?Windows-1252?Q?c9h8D2EFtFNEGb3hqkX/71hjThKQRL4jiq+u1eXUFI9oVxtRn0RREv9w?=

=?Windows-1252?Q?Qfx1bvX1CCZqNfcuhrFsd5awZma51tM5PNbWSVgAhqgOunXeaENeAr8Z?=

=?Windows-1252?Q?ADIEdm70jAERScBrZr5kRE63qEdr1xxQYCJfE0cLdwgmGAfK4Cspn49d?=

=?Windows-1252?Q?oH8oALjiuHdgyyya7L+Vhc1LaByzrIQzQMfwmElxBqn3FvlA5TW3pubB?=

=?Windows-1252?Q?EKfIaFiwX5hRygV6c8sP0jfYVl2Kg21yDOc5ISYJg463gTz0J+FHWmQ4?=

=?Windows-1252?Q?ARnOHR3LWtD9HJ8VFswSCBALjsVQYumVZt4Pdnin6N95PJ3haRMS458d?=

=?Windows-1252?Q?rq16HPbGOMxagTJKoU8uf+m8q/oWzqRtXfzJEARqPak02BNOJxa8+TiK?=

=?Windows-1252?Q?KfHjZddbZb+8+6tq09s/ApFmnhij4Ca41YvZkEBJqB50SxKGlbtPRRVh?=

=?Windows-1252?Q?4oYbV/epSBcPCSv3QDhloAOjElwIK36S8qFi0w+VEQNXt4pZ/w03/4Vw?=

=?Windows-1252?Q?av3CA5f+8pJB+UCY3DR9GRGfkBp8H3SGzPyST0UG4Qc+qVc0vv0KONTS?=

=?Windows-1252?Q?paOqy0IC7UXt16g9T6CEd9UWtqLE3DrrM4MESpLjBUSZKkq52VLY/exb?=

=?Windows-1252?Q?nbB5O2LH2CaMVrwDusmCu/XSD2oFiSw5peaG0Qz1mAZVPR7XEt2cI7to?=

=?Windows-1252?Q?rU52GptEie8A0/AaKYjcLBmAVuwwXe6Jw/YvBsF9aXszCh4aUWZ0AwZt?=

=?Windows-1252?Q?kz4ATunuOZOOTij8jWZJlUHkfU5eN3M34ZW3XvyGq3BEjrqERY2JxdUq?=

=?Windows-1252?Q?xI5yEq/5xsyis0wr?=

Web/SEO/App spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on
Content-Type: multipart/alternative;

boundary="_000_SEZPR01MB7557DD9462EB9DFBF297F916EE0F2SEZPR01MB7557apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SEZPR01MB7557.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 1211e765-6151-4689-8abe-08deb7c3d434

X-MS-Exchange-CrossTenant-originalarrivaltime: 22 May 2026 05:34:22.3831

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: KUZPR01MB7945



--_000_SEZPR01MB7557DD9462EB9DFBF297F916EE0F2SEZPR01MB7557apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,



Following up on my previous email. Let me know if you'd like more details o=

n our SEO, PPC, and social media services.



Thanks!



________________________________

From: kapial kumar

Sent: Tuesday, April 7, 2026 5:53 PM

Subject: Re: Marketing Proposal and Pricing Details



Hi,



May I share our pricing, company details, and a few case studies for your r=

eference?



Please let me know.



Thank you!





________________________________

From: kapial kumar

Sent: Thursday, February 19, 2026 11:53 PM

Subject: Marketing Proposal and Pricing Details



Hi,



Do you want more leads and online visibility?



We=92re specialists in SEO, PPC, Content Marketing, and Social Media campai=

gns.



If interested, I can share a proposal with pricing.



Best,

Kapial





--_000_SEZPR01MB7557DD9462EB9DFBF297F916EE0F2SEZPR01MB7557apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Hi,



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Following up on my previous email. Let me know if you'd like more details o=

n our

SEO, PPC, and social media services.



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Thanks!



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">











yle=3D"font-size:11pt" color=3D"#000000">From: kapial kumar <kapi=

alkumsr.web@outlook.com>


Sent: Tuesday, April 7, 2026 5:53 PM


Subject: Re: Marketing Proposal and Pricing Details

 









nt,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:=

rgb(0,0,0)">

Hi,



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">







ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

May I share our pricing, company details, and a few case studie=

s for your reference?



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">







ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

Please let me know.



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">




Document phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 21 May 2026 21:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQGce-000000002X0-2SNA

for dave@doctor.nl2k.ab.ca;

Thu, 21 May 2026 21:32:28 -0600

Resent-From: The Doctor

Resent-Date: Thu, 21 May 2026 21:32:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvtnrb.outbound-mail.sendgrid.net ([149.72.114.91]:60388)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQEYn-00000000PLr-1sS6

for doctor@nl2k.ab.ca;

Thu, 21 May 2026 19:20:29 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=empverify.com;

h=subject:from:mime-version:content-type:date:to:cc:content-type:date:

from:subject:to;

s=s1; t=1779412720;

bh=iv4LvqVjGodypmUgYOths5WMgxCKkkmBTxarGGtbEiQ=;

b=kAvLQkWTpftw5lq8YAwtsQxUpEErxSNJmqkL83NC59AObFJz2qOYdSvTVbPxg1mFbA1j

K7u/AHMgJUMx3raJZyZa5hs1s+g4G7Mp7pCxM9QcvBaxUOXytJyhNl2YVhBvUIW2nQSgQo

z4PW3W4TzXfcprErBCJ26BZ/5MdJnbjBKfD+LHSUxjZ5yWeJ6qpg8dxzyNzacsgMp/bXmm

kQ9OB8nFRQqp8OlTrWS2daEMT/b78Ldn00D+J7AT1J4WfFfFoLnU9VKto8ZzKs7SifFctk

wMMQGL2GmJuJ8blvekZAavgVaaIo7DvCZW8vw9LDi5/Jsqy2+fGw4wq4VO7Nigrw==

Received: by recvd-6dc99dfcc-kmflc with SMTP id recvd-6dc99dfcc-kmflc-1-6A0FAEF0-57

2026-05-22 01:18:40.636401412 +0000 UTC m=+2000838.168727825

Received: from [185.161.208.213] (unknown)

by geopod-ismtpd-0 (SG)

with ESMTP id G0l_Rt7MQq-ti815lW-3Qg

for ;

Fri, 22 May 2026 01:18:40.563 +0000 (UTC)

Subject:

From: Doctor

MIME-Version: 1.0

Content-Type: multipart/related; boundary="===============67409873226141853702=="

Message-ID:

Date: Fri, 22 May 2026 01:18:40 +0000 (UTC)

X-SG-EID:

=?us-ascii?Q?u001=2EtEEv7EM7uSpW62rZ7UH0GP=2FJ=2Fh9mnSsjb2wcFT=2FPQAMNaIViiXhxGwGmf?=

=?us-ascii?Q?DvfEPFIf4gjizz20yJIibEdrhPm2A0mESfdi=2FO2?=

=?us-ascii?Q?JrVFX1PYn8hPIi9MH9IdN=2FoMz+5AGJIUsAlwZC2?=

=?us-ascii?Q?ot5jMTgHoPkTIT19kgsuKQZBJ69pj+62qok3qhP?=

=?us-ascii?Q?Rc3VMxXJ=2F50JjN6HHmCHiavml2WmcMKfPuDm+ZP?=

=?us-ascii?Q?8AHxQuKffnN4yb75keKkAQ=3D?=

To: doctor@nl2k.ab.ca

X-Entity-ID: u001.aET258zFD/ldDHwUwbLSRw==

X-Spam_score: 33.3

X-Spam_score_int: 333

X-Spam_bar: +++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Doctor Internal Update



Content analysis details: (33.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

[185.161.208.213 listed in dnsbl.ahbl.org]

[185.161.208.213 listed in dnsbl.ahbl.org]

[185.161.208.213 listed in dnsbl.ahbl.org]

[149.72.114.91 listed in dnsbl.ahbl.org]

[149.72.114.91 listed in dnsbl.ahbl.org]

[149.72.114.91 listed in dnsbl.ahbl.org]

[149.72.114.91 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[149.72.114.91 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.114.91 listed in bl.score.senderscore.com]

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?}



Doctor Logo

Doctor

Internal Update

Document Ready for Review



Hi Doctor,



A new file has been added to your Doctor workspace and is now ready for review.



Please review the document before it expires on May 21, 2026.

Review Document →

Doctor

Automated Notice



Document phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 21 May 2026 21:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQGca-000000002Wl-1pve

for dave@doctor.nl2k.ab.ca;

Thu, 21 May 2026 21:32:24 -0600

Resent-From: The Doctor

Resent-Date: Thu, 21 May 2026 21:32:24 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzhsq.outbound-mail.sendgrid.net ([159.183.224.100]:38836)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQEYs-00000000PLq-2qQz

for doctor@doctor.nl2k.ab.ca;

Thu, 21 May 2026 19:20:34 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=empverify.com;

h=from:subject:mime-version:content-type:date:to:cc:content-type:date:

from:subject:to;

s=s1; t=1779412720;

bh=TDTNaJqSUnr4JCy7vVZdJIgZ25XLTNRsQmbVV5vO+JE=;

b=U2quqwC8rXYyP8tZ64/KuVWKxsusMP7wyi9a6cWI0CFO0QYYMTaBPKPP6F7xp8G5FWlQ

U7nzDd2k72H7sTdOrI/CCZmAHNqDolmXdiVUIHiKG/3J29VItFlJ9o0j/GPIBXS1QeRHJK

8oGM3u/8vMEKfogVS4D1Uaw+9i8NTjzzQYIZ0JSLwybUNumCDGpLpcX6vEiTWZrrOqrnsK

+f4u9THpJPiqSkKdDX1Je3i7aLWQZuHin+32bChYwXrLWp9r3wXryknvUPgMdLZFN0fQUy

CJU8GNIVKctaeYSkX1fpd3cy95lvkSSePanLamWbLAg6pderit1a6EmPqrVxUpCg==

Received: by recvd-5744f687b-9rlmj with SMTP id recvd-5744f687b-9rlmj-1-6A0FAEF0-44

2026-05-22 01:18:40.505790118 +0000 UTC m=+2000490.984851486

Received: from [185.161.208.213] (unknown)

by geopod-ismtpd-16 (SG)

with ESMTP id bxIIZDTASSywXUxHuMxk9w

for ;

Fri, 22 May 2026 01:18:40.391 +0000 (UTC)

From: Doctor

Subject:

MIME-Version: 1.0

Content-Type: multipart/related; boundary="===============45158735235125019587=="

Message-ID:

Date: Fri, 22 May 2026 01:18:40 +0000 (UTC)

X-SG-EID:

=?us-ascii?Q?u001=2EtEEv7EM7uSpW62rZ7UH0GP=2FJ=2Fh9mnSsjb2wcFT=2FPQAMNaIViiXhxGwGmf?=

=?us-ascii?Q?DvfEPFIHXHL5TkWSp+tS0enx7ezPjl5otVfQE9P?=

=?us-ascii?Q?+hOPHzWPwgzJWGB7a1x3DtbQ2J+8CQ1OhbJPWtn?=

=?us-ascii?Q?oncSnQwm3zCdItD0Yy1BM1y=2FvaE+Gib3MPcvmFX?=

=?us-ascii?Q?VuKE4UkzmCm2U1lnrKesY8aEkQLVhfa2xyc6b3P?=

=?us-ascii?Q?3IspgR+hZut1qs5AryQHh4=3D?=

To: doctor@doctor.nl2k.ab.ca

X-Entity-ID: u001.aET258zFD/ldDHwUwbLSRw==

X-Spam_score: 33.1

X-Spam_score_int: 331

X-Spam_bar: +++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Doctor Internal Update



Content analysis details: (33.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

[185.161.208.213 listed in dnsbl.ahbl.org]

[185.161.208.213 listed in dnsbl.ahbl.org]

[185.161.208.213 listed in dnsbl.ahbl.org]

[159.183.224.100 listed in dnsbl.ahbl.org]

[159.183.224.100 listed in dnsbl.ahbl.org]

[159.183.224.100 listed in dnsbl.ahbl.org]

[159.183.224.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.224.100 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[159.183.224.100 listed in wl.mailspike.net]

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?}



From:

Doctor

Date:

5/21/26, 19:18

To:

doctor@doctor.nl2k.ab.ca



Doctor Logo

Doctor

Internal Update

Document Ready for Review



Hi Doctor,



A new file has been added to your Doctor workspace and is now ready for review.



Please review the document before it expires on May 21, 2026.

Review Document →

Doctor

Automated Notice

Nagindas Khandwala College phish From Google User

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 May 2026 11:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQTz1-000000001NC-2hD4

for dave@doctor.nl2k.ab.ca;

Fri, 22 May 2026 11:48:27 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 May 2026 11:48:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 138.191.192.35.bc.googleusercontent.com ([35.192.191.138]:59290 helo=[10.88.0.4])

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wQPQi-00000000P02-3vZE

for root@nk.ca;

Fri, 22 May 2026 06:56:52 -0600

Content-Type: multipart/related; boundary="===============1254440665516529268=="

MIME-Version: 1.0

From: "Nagindas Khandwala College ."

To: root@nk.ca

Subject: =?utf-8?q?Completed=3A_Shared_via_ShareFile_=E2=80=93_Nagindas_Khandwala_College_shared_a_summary-Bonus=5FStatement=5F2026=2Epdf__Contact=2E?=

X-Priority: 2

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Reimbursement Summary Nagindas Khandwala College shared a

summary Shared from Nagindas Khandwala College Finance • 23 May, 2026



Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.4 MISSING_DATE Missing Date: header

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

[35.192.191.138 listed in dnsbl.ahbl.org]

[35.192.191.138 listed in dnsbl.ahbl.org]

[35.192.191.138 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 TVD_RCVD_IP Message was received from an IP address

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.192.191.138 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.8 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

1.0 XPRIO Has X-Priority header

0.2 HELO_MISC_IP Looking for more Dynamic IP Relays

Subject: {SPAM?} =?utf-8?q?Completed=3A_Shared_via_ShareFile_=E2=80=93_Nagindas_Khandwala_College_shared_a_summary-Bonus=5FStatement=5F2026=2Epdf__Contact=2E?=



--===============1254440665516529268==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



Nagindas Khandwala College shared a summary

Shared from Nagindas Khandwala College Finance • 23 May, 2026

Hi Root, your reimbursement summary for the current period is available.



Two items need additional documentation before processing.

XLSX

Reimbursement_Summary_Root_2026.xlsx

310 KB • Spreadsheet

2 sheets • Updated today

Open in Excel

Shared from Nagindas Khandwala College. If you were not expecting this email, you can safely ignore it.

Canada Revenue Agency Phish from Japan

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 21 May 2026 16:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQBuJ-000000003YA-3Fh4

for dave@doctor.nl2k.ab.ca;

Thu, 21 May 2026 16:30:23 -0600

Resent-From: The Doctor

Resent-Date: Thu, 21 May 2026 16:30:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp1.kagoya.net ([153.127.234.3]:43938)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQA4G-00000000JeR-4A1h

for www@nl2k.ab.ca;

Thu, 21 May 2026 14:32:42 -0600

Received: from kagoya.net (act03.kagoya.net [133.18.75.69])

by smtp1.kagoya.net (Postfix) with ESMTPA id 56490608AB5D1;

Fri, 22 May 2026 05:26:55 +0900 (JST)

MIME-Version: 1.0

Message-ID: <20260521202655.0002E129.0152@kagoya.net>

Date: Fri, 22 May 2026 05:26:55 +0900

From: "Canada Revenue Agency (CRA)"

To:

Subject: Important Document

Content-Type: multipart/alternative;

boundary="-----ELU8WU74L82UYT.RFTZEWYE25FQ28T0_0_0002E129"

X-Priority: 3

X-MAILER: Active! mail



This is a multi-part message in MIME format.



-------ELU8WU74L82UYT.RFTZEWYE25FQ28T0_0_0002E129

Content-Type: text/plain; charset=US-ASCII

Content-Transfer-Encoding: 7bit





Changes On Your Canada Revenue Agency (CRA)

Canada Revenue Agency (CRA) sent you an important document to review and sign.

Review Document

If you have any questions or need assistance, feel free to contact us.

CRA

Canada Revenue Agency



Please do not reply to this email, as it is for notification purposes only.

This is an automated notification. Please do not reply to this message directly.



-------ELU8WU74L82UYT.RFTZEWYE25FQ28T0_0_0002E129

Content-Type: text/html; charset=US-ASCII

Content-Transfer-Encoding: 7bit









Changes On Your Canada Revenue Agency (CRA) 




Canada Revenue Agency (CRA) sent you an important document to review and sign.



If you have any questions or need assistance, feel free to contact us.

CRA
Canada Revenue Agency





 



Please do not reply to this email, as it is for notification purposes only.


This is an automated notification. Please do not reply to this message directly.















-------ELU8WU74L82UYT.RFTZEWYE25FQ28T0_0_0002E129--



Canada revenue phish from Japan

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 21 May 2026 16:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQBuD-000000003XX-18PZ

for dave@doctor.nl2k.ab.ca;

Thu, 21 May 2026 16:30:17 -0600

Resent-From: The Doctor

Resent-Date: Thu, 21 May 2026 16:30:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp3.kagoya.net ([]:44344)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQA8E-00000000K2y-1nGQ

for doctor@nl2k.ca;

Thu, 21 May 2026 14:36:46 -0600

Received: from kagoya.net (act02.kagoya.net [133.18.75.68])

by smtp3.kagoya.net (Postfix) with ESMTPA id 03C69663319B7;

Fri, 22 May 2026 05:26:24 +0900 (JST)

MIME-Version: 1.0

Message-ID: <20260521202623.0000F8AB.0116@kagoya.net>

Date: Fri, 22 May 2026 05:26:23 +0900

From: "Canada Revenue Agency (CRA)"

To:

Subject: Important Document

Content-Type: multipart/alternative;

boundary="-----FVNGIR5OT.RN46RKMCSQKPF7A3.09SJ_0_0000F8AB"

X-Priority: 3

X-MAILER: Active! mail



This is a multi-part message in MIME format.



-------FVNGIR5OT.RN46RKMCSQKPF7A3.09SJ_0_0000F8AB

Content-Type: text/plain; charset=US-ASCII

Content-Transfer-Encoding: 7bit





Changes On Your Canada Revenue Agency (CRA)

Canada Revenue Agency (CRA) sent you an important document to review and sign.

Review Document

If you have any questions or need assistance, feel free to contact us.

CRA

Canada Revenue Agency



Please do not reply to this email, as it is for notification purposes only.

This is an automated notification. Please do not reply to this message directly.



-------FVNGIR5OT.RN46RKMCSQKPF7A3.09SJ_0_0000F8AB

Content-Type: text/html; charset=US-ASCII

Content-Transfer-Encoding: 7bit









Changes On Your Canada Revenue Agency (CRA) 




Canada Revenue Agency (CRA) sent you an important document to review and sign.



If you have any questions or need assistance, feel free to contact us.

CRA
Canada Revenue Agency





 



Please do not reply to this email, as it is for notification purposes only.


This is an automated notification. Please do not reply to this message directly.















-------FVNGIR5OT.RN46RKMCSQKPF7A3.09SJ_0_0000F8AB--



Canada Revenue Phish from Japan

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 21 May 2026 16:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQBuD-000000003XX-18PZ

for dave@doctor.nl2k.ab.ca;

Thu, 21 May 2026 16:30:17 -0600

Resent-From: The Doctor

Resent-Date: Thu, 21 May 2026 16:30:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp3.kagoya.net ([153.127.234.5]:44344)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQA8E-00000000K2y-1nGQ

for doctor@nl2k.ca;

Thu, 21 May 2026 14:36:46 -0600

Received: from kagoya.net (act02.kagoya.net [133.18.75.68])

by smtp3.kagoya.net (Postfix) with ESMTPA id 03C69663319B7;

Fri, 22 May 2026 05:26:24 +0900 (JST)

MIME-Version: 1.0

Message-ID: <20260521202623.0000F8AB.0116@kagoya.net>

Date: Fri, 22 May 2026 05:26:23 +0900

From: "Canada Revenue Agency (CRA)"

To:

Subject: Important Document

Content-Type: multipart/alternative;

boundary="-----FVNGIR5OT.RN46RKMCSQKPF7A3.09SJ_0_0000F8AB"

X-Priority: 3

X-MAILER: Active! mail



This is a multi-part message in MIME format.



-------FVNGIR5OT.RN46RKMCSQKPF7A3.09SJ_0_0000F8AB

Content-Type: text/plain; charset=US-ASCII

Content-Transfer-Encoding: 7bit





Changes On Your Canada Revenue Agency (CRA)

Canada Revenue Agency (CRA) sent you an important document to review and sign.

Review Document

If you have any questions or need assistance, feel free to contact us.

CRA

Canada Revenue Agency



Please do not reply to this email, as it is for notification purposes only.

This is an automated notification. Please do not reply to this message directly.



-------FVNGIR5OT.RN46RKMCSQKPF7A3.09SJ_0_0000F8AB

Content-Type: text/html; charset=US-ASCII

Content-Transfer-Encoding: 7bit









Changes On Your Canada Revenue Agency (CRA) 




Canada Revenue Agency (CRA) sent you an important document to review and sign.



If you have any questions or need assistance, feel free to contact us.

CRA
Canada Revenue Agency





 



Please do not reply to this email, as it is for notification purposes only.


This is an automated notification. Please do not reply to this message directly.















-------FVNGIR5OT.RN46RKMCSQKPF7A3.09SJ_0_0000F8AB--



Company representative spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 21 May 2026 13:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQ9Tp-00000000Fm4-35tE

for dave@doctor.nl2k.ab.ca;

Thu, 21 May 2026 13:54:53 -0600

Resent-From: The Doctor

Resent-Date: Thu, 21 May 2026 13:54:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [122.199.230.242] (port=38580 helo=mail.vtopia.co.kr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQ8uJ-00000000Btq-19Bi

for root@nk.ca;

Thu, 21 May 2026 13:18:21 -0600

Received: by mail.vtopia.co.kr (Postfix, from userid 1002)

id 82D17346A7; Thu, 21 May 2026 08:01:44 -1100 (SST)

Received: from [62.60.130.106] (unknown [62.60.130.216])

by mail.vtopia.co.kr (Postfix) with ESMTPA id 1D7382941A

for ; Thu, 21 May 2026 08:01:39 -1100 (SST)

Content-Type: multipart/mixed; boundary="===============1949812648329625108=="

MIME-Version: 1.0

Subject: COMPLY IF INTERESTED

From: Jacob Cheng

To: root@nk.ca

Reply-To: jacobcheng717@gmail.com

Disposition-Notification-To: stowefitzgerald@gmail.com

Return-Receipt-To: stowefitzgerald@gmail.com

X-Mailer: SMTP Load Balancer

Message-ID: <578672dc-ecb7-44b4-9aba-391d1e3fa344@122.199.230.242>

Date: Thu, 21 May 2026 08:01:44 -1100 (SST)

X-Spam_score: 17.1

X-Spam_score_int: 171

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Good day, Our Company seeks a reputable representative in

your region, are you available for communication? Good day, Our Company seeks

a reputable representative in your region, are you available for [...]



Content analysis details: (17.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[122.199.230.242 listed in dnsbl.ahbl.org]

[122.199.230.242 listed in dnsbl.ahbl.org]

[122.199.230.242 listed in dnsbl.ahbl.org]

[122.199.230.242 listed in dnsbl.ahbl.org]

[62.60.130.216 listed in dnsbl.ahbl.org]

[62.60.130.216 listed in dnsbl.ahbl.org]

[62.60.130.216 listed in dnsbl.ahbl.org]

[62.60.130.216 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[122.199.230.242 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[122.199.230.242 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[122.199.230.242 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[122.199.230.242 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[62.60.130.216 listed in will-spam-for-food.eu.org]

[62.60.130.216 listed in will-spam-for-food.eu.org]

[62.60.130.216 listed in will-spam-for-food.eu.org]

[62.60.130.216 listed in will-spam-for-food.eu.org]

[62.60.130.216 listed in will-spam-for-food.eu.org]

[62.60.130.216 listed in will-spam-for-food.eu.org]

[62.60.130.216 listed in will-spam-for-food.eu.org]

[62.60.130.216 listed in will-spam-for-food.eu.org]

[122.199.230.242 listed in will-spam-for-food.eu.org]

[122.199.230.242 listed in will-spam-for-food.eu.org]

[122.199.230.242 listed in will-spam-for-food.eu.org]

[122.199.230.242 listed in will-spam-for-food.eu.org]

[122.199.230.242 listed in will-spam-for-food.eu.org]

[122.199.230.242 listed in will-spam-for-food.eu.org]

[122.199.230.242 listed in will-spam-for-food.eu.org]

[122.199.230.242 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[62.60.130.216 listed in sbl-xbl.spamhaus.org]

[62.60.130.216 listed in sbl-xbl.spamhaus.org]

[62.60.130.216 listed in sbl-xbl.spamhaus.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[62.60.130.216 listed in zen.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[122.199.230.242 listed in bl.score.senderscore.com]

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[jacobcheng717(at)gmail.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.5 GB_FREEMAIL_DISPTO_NOTFREEM Disposition-Notification-To/From contain

different freemails but mailfrom is not a

freemail

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.5 GB_FREEMAIL_DISPTO Disposition-Notification-To/From or

Disposition-Notification-To/body contain

different freemails

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} COMPLY IF INTERESTED



--===============1949812648329625108==

Content-Type: multipart/alternative; boundary="===============6128958714502388886=="

MIME-Version: 1.0



--===============6128958714502388886==

Content-Type: text/plain; charset="us-ascii"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Good day, Our Company seeks a reputable representative in your region, are you available for communication?

--===============6128958714502388886==

Content-Type: text/html; charset="us-ascii"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Good day, Our Company seeks a reputable representative in your region, are you available for communication?

--===============6128958714502388886==--



--===============1949812648329625108==--

Geek Squad phish from Microsoft Outlook Part 4

Posted by Dave Yadallee on
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

1.0 HK_RANDOM_FROM From username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.1 TW_RW BODY: Odd Letter Triples with RW

0.6 MEGALONGWORD BODY: Uses really overlong words

0.1 TW_VW BODY: Odd Letter Triples with VW

0.3 LONGWORD BODY: Uses overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

0.1 TO_IN_SUBJ To address is in Subject

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Geek_Squad_Renewal_Transaction_Record_=40_?=

=?UTF-8?Q?=C5=A1t_21=2E_m=C3=A1j_2026_=28cynthiaperez389903=40groups=2Eoutlook=2Ecom=29?=





Haresasz Nxysarwsa has invited you to Geek Squad Renewal Transaction Record

Title: Geek Squad Renewal Transaction Record

Location: https://meet.google.com/wyb-anea-vwh

When: May 21, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Client,



We are pleased to notify you that the Geek Squad 365 Advanced Protection Plan has undergone a successful renewal for another three-year term.



The required amount of $214.99 was charged against your saved payment option. Please wait up to twenty-four hours for this activity to reflect on your personal bank account statements.



Transaction Overview:

Item: 365 Advanced Protection Plan

Span: 3 Years

Charged: $214.99



If this charge is unfamiliar or unauthorized by you, dial our Billing Specialists right now at +1 808 755 9135 to request instant and complete cancellation help.



Thank you for continuing to prefer Geek Squad for safety.



Respectfully,

Geek Squad Billing Team



-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Pripojiť sa cez Google Meet: https://meet.google.com/wyb-anea-vwh



Viac o službe Meet sa dozviete na https://support.google.com/a/users/answer/9282720



Túto sekciu neupravujte.

-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Attendees:



cynthiaperez389903@groups.outlook.com



Geek Squad Renewal Transaction Record

Pripojiť sa cez Google Meet – Dear Client, We are pleased to notify you that the Geek Squad 365 Advanced Protection Plan has undergone a successful renewal for another three-year term. The required amount of $214.99 was charged



Pripojiť sa cez Google Meet

Odkaz na stretnutie

meet.google.com/wyb-anea-vwh

Dear Client,



We are pleased to notify you that the Geek Squad 365 Advanced Protection Plan has undergone a successful renewal for another three-year term.



The required amount of $214.99 was charged against your saved payment option. Please wait up to twenty-four hours for this activity to reflect on your personal bank account statements.



Transaction Overview:

Item: 365 Advanced Protection Plan

Span: 3 Years

Charged: $214.99



If this charge is unfamiliar or unauthorized by you, dial our Billing Specialists right now at +1 808 755 9135 to request instant and complete cancellation help.



Thank you for continuing to prefer Geek Squad for safety.



Respectfully,

Geek Squad Billing Team

Kedy

štvrtok 21. máj 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Geek Squad phish from Microsoft Outlook Part 3

Posted by Dave Yadallee on
Content preview: Geek Squad Renewal Transaction Record štvrtok 21. máj 2026

Pripojiť sa cez Google Meet https://meet.google.com/wyb-anea-vwh?hs=224

Dear Client,



Content analysis details: (17.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.10.73 listed in dnsbl.ahbl.org]

[40.93.10.73 listed in dnsbl.ahbl.org]

[40.93.10.73 listed in dnsbl.ahbl.org]

[40.93.10.73 listed in dnsbl.ahbl.org]

[2603:10b6:510:2cf:cafe:0:0:84 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:2cf:cafe:0:0:84 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:2cf:cafe:0:0:84 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:2cf:cafe:0:0:84 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:2cf:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:2cf:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:2cf:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:2cf:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[209.85.221.72 listed in dnsbl.ahbl.org]

[209.85.221.72 listed in dnsbl.ahbl.org]

[209.85.221.72 listed in dnsbl.ahbl.org]

[209.85.221.72 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.10.73 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.10.73 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.10.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.10.73 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.72 listed in will-spam-for-food.eu.org]

[209.85.221.72 listed in will-spam-for-food.eu.org]

[209.85.221.72 listed in will-spam-for-food.eu.org]

[209.85.221.72 listed in will-spam-for-food.eu.org]

[209.85.221.72 listed in will-spam-for-food.eu.org]

[209.85.221.72 listed in will-spam-for-food.eu.org]

[209.85.221.72 listed in will-spam-for-food.eu.org]

[209.85.221.72 listed in will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:84 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:84 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:84 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:84 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:84 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:84 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:84 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:84 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[40.93.10.73 listed in will-spam-for-food.eu.org]

[40.93.10.73 listed in will-spam-for-food.eu.org]

[40.93.10.73 listed in will-spam-for-food.eu.org]

[40.93.10.73 listed in will-spam-for-food.eu.org]

[40.93.10.73 listed in will-spam-for-food.eu.org]

[40.93.10.73 listed in will-spam-for-food.eu.org]

[40.93.10.73 listed in will-spam-for-food.eu.org]

[40.93.10.73 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.10.73 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.10.73 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.10.73 listed in list.dnswl.org]

Geek Squad phish from Microsoft Outlook Part 2

Posted by Dave Yadallee on
X-Microsoft-Antispam-Message-Info:

=?utf-8?B?WUpuUDRWS1RZeU5zdlIzRUNXbWZoMGpibERtTUdBSW1hdTlTNGVFQWhZNkxY?=

=?utf-8?B?ZS9NNk1QNG9mZ3RqSXZzUXZkS1VtQUFzK3hBNFVoY2xCS1lxZGRPSzBSWC9z?=

=?utf-8?B?RmYwOVcvdFJBVnYwUzE1Njd2dERzSzlDaDdwaVRoY0owYytRNzh5RlloR1R6?=

=?utf-8?B?RFg1L3MxRWp1ZWR6MkpGbUFISE1MOGJzelJ2bk5NdVVkRWFBNVJsQnhwbjYr?=

=?utf-8?B?Y2tDTk5EVWxmOE1uU0tvR20vRG93emxaUi9yc1RrTisvZS8vbGpSeGNtamtF?=

=?utf-8?B?OTNmREVFUWxhdklUYmhDOHFvRHIwRjNwTEJSOVM3VFk2UU02d1JJeUF5VDdw?=

=?utf-8?B?dHV3UFQyUW1JK2JuOVhTWnA1U1RrSjZnVzhOTFF6b2dEcjg4NlNmL1VXZGo2?=

=?utf-8?B?NmRGN0RGL29EOHBQWFRCdEF1MmhyU2xXcjFndnV5alVLc1d4cUx1SXNzM2E1?=

=?utf-8?B?QW9kblV5ZUt5dU5vOGt4Z3lLQ3hLeE92c2czTVZEaHBxMFpWL3ZseUNMdE5V?=

=?utf-8?B?emFtSHFYajQvT2svZjY4MHp3dHR1K2ZLWmRsWVhGZ2dMS1VJeWw2eGZnNE1i?=

=?utf-8?B?V1JZMXJ5TEVSa1RNWmlvTzF0L1QwWWpQeVFiMHZaYXBXOE9XUHE3bmpQVzFR?=

=?utf-8?B?clNQdE9BNENrM2pWTFJiV1I1dFo4K0t6MlZDMzVxUGVzVk9mSCtHSXhIYWo2?=

=?utf-8?B?WlNCd0ZoeUlOcEJtdlYyVGlLK0JwcGJvaUlpRGNNSThwQmx4SitSM2dZd1Z4?=

=?utf-8?B?YXJrT0E0bURkWjc0bkIyaFJYSkZWUUxOVEtTMDVGWktqV2diV1M2S280QStM?=

=?utf-8?B?OE1DcEF5NzJNa2VsZzRBdSt2S0hYNGRaUlplMy9EQXBPSmZjWklKcThBUnh3?=

=?utf-8?B?QVNtWHB0U21zYzl6TjZMU0IwQnJqc3QzcjVvSUhOUTZuSTRuWlFUK1M2NnhE?=

=?utf-8?B?ajhqQmpxNzM1VkFpQnB0V3hXbjAvdW1SMFNITWttV2t3bVJ5UUU5ZG1IbXhG?=

=?utf-8?B?WkE4MHY2aXF1YVFDcCs2czFCeGJoVTZSc1d0Y1FHbnNLTmNKNWlZRFJna2g4?=

=?utf-8?B?c0grQ1dHUmI2TTVXYy9FSzlTbG1rK2FTbTdUUEVzNnBkLy91RC9hQ2Vra0dm?=

=?utf-8?B?RkFZZThpakVtZGZRbmhuaC9SRno5Y3ZHeWV4djNHTlJHcFllOHpPL2Vidlh5?=

=?utf-8?B?SUdvcGFlRnpZYktLTk5PUTJCUXF0ZHdVNEVQU2kxVHZkMGdqV3ZJR3VTSEY5?=

=?utf-8?B?dGRxS3NzckhtTGFRRzFiVWpXWlBzcUhEdHdzNy9xMDQ5N0JOeEZKT1FjQzBq?=

=?utf-8?B?SkpPS1NpVUNBa0Q5dVpoSW5zR0JhdU9HUFZacFMvdEYwSmRXdUU2ZTVxNlEw?=

=?utf-8?B?SWVPR2VGeHhJVFUzYVlJNUxvQllseGFacmJmMmY2UERBbm0yZFNCTlFOKzBG?=

=?utf-8?B?WTFvcFNEQ3JoSzQyOUFGS3ZTVDg4bUpUUjdiR1JycHV3TlI3MjRUZ3FUd3JB?=

=?utf-8?B?TjI2S3RoVmlaT205aU5UelFISVl1Z09SNG1uR2RpRWxtL0RSdjRXR1NIRHp3?=

=?utf-8?B?S09vdlc0SWxMT014WVQ5a2x2Ri9aWUpqbGFDeHpGQThsYlhUcGo2SEF0MHRV?=

=?utf-8?B?N2NFTUkxaWZOdEdJRXZ1bjI0bDJFWkxubllxcmo4OXRGR2ZmdmxTUnJRM0VI?=

=?utf-8?B?cnRjSXN0ZEpGV1F4emJSV25McE1JMm4yYWxBN3d4anorRDRKb3ZFVHh0Qksr?=

=?utf-8?B?SVpQQjI4a1NKNnE0R0V1VmNkazZkSW5qWGVPdEttb3RqVkcxdGh4Ulh2MWcy?=

=?utf-8?B?emFXVGZXTm5MQWdzTTRhenQzQUlPWVVHRGN4OGY1MzZmdjZGdVBwUVRtdFRW?=

=?utf-8?B?UDFJa2JqM25vNTVidXFPMGlDQnRCSUlleVBJY3RtNE1uZnJqdmxHQVoxN3Zt?=

=?utf-8?B?aEhIZnpzV1RPTUZWbEZMdGlFaFg4Y1p2anUrSTBvRnFjODlEMlJISUc4L3Rh?=

=?utf-8?B?SUp5N2hhZTliSjZhKzlDTER0Ujk3Y3hyWGZ4b09Xc1F4a2J2Mnc2Rm9RRFNr?=

=?utf-8?B?MGhLMTYrZys2ZWtyb1N6S2NrM1poR0dWNHVmTzgyRnlYQkxVZXRpc05xYWhH?=

=?utf-8?B?aVJjT3BBWEU0cldVdUxmaTZGdzJ6NSt0SmhjV1VPRmI5MS9WSkM3NTl1VndE?=

=?utf-8?B?R1E4MjB6TFpuc1hSbVZWclRvUzZoTGtJa0I1RVhNZ2dkMk5LQXNqTnhScEpr?=

=?utf-8?B?ZThEamkyTExyZ1BMMW5CQktZaHdDNkYzc1FWdHJWRy9Ob2dPajUwcjI0eGVa?=

=?utf-8?B?aW5YM1IrRFBGbks5bU1uYXJiQUR0V3hXdnZRSXdLd0dCc3NKQ052cVpJZjdx?=

=?utf-8?B?emFldFVZWmorTXNxQ2o4SDc3clYybDBEby9IVWM1ZjVlS0hNaElpSkJuZ2I0?=

=?utf-8?B?ZnNmOElPYzlLRUZ4d2RMUnBOTzJ5clN6OVB1UHZJd2FneHpWeFJPTHlMNUdl?=

=?utf-8?B?M01oNHJocmsxUG0xbFE3clNJdGtRb2VySURlK3JjOENlMklHY1NZVE5VejBD?=

=?utf-8?B?bVdGY3E2bzNYSEt2QlV1dFhEVCsweTVvUVIrSjFCWVBLZE8zSnh0QWNFb2lk?=

=?utf-8?B?c2daY1FZUms4dWRMUnN0Mll6TVlvTzNqb21LSk9iOHg3QlNzeml3K0xWbHFl?=

=?utf-8?B?NkMzcUs1UEVVNWtHWUtjdlJDbUQxTFRjUURPcCtqQXhJa1grRm5EU0F4MWNQ?=

=?utf-8?B?dXRqVEpGRXRqWE9zTjZ1OXRleUxnWXlSYUJmUWd1UXgwc3A1YXpPWld4dGRz?=

=?utf-8?B?RmVVVUFtOS9BeE1TY010b29wYlN3ZEx3SHlXZ2tpVVdnU0xjTCtXSE5yS2Q5?=

=?utf-8?B?eG9FMzUxQk9heCtuV2FvejkvR0xJWUF2QkJEZWtYR2dnbVNjSlZLL2hQalpB?=

=?utf-8?B?OVhNVHpxeEJZQUpVZXdjQ0ZLT0xKY3ZQUGtLdEs3cERHdXRPQW5YSFZKVTNT?=

=?utf-8?B?YlFjeFU2ckV5cjQ1ZHhYWUhvL1NxeWMxWnFpRzFpeURMbU9LTnF4YUVHQXZl?=

=?utf-8?B?alpWQVlyVDBGZndrNzFDbnU1VlRzNHFoODB4bUx5V05MdGxsWmd5SFhWQ0Jj?=

=?utf-8?B?dnFkS1pHTlZybU5rZWM4SUJvelJpcWNVNzJkN0Fwc3dJZ05jZ1ZSWEZyTGFH?=

=?utf-8?B?OGVkZWUyRHJJQ1g4amJYckRTdUZ3WVdvVVRmbXl1RzNiZy9rempvRW5Od2N0?=

=?utf-8?B?KzVmczROWGgvbUN5eVhvRUw2UmJnd3lwNll6MXd0eUxXN2xwdzRaNTI0Qk82?=

=?utf-8?B?YjhIVHczR3h4aFNvblJsS0lLOGFlY21JWXV1UjRna1A5TzFMZ0VDTlpzRnFT?=

=?utf-8?B?RndVdjQyTit3MUc1aDNqaUNiWjRZSVNIdlFmYTI1VVlTcDR0d1EvNTdvWld2?=

=?utf-8?Q?Y/F5tMmYx7rEORz+IA9DhbWEFBrgTCt6mHFzEsUb?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 May 2026 17:34:27.2128

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 75e25c6f-defa-4d5f-453a-08deb75f3503

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000E9D9.namprd05.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR18MB5840

X-Spam_score: 17.0

X-Spam_score_int: 170

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Geek Squad phish from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 21 May 2026 13:54:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQ9Sh-00000000FeF-1I8I

for dave@doctor.nl2k.ab.ca;

Thu, 21 May 2026 13:53:43 -0600

Resent-From: The Doctor

Resent-Date: Thu, 21 May 2026 13:53:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [40.93.10.73] (port=49540 helo=CO1PR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQ7J0-000000004km-2aPh

for doctor@doctor.nl2k.ab.ca;

Thu, 21 May 2026 11:35:47 -0600

Received: from PH8PR07CA0026.namprd07.prod.outlook.com (2603:10b6:510:2cf::21)

by BY1PR18MB5840.namprd18.prod.outlook.com (2603:10b6:a03:4b5::5) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.25.23; Thu, 21 May

2026 17:34:27 +0000

Received: from CY4PEPF0000E9D9.namprd05.prod.outlook.com

(2603:10b6:510:2cf:cafe::84) by PH8PR07CA0026.outlook.office365.com

(2603:10b6:510:2cf::21) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.48.17 via Frontend Transport; Thu, 21

May 2026 17:34:27 +0000

Authentication-Results: spf=pass (sender IP is 209.85.221.72)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.221.72 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.221.72; helo=mail-wr1-f72.google.com; pr=C

Received: from mail-wr1-f72.google.com (209.85.221.72) by

CY4PEPF0000E9D9.mail.protection.outlook.com (10.167.241.72) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.7 via

Frontend Transport; Thu, 21 May 2026 17:34:27 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:1A1CF05D80548BC78EF099C3E635CB57598F6106C9BDB69AA49D9B252C27F5D1;UpperCasedChecksum:88AC9B03E598B61EC4695DD5E10DDBA3E7952946C317910243ACF6FF01405E55;SizeAsReceived:3385;Count:15

Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-43d7b7bacddso4642350f8f.0

for ; Thu, 21 May 2026 10:34:27 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1779384866; x=1779989666; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=Q0/Q0Hz64sMizArNW0XxHP5QfPQ3hXB3w7xzbnNIlHI=;

b=Yfbp4ADaktqE0ppiMalv3uzzuV+qNUNJ4mETAAyDwWFQZiW+mGQl/U0EWl3Wy+wT+q

UY5FqjO3OkFQeXoECjgZvNWObgAscAdzLAU2K97YRxDr0BioAZxprqA4CKljewHDbYSS

mOX9WG6f4tIo78VRbP3v5ldTfLTgVRFfF/V+vO5Ekt8azhlkEG3Oqyh/05E0SsSpbt7e

oFaJhlDoTYhfEsJfz3GDapJ1HMhnCI02YQAAOux7+c4wqqqn9bhMuRon5chOl/shuzs+

NOsk4TfYEY0N9LJPoqHhUmhYjH2070wcpHUpTMm7OX6LZM73JihD2AQbpJUPdzueZdnn

hzHw==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1779384866; x=1779989666; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=Q0/Q0Hz64sMizArNW0XxHP5QfPQ3hXB3w7xzbnNIlHI=;

b=QyJx/gH/Z+acMIbbUsDgUYHs1jagZ1QbgHLWT7O2VMJ4OAj1MLzO+tZZOHL3id/pmk

UtA2/lLqg3sghoHOJXiY9wRx3buqTpu2oP/suhwN4h8u3MVspa7mRf3gQBRmMXWnC15r

dQUtkmtaeHc25QtwVPihC5Q45Y5DHGyrNTOjmRbs1ko9PjAgsUM7s14cKvPh47HvF3S3

6vfDtuTgEVVvZPFmkLq0OGNXaj64w89otzgSfp9vPDprRHiu4TXITmlpS/gge6oTk618

zcdNCxoeacxIyScf3cBfrPiUpJdIrZO0tTLAFQwlGD/zNKpN7j6URiJqFxxlNTiHKGVi

Ufyw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1779384866; x=1779989666;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Q0/Q0Hz64sMizArNW0XxHP5QfPQ3hXB3w7xzbnNIlHI=;

b=Nxx536cdWy/2pRM8KgtebewkGZRcT5NSUBz+rOEG6uPYJEFHLjSHHSH5TqChY5xBgm

CJdtD8/LeOjEQqt8Y27/3a8cmqwsLeTylGx6YuVwJFf+RGIHqmhIjrJLpC4FTAw+eENP

kjPglBpBLokIpP+ZcBtMe7wUP7GXme5PclZrC91rFA3NoYBSdELkhYZVUBQ8wq6QqaB7

sVrsumNcHPbmcdTlHLAMEkj9PfjYIzmGbiixuMpz9+a03Wd9kuqoBKkFfViICrAnG9AU

y8Qrxta861IQnG3svz8zOksD93gKYROfVBLY2Aa3isu+FjQUj4yoXioSVCZ1CJ+3z2AM

0BVg==

X-Gm-Message-State: AOJu0YxjuTPp4f1CdIGVFChN1FNfRbOp9zUfRq0MXbdrIYo7owOjaSNP

yf7qRjpdwddYyhr0/VX6Fp2C5nDojwW1smjg5Y2CwrWwwyLKs/SdD4WcXufxNbLCU7FluFSoPQA

1kVirnyZTYKdRvQdNOUxWGPaGMcqjVcFQ1rI=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:698e:b0:48f:e230:c3fa with SMTP id

5b1f17b1804b1-490360d5902mr53098655e9.32.1779384865127; Thu, 21 May 2026

10:34:25 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Thu, 21 May 2026 17:34:25 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Geek_Squad_Renewal_Transaction_Record_=40_?=

=?UTF-8?Q?=C5=A1t_21=2E_m=C3=A1j_2026_=28cynthiaperez389903=40groups=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000ce081006525752f6"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: CY4PEPF0000E9D9:EE_|BY1PR18MB5840:EE_

X-MS-Office365-Filtering-Correlation-Id: 75e25c6f-defa-4d5f-453a-08deb75f3503

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.221.72

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|29080799009|22000799015|1680799066|5149299006|6092099016|3069299007|9000799056|970799063|26130799012|26000799027|9020799019|3151999006|9400799043|32020799003|24102599021|16200799027|4040799016|6019299003|5139299004|34130799006|3412199025|4302099013|440099028|18021999003|30041999003|2145499017|1360799030|1380799030|1370799030|26104999009|21002599022;

Lucrative business proposal spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 21 May 2026 08:45:00 -0600

Received: from mail-wm1-f66.google.com ([209.85.128.66]:50402)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQ4d6-000000006Xz-1vWz

for dave@doctor.nl2k.ab.ca;

Thu, 21 May 2026 08:44:18 -0600

Received: by mail-wm1-f66.google.com with SMTP id 5b1f17b1804b1-48a563e4ef7so49440275e9.0

for ; Thu, 21 May 2026 07:43:21 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1779374594; x=1779979394; darn=doctor.nl2k.ab.ca;

h=mime-version:message-id:list-unsubscribe:date:subject:to:reply-to

:from:from:to:cc:subject:date:message-id:reply-to;

bh=72RLEJ0BB3eiaKHaoADcLoK+obOnShVsV9dqWrc1H54=;

b=k+BLIB84Bl/ccrjSllVn1HySMCNfHaX5DAGaHJaJvuLZXpLyXjrRpwtj7jdJiwKYcN

n6MsElrWtmDdrdtQ4xeft/KkMdXbIFPnUhCC9k2JWBwCelKNcA2JHnNLf2YJS4DhwDtC

qRbdYk3Ju1SyTvWzXyPBCCqEkHQo+sRSr1LATrCfc4+a3KZTK475rJBEWlUm1xjNNDjD

fQSk0Kd17rPnOJDF7e1HJyIa1BxA4lQZv5XtE6rnhgK2mJXgyOkUFN/mTIg0JjWsOrKJ

e8rVLVwmPL1oLXzuEs7odzE/gYwUOPjVMORs6J5iFBcM/ln+PKh0Wr4KenPW82J8JU+d

I8kA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1779374594; x=1779979394;

h=mime-version:message-id:list-unsubscribe:date:subject:to:reply-to

:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=72RLEJ0BB3eiaKHaoADcLoK+obOnShVsV9dqWrc1H54=;

b=cx++jvwFFTqfuRirX9sJ5Z/tWO70SY32JPf6sBdKKl91HGbybB/MzV+RknaGf3fCoh

/YuxUy9pt4jQvENlOzVBN2An/+/gpa5opBBLwKmTTb+NUqscIKbafjwWucOvGd93+3bm

agUVTC504/IXJEzQ8+7ywA6+wF9i5Xst515ok7jQabWNeLDRo++fhz6JjKRtbM+Tmjgm

gyWJKczI8JfVTXKusmz0z98FdfwDvUJSLDaV0tOCRquEFOa4Yd1kRaDJEimrvUcZHp+e

oJ0BOKhjgXAAb/9x6L2v8lfXRLtdS1QDv0V3qFtTeaFyv2uKx7MV/1BnytmI4s4Au1f/

Kgiw==

X-Gm-Message-State: AOJu0YzuZ9M+BkO5LVmdqcmPAU1jEwRMxy8WH+gsCHpZ4mJaHnywhjpA

Ds+oNP/n3VvJots3p9Pczqro6GkG2F1kmYNkT481xvIr2cEcXmyfxspNZ+ShTWvxD1cfk1F7j2K

mlQ==

X-Gm-Gg: Acq92OFBPFyqbREA1vI1sTl5Z0Imq20XSMGouP8yOXL1ccuphU5hMPi1vVCqsiCMlb0

DGY8S3HcZ1e1bqpoBRPCNs4UM30riM3hPF4Gjpzo+OdwOE9oJ2yqWmRUu7chEbCWWmrMIRxH2yx

KKXxOMUP1Qa9Hd3iqZgUWA+W7PEb8dumazkRf7+POxXfDb5MUI7DpEIuOKU4S+z3reMNmoxNPqb

Kbt9cRGCTfJ1dTIb0tZltyjqRmolBvWuRABGvKcuXTmXOlfn8WQwAqlfXKGkW70uoT5WqjKg9M+

yZ7S7W239xd4p9A8IHC6s7jsaxapo3YSeiMYN+BqaHhfUWlw7jwcEzO62xls/jVJAsnyTwYvmRS

BV/XSUD/YJDmxKdLqoEjoMlFi+Lbj46p69MfQGZK+zYvgHGpkj52/6r8FEIqVYjival8JBC63At

eRHONq0kD4bXizvi6bJFfxbTxsUrKpkA0r/sJF6ptb/g==

X-Received: by 2002:a05:600c:8b45:b0:48e:635a:18d2 with SMTP id 5b1f17b1804b1-490360341c0mr51211975e9.2.1779374594044;

Thu, 21 May 2026 07:43:14 -0700 (PDT)

Received: from DESKTOP-7KFFQ7I ([102.89.82.27])

by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49033d9eca8sm69461925e9.12.2026.05.21.07.43.13

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 21 May 2026 07:43:13 -0700 (PDT)

From: =?utf-8?B?U2VudGFvZGlsYWx0ZA==?=

Reply-To: naruhitok@aktio-us.com

To: dave@doctor.nl2k.ab.ca

Subject: =?utf-8?B?THVjcmF0aXZlIEJ1c2luZXNzIFByb3Bvc2Fs?=

Date: Thu, 21 May 2026 15:43:10 +0100

List-Unsubscribe:

X-Priority: 3

Message-ID: <67FA77E5D1354E7CBE75C4A3C8A1FD75@gmail.com>

Mime-Version: 1.0

Content-Type: multipart/alternative; boundary="2FB4B6583ADE442BB24A50EA8863D94D"

X-Spam_score: 5.3

X-Spam_score_int: 53

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, I came across your profile and i was impressed by

your background. AKTIO CORPORATION are expanding into North America and are

looking to hire a Regional Executive Partner to lead their new operations.

[...]



Content analysis details: (5.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.66 listed in dnsbl.ahbl.org]

[209.85.128.66 listed in dnsbl.ahbl.org]

[209.85.128.66 listed in dnsbl.ahbl.org]

[209.85.128.66 listed in dnsbl.ahbl.org]

[102.89.82.27 listed in dnsbl.ahbl.org]

[102.89.82.27 listed in dnsbl.ahbl.org]

[102.89.82.27 listed in dnsbl.ahbl.org]

[102.89.82.27 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.66 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.66 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.89.82.27 listed in will-spam-for-food.eu.org]

[102.89.82.27 listed in will-spam-for-food.eu.org]

[102.89.82.27 listed in will-spam-for-food.eu.org]

[102.89.82.27 listed in will-spam-for-food.eu.org]

[102.89.82.27 listed in will-spam-for-food.eu.org]

[102.89.82.27 listed in will-spam-for-food.eu.org]

[102.89.82.27 listed in will-spam-for-food.eu.org]

[102.89.82.27 listed in will-spam-for-food.eu.org]

[209.85.128.66 listed in will-spam-for-food.eu.org]

[209.85.128.66 listed in will-spam-for-food.eu.org]

[209.85.128.66 listed in will-spam-for-food.eu.org]

[209.85.128.66 listed in will-spam-for-food.eu.org]

[209.85.128.66 listed in will-spam-for-food.eu.org]

[209.85.128.66 listed in will-spam-for-food.eu.org]

[209.85.128.66 listed in will-spam-for-food.eu.org]

[209.85.128.66 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.66 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[sentaodila3(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[sentaodila3(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.66 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.66 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} =?utf-8?B?THVjcmF0aXZlIEJ1c2luZXNzIFByb3Bvc2Fs?=



--2FB4B6583ADE442BB24A50EA8863D94D

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable



=0D=0A
quiv=3DContent-type>=0D=0A=0D=0A=0D=0A
=3D"MSHTML=2011.00.10570.1001">=0D=0A=0D=0A
 Hello,
DIV>=0D=0A
I=20came=20across=20your=20profile=20and=20i=20was=20impress=

ed=20by=20your=20background.=20AKTIO=20CORPORATION=20are=20expanding=20into=

=20North=20America=20and=20are=20looking=20to=20hire=20a=20Regional=20Execu=

tive=20Partner=20to=20lead=20their=20new=20operations.=20This=20is=20a=20pa=

rt-time=20position=20with=20a=20competitive=20salary,=20attractive=20commis=

sion,=20and=20a=20flexible=20schedule=20that=20won't=20conflict=20with=20yo=

ur=20current=20job.
=0D=0A
If=20you=20are=20open=20to=20considerin=

g=20new=20professional=20opportunities,=20reply =20and=20I=20will=20be=

=20pleased=20to=20share=20additional=20information
 
Best=20rega=

rds,
=0D=0A
Independent=20Recruiter
=0D=0A

 

=0D=0A=



--2FB4B6583ADE442BB24A50EA8863D94D--