Loan phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 14:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuG1H-000000006oP-28e8

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 14:57:51 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 14:57:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f181.google.com ([209.85.210.181]:42046)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuFkv-000000003HO-1Cjn

for sales@nk.ca;

Wed, 12 Aug 2026 14:41:05 -0600

Received: by mail-pf1-f181.google.com with SMTP id d2e1a72fcca58-84847482584so266266b3a.0

for ; Wed, 12 Aug 2026 13:40:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=kesefmarketing.com; s=google; t=1786567204; x=1787172004; darn=nk.ca;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:content-type:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=tbZIXyF/GNVVf8IjUiKQ+oV/jqy4i5laBakVQZhtqkY=;

b=EYBGAeo33Zcg2OG0YC0bcK2kJBeffD0WtKoDiiHN4WUuehJ24U4VeiNlHX2v/AjK7b

NCrmIa+OFdE34Owonou3Ga51SnyJ7GW+uJDvKhE7ZPtbe6FZeAMNTcRqS+cdDZsoElnj

1kQ4TpSRbhMOZ3KQ52QaAY1szfqnHAHxnN5nOB6vCd5WBbZy+M/wL8fSQ1TKqyqQF6gD

0eesvF3tzU3Oi0D1ZwzCAnxLQt5ytGMTW7ojbwrtUn3IYCcSk6eHvaeBKpsf/fbAWwZP

uNlSj5xCYR0SuUSFFp0dU+barUCAQQhVxaBd8DCOZiIIwfOhMRTjeOA+fPqhvZgcnrV4

FJ/A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786567204; x=1787172004;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:content-type:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=tbZIXyF/GNVVf8IjUiKQ+oV/jqy4i5laBakVQZhtqkY=;

b=kvjrmShxRPm7Inmjf59poq+05M1BuSt5vuZP29mSns2/u05YNrQsVAqkJfiWxuzRH/

3MBmBDWqVm9R0W8IX1PjNmreE7xK4n2gx4HHE8OC8fAcSy2cV9A3duLQZXw6183iGlaY

DaCT3UCYznoPVBULureC7Z6JZGltL81/9NkfQ4i2LTdNGKuTGqHRui8UwvdSsRG11KWo

ECVHff/2gWiaoxkirYafg72xZUCFpaomZuZuluJuxEab6JCCUcb38ndewITEgAKaGkTk

BSry/7Ftjee1ma8ZeZYU20z4BMXDssDSzzf75UvxEjDRs6T1xB2fjkZJVWr3rMC12QS1

QGCQ==

X-Gm-Message-State: AOJu0Yw1AOcTHfbfQ/jJrMBQA1dQwMR3cpRKOyO3mIZaI8STo5kE4NZf

yf2wb3h6BDvpl36KwniUtjIkrwCS/h9XjRd6x4HF2ySu9l6pV9IzVdpf/kMC54biaFE3CB2Qmty

xR5Qx

X-Gm-Gg: AR+sD11t3seTxUqVbrNXpvLfZicFGyHG6GS5mYzW9qZrtNqO9k/dr2NAsJhSRYouF24

YW9GL8CdAfvYI10gVLyG+ocmEwWS7Vs6BoSn/YGMMNTcfCRIJYrgcrvTZlmtkQ2oYICNGkHA2Bg

zCVLn/OZ03KmScpyJWiafS7nLt+U+mhgjRwwcJehZiVey+oBlTcXeDesupLe+oJdyUCo92dbIlJ

V/bWQjrIs6B6LOxeYr3iuGVrwi62wA/nkHtG1IYYG+/H39VGnzKjNfq92uxw6gCKl97cmiMsK/R

DueJszsJyvNOYkzDrZcmdvo2clcDW+IProQ1gHiXFkVX8rHF6eIIodA8gkt0g3c2Tq2RfbjPTrt

oVca6U+le+hOb6kqHNlHnhS2nIqgjZtmLSbNJo6nfk+oCzDgQ3nelxzc0uyNZsGc1Q6bdllnqCT

Dy0s5BPfD+hjMhpAuFqeAJgOfdqzStv9XM0Ewg1TEpSmK9p8CXuD/uB7RkwXNGNE8QdA3goRok4

/YXulMX9c3Mb78D3xHhGEWfMimz8beqH4iCznTJmoM=

X-Received: by 2002:a05:6a00:14d5:b0:847:70f4:613f with SMTP id d2e1a72fcca58-84fc7c1ec38mr395443b3a.12.1786567203427;

Wed, 12 Aug 2026 13:40:03 -0700 (PDT)

Received: from smtpgw.close.com (am11-natgw-c0.close.com. [54.200.191.154])

by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84fc5a68c60sm114648b3a.48.2026.08.12.13.40.02

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 12 Aug 2026 13:40:02 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============7946878310728263274=="

MIME-Version: 1.0

Subject: Re: Kesef Marketing | Smarter Access to Business Loans

From: =?utf-8?q?Lilian_Llanillo?=

To: =?utf-8?q?Gurkirat_Wirring?=

Date: Wed, 12 Aug 2026 20:40:02 +0000

Message-ID: <178656720216.7.1487486787664217380@smtpgw.close.com>

X-CLOSEIO-EMAIL-ID: acti_nk8LpFsOBhJSXuOowoxSS5NguctysG6eZdZgsfW6yYW

References: <178646337461.7.1240611996543057914@smtpgw.close.com> <178646337461.7.8575171778634196756@smtpgw.close.com>

In-Reply-To: <178646337461.7.1240611996543057914@smtpgw.close.com>

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click



--===============7946878310728263274==

Content-Type: multipart/alternative; boundary="===============6079678544044073755=="

MIME-Version: 1.0



--===============6079678544044073755==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



**Hi Gurkirat, **



=20



**We noticed your Cash Advance application is still incomplete.**



=20



**You=E2=80=99re just a few steps away from securing up to $800,000 in fund=

ing within

48 hours.**



=20



**To move forward, please complete your application here: =20

**



[**Click to Start your Application

here**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1MVGGnNXqVx=

8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN

K

MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadTyp=

e=3DAutomation)



=20



**and upload your last 3 months of bank statements. This will allow us to

finalize your review and match you with the best available funding options.=

**



=20



**If you have any questions or would prefer to speak directly, feel free to

call me at +1-866-216-5475 or 873-771-7630**



=20

**Best regards, =20

**



=20



**Lilian Llanillo**



**FUNDING ADVISOR**



=20



![email \(16px\).png](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877403=

9066-email+%2816px%29.png)****[**lilian@kesefmarketing.com**](https://lilia=

n@kesefmarketing.com)



![phone-call \(16px\).png](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877413=

7354-phone-

call+%2816px%29.png)**+1 (873) 771-7630**



**____________________________**



![IMG_5340.jpg](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877416=

5068-IMG_5340.jpg)



=20



To stop receiving these emails, click

[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=

kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).



=20

=20

On Aug 11, 2026, at 09:49 AM, Lilian Llanillo

wrote: =20



> **Hi Gurkirat,**

>

> =20

>

>

> **This is Lilian Llanillo from Kesef Marketing.**

>

> =20

>

>

> **Welcome! I wanted to personally reach out and thank you for your intere=

st

> in business funding. We work with lenders across Canada to provide reliab=

le

> funding solutions that support growth, manage cash flow, and cover upcomi=

ng

> expenses=E2=80=94while helping you access competitive interest rates.**

>

> =20

>

>

> **If you=E2=80=99re open to exploring your options, you can get started h=

ere: =20

> **[**Click Here To Start Your

> Application**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1M=

VGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN

> K

> MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadT=

ype=3DAutomation)

>

> **Once submitted, our team will review your information and present the b=

est

> available funding options tailored to your needs.**

>

> =20

>

>

> **If you have any questions or would prefer to speak directly, feel free =

to

> call me at +1-866-216-5475 or 873-771-7630**

>

> =20

>

>

> **Looking forward to connecting.**

>

> =20

>

>

> **Best regards, =20

> **

>

> =20

>

>

> **Lilian Llanillo**

>

> **FUNDING ADVISOR**

>

> =20

>

>

> ![email \(16px\).png](https://closeio-

> filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774=

039066-email+%2816px%29.png)****[**lilian@kesefmarketing.com**](https://lil=

ian@kesefmarketing.com)

>

> ![phone-call \(16px\).png](https://closeio-

> filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774=

137354-phone-

> call+%2816px%29.png)**+1 (873) 771-7630**

>

> **____________________________**

>

> ![IMG_5340.jpg](https://closeio-

> filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774=

165068-IMG_5340.jpg)

>

> =20

>

>

> To stop receiving these emails, click

> [here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDni=

l9kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

> --tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).

--===============6079678544044073755==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



Hi Gurkirat, 

W=

e noticed your Cash Advance application is still incomplete.
=


You=E2=80=99re just a few steps away from secur=

ing up to $800,000 in funding within 48 hours.


>
To move forward, please complete your application here:

strong>


rong>and upload your last 3 months of bank statements. This will allow us t=

o finalize your review and match you with the best available funding option=

s.

If you have any questions or w=

ould prefer to speak directly, feel free to call me at +1-866-216-5475 or 8=

73-771-7630

Best regards,
=



ont-weight: 700;">Lilian Llanillo

tyle=3D"font-weight: 700; color: rgb(57, 208, 150);">FUNDING ADVISOR=



3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774039066-email+%=

2816px%29.png" alt=3D"email (16px).png">
700;">
et=3D"_blank" rel=3D"noopener noreferrer nofollow">
ont-weight: 700;">lilian@kesefmarketing.com
<=

img src=3D"https://closeio-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOg=

mo8WoImXFkS0Dtk%2F1778774137354-phone-call+%2816px%29.png" alt=3D"phone-cal=

l (16px).png"> +1 (873) 771-7630<=

/span>
_______=

_____________________

-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F17787741=

65068-IMG_5340.jpg" alt=3D"IMG_5340.jpg" style=3D"width: 159px; height: 64.=

1129px;">


ribe-footer">


ed-text">

On Aug 11, 2026, at 09:49 AM, Lilian Llanillo <lilian@k=

esefmarketing.com> wrote:
Hi G=

urkirat,

This is Lilian Llanillo =

from Kesef Marketing.

Welcome! I =

wanted to personally reach out and thank you for your interest in business =

funding. We work with lenders across Canada to provide reliable funding sol=

utions that support growth, manage cash flow, and cover upcoming expenses=

=E2=80=94while helping you access competitive interest rates.
>

If you=E2=80=99re open to exploring your optio=

ns, you can get started here:

om/260672364104452?lead_id=3Dlead_1MVGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxa=

D3&legalBusiness=3DN K MAINTENANCE&fullName[first]=3DGurkirat&f=

ullName[last]=3DWirring&leadType=3DAutomation" rel=3D"noopener noreferr=

er nofollow">Click Here To Start Your Application
>
Once submitted, our team will review your information and pre=

sent the best available funding options tailored to your needs.
iv>

If you have any questions or would prefer to=

speak directly, feel free to call me at +1-866-216-5475 or 873-771-7630
trong>

Looking forward to connecting.
ong>

Best regards,

data-system-generated=3D"signature">

eight: 700;">Lilian Llanillo

=3D"font-weight: 700; color: rgb(57, 208, 150);">FUNDING ADVISOR
rong>


azonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774039066-email+%2816=

px%29.png" alt=3D"email (16px).png">
;">
=3D"_blank" rel=3D"noopener noreferrer nofollow">
t-weight: 700;">lilian@kesefmarketing.com

g src=3D"https://closeio-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo=

8WoImXFkS0Dtk%2F1778774137354-phone-call+%2816px%29.png" alt=3D"phone-call =

(16px).png"> +1 (873) 771-7630
pan>
_________=

___________________

ilepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774165=

068-IMG_5340.jpg" alt=3D"IMG_5340.jpg" style=3D"width: 159px; height: 64.11=

29px;">


be-footer">


://ml.closeml.com/t/nk8LpFsOBhJSXuOowoxSS5NguctysG6eZdZgsfW6yYW/YVFsbTnwSw.=

png" alt=3D"" width=3D"1" height=3D"1" />

--===============6079678544044073755==--



--===============7946878310728263274==--

Charity donation spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 14:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuG0b-000000006hr-3kqP

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 14:57:09 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 14:57:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f43.google.com ([209.85.161.43]:44210)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuDtw-000000008wZ-3cYs

for bin@nl2k.ab.ca;

Wed, 12 Aug 2026 12:42:17 -0600

Received: by mail-oo1-f43.google.com with SMTP id 006d021491bc7-6a168dc590cso1061657eaf.0

for ; Wed, 12 Aug 2026 11:41:21 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1786560075; cv=none;

d=google.com; s=arc-20260327;

b=ojh/dmeC/zE/1v2xPiZ910wq3lSSgwQaHOpvdEtUzfNo1DAKIIV7ksZqBjTmy3WDcs

NTZq4XZ86BMrbAZzeQdkvU9Sc9uVpo27q3N953eUSCrl480psPBd/8H2rEPxkwV4nazg

2KvbkeCK56DpqXJWTSc5S3UKVEQkqUCEs/GYTowh5nScCKoquq/paEt1EkjTu7snuF28

u8fmsmH4AoMsePED9Qp78T8zL/0RgnA4MqDBlIGGVsn6tIswPiuT1TQWYwZp9de99gv7

beZz6QO1yKVPQKnbQUH7E8Qsmd6jw2nykWgGa46Yg+h2Z7Vr+qbfLJNzpaxhJWu1cOQR

fIlg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=sCEQzu8upI9ZeYLWO1+SO/xtyTcIxNZesGTV7nuZiic=;

fh=Q/dGJ/Cv89OtrXCiLLKR7ggGXIAbJq64SMOAMdngurI=;

b=kyr6BhhjNF+qP3WR1cJz7+8M6c1e6rSYlXKE+36S3ZGc3Mnl523uLMm0Mtv4TnxA0R

8ukXwB9Hr2egUzLzwVHtzs1TN5PAw6E+xh+JOtn53xcaOFB8uivvjCMT6qfIXkgn7WgA

u65zTAXqNE6D0bF9F+XUGNch5892Fra5kEAXv7MV6u6VkIQEpskoQGxJb+lY9NpAb0wb

rvtgb8ohzv3JeH7pi8UYF/AYzaRyqa6UAeN31cIt4tqFu1TmcZ0HKPnZ3Qtg0iBmUzbb

yhR4tpweGVzfKw9V1Fq4MrQeV/kf22CSAXmHtcCCh7BqLI0rqAn0/gyFVQGjrPdYiF7v

eXFw==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=jisuniversity.ac.in; s=google; t=1786560075; x=1787164875; darn=nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=sCEQzu8upI9ZeYLWO1+SO/xtyTcIxNZesGTV7nuZiic=;

b=U3MeQaTAUTVs/zsdNrp8sDCiMkp7UaTOgmX2VJZeU4fhGWYKltbOkRvF8Z7quVQEI3

IRE/mCdGusx0X9c0B8U9kDH2TSq2uju3UNVOpXBFmAQEsOICTwYaGe1j9xL5H/CMvzF+

StSTCnnke6XFHzfvXpPZLuXWddeBcUo47V8nRdZZkCAQFB50R9Sv75obALlqdNLOi2r7

+6tk90ydvbtFPeXAAGpe0nlGwOTxw/hstC9Nh9zibZ7W1TMoBa58JqiVMWO7GE2MMh2T

+q8Ond5U8G+GqQAX9F+3gDT8eIiK6eZtRqDYQrCuOd+7ZPffqGChLxZY/rk/h39jnXMk

9tDA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786560075; x=1787164875;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=sCEQzu8upI9ZeYLWO1+SO/xtyTcIxNZesGTV7nuZiic=;

b=bs+nSTKPM7AWEYpymJjI1kNhihDKrGgHf9xMwasR7U5jzhx0ZSf5xFEZD/wwJbUtTx

fz7RrPZEmP7msfgUEJ3sWUHYLDXyij/JoLqyv9bTysY2VNJn3BMNb8oXDYVt7wM1V5AC

kPnP6Q+baHQ7vucqqylsrQF4jIVPhC0Y65nEnW8Y0hdDRhIjHM82IW6o6krFF2PeEGMn

lDRWb353Db+tvKPDiC1KnREJl0ErcdK7RzQVZZ2pokGZfjN9ADBM1C5L3ZcN8w3e5aWr

ENxA4D9AOSyq24RiWhNACd2Iy+Lq0Mt9qDbHy4AhChlMQTkzwLYO2bRLZyIhh/0xliIQ

w38w==

X-Forwarded-Encrypted: i=1; AHgh+RpfbEhYGtZauJlTjnR4sN1kyTeYxGA5ZnyZK0MYNeCV1RfAfsod5d05qnDqg88ualMN+xQ=@nl2k.ab.ca

X-Gm-Message-State: AOJu0Yx0JFr/4RtFSm4rxsVMnbs0q4ntc/fYvopI7VYhgB3ZbUg0T6Ij

vIpcLej6q/7MqOHBW4nfUKW6HRCUuIRkcJeLoOhidRAAIcHIF0H83fUtW/Oe6zdcqbcqqS7LaG9

yqLVzRswL4GSjez2Tt0BR5a8R3J4xi4yPbFebQs2Ueg==

X-Gm-Gg: AR+sD11/3pInu6WrEdjTNQJHfLLTSD35Mc/4aVp1sgfD5w5z5j1UuuzCwvnDfNux3Ks

x+TRNIUI4qe42yermMNCtdGaiRbaMfB9WeG9tmd81EQGvfOPnm7OPAG5nLzGiyPEfR1Hb9Mv9GQ

QX4ErxKEB+TFyHQq29knHCpce3Jm9Jdvl+jaTWSWH3njoCbfy6Og1nSjIbmvIQORYMnJd4M0JTv

zYjN86XvBCpdUYWFbXbXKK/WVL3t3pc4r81M3FZbdzSD1X/PmJzYcQ2omIhIG+iYLylsZuOstaO

twNWrN0kN5MK8UpWwWY4KR4/K8u1ka+uCyxRMBTr73c5L6TWRHCWSciaCVu8h+Pk6wy0+PDw9CF

bOA==

X-Received: by 2002:a05:6820:8c9:b0:6a1:44aa:86ce with SMTP id

006d021491bc7-6b0c435bc25mr501805eaf.22.1786560074541; Wed, 12 Aug 2026

11:41:14 -0700 (PDT)

MIME-Version: 1.0

Reply-To: santiagodiannahmeed@gmail.com

From: Diann Ahmed Santiago

Date: Wed, 12 Aug 2026 19:41:02 +0100

X-Gm-Features: AUfX_mwI6FZqwYJDSL5F64IXpeFztPNffmEl5X3tDqkYeAL4Slc2dFRjN1Xqii8

Message-ID:

Subject: CHARITY DONATION

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000009cfc0a0658ddee7c"

Bcc: bin@nl2k.ab.ca

X-Spam_score: 16.8

X-Spam_score_int: 168

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: -- Dear Beloved as a formal introduction I'm Diann Ahmed Santiago

an Indonesia citizens, I'm in the hospital undergoing serious treatment for

Esophageal cancer. I was recently transferred from the Jam [...]



Content analysis details: (16.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

[209.85.161.43 listed in dnsbl.ahbl.org]

[209.85.161.43 listed in dnsbl.ahbl.org]

[209.85.161.43 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.43 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.43 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.43 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 LOTS_OF_MONEY Huge... sums of money

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} CHARITY DONATION



--0000000000009cfc0a0658ddee7c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



--=20

Dear Beloved as a formal introduction I'm Diann Ahmed Santiago an Indonesia

citizens, I'm in the hospital undergoing serious treatment for

Esophageal cancer. I was recently transferred from the James OSU Cancer

Centre

in Columbus Ohio United States of America to United Kingdom. I

have since lost my ability to talk and my Doctors have told me that I

have only a few months to live, due to my serious illness, I, therefore,

seize this opportunity to

notify you that I Diann Ahmed Santiago have decided to make you a

beneficiary to my ''WILL'' which based on my personal visit & search

in the export promotion council from the internet where your details

was well convinced to me of you been a reliable and trustworthy

fellow, I want you to assure me that you will not betray nor

disappoint my trust in you at the end of the transaction.



My Beloved, I and my late husband left the sum of Ten Million

Pounds (=C2=A310,000,000.00) in two trunks of metal boxes with

a security company as family valuables. I know this might sound

unbelievable to you, but I

tell you it's real and true.



I have decided to do this based on my short notice and limited time

state by my doctors, I decided in my mind that I should give this

resources to you, where I desire that you help take good care of

the needy ones in your country or around your region, such as

motherless baby's homes, widows, hurricane victims, and churches...Note

also, that before my illness. I have been carrying out the assignment

similar to this project just after the death of my husband.



As soon as I know your readiness to work and help me on this issue, I

shall provide the security company contact information for you to be sworn

into action.

You are humbly advised to contact me through my email

address as santiagodiannahmed@gmail.com



Remain Blessed,

Diann Ahmed Santiago

santiagodiannahmed@gmail.com



--0000000000009cfc0a0658ddee7c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable






"gmail_signature_prefix">--

ature" data-smartmail=3D"gmail_signature">
Dear Beloved as =

a formal introduction I'm Diann Ahmed Santiago an Indonesia
citizens=

, I'm in the hospital undergoing serious treatment for
Esophageal ca=

ncer. I was recently transferred from the James OSU Cancer Centre
in Co=

lumbus Ohio United States of America to United Kingdom. I
have since los=

t my ability to talk and my Doctors have told me that I
have only a few =

months to live, due to my serious illness, I, therefore,
seize this opp=

ortunity to
notify you that I Diann Ahmed Santiago have decided to make =

you a
beneficiary to my ''WILL'' which based on my perso=

nal visit & search
in the export promotion council from the internet=

where your details
was well convinced to me of you been a reliable and =

trustworthy
fellow, I want you to assure me that you will not betray nor=


disappoint my trust in you at the end of the transaction.

My Bel=

oved, I and my late husband left the sum of Ten Million
Pounds (=C2=A310=

,000,000.00) in two trunks of metal boxes with
a security company as fam=

ily valuables. I know this might sound unbelievable to you, but I
tell y=

ou it's real and true.

I have decided to do this based on my sho=

rt notice and limited time
state by my doctors, I decided in my mind tha=

t I should give this
resources to you, where I desire that you help take=

good care of
the needy ones in your country or around your region, such=

as
motherless baby's homes, widows, hurricane victims, and churches=

...Note
also, that before my illness. I have been carrying out the assig=

nment
similar to this project just after the death of my husband.

>As soon as I know your readiness to work and help me on this issue, I
s=

hall provide the security company contact information for you to be sworn i=

nto action.
You are humbly advised to contact me through my email
add=

ress as s=

antiagodiannahmed@gmail.com

Remain Blessed,
Diann Ahmed Santi=

ago
sa=

ntiagodiannahmed@gmail.com




--0000000000009cfc0a0658ddee7c--

Intelcom Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 14:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuG0Q-000000006fp-0KQJ

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 14:56:58 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 14:56:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps.fslocal.com ([199.83.208.249]:46158)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuDSa-00000000LyF-32zb

for sales@nk.ca;

Wed, 12 Aug 2026 12:14:03 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=laravel.perksona.com; s=default; h=MIME-Version:Date:

Content-Transfer-Encoding:Message-ID:Subject:To:From:Content-Type:Sender:

Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From:

Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:

List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:

List-Archive; bh=/McdDXbMdaxgJ6ulkQo9xWuZbF1iRwDyuEIZ8YTRZOw=; b=c0AQULgFqBX3

E/f6D40isL5BFbq2sNZXCyf0RFBrJm1ah0zlCfAaKy3ADil+Q3diWsVbEeC/7Oadm9YRi9+fAjXBH

A2JaFl6Y9JNiYNM4S+8XZ6LGds+bG9AcTfOe7LHIfCxkF7krx7MVGQqYYjxYvqSu4VwCLgBQ6n1BK

q4XZh6vj/jfRU8BLiV17i0g2b8pMWHftBot+ye6tPIC2x1sobGVR9fZQnK28n7vmJxMhegQiM7Ald

g3hN9ibQ+Uk6eD6OOfL4kd2gZ1hPDVOrwTEmlfSBXvvqg4QuRpBesIZsTJI89smXQ4LJ5H9KAMIPO

mxibc/TvAwe2fDrT6rHGWg==;

Received: from [196.75.231.148] (port=62198 helo=[127.0.0.1])

by vps.fslocal.com with esmtpsa (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5)

(envelope-from )

id 1wuDRO-00000001uhm-3xBU

for sales@nk.ca;

Wed, 12 Aug 2026 14:12:59 -0400

Content-Type: text/html

From: Intelcom

To: sales@nk.ca

Subject: Intelcom Delivery Notification

Message-ID: <1b29bfb9-63f1-28aa-b050-5822b1aaa86b@laravel.perksona.com>

Content-Transfer-Encoding: quoted-printable

Date: Wed, 12 Aug 2026 18:12:35 +0000

MIME-Version: 1.0

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - vps.fslocal.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - laravel.perksona.com

X-Get-Message-Sender-Via: vps.fslocal.com: authenticated_id: info-mjqu@laravel.perksona.com

X-Authenticated-Sender: vps.fslocal.com: info-mjqu@laravel.perksona.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 6.2

X-Spam_score_int: 62

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Intelcom Delivery Update



Content analysis details: (6.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

[196.75.231.148 listed in dnsbl.ahbl.org]

[196.75.231.148 listed in dnsbl.ahbl.org]

[196.75.231.148 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[199.83.208.249 listed in bl.score.senderscore.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Intelcom Delivery Notification
















MARGIN: 30px auto; border-radius: 10px; box-shadow: 0 4px 10px rgba(0,0,0,0=

.08)">


center; PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

Intelcom










TEXT-ALIGN: center; PADDING-TOP: 30px; PADDING-LEFT: 30px; PADDING-RIGHT: =

30px">

Delivery Update





Your package is currently being processed and =

requires a small fee for customs handling.






18px; FONT-WEIGHT: bold; COLOR: #04ab94">Amount due: 2.96 CAD





Please confirm your delivery =

details to ensure a smooth delivery experience.




org/Intelcom/Contactez-support-Intelcom.ca/" style=3D"TEXT-DECORATION: =

none; BACKGROUND: #04ab94; MARGIN-TOP: 20px; FONT-WEIGHT: bold; COLOR: =

#ffffff; PADDING-BOTTOM: 12px; PADDING-TOP: 12px; PADDING-LEFT: 25px; =

DISPLAY: inline-block; PADDING-RIGHT: 25px; border-radius: 6px">Manage My =

Delivery







BACKGROUND: #f1f1f1; COLOR: #888; PADDING-BOTTOM: 20px; TEXT-ALIGN: center;=

PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

This is an automated message. Please do not reply.=





© 2026 Intelcom Express











Wealthsimple Phish from Google

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 14:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuG0J-000000006em-127C

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 14:56:51 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 14:56:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from weall04.weiyuzhishiw.com ([35.217.83.89]:51393)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuD5v-000000009Kn-2wBf

for doctor@nk.ca;

Wed, 12 Aug 2026 11:50:35 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=weall04.weiyuzhishiw.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=UOVDZS@weall04.weiyuzhishiw.com;

bh=+uJBQiwcPS9ZW9Qp2u2m1mf4t9zqzQ9e3ZuBAlKBz6I=;

b=isUQmnm8uQz+fOPGBsjMnhcm9hAR0RhASwqSbZh8jU++z0z7Zl9IexGSSMbc6HC/lSCNHZNzQNSZ

Tobb8bL1NdWqcfr4aSYHdBqgzXHSwSK5fCBiEYBW1n//NijLJTgI/cb4kPF3izGHzxW0ukQn6H4w

61oQolEuOnLDQn0nuVtGJ9B4eATI81jlj5JpPPtzZnjM9hSQ2VAq23e7W1RH8KFbV4zOoDpltK/V

cy07Lj/pbWdoa4MRBLD26f9l5ZpwyM5Ogap8JhkaEcWalK6AW1RQ6c9BVNwnxjP1V/2h5PO+REsm

WIcbM3MU6hvybFSgkkoOIZy7a2tNG5gii2sm+w==

Content-Type: multipart/alternative;

boundary="===============8869485953320447085=="

MIME-Version: 1.0

From:

=?utf-8?b?V+KAi2XigIth4oCLbOKAi3TigIto4oCLc+KAi2nigItt4oCLcOKAi2zigItl4oCLIOKAi0PigIts4oCLaeKAi2XigItu4oCLdOKAiyDigItT4oCLdeKAi3DigItw4oCLb+KAi3LigIt0?=



To: doctor@nk.ca

Subject: =?utf-8?q?Transfer_Pause_in_Effect_=E2=80=94_Verify_Your_Identity_T?=

=?utf-8?q?oday_-_Suspension_de_transfert_en_vigueur_=E2=80=94_Verifiez_votr?=

=?utf-8?q?e_identite_aujourdhui?=

Date: Wed, 12 Aug 2026 13:49:39 -0400

Message-ID: <178655697959.3782.14659689807189522119@weall04.weiyuzhishiw.com>

X-Spam_score: 12.1

X-Spam_score_int: 121

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: TRANSFERS CURRENTLY PAUSED — ACTION REQUIRED Transfer Pause

in Effect — Verify Your Identity Today ================================================================





Content analysis details: (12.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

[35.217.83.89 listed in dnsbl.ahbl.org]

[35.217.83.89 listed in dnsbl.ahbl.org]

[35.217.83.89 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: npclw.com]

[URI: hqkjweb.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: login.hqkjweb.com]

[URI: login.npclw.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: npclw.com]

[URI: hqkjweb.com]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: npclw.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.217.83.89 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

1.0 ACCT_PHISHING Possible phishing for account information

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} =?utf-8?q?Transfer_Pause_in_Effect_=E2=80=94_Verify_Your_Identity_T?=

=?utf-8?q?oday_-_Suspension_de_transfert_en_vigueur_=E2=80=94_Verifiez_votr?=

=?utf-8?q?e_identite_aujourdhui?=



chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 10:09:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuBUq-00000000NWp-164A

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 10:08:04 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 10:08:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from static30-154.uszonea.dm.aliyun.com ([8.221.30.154]:28172)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuBPD-00000000MPw-1Nwr

for doctor@nl2k.ab.ca;

Wed, 12 Aug 2026 10:02:25 -0600

X-AliDM-RcptTo: ZG9jdG9yQG5sMmsuYWIuY2E=

Feedback-ID: default:trumsense-mirrorswitch@chinasmartsensor.cn:vip_dmx_DmxBatch:521943

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=chinasmartsensor.cn; s=mailbee-cn-1f0b3f2;

t=1786550477; h=List-Unsubscribe-Post:List-Unsubscribe:Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=AyqVZ7Q3Cu/yzlcUrKPBvBGjAJ2z3QkLxu0gom4eRJQ=;

b=K2hE0ciZR0x4op7HACik1SjAttBdiPDFMlcwbjq8E7885S7HAIJ8xkUQAiD4nLV8HXYAUzmD6NGXVbwOOTriGriqlMiQ2UvN5UqNEK1gu4E/Z96JcZLsnsKU5eklbFGj9Yinhg+8nH59bVoRgdmynoiD3+r19OVgYEZvputZJPYUoKPr3jLbzUVANNgZWPbuf009YGlXLPzyF9JnX/rJzZCQHSXM2PIedTSYZC0tj8ia7heeF21VTOHdrn5NjkiSvd3jnyo4raR9TBmLA156jPZQdCGHxzvoD/6b7bjuXR86/phBb+O0woV04OX8Vd/ZrUclNJtrobzUrmIjj0P4wQ==

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dm-fbl.aliyuncs.com; s=feedback;

t=1786550477; h=List-Unsubscribe-Post:List-Unsubscribe:Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=AyqVZ7Q3Cu/yzlcUrKPBvBGjAJ2z3QkLxu0gom4eRJQ=;

b=NELkXzAv/aKUGkGeWxTShK+htTY7329Ymk07JYUvJbTvIZG1DfHPUJOT+I4N8Uv29F8X/1G6qg9UnmhI0xuE755cdsxLC6i0Q4d4NzuUqH5jg9PF0yVCFxuKwhaJfUbd8qVsziQ/0HMEh4+DYT3PQLo/OAos1rHnlCgpesbURK4=

List-Unsubscribe-Post: List-Unsubscribe=One-Click

List-Unsubscribe:

Received: from chitu-hsf(mailfrom:trumsense-mirrorswitch@chinasmartsensor.cn fp:metaq-uuid-f34310f9-132a-4f6a-b300-85a64c76b08c cluster:AY35D)

by smtp.aliyun-inc.com(127.0.0.1);

Thu, 13 Aug 2026 00:01:17 +0800

Date: Thu, 13 Aug 2026 00:01:17 +0800

From: "LED Mirror Touch Switch"

To:

Reply-To: "ledmirror-touchswitch@trumsense.com"

Message-ID: <624b5c9d-716e-4927-bbfd-d27e7ad3a956@alibaba.com>

Subject: =?UTF-8?B?UmU6IFImRCBzdXBwb3J0IGZvciB5b3VyIG5ldyBtaXJyb3Igc2VyaWVz?=

X-Priority: 3

MIME-Version: 1.0

X-EnvId: 600000347503892566

X-AliDM-Settings: eyJPdXRib3VuZElwIjp7IklwTGlzdCI6W10sIklwUG9vbElkIjoiNDBkODFhOGEtMDM2Mi00ZWMxLWIzMzQtNzQzZWZjZmJmNTU2In0sIlVuc3Vic2NyaWJlIjp7IkZpbHRlckxldmVsIjoiZGVmYXVsdCIsIkxpbmtUeXBlIjoiZGVmYXVsdCJ9LCJWZXJzaW9uIjoiMS4wIn0=

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Working directly with our factory eliminates extra costs

and speeds up delivery.



Content analysis details: (7.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[8.221.30.154 listed in will-spam-for-food.eu.org]

[8.221.30.154 listed in will-spam-for-food.eu.org]

[8.221.30.154 listed in will-spam-for-food.eu.org]

[8.221.30.154 listed in will-spam-for-food.eu.org]

[8.221.30.154 listed in will-spam-for-food.eu.org]

[8.221.30.154 listed in will-spam-for-food.eu.org]

[8.221.30.154 listed in will-spam-for-food.eu.org]

[8.221.30.154 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[8.221.30.154 listed in dnsbl.ahbl.org]

[8.221.30.154 listed in dnsbl.ahbl.org]

[8.221.30.154 listed in dnsbl.ahbl.org]

[8.221.30.154 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[8.221.30.154 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[8.221.30.154 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[8.221.30.154 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[8.221.30.154 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[8.221.30.154 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or

Generic rPTR

0.6 J_CHICKENPOX_45 BODY: 4alpha-pock-5alpha

0.6 J_CHICKENPOX_82 BODY: 8alpha-pock-2alpha

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} =?UTF-8?B?UmU6IFImRCBzdXBwb3J0IGZvciB5b3VyIG5ldyBtaXJyb3Igc2VyaWVz?=




ne; font-size:0px; line-height:0px; max-height:0px; max-width:0px; opacity:0; =

overflow:hidden; visibility:hidden; mso-hide:all;">=0A<=

div style=3D"clear: both;">

Hi,


=3D"MsoNormal">Working directly with our factory=0Aeliminates extra cost=

s and speeds up delivery.


r: rgb(255, 0, 0);">We produce LED mirror touch switches with=0Adimming, Bluet=

ooth, and anti-fog control.

With 17 yea=

rs of manufacturing experience=0Aand all key certifications, we make importing=

simple.

Would you like a quotation for=

your current=0Ademand?

 
p>

 

B=

est regards,

Cathy Wong


ass=3D"MsoNormal">Shenzhen Trumsense Technology Co.,Ltd.


ass=3D"MsoNormal">Address=EF=BC=9AA3102,Southern=0ALake, Ji=

ndi Community,Street3# Chunlin,Qujiang District,Xi'an City,Shaan Xi=0AProvince=

, China 710061

Tel: 008613891846516
an>

Email: ledmirror-touchswitch@trumsense.com=


=




"clear: both;">
If you don't want to receive our emails, you can=


7a1f3353364b12b65812452b4b4abd19&token=3DeyJjYW1wYWlnbl90aW1lIjoxNzg2NTUwNDc3L=

CJlZG1faWQiOjUyMTk0MywiZW52aWQiOiI2MDAwMDAzNDc1MDM4OTI1NjYiLCJtYWlsX2Zyb20iOiJ=

0cnVtc2Vuc2UtbWlycm9yc3dpdGNoQGNoaW5hc21hcnRzZW5zb3IuY24iLCJtYWlsX3RvIjoiZG9jd=

G9yQG5sMmsuYWIuY2EiLCJ0YXNraWQiOiJkNGQ5NTRkNi04ZGRkLTQxZDEtODM2Yi01ODBmNGZiOWU=

2NTgifQ%3D%3D&version=3D1.0" data-alidmx-urlmark=3D"f49293ac-8586-4b9d-8837-4e=

8a833fa16a">unsubscribe.

/v1/report?bid=3Dd4d954d6-8ddd-41d1-836b-580f4fb9e658&env=3D600000347503892566=

&mac=3D521943&mf=3Dtrumsense-mirrorswitch%40chinasmartsensor.cn&msgid=3D624b5c=

9d-716e-4927-bbfd-d27e7ad3a956%40alibaba.com&sac=3D0&tag=3DDMXTask&tid=3Dd4d95=

4d6-8ddd-41d1-836b-580f4fb9e658&to=3Ddoctor%40nl2k.ab.ca&tpl=3D&ts=3D178655047=

7&type=3D1&url=3D&v=3D1.0&sign=3Dcb528a618613da19244501f703ea697b&urlts=3D1786=

550477" alt=3D"" style=3D"display: none; width: 1px; height: 1px;" />

WEb/SEO/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 10:08:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuBUj-00000000NUb-468t

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 10:07:57 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 10:07:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f41.google.com ([209.85.216.41]:52231)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuBPD-00000000MQc-0F1t

for sales@nk.ca;

Wed, 12 Aug 2026 10:02:25 -0600

Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-3900e39d935so1481744a91.0

for ; Wed, 12 Aug 2026 09:01:27 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1786550481; x=1787155281; darn=nk.ca;

h=disposition-notification-to:content-language:thread-index

:content-type:mime-version:message-id:date:subject:to:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=yklAkINHbzjZeNzhZD9lcNCaz278+gZgEk2532ihsq0=;

b=jPrsLye59nwBtPLHZYy565OTexo/LV0oq1byQ7ydX4+IrJUhQoOI1RPOjRli7cnivJ

RQVQC0kf+26GKyE/eeeKnzdC6sjlut5xbL1mQdIQYN/VaBVez6ZyUi4X3Rhg+qgRRscy

yHTZ/QVLA04JOpSZmi0Ynk+uS19UWZuc6RuzLGo2zz262MRWnJJMntHGkyoikMDMVR0G

qu1r+0DmvQYxKj1KJB0Z7kaW7zCYNVIqSTHdeXPQx5uCkQr0GIg0Ji32uo9mcsTpcpiq

OTcDOKWoV4sJaZubqwoVh/+gArOOqSqGrf79AxlSPsD/hYh0Y83iJ3Vznxx9/ew7cGXZ

DqoQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786550481; x=1787155281;

h=disposition-notification-to:content-language:thread-index

:content-type:mime-version:message-id:date:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=yklAkINHbzjZeNzhZD9lcNCaz278+gZgEk2532ihsq0=;

b=BBDqDIMCOK8C3WqhPTFG/fzrLCPRfpXqEkXcwvNf62ahG0giZjBQOJG2zQS1bw9EfS

44X68AbDpRKJ4nGkrYn1Nr2EzD3oSuzrfMJFXT4cbIaJ86jeS2w6bozlsBQKKCC1ZbvD

2LTHr7k8+7q9Qome5pU6+ooPIOajgLCUjx1cL14bcKL2QJ9byY0ozMrm0gSPfmjf4FWm

luY6GU1an3thJjF2FLIlDk0DE05pFyyEA5IOx8KqIriRX1qwTieOgeuXDCBMFkrwdmdx

rAY/N4iaAUSO5WKh7qCdyq49Ba1azwoXsoXep3iPb14Yx+EqHnzjdAhnejDjTSAiGOgN

RwUw==

X-Gm-Message-State: AOJu0Ywoveuov2mxfhyb7l+pMHki7Yz4fa+QaWBLd9tYBHfiukluAJNK

aFCStOmXKl2M1oZ/klWg9JOq5jjxoht5G3Mrf5sLWyxOLU10KAhf2zFzE3I8P59/Qp8=

X-Gm-Gg: AR+sD12OkYBrnoHCCTYIbXwRGrM4nVFChWOyuLPaVZ0oG2Me7fr5qMbBuZsVGj3005e

qeSpHYOXIblmU6fmnxA3KTMpxtxLYd7hj15lZrk7NVZ2yvr2jIOGrOPou+TqCHBN18UMfWaIRqk

EaOWueY/NbFs8UWlBK/xxngpPgDLz5CCZ1ZVRlbmEDlAPw5bWdqaNjD9ujlpJOP8KLmgiz5nvUU

nalPp6BapSa/PtBbSTbOUndNZcJF60LYKl8qQWJNJE1/oAJcREKH7bVPwPQc+BVLWdU9jkObaQp

ZEJ/1l+kt/sDhTHAfcOhyeojW5o5rtlQ0ozZJ6RqLGxULLwYAJPfe/4FOsP8u1rczfOoq/N2jN1

7kPvJGRTYTwedvt3f29pCpLc054NDrPOthNLlCO667Ls2QwBsi8TB2VxdX5ekQPK57aufe6QyvH

HjE6pUCx06UpubmOwTtWNLvLgrqrcMmUPUo/9zII0pv6cwwXtwCPceHXqArLOV4w79Rb7oXUDCM

nX0TFVO7Q4QseYXokQE5ojG2mLQOe1k+m8VIagAZiTDY1x1Q9q8HFA=

X-Received: by 2002:a17:90b:2d87:b0:38e:67e1:15b with SMTP id 98e67ed59e1d1-3930129aa1dmr6958454a91.6.1786550480952;

Wed, 12 Aug 2026 09:01:20 -0700 (PDT)

Received: from DESKTOPH0SNGFD (204.124.163.103.broadband.rapidnet.in. [103.163.124.204])

by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-392f8cfdaccsm4024973a91.11.2026.08.12.09.01.19

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Wed, 12 Aug 2026 09:01:20 -0700 (PDT)

From: "Moni Choudhry"

To:

Subject: Re: Looking a Website Designer or Developer..

Date: Wed, 12 Aug 2026 21:28:53 +0530

Message-ID: <05be01dd2a73$d0d33090$727991b0$@gmail.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_05BF_01DD2AA1.EA8C2FE0"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: Ad0qXB5dMBKOw8e/RpK29Q+a8dX5aA==

Content-Language: en-us

Disposition-Notification-To: "Moni Choudhry"

X-Spam_score: 5.7

X-Spam_score_int: 57

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi sales@nk.ca, I hope you're doing well. I wanted to follow

up to see if you have had a chance to review my previous message. If you're

interested, It would be great if you share the details of your requirement

so that I can come up with my best solution accordingly & I can send you

more details on the packages/action/Portfo [...]



Content analysis details: (5.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.163.124.204 listed in will-spam-for-food.eu.org]

[103.163.124.204 listed in will-spam-for-food.eu.org]

[103.163.124.204 listed in will-spam-for-food.eu.org]

[103.163.124.204 listed in will-spam-for-food.eu.org]

[103.163.124.204 listed in will-spam-for-food.eu.org]

[103.163.124.204 listed in will-spam-for-food.eu.org]

[103.163.124.204 listed in will-spam-for-food.eu.org]

[103.163.124.204 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.41 listed in dnsbl.ahbl.org]

[209.85.216.41 listed in dnsbl.ahbl.org]

[209.85.216.41 listed in dnsbl.ahbl.org]

[209.85.216.41 listed in dnsbl.ahbl.org]

[103.163.124.204 listed in dnsbl.ahbl.org]

[103.163.124.204 listed in dnsbl.ahbl.org]

[103.163.124.204 listed in dnsbl.ahbl.org]

[103.163.124.204 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.41 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.163.124.204 listed in sbl-xbl.spamhaus.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.41 listed in list.dnswl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[websiterevamp1(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[websiterevamp1(at)gmail.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.41 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.216.41 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.5 GB_FREEMAIL_DISPTO Disposition-Notification-To/From or

Disposition-Notification-To/body contain

different freemails

Subject: {SPAM?} Re: Looking a Website Designer or Developer..



This is a multipart message in MIME format.



------=_NextPart_000_05BF_01DD2AA1.EA8C2FE0

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi sales@nk.ca,







I hope you're doing well. I wanted to follow up to see if you have had a

chance to review my previous message.







If you're interested, It would be great if you share the details of your

requirement so that I can come up with my best solution accordingly & I can

send you more details on the packages/action/Portfolio/past work details.







Best regards,



Moni.







From: Moni Choudhary

Sent: June 24, 2026 4:51 PM

To: sales@nk.ca

Subject: Looking a Website Designer or Developer.??







Hi sales@nk.ca,







I hope this email finds you well.







My name is Moni, and I am a highly skilled Full Stack Developer with

extensive experience in both front-end and back-end development. I am am

reaching to you in case you want to hire a perfect developer who can manage

your website, can make updates, enhance the visibility, develop advance

features in your website and provide you continue support on very reasonable

prices.







My Skills are:-



PHP (Laravel, CakePHP, Zend, Symphony, Yii), Node.js, Express.js, Magento,

WordPress, Shopify

HTML, CSS, JavaScript, Next.js, React.js, Angular, TypeScript, Vue.js.







I am happy offer a free 10- 15 hour trial to demonstrate my skills and I am

ready to work with you on monthly basis or as per your requirements. I can

mange the design and development both side.







If you are interested, then let me know your requirement, so I can assist

you with best solution.



Regards,



Moni.









------=_NextPart_000_05BF_01DD2AA1.EA8C2FE0

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">
link=3D"#0563C1" vlink=3D"#954F72" style=3D'word-wrap:break-word'>

class=3DWordSection1>


style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>Hi =

sales@nk.ca,


style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>I hope you’re doing well. I wanted to =

follow up to see if you have had a chance to review my previous =

message.


style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>If you’re interested, 
style=3D'background:yellow'>It would be great if you share the details =

of your requirement so that I can come up with my best solution =

accordingly & I can send you more details on the =

packages/action/Portfolio/past work =

details.


class=3DMsoNoSpacing>
New Roman",serif;color:#002060'>Best regards,


class=3DMsoNoSpacing>
New Roman",serif;color:#002060'>Moni.


class=3DMsoNoSpacing>
New Roman",serif;color:#002060'> 


class=3DMsoNoSpacing>
style=3D'font-size:11.0pt;font-family:"Times New =

Roman",serif'>From:
style=3D'font-size:11.0pt;font-family:"Times New Roman",serif'> Moni =

Choudhary
Sent: June 24, 2026 4:51 =

PM
To: sales@nk.ca <sales@nk.ca>
Subject: =

Looking a Website Designer =

or Developer.??


class=3DMsoNoSpacing>
New Roman",serif;color:#002060'> 


class=3DMsoNoSpacing>
New Roman",serif;color:#002060;background:#F8F8F8'>Hi =

sales@nk.ca,


style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>


class=3DMsoNoSpacing>
New Roman",serif;color:#002060;background:#F8F8F8'>I hope this email =

finds you well.


style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>


class=3DMsoNoSpacing>
New Roman",serif;color:#002060;background:#F8F8F8'>My name is =


Roman",serif;color:#002060'>Moni, and =

I am a highly skilled Full Stack Developer with extensive experience in =

both front-end and back-end development. I am am reaching to you in case =

you want to hire a perfect developer who can manage your website, can =

make updates, enhance the visibility, develop advance features in your =

website and provide you continue support on very reasonable =

prices.


class=3DMsoNoSpacing>
style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060;background:#F8F8F8'>My Skills =

are:-

New Roman",serif;color:#002060'>

style=3D'background:#F8F8F8'>PHP (Laravel, CakePHP, Zend, Symphony, =

Yii), Node.js, Express.js, Magento, WordPress, Shopify

style=3D'background:#F8F8F8'>HTML, CSS, JavaScript, Next.js, React.js, =

Angular, TypeScript, Vue.js.


class=3DMsoNoSpacing>
New Roman",serif;color:#002060;background:yellow'>I am happy offer a =

free 10- 15 hour trial to demonstrate my skills and I am ready to work =

with you on monthly basis or as per your requirements. I can mange the =

design and development both side.
style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060;background:#F8F8F8'>


style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>


class=3DMsoNoSpacing>
style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>If you are interested, then let me know your =

requirement, so I can assist you with best solution.

style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>
Regards,


class=3DMsoNoSpacing>
New Roman",serif;color:#002060'>Moni.


class=3DMsoNoSpacing>
New =

Roman",serif;color:#002060'> 


ml>

------=_NextPart_000_05BF_01DD2AA1.EA8C2FE0--



chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 10:08:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuBUf-00000000NTp-1t5q

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 10:07:53 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 10:07:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m4785125235.xmail.ntesmail.com ([47.85.125.235]:50706)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuBHH-00000000Hgr-0de5

for sales@nk.ca;

Wed, 12 Aug 2026 09:54:16 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_1321650_288016661.1786549980954"

To: sales

Subject: =?UTF-8?B?TmVlZCBhIHJlbGlhYmxlIHN1cHBsaWVyIGZvciBnb2xmIGNhcnRzPw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from park@hxcarts.com( [10.139.5.81] ) by ajax-webmail ( [127.0.0.1] ) ; Wed, 12 Aug 2026 23:53:00 +0800 (GMT+08:00)

From: Lilly

Date: Wed, 12 Aug 2026 23:53:00 +0800 (GMT+08:00)

X-WM-Tid: 0a9ff6ad4ebb03c0kunm1d49ed6e1a12e1

DKIM-Signature: a=rsa-sha256;

b=MT5OWxIEKepAxbMfxaW+QvMc90Fq78LaMioHmIUsI0YJ8YdzfRNOYPkWxXabvL/oYEjkEKzwVGwBUqj3DhI0Cb7g3AUd4vTZBDq4zNQ+5I08e6mjz6gzi6y6sF+XS3s/eGh0rpMdteBux++Q6ZqLzrtUADyuceGwXzmaTx3sLAedLLn8FymxJaYrL8UKfUr+KiXMkZGwvZtQS0Jgnh9Mwh6nc49iI5F7LNHOWza/LD0YFu75tU/QMOvsnbTrzaA5QTP2Q9wnUJP/3mDwit1azMGC1HKa2VRN9Rh2QuDLUd5nPRK0OGr+wvf5ukDkVRoIcQ0ACze6cqP/sEH78A6irQ==; c=relaxed/relaxed; s=default; d=hxcarts.com; v=1;

bh=grnXGdSXF1PX8SJfMjyKm7zMn4QhKVm9DAcPCKbEMdE=;

h=date:mime-version:subject:message-id:from;

Message-ID:





Hi Sales,

We make golf carts and electric tricycles. Factory direct. Fully customizable.

What that means for you:

- 30-50% lower cost than most brands

- Your logo, your color, your specs

- CE/EEC certified – ready for your market

We deliver 800+ units monthly from our China and Vietnam facilities. If you're currently sourcing these products, I'd love to send you our catalog and price list. Would you be open to a quick look?

This is my WhatsApp. Feel free to reach out anytime if there's any issue.



Whatsapp

Best regards, Lilly Anhui Huaxin Electric Technology Co., LTD





Stay informed with our latest news and enhancements by selecting . Stay Connected



If emails aren’t for you, hit Change Preferences.





Enable regular insights and our product’s newest features by hittinging . Continue Updates



If you’d rather not get more emails, just hit Adjust Settings at any time.



Park





park@hxcarts.com







在2026-07-10，Lilly 写道:



-----原始邮件-----

发件人： Lilly

发件时间: 2026年07月10日 周五

收件人： [sales ]

主题： Need a reliable supplier for golf carts?



Hi Sales,

We make golf carts and electric tricycles. Factory direct. Fully customizable.

What that means for you:

- 30-50% lower cost than most brands

- Your logo, your color, your specs

- CE/EEC certified – ready for your market

We deliver 800+ units monthly from our China and Vietnam facilities. If you're currently sourcing these products, I'd love to send you our catalog and price list. Would you be open to a quick look?

This is my WhatsApp. Feel free to reach out anytime if there's any issue.



Whatsapp

Best regards, Lilly Anhui Huaxin Electric Technology Co., LTD





Stay informed with our latest news and enhancements by selecting . Stay Connected



If emails aren’t for you, hit Change Preferences.





Enable regular insights and our product’s newest features by hittinging . Continue Updates



If you’d rather not get more emails, just hit Adjust Settings at any time.



Park





park@hxcarts.com







Questrade Wealth Management Inc phish from Google

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 10:08:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuBUY-00000000NSb-0Ngd

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 10:07:46 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 10:07:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from qtmail03.vesrecycle.com ([35.217.104.64]:52783)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuB4W-000000004RB-3GvJ

for doctor@nl2k.ab.ca;

Wed, 12 Aug 2026 09:41:00 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=qtmail03.vesrecycle.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=ISQTTK@qtmail03.vesrecycle.com;

bh=An7Qj/CagAKsxiTGF9DMH6Ht5vVNmpKX41kbdYJobDc=;

b=SFk5/NwjxHy+sYmnBoum9Sz6Eb+V+FZuHSGu/ERdaq2KUgQlUDwF/QYmg1E1GfKRE8Dhz66woXYf

tRmPNBPD04WKUCjJ7lczs6aPhgoYiZ/er4iMb1nCu4UWD9MOu86Qv6zhj0GkAu5zTM7jkkjlz3kr

WhDqC59l8q9duzxdRUAIaaiCEggOyChEBxYCiiJpsO31NykmUSLBv7Yseba8AbVefP7XO9A+6tfw

t2CNHuk7ytdU14O8lqFI/oW4HWIc+zelk2loFGJA7KWW7Eqxy1T6VI6l5EYvYXj8JVhFNxmLhrBQ

7gPes899S40HYzvnIYaubrcwvguzS1TyFiBEXg==

Content-Type: multipart/alternative;

boundary="===============7098849002770827321=="

MIME-Version: 1.0

From: Questrade Client Services Team

To: doctor@nl2k.ab.ca

Subject: Confirm Your Details for Your T5 Tax Slip - Confirmez vos

renseignements pour votre feuillet T5

Date: Wed, 12 Aug 2026 11:40:04 -0400

Message-ID: <178654920485.3849.9994424907838740410@qtmail03.vesrecycle.com>

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: TAX SEASON UPDATE — T5 SLIP VERIFICATION NEEDED Confirm

Your Details for Your T5 Tax Slip ================================================================





Content analysis details: (9.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.217.104.64 listed in will-spam-for-food.eu.org]

[35.217.104.64 listed in will-spam-for-food.eu.org]

[35.217.104.64 listed in will-spam-for-food.eu.org]

[35.217.104.64 listed in will-spam-for-food.eu.org]

[35.217.104.64 listed in will-spam-for-food.eu.org]

[35.217.104.64 listed in will-spam-for-food.eu.org]

[35.217.104.64 listed in will-spam-for-food.eu.org]

[35.217.104.64 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.217.104.64 listed in dnsbl.ahbl.org]

[35.217.104.64 listed in dnsbl.ahbl.org]

[35.217.104.64 listed in dnsbl.ahbl.org]

[35.217.104.64 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.217.104.64 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.217.104.64 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.217.104.64 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.217.104.64 listed in dnsbl.ahbl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: login.npgmw.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: npgmw.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.217.104.64 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 ACCT_PHISHING Possible phishing for account information

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} Confirm Your Details for Your T5 Tax Slip - Confirmez vos

renseignements pour votre feuillet T5





Questrade

TAX SEASON UPDATE

Your T5 Statement of Investment Income is being prepared. Before we can issue it, we need you to confirm that your personal information on file is accurate.

doctor, please verify your details for your upcoming T5 tax slip



Your T5 reports investment income — dividends, interest, and other earnings from your non-registered accounts — directly to the Canada Revenue Agency. If the personal information attached to your slip is incorrect, the CRA may flag your return for review, delay your assessment, or disallow income reporting.



This is not a penalty and there is nothing wrong with your account. It is a standard pre-issuance check to make sure your T5 reaches the CRA with the right details attached. Most issues are simple — an outdated address, a middle name that does not match your SIN record, or a mailing address that changed during the year.

PLEASE CONFIRM THESE DETAILS

Your full legal name exactly as it appears on your CRA notice of assessment

Your Social Insurance Number (SIN) — must match CRA records

Your current mailing address on file with the CRA

Your date of birth as registered with Service Canada

WHY THIS MATTERS



An incorrect T5 can result in a CRA reassessment, delayed refunds, or additional documentation requests. Verifying now takes under 2 minutes and ensures your tax filing goes smoothly — no follow-ups, no corrections, no surprises.

Verify my details



Log in to confirm your information. Takes under 2 minutes.



Over two million Canadians invest with Questrade. Your personal data is encrypted and handled in strict compliance with Canadian privacy law. If your details are already up to date, no further action is needed — you are all set.

SECTION FRANÇAISE

Questrade

MISE À JOUR — SAISON DES IMPÔTS

Votre feuillet T5 (État des revenus de placement) est en cours de préparation. Avant que nous puissions le délivrer, nous avons besoin que vous confirmiez que vos renseignements personnels au dossier sont exacts.

doctor, veuillez vérifier vos renseignements pour votre prochain feuillet T5



Votre T5 déclare les revenus de placement — dividendes, intérêts et autres gains de vos comptes non enregistrés — directement à l’Agence du revenu du Canada. Si les renseignements personnels liés à votre feuillet sont incorrects, l’ARC pourrait signaler votre déclaration pour examen, retarder votre cotisation ou refuser la déclaration de vos revenus.



Il ne s’agit pas d’une pénalité et il n’y a rien d’anormal avec votre compte. C’est une vérification standard avant l’émission pour s’assurer que votre T5 parvient à l’ARC avec les bons renseignements. La plupart des problèmes sont simples — une adresse périmée, un deuxième prénom qui ne correspond pas à votre dossier de NAS, ou une adresse postale qui a changé en cours d’année.

VEUILLEZ CONFIRMER CES RENSEIGNEMENTS

Votre nom légal complet tel qu’il apparaît sur votre avis de cotisation de l’ARC

Votre numéro d’assurance sociale (NAS) — doit correspondre aux dossiers de l’ARC

Votre adresse postale actuelle au dossier de l’ARC

Votre date de naissance telle qu’enregistrée auprès de Service Canada

POURQUOI C’EST IMPORTANT



Un T5 incorrect peut entraîner une nouvelle cotisation de l’ARC, des retards de remboursement ou des demandes de documents supplémentaires. Vérifier maintenant prend moins de 2 minutes et garantit que votre déclaration de revenus se déroule sans accroc — aucun suivi, aucune correction, aucune surprise.

Vérifier mes renseignements



Connectez-vous pour confirmer vos informations. Prend moins de 2 minutes.



Plus de deux millions de Canadiens investissent avec Questrade. Vos données personnelles sont chiffrées et traitées en stricte conformité avec les lois canadiennes sur la protection des renseignements personnels. Si vos renseignements sont déjà à jour, aucune autre action n’est requise — tout est en règle.

Questrade · Questrade Wealth Management Inc. · Member of CIPF

This is an automated tax season notification sent to doctor.

© 2026 Questrade. All rights reserved.

Questtrade phish from Google gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 10:08:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuBUU-00000000NS5-1YGC

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 10:07:42 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 10:07:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from qtmail05.mbfrgmb.com ([35.217.120.232]:46397)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuAyw-00000000LKF-2Car

for doctor@nk.ca;

Wed, 12 Aug 2026 09:35:14 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=qtmail05.mbfrgmb.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=ADRXUJ@qtmail05.mbfrgmb.com;

bh=3X3YaoxpAoyHRcgfb6eo1avh+YLN51Y7Bt+GoKHBYpM=;

b=gVgNQQbTbj9BslSgWIHT460g18rIEap3LF+KklwusK5tClSug/Fsqw4kT0inWZlsuz30JAFLYaQm

1Y/783RMYPXxN0RiY8o9gmBd3XbeWNCagaL8rcF54wrCVz9XnvD/EfVZhkcGbMabInFkkJ65/cOS

s/it5DV7jlq0Mdm1ZucnmYJ5PXB0/MKZe4/WWsdsnAiWXzTVxLPllWZJSSHUdRz58+lld7jXqG2S

PU53gtWWl9G5gHVzVq22XYuz/vt3ivrZDy4cgCqtmM35VS8fuvoE6PH4s61UKribqkAmH3fKAwM2

WvZl4cFKOf/xonk1UGnNuhEFWfJOEazcs7dTRA==

Content-Type: multipart/alternative;

boundary="===============1194225154559682835=="

MIME-Version: 1.0

From: Questrade Reserve Team

To: doctor@nk.ca

Subject: Confirm Your Details for Your T5 Tax Slip - Confirmez vos

renseignements pour votre feuillet T5

Date: Wed, 12 Aug 2026 11:34:18 -0400

Message-ID: <178654885850.4021.6938034204957569759@qtmail05.mbfrgmb.com>

X-Spam_score: 13.6

X-Spam_score_int: 136

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: TAX SEASON UPDATE — T5 SLIP VERIFICATION NEEDED Confirm

Your Details for Your T5 Tax Slip ================================================================





Content analysis details: (13.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.217.120.232 listed in will-spam-for-food.eu.org]

[35.217.120.232 listed in will-spam-for-food.eu.org]

[35.217.120.232 listed in will-spam-for-food.eu.org]

[35.217.120.232 listed in will-spam-for-food.eu.org]

[35.217.120.232 listed in will-spam-for-food.eu.org]

[35.217.120.232 listed in will-spam-for-food.eu.org]

[35.217.120.232 listed in will-spam-for-food.eu.org]

[35.217.120.232 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.217.120.232 listed in dnsbl.ahbl.org]

[35.217.120.232 listed in dnsbl.ahbl.org]

[35.217.120.232 listed in dnsbl.ahbl.org]

[35.217.120.232 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.217.120.232 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.217.120.232 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.217.120.232 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.217.120.232 listed in dnsbl.ahbl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_DOMAIN_NOVOWEL From: domain has series of non-vowel letters

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: login.npgmw.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: npgmw.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.217.120.232 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.9 URI_PHISH Phishing using web form

1.0 ACCT_PHISHING Possible phishing for account information

Subject: {SPAM?} Confirm Your Details for Your T5 Tax Slip - Confirmez vos

renseignements pour votre feuillet T5





Questrade

TAX SEASON UPDATE

Your T5 Statement of Investment Income is being prepared. Before we can issue it, we need you to confirm that your personal information on file is accurate.

doctor, please verify your details for your upcoming T5 tax slip



Your T5 reports investment income — dividends, interest, and other earnings from your non-registered accounts — directly to the Canada Revenue Agency. If the personal information attached to your slip is incorrect, the CRA may flag your return for review, delay your assessment, or disallow income reporting.



This is not a penalty and there is nothing wrong with your account. It is a standard pre-issuance check to make sure your T5 reaches the CRA with the right details attached. Most issues are simple — an outdated address, a middle name that does not match your SIN record, or a mailing address that changed during the year.

PLEASE CONFIRM THESE DETAILS

Your full legal name exactly as it appears on your CRA notice of assessment

Your Social Insurance Number (SIN) — must match CRA records

Your current mailing address on file with the CRA

Your date of birth as registered with Service Canada

WHY THIS MATTERS



An incorrect T5 can result in a CRA reassessment, delayed refunds, or additional documentation requests. Verifying now takes under 2 minutes and ensures your tax filing goes smoothly — no follow-ups, no corrections, no surprises.

Verify my details



Log in to confirm your information. Takes under 2 minutes.



Over two million Canadians invest with Questrade. Your personal data is encrypted and handled in strict compliance with Canadian privacy law. If your details are already up to date, no further action is needed — you are all set.

SECTION FRANÇAISE

Questrade

MISE À JOUR — SAISON DES IMPÔTS

Votre feuillet T5 (État des revenus de placement) est en cours de préparation. Avant que nous puissions le délivrer, nous avons besoin que vous confirmiez que vos renseignements personnels au dossier sont exacts.

doctor, veuillez vérifier vos renseignements pour votre prochain feuillet T5



Votre T5 déclare les revenus de placement — dividendes, intérêts et autres gains de vos comptes non enregistrés — directement à l’Agence du revenu du Canada. Si les renseignements personnels liés à votre feuillet sont incorrects, l’ARC pourrait signaler votre déclaration pour examen, retarder votre cotisation ou refuser la déclaration de vos revenus.



Il ne s’agit pas d’une pénalité et il n’y a rien d’anormal avec votre compte. C’est une vérification standard avant l’émission pour s’assurer que votre T5 parvient à l’ARC avec les bons renseignements. La plupart des problèmes sont simples — une adresse périmée, un deuxième prénom qui ne correspond pas à votre dossier de NAS, ou une adresse postale qui a changé en cours d’année.

VEUILLEZ CONFIRMER CES RENSEIGNEMENTS

Votre nom légal complet tel qu’il apparaît sur votre avis de cotisation de l’ARC

Votre numéro d’assurance sociale (NAS) — doit correspondre aux dossiers de l’ARC

Votre adresse postale actuelle au dossier de l’ARC

Votre date de naissance telle qu’enregistrée auprès de Service Canada

POURQUOI C’EST IMPORTANT



Un T5 incorrect peut entraîner une nouvelle cotisation de l’ARC, des retards de remboursement ou des demandes de documents supplémentaires. Vérifier maintenant prend moins de 2 minutes et garantit que votre déclaration de revenus se déroule sans accroc — aucun suivi, aucune correction, aucune surprise.

Vérifier mes renseignements



Connectez-vous pour confirmer vos informations. Prend moins de 2 minutes.



Plus de deux millions de Canadiens investissent avec Questrade. Vos données personnelles sont chiffrées et traitées en stricte conformité avec les lois canadiennes sur la protection des renseignements personnels. Si vos renseignements sont déjà à jour, aucune autre action n’est requise — tout est en règle.

Questrade · Questrade Wealth Management Inc. · Member of CIPF

This is an automated tax season notification sent to doctor.

© 2026 Questrade. All rights reserved.

Wealthsimple phish from Google

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 10:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuBTo-00000000NL7-2Yfa

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 10:07:00 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 10:07:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from weal08.ktbbfd.com ([35.207.118.211]:56459)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wu9DO-000000008En-2F2H

for doctor@nk.ca;

Wed, 12 Aug 2026 07:42:02 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=weal08.ktbbfd.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=VGQZQH@weal08.ktbbfd.com;

bh=XwTEOw7XrE7YaOXm7GjUTXsA2xD0TPYHeUS2mFPVt5I=;

b=F3HyPudBGCfP458i76Q+Xt3Ty4RqK37e7KpqJWIsv3AowcdtqcM5AfedGwkGua2UxCF3HgIXNZUn

oZCKZJuapRTJI2wpX2NtB1gkk3y4HywBo9Pit0pVvXncCQYQ3R0vduRd16kXmIAOkQxeOfG60kkH

c8TuKNdrywfz+eODPv1zjSZCmbgk+bAHNMZwdVUl8kKovEufAyjCT1sPND9kJsaE0lyK9wfJkqwJ

nVg8bak0UkLptYOJngPj+844vBltN//sEFiciKeEad6I+6G5JBqoT4A74F2nwNSKVhy7eZTawqYT

SnLLZ0X6wCzeLw36pjFGeC+1Fz0KfLZ8VND+vg==

Content-Type: multipart/alternative;

boundary="===============0325390231036235215=="

MIME-Version: 1.0

From: Wealthsimple Client Support

To: doctor@nk.ca

Subject: =?utf-8?q?Unrecognized_Access_Detected_=E2=80=94_Confirm_Within_48_?=

=?utf-8?q?Hours_-_Acces_non_reconnu_detecte_=E2=80=94_Confirmez_dans_les_48?=

=?utf-8?q?_heures?=

Date: Wed, 12 Aug 2026 09:41:00 -0400

Message-ID: <178654206044.3799.5254954895808657818@weal08.ktbbfd.com>

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: SECURITY ALERT — RESPONSE NEEDED WITHIN 48 HOURS Unrecognized

Access Detected — Confirm Within 48 Hours ================================================================





Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.207.118.211 listed in will-spam-for-food.eu.org]

[35.207.118.211 listed in will-spam-for-food.eu.org]

[35.207.118.211 listed in will-spam-for-food.eu.org]

[35.207.118.211 listed in will-spam-for-food.eu.org]

[35.207.118.211 listed in will-spam-for-food.eu.org]

[35.207.118.211 listed in will-spam-for-food.eu.org]

[35.207.118.211 listed in will-spam-for-food.eu.org]

[35.207.118.211 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.207.118.211 listed in dnsbl.ahbl.org]

[35.207.118.211 listed in dnsbl.ahbl.org]

[35.207.118.211 listed in dnsbl.ahbl.org]

[35.207.118.211 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.207.118.211 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.207.118.211 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.207.118.211 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.207.118.211 listed in dnsbl.ahbl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

1.0 HK_RANDOM_FROM From username looks random

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.207.118.211 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?utf-8?q?Unrecognized_Access_Detected_=E2=80=94_Confirm_Within_48_?=

=?utf-8?q?Hours_-_Acces_non_reconnu_detecte_=E2=80=94_Confirmez_dans_les_48?=

=?utf-8?q?_heures?=



Wealthsimple

doctor, we detected an access attempt we don’t recognize



Our systems flagged a sign-in to your Wealthsimple account from a device or location outside your usual pattern. If you do not confirm this activity within 48 hours, your account will be temporarily locked to prevent any possibility of unauthorized access to your investments.

WHAT WE DETECTED

●Sign-in from a browser or device not previously associated with your account

●Geographic location that does not match your typical access pattern

●Network address outside your known range



No changes have been made to your account, and your funds are fully secure. This is a precautionary measure — part of the continuous monitoring that protects every Wealthsimple account.

If you don’t confirm

Your account will be locked within 48 hours. You will need to contact support to regain access, which may take 1–2 business days.

If you confirm now

Your device is trusted, your account stays open, and you can enable stronger security in one tap. Takes under 30 seconds.

Confirm this was me



Log in to confirm the activity and keep your account open.



Over two million Canadians trust Wealthsimple to protect their financial future. Our security systems monitor accounts around the clock, and alerts like this are how we keep your money safe. If this wasn’t you, logging in now lets you reset your credentials and review recent activity immediately.

SECTION FRANÇAISE

Wealthsimple

doctor, nous avons détecté une tentative d’accès non reconnue



Nos systèmes ont signalé une connexion à votre compte Wealthsimple depuis un appareil ou un emplacement qui ne correspond pas à vos habitudes. Si vous ne confirmez pas cette activité dans les 48 heures, votre compte sera temporairement verrouillé afin d’éviter toute possibilité d’accès non autorisé à vos placements.

CE QUE NOUS AVONS DÉTECTÉ

●Connexion depuis un navigateur ou appareil non associé précédemment à votre compte

●Emplacement géographique qui ne correspond pas à vos habitudes d’accès

●Adresse réseau en dehors de votre plage connue



Aucune modification n’a été apportée à votre compte, et vos fonds sont entièrement en sécurité. Il s’agit d’une mesure de précaution — qui fait partie de la surveillance continue protégeant chaque compte Wealthsimple.

Si vous ne confirmez pas

Votre compte sera verrouillé dans les 48 heures. Vous devrez contacter l’assistance pour récupérer l’accès, ce qui peut prendre 1 à 2 jours ouvrables.

Si vous confirmez maintenant

Votre appareil est reconnu comme fiable, votre compte reste ouvert, et vous pouvez activer une sécurité renforcée en un seul geste. Prend moins de 30 secondes.

Confirmer que c’était moi



Connectez-vous pour confirmer l’activité et garder votre compte ouvert.



Plus de deux millions de Canadiens font confiance à Wealthsimple pour protéger leur avenir financier. Nos systèmes de sécurité surveillent les comptes en tout temps, et des alertes comme celle-ci sont notre façon de protéger votre argent. Si ce n’était pas vous, connectez-vous maintenant pour réinitialiser vos identifiants et examiner l’activité récente immédiatement.

Wealthsimple · Wealthsimple Investments Inc. · Member of CIPF

This is an automated security notification sent to doctor.

© 2026 Wealthsimple. All rights reserved.

Nigerian Business Proposal spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 11 Aug 2026 16:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wtv66-000000003bw-3RjB

for dave@doctor.nl2k.ab.ca;

Tue, 11 Aug 2026 16:37:26 -0600

Resent-From: The Doctor

Resent-Date: Tue, 11 Aug 2026 16:37:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ukwestazolkn19011029.outbound.protection.outlook.com ([52.103.38.29]:36112 helo=CWXP265CU009.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wtruG-00000000E5M-1d4q

for doctor@doctor.nl2k.ab.ca;

Tue, 11 Aug 2026 13:13:09 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=WSUaXWHCDsIz6JMItB06rOoM/ZHd+0CTkxD6N0H9S8bwrRk1JmAoc3HNxxCo94ePttK+BDRio+aQWCufB3lnou74xM8JXs7y4wcIg3cPFa4vN3v/J6a5GAgNNjgBabczLErkJvBVkOURrYfSLt1ZWa10/v4ScjYQvumiPTLu0ezDE0t9Kn+hy358GiBHVbQmqp75QStn7N5OXapQnxbWWrHvNY+A0uZTFY1ogfW7RktD5zAgeFVxUwCzZTZEG519MidlNcLCsLRPgKo9v3aNpIihHCScst9q27O4u9TWwn/Wedkej4KQeY7mWY6WLqz/wdMGub3S8YH1BPfUZn9ilw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=pJuUr/KvbCotuu4ozsSzWcPiVHRs3lzIEGmxgiZqZNo=;

b=Evl4tbmnooPXcXv1quuz+gEfkcf02GKZ004bFzEDSUJmamd5yXHU6u59hvxD6E9O0h+dshe6b1dRPveq8a7axwB+1fQseu5B3+ORdEULnP2lv8eqRm7GhlP3OLi0aDoc3Lq3Y37l3ecncblKi7aCYA1thYNPNYYIrU6D42ODMBZAhuNlw4ezkeBJ2LhmkRHRkUkhkV9vHgz74BieZXoLQNr12RMLpX55hrIb9GHAnDo4NpyPTTEikB9xEvC4VKLa+zMRrjvTYQT2oB9FHqBcEslA6q4wEeM53ODnGvbcBjXVsQBHqCMyItM+hCRSejTVJGIEySjlZ8dcKAuz4cnUlw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=pJuUr/KvbCotuu4ozsSzWcPiVHRs3lzIEGmxgiZqZNo=;

b=KUvrJUst/PB0cmUoLMiCGesqsKFIIF8pze8VTRlK2tWYvqhnVGP7q9t8iRV2BFwEVbUFoZIwvBNl98xWaKmXpjqntBJx93nQDorIb/x/01MvYv4JcEjaXKlvb/IAjSHu9xpDQblJ8QV50FIWqYwRgNRugYvL2j2Gqu6hXX8ouDI+vWx8HUEG7WulhnYvvKK9zcPQ57PPPSXCYLXm/f1X6BYTYkIy1pfIge8muWyhHV3YkpSn74U8Iw7KWuFow5mxqJ3WQvjEaJfBEVS9VF5CleiIy2Pk9llLRUrMQHM11+Ogvcb9JVMv4r9bl0IhLQpuGonkY6zClojgP1OMxRFYkA==

Received: from LOBP302MB2291.GBRP302.PROD.OUTLOOK.COM (2603:10a6:600:447::14)

by CWLP302MB0054.GBRP302.PROD.OUTLOOK.COM (2603:10a6:400:224::11) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.25; Tue, 11 Aug

2026 19:11:39 +0000

Received: from LOBP302MB2291.GBRP302.PROD.OUTLOOK.COM

([fe80::404f:b5ed:5fe9:9a75]) by LOBP302MB2291.GBRP302.PROD.OUTLOOK.COM

([fe80::404f:b5ed:5fe9:9a75%5]) with mapi id 15.21.0292.025; Tue, 11 Aug 2026

19:11:38 +0000

From: Mansour Mohamed

Subject: CEO MANSOUR GROUP

Thread-Topic: CEO MANSOUR GROUP

Thread-Index: AQHdKcU6eYW8Uc/AMUGep340Z75c1g==

Date: Tue, 11 Aug 2026 19:11:38 +0000

Message-ID:



Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: LOBP302MB2291:EE_|CWLP302MB0054:EE_

x-ms-office365-filtering-correlation-id: bc255f6e-a910-4fec-b27c-08def7dc5ebf

x-microsoft-antispam:

BCL:0;ARA:14566002|15030799006|15080799012|31061999003|41001999006|37011999003|8060799015|19110799012|22091999003|24121999003|8062599012|39105399006|19101099003|55001999006|25010399006|4140399003|10035399007|39145399003|41105399003|40105399003|260806224601699006|18071099003|2607281247196008|56899033|34005399003|102099032|3412199025|440099028|2406899039;

x-microsoft-antispam-message-info:

=?utf-8?B?SEw4RURpNGE5OE5JWkVKbUt2NDQ0WkpQbmJDRnJVb3ZxNmhGOTVaWWE3OEpp?=

=?utf-8?B?OWs3YjFXek1PMjI3bWp3WG4rTGNadXp2azBOQWxkcjg3WTcxWWpvbHQ1cGpz?=

=?utf-8?B?R0h5Skw0dHRMMUl0N2JNd2tRU09FaTVVWFBCOEhhVGV2WE93RWVxZGM1cHY0?=

=?utf-8?B?ZWwzMERma29HaWRPb0NtTHFKTEpDdmV3S0o3c05PdDJvRExSMDAvOWtkcVc1?=

=?utf-8?B?Uk9RaTNoZ1I3YzJvMnQ4NkoxZXluc2YxaGlCT3NKQTBKektjc2tneVE2VTA4?=

=?utf-8?B?VUduc2VQRkJxNFF6YlF2S3ZLOW1IT2VLQjlaN0R6MTVGWGNwTHBieFA5Q0kz?=

=?utf-8?B?SldRcEI5b1RVd09HOTU5ZFBpNEhOKzNWZlZHbTA4dGtmZ29aVVp1ZEZTdFpa?=

=?utf-8?B?OHBIdHp5Wk91TWV1UjdocURsZXh4eWxXQ3NQUFRqUC9DL3NhNVNvc2ZCU1h3?=

=?utf-8?B?eE5rUEs0RmE2cG5MZnRUVTR0VXJrTEhYVGk2b0ZQYzRxaWFZODlDZEM3VVox?=

=?utf-8?B?cGRXQitPaU0vZzVnUGlyekMvcmhmNzltR20zSEcvYTNId0Q4cUFKdXFHZUsy?=

=?utf-8?B?L243WVhzQXRMcENPS1ZYWG1pY1ZJdjJBS2dnNjl0aWllMktKODltR2thN3I5?=

=?utf-8?B?V3pkR2pxcXhDNWRneXR4ZmdYQUFHUDkzem9aMG84aDhGejJFcWdGem0zbmRk?=

=?utf-8?B?Uy9TMnJXdVp2MGVtTUtBaWRGOGdBbktpMWJ2NU1nRE90ZUFmWHR3aHMxeWI4?=

=?utf-8?B?VUU5Yjh5OEJUTC9mTEhWMk1HS3l3V0RoSy9VWDBSdG1vZlJIWTJYYTJqODIz?=

=?utf-8?B?bDlIV3hsTU5wTGpOTHE1empEWjN6RlRoWEdhTCszN1pXaWxHemVlTitONnRQ?=

=?utf-8?B?azEyNUoxazJwZFR4U1NxM1J5a3RyKy8wWkFFa1V4YWZ1Q0VhWTFCTDAxRDZY?=

=?utf-8?B?UXk0UzNkRm9oYmVkZEswNkVjTHEwQUlwVDQ0Q2VRS3pxMUJtd2J2TmpwSEtP?=

=?utf-8?B?dzdjbFRZeVZ0UWVYQ3cyUlpmYUtBZ1dHdW9DWDJBZXllUmNkY2VOUjQ0TFV6?=

=?utf-8?B?cWxwRWViT2gvZmhHcGdMdlovUGttRXExMXhwektnOW00ZHlwcTE3TkNIbll2?=

=?utf-8?B?aEgvbmxNaWlBZjNrTy94aEJRWXJuSkFvMnkydngyaWNiU0VPY1YrTUdLVHlB?=

=?utf-8?B?ZFl1UW9JazZjN2p0SktQVVB3UnJ5ZzgwOFJzeUo4WHQvbFdNTnpTOWw4eVlN?=

=?utf-8?B?NC8veHBGTFU4S2I5M3V3NktZV1RUb2FQWjNMSTBwRnJvcUpwZjVjWUFvTzBn?=

=?utf-8?B?SFhwdko0dUttcUVSRm0xY1QzbEszbTMxMzJTb2JVOGdFOFZmbTFsTVArcFp5?=

=?utf-8?B?V1dudmhMdGdXdkFzWFl2bmZucVpib0I4Wm5OeHdNQ2lzOGNVSVQrSUJBZ3Q2?=

=?utf-8?B?cER6TFNlNUQ1dWJrb3o0WUNXckFTY3BLUWcvMkdxTjRxSVlYQmN4V092Z2I3?=

=?utf-8?B?UytwWkxicXQzR0NqMUVEenFYeTZOOHl2VFpwQTRCU0FpN3FzL0tEdmFlT2Fw?=

=?utf-8?B?Mmo3R2hkSHFVSU1NTGJXRkJTTStRS0ZEQzVnVjM3a2JuR01rVkRSYTROalZl?=

=?utf-8?B?Qm9RaU84OWhGb3pqc0lqTGRoQzZZTjUrVVRVcXpaQ0U4Ukt6bFUrV0VaWktX?=

=?utf-8?B?cWZJM3R5MWRUdmZsdXhtVmtKQ2RnenRtYVlZL2xWZDQ2NkpWMzdQZC9BPT0=?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?utf-8?B?VzkzMkRzN1ZCNDBpNWR4czkxaG5ja0h5enNOS3RKSVFKR2dOSFVhcEZURTFw?=

=?utf-8?B?UjVOVUpENjUvYnMvWDJUbVg3Qmw1T3hXUVFjUlVaRjhBT3Y2YlZJcCtONEZq?=

=?utf-8?B?dTN3MFlhWEh1Q25Lc2E5MDUyTUhRRS8vUmdnbEFWdEdvYTRyUWVrYThYR21E?=

=?utf-8?B?Qk5SbjRHQlM4WUc4NHVYZnZrSStsL1Vkdmh0NGNHVmQrOTJsZ3RtLzM3bjBU?=

=?utf-8?B?bmhlbEdybWxydVJEcUZlSUMyM05waHBINUhOOEpUaFdsS3Z0Mm1jVWo5T0RZ?=

=?utf-8?B?NDFSN2cyRzdDck1vM1ZuNDIycHRQVllDdjh4Y3BKdldiUSsrNDY4NERTNzV4?=

=?utf-8?B?YmRrSS9laWRoNWhBc3hTOXBXdW0rd2xrVVdrT1loQ0RqRlBId1RseDRqdU5q?=

=?utf-8?B?Q0N5KzRoVUt2eWhiMXJBeENiOUFJYW1WUjBjZ0xiR2h1SzVFMzc4d2twaWE3?=

=?utf-8?B?K0g4MGpHdXo5SEk1WGJYQ0srR1hMZ29pMnNGVnFOUS9JUmFvclNWRmNzNVZs?=

=?utf-8?B?QmU1WFVvejRZajU0S2Y5cTBzb0RsZFlkamJDNU9TUDNGellUbG95MVQyRjBq?=

=?utf-8?B?SWZlK0pERXEwOEJLRXFPK2YyM256SnlEMWR2UkJtMVgrd3BGcHhQTjBrQXlJ?=

=?utf-8?B?K1FPOElhZmRTQWMrbE11UUx0M2JTcXloQ2JHUWpTWHZFOGpwY1NRd1ZHRXpv?=

=?utf-8?B?T2doTjJmNVJZc2N3aDNCYzVJeGU5REhqSjRaMHVCb2RSaGlZOGN6WmxlODNB?=

=?utf-8?B?Q2kyVWt4czhISlhkcGowS0loWUhrcUhTdWkzVVlHMHNnckozM1R4eWtFWE1L?=

=?utf-8?B?YWdqR3NEcWtpUGVRY1M4WW1ZUjFsOXloU25wT0s0aFcrUzc0Z0Q4SGdmd2NP?=

=?utf-8?B?Ykx6TUFaVzk1UXFMSk9XOVBqS1Zhbkp0VmRnZFlzNWZHUkFUbFlZRzdua29O?=

=?utf-8?B?Z2c5Wm4va1I0VG1vTWU3RUhzUm92em1adklzWTNoQmIwOXNhU0pEaW1hNXA4?=

=?utf-8?B?TTJpWW44YzBUdVRxM1BJd1BReTN4QWlESWJyYW1WNFVGRlFkS1BndE8zT3pZ?=

=?utf-8?B?TmkraUV5ZThjSERlbHJhM0s1UHVLVWxLL2NnendFeFJZYmg1TUtUNFlCQWlP?=

=?utf-8?B?ZzdmVXdoM05INUI5bHgwaytYVUU5WVF0dVdoWkN4OGo1alBLanlrSlh5d2t0?=

=?utf-8?B?RkJoV1UzV2ZxNGh5VDRGU1BwZGkrY2pjdE13dmVKcVgxMGp0VTYxcjVmNnB4?=

=?utf-8?B?djhSTDV1ckEzYUErUXJ3N1EyeEl1QmNJeVZ2dDJZamt1NTdmQnh0R2t0N0ZT?=

=?utf-8?B?RGQ2ZEpXNG44MGQ0WEE0OG0xT1pjY0E1WE05bHJSWG1GR1JqWmxoTkJpVE8x?=

=?utf-8?B?eE1zZTVMeExwNWI4dWllUS84a0tVODNSQW9SOUZrYjdqK0M0dExrVFFDZldO?=

=?utf-8?B?R0hIL1JxSFE1SlgvVnVVdGpsM1p4RkNBUDZ4SUh3VzNFTkhKYXJqWndMTThz?=

=?utf-8?B?ZzhSMEswMVA3STlHRWVnUFhTY0RjNG1aZEloRWNDb2VDSGpSYnlHbWZVQ3Zz?=

=?utf-8?B?YVFBNmMxdnBPNHhZNWE0L2x5Rm50bEhPZmdGd3ROOHhSbWRrbUV2QjVoVVhu?=

=?utf-8?B?ZlV0dXBXUm1iUXRmay8ycHMrNHRIU05ZMnlleXpZU3prUFV0N3NveExtbmpN?=

=?utf-8?B?VmJCbGpEOUJOV040NXN3a1pEMXlXVEx1MUJiWkQ1UDlqa1pkSWRieHlkZTVx?=

=?utf-8?B?aklaTVFWeU1KQkVMNmhqV3VOZXd6Z0ZiUGtoaVFkRkNJSS9DbDVRazd0alFz?=

=?utf-8?B?Ly9GVmUwVzlFVmJMZUhRNzEzaXZPdVRHTlZjaDhJOHJzN2VDODNzUGY2L1BW?=

=?utf-8?B?aVNvR24wSmh0a3VjdzNjVnZ5b0VKeGdFbGxHOUJ2MTFSOUE9PQ==?=

Content-Type: multipart/alternative;

boundary="_000_LOBP302MB2291950B0B5BF2DA05D2DF36C9DD2LOBP302MB2291GBRP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: LOBP302MB2291.GBRP302.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: bc255f6e-a910-4fec-b27c-08def7dc5ebf

X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Aug 2026 19:11:38.6785

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP302MB0054

X-Spam_score: 7.9

X-Spam_score_int: 79

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings! My name is Mohamed Mansour (CEO Mansour Group),

I got your contact from my LinkedIn contact. I have a business project worth

the sum of Usd$15,600,000 which I wish to discuss with you and I [...]



Content analysis details: (7.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:600:447:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:600:447:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:600:447:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:600:447:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:600:447:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:600:447:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:600:447:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:600:447:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[52.103.38.29 listed in will-spam-for-food.eu.org]

[52.103.38.29 listed in will-spam-for-food.eu.org]

[52.103.38.29 listed in will-spam-for-food.eu.org]

[52.103.38.29 listed in will-spam-for-food.eu.org]

[52.103.38.29 listed in will-spam-for-food.eu.org]

[52.103.38.29 listed in will-spam-for-food.eu.org]

[52.103.38.29 listed in will-spam-for-food.eu.org]

[52.103.38.29 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.38.29 listed in dnsbl.ahbl.org]

[52.103.38.29 listed in dnsbl.ahbl.org]

[52.103.38.29 listed in dnsbl.ahbl.org]

[52.103.38.29 listed in dnsbl.ahbl.org]

[2603:10a6:600:447:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:10a6:600:447:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:10a6:600:447:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:10a6:600:447:0:0:0:14 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.38.29 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.38.29 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.38.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.38.29 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.38.29 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[mansourgroupchairman(at)outlook.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.2 MISSING_HEADERS Missing To: header

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[52.103.38.29 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.38.29 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

Subject: {SPAM?} CEO MANSOUR GROUP











Greetings!

My name is Mohamed Mansour (CEO Mansour Group), I got your contact from my LinkedIn contact. I have a business project worth the sum of Usd$15,600,000 which I wish to discuss with you and I need your kind response to discuss further.



Kindly reach out at your earliest convenience.



While I wait your response, please accept the assurances of my highest regards.





Best,



Mohamed Mansour



Founder & CEO: Mansour Group



Address: No.17, Ummam Center Salah Eddeen Road, Malaz Riyadh, Kingdom of Saudi Arabia

      

Website: www.mansourgroup.com



The content of this email is confidential and intended for the recipient specified in message only. It is strictly forbidden to share any part of this message with any third party, without a written consent of the sender. If you received this message by mistake, please reply to this message and follow with its deletion, so that we can ensure such a mistake does not occur in the future. Unsubscribe from email or ignore





Loan spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 11 Aug 2026 16:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wtv5l-000000003XQ-3eK2

for dave@doctor.nl2k.ab.ca;

Tue, 11 Aug 2026 16:37:05 -0600

Resent-From: The Doctor

Resent-Date: Tue, 11 Aug 2026 16:37:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f47.google.com ([209.85.216.47]:44066)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wtrcI-000000001Pf-46Ju

for sales@nk.ca;

Tue, 11 Aug 2026 12:54:29 -0600

Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-38d489b6b71so273304a91.0

for ; Tue, 11 Aug 2026 11:53:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=kesefmarketing.com; s=google; t=1786474413; x=1787079213; darn=nk.ca;

h=references:list-unsubscribe-post:list-unsubscribe:message-id:date

:to:from:subject:mime-version:content-type:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=vQV3PY/M7PkQwTUHm/rajiqVNItQbR9e4he4jNjR/Pc=;

b=CoZI/SfC3YZFRWN8F9XafZUuNR4XEzH1G0OEbmV/btjr/pyc4oizZ+FZO422pTa9z8

14S+aKVQFgx/7G7fdOQiPom0EcMghPz1XUHzSU5A4lQP4kr28gvg++EmwD2bNwlb0EkQ

Aj0RsCDWZK5lNsbck2FotRk8/bmp1fng5g+eIg4SC30PB98myZKNlf5EQlNyAAq3GaR3

ni7YQQL44/AgF+b4aHyW6ihPT+PU5FBtBo+lMjrDBNeyysqHVe6UvtQvVpdTIAQwOQ+J

3h8h3BpAZV8a473WfgNLFiT0zCzFiXX64Hyx5ZsZqsXwQGNvVEGEYimJen+rOy3BkNaH

+LaA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786474413; x=1787079213;

h=references:list-unsubscribe-post:list-unsubscribe:message-id:date

:to:from:subject:mime-version:content-type:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=vQV3PY/M7PkQwTUHm/rajiqVNItQbR9e4he4jNjR/Pc=;

b=s9HpI6Wy82PQPHo8RpIL0Cl4ITb9oZLN6GrGCaB+yDG87oBl8ld6S4OND9zNR6XNua

BrmzrFIMqEC92yfU5Nej6SABfnEAxm1q+nDKfEF2y2h5jlerue4G5FwUM1e7tpi8WaTF

8EyJTobsEmZQkpiWHQtRxHJdWIpXWOqlOny8pRmW1TDHbPACjSYn5rREk83BVRT8yE2n

sm+kx2lDc6YkB5/TnPLNSZs+rRJvMSNIsg99qrz7uprrl4RrkYEgxTU+YAxh9TZ7ujcc

USDnBQaXFvdkUe3Bz7b4nqvMDjGDItzU+P9e2hkwZPjlIPxVvJ3NYzKqRLpBXtKq/0jc

gGdg==

X-Gm-Message-State: AOJu0YxEko+TSRLwrT9LoflX9On32mXGcPxG0cBkZsAtdUVwU3eldHii

/nQKcSjo3QXo+zGQ6uilFdfPk0pbhF/UbUv+s/SR/0CJrj01hK7k1zreDMRCFivVkH2Xb68NlUr

eDOZV

X-Gm-Gg: AR+sD12qp+4ysf3krwrCfqCzVJjWOTFhQZdlQ5UgeheHCzUh+9/YRLBr/QZF2RWCe1Q

guxAsUCHK/e1GKA14dXZwMQh4zAS3rk6bowA/TlulszwmhjcqNTtEFxim7xA4Z+HLds+WJcc6Dh

8U9LNw3zeSykPSpdL26KTawG3twuqcKoVNTJyoFu+stw2YqhmvT/4TjwX3znkgchYaWftPeTO4p

JBc/+vEpVabC3XXZKaeeLkC3EQgWulgL6j0sfKjccTkNUhgH7NQX00S1bshII7C1QA0/npM7uWt

X1pVrDF8G1ljWmFhjfDLpHEeNwIEefMg0MCGK/Ke+3bkYIcKwon7GJPsoE3Mj9pi6uEvhxRS1Pz

cBYV/u2wsUME6RotctsRCxmAcctyZ7wRhdetCLzTw2FgpzOGyGgYxUBU1ZEkerlCruq8PkzUs9x

ZFUkO/RdlJ0Dni9rPB++BQJeBhmyb6MtUdlkh2xm4uTvMg0VMWBd51/c6hfRwyUfme3+zJn/Y3e

wG+SkwBIfWPy6CcRRxLuejr7ysf

X-Received: by 2002:a17:90b:5443:b0:37c:6130:7a5b with SMTP id 98e67ed59e1d1-392f46d17a5mr2372890a91.8.1786474412937;

Tue, 11 Aug 2026 11:53:32 -0700 (PDT)

Received: from smtpgw.close.com (am11-natgw-b0.close.com. [54.186.6.46])

by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-392f94add3asm527171a91.12.2026.08.11.11.53.32

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 11 Aug 2026 11:53:32 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============2816051746494269302=="

MIME-Version: 1.0

Subject: Fast Capital Option for Your Business

From: =?utf-8?q?Lilian_Llanillo?=

To: sales@nk.ca

Date: Tue, 11 Aug 2026 18:53:32 +0000

Message-ID: <178647441175.7.488087535726553235@smtpgw.close.com>

X-CLOSEIO-EMAIL-ID: acti_YhwDK8b2tyEbUFWxrnxNv2WuB35FVbMzY5e4eFQpWxV

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

References: <178647441175.7.7550506905009199379@smtpgw.close.com>



--===============2816051746494269302==

Content-Type: multipart/alternative; boundary="===============2182699059810350290=="

MIME-Version: 1.0



--===============2182699059810350290==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



Hi Gurkirat Wirring ,



=20



I tried reaching you briefly by phone earlier but wasn=E2=80=99t able to co=

nnect.



=20



My name is Lilian Llanillo from Kesef Marketing. I=E2=80=99m reaching out b=

ecause we

work with business owners who are looking for faster access to working capi=

tal

to support growth, expansion, or improve cash flow.



=20



Unlike traditional banks, our process is much simpler. We typically don=E2=

=80=99t

require tax returns or collateral, and approvals are usually based on the

business=E2=80=99s recent cash flow. In many cases, funding can be arranged=

within 24

to 48 hours once everything is reviewed.



=20



Even if you=E2=80=99re not actively looking right now, many owners like to =

keep an

option like this available for when the right opportunity comes up.



=20



If you have a few minutes later this week, I=E2=80=99d be happy to introduc=

e myself

and see if this could be helpful for your business.



=20



=20



=F0=9F=91=89 **Complete Your Application Here:**[**Click Here To Start Your

Application**](https://form.jotform.com/260672364104452?lead_id=3D)



Wishing you continued success, and I look forward to connecting.



=20



Best regards,



=20



=20



**Lilian Llanillo**



**FUNDING ADVISOR**



=20



![email \(16px\).png](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877403=

9066-email+%2816px%29.png)****[**lilian@kesefmarketing.com**](https://lilia=

n@kesefmarketing.com)



![phone-call \(16px\).png](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877413=

7354-phone-

call+%2816px%29.png)**+1 (873) 771-7630**



**____________________________**



![IMG_5340.jpg](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877416=

5068-IMG_5340.jpg)



=20



To stop receiving these emails, click

[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=

kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).

--===============2182699059810350290==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



Hi Gurkirat Wirring ,

I tried reaching you br=

iefly by phone earlier but wasn=E2=80=99t able to connect.


div>
My name is Lilian Llanillo from Kesef Marketing. I=E2=80=99m reach=

ing out because we work with business owners who are looking for faster acc=

ess to working capital to support growth, expansion, or improve cash flow.<=

/div>

Unlike traditional banks, our process is much simp=

ler. We typically don=E2=80=99t require tax returns or collateral, and appr=

ovals are usually based on the business=E2=80=99s recent cash flow. In many=

cases, funding can be arranged within 24 to 48 hours once everything is re=

viewed.

Even if you=E2=80=99re not actively lookin=

g right now, many owners like to keep an option like this available for whe=

n the right opportunity comes up.

If you have a fe=

w minutes later this week, I=E2=80=99d be happy to introduce myself and see=

if this could be helpful for your business.


<=

/div>
Wishing you continued success, and I look forward =

to connecting.

Best regards,

<=

span data-system-generated=3D"signature">

nt-weight: 700;">Lilian Llanillo

yle=3D"font-weight: 700; color: rgb(57, 208, 150);">FUNDING ADVISOR<=

/strong>


.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774039066-email+%2=

816px%29.png" alt=3D"email (16px).png">
700;">
t=3D"_blank" rel=3D"noopener noreferrer nofollow">
nt-weight: 700;">lilian@kesefmarketing.com

mg src=3D"https://closeio-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgm=

o8WoImXFkS0Dtk%2F1778774137354-phone-call+%2816px%29.png" alt=3D"phone-call=

(16px).png"> +1 (873) 771-7630
span>
________=

____________________

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877416=

5068-IMG_5340.jpg" alt=3D"IMG_5340.jpg" style=3D"width: 159px; height: 64.1=

129px;">


ibe-footer">


/YhwDK8b2tyEbUFWxrnxNv2WuB35FVbMzY5e4eFQpWxV/1TRpq4kUQd.png" alt=3D"" width=

=3D"1" height=3D"1" />

--===============2182699059810350290==--



--===============2816051746494269302==--

chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 11 Aug 2026 16:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wtv4x-000000003MV-3ubE

for dave@doctor.nl2k.ab.ca;

Tue, 11 Aug 2026 16:36:15 -0600

Resent-From: The Doctor

Resent-Date: Tue, 11 Aug 2026 16:36:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m478512586.xmail.ntesmail.com ([47.85.125.86]:52468)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wtqrJ-00000000Jc8-41m7

for sales@nk.ca;

Tue, 11 Aug 2026 12:06:04 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_1051104_1418863448.1786471495171"

To: sales

Subject: =?UTF-8?B?UmU6IFN0aWxsIGxvb2tpbmcgZm9yIGEgcmVsaWFibGUgZnJlaWdodCBwYXJ0bmVyIGluIENoaW5hPyA=?=

X-Priority: 3

MIME-Version: 1.0

Received: from sales03_szx@bnclogistics.com( [10.139.4.160] ) by ajax-webmail ( [127.0.0.1] ) ; Wed, 12 Aug 2026 02:04:55 +0800 (GMT+08:00)

From: Sunny

Date: Wed, 12 Aug 2026 02:04:55 +0800 (GMT+08:00)

X-WM-Tid: 0a9ff1ffb5f9d096kusy06a5572a14b8b2

Message-ID:

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: B&C International Logistics offers reliable shipping solutions

from China to the US, addressing challenges like rising freight costs and

delayed shipments to streamline your supply chain management. H [...]



Content analysis details: (5.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[47.85.125.86 listed in will-spam-for-food.eu.org]

[47.85.125.86 listed in will-spam-for-food.eu.org]

[47.85.125.86 listed in will-spam-for-food.eu.org]

[47.85.125.86 listed in will-spam-for-food.eu.org]

[47.85.125.86 listed in will-spam-for-food.eu.org]

[47.85.125.86 listed in will-spam-for-food.eu.org]

[47.85.125.86 listed in will-spam-for-food.eu.org]

[47.85.125.86 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[47.85.125.86 listed in dnsbl.ahbl.org]

[47.85.125.86 listed in dnsbl.ahbl.org]

[47.85.125.86 listed in dnsbl.ahbl.org]

[47.85.125.86 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[47.85.125.86 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[47.85.125.86 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[47.85.125.86 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[47.85.125.86 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[47.85.125.86 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?B?UmU6IFN0aWxsIGxvb2tpbmcgZm9yIGEgcmVsaWFibGUgZnJlaWdodCBwYXJ0bmVyIGluIENoaW5hPyA=?=



Hi partner,



I came across your company while researching businesses importing products from China, and I wanted to reach out.



Many US importers tell us they're facing similar challenges—



l rising freight costs,



l delayed sailings,



l limited vessel space during peak seasons,



l slow communication when shipments run into problems.



That's where we help.



At B&C International Logistics, we support US importers with dependable shipping solutions from China, backed by local teams in both China and the US to keep cargo moving and issues resolved quickly.



Rather than simply moving containers, we focus on making your supply chain more predictable and easier to manage.



Would you be open to a quick conversation to see if there's an opportunity to support your business?





Don’t miss out on our latest impro vements: hit . Receive Ongoing Info



To halt receiving emails, head to Adjust Inbox Choices.









Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 11 Aug 2026 16:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wtv4a-000000003Hl-1wi7

for dave@doctor.nl2k.ab.ca;

Tue, 11 Aug 2026 16:35:52 -0600

Resent-From: The Doctor

Resent-Date: Tue, 11 Aug 2026 16:35:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m81247.netease.com ([47.88.81.247]:59530)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wtqL5-00000000DtH-0Hwp

for sales@nk.ca;

Tue, 11 Aug 2026 11:33:00 -0600

Content-Type: multipart/mixed; BOUNDARY="=_Part_1042012_1444395078.1786469495750"

To: sales

Subject: =?UTF-8?B?UmU6IEV4Y2x1c2l2ZSBEaXN0cmlidXRvciBCZW5lZml0cyBmb3IgT1VSRUxBIG91dGRvb3IgR1BTIHdhdGNoZXMg?=

X-Priority: 3

MIME-Version: 1.0

Received: from lilian@ourela.com( [10.139.1.59] ) by ajax-webmail ( [127.0.0.1] ) ; Wed, 12 Aug 2026 01:31:35 +0800 (GMT+08:00)

From: Lilian

Date: Wed, 12 Aug 2026 01:31:35 +0800 (GMT+08:00)

X-WM-Tid: 0a9ff1e1330d069dkunmaba1ac9f148cf9

DKIM-Signature: a=rsa-sha256;

b=HYi0GRNzBeLjh0lj51l2o87OAT8Y9zjzrprfpa2HBf8MyObaYH2dqe2aMEwsz3xiIpLDKLezazO/HJTNfShVUklCg/cQMrakFM4+yMGRFEXDHTRjZFlQ2F+x3T4elWgwN4OVTFCmeXxY8v8yduk3cCcfthroB94+RotCikJJsRs=; s=default; c=relaxed/relaxed; d=ourela.com; v=1;

bh=v3T6ZZGiKqvJSMZDVzuBQR8z+jhKrtupPKW+YNtl88c=;

h=date:mime-version:subject:message-id:from;

Message-ID:



--=_Part_1042012_1444395078.1786469495750

Content-Type: multipart/alternative; BOUNDARY="=_Part_1042013_1449787921.1786469495750"





Dear Sales,



I’m reaching out again to share extra market & partnership highlights about OURELA’s GPS smartwatch series that I didn’t fully cover last time, which I believe will bring stable high margins to your business.



Why OURELA Mid-Range Outdoor GPS Watches Stand Out in Market

Most outdoor GPS watches on the market are either ultra-expensive brands like Garmin or fitbit or low-end basic smartwatches without accurate satellite navigation. OURELA perfectly fills this blank: professional full outdoor functions at mid-range price, so your channel can attract both budget-focused adventurers and quality-sensitive urban sports users.



Exclusive Benefits for New Authorized Distributors:

1. First-order exclusive discount for new partners to lower your trial cost

2. Free customized marketing posters, short video ads for your online & offline store

3. Priority stock allocation during peak hiking/camping seasons

4. Streamlined return & warranty service to cut your after-sales workload



Our 4-model lineup allows you to create tiered product pricing in your store: rugged high-end models for hardcore hikers, slim lightweight models for city consumers, maximizing your customer coverage. The built-in compass, altitude pressure monitor and offline trail maps are strong selling points to beat competitors.

Would you mind replying with a quick yes/no if you’re interested in receiving our full distributor proposal?

If outdoor wearable expansion is not your current priority, simply let me know and I won’t disturb you repeatedly.



Sincerely,









Lilian



lilian@ourela.com

www.ourela.com

Whatsapp: +8615914183886





在2026-07-22，Lilian 写道:



-----原始邮件-----

发件人： Lilian

发件时间: 2026年07月22日 周三

收件人： [sales ]

主题： New UK-inspired Outdoor GPS Smartwatch brand OURELA Distribution Oppotunity



Dear Sales ,



Hope this email finds you well.

I’m Lilian from OURELA, a UK-rooted outdoor smartwatch brand, writing to introduce our brand-new full series of professional Outdoor GPS Sports Watches, and explore exclusive distributor partnership with your company.



About OURELA

Founded by British designers & outdoor enthusiasts, we fill the market gap: premium rugged outdoor watch performance at mid-range accessible prices. Our core values are high durability, multi-satellite precise positioning, and timeless dual-scenario design (wild adventure + daily urban wear).



We own ISO9001 automated manufacturing factory and independent R&D labs in Shenzhen, and a complete supply chain to guarantee stable quality & healthy profit margins for global partners.



Distributor Exclusive Support

- Ready stock with 3-5 days fast global shipment

- 15-month industry-leading product warranty

- flexible MOQ



The global outdoor wearable market is booming, while mid-range professional GPS watches remain underserved.

OURELA’s “accessible premium” positioning will help you capture adventure enthusiasts segment users easily.

I’ve attached our brand catalog & product spec sheet for your reference. if you are interested for sample testing, pls fell free to let me know.



Best regards,





Lilian



lilian@ourela.com

www.ourela.com

Whatsapp: +8615914183886





Neo phish from nxcli

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dae@doctor.nl2k.ab.ca

Delivery-date: Tue, 11 Aug 2026 16:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wtv45-000000003B3-2wJQ

for dae@doctor.nl2k.ab.ca;

Tue, 11 Aug 2026 16:35:21 -0600

Resent-From: The Doctor

Resent-Date: Tue, 11 Aug 2026 16:35:21 -0600

Resent-Message-ID:

Resent-To: dae@doctor.nl2k.ab.ca

Received: from cloudhost-3090806.us-midwest-1.nxcli.net ([209.87.149.148]:33570)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wtpVZ-000000005EJ-3ri2

for sales@nk.ca;

Tue, 11 Aug 2026 10:39:29 -0600

Comment: DomainKeys? See http://domainkeys.sourceforge.net/

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=default; d=2fd4e89872.nxcli.io;

b=gwGJG1u4IJOAQ17tJ9IslNpHEjDnsTgS2rH/u+gxXQyIrRQIG08OK752D1Cog1vzDXeHs7Q1EXqIi7Rt04/tuoj7lVACes0RIa2gR/oj4CWPbV4i9lcVcJBZIFFwNevF3G+I5DtLIjjWe8sHx1vNm/hMdZg6JtbeiGIuD+gRguqhRB5RqlGSrIjpns0rwJfvilReQZPN7A3qpnwwdoaducjY5Th3kFkWeblRlIx7lIKQm6BBuH2vl1H6UV73xp+7WGJWcdrwQ5sXfIEWPz1drXH1sdU+d2DscV7BrBSnCEPLIRu9D+RxUYfEAdQlyllpWTBX1ZXqpaKdF+TH5xXbNQ==;

h=Received:Date:Message-ID:To:Subject:X-PHP-Originating-Script:MIME-Version:Content-type:From:Reply-To;

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=2fd4e89872.nxcli.io; h=

date:message-id:to:subject:mime-version:content-type:from

:reply-to; s=default; bh=2SS/kNgj1ZAvMcVdpUquqA6KXnhgx27WYkJMtIF

9zWA=; b=n6ksSsaI3Ztn6DgfXE3bgfVx7YsgfRrUjpSsQlEq2qcdIpw37xA0fTp

va+gVKV6ZnSbImLXgCyfQCYf8RnZkq1LobyVqdjUQEfoNkD1Nj5vXuOINfNkgCT5

NdekdMdhi6dT9tkdDhoR9rJQeMo2b5x+NfIAIG8ZUvzi3Ctab59fUyrbE7FuO39z

8CaMi9ATrEKG0PBUlZ+xk5qhgNC+oM8IHCID4yIyZsWh/TlM3+j58UimI9+U/eDe

eQrtpg4qCBH2RfnmFsNKl1k5hYA1G9/KOd6F7/KacfBbABcMhd7bjD8Jk7yDfUjP

48s5T9TxoWia4CTYKtnIQ5PfyL+LlqQ==

Received: (qmail 4227 invoked by uid 10222); 11 Aug 2026 16:38:27 +0000

Date: 11 Aug 2026 16:38:27 +0000

Message-ID: <20260811163827.4215.qmail@cloudhost-3090806.us-midwest-1.nxcli.net>

To: sales@nk.ca

Subject: Security Update For Enhanced Protection

X-PHP-Originating-Script: 10222:mdm.php

MIME-Version: 1.0

Content-type: text/html; charset=UTF-8

From: Neo Financial

Reply-To: postmaster@2fd4e89872.nxcli.io















Security Update - Neo Financial













🔒 Security








Security Update For Enhanced Protection





August 11, 2026 | Subject: Continuous Security Improvement




Dear Neo Member,





At Neo, the security of your finances is our top priority. That's why we're rolling out a major security update to our infrastructure today. This enhancement, designed to deliver unwavering reliability, reflects our commitment to providing you with superior protection.









🛡️ Next Gen Security





Advanced security isn't an add-on; it's the foundation. Every Neo account and card is now fortified with next-generation technology designed to stop unauthorized movement before it starts.













✓






Real-time Alerts





Get instant notifications for every purchase or money movement. Full transparency means you can spot any irregularities quickly.











✓






Mastercard Zero Liability Protection





You're not responsible for unauthorized purchases made with your card. Enjoy peace of mind with every transaction.











✓






Enhanced Authentication





Our multi-factor authentication system has been upgraded for even more robust identity verification.











This update requires action on your part. We've also strengthened our encryption protocols and proactive monitoring to ensure optimal reliability for your transactions and data.



Log In to Your Account



Need help? Contact us











CDIC The safety of a big bank, without the big bank baggage. Your deposits are protected by the Canada Deposit Insurance Corporation.






© 2026 Neo Financial