WealthSimple T5 Phish from Google

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 23 Aug 2026 17:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyHqt-00000000G2K-3sV8

for dave@doctor.nl2k.ab.ca;

Sun, 23 Aug 2026 17:43:47 -0600

Resent-From: The Doctor

Resent-Date: Sun, 23 Aug 2026 17:43:47 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from email14.hzhssc.com ([35.214.26.233]:49573)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyDbi-00000000JFO-3aLc

for doctor@nl2k.ab.ca;

Sun, 23 Aug 2026 13:11:58 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=email14.hzhssc.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;

i=info@email14.hzhssc.com;

bh=yS4Z2CrwwT3yQHzEfF9sT006uPMkoAdqAXsu2vzm8tk=;

b=Nb1aKLfe9UbE762JzMSO2oLN1V7RsiCCX2j/N0P0OPM3YP2U8TC5k0GWyqIVlI4zO0HdnlauynVa

5UTcm5RqeL1mJbB7ud9ucbFH+71BbQgyEEHmzfrTpMmtvdowhNpGS24A0bgz9fka5qL5b0y4lcR5

AqQT29sHajqatZA8JJ2CKI1rxf6FiibJ4KUi7fSphnbC42D+vkhE2kMKaF/8dZoWGG/csT7cGJyI

QkLkmwx0pAhuvJLqv9sUs8ICKZus7IxTn4ixSDVhG8rbSkEsaI24xknC+kmd1/c4Uxs3SEnjD54P

zp2/hOl8dr+sNSxmVbMRnPgvIC68DtNHzJm1pA==

Content-Type: multipart/alternative;

boundary="===============3649354081281856333=="

MIME-Version: 1.0

From: Wealthsimple Notify

To: doctor@nl2k.ab.ca

Subject: Your T5 is almost ready - we just need a quick update

Date: Sun, 23 Aug 2026 15:11:01 -0400

Message-ID: <178751226134.4018.13851216408756025903@email14.hzhssc.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Reply-To: info@email14.hzhssc.com

X-Spam_score: 10.8

X-Spam_score_int: 108

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi doctor, We're getting your T5 tax slip ready, but a few

details in your profile are missing or don't quite match our records. A quick

review on your end will get everything back on track. Please complete this

within 24 hours of receiving this email so we can keep your tax slip on schedule.





Content analysis details: (10.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.214.26.233 listed in will-spam-for-food.eu.org]

[35.214.26.233 listed in will-spam-for-food.eu.org]

[35.214.26.233 listed in will-spam-for-food.eu.org]

[35.214.26.233 listed in will-spam-for-food.eu.org]

[35.214.26.233 listed in will-spam-for-food.eu.org]

[35.214.26.233 listed in will-spam-for-food.eu.org]

[35.214.26.233 listed in will-spam-for-food.eu.org]

[35.214.26.233 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.214.26.233 listed in dnsbl.ahbl.org]

[35.214.26.233 listed in dnsbl.ahbl.org]

[35.214.26.233 listed in dnsbl.ahbl.org]

[35.214.26.233 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.214.26.233 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.214.26.233 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.214.26.233 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.214.26.233 listed in dnsbl.ahbl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: www.grnysm.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: grnysm.com]

0.0 URIBL_RED Contains an URL listed in the URIBL redlist

[URI: grnysm.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.214.26.233 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.9 URI_PHISH Phishing using web form

1.0 ACCT_PHISHING Possible phishing for account information

Subject: {SPAM?} Your T5 is almost ready - we just need a quick update



--===============3649354081281856333==

Content-Type: text/plain; charset="iso-2022-jp"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Hi doctor,



We're getting your T5 tax slip ready, but a few details in your profile are missing or don't quite match our records. A quick review on your end will get everything back on track.



Please complete this within 24 hours of receiving this email so we can keep your tax slip on schedule.



Update your information:

https://www.grnysm.com/?uid=wqKxEw578gAUvrRrM5Ob8dZX



How it works:

1. Log in to your Wealthsimple account.

2. Review and update your personal information.

3. Save your changes - we'll take care of the rest.



It only takes a couple of minutes, and we'll never ask for your password by email.



Thanks for taking care of this,

Team Wealthsimple



---

This email was sent to doctor@nl2k.ab.ca.

This is an automated message from Wealthsimple. Please do not reply directly to this email.



--===============3649354081281856333==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PCEtLSBzdWJqZWN0OiBZb3VyIFQ1IGlzIGFsbW9zdCByZWFkeSAtIHdlIGp1c3QgbmVlZCBhIHF1

aWNrIHVwZGF0ZSAtLT4KCjwhRE9DVFlQRSBodG1sPgo8aHRtbCBsYW5nPSJlbiI+CjxoZWFkPgog

IDxtZXRhIGNoYXJzZXQ9IlVURi04Ij4KICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0i

d2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+CiAgPHRpdGxlPllvdXIgVDUg

aXMgYWxtb3N0IHJlYWR5IC0gd2UganVzdCBuZWVkIGEgcXVpY2sgdXBkYXRlPC90aXRsZT4KPC9o

ZWFkPgo8Ym9keSBzdHlsZT0ibWFyZ2luOjA7IHBhZGRpbmc6MDsgYmFja2dyb3VuZC1jb2xvcjoj

RkFGOEY1OyBmb250LWZhbWlseTpBcmlhbCwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyAtd2Via2l0

LXRleHQtc2l6ZS1hZGp1c3Q6MTAwJTsgLW1zLXRleHQtc2l6ZS1hZGp1c3Q6MTAwJTsiPgoKICA8

IS0tIE91dGVyIGJhY2tncm91bmQgLS0+CiAgPHRhYmxlIHJvbGU9InByZXNlbnRhdGlvbiIgd2lk

dGg9IjEwMCUiIGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgYm9yZGVyPSIwIiBzdHls

ZT0iYmFja2dyb3VuZC1jb2xvcjojRkFGOEY1OyBwYWRkaW5nOjQwcHggMTZweDsiPgogICAgPHRy

PgogICAgICA8dGQgYWxpZ249ImNlbnRlciI+CgogICAgICAgIDwhLS0gQ29udGVudCBjb250YWlu

ZXIgLS0+CiAgICAgICAgPHRhYmxlIHJvbGU9InByZXNlbnRhdGlvbiIgd2lkdGg9IjEwMCUiIGNl

bGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgYm9yZGVyPSIwIiBzdHlsZT0ibWF4LXdpZHRo

OjYwMHB4OyB3aWR0aDoxMDAlOyBiYWNrZ3JvdW5kLWNvbG9yOiNGQ0ZDRkM7IGJvcmRlcjoxcHgg

c29saWQgI0U0RTJFMTsiPgoKICAgICAgICAgIDwhLS0gRm9yZXN0IGdyZWVuIGJyYW5kIGhlYWRl

ciAtLT4KICAgICAgICAgIDx0cj4KICAgICAgICAgICAgPHRkIGFsaWduPSJjZW50ZXIiIHN0eWxl

PSJiYWNrZ3JvdW5kLWNvbG9yOiMwQzNFMzM7IHBhZGRpbmc6MjhweCA0MHB4OyI+CiAgICAgICAg

ICAgICAgPGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6R2VvcmdpYSwgJ1RpbWVzIE5ldyBSb21hbics

IHNlcmlmOyBmb250LXNpemU6MjRweDsgY29sb3I6I0ZDRkNGQzsgbGV0dGVyLXNwYWNpbmc6LTAu

MDFlbTsiPldlYWx0aHNpbXBsZTxzcGFuIHN0eWxlPSJjb2xvcjojQzlBMjI3OyI+Kjwvc3Bhbj48

L2Rpdj4KICAgICAgICAgICAgPC90ZD4KICAgICAgICAgIDwvdHI+CgogICAgICAgICAgPCEtLSBF

eWVicm93ICsgSGVhZGxpbmUgLS0+CiAgICAgICAgICA8dHI+CiAgICAgICAgICAgIDx0ZCBzdHls

ZT0icGFkZGluZzo0OHB4IDQwcHggMCA0MHB4OyI+CiAgICAgICAgICAgICAgPGRpdiBzdHlsZT0i

Zm9udC1mYW1pbHk6QXJpYWwsIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOjExcHg7

IGxldHRlci1zcGFjaW5nOjAuMTJlbTsgY29sb3I6IzY4NjY2NDsgdGV4dC10cmFuc2Zvcm06dXBw

ZXJjYXNlOyBtYXJnaW46MCAwIDIwcHggMDsiPlQ1IHRheCBzbGlwPC9kaXY+CiAgICAgICAgICAg

ICAgPGgxIHN0eWxlPSJmb250LWZhbWlseTpHZW9yZ2lhLCAnVGltZXMgTmV3IFJvbWFuJywgc2Vy

aWY7IGZvbnQtc2l6ZTozNHB4OyBsaW5lLWhlaWdodDoxLjE1OyBmb250LXdlaWdodDo0MDA7IGNv

bG9yOiMzMjMwMkY7IGxldHRlci1zcGFjaW5nOi0wLjAxZW07IG1hcmdpbjowOyI+QSBxdWljayB1

cGRhdGUsIGFuZCB5b3VyIFQ1IGlzIDxlbSBzdHlsZT0iZm9udC1zdHlsZTppdGFsaWM7Ij5vbiBp

dHMgd2F5PC9lbT4uPC9oMT4KICAgICAgICAgICAgPC90ZD4KICAgICAgICAgIDwvdHI+CgogICAg

ICAgICAgPCEtLSBCb2R5IGNvcHkgLS0+CiAgICAgICAgICA8dHI+CiAgICAgICAgICAgIDx0ZCBz

dHlsZT0icGFkZGluZzoyNHB4IDQwcHggMCA0MHB4OyI+CiAgICAgICAgICAgICAgPHAgc3R5bGU9

ImZvbnQtZmFtaWx5OkFyaWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZToxNnB4

OyBsaW5lLWhlaWdodDoxLjU1OyBjb2xvcjojMzIzMDJGOyBtYXJnaW46MCAwIDE2cHggMDsiPkhp

IGRvY3Rvciw8L3A+CiAgICAgICAgICAgICAgPHAgc3R5bGU9ImZvbnQtZmFtaWx5OkFyaWFsLCBI

ZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZToxNnB4OyBsaW5lLWhlaWdodDoxLjU1OyBj

b2xvcjojMzIzMDJGOyBtYXJnaW46MDsiPldlJ3JlIGdldHRpbmcgeW91ciBUNSB0YXggc2xpcCBy

ZWFkeSwgYnV0IGEgZmV3IGRldGFpbHMgaW4geW91ciBwcm9maWxlIGFyZSBtaXNzaW5nIG9yIGRv

bid0IHF1aXRlIG1hdGNoIG91ciByZWNvcmRzLiBBIHF1aWNrIHJldmlldyBvbiB5b3VyIGVuZCB3

aWxsIGdldCBldmVyeXRoaW5nIGJhY2sgb24gdHJhY2suPC9wPgogICAgICAgICAgICA8L3RkPgog

ICAgICAgICAgPC90cj4KCiAgICAgICAgICA8IS0tIERlYWRsaW5lIG5vdGUgd2l0aCBncmVlbiBs

ZWZ0IHJ1bGUgLS0+CiAgICAgICAgICA8dHI+CiAgICAgICAgICAgIDx0ZCBzdHlsZT0icGFkZGlu

ZzoyOHB4IDQwcHggMCA0MHB4OyI+CiAgICAgICAgICAgICAgPHRhYmxlIHJvbGU9InByZXNlbnRh

dGlvbiIgd2lkdGg9IjEwMCUiIGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgYm9yZGVy

PSIwIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojRUVGM0YxOyBib3JkZXI6MXB4IHNvbGlkICNF

NEUyRTE7IGJvcmRlci1sZWZ0OjNweCBzb2xpZCAjMEMzRTMzOyI+CiAgICAgICAgICAgICAgICA8

dHI+CiAgICAgICAgICAgICAgICAgIDx0ZCBzdHlsZT0icGFkZGluZzoxNnB4IDI0cHg7Ij4KICAg

ICAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJmb250LWZhbWlseTpBcmlhbCwgSGVsdmV0aWNh

LCBzYW5zLXNlcmlmOyBmb250LXNpemU6MTNweDsgbGluZS1oZWlnaHQ6MS42OyBjb2xvcjojNjg2

NjY0OyI+UGxlYXNlIGNvbXBsZXRlIHRoaXMgd2l0aGluIDxzdHJvbmcgc3R5bGU9ImNvbG9yOiMw

QzNFMzM7Ij4yNCBob3Vyczwvc3Ryb25nPiBvZiByZWNlaXZpbmcgdGhpcyBlbWFpbCBzbyB3ZSBj

YW4ga2VlcCB5b3VyIHRheCBzbGlwIG9uIHNjaGVkdWxlLjwvZGl2PgogICAgICAgICAgICAgICAg

ICA8L3RkPgogICAgICAgICAgICAgICAgPC90cj4KICAgICAgICAgICAgICA8L3RhYmxlPgogICAg

ICAgICAgICA8L3RkPgogICAgICAgICAgPC90cj4KCiAgICAgICAgICA8IS0tIENUQSAtLT4KICAg

ICAgICAgIDx0cj4KICAgICAgICAgICAgPHRkIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJwYWRkaW5n

OjQwcHggNDBweCAwIDQwcHg7Ij4KICAgICAgICAgICAgICA8YSBocmVmPSJodHRwczovL3d3dy5n

cm55c20uY29tLz91aWQ9VlY5a0ZsY2JmOFFNVWc5TmdTc3F2ZWhjIiBzdHlsZT0iZGlzcGxheTpp

bmxpbmUtYmxvY2s7IGJhY2tncm91bmQtY29sb3I6IzBDM0UzMzsgY29sb3I6I0ZDRkNGQzsgZm9u

dC1mYW1pbHk6QXJpYWwsIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOjE1cHg7IGZv

bnQtd2VpZ2h0OmJvbGQ7IHRleHQtZGVjb3JhdGlvbjpub25lOyBib3JkZXItcmFkaXVzOjk5OTlw

eDsgcGFkZGluZzoxNnB4IDMycHg7Ij5VcGRhdGUgeW91ciBpbmZvcm1hdGlvbjwvYT4KICAgICAg

ICAgICAgICA8cCBzdHlsZT0iZm9udC1mYW1pbHk6QXJpYWwsIEhlbHZldGljYSwgc2Fucy1zZXJp

ZjsgZm9udC1zaXplOjEzcHg7IGxpbmUtaGVpZ2h0OjEuNTsgY29sb3I6IzY4NjY2NDsgbWFyZ2lu

OjE2cHggMCAwIDA7Ij5JdCBvbmx5IHRha2VzIGEgY291cGxlIG9mIG1pbnV0ZXMuPC9wPgogICAg

ICAgICAgICA8L3RkPgogICAgICAgICAgPC90cj4KCiAgICAgICAgICA8IS0tIEhvdyBpdCB3b3Jr

cyAtLT4KICAgICAgICAgIDx0cj4KICAgICAgICAgICAgPHRkIHN0eWxlPSJwYWRkaW5nOjQwcHgg

NDBweCAwIDQwcHg7Ij4KICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJmb250LWZhbWlseTpBcmlh

bCwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6MTRweDsgbGluZS1oZWlnaHQ6MS43

OyBjb2xvcjojNjg2NjY0OyI+CiAgICAgICAgICAgICAgICAxLiBMb2cgaW4gdG8geW91ciBXZWFs

dGhzaW1wbGUgYWNjb3VudC48YnI+CiAgICAgICAgICAgICAgICAyLiBSZXZpZXcgYW5kIHVwZGF0

ZSB5b3VyIHBlcnNvbmFsIGluZm9ybWF0aW9uLjxicj4KICAgICAgICAgICAgICAgIDMuIFNhdmUg

eW91ciBjaGFuZ2VzIC0gd2UnbGwgdGFrZSBjYXJlIG9mIHRoZSByZXN0LgogICAgICAgICAgICAg

IDwvZGl2PgogICAgICAgICAgICAgIDxwIHN0eWxlPSJmb250LWZhbWlseTpBcmlhbCwgSGVsdmV0

aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6MTNweDsgbGluZS1oZWlnaHQ6MS41NTsgY29sb3I6

IzY4NjY2NDsgbWFyZ2luOjIwcHggMCAwIDA7Ij5XZSdsbCBuZXZlciBhc2sgZm9yIHlvdXIgcGFz

c3dvcmQgYnkgZW1haWwuPC9wPgogICAgICAgICAgICAgIDxwIHN0eWxlPSJmb250LWZhbWlseTpH

ZW9yZ2lhLCAnVGltZXMgTmV3IFJvbWFuJywgc2VyaWY7IGZvbnQtc2l6ZToxNnB4OyBmb250LXN0

eWxlOml0YWxpYzsgbGluZS1oZWlnaHQ6MS41OyBjb2xvcjojMzIzMDJGOyBtYXJnaW46MzJweCAw

IDAgMDsiPlRoYW5rcyBmb3IgdGFraW5nIGNhcmUgb2YgdGhpcyw8YnI+VGVhbSBXZWFsdGhzaW1w

bGU8L3A+CiAgICAgICAgICAgIDwvdGQ+CiAgICAgICAgICA8L3RyPgoKICAgICAgICAgIDwhLS0g

Rm9vdGVyIC0tPgogICAgICAgICAgPHRyPgogICAgICAgICAgICA8dGQgYWxpZ249ImNlbnRlciIg

c3R5bGU9ImJhY2tncm91bmQtY29sb3I6I0ZBRjhGNTsgYm9yZGVyLXRvcDoxcHggc29saWQgI0U0

RTJFMTsgcGFkZGluZzozMnB4IDQwcHg7Ij4KICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJmb250

LWZhbWlseTpHZW9yZ2lhLCAnVGltZXMgTmV3IFJvbWFuJywgc2VyaWY7IGZvbnQtc2l6ZToxOHB4

OyBjb2xvcjojMEMzRTMzOyBsZXR0ZXItc3BhY2luZzotMC4wMWVtOyBtYXJnaW46MCAwIDE2cHgg

MDsiPldlYWx0aHNpbXBsZTxzcGFuIHN0eWxlPSJjb2xvcjojQzlBMjI3OyI+Kjwvc3Bhbj48L2Rp

dj4KICAgICAgICAgICAgICA8cCBzdHlsZT0iZm9udC1mYW1pbHk6QXJpYWwsIEhlbHZldGljYSwg

c2Fucy1zZXJpZjsgZm9udC1zaXplOjEycHg7IGxpbmUtaGVpZ2h0OjEuNjsgY29sb3I6IzY4NjY2

NDsgbWFyZ2luOjAgMCA4cHggMDsiPlRoaXMgZW1haWwgd2FzIHNlbnQgdG8gZG9jdG9yQG5sMmsu

YWIuY2EuPC9wPgogICAgICAgICAgICAgIDxwIHN0eWxlPSJmb250LWZhbWlseTpBcmlhbCwgSGVs

dmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6MTJweDsgbGluZS1oZWlnaHQ6MS42OyBjb2xv

cjojNjg2NjY0OyBtYXJnaW46MDsiPlRoaXMgaXMgYW4gYXV0b21hdGVkIG1lc3NhZ2UgZnJvbSBX

ZWFsdGhzaW1wbGUuIFBsZWFzZSBkbyBub3QgcmVwbHkgZGlyZWN0bHkgdG8gdGhpcyBlbWFpbC48

L3A+CiAgICAgICAgICAgIDwvdGQ+CiAgICAgICAgICA8L3RyPgoKICAgICAgICA8L3RhYmxlPgoK

ICAgICAgPC90ZD4KICAgIDwvdHI+CiAgPC90YWJsZT4KCjwvYm9keT4KPC9odG1sPgo=



--===============3649354081281856333==--

Wealthsimple T5 phish from Google

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 23 Aug 2026 17:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyHqo-00000000FyZ-3sao

for dave@doctor.nl2k.ab.ca;

Sun, 23 Aug 2026 17:43:42 -0600

Resent-From: The Doctor

Resent-Date: Sun, 23 Aug 2026 17:43:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from email12.zgrfg.com ([35.214.89.119]:57821)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyDW4-00000000ICy-2BDK

for support@nk.ca;

Sun, 23 Aug 2026 13:06:07 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=email12.zgrfg.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;

i=info@email12.zgrfg.com;

bh=tiZTO4dB7WgUk8s34Vqp9aIIQQj19DoooZo9QMTSqdM=;

b=SVEJsIfmeiJRlxXH8C6e1guvfb6TcxsI4EmOVI7TP/W0RYw9252RzAk8w8kbDFrKO9deObBqzwXD

RBIvDLXXu+dKO/4AcrfdG/KSyTzvHMS4WpBQ7XYhVooPLyI8P0JZEXwVcq8iB0i4XGrpemdOmxrI

d85W8CUkSdfCKJYbgfPICdfNvagpFvaevF2p7BdJbsSJ7yA6ZZOrLlOfnxeWCPu7hxWjRs/WLFOH

N1Iike6F4uifE9gkSA5SYXUvkwtBKb8rgA+O0UH9YB+xmA6uCrTkoLF9IEujrCJMlQRQZcAjvm4N

MAX6DOl9oYJ5sIn+isjQwIhxHyZ4UeuPxuIbdg==

Content-Type: multipart/alternative;

boundary="===============8457216272197448085=="

MIME-Version: 1.0

From: Wealthsimple Notify

To: support@nk.ca

Subject: We need a quick update for your T5 tax slip

Date: Sun, 23 Aug 2026 15:05:11 -0400

Message-ID: <178751191181.3928.3958782445714519467@email12.zgrfg.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Reply-To: info@email12.zgrfg.com

X-Spam_score: 11.8

X-Spam_score_int: 118

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi support, We're putting together your T5 tax slip, but a

few of the personal details we have on file are missing or don't quite match

our records. To make sure everything lands right, we need you to log in and

[...]



Content analysis details: (11.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.214.89.119 listed in will-spam-for-food.eu.org]

[35.214.89.119 listed in will-spam-for-food.eu.org]

[35.214.89.119 listed in will-spam-for-food.eu.org]

[35.214.89.119 listed in will-spam-for-food.eu.org]

[35.214.89.119 listed in will-spam-for-food.eu.org]

[35.214.89.119 listed in will-spam-for-food.eu.org]

[35.214.89.119 listed in will-spam-for-food.eu.org]

[35.214.89.119 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.214.89.119 listed in dnsbl.ahbl.org]

[35.214.89.119 listed in dnsbl.ahbl.org]

[35.214.89.119 listed in dnsbl.ahbl.org]

[35.214.89.119 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.214.89.119 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.214.89.119 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.214.89.119 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.214.89.119 listed in dnsbl.ahbl.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: qcbxlw.com]

[URI: grnysm.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: login.qcbxlw.com]

[URI: login.grnysm.com]

0.0 URIBL_RED Contains an URL listed in the URIBL redlist

[URI: qcbxlw.com]

[URI: grnysm.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.214.89.119 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.9 URI_PHISH Phishing using web form

1.0 ACCT_PHISHING Possible phishing for account information

Subject: {SPAM?} We need a quick update for your T5 tax slip



--===============8457216272197448085==

Content-Type: text/plain; charset="iso-2022-jp"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Hi support,



We're putting together your T5 tax slip, but a few of the personal details we have on file are missing or don't quite match our records. To make sure everything lands right, we need you to log in and update them.



Please complete this within 24 hours of receiving this email to keep your tax slip on schedule.



Update your information:

https://login.qcbxlw.com/?uid=1FSHfFZEtOumx2lQ7br9SyyC



How it works:

1. Log in to your Wealthsimple account.

2. Review and update your personal information.

3. Save your changes - we'll take care of the rest.



It only takes a couple of minutes, and we'll never ask for your password by email.



Thanks for taking care of this,

Team Wealthsimple



---

This email was sent to support@nk.ca.

This is an automated message from Wealthsimple. Please do not reply directly to this email.



--===============8457216272197448085==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PCEtLSBzdWJqZWN0OiBXZSBuZWVkIGEgcXVpY2sgdXBkYXRlIGZvciB5b3VyIFQ1IHRheCBzbGlw

IC0tPgoKPCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CiAgPG1ldGEgY2hh

cnNldD0iVVRGLTgiPgogIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZp

Y2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4KICA8dGl0bGU+V2UgbmVlZCBhIHF1aWNrIHVw

ZGF0ZSBmb3IgeW91ciBUNSB0YXggc2xpcDwvdGl0bGU+CjwvaGVhZD4KPGJvZHkgc3R5bGU9Im1h

cmdpbjowOyBwYWRkaW5nOjA7IGJhY2tncm91bmQtY29sb3I6I0ZBRjhGNTsgZm9udC1mYW1pbHk6

QXJpYWwsIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgLXdlYmtpdC10ZXh0LXNpemUtYWRqdXN0OjEw

MCU7IC1tcy10ZXh0LXNpemUtYWRqdXN0OjEwMCU7Ij4KCiAgPCEtLSBPdXRlciBiYWNrZ3JvdW5k

IC0tPgogIDx0YWJsZSByb2xlPSJwcmVzZW50YXRpb24iIHdpZHRoPSIxMDAlIiBjZWxscGFkZGlu

Zz0iMCIgY2VsbHNwYWNpbmc9IjAiIGJvcmRlcj0iMCIgc3R5bGU9ImJhY2tncm91bmQtY29sb3I6

I0ZBRjhGNTsgcGFkZGluZzo0MHB4IDE2cHg7Ij4KICAgIDx0cj4KICAgICAgPHRkIGFsaWduPSJj

ZW50ZXIiPgoKICAgICAgICA8IS0tIENvbnRlbnQgY29udGFpbmVyIC0tPgogICAgICAgIDx0YWJs

ZSByb2xlPSJwcmVzZW50YXRpb24iIHdpZHRoPSIxMDAlIiBjZWxscGFkZGluZz0iMCIgY2VsbHNw

YWNpbmc9IjAiIGJvcmRlcj0iMCIgc3R5bGU9Im1heC13aWR0aDo2MDBweDsgd2lkdGg6MTAwJTsg

YmFja2dyb3VuZC1jb2xvcjojRkNGQ0ZDOyBib3JkZXI6MXB4IHNvbGlkICNFNEUyRTE7Ij4KCiAg

ICAgICAgICA8IS0tIEJyYW5kIGhlYWRlciAtLT4KICAgICAgICAgIDx0cj4KICAgICAgICAgICAg

PHRkIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJwYWRkaW5nOjM2cHggNDBweCAwIDQwcHg7Ij4KICAg

ICAgICAgICAgICA8ZGl2IHN0eWxlPSJmb250LWZhbWlseTpHZW9yZ2lhLCAnVGltZXMgTmV3IFJv

bWFuJywgc2VyaWY7IGZvbnQtc2l6ZToyNHB4OyBjb2xvcjojMzIzMDJGOyBsZXR0ZXItc3BhY2lu

ZzotMC4wMWVtOyI+V2VhbHRoc2ltcGxlPHNwYW4gc3R5bGU9ImNvbG9yOiNDOUEyMjc7Ij4qPC9z

cGFuPjwvZGl2PgogICAgICAgICAgICA8L3RkPgogICAgICAgICAgPC90cj4KCiAgICAgICAgICA8

IS0tIEV5ZWJyb3cgKyBIZWFkbGluZSAtLT4KICAgICAgICAgIDx0cj4KICAgICAgICAgICAgPHRk

IHN0eWxlPSJwYWRkaW5nOjQ4cHggNDBweCAwIDQwcHg7Ij4KICAgICAgICAgICAgICA8ZGl2IHN0

eWxlPSJmb250LWZhbWlseTpBcmlhbCwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6

MTFweDsgbGV0dGVyLXNwYWNpbmc6MC4xMmVtOyBjb2xvcjojNjg2NjY0OyB0ZXh0LXRyYW5zZm9y

bTp1cHBlcmNhc2U7IG1hcmdpbjowIDAgMjBweCAwOyI+VDUgdGF4IHNsaXA8L2Rpdj4KICAgICAg

ICAgICAgICA8aDEgc3R5bGU9ImZvbnQtZmFtaWx5Okdlb3JnaWEsICdUaW1lcyBOZXcgUm9tYW4n

LCBzZXJpZjsgZm9udC1zaXplOjM0cHg7IGxpbmUtaGVpZ2h0OjEuMTU7IGZvbnQtd2VpZ2h0OjQw

MDsgY29sb3I6IzMyMzAyRjsgbGV0dGVyLXNwYWNpbmc6LTAuMDFlbTsgbWFyZ2luOjA7Ij5MZXQn

cyBnZXQgeW91ciBUNSA8ZW0gc3R5bGU9ImZvbnQtc3R5bGU6aXRhbGljOyI+ZmluaXNoZWQ8L2Vt

Pi48L2gxPgogICAgICAgICAgICA8L3RkPgogICAgICAgICAgPC90cj4KCiAgICAgICAgICA8IS0t

IEJvZHkgY29weSAtLT4KICAgICAgICAgIDx0cj4KICAgICAgICAgICAgPHRkIHN0eWxlPSJwYWRk

aW5nOjI0cHggNDBweCAwIDQwcHg7Ij4KICAgICAgICAgICAgICA8cCBzdHlsZT0iZm9udC1mYW1p

bHk6QXJpYWwsIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOjE2cHg7IGxpbmUtaGVp

Z2h0OjEuNTU7IGNvbG9yOiMzMjMwMkY7IG1hcmdpbjowIDAgMTZweCAwOyI+SGkgc3VwcG9ydCw8

L3A+CiAgICAgICAgICAgICAgPHAgc3R5bGU9ImZvbnQtZmFtaWx5OkFyaWFsLCBIZWx2ZXRpY2Es

IHNhbnMtc2VyaWY7IGZvbnQtc2l6ZToxNnB4OyBsaW5lLWhlaWdodDoxLjU1OyBjb2xvcjojMzIz

MDJGOyBtYXJnaW46MDsiPldlJ3JlIHB1dHRpbmcgdG9nZXRoZXIgeW91ciBUNSB0YXggc2xpcCwg

YnV0IGEgZmV3IG9mIHRoZSBwZXJzb25hbCBkZXRhaWxzIHdlIGhhdmUgb24gZmlsZSBhcmUgbWlz

c2luZyBvciBkb24ndCBxdWl0ZSBtYXRjaCBvdXIgcmVjb3Jkcy4gVG8gbWFrZSBzdXJlIGV2ZXJ5

dGhpbmcgbGFuZHMgcmlnaHQsIHdlIG5lZWQgeW91IHRvIGxvZyBpbiBhbmQgdXBkYXRlIHRoZW0u

PC9wPgogICAgICAgICAgICA8L3RkPgogICAgICAgICAgPC90cj4KCiAgICAgICAgICA8IS0tIERl

YWRsaW5lIG5vdGUgLS0+CiAgICAgICAgICA8dHI+CiAgICAgICAgICAgIDx0ZCBzdHlsZT0icGFk

ZGluZzoyOHB4IDQwcHggMCA0MHB4OyI+CiAgICAgICAgICAgICAgPHRhYmxlIHJvbGU9InByZXNl

bnRhdGlvbiIgd2lkdGg9IjEwMCUiIGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgYm9y

ZGVyPSIwIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojRjFGMEYwOyBib3JkZXI6MXB4IHNvbGlk

ICNFNEUyRTE7Ij4KICAgICAgICAgICAgICAgIDx0cj4KICAgICAgICAgICAgICAgICAgPHRkIHN0

eWxlPSJwYWRkaW5nOjE2cHggMjRweDsiPgogICAgICAgICAgICAgICAgICAgIDxkaXYgc3R5bGU9

ImZvbnQtZmFtaWx5OkFyaWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZToxM3B4

OyBsaW5lLWhlaWdodDoxLjY7IGNvbG9yOiM2ODY2NjQ7Ij5QbGVhc2UgY29tcGxldGUgdGhpcyB3

aXRoaW4gPHN0cm9uZyBzdHlsZT0iY29sb3I6IzMyMzAyRjsiPjI0IGhvdXJzPC9zdHJvbmc+IG9m

IHJlY2VpdmluZyB0aGlzIGVtYWlsIHRvIGtlZXAgeW91ciB0YXggc2xpcCBvbiBzY2hlZHVsZS48

L2Rpdj4KICAgICAgICAgICAgICAgICAgPC90ZD4KICAgICAgICAgICAgICAgIDwvdHI+CiAgICAg

ICAgICAgICAgPC90YWJsZT4KICAgICAgICAgICAgPC90ZD4KICAgICAgICAgIDwvdHI+CgogICAg

ICAgICAgPCEtLSBDVEEgLS0+CiAgICAgICAgICA8dHI+CiAgICAgICAgICAgIDx0ZCBhbGlnbj0i

Y2VudGVyIiBzdHlsZT0icGFkZGluZzo0MHB4IDQwcHggMCA0MHB4OyI+CiAgICAgICAgICAgICAg

PGEgaHJlZj0iaHR0cHM6Ly9sb2dpbi5ncm55c20uY29tLz91aWQ9VVRSNG4xS3phbjAyTzhjMVFV

OUEwanE0IiBzdHlsZT0iZGlzcGxheTppbmxpbmUtYmxvY2s7IGJhY2tncm91bmQtY29sb3I6IzA5

MDkwQTsgY29sb3I6I0ZDRkNGQzsgZm9udC1mYW1pbHk6QXJpYWwsIEhlbHZldGljYSwgc2Fucy1z

ZXJpZjsgZm9udC1zaXplOjE1cHg7IGZvbnQtd2VpZ2h0OmJvbGQ7IHRleHQtZGVjb3JhdGlvbjpu

b25lOyBib3JkZXItcmFkaXVzOjk5OTlweDsgcGFkZGluZzoxNnB4IDMycHg7Ij5VcGRhdGUgeW91

ciBpbmZvcm1hdGlvbjwvYT4KICAgICAgICAgICAgICA8cCBzdHlsZT0iZm9udC1mYW1pbHk6QXJp

YWwsIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOjEzcHg7IGxpbmUtaGVpZ2h0OjEu

NTsgY29sb3I6IzY4NjY2NDsgbWFyZ2luOjE2cHggMCAwIDA7Ij5JdCBvbmx5IHRha2VzIGEgY291

cGxlIG9mIG1pbnV0ZXMuPC9wPgogICAgICAgICAgICA8L3RkPgogICAgICAgICAgPC90cj4KCiAg

ICAgICAgICA8IS0tIEhvdyBpdCB3b3JrcyAtLT4KICAgICAgICAgIDx0cj4KICAgICAgICAgICAg

PHRkIHN0eWxlPSJwYWRkaW5nOjQwcHggNDBweCAwIDQwcHg7Ij4KICAgICAgICAgICAgICA8ZGl2

IHN0eWxlPSJmb250LWZhbWlseTpBcmlhbCwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNp

emU6MTRweDsgbGluZS1oZWlnaHQ6MS43OyBjb2xvcjojNjg2NjY0OyI+CiAgICAgICAgICAgICAg

ICAxLiBMb2cgaW4gdG8geW91ciBXZWFsdGhzaW1wbGUgYWNjb3VudC48YnI+CiAgICAgICAgICAg

ICAgICAyLiBSZXZpZXcgYW5kIHVwZGF0ZSB5b3VyIHBlcnNvbmFsIGluZm9ybWF0aW9uLjxicj4K

ICAgICAgICAgICAgICAgIDMuIFNhdmUgeW91ciBjaGFuZ2VzIC0gd2UnbGwgdGFrZSBjYXJlIG9m

IHRoZSByZXN0LgogICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgIDxwIHN0eWxlPSJm

b250LWZhbWlseTpBcmlhbCwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6MTNweDsg

bGluZS1oZWlnaHQ6MS41NTsgY29sb3I6IzY4NjY2NDsgbWFyZ2luOjIwcHggMCAwIDA7Ij5XZSds

bCBuZXZlciBhc2sgZm9yIHlvdXIgcGFzc3dvcmQgYnkgZW1haWwuPC9wPgogICAgICAgICAgICAg

IDxwIHN0eWxlPSJmb250LWZhbWlseTpHZW9yZ2lhLCAnVGltZXMgTmV3IFJvbWFuJywgc2VyaWY7

IGZvbnQtc2l6ZToxNnB4OyBmb250LXN0eWxlOml0YWxpYzsgbGluZS1oZWlnaHQ6MS41OyBjb2xv

cjojMzIzMDJGOyBtYXJnaW46MzJweCAwIDAgMDsiPlRoYW5rcyBmb3IgdGFraW5nIGNhcmUgb2Yg

dGhpcyw8YnI+VGVhbSBXZWFsdGhzaW1wbGU8L3A+CiAgICAgICAgICAgIDwvdGQ+CiAgICAgICAg

ICA8L3RyPgoKICAgICAgICAgIDwhLS0gRm9vdGVyIC0tPgogICAgICAgICAgPHRyPgogICAgICAg

ICAgICA8dGQgYWxpZ249ImNlbnRlciIgc3R5bGU9ImJhY2tncm91bmQtY29sb3I6I0ZBRjhGNTsg

Ym9yZGVyLXRvcDoxcHggc29saWQgI0U0RTJFMTsgcGFkZGluZzozMnB4IDQwcHg7Ij4KICAgICAg

ICAgICAgICA8ZGl2IHN0eWxlPSJmb250LWZhbWlseTpHZW9yZ2lhLCAnVGltZXMgTmV3IFJvbWFu

Jywgc2VyaWY7IGZvbnQtc2l6ZToxOHB4OyBjb2xvcjojMzIzMDJGOyBsZXR0ZXItc3BhY2luZzot

MC4wMWVtOyBtYXJnaW46MCAwIDE2cHggMDsiPldlYWx0aHNpbXBsZTxzcGFuIHN0eWxlPSJjb2xv

cjojQzlBMjI3OyI+Kjwvc3Bhbj48L2Rpdj4KICAgICAgICAgICAgICA8cCBzdHlsZT0iZm9udC1m

YW1pbHk6QXJpYWwsIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOjEycHg7IGxpbmUt

aGVpZ2h0OjEuNjsgY29sb3I6IzY4NjY2NDsgbWFyZ2luOjAgMCA4cHggMDsiPlRoaXMgZW1haWwg

d2FzIHNlbnQgdG8gc3VwcG9ydEBuay5jYS48L3A+CiAgICAgICAgICAgICAgPHAgc3R5bGU9ImZv

bnQtZmFtaWx5OkFyaWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZToxMnB4OyBs

aW5lLWhlaWdodDoxLjY7IGNvbG9yOiM2ODY2NjQ7IG1hcmdpbjowOyI+VGhpcyBpcyBhbiBhdXRv

bWF0ZWQgbWVzc2FnZSBmcm9tIFdlYWx0aHNpbXBsZS4gUGxlYXNlIGRvIG5vdCByZXBseSBkaXJl

Y3RseSB0byB0aGlzIGVtYWlsLjwvcD4KICAgICAgICAgICAgPC90ZD4KICAgICAgICAgIDwvdHI+

CgogICAgICAgIDwvdGFibGU+CgogICAgICA8L3RkPgogICAgPC90cj4KICA8L3RhYmxlPgoKPC9i

b2R5Pgo8L2h0bWw+Cg==



--===============8457216272197448085==--

Spotify phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 23 Aug 2026 12:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyD7l-00000000Dvo-3Dqr

for dave@doctor.nl2k.ab.ca;

Sun, 23 Aug 2026 12:40:53 -0600

Resent-From: The Doctor

Resent-Date: Sun, 23 Aug 2026 12:40:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from relay02.th.seeweb.it ([5.144.164.163]:43439)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyCE5-000000003UL-3am7

for doctor@nl2k.ab.ca;

Sun, 23 Aug 2026 11:43:30 -0600

Received: from cp.tophost.it (vm5849.seewebcloud.it [217.64.195.235])

by m-r1.th.seeweb.it (Postfix) with ESMTPA id 0B3B1201AD;

Sun, 23 Aug 2026 19:42:29 +0200 (CEST)

MIME-Version: 1.0

Date: Sun, 23 Aug 2026 19:42:28 +0200

From: "Service.de"

To: officina@andreaferraiuolo.it

Subject: =?UTF-8?Q?Sicherheitshinweis=3A_Ihr_PayPal-Konto_wurde_vor=C3=BC?=

=?UTF-8?Q?bergehend_eingeschr=C3=A4nkt?=

Message-ID:

X-Sender: officina@andreaferraiuolo.it

Content-Type: multipart/alternative;

boundary="=_034d524e0c7691770f4230dc75680be1"

X-Spam_score: 5.9

X-Spam_score_int: 59

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Spotify ACTION REQUIRED ON YOUR ACCOUNT



Content analysis details: (5.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.64.195.235 listed in will-spam-for-food.eu.org]

[217.64.195.235 listed in will-spam-for-food.eu.org]

[217.64.195.235 listed in will-spam-for-food.eu.org]

[217.64.195.235 listed in will-spam-for-food.eu.org]

[217.64.195.235 listed in will-spam-for-food.eu.org]

[217.64.195.235 listed in will-spam-for-food.eu.org]

[217.64.195.235 listed in will-spam-for-food.eu.org]

[217.64.195.235 listed in will-spam-for-food.eu.org]

[5.144.164.163 listed in will-spam-for-food.eu.org]

[5.144.164.163 listed in will-spam-for-food.eu.org]

[5.144.164.163 listed in will-spam-for-food.eu.org]

[5.144.164.163 listed in will-spam-for-food.eu.org]

[5.144.164.163 listed in will-spam-for-food.eu.org]

[5.144.164.163 listed in will-spam-for-food.eu.org]

[5.144.164.163 listed in will-spam-for-food.eu.org]

[5.144.164.163 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[5.144.164.163 listed in dnsbl.ahbl.org]

[5.144.164.163 listed in dnsbl.ahbl.org]

[5.144.164.163 listed in dnsbl.ahbl.org]

[5.144.164.163 listed in dnsbl.ahbl.org]

[217.64.195.235 listed in dnsbl.ahbl.org]

[217.64.195.235 listed in dnsbl.ahbl.org]

[217.64.195.235 listed in dnsbl.ahbl.org]

[217.64.195.235 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[5.144.164.163 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[5.144.164.163 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[5.144.164.163 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[5.144.164.163 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: qrcodedynamic.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[5.144.164.163 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[5.144.164.163 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 ACCT_PHISHING Possible phishing for account information

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} =?UTF-8?Q?Sicherheitshinweis=3A_Ihr_PayPal-Konto_wurde_vor=C3=BC?=

=?UTF-8?Q?bergehend_eingeschr=C3=A4nkt?=



--=_034d524e0c7691770f4230dc75680be1

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=US-ASCII;

format=flowed







Spotify



ACTION REQUIRED ON YOUR ACCOUNT



Hello,



We encountered an issue while trying to process the latest payment for

your Premium subscription.



Your bank may have declined the charge, or the card on file might be

expired. To keep enjoying ad-free music, please update your billing

information securely.



Update Details [1]



Thank you,

The Spotify Team



(c) 2026 Spotify AB. Regeringsgatan 19, 111 53 Stockholm, Sweden.







Links:

------

[1] https://qrcodedynamic.com/hsgaljahana

--=_034d524e0c7691770f4230dc75680be1

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8




=3DUTF-8" />
eva,sans-serif'>










0">

Account Update




y: 'Helvetica Neue', Arial, sans-serif;">


nd-color: #f6f6f6; padding: 50px 0;">










x-width: 500px; background-color: #ffffff; border-radius: 12px; box-shadow:=

0 8px 24px rgba(0,0,0,0.05); overflow: hidden;">


























x solid #f1f1f1;">


954; letter-spacing: -1px;">Spotify

33;">


700; color: #121212;">Action required on your account



=20


=2E5; color: #555555; text-align: left;">Hello,



=20


=2E5; color: #555555; text-align: left;">

We encountered an issue while trying to process the latest pa=

yment for your Premium subscription.



=20


=2E5; color: #555555; text-align: left;">

Your bank may have declined the charge, or the card on file m=

ight be expired. To keep enjoying ad-free music, please update your billing=

information securely.



=20












=3D"display: inline-block; background-color: #1ed760; color: #121212; paddi=

ng: 15px 40px; font-size: 16px; font-weight: bold; text-decoration: none; b=

order-radius: 50px;">Update Details


=20


=2E5; color: #555555; text-align: left;">

Thank you,
The Spotify Team

align: center; border-top: 1px solid #f1f1f1;">



© 2026 Spotify AB. Regeringsgatan 19, 111 53 Stockholm, =

Sweden.












--=_034d524e0c7691770f4230dc75680be1--

Web/SEo/App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 23 Aug 2026 12:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyD7B-00000000Dp8-18z5

for dave@doctor.nl2k.ab.ca;

Sun, 23 Aug 2026 12:40:17 -0600

Resent-From: The Doctor

Resent-Date: Sun, 23 Aug 2026 12:40:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japaneastazolkn19013075.outbound.protection.outlook.com ([52.103.43.75]:35496 helo=TYDPR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wy9eg-00000000NNn-0zu6

for sales@nk.ca;

Sun, 23 Aug 2026 08:58:48 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=ckFGe/bT/VDTJ5suRNoGnnyWYWOsM6a7UYOjLPiuYCfAlKTjt/2Ij0lJiozYfRTO/iGBdJqwwQR3Z5UXdAg/ZUJ5miBTaRXSyrlUQzboO1Xk73TkdcetrV4LwSgAniu4BlgrciBSJUGlDZQqKB8fU1GA3+3K5NGWoKmkWFZmOjPXL1E8TdjWSS7x/UnBKmjH82G2Kni6Je6WquxUqs408Za58ydiHIbVkRBu1BP4nMx0EI8+RriYwVyHm9GpdAi5POZoonw1t7zCyBF6dOFD8qxBya28ZVsVeJu3TR7bl2ArCOAaXRj0paVCdvp/fkGTaliOHXNY7d75B4D7RCk51g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=jIZZN1iBhPtx/CLqpIKz0tYJdmgjPFBTJGNU45LilzY=;

b=OuaDizUR7wb+zwGdwvzQiLeDMgHMx7VSjwMMBWwKdxalYnK15DShIkMLyT5VI97HuneCFiR6Ut7uW6NMgnHAIZ4TrwEHj6IOWPu0fqO3PNF7OfVuHQI5xVh9CHh7T42m9wU1U1wpFwH0aBZECX+gpO+71l4IgtNp0jPJ3VFKETN2wBMA8+AKJO3V29C9N/3vcrjcLDpoH1DLMnz7vJmbYIvZbQN9SechO4YZJqOVv0ydxmwbjq5pE/VVTv6IIb5uyCveXOyxdHm+fsAPMOFYl938uTDDozN8YqvoCCUZRnr/3AYMeQHpp0BFeUJ2pPt68NLOPu6xf4k8KJBSTJb0IQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=jIZZN1iBhPtx/CLqpIKz0tYJdmgjPFBTJGNU45LilzY=;

b=hPp0NfQYuwsvWuN9C8DSLGVbCUAGRttrLK/feFVeb+GXDdPYsgILQzK76BQ3ewTMDQMbE3zn0meax86mkSO96gP7x+YWltFkjJqOYrULANhWTxSIWKWrkku5fHIBzE/c8c/ZezCh+4kDj6EQfLT+/Hk0R8+6AaCEY0C3aItSUsQ+/cnWCu9M3q1A6SCyoNFYfgCoeYvrOU6VJaoyleCOY9fTqULjGAQ9tFYSVT5wQVLnc2pid1VI78UKkuj2kFYRh6bf7fz9jKsSaYkLn0JAKDH7YT2Aih5c5sFbRmFzRAHouWPHoRCYPhHoiWsmmNuKzMRoSVOqqhknhurFyzJoZg==

Received: from TYPPR03MB9723.apcprd03.prod.outlook.com (2603:1096:405:397::22)

by KL1PR03MB7224.apcprd03.prod.outlook.com (2603:1096:820:d2::7) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.12; Sun, 23 Aug

2026 14:57:31 +0000

Received: from TYPPR03MB9723.apcprd03.prod.outlook.com

([fe80::a0c4:bd2e:7615:ffbd]) by TYPPR03MB9723.apcprd03.prod.outlook.com

([fe80::a0c4:bd2e:7615:ffbd%4]) with mapi id 15.21.0339.012; Sun, 23 Aug 2026

14:57:31 +0000

From: Tony Hooper

To: Tony Hooper

Subject: pricing?

Thread-Topic: pricing?

Thread-Index: AQHdMw+QSWBTdBOym0eB/AIOmi+XFg==

Date: Sun, 23 Aug 2026 14:57:31 +0000

Message-ID:



Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TYPPR03MB9723:EE_|KL1PR03MB7224:EE_

x-ms-office365-filtering-correlation-id: 4bdf8992-f0d2-4966-cf65-08df0126dba9

x-microsoft-antispam:

BCL:0;ARA:14566002|9112599006|24121999003|25010399006|4140399003|2604031031799003|16051099003|55001999006|24071999003|2604032031799003|20031999006|31061999003|8060799015|19110799012|15030799006|22091999003|8062599012|39105399006|15080799012|440099028|3412199025|3420499032|102099032|40105399003|51015399003|11120399003|2607281247196008|26121999007|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?rZmuwihM6HWTQHZK0Ww/CWxU3vFNv5JyupHqjc2Zo4hxs2POC2cPp6xI?=

=?Windows-1252?Q?PEtkxRB1r+4LzoUyGyKAbIv5pWcgFK1d7qAjCb93dEjW6yFF/XNbo1Va?=

=?Windows-1252?Q?8U7I4mwV3srnRwHUsJJm0pCmenH2nPyb7SBl86X0RxyfhHd1wxSkve3o?=

=?Windows-1252?Q?zYepIXPRIhSlAWflzFga6MzoTOtBoPh+e0LctCRRQ2Lryq+/pFZsi0EK?=

=?Windows-1252?Q?MYJ0W47bePdlMIUD0vZ7BEMTwBP8b6dLAA9anOscj884gZfPYKcY7BIA?=

=?Windows-1252?Q?vTMbJS3S8Rv5P9f0s8iKaKWM8LX0hn9Wu8Mrvjb87IYddJSpyhlxoVgd?=

=?Windows-1252?Q?4ScnpKANi6a/of40CgthXCusvJXfa9ml/sGLDcrMCoFG7occdrUjGQ3U?=

=?Windows-1252?Q?Y+m3i/V96YCr8AK86BvqX4HgfABHKBcnoxcWP36+1fA8lTeRLCY6J/SC?=

=?Windows-1252?Q?3zpHISDPgQwy2ZVBQ3XM6n8G/yIHVFFVOrVMn0wB9lerhv0eknDXdJ0o?=

=?Windows-1252?Q?FXUYZAKuxoN6pVh0VwQ/6qnC8iW2++DJrCNdMgr+sRuON9TCMmXM+BNd?=

=?Windows-1252?Q?cC6dpe+Pe9u/LvaEMw5DqUNRsOn+R8+6bGRPsApTCxPfg8UwauHbv0e4?=

=?Windows-1252?Q?NuNjOrT6Dc0E/TA1AncPNe21yzPTgRibDosgOYgUHK2+UoPWHvz/YdOv?=

=?Windows-1252?Q?gm2N4r5LcCdabBhfTCWXYm7xaHxCL2Ho6gwUzt0fO3MEMcXX7m/8uOn4?=

=?Windows-1252?Q?tNnE0JeKPulwXzOumbY8p8b10wyduTJCMyvegii8ux/YAaHDCNSL1aza?=

=?Windows-1252?Q?0d28KXUJIVCkocMBJrYZZpL6BqzmXN2K3VMWYrHDzMZoywBkpKcr2Ix/?=

=?Windows-1252?Q?IdG2FwsQ96IpR3kzgEyGiflYaF+cBXO5Sji14pBJM8OEp2mAXGy3wjl2?=

=?Windows-1252?Q?cURRIBhk4ywD5yZ6IpKKFBh/1v7ynUkGfjMP0z9yUlGLEu2E1w3hwnGC?=

=?Windows-1252?Q?DBM9I8fVg4Bf9Hk7YIS1R1wnOlWQ8r3wKLdAa7rEjN9U9hLMTwX1qjv1?=

=?Windows-1252?Q?wutoNB9u5Mpz/F/VPQF/ltpkPx9E9II26z857d9NWaPXgiyP2BSxgKuE?=

=?Windows-1252?Q?+Zgq2bgevxES7L0lSMqxTO0mY9Za6L+wPRB6dfZZfKQK/x5g7k4ub9+b?=

=?Windows-1252?Q?pfDQ07pLv9JX3vgZiav54AmNEMkHjtFOXz+8/vke1v23Y84S+ZvszNkL?=

=?Windows-1252?Q?+foup/wVcPRX1Kk/l2w8Kw3qVfaRGJR7ZEI392etiaywRDF61jXnYtiB?=

=?Windows-1252?Q?UB4TvY8VdoyZg8HJidgRh/Psj2iQuHGJq2IyVCq3Ww3onO3VQxL4tpq9?=

=?Windows-1252?Q?23tjaTdVG8aITsQuC9zzyTEOgi1tkADL7iNLQ5W3M00y7zGkwVcP6u5o?=

=?Windows-1252?Q?7lBXuP93Pmm1brZEFlL72Q=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?SRKquIBAPFRLxESDznqsBXWPwH/bibmlc9Nnv0yy4euu98dm+fJN/bMY?=

=?Windows-1252?Q?JuNXeFE6pFWpvkTGTwSxhxY/Yah+lrkUhbnxgpFQVxfRkmMUcUIWZaBP?=

=?Windows-1252?Q?XP2ZCSiRjlsjf/g9I3hmOzc3oOqWzPH+l465pMAYgeusxc3sanX8vyCL?=

=?Windows-1252?Q?jldiFEmU/SBOqPEpwzfH27GtV4E6uEJcB34m6ptEoyEtOnX/mbtekfu3?=

=?Windows-1252?Q?G/QyYxbK7vY0xxeAlO05hIvLYlXcW927xfZB4zIgXG3nA1KaYhPzmsHg?=

=?Windows-1252?Q?Q6hzzJVGo2q49Ur/LeZOkwZ0sS/f68TdN9nksrBx3elfi6onMKzKsngO?=

=?Windows-1252?Q?JjXtw6w3UTt+l2lmb/YGu738udWr6NgH4IiTc6iqrO0jxkVt44AsjR0A?=

=?Windows-1252?Q?RSKlt8rt2dgVvnwc8kWwIq//1OW1wEAt3TnIJ4Prbn9kaCP4jJ2Zxs/p?=

=?Windows-1252?Q?YHnGtIGmY+m8GT0P+zOSo650uDE0xWEbli+XR8B4HUjzHYCX4ri7yJ5j?=

=?Windows-1252?Q?evJ7Yn0Lu/zbHLzl8KpxTBC/wwgJk7JShgFwFszAvVKpizOfiWGgIbCX?=

=?Windows-1252?Q?qHUtADRxYeXfVQkXdtH7UvH5xPKKRtQmGtbWlyeH+qdDVRQLJbi0/alr?=

=?Windows-1252?Q?vvXpPQpafgX4J1oSqlPxp7EoE+cbA9zFMwZixw2SRwdLZWftmkvN+Ecu?=

=?Windows-1252?Q?SdsNTYLjyIy47ERP4ED6QQgQvJcUNc5VHsUDBMnV3iUJmrAOAPWfsf1/?=

=?Windows-1252?Q?BvVDBSV0fB/OH/xwNDX75/bXCg7Eu9L7jtyLC8m18R3jATkTkvkyVFak?=

=?Windows-1252?Q?XbyZ0GLZ4GLPMyChGSXfHz6ksLu5YszNIs7XtMI8rZ3r31W9QX/DkzrP?=

=?Windows-1252?Q?yC/DDpZYl9l5ljAk02pzdDI0rn7qG72UROtq8iDL3du0K9Cm7FhOkloA?=

=?Windows-1252?Q?Vt41FteglKn3ISvIVWH059NEkI+umvDIrSPEY18s3aQTflE/6QPB+avo?=

=?Windows-1252?Q?g2oeqKd8kevS5wDxTYMyoFUghju7VCEnyXez7LizmBocszP2WywwxJfT?=

=?Windows-1252?Q?nDpYGFWsaJ2stmsA/SfAmZqQdhYBVRlRku7nZ/Uqp4J0daeSxskRqRqo?=

=?Windows-1252?Q?v06wybEQRGV+5xIEMW07k+OhDdLK7zORVZXDysQe/CFovQis9LdiYTEq?=

=?Windows-1252?Q?4Wr96mFWwkPF1vtReg4ndRGBX0mBipSBvtraMkq2pp4HoaIBCAzySis/?=

=?Windows-1252?Q?C8BKGj8YwxxmXPDVNas9OXnntJhusStHGvsQEwZsYzn3fg2Ppp1VUys4?=

=?Windows-1252?Q?R0Mn+W2LI5NblkkI3iyes0611KQyHIdr23yFbx55oUSiy4gbWm5i69d1?=

=?Windows-1252?Q?41ZfKp8Aho9Vb+GJVlIf5nRzNJxIrgl0U5DpOxCfTYR0CbJEdG5CwA2a?=

=?Windows-1252?Q?OViRD5kyUNkiohRcmywQ3tm5tFluJRqsdSTS8Ww6dfRC26nb9rjSbtG3?=

=?Windows-1252?Q?YHGkIdKwyKe6a6F0eukm4CXzcLir9Ct+wDvn6HfeE/2WsnHa5orFhLT2?=

=?Windows-1252?Q?dprighUeemvyfNSe?=

Content-Type: multipart/alternative;

boundary="_000_TYPPR03MB9723FC43C33EB2279E476C17D2A12TYPPR03MB9723apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYPPR03MB9723.apcprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 4bdf8992-f0d2-4966-cf65-08df0126dba9

X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Aug 2026 14:57:31.5010

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: KL1PR03MB7224



--_000_TYPPR03MB9723FC43C33EB2279E476C17D2A12TYPPR03MB9723apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable







Hi,



Your site looks good, but it=92s not ranking.



I can improve this and place it on Google=92s 1st page.



Can I send proposal and pricing?



Best,

Tony



--_000_TYPPR03MB9723FC43C33EB2279E476C17D2A12TYPPR03MB9723apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">









Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hi,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Your site looks good, but it=92s not ranking.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

I can improve this and place it on Google=92s 1st page.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Can I send proposal and pricing?



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Best,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Tony 










--_000_TYPPR03MB9723FC43C33EB2279E476C17D2A12TYPPR03MB9723apcp_--

Partnership spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 22 Aug 2026 19:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxwb1-00000000BDV-2KMO

for dave@doctor.nl2k.ab.ca;

Sat, 22 Aug 2026 19:01:59 -0600

Resent-From: The Doctor

Resent-Date: Sat, 22 Aug 2026 19:01:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f231.google.com ([209.85.214.231]:50384)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxwHv-000000003KE-0pkG

for root@nk.ca;

Sat, 22 Aug 2026 18:42:25 -0600

Received: by mail-pl1-f231.google.com with SMTP id d9443c01a7336-2cace91f112so25149975ad.0

for ; Sat, 22 Aug 2026 17:41:27 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1787445682; x=1788050482; darn=nk.ca;

h=content-type:mime-version:date:message-id:subject:to:from:reply-to

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=35Ssk1DIWUO0BRRTNQthcH8yHQ1PdsDYieeyjgU00Jk=;

b=XWDtrANYGqkO3Qq52LPMNTCwyXVVfvN9k90wmFNMM8lCHvXXC6QCD9Ql63JoYSp0LZ

5E5wTL6aD72Cf0JfSZJN7S2afTxuSIfMgC7+GmRpXVLKsx1ND4ViLdjO8ymoZ1w2DDpI

I8sAHIX3t3tfUxOkw7AU2sD7nCE7eBy0+J93c=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787445682; x=1788050482;

h=content-type:mime-version:date:message-id:subject:to:from:reply-to

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=35Ssk1DIWUO0BRRTNQthcH8yHQ1PdsDYieeyjgU00Jk=;

b=dXUMibOHksFZoHzvtBfMd2VPo+EgXqB7ycASGpLyT/dnzQhZ+7VYB7ainL5FovtNYR

d1LP9K0/GdpnLCxOHoL5XWdyT2AUge3I/Z5AL4gk8zx1uT1nygEOCyX2I4LlgnToZ61q

TfWkTPDMP0nevGd1y8Wv33LY/eCu9YQUuSCYxCinRJ+D3EOx1/5nt8RTxM2t5scGcEWG

SNWkOVEdsTt4HGHia6zFiwdBw2Gg8heIsk7oazVOYHUjbfhf/qxHDam5ZdzVk41jB3ZE

MPKr9dByfYl5ueTxhPMHtITjbhNfUfWduqSMgyDabTe9MkDt9wasQVFWNNPNxYFw8uLE

HowQ==

X-Gm-Message-State: AFuF++llmDwkLlFiJfByWlCCwQVdH2vMTOhzt3y+XVkhmsBeBYdypV1u

Tk5vOTfGQgOJAUOei5jOO0TXY3/i20HgPaOzLFaG/eBaqtiW37O9kuz0hwnbrKFhphE1IIfFfni

x5OetbNJnHEumZY+2oGOj9OXyiUDPDSuY/gF/EM/1LPC8k8E=

X-Gm-Gg: AR+sD11xMXviE14hNJzJqp+toJlEXHjXTK1ZQe1rk9MDkzke1894mO428pfXigf/GNg

4P755tWdapUZbT+J/vEcm3QXQVOvYS8uLsUzhFyqcxc6tKiKhT00vlaBZrmWoy01AFnZ3OfJWZB

3xXY7RWwzCtifa7xfjbHRhG4nzi+LMgtQ9gGtn28sKbdb9i1VErxjrPuThsh3/AYVgJcauJSR8q

Fa339h/ItEMjJ+6TdbNpAVIB5yNAbkL1aEDa3ihdIY4IuWZO5ccGNJCuXf04HtnPwaWGZk2GBaP

CE0S2TCx8QddP0zbqHjzn5WoxjXwVvmhG+keYhmr6fJLVz/jFLHGDMqbJeirGQ==

X-Received: by 2002:a17:90b:2808:b0:37d:f983:7b5 with SMTP id 98e67ed59e1d1-395df289c4bmr15374692a91.9.1787445681953;

Sat, 22 Aug 2026 17:41:21 -0700 (PDT)

Received: from sabeng.it ([172.245.27.164])

by smtp-relay.gmail.com with ESMTPS id 98e67ed59e1d1-395e4b0d991sm1719226a91.8.2026.08.22.17.41.21

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Sat, 22 Aug 2026 17:41:21 -0700 (PDT)

X-Relaying-Domain: sabeng.it

Reply-To: muhammadomer@onionmail.org

From: Continental Management Group

To: root@nk.ca

Subject: Strategic Partnership and Funding Opportunity

Message-ID:

Date: Sun, 23 Aug 2026 00:41:21 +0000

MIME-Version: 1.0

Content-Type: multipart/related; type="text/html";

boundary="--_NmP-e0933fc74c1679e3-Part_1"



----_NmP-e0933fc74c1679e3-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable



=EF=BB=BF

Attention: root@nk.ca,





Greetings,





We, Continental Management Group(CMG) LLC, Brunei/Bahrain, invite you to=

partner with us and benefit from our new Investment/Loan and Partnership =

Project funding program. We offer Investments/loans and funding for various=

good projects.





Do you have any Investment projects that need funding? We are =

ready/eager to partner with you and also give you any substantial sum and a=

big loan of just 2% per annum for a period of 15 years.





We are interested in projects that require funding. Our Company is =

willing and ready to fund your viable projects. If you are serious and =

interested, do contact us with your project plan and executive summary of =

your project. If you're interested in any of our proposals, send me =

your Email ID and Mobile phone number so that I can write to you and give =

you more details on our Investment Loan Funding Plan. Reply us with this =

email address below:  muhammadomer@onionmail.org  








Regards,


Mr Muhammad Omer.



----_NmP-e0933fc74c1679e3-Part_1

Content-Type: image/png; name=nk.ca-logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=nk.ca-logo.png



iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAC

rklEQVR4nGNgGAWjYBQQC1b9ZwZjaqkjG/z/z8hAb2Bfv59FacEzT5llLz0YZp5hxadWZukre/lF

zzwY6uuZqOZb9TnXeRVXfHwst/P/f9EN7xPBcujBDFUrs/7zGYWVH18YwxxKUYj9RzhAbvHzh9Lb

f/0X2fPzNe/Wj2pg+fr/TOhqJVe/PSWz9OUzqjpAb9FzbtklL19Lrnr9QHjvz1f8B34cwDAc5oA1

b87ILHv1nKoOMJ75lEtu6auv0ivfbBba8SlY6Mr//7z7f5SC1ez/z4KsVmr1mzNyS2ngAIXFLz7J

LH99GMQX3v1tneCx///5d34whqcHqFrpFa/PKCx+QWUH1J/hUpr37JP84ldgB0gvfiwjvOfHG6E9

3y8w1O/nQE4P8otfnFGa9wzhAAYqOUB15pNPSvOfH4RJia57EyR1+P9/iU0fOsFqoBYqz3t2RnXW

E+o7QGvKw09qM5+AHaC16gobiJZZ9W6W/Pb//+UWv3CGaVGb+fiMxrRH1HeATt+9T1qTHxyEFUwg

Wr7/vIDy0g/3VBa/e6jVe0UI7LhJ98/q9t97bpxGZQcYdtz+pNdzF+yA0NBV8PJebdoDJ50l3/9r

Tn86D8TX7717zrDjDpUcwIBwgGnTzU/GrbcRDgABqCN0Jz5qN537879xx11v45ab+0ybbryivgMa

b3wya7yB6gCovEruNnbTzocXzNsfPTVrvP4IhLXqIemEKg6w6H3EadZ4451p0419qA5gYKiHZj/j

+vNm5u0Pvlm0P/pv2nD9mn39fQ4qpoGnXJadTz9bdUGyIbIDwHxoVJg13Sy1m/z1v2XXs5vUcQAU

2Nf/ZzFtvJ5hXH89BF/pBgopkDqThuuJoatQHUkXUI9cO1Ib2NfvZ0EPekzwnxGkDlZOjIJRMAoY

iAAAJQGMCHHrJ6AAAAAASUVORK5CYII=

----_NmP-e0933fc74c1679e3-Part_1--

Dating phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 22 Aug 2026 19:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxwar-00000000BBn-0HUp

for dave@doctor.nl2k.ab.ca;

Sat, 22 Aug 2026 19:01:49 -0600

Resent-From: The Doctor

Resent-Date: Sat, 22 Aug 2026 19:01:48 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f72.google.com ([209.85.216.72]:56527)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxvFy-00000000C94-3a83

for sales@nk.ca;

Sat, 22 Aug 2026 17:36:18 -0600

Received: by mail-pj1-f72.google.com with SMTP id 98e67ed59e1d1-381250979d5so2339250a91.0

for ; Sat, 22 Aug 2026 16:35:23 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sau-ac-th.20251104.gappssmtp.com; s=20251104; t=1787441718; x=1788046518; darn=nk.ca;

h=content-type:to:from:subject:date:message-id:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=LBygA+NSqVVEibaAnNljtIxJaA2WxfAn7b0iB2i1mcE=;

b=gAo4Dzqk6tyHwTeG5yhEJKXNTk7UYebH9yaA6NiAE0ilApcZX7M7oTp9aJhFdNota1

mMit9VSPjfsDZZbKjQrq1i+Ezbn7Lr2lh8EboBjbE+SEQ+mE0OysskrrxuwAcOC4XbzG

pE9GiMJEvKvvJDrOGzyEfCLD57E0PMYuJem9ax37CXfgKdM7ZXKoQEH/S2d5oGkWt33t

2FrkuNLUZryHvRXhMYaHTEwObDAofsNiK0kmQtak1tt51cpS7auk4+Nb8+WTEch+wqNg

La3WmYWiF9EPHFtl7r/s2qWG/N7UyQtiynaLXwTPLtNypYVigwvY2niwoOV0N3bdWih2

Wt8A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787441718; x=1788046518;

h=content-type:to:from:subject:date:message-id:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=LBygA+NSqVVEibaAnNljtIxJaA2WxfAn7b0iB2i1mcE=;

b=Ci4F6J2EY4hDAv1VJcXqqlnjB5ROwn+Nc8COWd8ZsMOpAa0QT3lOKDGRGrWau6ZnLc

vhxamGjQrEVlmLyozxRqlYj58x0wwUd6h0008MFnxy89Ab/VGbKwFxv2yWzTuBYHt0hx

juhWLw8h+GohP+di3k+FKCYz68j49pSrcMCepQTZjMNqvd+FAg23ivgdJMbCGm2IfHBO

yuwqUaD0whuQH3P0Z/OUS4sfltXcheaPLD6QWdwWViywpcXr2KIYfJ4f4fRQYgKBvu82

/JLRnczNreokvySZGmAm/+uq0iB3NJvtkEfbrIXuOmY0gytPB28B/WCP3oH8vZdwuMND

iohw==

X-Gm-Message-State: AFuF++lJyveuxlkyfgINRWiNlNHk9JVOxSrC+rGb1z1oNYYX8nT4Nazs

QwPy2nyGXJJ1KOVY+rlJuQYGICcngRM6Hd71jo3N2I2/HY56E7EF/Jpp/5CGLnW5Yf+B/7+9QSb

WBXoN9P0UZAqwgOkhCEd8Aw==

MIME-Version: 1.0

X-Received: by 2002:a17:90b:224f:b0:381:1f51:1ff0 with SMTP id

98e67ed59e1d1-395c354d445mr26505898a91.2.1787441717763; Sat, 22 Aug 2026

16:35:17 -0700 (PDT)

Message-ID:

Date: Sat, 22 Aug 2026 23:35:17 +0000

Subject: did you get my message?

From: Anna

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000a4f31e0659ab3460"

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 1,200+ single Ukrainian women online. They make the first

move — you just have to show up. Dating, but backwards Here, she writes

first.



Content analysis details: (10.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.216.72 listed in will-spam-for-food.eu.org]

[209.85.216.72 listed in will-spam-for-food.eu.org]

[209.85.216.72 listed in will-spam-for-food.eu.org]

[209.85.216.72 listed in will-spam-for-food.eu.org]

[209.85.216.72 listed in will-spam-for-food.eu.org]

[209.85.216.72 listed in will-spam-for-food.eu.org]

[209.85.216.72 listed in will-spam-for-food.eu.org]

[209.85.216.72 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.72 listed in dnsbl.ahbl.org]

[209.85.216.72 listed in dnsbl.ahbl.org]

[209.85.216.72 listed in dnsbl.ahbl.org]

[209.85.216.72 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.72 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.72 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.72 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.72 listed in dnsbl.ahbl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: 26cwiu.cfd]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: 26cwiu.cfd]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.72 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.72 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.216.72 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 OPT_OUT BODY: No description available.

0.2 MARKETING_PARTNERS BODY: Claims you registered with a partner

0.3 OFFER BODY: Offers you Something

1.7 BAD_CREDIT BODY: Eliminate Bad Credit

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} did you get my message?



--000000000000a4f31e0659ab3460

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



MSwyMDArIHNpbmdsZSBVa3JhaW5pYW4gd29tZW4gb25saW5lLiBUaGV5IG1ha2UgdGhlIGZpcnN0

IG1vdmUg4oCUIHlvdSBqdXN0ICANCmhhdmUgdG8gc2hvdyB1cC4NCg0KDQoNCg0KRGF0aW5nLCBi

dXQgYmFja3dhcmRzDQoNCkhlcmUsIHNoZSB3cml0ZXMgZmlyc3QuDQoNCjEsMjAwKyBzaW5nbGUg

VWtyYWluaWFuIHdvbWVuIGFyZSBvbmxpbmUgdG9uaWdodCDigJQgd2l0dHksIGRpcmVjdCwgYW5k

IHRpcmVkICANCm9mIHdhaXRpbmcgYXJvdW5kLg0KDQpNYWtlIGEgcHJvZmlsZSwgYW5kIHRoZSBm

cmllbmQgcmVxdWVzdHMgY29tZSB0byB5b3UuDQoNCg0KDQoNClNlZSB3aG8ncyBvbmxpbmUg4oaS

DQoNCg0KDQpGcmVlIHJlZ2lzdHJhdGlvbiDCtyBObyBjcmVkaXQgY2FyZCDCtyBObyBmYWtlIHBy

b2ZpbGVzDQoNCg0KDQpZb3UgYXJlIHJlY2VpdmluZyB0aGlzIG1lc3NhZ2UgYmVjYXVzZSB5b3Ug

b3B0ZWQgaW4gdG8gcmVjZWl2ZSBvZmZlcnMgZnJvbSAgDQpvbmUgb2Ygb3VyIG1hcmtldGluZyBw

YXJ0bmVycy4gU2VudCBieSBhbiBpbmRlcGVuZGVudCB0aGlyZC1wYXJ0eSBtYXJrZXRpbmcgIA0K

Y29tcGFueSwgbm90IHRoZSBhZHZlcnRpc2VyLiBNdXN0IGJlIDE4Ky4NClVuc3Vic2NyaWJlIMK3

IE9wdCBvdXQgb2YgYWxsIG1haWxpbmdzDQoNCg0KDQo=

--000000000000a4f31e0659ab3460

Content-Type: text/html; charset="UTF-8"







Someone new



1,200+ single Ukrainian women online. They make the first move — you just have to show up.


















Dating, but backwards



Here, she writes first.



1,200+ single Ukrainian women are online tonight — witty, direct, and tired of waiting around.



Make a profile, and the friend requests come to you.











See who’s online →




Free registration  ·  No credit card  ·  No fake profiles









You are receiving this message because you opted in to receive offers from one of our marketing partners. Sent by an independent third-party marketing company, not the advertiser. Must be 18+.


Unsubscribe  ·  Opt out of all mailings













--000000000000a4f31e0659ab3460--

Dating phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 22 Aug 2026 19:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxwan-00000000BB6-3gpT

for dave@doctor.nl2k.ab.ca;

Sat, 22 Aug 2026 19:01:45 -0600

Resent-From: The Doctor

Resent-Date: Sat, 22 Aug 2026 19:01:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qt1-f198.google.com ([209.85.160.198]:42191)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxvFi-00000000C6W-09F0

for usenet@nl2k.ab.ca;

Sat, 22 Aug 2026 17:36:06 -0600

Received: by mail-qt1-f198.google.com with SMTP id d75a77b69052e-52827090cc5so28191701cf.0

for ; Sat, 22 Aug 2026 16:35:07 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=ousl.lk; s=google; t=1787441701; x=1788046501; darn=nl2k.ab.ca;

h=content-type:to:from:subject:date:message-id:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=npdLiaD8VADZCVlghtyEQZeEbVXLx+4vNI/u0SJDIU4=;

b=IEE5SBq78nHBT9pKp1o7bOTGHy4esK/nXV+PkdrMqG2gNl32lHbOgW9lj1v1OGUrAD

xdFQd1395oxnauKwh8DQfEvmu4NfcXEgalNyt6h6545JFE66q0FKrMR4Mlalg+1yxKiK

NKl9ypoCSArp0i3nC/rh5yUtUZeO7muhKDSJI=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787441701; x=1788046501;

h=content-type:to:from:subject:date:message-id:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=npdLiaD8VADZCVlghtyEQZeEbVXLx+4vNI/u0SJDIU4=;

b=RykccmW8tqpDJOTrHX0jf+5vH3UP8cRbd6NhpEG8HpSblrcT7FI44o5QxwrE3qpYpP

chw52OW8kg0acoB1RCrV6gOfRhbVmF1+b0Hu7Gb2xipZE0cKwLwu34zIpcRz/CPtRlRw

y93v6j8q1XZl+hXSgeUvgU02W5cwURCsJY2bM6XV7FGieaOJPK738CLPOMN7gpHHbz0U

foQmunhwMq28ZCrmG0bBeyJf2X/go0AZzuYjjfMc7nULNdSaL4KuZTYJLXsERHqFR2fh

IksodqLQGw0SwW8LidydYngkupt8RhJrjq4A1k5MrOJsYJp5/CKFGjPNxuUvug+wyImz

UVaQ==

X-Gm-Message-State: AFuF++lboZS6BFUeIvpPNNQWtTtJfOD/ZmCg2aWpqkkuS6vKJmHwN6lJ

faBtml8KQ+Hr1YNp+7i+BL4Q3g0/Y/YLvpZwDpFzR2DK3wdYuKro6XPJsdVpIRutpuYEv1GZQNC

uc+jPkRQiuvj44EeZFg3kug==

MIME-Version: 1.0

X-Received: by 2002:a05:622a:4115:b0:51c:d1c:10e2 with SMTP id

d75a77b69052e-52de307caffmr243760961cf.12.1787441700785; Sat, 22 Aug 2026

16:35:00 -0700 (PDT)

Message-ID:

Date: Sat, 22 Aug 2026 23:35:00 +0000

Subject: did you get my message?

From: Anna

To: usenet@nl2k.ab.ca

Content-Type: multipart/alternative; boundary="000000000000a1e2740659ab33d5"

X-Spam_score: 13.2

X-Spam_score_int: 132

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 1,200+ single Ukrainian women online. They make the first

move — you just have to show up. Dating, but backwards Here, she writes

first.



Content analysis details: (13.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

[209.85.160.198 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

[209.85.160.198 listed in dnsbl.ahbl.org]

[209.85.160.198 listed in dnsbl.ahbl.org]

[209.85.160.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.198 listed in dnsbl.ahbl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: 26cwiu.cfd]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: 26cwiu.cfd]

2.5 URIBL_DBL_BOTNETCC Contains a botned C&C URL listed in the DBL

blocklist

[URI: ousl.lk]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.198 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 OPT_OUT BODY: No description available.

0.2 MARKETING_PARTNERS BODY: Claims you registered with a partner

0.3 OFFER BODY: Offers you Something

1.7 BAD_CREDIT BODY: Eliminate Bad Credit

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.198 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.198 listed in wl.mailspike.net]

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} did you get my message?



--000000000000a1e2740659ab33d5

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



MSwyMDArIHNpbmdsZSBVa3JhaW5pYW4gd29tZW4gb25saW5lLiBUaGV5IG1ha2UgdGhlIGZpcnN0

IG1vdmUg4oCUIHlvdSBqdXN0ICANCmhhdmUgdG8gc2hvdyB1cC4NCg0KDQoNCg0KRGF0aW5nLCBi

dXQgYmFja3dhcmRzDQoNCkhlcmUsIHNoZSB3cml0ZXMgZmlyc3QuDQoNCjEsMjAwKyBzaW5nbGUg

VWtyYWluaWFuIHdvbWVuIGFyZSBvbmxpbmUgdG9uaWdodCDigJQgd2l0dHksIGRpcmVjdCwgYW5k

IHRpcmVkICANCm9mIHdhaXRpbmcgYXJvdW5kLg0KDQpNYWtlIGEgcHJvZmlsZSwgYW5kIHRoZSBm

cmllbmQgcmVxdWVzdHMgY29tZSB0byB5b3UuDQoNCg0KDQoNClNlZSB3aG8ncyBvbmxpbmUg4oaS

DQoNCg0KDQpGcmVlIHJlZ2lzdHJhdGlvbiDCtyBObyBjcmVkaXQgY2FyZCDCtyBObyBmYWtlIHBy

b2ZpbGVzDQoNCg0KDQpZb3UgYXJlIHJlY2VpdmluZyB0aGlzIG1lc3NhZ2UgYmVjYXVzZSB5b3Ug

b3B0ZWQgaW4gdG8gcmVjZWl2ZSBvZmZlcnMgZnJvbSAgDQpvbmUgb2Ygb3VyIG1hcmtldGluZyBw

YXJ0bmVycy4gU2VudCBieSBhbiBpbmRlcGVuZGVudCB0aGlyZC1wYXJ0eSBtYXJrZXRpbmcgIA0K

Y29tcGFueSwgbm90IHRoZSBhZHZlcnRpc2VyLiBNdXN0IGJlIDE4Ky4NClVuc3Vic2NyaWJlIMK3

IE9wdCBvdXQgb2YgYWxsIG1haWxpbmdzDQoNCg0KDQo=

--000000000000a1e2740659ab33d5

Content-Type: text/html; charset="UTF-8"







Someone new



1,200+ single Ukrainian women online. They make the first move — you just have to show up.


















Dating, but backwards



Here, she writes first.



1,200+ single Ukrainian women are online tonight — witty, direct, and tired of waiting around.



Make a profile, and the friend requests come to you.











See who’s online →




Free registration  ·  No credit card  ·  No fake profiles









You are receiving this message because you opted in to receive offers from one of our marketing partners. Sent by an independent third-party marketing company, not the advertiser. Must be 18+.


Unsubscribe  ·  Opt out of all mailings













--000000000000a1e2740659ab33d5--

Dating phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 22 Aug 2026 19:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxwag-00000000B9b-2aM2

for dave@doctor.nl2k.ab.ca;

Sat, 22 Aug 2026 19:01:38 -0600

Resent-From: The Doctor

Resent-Date: Sat, 22 Aug 2026 19:01:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f198.google.com ([209.85.128.198]:51301)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from <3GzKKagYIAwQw65BA5et.eg.xl000rp6o.ef.ge@maestro.bounces.google.com>)

id 1wxvFZ-00000000C4b-0yIy

for www@nl2k.ab.ca;

Sat, 22 Aug 2026 17:35:54 -0600

Received: by mail-yw1-f198.google.com with SMTP id 00721157ae682-81e6bb29581so38015037b3.2

for ; Sat, 22 Aug 2026 16:34:57 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=ap-ac-th.20251104.gappssmtp.com; s=20251104; t=1787441691; x=1788046491; darn=nl2k.ab.ca;

h=content-type:to:from:subject:date:message-id:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=Ed+wkKq1+FNj2cf7rWegAA7CE9EXauT6HrhMt2EXSs8=;

b=lKfHVwsf+MrKfIZ8J2mPubiNUe2nin5JddX2IVoEgWW2x3nNdDdrc4Q96Y9m7nenvZ

QyPjy4hkAR425xv5XcshomWx9KZVp+YVMAt88Mnr9t4mKHXL2PPbr1lxMiv1yjynYWCZ

0pccu2ADtCzmre9jswuN+WUcSLoCKrZtgDgM8u+nH8Bl6qYtdokdkJO2gV8q1h0HxyGZ

89thMA1m0x9j97XL3Y35FS1slC1FXpVqQFhvw0spa/h7SLL72N8Skfzu7B/rQOhoBatg

zKL1XNVZrvZ719P7eKzWSxBNgJ3iQbQQxRz0cYPCv0g+A+XO56PQfn0WKYtAonLFyMK6

yGyw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787441691; x=1788046491;

h=content-type:to:from:subject:date:message-id:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=Ed+wkKq1+FNj2cf7rWegAA7CE9EXauT6HrhMt2EXSs8=;

b=c77ZwaRzS/3MO5mEgouRxiucCo4g/qOeYeBRwD074j72+fVq+SmlRX5htUglbmWWWj

n2DLb6ZH3qYw8meJ6cd6UWVJFivvVx7LBGYJ1SNBFQvYZzQZFUx1iYc5MpapYc9JDAKC

F2k7hxbsYF/CHAfyPWNjF7LMeqOSMU74TPFt9WWvmK5BsmZ48iFciWeP5gWguuhkE8zo

KEIyKBJ1AO/R+lE7PzLoi/WrbGU+sTBguUfOQ283SLwgSSrbUMOOcQ2CcYJBIP4DDAl9

2kXv7LJ7Al4LhjwdyuryaZqsaBH8GsJvdJhWdFmjZqD+w0EM7+/SETmI0OdrBjkOdzM5

JqvQ==

X-Gm-Message-State: AFuF++m4vBJc6ESmi7xRd+JOD5OG6reZX1XXOg0yNPyHbN4nfyNDg464

1sleONXZXXWcA1VngUXufC5ooBV5UanZ46EcyV73WaB1q5PNGhp7E917VVhWf8b0BVNfaoZ/vqL

oVwY+Lmlw/OM5npRUMMS+aV8B

MIME-Version: 1.0

X-Received: by 2002:a05:690e:1385:b0:66c:f25a:e6be with SMTP id

956f58d0204a3-66cf25aebe3mr2110254d50.14.1787441691301; Sat, 22 Aug 2026

16:34:51 -0700 (PDT)

Message-ID:

Date: Sat, 22 Aug 2026 23:34:51 +0000

Subject: did you get my message?

From: Anna

To: www@nl2k.ab.ca

Content-Type: multipart/alternative; boundary="0000000000001130e30659ab338c"

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 1,200+ single Ukrainian women online. They make the first

move — you just have to show up. Dating, but backwards Here, she writes

first.



Content analysis details: (10.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.198 listed in will-spam-for-food.eu.org]

[209.85.128.198 listed in will-spam-for-food.eu.org]

[209.85.128.198 listed in will-spam-for-food.eu.org]

[209.85.128.198 listed in will-spam-for-food.eu.org]

[209.85.128.198 listed in will-spam-for-food.eu.org]

[209.85.128.198 listed in will-spam-for-food.eu.org]

[209.85.128.198 listed in will-spam-for-food.eu.org]

[209.85.128.198 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.198 listed in dnsbl.ahbl.org]

[209.85.128.198 listed in dnsbl.ahbl.org]

[209.85.128.198 listed in dnsbl.ahbl.org]

[209.85.128.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.198 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.198 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.198 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.198 listed in list.dnswl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: 26cwiu.cfd]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.0 OPT_OUT BODY: No description available.

0.2 MARKETING_PARTNERS BODY: Claims you registered with a partner

0.3 OFFER BODY: Offers you Something

1.7 BAD_CREDIT BODY: Eliminate Bad Credit

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: 26cwiu.cfd]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.198 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.198 listed in wl.mailspike.net]

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} did you get my message?



--0000000000001130e30659ab338c

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



MSwyMDArIHNpbmdsZSBVa3JhaW5pYW4gd29tZW4gb25saW5lLiBUaGV5IG1ha2UgdGhlIGZpcnN0

IG1vdmUg4oCUIHlvdSBqdXN0ICANCmhhdmUgdG8gc2hvdyB1cC4NCg0KDQoNCg0KRGF0aW5nLCBi

dXQgYmFja3dhcmRzDQoNCkhlcmUsIHNoZSB3cml0ZXMgZmlyc3QuDQoNCjEsMjAwKyBzaW5nbGUg

VWtyYWluaWFuIHdvbWVuIGFyZSBvbmxpbmUgdG9uaWdodCDigJQgd2l0dHksIGRpcmVjdCwgYW5k

IHRpcmVkICANCm9mIHdhaXRpbmcgYXJvdW5kLg0KDQpNYWtlIGEgcHJvZmlsZSwgYW5kIHRoZSBm

cmllbmQgcmVxdWVzdHMgY29tZSB0byB5b3UuDQoNCg0KDQoNClNlZSB3aG8ncyBvbmxpbmUg4oaS

DQoNCg0KDQpGcmVlIHJlZ2lzdHJhdGlvbiDCtyBObyBjcmVkaXQgY2FyZCDCtyBObyBmYWtlIHBy

b2ZpbGVzDQoNCg0KDQpZb3UgYXJlIHJlY2VpdmluZyB0aGlzIG1lc3NhZ2UgYmVjYXVzZSB5b3Ug

b3B0ZWQgaW4gdG8gcmVjZWl2ZSBvZmZlcnMgZnJvbSAgDQpvbmUgb2Ygb3VyIG1hcmtldGluZyBw

YXJ0bmVycy4gU2VudCBieSBhbiBpbmRlcGVuZGVudCB0aGlyZC1wYXJ0eSBtYXJrZXRpbmcgIA0K

Y29tcGFueSwgbm90IHRoZSBhZHZlcnRpc2VyLiBNdXN0IGJlIDE4Ky4NClVuc3Vic2NyaWJlIMK3

IE9wdCBvdXQgb2YgYWxsIG1haWxpbmdzDQoNCg0KDQo=

--0000000000001130e30659ab338c

Content-Type: text/html; charset="UTF-8"







Someone new



1,200+ single Ukrainian women online. They make the first move — you just have to show up.


















Dating, but backwards



Here, she writes first.



1,200+ single Ukrainian women are online tonight — witty, direct, and tired of waiting around.



Make a profile, and the friend requests come to you.











See who’s online →




Free registration  ·  No credit card  ·  No fake profiles









You are receiving this message because you opted in to receive offers from one of our marketing partners. Sent by an independent third-party marketing company, not the advertiser. Must be 18+.


Unsubscribe  ·  Opt out of all mailings













--0000000000001130e30659ab338c--

Nk.CA Credential Phishing

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 22 Aug 2026 10:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxof7-000000008aG-0jcv

for dave@doctor.nl2k.ab.ca;

Sat, 22 Aug 2026 10:33:41 -0600

Resent-From: The Doctor

Resent-Date: Sat, 22 Aug 2026 10:33:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.emergingrating.com ([103.16.72.108]:60178)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxnMZ-00000000OPK-1xY0

for sales@nk.ca;

Sat, 22 Aug 2026 09:10:38 -0600

Received: from localhost (localhost.localdomain [127.0.0.1])

by mail.emergingrating.com (Postfix) with ESMTP id 040233E3FE2

for ; Sat, 22 Aug 2026 21:13:48 +0600 (+06)

Received: from mail.emergingrating.com ([127.0.0.1])

by localhost (mail.emergingrating.com [127.0.0.1]) (amavis, port 10032)

with ESMTP id ABkzDZ6xayNb for ;

Sat, 22 Aug 2026 21:13:47 +0600 (+06)

Received: from localhost (localhost.localdomain [127.0.0.1])

by mail.emergingrating.com (Postfix) with ESMTP id 89F8E40DEAF

for ; Sat, 22 Aug 2026 21:13:47 +0600 (+06)

X-Virus-Scanned: amavis at emergingrating.com

Received: from mail.emergingrating.com ([127.0.0.1])

by localhost (mail.emergingrating.com [127.0.0.1]) (amavis, port 10026)

with ESMTP id pHGn8B5ogJpz for ;

Sat, 22 Aug 2026 21:13:47 +0600 (+06)

Received: from 96e973dc.com (unknown [62.169.135.177])

by mail.emergingrating.com (Postfix) with ESMTPSA id D76C113F8314

for ; Sat, 22 Aug 2026 21:13:28 +0600 (+06)

Content-Type: multipart/mixed; boundary="===============1045353409688801620=="

MIME-Version: 1.0

From: Admin Nk Helpdesk online mail support account

imgfjqniwktkargewvphetsxffzcgkqsrtwdqcbvnlyitfaocsjjrpdyzljjsdmcxslloo



To: sales@nk.ca

Subject: Sales Nk Closure last notice update

Date: Sat, 22 Aug 2026 15:09:04 -0000

Message-ID: <178741134466.243240.6383465376943250951@emergingrating.com>

X-YRLMSZ: NBOBNT

X-TOQMD: QTWFCZCBF

X-Accept-Language: en-us, en

X-Spam_score: 13.0

X-Spam_score_int: 130

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (13.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[62.169.135.177 listed in will-spam-for-food.eu.org]

[62.169.135.177 listed in will-spam-for-food.eu.org]

[62.169.135.177 listed in will-spam-for-food.eu.org]

[62.169.135.177 listed in will-spam-for-food.eu.org]

[62.169.135.177 listed in will-spam-for-food.eu.org]

[62.169.135.177 listed in will-spam-for-food.eu.org]

[62.169.135.177 listed in will-spam-for-food.eu.org]

[62.169.135.177 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.16.72.108 listed in dnsbl.ahbl.org]

[103.16.72.108 listed in dnsbl.ahbl.org]

[103.16.72.108 listed in dnsbl.ahbl.org]

[103.16.72.108 listed in dnsbl.ahbl.org]

[62.169.135.177 listed in dnsbl.ahbl.org]

[62.169.135.177 listed in dnsbl.ahbl.org]

[62.169.135.177 listed in dnsbl.ahbl.org]

[62.169.135.177 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.16.72.108 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.16.72.108 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.16.72.108 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.16.72.108 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[62.169.135.177 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[62.169.135.177 listed in zen.spamhaus.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.16.72.108 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 DC_PNG_UNO_LARGO Message contains a single large inline gif

0.1 DC_IMAGE_SPAM_HTML Possible Image-only spam

0.1 DC_IMAGE_SPAM_TEXT Possible Image-only spam with little text

0.2 GMD_PDF_EMPTY_BODY BODY: Attached PDF with empty message body

Subject: {SPAM?} Sales Nk Closure last notice update



phishing notice




Nkclosure.pdf

Web/SEO/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 22 Aug 2026 07:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxlny-00000000BQ8-1wyn

for dave@doctor.nl2k.ab.ca;

Sat, 22 Aug 2026 07:30:38 -0600

Resent-From: The Doctor

Resent-Date: Sat, 22 Aug 2026 07:30:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f173.google.com ([209.85.208.173]:55566)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxkSA-00000000Ffs-2Vod

for sales@nk.ca;

Sat, 22 Aug 2026 06:04:10 -0600

Received: by mail-lj1-f173.google.com with SMTP id 38308e7fff4ca-39f91ba1ef7so14743951fa.3

for ; Sat, 22 Aug 2026 05:03:15 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1787400189; cv=none;

d=google.com; s=arc-20260327;

b=AKOw9Jpcc0+f8KMiN1Ii2nag4U6FO3vig0dU3N/WzSRuOCs/61eTq9fCN1GCCo/Owo

MHYoQDKn0sdfZ2gaF0Sdo3BH1iDsdziOQv3MPb5e3U+44fsWrznkaeUwpsuJ+0XRm+1p

7mzLKPz51jTWT2tEY0oPACptKPUqvCRH0IAq0hTwVfX2/jd3MD+WknxqZkI4wNzUpYQ+

1ghNyfsKZPmMtM7VfsOa9p+ZfnhSvkMpKTANgxArzvWA/2goS+X8cExjnxPEF93eihRK

XXOVJLtO4iNwavUwoUTrHojrNajQaiWWI67hhG9xADg4umPHXAUmJ/p5Ggc8N1ol7D7+

Sg1w==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:reply-to:from:sender:mime-version

:dkim-signature;

bh=ARrCOozyN6Qh1FlKclQkEOx6He0MstnsEcSEj5+w6l0=;

fh=K4YXDlBzh75jp+umpiVSGKtavKLbAmcgNobJ9O4QpWc=;

b=c7ivSIro8veL2e2Gfy0tTxwT9Dti0zzxw3dS4oWRy0PYzS48MhikM1ZibcS5vN97Qn

A8E+F7jwjnkBmRIQfEGYy1W8NYXSF2VSAAZp56t0AeP6GBDLeBPXcWDonYZa5XXldIok

JAywgyy73TNe56mXILBeMXG/8v2b0WY3Fvcegfmt1v4reU0prwTzhYLqKWa6zkzdG7yS

KHfALucb5f84JmDZDblNO2kJiQaRf9jyxBESHyEjv8uQyGWhRln/1NdZWmidO3zMB1YJ

/QMGfYO/u6wc329Snyfbv/JGR6WcWXDQe3qOWbc4tsTWqhS9Mdww0S7pamd5l5RBFBs6

HLwA==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=zubintech.com; s=google; t=1787400189; x=1788004989; darn=nk.ca;

h=content-type:to:subject:message-id:date:reply-to:from:sender

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=ARrCOozyN6Qh1FlKclQkEOx6He0MstnsEcSEj5+w6l0=;

b=Z2WcSlnM07H4E4EdDPuzqsk2LX3z5axMDUIrcMpUfNBaCTj3xydhvp8HyiwNlzqBPo

qva5c1TPnBKIyRj8KwtdkizwNsmAnVhQLTh7ZMW+zfxA+8nppR3qrkMRJf5hkDzNTyYC

C/TxMXKY2EThgGgCS7rYHAPZUKxUC7b6K2rMg=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787400189; x=1788004989;

h=content-type:to:subject:message-id:date:reply-to:from:sender

:mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=ARrCOozyN6Qh1FlKclQkEOx6He0MstnsEcSEj5+w6l0=;

b=YamQVgWSXa13XYrGQYlPOtmOtdi+4UUUrTo/ylhoM6haVlI+p34nsetRTlqn8D3Pkf

fvaqU/ygcpeZx9yof+xUWNLizdeMDpb64KWh9dFev+oZUjyAkogGytMQRAgM58JuB8RK

SVOjH2Dl/Vml7ZO0BRBet2/Hz+o20i4U8j8H/AWbGfGuMthtp2IDVEDuY5w3JKcYKJtx

KS0rdGhoJMhyL4YFsnUxL/qfcVTQ64L3HnOI0lN5pWMTAzGyeVkqjmrRG03I1D78X+6R

+aAlj3IxIVm9HVl+PJo5uJUI9jDFQuOceYGJ+npk40HYzREi7Q8lHR2JQtikvjIbpgiE

zbMQ==

X-Gm-Message-State: AFuF++kV5e4BCgMoEF7AcTULg4sfoyvjHYUo1Ej2m+t238TvrOfslKF5

3q0uxWi6vwROKePQ4KHuToxvHQJKK6freQn/PbYXEUkDGivdgf/3oqOnIP4CSds6F3TKh5RfBB5

wB9YvlCBxZf/9EN79f5Kky7Yk8dmZ960S50r2CntCrr84BU1C+mTpYU3Z

X-Gm-Gg: AR+sD10rmkdf2R616X/mOoyGgPHCz5/MV346xvj7R94DNn1BgLWoDbcs1xcaDWLXdjG

VMxNVp6CbWEMRCCfseqSgsJNFmFK2TDRzULeeI0p4Y9njtz33KXjX6yVgEwDB58hFI/ugROZ+s9

zOYb1fHgOWENApT8QwOBJqSEj0ti93IQrNUV6vj5HgZ+mY5GrAuYFr/0EMP+pCCm4/K/znGRNLb

51zD9sn3rlWfVQaanXXHZU22ruGnxms7T4AGiusQi1BxxXS4fLnN/FbM0U80TTSSKe1sRMkCLuu

M9YMmJzzz0UuoKDZZBz0JhXse4EAd/N1E+8Xo65OJRRpLMVTjyvR2HYjVAK246SrD2LSEvipTOJ

pO/+kyncri2QP0J+wzVgfKtVT8Ig6I6pXoqU6Hv/4A/h2k57C6Fvu410w8eM=

X-Received: by 2002:a05:651c:a0a:b0:39a:da70:2c83 with SMTP id

38308e7fff4ca-3a1c1e211f0mr12316531fa.7.1787400188442; Sat, 22 Aug 2026

05:03:08 -0700 (PDT)

Received: from 52669349336 named unknown by gmailapi.google.com with HTTPREST;

Sat, 22 Aug 2026 07:03:07 -0500

Received: from 52669349336 named unknown by gmailapi.google.com with HTTPREST;

Sat, 22 Aug 2026 05:03:06 -0700

MIME-Version: 1.0

Sender: Jeff Marsh

From: Jeff Marsh

Reply-To: sales@converthink.com

Date: Sat, 22 Aug 2026 07:03:07 -0500

X-Google-Sender-Auth: 2xu06FoARBfpubezedjOLI-QG8M

X-Gm-Features: AcwNN1Wy9H1JmL9tveZSVoIAQXfhQA2Km7DHcJ6Kch_5ozTMaMJ9_z7zhae-xP8

Message-ID:

Subject: A quick note about nk.ca

To: Sales

Content-Type: multipart/alternative; boundary="0000000000004dc2eb0659a1898c"



--0000000000004dc2eb0659a1898c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi nk.ca


1msQxqtGEYqw1IhkalopoAGpr6XwiNRwLOasZ46AsPTqE_Kl9U0_ElVfeWx9kLpHUTr_xBAhXjJ=

kkSRgJO3S-CPuaD0o6D1aURGB71-98jqqlQKINLWrwErW6-ykajdahP86OY_BRg8pzw>

,





I came across nk.ca


QtOydtKDw6LXtoxnalopoAEwpXY_gavq6hZpWmJXdO7H_iAwXi80a_flxoLVzuraepC4s_WKIzU=

8a5chTCkpHMGKMDO00vX6qVPmfm4meETBd7H-jzH8wtUDmhti2Nnb1THElyoP2ugjPg>

today and spent some time looking through the pages.





I noticed the SEO areas need attention and affect the pages to appear in

search results.





I wanted to point this out because these areas can be addressed with the

right changes.





If you=E2=80=99d like, I can share the specific points I found. Just reply =

Yes to

this email, and I=E2=80=99ll send them over.





If it's more convenient, you can also share your WhatsApp Number, for more

and quick communication.





Best Regards,





Jeff Marsh



Business Manager





Note: - Our next conversation will be on my corporate Email ID. If this is

something you are interested in, please respond to this email. If this is

not your interest, don't worry, we will not email you again.









[image: beacon]



--0000000000004dc2eb0659a1898c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




a3-b154cefc5b6c">


gin-bottom:0pt">
);font-family:Calibri,sans-serif;font-size:12pt;font-weight:700;white-space=

:pre-wrap">Hi
bSsM84fzmsgWlIMUilJw64RI1msQxqtGEYqw1IhkalopoAGpr6XwiNRwLOasZ46AsPTqE_Kl9U0=

_ElVfeWx9kLpHUTr_xBAhXjJkkSRgJO3S-CPuaD0o6D1aURGB71-98jqqlQKINLWrwErW6-ykaj=

dahP86OY_BRg8pzw" rel=3D"nofollow">nk.ca,


e=3D"line-height:1.2;margin-top:0pt;margin-bottom:0pt">
ght:normal">


0pt;margin-bottom:0pt">
ns-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font=

-style:normal;font-variant:normal;text-decoration:none;vertical-align:basel=

ine;white-space:pre-wrap">I came across
t;font-family:Calibri,sans-serif;color:rgb(0,0,0);background-color:transpar=

ent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:n=

one;vertical-align:baseline;white-space:pre-wrap">
ech-dot-yamm-track.appspot.com/224eNd3JbhBPxeevSGZeXnErvP25kQtOydtKDw6LXtox=

nalopoAEwpXY_gavq6hZpWmJXdO7H_iAwXi80a_flxoLVzuraepC4s_WKIzU8a5chTCkpHMGKMD=

O00vX6qVPmfm4meETBd7H-jzH8wtUDmhti2Nnb1THElyoP2ugjPg" rel=3D"nofollow">nk.c=

a
lor:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:norm=

al;font-variant:normal;text-decoration:none;vertical-align:baseline;white-s=

pace:pre-wrap"> today and spent some time looking through the pages.=


t">


-height:1.2;margin-top:0pt;margin-bottom:0pt">
;font-family:Calibri,sans-serif;color:rgb(0,0,0);background-color:transpare=

nt;font-weight:400;font-style:normal;font-variant:normal;text-decoration:no=

ne;vertical-align:baseline;white-space:pre-wrap">I noticed the SEO areas ne=

ed attention and affect the pages to appear in search results.


dir=3D"ltr" style=3D"line-height:1.2;margin-top:0pt;margin-bottom:0pt">
style=3D"font-weight:normal">


t:1.2;margin-top:0pt;margin-bottom:0pt">
family:Calibri,sans-serif;color:rgb(0,0,0);background-color:transparent;fon=

t-weight:400;font-style:normal;font-variant:normal;text-decoration:none;ver=

tical-align:baseline;white-space:pre-wrap">I wanted to point this out becau=

se these areas can be addressed with the right changes.


"ltr" style=3D"line-height:1.2;margin-top:0pt;margin-bottom:0pt">
=3D"font-weight:normal">


;margin-top:0pt;margin-bottom:0pt">
y:Calibri,sans-serif;color:rgb(0,0,0);background-color:transparent;font-wei=

ght:400;font-style:normal;font-variant:normal;text-decoration:none;vertical=

-align:baseline;white-space:pre-wrap">If you=E2=80=99d like, I can share th=

e specific points I found. Just reply
font-family:Calibri,sans-serif;color:rgb(0,0,0);background-color:transparen=

t;font-weight:700;font-style:normal;font-variant:normal;text-decoration:non=

e;vertical-align:baseline;white-space:pre-wrap">Yes
nt-size:12pt;font-family:Calibri,sans-serif;color:rgb(0,0,0);background-col=

or:transparent;font-weight:400;font-style:normal;font-variant:normal;text-d=

ecoration:none;vertical-align:baseline;white-space:pre-wrap"> to this email=

, and I=E2=80=99ll send them over.


eight:1.2;margin-top:0pt;margin-bottom:0pt">
>


bottom:0pt">
lor:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:norm=

al;font-variant:normal;text-decoration:none;vertical-align:baseline;white-s=

pace:pre-wrap">If it's more convenient, you can also share your =


0);background-color:transparent;font-weight:700;font-style:normal;font-vari=

ant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wra=

p">WhatsApp Number
sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;fo=

nt-style:normal;font-variant:normal;text-decoration:none;vertical-align:bas=

eline;white-space:pre-wrap">, for more and quick communication.

<=

p dir=3D"ltr" style=3D"line-height:1.2;margin-top:0pt;margin-bottom:0pt">
style=3D"font-weight:normal">


ht:1.2;margin-top:0pt;margin-bottom:0pt">
-family:Calibri,sans-serif;color:rgb(0,0,0);background-color:transparent;fo=

nt-weight:700;font-style:normal;font-variant:normal;text-decoration:none;ve=

rtical-align:baseline;white-space:pre-wrap">Best Regards,


=3D"ltr" style=3D"line-height:1.2;margin-top:0pt;margin-bottom:0pt">
tyle=3D"font-size:12pt;font-family:Calibri,sans-serif;color:rgb(0,0,0);back=

ground-color:transparent;font-weight:700;font-style:normal;font-variant:nor=

mal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">
=


gb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;fo=

nt-variant:normal;text-decoration:none;vertical-align:baseline;white-space:=

pre-wrap">Jeff Marsh


in-top:0pt;margin-bottom:0pt">
ibri,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:7=

00;font-style:normal;font-variant:normal;text-decoration:none;vertical-alig=

n:baseline;white-space:pre-wrap">Business Manager


style=3D"line-height:1.2;margin-top:0pt;margin-bottom:0pt">
-weight:normal">


top:0pt;margin-bottom:0pt">
i,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;=

font-style:normal;font-variant:normal;text-decoration:none;vertical-align:b=

aseline;white-space:pre-wrap">Note: - Our next conversation will be on my c=

orporate Email ID. If this is something you are interested in, please respo=

nd to this email. If this is not your interest, don't worry, we will no=

t email you again.


-top:0pt;margin-bottom:0pt">
ri,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400=

;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:=

baseline;white-space:pre-wrap">=C2=A0


e-height:1.2;margin-top:0pt;margin-bottom:0pt">

erchange-newline">




semaLiVkD6IoqQ8FHx6-JayY7xealopoAFlE-gtXgVMujrQqQY5rCMNQsdgscxzii7SaO57s6E-=

qiNeYocZ_dn5e6YoGglCxqc-WMpzwIir4vQVDFnbr_1xq58wLQf7t4sZH_kcfjehM9IALg" wid=

th=3D"1" height=3D"1" alt=3D"beacon" style=3D"display:none; display:none!im=

portant;">



--0000000000004dc2eb0659a1898c--

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 23:06:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxdvM-00000000E0n-1pgy

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 23:05:44 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 23:05:44 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m158132.netease.com ([47.251.158.132]:38854)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxcV2-000000001iS-3Mwj

for sales@nk.ca;

Fri, 21 Aug 2026 21:34:44 -0600

Content-Type: multipart/mixed; BOUNDARY="=_Part_258855_631013743.1787369605805"

To: sales

Subject: =?UTF-8?B?T2lsIEZyYWdyYW5jZSBoaWdoIHF1YWxpdHkgaG90ZWwgc2hhbXBvbyBzaG93ZXIgZ2VsIGNvbmRpdGlvbmVy?=

X-Priority: 3

MIME-Version: 1.0

Received: from emily@ylhotelsupply.com( [10.139.4.160] ) by ajax-webmail ( [127.0.0.1] ) ; Sat, 22 Aug 2026 11:33:25 +0800 (GMT+08:00)

From: Emily

Date: Sat, 22 Aug 2026 11:33:25 +0800 (GMT+08:00)

X-WM-Tid: 0aa02787c85cd068kusy5221c6a14b08f

Message-ID:



Subject:

Oil Fragrance high quality hotel shampoo shower gel conditioner

From:

Emily

Date:

8/21/26, 21:33

To:

sales



Good day General Manager and Purchasing,







Have you considered offering the most popular oil fragrance hotel shampoo shower gel conditioner body lotion?



Every guest is speaking highly our range of attached picture and admit this is most nicest range that they like.



It has 380ml and 50ml range, etc. Different dispenser bottles and sizes are available. What's more, our cost is very attractive.



Wall mounted brackets are in ABS material and stainless steel. Single, double and triple brackets can be sold by carton.



Dental kit, shaving kit, vanity kit, shower cap, sewing kit, loofah, comb, sanitary bag, pen, pencil, hotel slipper, laundry bag, tea tray, rubbish bin, toilet paper, tissue paper are offered with world's most updated design and cheap cost.



International shipping service is offered as well!







Kindest regards,



Emily







Yuelong Hotel Amenities



www.yuelonghotelamenities.com



Mobile/WeChat/Whatsapp:0086-13480795524







20250716155454 (47).jpg



20250716155454 (52).jpg



20250716155454 (54).jpg



20250716155454 (55).jpg



20250716155454 (60).jpg



20250716155454 (70).jpg



20250716155454 (74).jpg



20250716155454 (78).jpg



20250716155454 (91).jpg



Sugarcane Paper box set.jpg



20251225161450_513_109.jpg



20251225161439_509_109.jpg



20251225161442_510_109.jpg



20251225161448_512_109.jpg

Attachments:

20250716155454 (47).jpg 41.8 KB

20250716155454 (52).jpg 76.6 KB

20250716155454 (54).jpg 65.9 KB

20250716155454 (55).jpg 71.3 KB

20250716155454 (60).jpg 367 KB

20250716155454 (70).jpg 68.6 KB

20250716155454 (74).jpg 52.1 KB

20250716155454 (78).jpg 72.5 KB

20250716155454 (91).jpg 44.9 KB

Sugarcane Paper box set.jpg 90.4 KB

20251225161450_513_109.jpg 64.0 KB

20251225161439_509_109.jpg 132 KB

20251225161442_510_109.jpg 142 KB

20251225161448_512_109.jpg 167 KB

Casino spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 19:51:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxasb-000000004H3-0RBk

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 19:50:41 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 19:50:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f70.google.com ([209.85.222.70]:44045)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxZ3V-00000000PXB-3lO6

for root@nk.ca;

Fri, 21 Aug 2026 17:53:57 -0600

Received: by mail-ua1-f70.google.com with SMTP id a1e0cc1a2514c-97bf8f6b90cso230396241.0

for ; Fri, 21 Aug 2026 16:53:02 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=beaconite.edu.pk; s=google; t=1787356376; x=1787961176; darn=nk.ca;

h=content-type:to:from:subject:date:message-id:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=oO+q9f7AMDQ1B9aa90OWtB+/EfJJ1vJ0XK5BMbOThaQ=;

b=GH/ChvvhdjJJMjyDfzw9I68CDAqxy8PQn420VtGr/RjPxRbI+CLux+e/a5axzpvmlC

tRU76w+kFsKoDbQhhiwpIQfIi7NIRb3mc2v/JH+/hfRvMKWdOzuqxt9Sc2QoDLQ3q248

o0FVzu7rRHNvDOl8jGcR/MPu7G42mP3P7ilf5kX6OjAbEQd0POOqWKWr+D5d5KJs++4b

ZnSjTCx7bXBvHAUaljzdez0eKtt5kmhj2uC5t/+/5fr2IeXnxLID4gTsH5X90lIiWao7

jDiKr8ppECIjFwaQfBZyXtyMcDr0RtkXMvKkBtScLZ5Dyp5qaCEIfaIlQmSmP9lT3EBc

9qiA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787356376; x=1787961176;

h=content-type:to:from:subject:date:message-id:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=oO+q9f7AMDQ1B9aa90OWtB+/EfJJ1vJ0XK5BMbOThaQ=;

b=AMGmalZXki20anbRHKbiD0xWMzvwwHTPKr+//kH1mUX+jd4VvVfmkzsKBLubwlcexE

aOwfY8O/S3X2LTgTfxw7/Z5O4quGO6gkYLKVfKnDHbE29n0olNMZp3xySQCvfg+SAPK0

zEqLV+PDyTV3nC1vsNuRuFnfMCc2SONmScQmLqXgnRpuJJwKWXU5QYj3hLB++UzdAqLz

Ri2ds09nHTc79NFjtGnZYV/ufErhAHyi8l4Det+wXbI9m86wPEdYZnc1/snMVT27q48r

0zIun48Lc9/nsvZFL4Zhih8CHILHyxofh+QIF2t5nezGDoFexfpNVw0ijODDcoYkFwjP

FwCA==

X-Gm-Message-State: AFuF++lrSBOUGZ8sEAzdoOwDE1umKNPYsCJOOP5xS9f0EHrN5OowdKrt

pX9+An8rOQcXjmqFfnNNS70r33wUW8dADGI4+p7Cf+vXPST6Lt9qFyDivjOkKc7AJ3HLo1ZWWc/

ZpBd6syJTNVq5/hUbwRxVzw==

MIME-Version: 1.0

X-Received: by 2002:a05:6102:5087:b0:77a:7cd:8481 with SMTP id

ada2fe7eead31-77a634526aamr3469871137.4.1787356375900; Fri, 21 Aug 2026

16:52:55 -0700 (PDT)

Message-ID:

Date: Fri, 21 Aug 2026 23:52:55 +0000

Subject: =?UTF-8?Q?Your_1000=25_Welcome_Match_is_ready_=E2=80=94_up_to_C=2415=2C000?=

From: Rivo Rewards

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000df78ca06599755a9"

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your 1000% Welcome Match is sitting in your account — up

to C$15,000. Follow the fox and claim it before it resets. RIVO FOLLOW THE

FOX Your Welcome Package is ready



Content analysis details: (8.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: 358-casino.co]

0.0 URIBL_RED Contains an URL listed in the URIBL redlist

[URI: 358-casino.co]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.70 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 OPT_OUT BODY: No description available.

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.70 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.70 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 J_BACKHAIR_27 RAW: 2 alpha-tag-7 alpha

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} =?UTF-8?Q?Your_1000=25_Welcome_Match_is_ready_=E2=80=94_up_to_C=2415=2C000?=



--000000000000df78ca06599755a9

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



WW91ciAxMDAwJSBXZWxjb21lIE1hdGNoIGlzIHNpdHRpbmcgaW4geW91ciBhY2NvdW50IOKAlCB1

cCB0byBDJDE1LDAwMC4gIA0KRm9sbG93IHRoZSBmb3ggYW5kIGNsYWltIGl0IGJlZm9yZSBpdCBy

ZXNldHMuDQoNCg0KDQoNClJJVk8NCkZPTExPVyBUSEUgRk9YDQoNCg0KDQpZb3VyIFdlbGNvbWUg

UGFja2FnZSBpcyByZWFkeQ0KDQpBIDEwMDAlIG1hdGNoIGlzDQp3YWl0aW5nIG9uIHlvdXIgZmly

c3QgZGVwb3NpdA0KDQoNCg0KdXAgdG8gQyQxNSwwMDANCg0KKyB5b3VyIGZ1bGwgU2xvdHMgV2Vs

Y29tZSBQYWNrYWdlDQoNCg0KDQpIZXJlJ3MgdGhlIHNpbXBsZSBwYXJ0Lg0KDQpNYWtlIHlvdXIg

Zmlyc3QgZGVwb3NpdCBhbmQgUml2byBtdWx0aXBsaWVzIGl0IGJ5IHRlbi4gRGVwb3NpdCBDJDUw

LCBwbGF5ICANCndpdGggQyQ1NTAuIFRoYXQncyBodW5kcmVkcyBvZiBleHRyYSBzcGlucyBhY3Jv

c3MgdGhlIHNsb3RzIGFuZCBsaXZlIHRhYmxlcyAgDQrigJQgb24gdGhlIGhvdXNlLg0KDQpUaGUg

Zm94IGFscmVhZHkga25vd3Mgd2hlcmUgdGhlIGdvb2QgZ2FtZXMgYXJlLiBGb2xsb3cgaGltIGlu

IGFuZCBzZWUgd2hlcmUgIA0KeW91ciBuZXh0IHNwaW4gbGFuZHMuDQoNCg0KDQoNCkNsYWltIG15

IDEwMDAlIGJvbnVzIOKGkg0KDQoNCk5ldyBwbGF5ZXJzIG9ubHkgwrcgMTgrIMK3IFRha2VzIHVu

ZGVyIDIgbWludXRlcw0KDQoNCg0KDQoNCg0KVGhlbiBldmVyeSB3ZWVrZW5kDQoNCkZvcnR1bmUg

VmF1bHQgRnJpZGF5DQoNCkEgMjAwJSBib251cyB1cCB0byBDJDMsMDAwIHRvIHJlbG9hZCBhbmQg

a2VlcCB0aGUgcmVlbHMgc3Bpbm5pbmcgaW50byB0aGUgIA0Kd2Vla2VuZC4NClN0YXJ0IHBsYXlp

bmcgYXQgUml2byDihpINCg0KDQpPZmZlciBmb3IgbmV3IHBsYXllcnMgb25seSwgMTgrLiBHYW1i

bGluZyBpcyBhIGZvcm0gb2YgZW50ZXJ0YWlubWVudCwgbm90IGEgIA0Kd2F5IHRvIG1ha2UgbW9u

ZXkuIFBsZWFzZSBwbGF5IHJlc3BvbnNpYmx5LiBJZiBnYW1ibGluZyBzdG9wcyBiZWluZyBmdW4g

4oCUICANCmFuIHVyZ2UgdG8ga2VlcCBwbGF5aW5nLCBjaGFzaW5nIGxvc3Nlcywgb3IgYm9ycm93

aW5nIHRvIHBsYXkg4oCUIGhlbHAgaXMgIA0KYXZhaWxhYmxlLiBUZXJtcyBhbmQgd2FnZXJpbmcg

cmVxdWlyZW1lbnRzIGFwcGx5Lg0KDQoNCg0KWW91IGFyZSByZWNlaXZpbmcgdGhpcyBiZWNhdXNl

IHlvdSBvcHRlZCBpbiB0byBvZmZlcnMgbGlrZSB0aGlzIG9uZS4NCg0KVW5zdWJzY3JpYmUgwrcg

T3B0IG91dCBvZiBhbGwgZnV0dXJlIGVtYWlscw0KDQoNCg0KDQo=

--000000000000df78ca06599755a9

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">








0"/>





Rivo








:1px;line-height:1px;color:#0d0b14;">Your 1000% Welcome Match is sitting in=

your account =E2=80=94 up to C$15,000. Follow the fox and claim it before =

it resets.





=3D"0" style=3D"background:#0d0b14;">








g=3D"0" cellspacing=3D"0" style=3D"width:600px;max-width:600px;background:#=

15111f;border:1px solid #2a2136;border-radius:16px;overflow:hidden;">


























































#241b31;" align=3D"center">


26px;font-weight:700;letter-spacing:5px;color:#f6c945;">RIVO


ing:2px;color:#8a7fa6;margin-top:4px;">FOLLOW THE FOX



ter">


:700;letter-spacing:3px;color:#c9a24b;text-transform:uppercase;">Your Welco=

me Package is ready



f;font-size:38px;line-height:44px;font-weight:800;color:#ffffff;margin:14px=

0 6px 0;">A 1000% match is
waiting on your first deposit



x;">


if;font-size:52px;line-height:56px;font-weight:800;color:#f6c945;">up to C$=

15,000



d0;margin-top:4px;">+ your full Slots Welcome Package



t">


5px;color:#d9d2ea;margin:0 0 16px 0;">Here’s the simple part.




5px;color:#d9d2ea;margin:0 0 16px 0;">Make your first deposit and Rivo mult=

iplies it by ten. Deposit C$50, p=

lay with C$550. That’s hundreds of extra spins across the slots and l=

ive tables — on the house.




5px;color:#d9d2ea;margin:0 0 4px 0;">The fox already knows where the good g=

ames are. Follow him in and see where your next spin lands.










der-radius:40px;background:#f6c945;">


=3D"_blank" style=3D"display:inline-block;padding:16px 46px;font-family:'Tr=

ebuchet MS',Arial,sans-serif;font-size:18px;font-weight:800;color:#1a1206;t=

ext-decoration:none;border-radius:40px;letter-spacing:0.5px;">Claim my 1000=

% bonus →



a6;margin-top:12px;">New players only · 18+ · Takes under 2 m=

inutes



1px;background:#241b31;line-height:1px;font-size:0;"> 

">


:700;letter-spacing:2px;color:#c9a24b;text-transform:uppercase;">Then every=

weekend



2px;font-weight:800;color:#ffffff;margin:8px 0 4px 0;">Fortune Vault Friday=




3px;color:#c7bfdd;margin:0 0 18px 0;">A 20=

0% bonus up to C$3,000 to reload and keep the reels spinning into =

the weekend.




_blank" style=3D"font-family:Arial,sans-serif;font-size:15px;font-weight:70=

0;color:#f6c945;text-decoration:underline;">Start playing at Rivo →
>


t">


8px;color:#6f6689;margin:0;">Offer for new players only, 18+. Gambling is a=

form of entertainment, not a way to make money. Please play responsibly. I=

f gambling stops being fun — an urge to keep playing, chasing losses,=

or borrowing to play — help is available. Terms and wagering require=

ments apply.




x solid #241b31;" align=3D"center">


9px;color:#7b7295;margin:0 0 8px 0;">You are receiving this because you opt=

ed in to offers like this one.




9px;color:#7b7295;margin:0;">


=3D"_blank" style=3D"color:#9a90b8;text-decoration:underline;">Unsubscribe<=

/a>

 · 


=3D"_blank" style=3D"color:#9a90b8;text-decoration:underline;">Opt out of a=

ll future emails
















ght=3D"1" alt=3D"">

--000000000000df78ca06599755a9--

German language spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 11:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxSlZ-00000000764-2cFk

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 11:10:53 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 11:10:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qt1-f179.google.com ([209.85.160.179]:60511)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxQEg-00000000KCk-3KgA

for doctor@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 08:28:55 -0600

Received: by mail-qt1-f179.google.com with SMTP id d75a77b69052e-51c2cce930cso9977981cf.0

for ; Fri, 21 Aug 2026 07:28:00 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1787322474; cv=none;

d=google.com; s=arc-20260327;

b=UbJ51eKzOZHjwoS5S/bPP0Pd5o1jIKpygV7sN3ZqQJG6M339F1LzIsxqP/5xDXeyZ5

+TqwNJVvsmLXzVc9kBlyWDISyQ+HfGDigou4sF9TF+GuGU4YL/S0ich74uoSrM8Tg4zo

KvUyC4lQ21WuKwABsmMSmv/LKrFiWllZp9jHAVaLCYtsXfARJISnBGEur/xhbgQ2vXUZ

MQonB0BxFHn3jG36J30ZS2IJbXH1Dv3JMFSipVfd6zd475Czedx0bD374j6/t/16jKSE

FakIpxUx4iVkWU3d2SlT/aLdsAJsz57sGb4X6B82ucqblYz6Ai0E39k4Nirv2FN5mkW7

6YnQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=wOX6BpqH3So5LgKt8GneAqTSTAPs09Y73IcfWrzHvV8=;

fh=pRgcWmOSOXn8W66CMFyqliyXjPcT6wOwkZfUNhmR3v4=;

b=XUf6PzdbRYslFfZCeZEmpuCWZz6eWGk5nHbo1AFGIi/qRbyW/v59kNP3K58NbWIDJq

ggSqHk28RSkr+Q+zxqfNU6FXxF6g3cliW4eKvJHrnEluhf6oZTlTsd6mRyR8tlfYg/fb

rABG2WajM2xC9jSlBAhMof8DhMZPy0/AbAO+tdXqyZBxW5+at14qL9I1ajxcbUGIH97v

TxTzJcgQC5nAXs71Ki2+GM0/CBmEReqEMQPmyHbkEtJEICK2YYqie3I6oYkQBq8Etch+

Jpe1ZhDJeItAk5tHq2giy8OR4zy+iO1jH4BEjijrk3ETavQub4Y8nydArR1KZ4t13GO/

zoAg==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787322474; x=1787927274; darn=doctor.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=wOX6BpqH3So5LgKt8GneAqTSTAPs09Y73IcfWrzHvV8=;

b=O2j6weRUuCWtKfW6jTyt3gke4Nvr86jJb7dtKu3SQtcslVcBMxQv6RkKeBo+ZVbnTQ

qC2C4wQXBU4NkFMDSwPN+gdpQc32uR+geLMWxReiLtaVqnJfWUcV4iDIk+vdZiUQGwwP

lg7QAq4MjPocjRNtBUXQPYV4iD6z3DqATN0bIJhNFmCoisAfwNAJFsf+n30yB1OYFGLg

BevWYVZlwhejPDKGT+2gUd7o2FuJuugNUFQW3I914I2MobZ+kO3MGrgef9R59lJl92bG

LMx2KFUxY9L7kKp7gtJx1+8XwANwCRaw1K12OJ6fFbM0wSWjerGBnX5BR1GNk0gpo6LS

Fb0g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787322474; x=1787927274;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=wOX6BpqH3So5LgKt8GneAqTSTAPs09Y73IcfWrzHvV8=;

b=RZijhQKo4OqyhqHWiFXa/SL//pQ+GDti5OzTSqB8RulQygasaUt+F3Miwx773kSauv

IcpGbncc9hH+ZquPRvfHmWNDKcBjOdmY3hdzWEVrUfCaQHpX0tXJNOxMfveuoIO5mdvp

DgDRIqpWR8giNIMZ8qQJKjCH1L64Zv1Of3viu8XGcTdD1wSiC5bSZCYiNmlv724FuJZv

saqlufYczEDPth6LPFy6BUlZ1pfX3xOaVzGnTt02xunROmzp4yXIFnxV/MBbw3aQlOKJ

IE/XeEaKakJOm9MuwaLeHW66ytcOaMaBPd0Ye3u0hW7Y/v9gveE5/g/xbH1Cttq/5d4d

Gs3g==

X-Forwarded-Encrypted: i=1; AHgh+RpJ1LYcPVYosMoW9MoD7WPLeePQspsa/3EwEZev8RfmkyYEVmCGYC5CcJ6aPI153Nqm1fb1Oiw=@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Yw54BiAQnsg3JAWq+5imfA5Bu1u/0+JXu1vNEod3MkVVe9cCUag

bBOv3vk/wPiJOSv2UIB0rJeWqSr11GQHHrl9ghmxzSQ177YDGQ5kf0w0anR5BqU301okyXciEG3

lnpzzdG1cIHLxqrwvHx/m6W+VkYxqrOU=

X-Gm-Gg: AR+sD11/aggC5TF3zvkg6iOPrbZNgRAhrozwcmuI2QcMAGKDWBYPlN+1zUrMI5sYltj

aCwDNawmCORNahCarYlAGtxoR4UoG5lVgS88w6cNIXdqUu9ie1a51g5HaIrmNHzaEdHzNlaCNE4

SfFo5P8hq/QFhM+2U+muWrT5T6bdWkyywSLj9f/PUu2OlpNVpitoOywLwLq9o5K/wDaIIrtm5vQ

+DEOU6MgH89QD4nmdDSZdTqWP9RhOWgUYI6pC8qbS0vlLt8exxD/1yt8q+himhy9zlNUkWoDvoj

tEmkIdqQfXv5BdG/E4JV4iLW6n0y+HwSVgLrg5Zo3ZUi8eGIl8jLkZhwjk2FTcsWrjfhr16aa/U

j62Xp1tTu3Rro9g6tdOdzqCgYgw==

X-Received: by 2002:ac8:5895:0:b0:51a:8b64:69e2 with SMTP id

d75a77b69052e-52df56315e4mr61207541cf.7.1787322473469; Fri, 21 Aug 2026

07:27:53 -0700 (PDT)

MIME-Version: 1.0

Reply-To: ubabankafrican205@gmail.com

From: "Mrs. Kristalina"

Date: Fri, 21 Aug 2026 14:28:39 -0700

X-Gm-Features: AcwNN1W5TtBxxJ362fItgGqTaEQ4li_84XiAyexq40pJDeg93AW5GQl145oHac4

Message-ID:

Subject: ACHTUNG. LIEBER E-MAIL-INHABER

To: ikechukwu7020@gmail.com

Content-Type: multipart/alternative; boundary="0000000000002161c106598f71ad"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: *Sehr geehrte/r Fondsempfänger/in,ich habe Ihnen dieses Schreiben

vor einem Monat zugesandt, aber da ich keine Rückmeldung erhalten habe,

bin ich mir nicht sicher, ob es angekommen ist. Daher wieder [...]



Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.160.179 listed in will-spam-for-food.eu.org]

[209.85.160.179 listed in will-spam-for-food.eu.org]

[209.85.160.179 listed in will-spam-for-food.eu.org]

[209.85.160.179 listed in will-spam-for-food.eu.org]

[209.85.160.179 listed in will-spam-for-food.eu.org]

[209.85.160.179 listed in will-spam-for-food.eu.org]

[209.85.160.179 listed in will-spam-for-food.eu.org]

[209.85.160.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.179 listed in dnsbl.ahbl.org]

[209.85.160.179 listed in dnsbl.ahbl.org]

[209.85.160.179 listed in dnsbl.ahbl.org]

[209.85.160.179 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.179 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.179 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.179 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[ubabankafrican205(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[bagwelmickael(at)gmail.com]

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.179 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.179 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 LOTS_OF_MONEY Huge... sums of money

1.5 HK_NAME_FM_MR_MRS No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.2 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

Subject: {SPAM?} ACHTUNG. LIEBER E-MAIL-INHABER



--0000000000002161c106598f71ad

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Sehr geehrte/r Fondsempf=C3=A4nger/in,ich habe Ihnen dieses Schreiben vor =

einem

Monat zugesandt, aber da ich keine R=C3=BCckmeldung erhalten habe, bin ich =

mir

nicht sicher, ob es angekommen ist. Daher wiederhole ich: Ich bin

Kristalina Georgieva, CEO und Pr=C3=A4sidentin des Internationalen

W=C3=A4hrungsfonds.Wir haben alle Hindernisse und Probleme im Zusammenhang =

mit

Ihrer unvollst=C3=A4ndigen Transaktion und Ihrer Unf=C3=A4higkeit, die Ihne=

n f=C3=BCr

fr=C3=BChere =C3=9Cberweisungen berechneten Geb=C3=BChren zu begleichen, ge=

pr=C3=BCft. Bitte

besuchen Sie unsere Website zur Best=C3=A4tigung (38=C2=B053=E2=80=B256=E2=

=80=B3N 77=C2=B02=E2=80=B239=E2=80=B3W).Wir, der

Verwaltungsrat der Weltbank und des Internationalen W=C3=A4hrungsfonds (IWF=

) in

Washington, D.C., zusammen mit dem US-Finanzministerium und einigen anderen

relevanten Forschungseinrichtungen in den Vereinigten Staaten von Amerika,

haben unsere Abteilung f=C3=BCr Auslands=C3=BCberweisungen, die United Bank=

of Africa

in Lom=C3=A9, Togo, angewiesen, Ihnen eine VISA-Karte auszustellen, auf die=

Ihr

Fonds in H=C3=B6he von 1.500.000,00 USD f=C3=BCr eine sp=C3=A4tere Abhebung=

geladen

wird.Im Zuge unserer Untersuchung stellten wir mit Bedauern fest, dass Ihre

Zahlung unn=C3=B6tigerweise durch korrupte Bankangestellte verz=C3=B6gert w=

urde, die

versuchten, Ihr Geld auf ihre Privatkonten umzuleiten.Wir m=C3=B6chten Sie =

heute

dar=C3=BCber informieren, dass Ihr Guthaben von der UBA Bank Ihrer VISA-Kar=

te

gutgeschrieben wurde und zur Auslieferung bereitsteht. Bitte kontaktieren

Sie nun den Sekret=C3=A4r der UBA Bank, Herrn Joseph C. Keshi, E-Mail:

ubabankafrican205@gmail.com . Senden Sie ihm

die folgenden Informationen, damit Ihre akkreditierte VISA-Bankkarte an

Ihre Adresse geliefert werden kann.Ihr vollst=C3=A4ndiger Name

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DIhr Herkunftsland =

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DIhre Stadt

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DIhr Beruf =3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3DIhr Reisepass/Personalausweis

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DIhr Alter =3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3DIhre Adresse =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3DIhre

Telefonnummer =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3DVerwenden Sie diesen Code (Ref:

CLIENTE-966/16) als Betreff Ihrer E-Mail zur Identifizierung und geben Sie

die oben genannten Informationen bitte an die folgenden Mitarbeiter der

Visa Multibanco-Kartenausgabe weiter:Ich werde dem Bankmitarbeiter

empfehlen, eine separate E-Mail-Adresse mit einer neuen Telefonnummer

einzurichten, um diese Zahlung und die =C3=9Cberweisungskommunikation zu

best=C3=A4tigen und so weitere Verz=C3=B6gerungen oder den Missbrauch der G=

elder zu

vermeiden. Kontaktieren Sie die United Bank for Africa jetzt unter:

ubabankafrican205@gmail.com Ansprechpartner:

Herr Oliver AlawubaAbteilung Clearing Transfer (United Bank for

Africa)E-Mail: ubabankafrican205@gmail.com Wir

erwarten dringend eine Antwort auf diese E-Mail, um weitere Verz=C3=B6gerun=

gen

zu vermeiden.Mit freundlichen Gr=C3=BC=C3=9Fen, Frau Kristalina



--0000000000002161c106598f71ad

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Sehr geehrte/r Fondsem=

pf=C3=A4nger/in,

ich habe Ihnen dieses Schreiben vor einem Monat zug=

esandt, aber da ich keine R=C3=BCckmeldung erhalten habe, bin ich mir nicht=

sicher, ob es angekommen ist. Daher wiederhole ich: Ich bin Kristalina Geo=

rgieva, CEO und Pr=C3=A4sidentin des Internationalen W=C3=A4hrungsfonds.
>
Wir haben alle Hindernisse und Probleme im Zusammenhang mit Ihrer unvo=

llst=C3=A4ndigen Transaktion und Ihrer Unf=C3=A4higkeit, die Ihnen f=C3=BCr=

fr=C3=BChere =C3=9Cberweisungen berechneten Geb=C3=BChren zu begleichen, g=

epr=C3=BCft. Bitte besuchen Sie unsere Website zur Best=C3=A4tigung (38=C2=

=B053=E2=80=B256=E2=80=B3N 77=C2=B02=E2=80=B239=E2=80=B3W).

Wir, der=

Verwaltungsrat der Weltbank und des Internationalen W=C3=A4hrungsfonds (IW=

F) in Washington, D.C., zusammen mit dem US-Finanzministerium und einigen a=

nderen relevanten Forschungseinrichtungen in den Vereinigten Staaten von Am=

erika, haben unsere Abteilung f=C3=BCr Auslands=C3=BCberweisungen, die Unit=

ed Bank of Africa in Lom=C3=A9, Togo, angewiesen, Ihnen eine VISA-Karte aus=

zustellen, auf die Ihr Fonds in H=C3=B6he von 1.500.000,00 USD f=C3=BCr ein=

e sp=C3=A4tere Abhebung geladen wird.

Im Zuge unserer Untersuchung s=

tellten wir mit Bedauern fest, dass Ihre Zahlung unn=C3=B6tigerweise durch =

korrupte Bankangestellte verz=C3=B6gert wurde, die versuchten, Ihr Geld auf=

ihre Privatkonten umzuleiten.

Wir m=C3=B6chten Sie heute dar=C3=BCb=

er informieren, dass Ihr Guthaben von der UBA Bank Ihrer VISA-Karte gutgesc=

hrieben wurde und zur Auslieferung bereitsteht. Bitte kontaktieren Sie nun =

den Sekret=C3=A4r der UBA Bank, Herrn Joseph C. Keshi, E-Mail:
ailto:ubabankafrican205@gmail.com">ubabankafrican205@gmail.com. Senden =

Sie ihm die folgenden Informationen, damit Ihre akkreditierte VISA-Bankkart=

e an Ihre Adresse geliefert werden kann.

Ihr vollst=C3=A4ndiger Name=

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ihr Herkunfts=

land =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ihre Stadt =3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ihr Beruf =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D
Ihr Reisepass/Personalausweis =3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D
Ihr Alter =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=

Ihre Adresse =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ihre Telefonnumm=

er =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=



Verwenden Sie diesen Code (Ref: CLIENTE-966/16) als Betreff Ihrer E=

-Mail zur Identifizierung und geben Sie die oben genannten Informationen bi=

tte an die folgenden Mitarbeiter der Visa Multibanco-Kartenausgabe weiter:<=

br>
Ich werde dem Bankmitarbeiter empfehlen, eine separate E-Mail-Adress=

e mit einer neuen Telefonnummer einzurichten, um diese Zahlung und die =C3=

=9Cberweisungskommunikation zu best=C3=A4tigen und so weitere Verz=C3=B6ger=

ungen oder den Missbrauch der Gelder zu vermeiden. Kontaktieren Sie die Uni=

ted Bank for Africa jetzt unter:
com">ubabankafrican205@gmail.com
Ansprechpartner: Herr Oliver Alawub=

a
Abteilung Clearing Transfer (United Bank for Africa)
E-Mail:
f=3D"mailto:ubabankafrican205@gmail.com">ubabankafrican205@gmail.com
>Wir erwarten dringend eine Antwort auf diese E-Mail, um weitere Verz=C3=B6=

gerungen zu vermeiden.

Mit freundlichen Gr=C3=BC=C3=9Fen, Frau Krist=

alina




--0000000000002161c106598f71ad--

Dragonfly phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 19:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxarh-000000003fs-39Iu

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 19:49:45 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 19:49:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps.fslocal.com ([199.83.208.249]:55204)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxVbq-000000005hj-0lL8

for sales@nk.ca;

Fri, 21 Aug 2026 14:13:15 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=laravel.perksona.com; s=default; h=MIME-Version:Date:

Content-Transfer-Encoding:Message-ID:Subject:To:From:Content-Type:Sender:

Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From:

Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:

List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:

List-Archive; bh=LfZj7rc3TmHGvNxFzFRUld6qJTeDDYsBdOHrEbuhyds=; b=DvvlqfgZCdmQ

aaHfYLs7loLioRlnmfw+GZyU/l661zkwO36LKriNORE2Jk/aFqqOkyRm9Bap2AinES68fLegUrm3x

6MVCOQdyASMtDsrcbMLV8sW9dSUfjn/q1D2RJCmDiKpdI36Qx47VnkzP8YRXMVQSbf4YKJIz+xYYZ

jLaqwKgeWBSBcqW7Ny3fIHgaJzuspCSNeiIDen173AipKZDe0EmOO8yIV79VsbikLlTos3+tQ/ISs

BGIh3iwHEs8ujn7N3/4PoYV+ykthFBQbT9s4VchdPIY77005SKGNdcl/PRIKRK9BOFD2h/j419/TM

MOzhRh1gjFAr5vh6UUWovw==;

Received: from [196.65.208.58] (port=58289 helo=[127.0.0.1])

by vps.fslocal.com with esmtpsa (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5)

(envelope-from )

id 1wxVaa-00000003KcV-1N7y

for sales@nk.ca;

Fri, 21 Aug 2026 16:12:08 -0400

Content-Type: text/html

From: Dragonfly

To: sales@nk.ca

Subject: Dragonfly Delivery Notification

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Fri, 21 Aug 2026 20:11:41 +0000

MIME-Version: 1.0

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - vps.fslocal.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - laravel.perksona.com

X-Get-Message-Sender-Via: vps.fslocal.com: authenticated_id: info-mjqu@laravel.perksona.com

X-Authenticated-Sender: vps.fslocal.com: info-mjqu@laravel.perksona.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dragonfly Express. Dear Customer,



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[196.65.208.58 listed in will-spam-for-food.eu.org]

[196.65.208.58 listed in will-spam-for-food.eu.org]

[196.65.208.58 listed in will-spam-for-food.eu.org]

[196.65.208.58 listed in will-spam-for-food.eu.org]

[196.65.208.58 listed in will-spam-for-food.eu.org]

[196.65.208.58 listed in will-spam-for-food.eu.org]

[196.65.208.58 listed in will-spam-for-food.eu.org]

[196.65.208.58 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[196.65.208.58 listed in dnsbl.ahbl.org]

[196.65.208.58 listed in dnsbl.ahbl.org]

[196.65.208.58 listed in dnsbl.ahbl.org]

[196.65.208.58 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[199.83.208.249 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[199.83.208.249 listed in bl.score.senderscore.com]

Subject: {SPAM?} Dragonfly Delivery Notification














hidden; MAX-WIDTH: 600px; BACKGROUND: #fff; MARGIN: 20px auto; =

border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">


align-items: center; justify-content: center">


30px; FONT-WEIGHT: bold; COLOR: #fff; FONT-STYLE: italic">Dragonfly Express=

.







PADDING-TOP: 24px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">


DISPLAY: inline-block; PADDING-RIGHT: 6px">Dear Customer,

 






1.6">

Goods imported into Canada may be subject to applicable duties =

and/or taxes. Carriers are authorized by the. to process occasional =

shipments on behalf of the importer or owner and may remit applicable =

duties and taxes.





However, a parcel belonging to you has been held =

by customs due to missing declaration details from the sender. Please pay: =

4.95 CAD





in duties and taxes as soon as =

possible using the button below: taxes, or other charges are actually owed.=








href=3D"https://dragonfly-express.duckdns.org/Dragonfly_Shipping/" =

style=3D"FONT-SIZE: 14px; TEXT-DECORATION: none; BACKGROUND: #04ab94; =

FONT-WEIGHT: bold; COLOR: #fff; PADDING-BOTTOM: 10px; PADDING-TOP: 10px; =

PADDING-LEFT: 20px; DISPLAY: inline-block; PADDING-RIGHT: 20px; =

border-radius: 5px">Track my package






COLOR: #000">Thank you for choosing Dragonfly Express.










COLOR: #717171; PADDING-BOTTOM: 20px; TEXT-ALIGN: center; PADDING-TOP: =

20px; PADDING-LEFT: 20px; MARGIN: 0px auto; PADDING-RIGHT: 20px; =

border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">

This email was sent by an automated system=

. Please do not reply official:





© 2026 =

Intelcom Express - Dragonfly Express. All rights reserved.











Product Sourcing Inquiry from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 12:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxTlh-000000003ri-3qob

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 12:15:05 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 12:15:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ed1-f101.google.com ([209.85.208.101]:56642)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxTW3-00000000NrC-2E53

for doctor@netknow.ca;

Fri, 21 Aug 2026 11:59:05 -0600

Received: by mail-ed1-f101.google.com with SMTP id 4fb4d7f45d1cf-6a051b737d8so1834199a12.1

for ; Fri, 21 Aug 2026 10:58:07 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=nwhssasi-com.20251104.gappssmtp.com; s=20251104; t=1787335081; x=1787939881; darn=netknow.ca;

h=message-id:date:reply-to:mime-version:content-type:to:subject:from

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=YIj577gQN3gcbkCNwFCceFilc43bUo7ya+iM6grQMEk=;

b=TyedWPo71fCB4Rfp6WG0psmS5OREBkq4eF6Vw+WFP4GBL6nxb8cqfsn7nHCn4Y2dK3

s/pj8kzzPpVLLilI5hcRVD7ndjakboin2ak+COLGnr5Cp47qp5OwDGgsHnBn6tfu/jfa

efW5rbq2gX89aj20QngVxXT8XG3kSCMfqVYd2sXOoOKjQmaSQbTApgttLBfbNZrw54M2

JapnInVeuAGQVYdy73TbvA33oL5iIjwADjT7Ne2hNfv4+QEYpw/uoSBRY/kFjcHI6KIw

TD8hkjwmL1RMgKA5VCPs3g/VHz9k5IQvNgx4mEwMkrJ80QZzQ6xnDZoCwxJhPVs2pvWL

DrMw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787335081; x=1787939881;

h=message-id:date:reply-to:mime-version:content-type:to:subject:from

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=YIj577gQN3gcbkCNwFCceFilc43bUo7ya+iM6grQMEk=;

b=LBQ/+xLhag5LP9VTWTMnlbMPNbSvQ7xDKKVcWFqSlAp5ORpWIjfhX31tQnn2zT7VzS

DWzZ3iI+qAhun8cYG/H+Ej88wnjqLV8DRUdjkQAfdCfgQdg4Z38sVoo78nOkdAfrhcFN

bg2IFpcFujuXf0yhhA8M9XWggqU2DRyvxemEf8XM6jxj5okFFU9GMAFSQKOxVE9dposZ

XrvSRSU/pxgEMvcMynCqP0JOTYmbrkPO3lAnpput6V5R8DCpBWgDgxU+8ZIBfq8qn1UD

e6HQ+qDHw+Y9C/yvKvWEWgDBHc7LQ3AKvNsI4RjUAPvzSnckzpa61znEdPQvq19hClDP

vHUA==

X-Gm-Message-State: AFuF++lI9rm0RolMq7JjpkW+c3RgjjpqfYP9PWZ3fVcEs/gfCn64FWi4

t5a7Sdv8iQioQNItq1xHd04VLF8RsINd/K3GJi+L8lMA3TIq2GPLNQReg4NgsQtumA82h1rKhuY

40cO4m8awke8xJlKohuv5wIHWIKWd+UzKNVL1uVzPVq5JiKo=

X-Gm-Gg: AR+sD10R3qKYlmeGEBJfW4+nQ0rTbdXkqFc2HeOqKv1nFXRB32BGDTq9hGR/kDVe0PW

CEY48yctE1kfNHsWzL3IujzrZCY5HBsNVXA9Fa9sfYoajhCvExukbPSXLb3HPZClGj92rm11B5B

TVxSPWQGsB57EFl/kabIJs12OsFBOJzQYGYGoZwY1WZ6dMlLC/lYHw4k/qrKoxP5OMy64qA96Bb

A4amzgmkIKZoNLmKJQ4tw/IYGUn/grPke1gHfdazXY0pmyFxpNpaf5xGdVEC3msqenjS5yYnSjo

70/pfTnFcpOVH8JLhc0irEQcgsrHYWsDZGDRLfQ7M0goMRdu/eiRLjA/ESwh5nkpTABUfuJbz/J

AFyiAnkfjHmmZ9vJQLEK52mSRARrkpncxstQpw/9J8B4=

X-Received: by 2002:a05:6402:320c:b0:6a3:fdb0:c374 with SMTP id 4fb4d7f45d1cf-6a42f2054b1mr9489333a12.13.1787335080959;

Fri, 21 Aug 2026 10:58:00 -0700 (PDT)

Received: from WIN-CLVG3PFJJET (ip31-70-65-27.pbiaas.com. [31.70.65.27])

by smtp-relay.gmail.com with ESMTPS id 4fb4d7f45d1cf-6a3fe165c71sm2948595a12.0.2026.08.21.10.58.00

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Fri, 21 Aug 2026 10:58:00 -0700 (PDT)

X-Relaying-Domain: sasinm.com

From: "SCAFFCO CONSTRUCTION INC."

Subject: Product Sourcing Inquirry

To:

Content-Type: multipart/alternative; boundary="m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS"

MIME-Version: 1.0

Reply-To:

Date: Fri, 21 Aug 2026 17:58:00 +0000

Message-Id: <20262108175800C34F8D19F5-7A349DB0B9@sasinm.com>



This is a multi-part message in MIME format



--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable





Good day,



I am writing to inquire about your product, Can you give me your price=

list or latest catalog if you have it. We have needs for a big order.=

Waiting for your feedback. Thanks



Regards

Bryo Evans

Email:bryon20221@gmail.com



--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








8859-1">


le=3D1"> <=

title>Product Sourcing Inquirry



Good =

day,

I am writing to inquire about your product, Can you give me=

your price list or latest catalog if you have it. We have needs for a=

big order. Waiting for your feedback. Thanks

Regards
Bryo Ev=

ans
Email:bryon20221@gmail.com







--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS--