NetKnow Corporate Blog

Catalogue product request spam Part 2

Posted by Dave Yadallee on Thursday, June 4. 2026

------=_NextPart_000_0012_6E075E45.51D8F6B3

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Good Morning

My name is Kris Imsang, and I am the Managing Director/Chief Executive at T=

haiol Group Thailand,engaged in integrated operations in oil and gas, petro=

chemicals,Oil services,Offshore services,Oilfield,refinery,AeroSpace, Medic=

al Supplies,Medical Equipments,Laboratory Equipments, ETC with one of the h=

ighest efficiencies in the Asia-Pacific region and over 40years experience =

in business.

We are currently making an enquiry in your company as we need your services=

,

Looking forward to hearing from you.

Best regards,

Mr. Kris Imsang,

Director

Chairman of the Risk Management Committee

Thaioil Group

+66977830122

Email: krisimsang1@thai-oilgroup.com

https://www.thaioilgroup.com/

------=_NextPart_000_0012_6E075E45.51D8F6B3

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

, 34); text-transform: none; text-indent: 0px; letter-spacing: normal; font=

-family: Arial, Helvetica, sans-serif; font-size: small; font-style: normal=

; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: 2; wid=

ows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=

text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration=

-style: initial; text-decoration-color: initial;">

4, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal;=

font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: n=

ormal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: 2=

; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -we=

bkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decor=

ation-style: initial; text-decoration-color: initial;">

Dear Sir,

xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">

I am reaching out regarding our interest in your products. Kindly provide y=

our product price list along with catalogs for our review. Additionally, pl=

ease include any relevant information that may assist us in conducting due =

diligence about your company.

xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">

Thank you for your attention to this matter. We are optimistic about the po=

tential for a long-term business partnership and look forward to your respo=

nse.

xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">

Regards
Mr. Hans Edstrom
CEO
Company Name: INWATER AB
Address: =

Lovangsvagen 12 194 45 Upplands Väsby
Stockholms,
Tel: +46739303=

676

xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">

tter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-size:=

small; font-style: normal; font-weight: 400; word-spacing: 0px; white-spac=

e: normal; orphans: 2; widows: 2; font-variant-ligatures: normal; font-vari=

ant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness=

: initial; text-decoration-style: initial; text-decoration-color: initial;"=

>

xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">

------=_NextPart_000_0012_6E075E45.51D8F6B3--

Catalogue product request spam Part 1

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvOU-00000000IWR-18HI

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:53:06 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:53:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [51.158.145.43] (port=53246 helo=ns3333.ahcorporation.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUrkG-000000002h7-1BKQ

for doctor@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 13:59:45 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=swiftshippingpk.com; s=default; h=Content-Type:MIME-Version:Message-ID:Date

:Subject:To:From:Reply-To:Sender:Cc:Content-Transfer-Encoding:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=He3euyPTcLeAsI1P0V8Ox4zjZD1lyY7BZVWgPllvD7k=; b=wszXi5/2+RPcNacH8JOFtKjpiA

bPGw59YRoDPiu4g5N95hmFam4lsUmJ4xqPY5JOMgb2Np3OgiJkP9yzpo4HAkQcsHIH7gckwPj3Eef

FVTi22AO9FCavmzSaIrH15V9kpa0y8BcQG1xM5jctgfd/odSoLC1i5kOa2zvE8TfohUMjEHqcBeXM

NIxKAVvxJ+c1VOBlqlKwR6ClKh2eGXdykfe09DpKaZfqoAnEEuYW4iKWB83zHI4MQgyJ41AstnCaM

Q8ZJ1O6YwyQbw3qEY60Z/p0FmVMHvpezHYdv961q9ssj7PNdxJSHGXmpbCmyd9ov1Ksb7LuTKR4P4

EBdg4e6Q==;

Received: from [23.94.82.24] (port=63991 helo=23-94-82-24-host.colocrossing.com)

by ns3333.ahcorporation.net with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.1)

(envelope-from )

id 1wUriy-00000009rlu-0m09

for doctor@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 21:58:00 +0200

Reply-To: edstromh00@gmail.com

From: "Hans Edstrom"

To: doctor@doctor.nl2k.ab.ca

Subject: Re: Your Products.

Date: 3 Jun 2026 21:57:58 +0200

Message-ID: <20260603215758.4374AFFF851308CC@swiftshippingpk.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0012_6E075E45.51D8F6B3"

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - ns3333.ahcorporation.net

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - swiftshippingpk.com

X-Get-Message-Sender-Via: ns3333.ahcorporation.net: authenticated_id: tariq@swiftshippingpk.com

X-Authenticated-Sender: ns3333.ahcorporation.net: tariq@swiftshippingpk.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 10.3

X-Spam_score_int: 103

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Good Morning My name is Kris Imsang, and I am the Managing

Director/Chief Executive at Thaiol Group Thailand,engaged in integrated operations

in oil and gas, petrochemicals,Oil services,Offshore services,Oilfield, [...]

Content analysis details: (10.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

[51.158.145.43 listed in dnsbl.ahbl.org]

[51.158.145.43 listed in dnsbl.ahbl.org]

[51.158.145.43 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[23.94.82.24 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[51.158.145.43 listed in bl.score.senderscore.com]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[edstromh00(at)gmail.com]

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Re: Your Products.

Urgency spam

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvOM-00000000IV5-3axt

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:52:58 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:52:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from jack.dvlp.de ([195.201.169.156]:53628)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUriF-000000002c7-0XQZ

for doctor@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 13:57:25 -0600

Received: from ben.ad.dvlp.de (unknown [10.80.2.6])

by jack.dvlp.de (Postfix) with ESMTPS id 724CD3A328D;

Wed, 3 Jun 2026 21:56:25 +0200 (CEST)

Received: from ben.ad.dvlp.de (10.80.2.6) by ben.ad.dvlp.de (10.80.2.6) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.41; Wed, 3 Jun

2026 21:56:24 +0200

Received: from ben.ad.dvlp.de ([fe80::984e:5908:1f1a:4709]) by ben.ad.dvlp.de

([fe80::984e:5908:1f1a:4709%7]) with mapi id 15.02.2562.041; Wed, 3 Jun 2026

21:56:24 +0200

From: Gudrun Ernst

Subject: I've been trying to reach you...

Thread-Topic: I've been trying to reach you...

Thread-Index: AQHc85JZr9mNEKaHe0KBjJnJpBqenA==

Date: Wed, 3 Jun 2026 19:56:24 +0000

Message-ID: <85591e73bbfe4171b6e368d49a5d02bd@dvlp.de>

Accept-Language: de-DE, en-US

Content-Language: de-DE

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip: [15.204.43.201]

Content-Type: multipart/alternative;

boundary="_000_85591e73bbfe4171b6e368d49a5d02bddvlpde_"

MIME-Version: 1.0

X-Rspamd-Queue-Id: 724CD3A328D

X-Spamd-Result: default: False [3.87 / 11.00];

MSBL_EBL(10.66)[sandeep.bakhshi67@outlook.com:email];

EMAIL_DOMAIN_TLD_ALLOW(-10.00)[dvlp.de];

MISSING_TO(2.84)[];

BAYES_SPAM(0.32)[67.74%];

RCVD_NO_TLS_LAST(0.14)[];

MIME_GOOD(-0.10)[multipart/alternative,text/plain];

MIME_TRACE(0.00)[0:+,1:+,2:~];

MISSING_XM_UA(0.00)[];

RCVD_COUNT_TWO(0.00)[2];

FROM_HAS_DN(0.00)[];

FREEMAIL_ENVRCPT(0.00)[live.ca,yahoo.ca,videotron.ca,hotmail.ca];

ARC_NA(0.00)[];

FROM_EQ_ENVFROM(0.00)[];

SUSPICIOUS_AUTH_ORIGIN(0.00)[];

LOCAL_OUTBOUND(0.00)[];

HAS_XOIP(0.00)[];

MID_RHS_MATCH_FROM(0.00)[]

X-Rspamd-Action: no action

X-Rspamd-Server: jack

--_000_85591e73bbfe4171b6e368d49a5d02bddvlpde_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

I HAVE A JOB FOR YOU !!

For More Info, Reply to: sandeep.bakhshi67@outlook.com
hi67@outlook.com>

--_000_85591e73bbfe4171b6e368d49a5d02bddvlpde_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

1">

-family:Calibri,Helvetica,sans-serif;" dir=3D"ltr">

size: 16px; font-style: normal; font-variant-ligatures: normal; font-varian=

t-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-=

align: start; text-indent: 0px; text-transform: none; widows: 2; word-spaci=

ng: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decorati=

on-thickness: initial; text-decoration-style: initial; text-decoration-colo=

r: initial; font-family: Calibri, Helvetica, sans-serif; background-color: =

rgb(255, 255, 255);">

iant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: st=

art; text-indent: 0px; text-transform: none; word-spacing: 0px; white-space=

: normal; text-decoration-style: initial; text-decoration-color: initial; c=

olor: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size=

: 16pt; background-color: rgb(255, 255, 255); float: none; display: inline =

!important;">I

HAVE A JOB FOR YOU !!

size: 16px; font-style: normal; font-variant-ligatures: normal; font-varian=

t-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-=

align: start; text-indent: 0px; text-transform: none; widows: 2; word-spaci=

ng: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decorati=

on-thickness: initial; text-decoration-style: initial; text-decoration-colo=

r: initial; font-family: Calibri, Helvetica, sans-serif; background-color: =

rgb(255, 255, 255);">

iant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: st=

art; text-indent: 0px; text-transform: none; word-spacing: 0px; white-space=

: normal; text-decoration-style: initial; text-decoration-color: initial; c=

olor: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size=

: 16pt; background-color: rgb(255, 255, 255); float: none; display: inline =

!important;">

size: 16px; font-style: normal; font-variant-ligatures: normal; font-varian=

t-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-=

align: start; text-indent: 0px; text-transform: none; widows: 2; word-spaci=

ng: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decorati=

on-thickness: initial; text-decoration-style: initial; text-decoration-colo=

r: initial; font-family: Calibri, Helvetica, sans-serif; background-color: =

rgb(255, 255, 255);">

iant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: st=

art; text-indent: 0px; text-transform: none; word-spacing: 0px; white-space=

: normal; text-decoration-style: initial; text-decoration-color: initial; c=

olor: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size=

: 16pt; background-color: rgb(255, 255, 255); float: none; display: inline =

!important;">
i, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "S=

egoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "And=

roid Emoji", EmojiSymbols; font-size: 16px; font-style: normal; font-v=

ariant-ligatures: normal; font-variant-caps: normal; font-weight: 400; lett=

er-spacing: normal; text-align: start; text-indent: 0px; text-transform: no=

ne; word-spacing: 0px; white-space: normal; background-color: rgb(255, 255,=

255); text-decoration-style: initial; text-decoration-color: initial; floa=

t: none; display: inline !important;">

ant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; tex=

t-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spa=

cing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decora=

tion-thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial; background-color: rgb(255, 255, 255); color: rgb(34, 34, 34);=

font-family: Arial, Helvetica, sans-serif; font-size: small;">

ant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; tex=

t-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spa=

cing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decora=

tion-thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial; background-color: rgb(255, 255, 255); color: rgb(34, 34, 34);=

font-family: Arial, Helvetica, sans-serif; font-size: small;">

For More Info, Reply to:
ef=3D"mailto:sandeep.bakhshi67@outlook.com" id=3D"m_-8039026269117471758LPN=

oLP" target=3D"_blank" style=3D"color: rgb(17, 85, 204);">
nt-size: 16pt;">sandeep.bakhshi67@outlook.
16pt;">com

--_000_85591e73bbfe4171b6e368d49a5d02bddvlpde_--

Instagram phish from Google Gmail

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 04 Jun 2026 14:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVEUY-000000003pN-1UU6

for dave@doctor.nl2k.ab.ca;

Thu, 04 Jun 2026 14:16:38 -0600

Resent-From: The Doctor

Resent-Date: Thu, 4 Jun 2026 14:16:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f200.google.com ([209.85.128.200]:56335)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVETX-000000003k5-46mo

for sales@nk.ca;

Thu, 04 Jun 2026 14:15:44 -0600

Received: by mail-yw1-f200.google.com with SMTP id 00721157ae682-7ebbaaf1679so25904547b3.0

for ; Thu, 04 Jun 2026 13:14:48 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1780604082; x=1781208882; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=eO3Xe5Ch1grL/sk0AQP0FLJ/o+MA7iAPZeaig3dGN4Q=;

b=JEhUFSfO81x6PqJND5xS3hZFT84Xq9vgn1DCGs3ogVyCGf+77YSHcs34dglSZE6Slb

o9stZrA3N0aIv2+63/u6CDdxnR78EkSL1OF8odtOqb3gi/NdRUY5r2GW1twsIiBC7LJU

8Bq2OPwQlAaZgPeaw4N8G8A83MvpxXsYVztSIubMJPJWYGRH/YC3KfVf6/2fJm5cQ3uP

HOts1Mto3O5U7AFyAGPxUFVQxBXeR2OlmWctY2K6pjDMU1+d8lsDoMGWusPuHRwqXUT5

XRhZcdIIyRXEzaxXCrU3qmJScUibYbgQWSKxzsOW6NU6KzZ37KiKpxFr+gWmhFcHvlVw

IZVw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780604082; x=1781208882;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=eO3Xe5Ch1grL/sk0AQP0FLJ/o+MA7iAPZeaig3dGN4Q=;

b=e6MCEerYrUD2uivzb/WKpfByhWB9lGmJuunytZZTQh3o87N5E83SyAJLUXW8sd6joR

rLsqbgpN8NwdjUFYG+b4K+M6CFu9lrNUQoddBOrH11WYnFYavPuiU9ftjVifNMzlo8cX

Q+aRImxXJjF96LjD45Rdp320DQJk95wKbO8Y/GNShn2gXoSbzkGj2/wMiSzNc4AkZ1+T

aEocJO4HMlfqDIDs6kSL2fwcdGufZmHoMlGEvzKsDUXy5MPMLwVDGynsNXSMQVbtrPA7

0Ubh4GecMcO/VkVeApEPjbpQql32+5xjfvc/VG1rb1RA79ld91saXSFqh8dqYmR9fw54

o3NQ==

X-Gm-Message-State: AOJu0Ywvevc552YgFrL8n9UH1ixkzgTAevSkcbOE/YwsJShcdpVVCl+d

hAc09oqbxTNmNPdFb8+dD6drr67KgkslxS46TuMABIYpl8CYb8xlkf/ntsoQpnmbFEoixtZ7UvF

WkvSCSA==

MIME-Version: 1.0

X-Received: by 2002:a05:690c:d87:b0:7d0:261a:692 with SMTP id

00721157ae682-7ed0ef46d8bmr4463167b3.44.1780604082257; Thu, 04 Jun 2026

13:14:42 -0700 (PDT)

Message-ID:

Date: Thu, 04 Jun 2026 20:14:42 +0000

Subject: daveyadallee, Get More 100,000 Instagram Followers

From: danicenell5555@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, daveyadallee, Get More 100,000 Instagram Followers Sorry

to interrupt your time. We offer social media services, If you're interested,

please visit our Website. If you're not interested, please skip this step.

Content analysis details: (5.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

[209.85.128.200 listed in dnsbl.ahbl.org]

[209.85.128.200 listed in dnsbl.ahbl.org]

[209.85.128.200 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.200 listed in list.dnswl.org]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[danicenell5555(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[danicenell5555(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.200 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.200 listed in bl.score.senderscore.com]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} daveyadallee, Get More 100,000 Instagram Followers

Hi, daveyadallee, Get More 100,000 Instagram Followers

Sorry to interrupt your time.

We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.

We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )

Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :

[ https://instatool.site/store/free/?daveyadallee ]

Take free trial service today only...!!

10 -101K Instagram Followers

- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest

Thank you,

Regards,

Copyright © 2014 - 2026 instatool.site

Instagram phish from Google Gmail

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 04 Jun 2026 14:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVEUT-000000003pC-0oE7

for dave@doctor.nl2k.ab.ca;

Thu, 04 Jun 2026 14:16:33 -0600

Resent-From: The Doctor

Resent-Date: Thu, 4 Jun 2026 14:16:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f70.google.com ([209.85.210.70]:56338)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVETh-000000003kN-0ik3

for sales@nk.ca;

Thu, 04 Jun 2026 14:15:52 -0600

Received: by mail-ot1-f70.google.com with SMTP id 46e09a7af769-7e6ed99d4dbso392569a34.0

for ; Thu, 04 Jun 2026 13:14:58 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1780604092; x=1781208892; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=eO3Xe5Ch1grL/sk0AQP0FLJ/o+MA7iAPZeaig3dGN4Q=;

b=nMiIDMtADEKEuJ18gwLLZqfpJMkXywQSmkkcgq6GiyHmeX33jk3A/O4Fuyy+OJcYDq

Rqcg4K4rGsXzJPUZSwf8qfU6NQVItmfdmabEkak/ARIGrk4UhVCQZG1nXve3XORnpD5t

l0hiWJMrURd4Xcj0O4e9frZthzN/76b1S5KteWOu8VLdi+nuSO18K15S8T7kn1K3AIiL

CiINN+RMpgvy2TXDNhmN1JOyA27Sqnpppq1wGGQcypWfejcW8kSen50el3q51F6ivi+i

R3z2OjLVoNW4NuX/y0G5SzWV0hKau/vryAd9kQDgaa68nWIowWVC89c8TU9YnlS5VicY

zw2A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780604092; x=1781208892;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=eO3Xe5Ch1grL/sk0AQP0FLJ/o+MA7iAPZeaig3dGN4Q=;

b=cMi3fjxFrpA6fO9cs/PjKVhe2YlQLaXT3E+Q/er1bxKhys1Iv15cjnYWPhptRJ9iDo

ZqkD+KSOf1e4NK4N7xD6QQIfZmBqj2s/UR8ees+Kf+VyLI2U+bo7m5Cfxv0nLQ2QsjMs

nYxBohnrDsuIepggjNghImT3WhXAlfS7fIGpNi2n/G+cBTC0S4ii51axAKqNskzuCBPv

tmIAbH+qZgqsDOp34sYkIoScC/5mfUYttfjs8Orhg4Mzuwv9c0iiyOdFZPjdMKinhzik

G0pW9rj9QfPQnEBFnxlj/niCPdKStgYwj8TNZkfg0iy7JtY62Oi1yGT5TuJeU51XaZMA

/m6g==

X-Gm-Message-State: AOJu0YwpknOEja/nGWYMkGI+86F+Sd5B3RumvVX3z7d38LPxOWoCAiNJ

276qQ05hq5o+sxsdiwB+62fonG3/dcGybIGfan0R+XCFxP9/4cRJlBwFFqm8iQONrxPZvmCgndR

7y26e9Q==

MIME-Version: 1.0

X-Received: by 2002:a05:690c:d87:b0:7d0:261a:692 with SMTP id

00721157ae682-7ed0ef46d8bmr4463167b3.44.1780604082257; Thu, 04 Jun 2026

13:14:42 -0700 (PDT)

Message-ID:

Date: Thu, 04 Jun 2026 20:14:42 +0000

Subject: daveyadallee, Get More 100,000 Instagram Followers

From: danicenell5555@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, daveyadallee, Get More 100,000 Instagram Followers Sorry

to interrupt your time. We offer social media services, If you're interested,

please visit our Website. If you're not interested, please skip this step.

Content analysis details: (6.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

[209.85.210.70 listed in dnsbl.ahbl.org]

[209.85.210.70 listed in dnsbl.ahbl.org]

[209.85.210.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.70 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[danicenell5555(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[danicenell5555(at)gmail.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.70 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.70 listed in wl.mailspike.net]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} daveyadallee, Get More 100,000 Instagram Followers

Hi, daveyadallee, Get More 100,000 Instagram Followers

Sorry to interrupt your time.

We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.

We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )

Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :

[ https://instatool.site/store/free/?daveyadallee ]

Take free trial service today only...!!

10 -101K Instagram Followers

- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest

Thank you,

Regards,

Copyright © 2014 - 2026 instatool.site

Instagram phish from Google Gmail

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvNm-00000000H3U-4ATS

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:52:22 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:52:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f70.google.com ([209.85.222.70]:44306)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUqvW-000000000JN-2sK6

for sales@nk.ca;

Wed, 03 Jun 2026 13:07:02 -0600

Received: by mail-ua1-f70.google.com with SMTP id a1e0cc1a2514c-96396658728so1739299241.1

for ; Wed, 03 Jun 2026 12:06:08 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1780513562; x=1781118362; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=Nk1X77ROWPND4KkUVa6jMZOsIHCAYHPgVKMCQ0eaG28=;

b=NaaXqUbQAcM7U/1UB7aZ7XjMHzhfu+0cnZ6+SXUDmbBnTGjMntY6yS+qM97cwr3jEn

7rROVw1+QNdwCd5vSN6D6XTjkKrc9SqnN5JkZBfor/6n7G639WLZsBPYoUcHrNnIo4D4

39xHcZbn5bVBvlvj9Ri9fVg31i9+GTmE9eZGWPY8uzvbaXB+yqgs6FsqlHm5Wibegosn

ECgLuaH3RqzOX5/x5N/VHvQ2H1UbUVtIiI1C2nqdiHHu016281RNymzUCcDlU1nBXrTO

QzQxaJsDv8B7eBO4pftkbfdr3cbmqcgVfkotutFVbLfUIIvvSJ+PYvkyZbTdQb7C/Cis

V4pw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780513562; x=1781118362;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=Nk1X77ROWPND4KkUVa6jMZOsIHCAYHPgVKMCQ0eaG28=;

b=pBBrzLYeQLz1ymrZd+nay1oWbJfut/xH4EL6ybjZrPwTvyEo2Xwthze6Shl8yIPi6F

IKSoH2TJziwjVP/3hGSAe6LaOVcdlQhLQVy5RFAuD6T80xdBaUKVq75UPdzajjt1jqFR

VRQ0IgUd7GedcBwCDb2vtXaj3S//xGj334AvWF38/hDeXwQnRp/JuA/f6tzDvYr9pjuT

ySBFbXg2gVf8tVAm0T/2rK8gabdpefHt7fQWmx5nOrCPL7qjHoIlAXywV4kOpF87bifN

XN0WY67lysB//2iDrNo6NZJJJ97nOhKMOT0sXVEUNZ8gAJHijlexv0aO44ls77wmV6j4

8POA==

X-Gm-Message-State: AOJu0YynOUYiFOeoQnielB1Km/SdFgig2yx0TW5LgfMvrOxVXn7gnMwd

w/w7NG5bY7iTQNPU7T4YvbKuiNdVgDqTxp4LKrDwgBBKbGKrOrGAHTKhzjBft/u9O1htrDJo/JO

fEhfa+w==

MIME-Version: 1.0

X-Received: by 2002:a05:6122:4d12:b0:573:a779:62cf with SMTP id

71dfb90a1353d-5a6e5ddeb96mr3050410e0c.7.1780513562069; Wed, 03 Jun 2026

12:06:02 -0700 (PDT)

Message-ID:

Date: Wed, 03 Jun 2026 19:06:02 +0000

Subject: Netknow Internet Service, Get More 100,000 Instagram Followers and

100,000 Facebook Likes here

From: tutugnangko836@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, Netknow Internet Service, Get More 100,000 Instagram Followers

and 100,000 Facebook Likes here Sorry to interrupt your time. We offer social

media services, If you're interested, please visit our Website. If you're

not interested, please skip this step.

Content analysis details: (5.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.70 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[tutugnangko836(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[tutugnangko836(at)gmail.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.70 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.70 listed in wl.mailspike.net]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Netknow Internet Service, Get More 100,000 Instagram Followers and

100,000 Facebook Likes here

Hi, Netknow Internet Service, Get More 100,000 Instagram Followers and 100,000 Facebook Likes here

Sorry to interrupt your time.

We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.

We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )

Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :

[ https://instatool.site/store/free/?netknowyeg ]

Take free trial service today only...!!

10 -101K Instagram Followers

- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest

Thank you,

Regards,

Copyright © 2014 - 2026 instatool.site

Instagram phish from Google Gmail

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvNq-00000000HF4-2rJa

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:52:26 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:52:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f72.google.com ([209.85.210.72]:44543)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUqvh-000000000KF-1AMz

for sales@nk.ca;

Wed, 03 Jun 2026 13:07:12 -0600

Received: by mail-ot1-f72.google.com with SMTP id 46e09a7af769-7e6f905ea78so619062a34.1

for ; Wed, 03 Jun 2026 12:06:18 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1780513573; x=1781118373; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=Nk1X77ROWPND4KkUVa6jMZOsIHCAYHPgVKMCQ0eaG28=;

b=kC3PQy3GiXmHmDiRgJHZ/MsB4GRmYqPG3BgQf7bJvzDdudk3yhpS450uARismz8MiQ

yqBirPNQMq2F9vYx9gVmsrf28m/+0KmA99ZLLfkfblBZKcgVoRrBSlGcEP/pgJVBE28z

wDMJXY1VXgMFpvqqjVANqhH6Exg0MQFqL25MOD3WmQoLjjAfkDxQqcMFGdCd9QYsniN4

fBVWcwUTKL20YDyP1aCpS6/z51Xf+1VcIvUOcMCZPaInETJkBo1xc4BPXmRCxQEiglkm

YAgaLIFvmkhaUnbTjP8h6ilUpcJiUuxohyOIXkEsBV2ZBIE1oD0iqoXEtw4SyEL2hfEx

PWKA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780513573; x=1781118373;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=Nk1X77ROWPND4KkUVa6jMZOsIHCAYHPgVKMCQ0eaG28=;

b=bDNehApeooOIe/WTAKdZrPqOl13GCqldaYcnJFNRpbZkjxQPuSRCj46hQOoKpa5cpS

/7zng+ESOqi7lpx8aykq4hWokBQaYuybDG+kvaNuDCTJxClOCDieZGR2C4KMZTIdfkAT

+tD54zma9mSbsQ5gla2yCsPFLmKg8Bdo50Rho8BEvnVDkVUc9/lMbMVIX2tiWdDQvPMI

Oe4THFunWKbF7fXvgwSrTvyUuyQmmKA4IwEr64/B5/RZ4xZOwFN4N0cxHxlyOgDrGa5f

2bJ2WUzyOuA9RdLiXzawldLTjS6pI12H0nyNeGXYlktxIzfySQVNwLmAu/rfC+VHyVHW

FBDA==

X-Gm-Message-State: AOJu0YwIZp1Xd8tEgLnFJAY/oPhYzX5TALeIPk8P+QP4XNfh/q4DObxn

SgEjhv/8bu1RtS1D/BmuCCVA//c74Q0Rsj53Gesm85oQjy3PJXzwyx9/jHBBU/J0IcOMcyHAjHQ

jD13UuA==

MIME-Version: 1.0

X-Received: by 2002:a05:6122:4d12:b0:573:a779:62cf with SMTP id

71dfb90a1353d-5a6e5ddeb96mr3050410e0c.7.1780513562069; Wed, 03 Jun 2026

12:06:02 -0700 (PDT)

Message-ID:

Date: Wed, 03 Jun 2026 19:06:02 +0000

Subject: Netknow Internet Service, Get More 100,000 Instagram Followers and

100,000 Facebook Likes here

From: tutugnangko836@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, Netknow Internet Service, Get More 100,000 Instagram Followers

and 100,000 Facebook Likes here Sorry to interrupt your time. We offer social

media services, If you're interested, please visit our Website. If you're

not interested, please skip this step.

Content analysis details: (6.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.72 listed in dnsbl.ahbl.org]

[209.85.210.72 listed in dnsbl.ahbl.org]

[209.85.210.72 listed in dnsbl.ahbl.org]

[209.85.210.72 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.72 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.72 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.72 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.72 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.72 listed in will-spam-for-food.eu.org]

[209.85.210.72 listed in will-spam-for-food.eu.org]

[209.85.210.72 listed in will-spam-for-food.eu.org]

[209.85.210.72 listed in will-spam-for-food.eu.org]

[209.85.210.72 listed in will-spam-for-food.eu.org]

[209.85.210.72 listed in will-spam-for-food.eu.org]

[209.85.210.72 listed in will-spam-for-food.eu.org]

[209.85.210.72 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[tutugnangko836(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[tutugnangko836(at)gmail.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.72 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.72 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.72 listed in wl.mailspike.net]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Netknow Internet Service, Get More 100,000 Instagram Followers and

100,000 Facebook Likes here

Hi, Netknow Internet Service, Get More 100,000 Instagram Followers and 100,000 Facebook Likes here

Sorry to interrupt your time.

We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.

We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )

Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :

[ https://instatool.site/store/free/?netknowyeg ]

Take free trial service today only...!!

10 -101K Instagram Followers

- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest

Thank you,

Regards,

Copyright © 2014 - 2026 instatool.site

Instagram phish from Google Gmail

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvNi-00000000H2O-3uFO

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:52:18 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:52:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dy1-f198.google.com ([74.125.82.198]:44082)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <3C3sgaggJBdoDFYZcWYfCI6EH.8KIO6HAOJG.86@maestro.bounces.google.com>)

id 1wUqvS-000000000Iw-3hLT

for sales@nk.ca;

Wed, 03 Jun 2026 13:06:58 -0600

Received: by mail-dy1-f198.google.com with SMTP id 5a478bee46e88-30761ab3483so892232eec.0

for ; Wed, 03 Jun 2026 12:06:04 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1780513558; x=1781118358; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=Nk1X77ROWPND4KkUVa6jMZOsIHCAYHPgVKMCQ0eaG28=;

b=NdmO1Ckl+fNQfOM4jWmjKAbDtEHoAQtV6FaQMBhKeRL77T+A8XU35mLqL24l497/qK

OsPyctjDOizxOlxzqYtD9IVFjE/mkmzPqc1r+bWts1gknSEkE/XIibRGjtbuJBxHJeSb

Lbbam7ZZ3b4cbH+xd4P9eRSxoRIaoArTQZnlNtNyl4UbDCumihe3LwhFx5GlOq6KReSe

Cmx2QgvGUCT2RG9Mr9O0WwO8otCH/qB1cXDWEgOshBbun2gur4hYHGAX/ubKW5xlrejv

fnKqEvwXkv48hkxoCiF1CpfHZh9skOa9gExOr54Ewwz3bWw6SXJMzqcxxNBLeST6WqfC

n2DA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780513558; x=1781118358;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=Nk1X77ROWPND4KkUVa6jMZOsIHCAYHPgVKMCQ0eaG28=;

b=NAjkY+FmTAZd+uaTXiMlxUSkJYGkj9tWIuWZrkzle4WwPNt9k3mwqUg/zEMJ3ViDxo

EHNxMmHD2rVDHu6UbvGw1rL01qdWDdYklMpXZIHwjIiJ82vW0ujVcwJWZ9lvCy24zAQ9

yoYuvHq1H0sgQxhrArMfTkCB9RIMoK61+0Fc43gExKGDX1G3u0zL+3tt7kFHLg5ZVp+S

hViwXvrjf7fUCM/Fi14IFqQrU5MDWqOksTO3RdVNcdPhl7Jnjn8gfebnU2fa72aGS1FQ

rl29jTiPccygdaNjgPWJvIVAFon/HUU7M8Lr5VH92qTuD9hPrE3glxnET5Y6/7tboHUx

LzMg==

X-Gm-Message-State: AOJu0Yz89+c9xrUA/9Eto95ApcTAA9ZZmtGn0H8qGd8nIpcrEyIm/rXC

2qsSrkDd7hvuK1TxplmAIHAPhPGpaS9dFYOhZp45VQmFq6SkFEHa+mZsDgdfHPXYoKsphpG/a7v

fYj7MCA==

MIME-Version: 1.0

X-Received: by 2002:a05:6102:5091:b0:6d6:c2ca:1c20 with SMTP id

ada2fe7eead31-6ec4504f3a1mr2684478137.14.1780513547799; Wed, 03 Jun 2026

12:05:47 -0700 (PDT)

Message-ID:

Date: Wed, 03 Jun 2026 19:05:47 +0000

Subject: Netknow Internet Service, Get More 100,000 Instagram Followers and

100,000 Facebook Likes here

From: hj236029@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 6.2

X-Spam_score_int: 62

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, Netknow Internet Service, Get More 100,000 Instagram Followers

and 100,000 Facebook Likes here Sorry to interrupt your time. We offer social

media services, If you're interested, please visit our Website. If you're

not interested, please skip this step.

Content analysis details: (6.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.82.198 listed in dnsbl.ahbl.org]

[74.125.82.198 listed in dnsbl.ahbl.org]

[74.125.82.198 listed in dnsbl.ahbl.org]

[74.125.82.198 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.82.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.82.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.82.198 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.82.198 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.82.198 listed in will-spam-for-food.eu.org]

[74.125.82.198 listed in will-spam-for-food.eu.org]

[74.125.82.198 listed in will-spam-for-food.eu.org]

[74.125.82.198 listed in will-spam-for-food.eu.org]

[74.125.82.198 listed in will-spam-for-food.eu.org]

[74.125.82.198 listed in will-spam-for-food.eu.org]

[74.125.82.198 listed in will-spam-for-food.eu.org]

[74.125.82.198 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.82.198 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[hj236029(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.82.198 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[74.125.82.198 listed in wl.mailspike.net]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

Subject: {SPAM?} Netknow Internet Service, Get More 100,000 Instagram Followers and

100,000 Facebook Likes here

Hi, Netknow Internet Service, Get More 100,000 Instagram Followers and 100,000 Facebook Likes here

Sorry to interrupt your time.

We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.

We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )

Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :

[ https://instatool.site/store/free/?netknowyeg ]

Take free trial service today only...!!

10 -101K Instagram Followers

- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest

Thank you,

Regards,

Copyright © 2014 - 2026 instatool.site

Instagram phish from Google Gmail

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvNm-00000000H3U-4ATS

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:52:22 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:52:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f70.google.com ([209.85.222.70]:44306)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUqvW-000000000JN-2sK6

for sales@nk.ca;

Wed, 03 Jun 2026 13:07:02 -0600

Received: by mail-ua1-f70.google.com with SMTP id a1e0cc1a2514c-96396658728so1739299241.1

for ; Wed, 03 Jun 2026 12:06:08 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1780513562; x=1781118362; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=Nk1X77ROWPND4KkUVa6jMZOsIHCAYHPgVKMCQ0eaG28=;

b=NaaXqUbQAcM7U/1UB7aZ7XjMHzhfu+0cnZ6+SXUDmbBnTGjMntY6yS+qM97cwr3jEn

7rROVw1+QNdwCd5vSN6D6XTjkKrc9SqnN5JkZBfor/6n7G639WLZsBPYoUcHrNnIo4D4

39xHcZbn5bVBvlvj9Ri9fVg31i9+GTmE9eZGWPY8uzvbaXB+yqgs6FsqlHm5Wibegosn

ECgLuaH3RqzOX5/x5N/VHvQ2H1UbUVtIiI1C2nqdiHHu016281RNymzUCcDlU1nBXrTO

QzQxaJsDv8B7eBO4pftkbfdr3cbmqcgVfkotutFVbLfUIIvvSJ+PYvkyZbTdQb7C/Cis

V4pw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780513562; x=1781118362;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=Nk1X77ROWPND4KkUVa6jMZOsIHCAYHPgVKMCQ0eaG28=;

b=pBBrzLYeQLz1ymrZd+nay1oWbJfut/xH4EL6ybjZrPwTvyEo2Xwthze6Shl8yIPi6F

IKSoH2TJziwjVP/3hGSAe6LaOVcdlQhLQVy5RFAuD6T80xdBaUKVq75UPdzajjt1jqFR

VRQ0IgUd7GedcBwCDb2vtXaj3S//xGj334AvWF38/hDeXwQnRp/JuA/f6tzDvYr9pjuT

ySBFbXg2gVf8tVAm0T/2rK8gabdpefHt7fQWmx5nOrCPL7qjHoIlAXywV4kOpF87bifN

XN0WY67lysB//2iDrNo6NZJJJ97nOhKMOT0sXVEUNZ8gAJHijlexv0aO44ls77wmV6j4

8POA==

X-Gm-Message-State: AOJu0YynOUYiFOeoQnielB1Km/SdFgig2yx0TW5LgfMvrOxVXn7gnMwd

w/w7NG5bY7iTQNPU7T4YvbKuiNdVgDqTxp4LKrDwgBBKbGKrOrGAHTKhzjBft/u9O1htrDJo/JO

fEhfa+w==

MIME-Version: 1.0

X-Received: by 2002:a05:6122:4d12:b0:573:a779:62cf with SMTP id

71dfb90a1353d-5a6e5ddeb96mr3050410e0c.7.1780513562069; Wed, 03 Jun 2026

12:06:02 -0700 (PDT)

Message-ID:

Date: Wed, 03 Jun 2026 19:06:02 +0000

Subject: Netknow Internet Service, Get More 100,000 Instagram Followers and

100,000 Facebook Likes here

From: tutugnangko836@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, Netknow Internet Service, Get More 100,000 Instagram Followers

and 100,000 Facebook Likes here Sorry to interrupt your time. We offer social

media services, If you're interested, please visit our Website. If you're

not interested, please skip this step.

Content analysis details: (5.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.70 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[tutugnangko836(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[tutugnangko836(at)gmail.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.70 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.70 listed in wl.mailspike.net]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Netknow Internet Service, Get More 100,000 Instagram Followers and

100,000 Facebook Likes here

Hi, Netknow Internet Service, Get More 100,000 Instagram Followers and 100,000 Facebook Likes here

Sorry to interrupt your time.

We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.

We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )

Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :

[ https://instatool.site/store/free/?netknowyeg ]

Take free trial service today only...!!

10 -101K Instagram Followers

- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest

Thank you,

Regards,

Copyright © 2014 - 2026 instatool.site

BBB complaints phish Part 2

Posted by Dave Yadallee on Thursday, June 4. 2026

BBB LOGO

BBB Great West + Pacific sent you a message about

Complaint Received: ID 27621257

TH!NK

Address:

500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920

Phone: (808) 224-6694

Website: https://think-training.com

Email: doctor@nk.ca

Local BBB: BBB Great West + Pacific

BBB File Opened: 3/7/2014

Years in Business: 23

Business Started: 1/6/2003

Category: Management Consultant

⚠ This business is NOT BBB Accredited.

Respond Within 10 Days

Your BBB received a complaint about your business. The complaint was submitted on May 8, 2026 and assigned ID 27621257. Although BBB makes no judgment on validity, we recognize there are two sides to every dispute. We request your good faith effort to resolve it outside the legal system.

⚠ PAY ATTENTION! Nature of complaint: Unsatisfactory product/service quality and delayed delivery! Requested resolution: Full refund plus written apology. The complainant submitted all known details about TH!NK and referenced the email address doctor@nk.ca. Please respond promptly to resolve this matter.

Respond to this Complaint

Please understand that the consumer’s complaint and your response may be publicly posted on the BBB web site (BBB reserves the right to not post in accordance with BBB policy). By submitting your response, you are representing that it is a truthful account of your experience with this consumer. BBB may edit the complaint or your response to protect privacy rights and to remove inappropriate language.

Key Details

Complaint ID: 27621257

Submitted: May 8, 2026

Access Code: 27621257-3D67D

Complainant: click to reveal

Category: Product Quality & Delivery

Business: TH!NK

If you received this complaint via Postal Mail, you may respond online using the link below or respond by mail using the address above.

To access/respond to this complaint online:

Go to:respond-bbb-org/letter/

Enter the following code: 27621257-3D67D

Sender Details

Service Representative - (609) 588-0808 Ext: 11 - complaints@bbb.org

BBB Great West + Pacific

Facebook

Instagram

LinkedIn

Twitter

YouTube

Better Business Bureau® | BBB.org

© 2026, International Association of Better Business Bureaus, Inc., separately incorporated Better Business Bureau organizations in the US and Canada, and BBB Institute for Marketplace Trust, Inc. All rights reserved.

Unsubscribe | Privacy | Log In

BBB Complaints phish Part 1

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvO9-00000000I7b-2KID

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:52:45 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:52:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from leaf104.mfilter.dimenoc.com ([72.29.89.7]:56392)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUsD4-000000005ky-0USL

for doctor@nk.ca;

Wed, 03 Jun 2026 14:29:15 -0600

Received: from localhost (localhost [127.0.0.1])

by leaf104.mfilter.dimenoc.com (Postfix) with ESMTP id 1D1BB5D1510

for ; Wed, 3 Jun 2026 16:28:03 -0400 (EDT)

X-Virus-Scanned: amavisd-new at leaf.mfilter.dimenoc.com

Received: from leaf104.mfilter.dimenoc.com ([127.0.0.1])

by localhost (leaf104.mfilter.dimenoc.com [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id UFK6DpHjymSm for ;

Wed, 3 Jun 2026 16:28:00 -0400 (EDT)

Received: from pass11.dizinc.com (pass11.dizinc.com [72.29.75.247])

by leaf104.mfilter.dimenoc.com (Postfix) with ESMTP

for ; Wed, 3 Jun 2026 16:28:00 -0400 (EDT)

Received: from hst-144-26.orlandonet.net ([83.143.144.26]:26936 helo=KDEEGBYL)

by pass11.dizinc.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.4)

(envelope-from )

id 1wUrYX-00000001GJA-1tGH

for doctor@nk.ca;

Wed, 03 Jun 2026 15:47:17 -0400

Message-ID:

From: BBB Great West + Pacific

To:

Subject: =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

Date: Wed, 03 Jun 2026 20:47:14 +0100

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="f147dd5acfb15e9f078cfe2a00041590"

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - pass11.dizinc.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - j-peters.com

X-Get-Message-Sender-Via: pass11.dizinc.com: authenticated_id: info@j-peters.com

X-Authenticated-Sender: pass11.dizinc.com: info@j-peters.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 11.4

X-Spam_score_int: 114

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: MAIN 600px CONTAINER --> LOGO / HEADER

-->

Content analysis details: (11.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[83.143.144.26 listed in will-spam-for-food.eu.org]

[83.143.144.26 listed in will-spam-for-food.eu.org]

[83.143.144.26 listed in will-spam-for-food.eu.org]

[83.143.144.26 listed in will-spam-for-food.eu.org]

[83.143.144.26 listed in will-spam-for-food.eu.org]

[83.143.144.26 listed in will-spam-for-food.eu.org]

[83.143.144.26 listed in will-spam-for-food.eu.org]

[83.143.144.26 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[72.29.75.247 listed in dnsbl.ahbl.org]

[72.29.75.247 listed in dnsbl.ahbl.org]

[72.29.75.247 listed in dnsbl.ahbl.org]

[72.29.75.247 listed in dnsbl.ahbl.org]

[72.29.89.7 listed in dnsbl.ahbl.org]

[72.29.89.7 listed in dnsbl.ahbl.org]

[72.29.89.7 listed in dnsbl.ahbl.org]

[72.29.89.7 listed in dnsbl.ahbl.org]

[83.143.144.26 listed in dnsbl.ahbl.org]

[83.143.144.26 listed in dnsbl.ahbl.org]

[83.143.144.26 listed in dnsbl.ahbl.org]

[83.143.144.26 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[72.29.75.247 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[72.29.75.247 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[72.29.75.247 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[72.29.75.247 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[83.143.144.26 listed in sbl-xbl.spamhaus.org]

[83.143.144.26 listed in sbl-xbl.spamhaus.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[83.143.144.26 listed in zen.spamhaus.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[72.29.89.7 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[72.29.89.7 listed in bl.score.senderscore.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.6 J_CHICKENPOX_22 BODY: 2alpha-pock-2alpha

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

Subject: {SPAM?} =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

BBB Complaints phish Part 1

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:52:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvNE-00000000GvL-3OwR

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:51:48 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:51:48 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wm4-131.speedhosting.co.kr ([111.92.189.131]:35644)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUqNV-00000000OqY-03fD

for doctor@nk.ca;

Wed, 03 Jun 2026 12:31:54 -0600

X-AuthUser: kschoi@hanulit.co.kr

Received: from WYWUFTKV ([62.42.154.199]:55843)

by wm4-131.speedhosting.co.kr with [XMail 1.27 Inames120228 ESMTP Server]

id for from ;

Thu, 4 Jun 2026 03:30:38 +0900

Message-ID:

From: BBB Great West + Pacific

To:

Subject: =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

Date: Wed, 03 Jun 2026 19:30:33 +0100

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="cde5c482645115291312cfd40003efb0"

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: MAIN 600.0px CONTAINER --> LOGO / HEADER

--> CARD 1: HEADLINE / INTRO -->BBB Great West + Pacific sent you

a message about Complaint Received: ID 27621257 NEW CARD: B [...]

Content analysis details: (10.9 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[111.92.189.131 listed in dnsbl.ahbl.org]

[111.92.189.131 listed in dnsbl.ahbl.org]

[111.92.189.131 listed in dnsbl.ahbl.org]

[111.92.189.131 listed in dnsbl.ahbl.org]

[62.42.154.199 listed in dnsbl.ahbl.org]

[62.42.154.199 listed in dnsbl.ahbl.org]

[62.42.154.199 listed in dnsbl.ahbl.org]

[62.42.154.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[111.92.189.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[111.92.189.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[111.92.189.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[111.92.189.131 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[62.42.154.199 listed in will-spam-for-food.eu.org]

[62.42.154.199 listed in will-spam-for-food.eu.org]

[62.42.154.199 listed in will-spam-for-food.eu.org]

[62.42.154.199 listed in will-spam-for-food.eu.org]

[62.42.154.199 listed in will-spam-for-food.eu.org]

[62.42.154.199 listed in will-spam-for-food.eu.org]

[62.42.154.199 listed in will-spam-for-food.eu.org]

[62.42.154.199 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[62.42.154.199 listed in sbl-xbl.spamhaus.org]

[62.42.154.199 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[62.42.154.199 listed in zen.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[111.92.189.131 listed in bl.score.senderscore.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.6 J_CHICKENPOX_22 BODY: 2alpha-pock-2alpha

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

Subject: {SPAM?} =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

BBB Complaints phish Part 2

Posted by Dave Yadallee on Thursday, June 4. 2026

BBB LOGO

BBB Great West + Pacific sent you a message about

Complaint Received: ID 27621257

TH!NK

Address:

500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920

Phone: (808) 224-6694

Website:https://think-training.com

Email: doctor@nk.ca

Local BBB: BBB Great West + Pacific

BBB File Opened: 3/7/2014

Years in Business: 23

Business Started: 1/6/2003

Category: Management Consultant

⚠ This business is NOT BBB Accredited.

Respond Within 10 Days

Your BBB received a complaint about your business. The complaint was submitted on May 8, 2026 and assigned ID 27621257. Although BBB makes no judgment on validity, we recognize there are two sides to every dispute. We request your good faith effort to resolve it outside the legal system.

⚠ PAY ATTENTION! Nature of complaint: Unsatisfactory product/service quality and delayed delivery! Requested resolution: Full refund plus written apology. The complainant submitted all known details about TH!NK and referenced the email address doctor@nk.ca. Please respond promptly to resolve this matter.

Respond to this Complaint

Please understand that the consumer’s complaint and your response may be publicly posted on the BBB web site (BBB reserves the right to not post in accordance with BBB policy). By submitting your response, you are representing that it is a truthful account of your experience with this consumer. BBB may edit the complaint or your response to protect privacy rights and to remove inappropriate language.

Key Details

Complaint ID: 27621257

Submitted: May 8, 2026

Access Code: 27621257-3D67D

Complainant: click to reveal

Category: Product Quality & Delivery

Business: TH!NK

If you received this complaint via Postal Mail, you may respond online using the link below or respond by mail using the address above.

To access/respond to this complaint online:

Go to:respond-bbb-org/letter/

Enter the following code: 27621257-3D67D

Sender Details

Service Representative - (609) 588-0808 Ext: 11 - complaints@bbb.org

BBB Great West + Pacific

Facebook

Instagram

LinkedIn

Twitter

YouTube

Better Business Bureau® | BBB.org

© 2026, International Association of Better Business Bureaus, Inc., separately incorporated Better Business Bureau organizations in the US and Canada, and BBB Institute for Marketplace Trust, Inc. All rights reserved.

Unsubscribe | Privacy | Log In

BBB Complaints phish Part 2

Posted by Dave Yadallee on Thursday, June 4. 2026

BBB LOGO

BBB Great West + Pacific sent you a message about

Complaint Received: ID 27621257

TH!NK

Address:

500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920

Phone: (808) 224-6694

Website: https://think-training.com

Email: doctor@nk.ca

Local BBB: BBB Great West + Pacific

BBB File Opened: 3/7/2014

Years in Business: 23

Business Started: 1/6/2003

Category: Management Consultant

⚠ This business is NOT BBB Accredited.

Respond Within 10 Days

Your BBB received a complaint about your business. The complaint was submitted on May 8, 2026 and assigned ID 27621257. Although BBB makes no judgment on validity, we recognize there are two sides to every dispute. We request your good faith effort to resolve it outside the legal system.

⚠ PAY ATTENTION! Nature of complaint: Unsatisfactory product/service quality and delayed delivery! Requested resolution: Full refund plus written apology. The complainant submitted all known details about TH!NK and referenced the email address doctor@nk.ca. Please respond promptly to resolve this matter.

Respond to this Complaint

Please understand that the consumer’s complaint and your response may be publicly posted on the BBB web site (BBB reserves the right to not post in accordance with BBB policy). By submitting your response, you are representing that it is a truthful account of your experience with this consumer. BBB may edit the complaint or your response to protect privacy rights and to remove inappropriate language.

Key Details

Complaint ID: 27621257

Submitted: May 8, 2026

Access Code: 27621257-3D67D

Complainant:𜝸click to reveal

Category: Product Quality & Delivery

Business: TH!NK

If you received this complaint via Postal Mail, you may respond online using the link below or respond by mail using the address above.

To access/respond to this complaint online:

Go to:respond-bbb-org/letter/

Enter the following code: 27621257-3D67D

Sender Details

Service Representative - (609) 588-0808 Ext: 11 - complaints@bbb.org

BBB Great West + Pacific

Facebook

Instagram

LinkedIn

Twitter

YouTube

Better Business Bureau® | BBB.org

© 2026, International Association of Better Business Bureaus, Inc., separately incorporated Better Business Bureau organizations in the US and Canada, and BBB Institute for Marketplace Trust, Inc. All rights reserved.

Unsubscribe | Privacy | Log In

BBB Complaints phish Part 1

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:52:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvN8-00000000GOZ-1hto

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:51:42 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:51:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from gamma.tagtech.ru ([83.166.99.196]:40515)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUq9o-00000000OAX-29DM

for doctor@nk.ca;

Wed, 03 Jun 2026 12:17:49 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rzhevsky.net; s=mail;

h=Content-Type:MIME-Version:Date:Subject:To:From:Message-ID; bh=gBPVGMku9zrpFVXjuMKd8RH5PhMFqMWAe9/Crv1GXrE=;

b=ZDc7p9LqCsSV3FsCnnjt0xRnk/L6X0aJVX7eUjyhm/PQOlfd34LKYI6PNfaB3DoufcCyqP22kOva+knrtxjIgZeDgr2BwQKmSRTyFUcV+fMN81M3ph62ToBdi/iTqoUnp0g2BiIwNAcWW32VlLgdYloMq98kaOuFnvER9iUUMOE=;

Received: from 84-216-123-141.customers.ownit.se ([84.216.123.141] helo=QLITFQJV)

by gamma.tagtech.ru with esmtpsa (UNKNOWN:AES256-GCM-SHA384:256)

(Exim 4.77)

(envelope-from )

id 1wUq91-0005Ma-JU

for doctor@nk.ca; Wed, 03 Jun 2026 21:16:48 +0300

Message-ID: <3998f58fe533c142d158ccb5359d4ca4@rzhevsky.net>

From: BBB Great West + Pacific

To:

Subject: =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

Date: Wed, 03 Jun 2026 19:16:42 +0100

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="dc378f2d9c91c5721b21a48400022a40"

X-User: 4682

X-Spam_score: 9.0

X-Spam_score_int: 90

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: BBB Great West + Pacific sent you a message about Complaint

Received: ID 27621257

Content analysis details: (9.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[83.166.99.196 listed in dnsbl.ahbl.org]

[83.166.99.196 listed in dnsbl.ahbl.org]

[83.166.99.196 listed in dnsbl.ahbl.org]

[83.166.99.196 listed in dnsbl.ahbl.org]

[84.216.123.141 listed in dnsbl.ahbl.org]

[84.216.123.141 listed in dnsbl.ahbl.org]

[84.216.123.141 listed in dnsbl.ahbl.org]

[84.216.123.141 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[83.166.99.196 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[83.166.99.196 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[83.166.99.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[83.166.99.196 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[84.216.123.141 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[84.216.123.141 listed in zen.spamhaus.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.6 J_CHICKENPOX_22 BODY: 2alpha-pock-2alpha

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[84.216.123.141 listed in will-spam-for-food.eu.org]

[84.216.123.141 listed in will-spam-for-food.eu.org]

[84.216.123.141 listed in will-spam-for-food.eu.org]

[84.216.123.141 listed in will-spam-for-food.eu.org]

[84.216.123.141 listed in will-spam-for-food.eu.org]

[84.216.123.141 listed in will-spam-for-food.eu.org]

[84.216.123.141 listed in will-spam-for-food.eu.org]

[84.216.123.141 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[83.166.99.196 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[83.166.99.196 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

Subject: {SPAM?} =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	June '26					Forward →
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30