Dragonfly phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Aug 2026 14:23:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzK8u-00000000P7B-1GAX

for dave@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 14:22:40 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Aug 2026 14:22:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zmail.eplanetglobal.com ([66.219.96.109]:44370)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzIzM-00000000Ech-33HE

for sales@nk.ca;

Wed, 26 Aug 2026 13:09:02 -0600

Received: from localhost (localhost [127.0.0.1])

by zmail.eplanetglobal.com (Postfix) with ESMTP id 03C087C8727

for ; Wed, 26 Aug 2026 15:04:51 -0400 (EDT)

Received: from zmail.eplanetglobal.com ([127.0.0.1])

by localhost (zmail.eplanetglobal.com [127.0.0.1]) (amavis, port 10032)

with ESMTP id HAfgDFv2mAvg for ;

Wed, 26 Aug 2026 15:04:50 -0400 (EDT)

Received: from localhost (localhost [127.0.0.1])

by zmail.eplanetglobal.com (Postfix) with ESMTP id 74A5E7C8322

for ; Wed, 26 Aug 2026 15:04:50 -0400 (EDT)

DKIM-Filter: OpenDKIM Filter v2.10.3 zmail.eplanetglobal.com 74A5E7C8322

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=eplanetglobal.com;

s=5A63B480-AE9A-11EF-B85C-7A3477DD596D; t=1787771090;

bh=LfZj7rc3TmHGvNxFzFRUld6qJTeDDYsBdOHrEbuhyds=;

h=From:To:Message-ID:Date:MIME-Version;

b=pkaYG+AP2OT8duH/C0FC/U2Ru8j3Al8its2rj6cHqHLpYpBROYUiT5gkyxAckc/3V

OnzpIwAJIjSdKuNxJkxU3XbfVelXABzbOUNpss+bzTiErkJ44nEE53kjCyYFHN4b/X

wSDvbUitcMgxwVvTySKJ8uB2uCoNgsw2TLPUE9YOSpudipVAxaSp3Q0PYDSH111TSh

p4Cm6kUxVtsjHQXDMSjDOo7crzRU0BVIzN0IJXUwwqUg028fkgkzyXwBhz8OP6lUkw

dmIeD0BSQ9MO1bzF9hmGla4GzOGcXHRDcs0EJL/hYgYeJTLKhFjykOkLQn1VcZsaUs

qY12A4IotkV2w==

X-Virus-Scanned: amavis at zmail.eplanetglobal.com

Received: from zmail.eplanetglobal.com ([127.0.0.1])

by localhost (zmail.eplanetglobal.com [127.0.0.1]) (amavis, port 10026)

with ESMTP id GCc35JV94udb for ;

Wed, 26 Aug 2026 15:04:50 -0400 (EDT)

Received: from [127.0.0.1] (unknown [196.74.228.253])

by zmail.eplanetglobal.com (Postfix) with ESMTPSA id 205607564A1

for ; Wed, 26 Aug 2026 15:04:49 -0400 (EDT)

Content-Type: text/html

From: Dragonfly

To: sales@nk.ca

Subject: Dragonfly Delivery Notification

Message-ID: <7f5ec407-0bb0-f21a-8c32-8934f1f65af2@eplanetglobal.com>

Content-Transfer-Encoding: quoted-printable

Date: Wed, 26 Aug 2026 19:04:37 +0000

MIME-Version: 1.0

X-Spam_score: 7.5

X-Spam_score_int: 75

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dragonfly Express. Dear Customer,



Content analysis details: (7.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[66.219.96.109 listed in wl.mailspike.net]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[66.219.96.109 listed in bb.barracudacentral.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[196.74.228.253 listed in will-spam-for-food.eu.org]

[196.74.228.253 listed in will-spam-for-food.eu.org]

[196.74.228.253 listed in will-spam-for-food.eu.org]

[196.74.228.253 listed in will-spam-for-food.eu.org]

[196.74.228.253 listed in will-spam-for-food.eu.org]

[196.74.228.253 listed in will-spam-for-food.eu.org]

[196.74.228.253 listed in will-spam-for-food.eu.org]

[196.74.228.253 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[196.74.228.253 listed in dnsbl.ahbl.org]

[196.74.228.253 listed in dnsbl.ahbl.org]

[196.74.228.253 listed in dnsbl.ahbl.org]

[196.74.228.253 listed in dnsbl.ahbl.org]

[66.219.96.109 listed in dnsbl.ahbl.org]

[66.219.96.109 listed in dnsbl.ahbl.org]

[66.219.96.109 listed in dnsbl.ahbl.org]

[66.219.96.109 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[196.74.228.253 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[196.74.228.253 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[196.74.228.253 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[196.74.228.253 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: dragonfly-express.duckdns.org/31.207.34.211]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: dragonfly-express.duckdns.org/31.207.34.211]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[66.219.96.109 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

Subject: {SPAM?} Dragonfly Delivery Notification














hidden; MAX-WIDTH: 600px; BACKGROUND: #fff; MARGIN: 20px auto; =

border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">


align-items: center; justify-content: center">


30px; FONT-WEIGHT: bold; COLOR: #fff; FONT-STYLE: italic">Dragonfly Express=

.







PADDING-TOP: 24px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">


DISPLAY: inline-block; PADDING-RIGHT: 6px">Dear Customer,

 






1.6">

Goods imported into Canada may be subject to applicable duties =

and/or taxes. Carriers are authorized by the. to process occasional =

shipments on behalf of the importer or owner and may remit applicable =

duties and taxes.





However, a parcel belonging to you has been held =

by customs due to missing declaration details from the sender. Please pay: =

4.95 CAD





in duties and taxes as soon as =

possible using the button below: taxes, or other charges are actually owed.=








href=3D"https://dragonfly-express.duckdns.org/Dragonfly_Shipping/" =

style=3D"FONT-SIZE: 14px; TEXT-DECORATION: none; BACKGROUND: #04ab94; =

FONT-WEIGHT: bold; COLOR: #fff; PADDING-BOTTOM: 10px; PADDING-TOP: 10px; =

PADDING-LEFT: 20px; DISPLAY: inline-block; PADDING-RIGHT: 20px; =

border-radius: 5px">Track my package






COLOR: #000">Thank you for choosing Dragonfly Express.










COLOR: #717171; PADDING-BOTTOM: 20px; TEXT-ALIGN: center; PADDING-TOP: =

20px; PADDING-LEFT: 20px; MARGIN: 0px auto; PADDING-RIGHT: 20px; =

border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">

This email was sent by an automated system=

. Please do not reply official:





© 2026 =

Intelcom Express - Dragonfly Express. All rights reserved.











Web/SEO/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Aug 2026 14:22:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzK8D-00000000OuY-3CPX

for dave@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 14:21:57 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Aug 2026 14:21:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f200.google.com ([209.85.208.200]:54574)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzHSK-00000000Bje-2tix

for root@nk.ca;

Wed, 26 Aug 2026 11:30:42 -0600

Received: by mail-lj1-f200.google.com with SMTP id 38308e7fff4ca-39f72d86889sf3801531fa.1

for ; Wed, 26 Aug 2026 10:29:45 -0700 (PDT)

ARC-Seal: i=3; a=rsa-sha256; t=1787765378; cv=pass;

d=google.com; s=arc-20260327;

b=ItCj7bPwien5Xu8OHEY5XeDtHm9HpTo7KhxiZ+s4w2oFvr9RTgLjJdcU/VNehFRx9U

Q5aYX/XNE9zrerGbkV83erYXCyaneEITgXeDW6REvi7WuvHdLYeFgz+4SGL+Ge6PT92h

5U7p3bfXug/YAVVPDHX0VaRjxfml9SxpSJ/6J1vI8OmLJxTPwiofGRqdWu6XTrvE82uF

RfVJHo5yFqb45G0/yaOGcKeXp6p3nZqUUiG92tiNWr8EPcnuLKss71h1YL9nG7CuJtGI

XYw1tZlnRnmMyn1dKN/FqtPG8c1SuUN1YYxv4WREyQLaNnbpg9nlIkKEjMC7hjYc8zJX

7plQ==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:to:subject:message-id:date:from

:in-reply-to:references:mime-version:sender:dkim-signature;

bh=yFTTuB+Whtu0hdzlZA6kboA0ZBtBWK1h7Jnfi/UjQvA=;

fh=OYqZ3+rrMDY2aAJEHM/mAZ7bZUqRpd2G/oLfeAKhFI4=;

b=XvmWxdhenSmTaaKpsvGr0iVdmc3CT2qgH77vLcPsG+yDOxEFdhA776XljtonjX4UW/

fTjRJDFogqOuHwiKQfnpyKHymXQlDU668KChfJts5KgSoQ/dqntwwlkdQ3YvNqfS/izG

xnpy+JXkULV7k/grEIZrVZXP6azGOtWLmm9qmztOofiUMYubc8MENEO3pfqDwpYynmTz

ebM32kHo6QZQuin4QXDhmlNicAZpr7kqloeIEf/dranrnyzi3SCnha4Yj2MId3cSWrlX

zBUJ7xn9XL1L1P5YvaQguiBUIyOjC3+OCI4uo0MNkLKr9m/P2fPwsNkY31xgI7Zgx9pB

2dKg==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=ap3KAlFA;

arc=pass (i=1);

spf=pass (google.com: domain of anaya.singh3226@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=anaya.singh3226@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=rankbeacon.xyz; s=google; t=1787765378; x=1788370178; darn=nk.ca;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:x-original-authentication-results

:x-original-sender:content-type:to:subject:message-id:date:from

:in-reply-to:references:mime-version:sender:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=yFTTuB+Whtu0hdzlZA6kboA0ZBtBWK1h7Jnfi/UjQvA=;

b=PHAmo5wtpxDjJK89s803BRl+8Z6I/28YZ2qLXdFqpMZj4r9wx7lh7pEdYai37q+7rf

4T44sqBPfINpkVtr8pmXEt+ss3S8NZNYcTZy0+w7zDqrP19P386vz6yxxEuBsd3l+o1F

Vr+TLxAHLCBFrrTy8uejDfMHtVQ79+BJL5vrsbvl000ls9qpT4/eXfu5ojpEN9CreuRy

hJh+fBRg8g1/sRgjyZKL3C/YO+5BaC1X0nGP+hRBf7FvqvCtVRNg1r59Q2m+Vxazfp/m

LpYl8RUbVjRVVv37i2CycsOE/VUVjyKFvAqvejie/7wWp86r10gIngX+Hb6TLLXcJ/A8

nXFQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787765378; x=1788370178;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence

:x-original-authentication-results:x-original-sender:content-type:to

:subject:message-id:date:from:in-reply-to:references:mime-version

:x-gm-gg:x-beenthere:x-gm-message-state:sender:from:to:cc:subject

:date:message-id:reply-to:content-type;

bh=yFTTuB+Whtu0hdzlZA6kboA0ZBtBWK1h7Jnfi/UjQvA=;

b=fnAHP+RovCnAlpOxW+wgwGG67Tybvz8VnPTrQ1nVTu+J26RywjEDUA7wU7H1L4S4BU

vUQtdQ41fBL8IMvEHa5QvTMvdq9BeUubXwH1uv6F01XXA9L8TRRvARLff4DrxlsytAo1

V0S5K093+d68gpTiGpUJwCRjw5guD3i606yMG+0zRKUtuB+bgaUBrYn4qNf8q2IcXl1+

gq+lvnFcSlPVXfcm2B92dswVloPHZWshvZaBLFpREVlisAkyQ9JQYR3NyQSGes8x729q

8/WZm5XE6HJOBBKeBvi7s0ymE8exYTsUg3PoqJP9nDO42nUZj6b5In2GYRCYiTebtlJq

ps6g==

Sender: google_seo@rankbeacon.xyz

X-Forwarded-Encrypted: i=3; AHgh+RqIGpQAjVzcYsDyuESCjF73FIX/LkoIK0b4Aft2y4XE3S4926euWG0xKQ5VFa+8lIDDnz0G@nk.ca

X-Gm-Message-State: AFuF++lbiIYtK++BpuyCLQUDcPjAAKPbDpiE26KruetxZyX3J3UI8RTo

Nj+R90qCz84wJfPyK4YDssYQsmt+bigumfVK4hUQtgtlV1T6Y/uG4LYTk4QnVeEoB2s=

X-Received: by 2002:a05:651c:b2b:b0:39c:8124:93b3 with SMTP id 38308e7fff4ca-3a1fd625883mr21135911fa.9.1787765378200;

Wed, 26 Aug 2026 10:29:38 -0700 (PDT)

X-BeenThere: google_seo@rankbeacon.xyz; h="ATskLddte4rdGxl0TG25Y8bXOnVGCQpOlhHEYbi/yOVil3mP2A=="

Received: by 2002:a05:651c:4384:10b0:3a1:e61d:46c6 with SMTP id

38308e7fff4ca-3a1e61d4a0dls6788161fa.1.-pod-prod-06-eu; Wed, 26 Aug 2026

10:27:17 -0700 (PDT)

X-Received: by 2002:a2e:be27:0:b0:3a1:d468:f988 with SMTP id 38308e7fff4ca-3a1fd453e09mr20760611fa.1.1787765237167;

Wed, 26 Aug 2026 10:27:17 -0700 (PDT)

ARC-Seal: i=2; a=rsa-sha256; t=1787765237; cv=pass;

d=google.com; s=arc-20260327;

b=DbjhD1q+DkJAnkzWai+9NmX8VF1JZ+FLikJ81ucEXX/ZtdQCH0WgrRHoT8QA4pdQ7t

U6GYNpNhVQ1m1AJhXyRRfWju7TbsDKphx6tBUpZDZLnLW84EsX92uoqsTLmVF+05LWek

06B8YF8YFFhYHboCyCcwQLRHhjFbkIVsEKFuEcy3ioKaBna+PNRgc4x1OPi21tY+UVEC

DvBIw2F9JWjnh3A7RP2X+T7w+ifPBAfHDJTvTpLu+6BorTQMcKZ/tlKJmqGyolKA/bjd

ufqhzo7fUEZzyjumpU3BGujQy35tBbmDfMqjcgia0zr4NxXtNjjc24NAHlwoWX6pr69m

9QBA==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=5XMxGduRYt5NfI8LlM3FKwgWeJEAuv1iSPTf08LPrbc=;

fh=PWSUFaEq1CkbsfShP2jell5RPg3MDtCYx7KzhsUuaJc=;

b=hnI4fYznMWdJEzVaBvWWzAUwX7T3Ra/mcIBt3G5N/2v2a6q8oieVQdNZlcPZhaoRn8

MMHRHneoHoJHRUho8zwxh7/g2WYcJEPTXmJksMVaZVKITCDHzv1m2MnaOmddj79gKz46

B0he0CgQ94GkYOxOc2Njc6gD5n476Tng+61VEZCk0cQfN6ftbaBrLGK4SPHoJlQ1dzwN

BGnFp90YYkZRsWnZPqn/tvUn0d0Y4MmueMDk29tDYH8Iy4QBXT6lxe1Ahoun+OX1GQXg

eeXMdXQGf+LSUAvthYDmUAvZYL/vB9mZWx9zDdjwimF03485FznwbUJOfyaR+Sb5DEW+

hCqQ==;

dara=google.com

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=ap3KAlFA;

arc=pass (i=1);

spf=pass (google.com: domain of anaya.singh3226@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=anaya.singh3226@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65])

by mx.google.com with SMTPS id 38308e7fff4ca-3a1fd2723e2sor5027611fa.22.2026.08.26.10.27.17

for

(Google Transport Security);

Wed, 26 Aug 2026 10:27:17 -0700 (PDT)

Received-SPF: pass (google.com: domain of anaya.singh3226@gmail.com designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65;

ARC-Seal: i=1; a=rsa-sha256; t=1787765237; cv=none;

d=google.com; s=arc-20260327;

b=i6r+QdBdw6L/FDxJRM3BMF8I8ZVY2iMritxj8N7gwvS8QPCPIP1LvlNMQw8cqZQ5Zc

09EirzK/jEaoqzEgTYmj8eX3OhCmtFCVkaAVD8amfcIitzTu49rI2F/zR7EmR10GsJMJ

5vURIlMts9vs8A8urqr3umGWK91/aWIGWERxfpg0JdJfbUQ51ubmArqvrlI35jsyREGv

MchD3lRLvyZADL/6BS72QkM0e73WMu/qJlvzItDe6LfypcqK/AC3K6iqwnapl5+IAsxk

CpscPRqpzshGaywHNOA+KXeL78orR4UW7mr4y2bl/Hiacmv/SkTfva/QFflcE8PZXeVW

7iCg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=5XMxGduRYt5NfI8LlM3FKwgWeJEAuv1iSPTf08LPrbc=;

fh=PWSUFaEq1CkbsfShP2jell5RPg3MDtCYx7KzhsUuaJc=;

b=MFe4ud+at2vmyjlhuPzZB2Kfpofm597IS1ZKUEU6ZIoHPNVY5okVmMlTbD0J1F17zL

Tu7vlbVhr7rUSKQ+R7dR7Nc5k4yu3PxnjqJukMrdwhJFe8tLt1BZ9zaufqckkLvJ3FVT

9f09VrYgb8wH0Q2yGK9W3d4XLAJNAF1qmsx1vt5TK9swRmSxKv9YHu35ovmvo3vbDXai

0/2li7un2yhcCuzvgNaqSJGxBwai4d4FwcO/blz6OwcnrfEb7422EpwnO9h/+tdKcFkd

arFETHnBGY/8uMZUMV7LnHmTJWcvW6LxiCou9by85DaNgiPYQwcAQQ+DVIBONlyfJy6N

MAzA==;

darn=rankbeacon.xyz

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Gm-Gg: AR+sD1371+4PqjPj4qUvJ+yC8iKA8luwmF5xvc3wNb1bWMn0ZiYSQuy1nDlgyqfzmIu

ozSanMqyjqcUKTmK18/Sm3rD+3ju25SXhurZFfCLgnAjpc8m04i4nKrp5RZsX2y+R9/G0+51Uvw

kIANwNqdn6TaM5II1ytpc4698uDuhPy6gVbuWc+sicvZQNsuwvyiysHFFyeF8BWHkPBpk0v4vRd

6ZejwJJ9p2RY7ge9q0vnxi1zyehi8cSgwoUCBeVxou+r3GQqbiS8cUHNA6UC8aONg97gSKPkY12

Tkxk25PpruKkCz0E/XKf065pLQNVCjprRItfyxbOTw1aUZLR+k64pMw2aicUxJMAmgScn7ST087

U0U0QRU6me4LoozqqwSXiQbvxoco6l/qG4uHENr6pw7SMXqLOha/Qqpy8LQ==

X-Received: by 2002:a2e:a804:0:b0:3a1:4f33:f64b with SMTP id

38308e7fff4ca-3a1fd5d1319mr23808681fa.8.1787765236618; Wed, 26 Aug 2026

10:27:16 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Anaya Singh

Date: Wed, 26 Aug 2026 22:59:09 +0530

X-Gm-Features: AcwNN1Uzxzi6Ki9cyCfkO8rJvXl4pTh1ei3fivdi_9S-oZu_4ZufO7ksoWn3zpM

Message-ID:

Subject: Re: Few improvements for your website !!!

To: google_seo@rankbeacon.xyz

Content-Type: multipart/alternative; boundary="000000000000dedd330659f6879c"

X-Original-Sender: anaya.singh3226@gmail.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@gmail.com header.s=20251104 header.b=ap3KAlFA; arc=pass

(i=1); spf=pass (google.com: domain of anaya.singh3226@gmail.com

designates 209.85.220.65 as permitted sender) smtp.mailfrom=anaya.singh3226@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

Precedence: list

Mailing-list: list google_seo@rankbeacon.xyz; contact google_seo+owners@rankbeacon.xyz

List-ID:

X-Spam-Checked-In-Group: google_seo@rankbeacon.xyz

X-Google-Group-Id: 1054195051699

List-Post: ,

List-Help: ,



List-Archive:

List-Subscribe: ,



List-Unsubscribe: ,



X-Spam_score: 8.0

X-Spam_score_int: 80

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Just following up on my last email regarding a few website

improvements that could help increase your traffic, leads, and conversions.

I still have the quick snapshot ready for you. Reply *“OK – SEND”

and I’ll share it over.



Content analysis details: (8.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.208.200 listed in will-spam-for-food.eu.org]

[209.85.208.200 listed in will-spam-for-food.eu.org]

[209.85.208.200 listed in will-spam-for-food.eu.org]

[209.85.208.200 listed in will-spam-for-food.eu.org]

[209.85.208.200 listed in will-spam-for-food.eu.org]

[209.85.208.200 listed in will-spam-for-food.eu.org]

[209.85.208.200 listed in will-spam-for-food.eu.org]

[209.85.208.200 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.208.200 listed in dnsbl.ahbl.org]

[209.85.208.200 listed in dnsbl.ahbl.org]

[209.85.208.200 listed in dnsbl.ahbl.org]

[209.85.208.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.220.65 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.220.65 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.220.65 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.220.65 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.200 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: rankbeacon.xyz]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[anaya.singh3226(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: rankbeacon.xyz (xyz)]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: rankbeacon.xyz]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.200 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.200 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 BULK_RE_SUSP_NTLD Precedence bulk and RE: from a suspicious TLD

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

Subject: {SPAM?} Re: Few improvements for your website !!!



--000000000000dedd330659f6879c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Just following up on my last email regarding a few website improvements

that could help increase your traffic, leads, and conversions.



I still have the quick snapshot ready for you.



Reply =E2=80=9COK =E2=80=93 SEND=E2=80=9D *and I=E2=80=99ll share it over.



Thanks,



On Sat, 25 Jul 2026 at 21:59, Anaya Singh wrote=

:



> Hi,

>

> Many local businesses are missing opportunities because they're not

> visible enough online.

>

> We help businesses generate more calls, inquiries, and customers through

> Google.

>

> Reply "Sure" and let's connect.

>

> Thanks,

>



To unsubscribe from this group and stop receiving emails from it, send an e=

mail to google_seo+unsubscribe@rankbeacon.xyz.



--000000000000dedd330659f6879c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Just following up on my last email regarding a=C2=A0=

few website improvements that could help increase your traffic, leads, and =

conversions.

I still have the=C2=A0quick snapshot ready for yo=

u.

Reply=C2=A0=E2=80=9COK =E2=80=93 SEND=E2=80=9D=C2=A0and=

I=E2=80=99ll share it over.

Thanks,



=3D"gmail_quote gmail_quote_container">

">On Sat, 25 Jul 2026 at 21:59, Anaya Singh <
gh3226@gmail.com">anaya.singh3226@gmail.com> wrote:

uote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1p=

x solid rgb(204,204,204);padding-left:1ex">
Hi,

Many=

local businesses are missing opportunities because they're not visible=

enough online.

We help businesses generate more calls, inquiries, a=

nd customers through Google.

Reply "Sure" and let's co=

nnect.

Thanks,










To unsubscribe from this group and stop receiving emails from it, send an e=

mail to google_seo=

+unsubscribe@rankbeacon.xyz.




--000000000000dedd330659f6879c--

Canadian Bread Court Information phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Aug 2026 14:22:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzK7e-00000000Og3-0CpU

for dave@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 14:21:22 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Aug 2026 14:21:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server57.dsbsv.net ([219.99.172.143]:36388)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzGmC-00000000Jge-0Zs7

for root@nl2k.ab.ca;

Wed, 26 Aug 2026 10:47:08 -0600

Received: from EC2AMAZ-OKAMBSG (ec2-16-174-119-216.ca-west-1.compute.amazonaws.com [16.174.119.216])

by server57.dsbsv.net (Postfix) with ESMTPA id 83575456A7A

for ; Thu, 27 Aug 2026 01:46:03 +0900 (JST)

MIME-Version: 1.0

From: "Canadian Bread Court Information"

To: root@nl2k.ab.ca

Date: 26 Aug 2026 16:46:03 +0000

Subject: =?utf-8?B?SW1wb3J0YW50IFNldHRsZW1lbnQgVGltZWxpbmUgSW5mb3Jt?=

=?utf-8?B?YXRpb24gOiBSZWYgTm/CuiA1MzMzMjMwNzMxIC8gOC8yNi8yMDI2IDQ6?=

=?utf-8?B?NDY6MDIgUE0=?=

Content-Type: multipart/alternative;

boundary=--boundary_4042_4519d45e-ffb5-43cd-be4d-6046e069123f







Settlement Information

Packaged Bread Class Actions



Information Notice

2026

Important Settlement Information

Loblaw/Weston

Packaged Bread Class Actions



Version française suit plus bas.

Recipient Information

You are receiving this email because you were identified as having claimed a $100 to $200 Loblaw Card from the Packaged Bread Loblaw Card Program and/or as having registered with the lawyers handling this class action.

Legal Notice

Authorized by the Superior Court of Justice for Ontario

01



Nature of the Proceedings

Class actions have been certified/authorized by the Ontario Superior Court of Justice and the Superior Court of Quebec on behalf of individuals and businesses resident in Canada who purchased Packaged Bread alleging certain manufacturers and retailers engaged in anticompetitive conduct resulting in overcharges for Packaged Bread sold in Canada.

The Courts have not yet made any decision on the merits of the claims or the defences in either of the actions.

National Settlement

$500 Million

$96 million already paid

02



Settlement Terms

The Plaintiffs in the actions have entered into a national settlement with Loblaw/Weston for $500 million and their cooperation in pursuing claims against non-settling defendants in the continuing actions.

If the settlement is approved by the Courts in both actions, the net settlement funds, after approved fees and expenses, will be distributed to and for the benefit of Settlement Class Members in accordance with the applicable distribution protocol.

03



Settlement Class Eligibility

If you are resident anywhere in Canada except Quebec and purchased Packaged Bread between January 1, 2008 and December 31, 2025, inclusive, and wish to participate in the Loblaw/Weston Settlement, please review the official settlement information and eligibility requirements.

Review Official Information

Please review the official settlement materials, eligibility requirements and applicable deadlines.

Apply Now Appliquez

Before submitting any information

Verify the settlement administrator, court notice, claim deadline and official website before providing personal or financial information.

This communication contains settlement information. Please consult the official settlement materials for the authoritative terms, eligibility requirements and deadlines.



https://www.canadianbreadsettlement.ca/ | Unsubscribe

```









GuardianForge Max from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Aug 2026 08:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzEvl-00000000HQC-08yi

for dave@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 08:48:45 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Aug 2026 08:48:44 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f176.google.com ([209.85.214.176]:48615)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzEl4-000000001uY-04dZ

for doctor@nl2k.ab.ca;

Wed, 26 Aug 2026 08:37:52 -0600

Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2d032846c95so14670175ad.1

for ; Wed, 26 Aug 2026 07:36:55 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787755009; x=1788359809; darn=nl2k.ab.ca;

h=priority:importance:subject:from:to:mime-version:content-type:date

:message-id:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=QmOdDLGnALDAcaWivtRD8q333qMSK0AKSEeZdjL8tkE=;

b=A4O1dD3/gUTr4LYWLL+3w0ViN9kIKuzI0Wu9g2uZ5Ui7iUOibEy4/+eYmcndHiQeUM

D9o0hB7XkDBMRJFzyd/t6Srz0yf5oXM+IfhFHxbcwjTy3vXNUpbTRrz/pdUqDD07wYak

vgqKp2fIl/m+5KcN0S2c8c7oALF2nrO21Y2CkDG9x1h7QVuG2IEIvJ/BdyJvGWkxZJvl

jwdZR2ikHkf05Kx9exBz7ZDLSudCBqG+ifxBqRztJ1YmXo9q7cTV47oEqbCCcqSNypU0

dOijtD9OVlwJ2HkXM1UrAkhGKuBEylTXCLhq11ySqK+tAJMG1FttH9wQclGY31NcO35j

2fwA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787755009; x=1788359809;

h=priority:importance:subject:from:to:mime-version:content-type:date

:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=QmOdDLGnALDAcaWivtRD8q333qMSK0AKSEeZdjL8tkE=;

b=jPvwAGKkwFDFBCVzGots1eZ2uhE2zYlAXfFIWXj9vVrN4Bt6gX0WyHLHV7ip9ef6yL

u0ULPob6cK7EFT2XvOVZVieRC+dYepljeTEcumMyBYcjyhnachKsF+Yw3zVTe0GjdPIp

0cU7CwCY3BNsxt7xelwdjlIWlLyeqHfcjigxfnMgbiUxcHShKIeivnGBhYPLiPmKdLbt

1uRfCLj30vSlfMIaGxS2Q+EeqhX9wOlHxWpVflEPm/Mo+N2UrVj2kpYh+ru4VfEtXoAa

V/aaEE6pP3qOEpTCI9OMxo6gippEfQxPGcfW794hzHgpY+J+HyurPTqU54euwCOqEUXU

3mGg==

X-Gm-Message-State: AFuF++lKQxKAzVQrEFbK6NTkIy6LGWACwCa0wnm4z6/XqcWOOX1kaJDn

+abWVMulXipQP+SJDKCaCNB4zPvf1WfGc6uy2t2sJD0gL0Ybivvfwfmsf/hPCV6Xq1A=

X-Gm-Gg: AR+sD12iHEQJXdRsBX7P94aSUiJljgyDkjBm5G+/03D/PGwY5VxioQrzfCyPd289lNr

93g+V9a9RU0JVjYRCn2yI9dNCDhONZgmB6ebv8LS0PNF9he/7iisl2Bj0CPw61iQKG8qkGPwNeD

5KxfBnG5Im9JZNnovblOTlnUwMYVF/gPq1dXUtHjLSd88GKrjyG4TQb5AWXfvUkzVX2MaFX6xLZ

146TyFvjXMsAYZEXxujuP0w/dgktVUzRzXTas/tgDc3HUIfRgiKTQO1kRMWem9R3/tVJU1mSHRT

CLqlFITyMx4jgzyABX1Mb/Jh2RpdVoXKWRkYrMhYdHvEx/7/Hs0s9EyxUv7ynWDWOmD6pB4Ttrl

1+Gdqqssm2w3cN/iE2JZgNOM0U4g7GC/FeYxoZk7982oPZWhs7MRVWNZFuTf9+jXKoZHRaxROb4

wg3lKnuJ+40T5TH9toArGMpiuRyP7oRO39MYKrT3zyGHeaFTUYHrJhMAZiVwVWGUnU3MZFO0fS/

+0SFgwk7CO7DbtwssjI1Sd/

X-Received: by 2002:a17:903:2f8f:b0:2d6:fb95:59f0 with SMTP id d9443c01a7336-2d707a032a0mr118933405ad.3.1787755009257;

Wed, 26 Aug 2026 07:36:49 -0700 (PDT)

Received: from [172.19.0.209] ([124.156.164.190])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d704ba5c94sm8267495ad.51.2026.08.26.07.36.48

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 26 Aug 2026 07:36:49 -0700 (PDT)

Message-ID: <6a8efa01.c8f5739a.100a91.5572@mx.google.com>

Date: Wed, 26 Aug 2026 07:36:49 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============1041963238324326565=="

MIME-Version: 1.0

to: Doctor

from: Doctor

subject: Payment #8267282 Details Are Listed in Your Records

Importance: normal

Priority: normal

X-Spam_score: 6.5

X-Spam_score_int: 65

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Date: Wednesday, August 26, 2026 Hello Doctor, This communication

summarizes the renewal information currently associated with your Subscription

under reference Receipt 8267282. The details below are provided for your

account records.



Content analysis details: (6.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[124.156.164.190 listed in will-spam-for-food.eu.org]

[124.156.164.190 listed in will-spam-for-food.eu.org]

[124.156.164.190 listed in will-spam-for-food.eu.org]

[124.156.164.190 listed in will-spam-for-food.eu.org]

[124.156.164.190 listed in will-spam-for-food.eu.org]

[124.156.164.190 listed in will-spam-for-food.eu.org]

[124.156.164.190 listed in will-spam-for-food.eu.org]

[124.156.164.190 listed in will-spam-for-food.eu.org]

[209.85.214.176 listed in will-spam-for-food.eu.org]

[209.85.214.176 listed in will-spam-for-food.eu.org]

[209.85.214.176 listed in will-spam-for-food.eu.org]

[209.85.214.176 listed in will-spam-for-food.eu.org]

[209.85.214.176 listed in will-spam-for-food.eu.org]

[209.85.214.176 listed in will-spam-for-food.eu.org]

[209.85.214.176 listed in will-spam-for-food.eu.org]

[209.85.214.176 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.176 listed in dnsbl.ahbl.org]

[209.85.214.176 listed in dnsbl.ahbl.org]

[209.85.214.176 listed in dnsbl.ahbl.org]

[209.85.214.176 listed in dnsbl.ahbl.org]

[124.156.164.190 listed in dnsbl.ahbl.org]

[124.156.164.190 listed in dnsbl.ahbl.org]

[124.156.164.190 listed in dnsbl.ahbl.org]

[124.156.164.190 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.176 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.176 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.176 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.176 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.176 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[nathkaushik933(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[nathkaushik933(at)gmail.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in phishing

mails

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.176 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.214.176 listed in wl.mailspike.net]

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 T_MXG_LOWER_HDR_SPAM Lower case header spam

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Payment #8267282 Details Are Listed in Your Records



--===============1041963238324326565==

Content-Type: text/plain; charset="us-ascii"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Date: Wednesday, August 26, 2026



Hello Doctor,



This communication summarizes the renewal information currently associated with your Subscription under reference Receipt 8267282. The details below are provided for your account records.



Invoice Information Center

Renewal Record

Subscription Reference: GuardianForge Max-607447

Account Reference: RVM16800EK8596

Renewal Period: 3 Years

Renewal Amount: $240.15



Account Information



Your Subscription profile is associated with the registered email address doctor@nl2k.ab.ca. The information above corresponds to the upcoming Subscription renewal period currently recorded for the account.



For questions about your Subscription renewal, account records, or available services, please contact our customer support team at (840) 260-6526.



Communication Details



This message was generated automatically for account documentation and recordkeeping purposes. Replies to this mailbox are not monitored. For Subscription or account assistance, please contact our customer support team at (840) 260-6526.



Faithfully,

Subscription Account Services

Webroot, Powered By Intel

Nancy Ramirez

--===============1041963238324326565==--

Amazon Prime Phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Aug 2026 07:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzDUP-0000000006z-0osm

for dave@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 07:16:25 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Aug 2026 07:16:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f180.google.com ([209.85.222.180]:49179)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzCnc-0000000071J-1Enx

for root@nk.ca;

Wed, 26 Aug 2026 06:32:22 -0600

Received: by mail-qk1-f180.google.com with SMTP id af79cd13be357-92e99ef0902so44203685a.2

for ; Wed, 26 Aug 2026 05:31:25 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=abx38-hamburg1-biz-id.20251104.gappssmtp.com; s=20251104; t=1787747479; x=1788352279; darn=nk.ca;

h=content-transfer-encoding:content-type:mime-version:message-id

:subject:to:date:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=siv5zOwqacF9NCL9VXzoCQVZAa52HdC/oz/nyCNGO/Q=;

b=DhFgjWcQ+NUtz51rvAum2Zm0FCb+BSblf/l866DhjoFRl8BluUT153fyeJ+1VBwxvz

p6e7hK6BROXU9LEuDQ+we6gUjAGa/wKmNqIR16WQFbApBcY4ptKctbLLIySX2q7mfm5T

lsv0ns3lreFmGMBO7H4DJChFRnymL6rof1rH29o6dUG44aTfhMjipddrIu3Qw/2L5bOU

rStygyp3FOy6IHWdL2noT8p/Hvf0GeWpodWmywlkNR8r5Gwa02Gjvz5lTTupXcFki1aQ

97rucwYHV+ByUDf0w714HFWj34e19mRYznbw7M1JbAEGpUAvg/CvrJHHKea0ZHx37DEP

qKcg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787747479; x=1788352279;

h=content-transfer-encoding:content-type:mime-version:message-id

:subject:to:date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject

:date:message-id:reply-to:content-type;

bh=siv5zOwqacF9NCL9VXzoCQVZAa52HdC/oz/nyCNGO/Q=;

b=fC8u7Fg7Sk3vfo3oNIkVyyScSoPjuiHBHHW1xoP1cyjc6jpM+FiKVO6Pj3MV2ei47x

W/dvX2piYDP20AlsEfk4su2jb1neKGry6pElj/pPkzqZiN2UvKVlINW0Cc3tI4rb9uIC

8khIeHbDgelg8BPqp9JTz9ia0bKSGDESnXgV0AOX9FLgYxd4L7Md+PmxEH+XrHwlodHs

QqFK9k07tlKbClOtxKyNMOpifv76Pg+8XMDUbIJSf1NLONYm6yjxGHjQ9w0REyDUUJdk

8xShsFX7daEIk5c3lHwbvOSCfOIO9Z/4Z72sFCStUCDxNU2cnsOc60KAfzUJtaViEKcU

qtpQ==

X-Gm-Message-State: AFuF++ncqoc30CsbycdXB9bn+EC9Frpd3ocN9HUXHblX73P1c5HlWvTv

hsQ4yHOOy2JZdr/4NeMWGJDH2Dh9FX5nGQTNpNGrrWO6KUXZd6adf87mfd9QYv/Oq4RS/BaM9KS

UN/mUP+05tbY=

X-Gm-Gg: AR+sD10+9IHYyMp6BfPsxkA8a+O8KXZ4u2rCSSGmnl1L6WG/nytCKyvdVV27/S00XWS

GqDJg3FDr832bVRBwpyBrEKnx3EHyoMSOBmS7HOZFT6K+sPU+1/X72zsz77u2B4SCx7OdMTiQvc

OubfU1Y60KlMDXp6/QdYsMAyaHmSWN7m9Zm5tDh3/80Fn19OWMlfYs6DiBWlfi1hnV/BR6eAp2X

wAIWIr/pa8ACPYHDfb0SSzqD4RHjxS4la8wfo1XH0EHU+QwQ/S2DHWd8c/6Vu93rN3QQ44oHoEh

emTJdK5f1vn3FTxs7udu3BEygSV/7GhVUzGHZwB7kAhmS/YVoN9rqAXenu8Yt/p4+mtNaTfOzf0

pj1aOa8vMETOGT4Y+VgBNWdwySWekh5TR6NmLl6Q4zNTihWZIfoUmUGdDcBVniFFpL+muPc7/IZ

vhYytnsskVN/6GTWdVKg+XdiY5qdCInw1Gw+KWVFrYSFKvXg66J2x1M+XLPqsAmt4kK4Kj1PWuE

Xee5Op7BgqGUAuwMikoRJfhnT56YkUGf8ebJNC6aA5SnWHhbYlNZUl6QHCBVL79HD5r

X-Received: by 2002:a05:620a:3bd0:b0:936:a407:98bb with SMTP id af79cd13be357-937800f72b0mr431932585a.9.1787747478412;

Wed, 26 Aug 2026 05:31:18 -0700 (PDT)

Received: from mail-qv1-6443.google.com (ec2-50-16-9-101.compute-1.amazonaws.com. [50.16.9.101])

by smtp.gmail.com with ESMTPSA id af79cd13be357-9377e36955bsm200092685a.19.2026.08.26.05.31.17

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 26 Aug 2026 05:31:18 -0700 (PDT)

From: "=?UTF-8?Q?Prime Membership Notification?="

X-Google-Original-From: =?UTF-8?Q?Prime Membership Notification?=

Date: Wed, 26 Aug 2026 12:31:17 +0000

To: root@nk.ca

Subject: =?UTF-8?Q?Your Prime benefits are on hold due to a billing issue on Wed, August 26, 2026 12:31 PM?=

Message-ID:

X-Priority: 1

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 6.4

X-Spam_score_int: 64

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your Prime benefits are on hold due to a billing issue Hello,

We're unable to charge your payment method for $14.99 and any applicable

taxes for your next 1 month of Prime. Your Prime benefits are cu [...]



Content analysis details: (6.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[50.16.9.101 listed in will-spam-for-food.eu.org]

[50.16.9.101 listed in will-spam-for-food.eu.org]

[50.16.9.101 listed in will-spam-for-food.eu.org]

[50.16.9.101 listed in will-spam-for-food.eu.org]

[50.16.9.101 listed in will-spam-for-food.eu.org]

[50.16.9.101 listed in will-spam-for-food.eu.org]

[50.16.9.101 listed in will-spam-for-food.eu.org]

[50.16.9.101 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

[209.85.222.180 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

[209.85.222.180 listed in dnsbl.ahbl.org]

[209.85.222.180 listed in dnsbl.ahbl.org]

[209.85.222.180 listed in dnsbl.ahbl.org]

[50.16.9.101 listed in dnsbl.ahbl.org]

[50.16.9.101 listed in dnsbl.ahbl.org]

[50.16.9.101 listed in dnsbl.ahbl.org]

[50.16.9.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.180 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.180 listed in list.dnswl.org]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.0 BAD_ENC_HEADER Message has bad MIME encoding in the header

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.180 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.180 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

3.0 URI_GOOGDRAWPREVIEW_MINFP Link to image at Google Docs, probable

phishing

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

Subject: {SPAM?} =?UTF-8?Q?Your Prime benefits are on hold due to a billing issue on Wed, August 26, 2026 12:31 PM?=



=0A =0A =0A =0A =0A=

=0A
=0A
=0A
enter class=3D"x_wrapper" style=3D"">=0A
" border=3D"0" cellspacing=3D"0" width=3D"100%" class=3D"x_main-container" =

style=3D"width:100%; max-width:578px; min-width:343px">=0A =

=0A =0A =0A

578">=0A
n=3D"center" width=3D"100%" style=3D"margin:0 auto; width:100%; border-spac=

ing:0; font-family:sans-serif; color:#4a4a4a">=0A =

=0A =0A =0A =0A
>=0A
=0A =


=3D"border-radius:16px; font-family:CircularStd,Arial">=0A =

=0A =0A =

=0A =

=0A =0A =

=0A
tr>=0A =0A =

=0A =

=0A =0A =

=0A =0A =

=0A
=0A
" width=3D"100%" class=3D"x_logo-table" bgcolor=3D"#ffffff" style=3D"border=

-top-left-radius:16px; border-top-right-radius:16px; background-color:#fff"=

>=0A =0A =

=0A =

=0A =

=0A =0A =


tom:24px">
ORw0KGgoAAAANSUhEUgAAAGEAAAA2CAYAAADXjffsAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjw=

v8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAABYOSURBVHhe7VsJjF3Vef7u9tZ582azZ7yAMXhsZ=

mzAGEMgLGmpWVKWxEQgVYXSkKihaRWUqmojkSpRqrZq0lQKShBJUSXShYQGFShlc0gAE0MMBIgh=

xMb74HXGs89b7rtLv+/c9wwxMPYMDgyuf/u+e+9Z//Pv/zl3rJiA4/CBgl2/H4cPEI4zYQbAjDd=

HQq6BoW4WL1s/xxDMeCaUA+C+jSG++4qDiRBY3Q18/nSgmE4YcizAjDZHEo9d48C/vFTBthGgf7=

iGe14u4dl9b2rHsQAzmwm8qmGMgSiPUYp92fPQb+cQBJGpO1ZgRjPBIuHnFCxc3DGEruoBFINxn=

NVcwfL22jEVUcx4n0A3gGH6hV8PAKUa0NsBzM1EZNCxw4bpM4HUqTiAiwBuTCoFISIPmEAKI76H=

0AdaU0CTq2iGL3ENoZ03ZkTks6MAEZ9slsSWAyui8Wd9ieKvetIbhbDCX4KV5iycknUu0XXCUcA=

rcswqAtZVWZcjPjE7RtQeiyM7UY2OPI0DnJpoopAF0qxPo8IZM5zP51zClUNVKsimiHzWQd5QYw=

y+VUAq4px1XidzVIhXBqNEzidCmq+F68u5LLDY2AiGZtMgvPMWG3wmhykzQY3V44FtATbsdZENf=

CxdkMLCTuCn24B1jGQ2DwUkDtDZHGPlwgz+YAmwJEuiW67pL6TWvAGs5UV64bTZwFWnACPjEdbu=

rOG5PTUMoAm3fATozgE/2Aj0DUckgI32PHBdD80UGSx4Zi/wxDYSnVw/q8PHmYuajdY8RFye3wW=

MjlWQs0tY1Bpi9RmzcO4JwAE6+cdYt35rCRuHHURBgFxTHr+zwMcfnpZCd7aEqpVDmv4oJC2dKM=

TQRIBHdmXwk60+Ng3HKPk2xa2KWU0eVnancR3xX5iP4FkSF63TJnETHA/Hhakzga0DXjc9XsOj2=

zzkKSJz24FM2seWwRCVKEuJpXRRMrN0oFmnip7OKv720hYsLkgLIkQc5NYnQ9z5eooaAZzeNIYv=

XFzA954FNuzn+FyHlwHuuAL4SLGE6x8I8PJIMzgc5mer+N7qNE5rDlGLHfzzerZ7KTFbXbkAvbN=

cbN05jDfCFkphTGmewKDXBFownOyO4IyFRby6J0QfPX3NtqkXnIv4umEIxylh1bwM/n6VhxaGwF=

5ACaek/2rYw1eeqOGJAx7StRC+45j5ikGZq7HIqAxWtFfx1UvTODPPMptqRzBKFLMlNX0yqCvb1=

ECMdWueUbVqpoxNJWDbfhuFlIP5LSFOyAfIOD4mPBv7vCzWHSjiu08PYVA2hlIlPQ5IQKGWplnY=

VCrg1h+TAfsChCRWioi7bOaR2S7NmGfHxjxJ/S2apCKlXohnIjYmSOssyt4bFRePUbt22S0okg7=

NdOrVdBNylBqZqS1+EfdvBjaVHaSyNjrSMea6gREEi4QatQt4creHzdQUh/OCmtvHdf7DE2NYv9=

/hOAE8Ir20GOOj1N7O9iwZSWmJI7w84ODfn2OfmKaYOIlGBjuZqcPAtJgg1aESI0u7nqM5SnPGT=

/W6uPPSFO6+3MH3r3BxyzlE0hug1NN+knCP7yvgV4NJ54Ao+nZDOmJQuzFSpmQ5NcydBZw010Fv=

F9BGQlZRhI+8sc1aWI12PKAhCIiBZQiVLCIbsqU/gctm13D7KuBHV9bww48Df3mGD5fSbJEyDu8=

dto8vrQhx15U0c1fHuO1yF735CUOwbBhghO32EhebY9eI9yM0a2v7m+jrEv/1uTMdPHTJAP7n4j=

dw1+XAeR0lKktIC2Fh7XafmlU3ueyfkH9yLRBMnQmiBKHsRZzaJaOLIO1wySLgrDkhuosVLCtWc=

W1vCud3taNA0+ISq32Bi1f2qD+R5BgeTZIk3eG9me/XLKzg3tUpPPoJ4CdXl/CjKwIsL/hmQVQE=

cDqk4wqn5wPfzQLpCGX6pAmGMW4eF3V7+PiCEEs6ApzaBnxsYYoBQkBBoZax36y8hdU9DpYzylr=

SWsZ582imOjLGzGaCktkSocXhHJYxVY9uGDRBBOUd53RU8NnlnLZ1FsqF+ehqph9g35rloUyh6g=

9yfE6EVAYyubPgMDB1JiQjIxXQumvxdg2uExon5MheUB0VzXS5Ec4+kWaEgsBHc706EKFC6ZJsB=

LwzLqI6p43GLu2kc2930MLucHNUezLLoffVoji4iB7FaRKdhOcAKc4XUwjEYF1qF3H6DM2dFhUj=

y/IQtDpIkYtBPShwadjEfBpTvmXNOIUMO3PMstNkSJYnRwIra7TzxZE2jNtJ6+7OgoJAWR/Y5Qr=

W9QFP7wyN+dH6OjOhGc8AzZshbt1kTgam3dGCmIRtcF4OeHaLbRYtkkhiB8d9cxf5ZyTU0TLOlv=

eh8RBlou+wXBL+b6/FuOzuAOf9J3D+f3n484cDbK1QakjoglPB6tNcapyfaCkHk7DFB83uu8PRZ=

YJ+DA/0xLCR8yfynpQYHs1AkLM3d/ObgPCtSuxZ6FL0UyS0RbM0UqpibMJnEOAwEmSITm2bnynh=

prMyuH6petLRmwH0G/Ht8HBUmdCA2CzHBkN0E0Za/CcTUKRhlemQpM1EkK8SJNjTtFGIPAkTk1F=

p9vn0N5/5aB7X9KRw05IAt6wEvnVhDfetzuKvT69gnqeUjpGXGYRRAOFICHxUmNCQ9MaT1LFKSd=

i2awgB1UGlaUYLC2dnaJ4abY8cptp++pBwQdorI9KSTyHDJKJM3ySf0uWP4YtnAF+/EPjax1z8B=

ZnwiZ4M2otcI3OFmJGbiC+NSXCW/zu8LkybCdpyUMQSalLG7cMTwITPRVCF7WACPx+08dB2hnVs=

oygjl3awkmGnEzPGl7Ois5WTdqMklKsycXonkPOv0TEKHKq+IiUtSzba4lg1dmPyynb0Oyy3qHl=

MuxIicGxJt4ioAvOszIzPtl5M4kFTE5dNCKyQ1DGoWSjxvTPHLLy9ZpytEuG1fTU8vFXrDA3O0g=

6TjLFugIscF1JiJHFJzLDeE42YDDjV9MAlAkl4aGHUzeIbT5fx6cd8/NnTKfzpmjz+5qEQr5eLJ=

C7Vmu1XtIxhMUNG4RUzwnHFDL5GjCLk+HLROO9a2m+CQthsxGyQ/Xxb0VCIPON5mTeBMnPt8TTG=

S0cVOGHZPMdMpESMQjievHMMh4mLnoW7oRELNa+iu2xYM0zORFXkKc0ek4trzkihhVl3jXx83Wr=

DV58McPNjIb7xTIh/fM7GrT9zcPOjMW58MMJPN5fM1ooJw83Mgjqik4DwmRZI8iSlIpJEcF+Qxb=

N9KTzwGvDgjgo2+VRJSnwrCbQoN4LPnFfEHE8ZZb0/pVULrh2MHhTyvh0dI00kvNgjhmqXJdSGn=

+J+hsIaTnUlmgNtKPosq8uowU9EJjlRZZ3KUgdNBYFrkBAxyDZMqTkeShTcCsNmwyoSc9Vc4PdP=

oT/jIvPU8nKlijW7U/jOLx1850XgrleANTstvELNH6xyLo4jn6e5jhSmzQSpvNboUQJbwxJWn0p=

iN48xRBsl8krl08hygT0dIb50eRErO8mw+k6jJi1kXbTGE1zcCHIowSvkzALeBiReJmWjyDla6C=

BzdhXjKS3SZY4CNNNSdUQjaAsG0VEZRobpe81NGyIow9U2g0u/lLPKKFJLmolvlX2M8HA8tSt6P=

maFYyjGw+iMRsHci4xgbz60OFX81UV5fH6lg3lpagTnNbJCXGX+lDRo7JOKIU7oyJq1SaveaSnv=

BtPewPuTRyUBSVmO6nrbVXl0MwvdvpdXf4X2NcKSLgu9XRl0ULqYYpEkkn6dijkYYiCxY4wIsJ3=

v2OgpKNYW9g3NSCBi+y000BO0SFqZth6WFaokhCQ+xB5mgzvojzJyFKTAKUUmW2Y+AoOBgMnjVs=

4zYpImG20c4+Rmn/MqhpFmetjH2zYmZtq3aua1kGNkDaOSnV+xXN13EI8X9gMb98YYLvlIc57OJ=

gdL57jopqklDxiyUne1tU8/lsx4eJj+LuoaMmGHNCFCE8q4/YocLpqX8N/YW4LsNicgJpIZOUsF=

q5qODdhP5kfvzLeNjzHl5norKNpiP3XTG6ttLZLEkeJrTNUbyTZ9OY4RVb3r4jPrZD7N9rIpUb9=

kbtOEhcJBIOdvCqjFqkzaqUx6xR7qwkvYGmAziU0iZGybDEM4+HBYOBJGvSNISkSQGhdcpQPUJp=

1BiJdkTJdByHyfIoKJAYLkt2GWVKraBJV63W9AcshjhudlEDYMEIhAyTZI0kD3xpL0Un9mnWZLi=

CVImGHaGCSTMZJx+GvGSPon7VST4K/lUHHhNS6+myUaP2Ue6teRQ4LTFEFTpBmxyMnpWdvNqagh=

S8dhqjB1JpDS0uAxt5lRByVSLzrLZJSjx+MwdZi6T9DFnzs3ARt2VhlghPBcB587N43uQl2lj8O=

UYMpMEKiDxYRGe/hyihXqU3PE8MKk7R9eNph1NZ4YOJgn2Xrz1ACWG5LVyWb8R8Og1J266tkvGS=

/5nQymxQSBIkKzQ69IhQyJnSYTMXz4NUE7n9qCJ3BtNROiyu/pnXUkunYntFVnDqX4rMjaiyukp=

phBCkSMeRmsKEpM9o4agcQ7w7SZAEq+DrQ1RcpIDXnO6GByns9wqIe+9HDMsfmo7RI+9ZcdbB+p=

4eV9ETYMprFtzMYYmyowyTkhZucd9HS5WHkicHYrgxYJJ2khqti/DSaosZKaO14FzpsDrGhl9Gw=

xXNXpk+Zmi8b+/IcNRHyRyzbEd7E1SOG+DcDDzId2MuEbooDL4qR52ebTFotZe2J2sqzoyQ7g7h=

s6keXylfe8mWNMbh+mzgS21lntNfdWMTg6gauXtmD1EhsLC8yDOZcYoCE/jIxIUjIRxUefn8JXH=

q/imf4UsnaEPCvS2hK2SV6XeYdfNbvGe+kQK9QeN4pRtMt45rM585FZitl4TC0igUUUM/67wbTM=

kb6g+PUQ8LW1Adb2u1RH4LqTQtzYG6GzkNhQ22QwHzLQFxKWZxgxRqnfsNeHk0qhhQUe7VOKaiI=

fIG0PIgt9bHP3ixEe3lzGBPJmG+PVT7Md27uxApVsYjoOQ4rp+wSm931VB7etq+D+rQ7GIg9zsg=

FWL3PxyROAnuYKXE9fVkjBpZpK5ur5sYxlAzleyrzf8vr+QGPVZj9ECEkPeJkzBm1RJNsUaqi9L=

rXw6AOMs3YyLGEtGbF+N3D9/wYIqD2L2hzcf23abN3bZlwyi+OIApPBtJlgUOfPAeJ1H3OG29eX=

MVh1Tc7QkrZw9uwIV53qYOU8oI2hhUtKG7y4xpDW14m1sVEH7a6aESWD7xMb9BFaAyFzt5CcQiR=

OWUQWE1TjhCFGAwcPvQGs21TCinlZ3NDLcjZ/ZKeFm38M1Gijr+ux8M0LKHB2Y0um4Rcmh+lrgk=

GPF8OxCuOBx/eREc8Cm/b5GKdFjOkfilTvZS0BrlycxvIFNhY01dBKx2Hp2xTWSwMEDRbIfb1fm=

qDTPhFKUtqY00RDipCISWDl0U9zs3tcn7XQOW+hqRlmeyK7Yi5wz6Vsys7fejHAP73oIsMFfH0V=

cO2JJQROrr4WFipyPEzu9B7Mkb5Qo+Pho8s8QXu9W6pZ3MNo4gcbxjEYNxnCUogQEtn5FK/e5ir=

OPiHGysUZrKQfke1MAjmuVp/ImQOZyRE+ekBiK57X/MYEuSS8hzEivXEQeGpLhBd2V7Bl2Ea/n0=

E6GkHVSWNZq4UvX5jGubOAcXa74b/L+PlQFt3uOO74ZBN6CyXU7JzZXdYJoqVd2d8WE0Q6xcA6X=

NFS9P2osuiIZuap3Ta+vX4C64eazKfu+lI5ICeU1GSIUzauore9htNOasJymqtTCsAcGlJ9hMvA=

430Cn6G2g0HfwW6dbVDi19PcvLyzgs2DASasJpOU6RzBtgPMcwJct8jCjeek0ZHxYcceXhu0cM1=

9wDDX9EeLKvjyRRk0O4lwelEFIRO2Rt48Gbwnn5BIsSLhZBLzES0hpmTt4+Ke6gN++PwAnh9uoz=

Ojo+OKzFEH7ZDv2WRcgDz9QZFhRUvOwYk0V6d2eehu1ykdMJfBRYacqzHSktkwttrMwVWbzfJDg=

VjJxhnHmgiKMLPDMqU8jRHipe9Md4+S2JT2DXt1UAOMTLDbxAhKzAv0ratPydVRqlxFm1XFZQtC=

fOqsHE5nIlZkuY5lQzrib6+38HcbPHR5If7jygjL2pPtbPmSI/UHgvfgE94OGkgX8TRPE0RhP6X=

s4VcCPPi6j00TOZNpGuIQO/M5YsQUiYzQgX9M6RKxlYfnUUV73sWsgo2TW2toK2TJKAtNpL1OvV=

rZkDGANm8PLlSBQo08qnKOkh+hVKkxwXKwqeRigOK6e2gCB6oWRnwJBEnEjurjU2Ir+ohAg/BdF=

GlP+ebb08uXNuPCU4AOVkmAkqgJ2E+n8oUHK1g3ksGtK2r44+UeUhxvOsb0qDJB8qlLRPHMCZWc=

HJEmcbdTAtftAu7dUMYLg1mka4FZuDb/xBSprTRDRAmZfeu8WYhJGpUjJZqgP8KgAaR2iGnipEN=

KNnIh+R/TX8+6s5/Mianmu+46/Ne45AXDCfmzJLHUPo+UaBZGcckCi8QvmD9e6SDTE+3TQMmGpd=

jwxB4Lt6wBzm4p45u/R7zy+SQ05TVVOKpMAFVUp+QNRJPlJk+WogRONcyw6Rd9If51i4MdeyYwM=

GGZP2sSURU0iYBqr83BFH2HVLtCUyIC6pIpMM9y5IeCwmDd+GsuvticM2W+bdIBpGyJhEJj6G8e=

iCfbtFAlT2y2cMHcGi7p8bCUZif5sykRnoalzmXNKCI71N7vv2bhma1VfHFVExZndKaeoZCoxdR=

14egyoY6EBmzsmTQQl07IpiNMwsBxNGH/eIRf9gM/2+Pi6b4Y+2mrRRh90CWJ1nLkzKkv6klICC=

vtKDNSORRUnpArAeEhOPgVBwu0pSDp11cbS9pcXLDANXtgi4sxWplsKvbXVxbCO9k5DamZyRfWK=

tNQOofewbyhyIIMxV9ip5WabQrWTxWOKhNEaA0m02G+OKCDlAQKkq/V9EVcmr4CaOKrMG5sC4/T=

hr90wMYvdvjYSIO7u+zRdlsY82NUGXEFVBMFAMZssL3+oONQ0NeAqtOMNgnlkisOr4wXoZkGu82=

rYUELHf/8FH63i46fzr9ZTGEb7QCb7WlejralJdfyU3zS8a2ZleaowQhbWm/EhKkny03AwZk/cC=

a8dwipARbGqQqMEulE6QCpONrB7KeW7B8JMFyOMEqHu72WNzY/QZ9mhcScbZfRqlA366Ajn8LsI=

h0sw98TeJ9N2z6b0tGWEmNISvqjmQIziglSaIV2idawQLbHAN8plQEvSaJkLjEYCSRskCYm9lia=

IDNmDlTM8niZMw+NY+SY/99uzj4omFFMkII3CGpMSv1ZuzgJyJ0moLpDQXVvbZmwMMlmBI063Y1=

/miEws8yRtn9FIjpG41mEmaIT1R0CipLeBqR6o7hxTxhRH8pc0g5qkdkimRkwo5ggRETwBkIyLo=

p4GpRslOsuN30oaMu5QXTTynSQCVKS9eaftipoToLZmQEzzDH//4R3Mq3H4X0F4P8ABwZVfDU9S=

DoAAAAASUVORK5CYII=3D" height=3D"65" alt=3D"=0A Information regarding your=

payment from Amazon Prime=0A">
=0A

ffffff; text-align:center; padding-bottom:52px">=0A =


=3D"padding-top:32px; width:100%; border-top:1px solid #e5e5e5">
=0A=


>=0A =0A =

=0A =0A =

=0A =0A=

=0A =

=0A =

=0A
=0A =

=0A =

=0A =

=0A
id=3D"x_message_body" class=3D"x_email-content" align=3D"left" style=3D"fo=

nt-family:CircularStd,Arial; font-size:16px; line-height:1.5; letter-spacin=

g:0.2px; color:#171731; text-align:left">=0A =


ng-bottom:32px; font-size:18px; color:#00405D">=0A =

=0A =

=0A
d>=0A =0A =

=0A =

=0A =
=0A =


align=3D"left" style=3D"padding-bottom:12px; font-family:CircularStd,Arial=

; font-size:17px; font-weight:bold; line-height:1.67; letter-spacing:0.38px=

; color:#13126c; text-align:left; margin:0">Your Prime benefits are on hold=

due to a billing issue

=0A =


:12px; font-family:CircularStd,Arial; font-size:15px; font-weight:bold; lin=

e-height:1.67; letter-spacing:0.38px; color:#13126c; text-align:left; margi=

n:0">Hello,

=0A

ass=3D"x_email-paragraph" style=3D"margin-bottom:24px">We're unable to char=

ge your payment method for $14.99 and any applicable taxes for your next 1 =

month of Prime. Your Prime benefits are currently on hold.
=0A =

ss=3D"x_email-content" align=3D"left" style=3D"font-family:CircularStd,Aria=

l; font-size:16px; line-height:1.5; letter-spacing:0.2px; color:#171731; te=

xt-align:left">=0A

s=3D"x_email-paragraph" style=3D"margin-bottom:24px">If you don't update yo=

ur payment method in the next 6 days, your membership may be canceled. To r=

estore access to your benefits, please update your payment information.
iv>=0A
=0A =

=0A
resentation" align=3D"left" style=3D"width:100%; max-width:303px">=0A
>=0A =0A =0A=

=0A=0A =0A =


ogle.com/drawings/d/1Fkgnyp6b0pIF1z0QNUNO6VdXZ0kPuDSIok2Ii8Z2ce4/preview?Zt=

IPs" target=3D"_blank" rel=3D"noopener noreferrer" data-auth=3D"NotApplicab=

le" id=3D"x_bill_view_link" data-linkindex=3D"0">=0A

tn x_btn-primary" bgcolor=3D"#3667e9" style=3D"padding-top:10px; padding-bo=

ttom:10px; padding-left:30px; padding-right:30px; letter-spacing:0.8px; lin=

e-height:1; border-radius:12px; border-width:1px; border-color:transparent;=

font-family:CircularStd,Arial; font-size:14px; font-weight:bold; backgroun=

d-color:#FFD916; color:#000000">Update Information
=0A

=3D"x_message_body" class=3D"x_email-content" align=3D"left" style=3D"font-=

family:CircularStd,Arial; font-size:16px; line-height:2; letter-spacing:0.2=

px; color:#171731; text-align:left">=0A =



">Sincerly,
Amazon Prime Team=0A =

=0A =

yle=3D"font-family:CircularStd,Arial; font-size:16px; line-height:0.5; lett=

er-spacing:0.2px; color:#171731; text-align:left">=0A =


bottom:24px">
=0A =

=0A
=0A
tion" width=3D"100%" class=3D"x_responsive-padding-x" style=3D"background-c=

olor:#fafafa; padding-top:31px; padding-bottom:31px">=0A =

=0A =0A =

=0A =0A =

=0A

eft">=0A =0A =


om:16px; font-family:CircularStd,Arial; font-size:12px; line-height:24px; l=

etter-spacing:0.18px; color:#171731">=C2=A9 Amazon.com, Inc. or its affilia=

tes. All rights reserved. Amazon, Amazon.com, Prime, the Amazon.com logo an=

d 1-Click are registered trademarks of Amazon.com, Inc. or its affiliates. =

=0A

-help-link" style=3D"font-family:CircularStd,Arial; font-size:16px; font-we=

ight:500; line-height:19px; letter-spacing:0.6px; color:#171731">=0A =


rgin-top:16px; margin-bottom:8px; font-family:CircularStd,Arial; font-size:=

12px; font-weight:500; line-height:19px; letter-spacing:0.6px; color:#17173=

1"> Amazon.com, 410 Terry Avenue N., Seattle, WA 98109-5210.

=0A=0A =

=0A =

=0A =

=0A =

=0A =


=3D"table1footer2" style=3D"border-spacing:0">=0A =

=0A =0A

Nigerian spam from Mesagelabs

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Aug 2026 07:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzDTp-00000000ORo-40L7

for dave@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 07:15:49 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Aug 2026 07:15:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail1.bemta39.messagelabs.com ([195.245.231.2]:11010)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzAJ8-00000000PAn-3CWz

for sales@nk.ca;

Wed, 26 Aug 2026 03:52:43 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gasnatural.com;

s=security; t=1787737900; i=@gasnatural.com;

bh=nJDlol4Q/ZoO8QZ35L6OOZh22ZPL30JUQIX5nHWESdI=;

h=Content-Type:MIME-Version:Content-Transfer-Encoding:

Content-Description:Subject:To:From:Date:Message-ID;

b=Sk/AVA75zypGfqVXeBCBXkBQ/SwDQXFrspBMldyf81f/rLlL3FIIgznqGNN8luyEf

6oHJ7mcMPbhJ1JqmSsghGe57eeGzAoWS/U6w0igQoZHdgpMUbw4UyqKX7RzKV5NLJv

X1HpjgNU30A6mH3DPoNoeJhFK8yRzlWQdxj8yHY0nc//R09j4h29k5JgJHyNfkef5f

W3YkJ98KAckoG9UzfgaMKCtUyzKuy1cO8JXRxy+MfOOzrIHbo+UcBx7j2wj4TXsx3e

S95imQaB6Z1CGjDjHD/OjmU0/wPIxISYQ7argXiF9xb9rmFVsyJ516h7sgaqGCLlyT

idthBxIIYexfQ==

X-Brightmail-Tracker: H4sIAAAAAAAAA1VSa1ATVxjlZjeblZIaAw5brNRZWyl1WAvjdG5

H2tqW0dVOHfzDKNDSgAsJDSHdTTS0jkN5zZCK5dXRRJlSMioUAoLyLBJJAQsqYAxP5VFBaIEy

EATp8LCbUpX+OXPud+53zvnx4Yj0BuaFMzoNw6pkShJzRYMGHr/n51N9Jvbt/mYSjprnMNgzO

4jAZIMFhXNFNgANjyZR2FSVg8HJ7k4U/pa1IIQrK50YXDIfh8sFHQA2m+LhXG69AKYOn4SlZQ

Z+ez5dBLsuFqBwoNwigu22JwL4y60sALuSqzA4aBzGYNZqKgaf/mEXwcVxkwB2Ly1gMGWwHcB

zPb0ofFw+hOzdSuf1pQK61jggoutsdkD3VE4jdMPDvxD6UvZdhP6xvx6hf29tR+nyqgwB/bd5

SUiP9hkQurx6AqUL/3yffpoaSlvTawV0gT4ieHOoUKGKjNd9IZSbcuYQdY1UN5Y2IkgEZRv1w

BWXSuYBYTCVoHqwgX80AqK46LCTIxKK6P0hF3NysWQT0WoYRdfmO4lLP00ieoDzfAcxr9c4x+

6SKCK78oLQyT0krxOrQ43AyTHJG0RDsQNxcpTn5oGz/1keIkoGEpG12G1Ex5VeNBO4GdclG9c

lG9clG18k5wP0ZwA5hj3OsH7vUpGsIkauiZMplJTsaz8ZxWjZeDXjd4LhNLupmCg1xXAcxSXE

RSmPUSpGUwH4U3CdCSZrwPXutF1W8AouIDeLb149Eyt9OTL+WIJcxskjWK2S4ayAwnHJWGlxJ

5DYZxxJAi9UFa9iSEIcfo3/vYllYhhdtELJn9izBQJ3Iz3ETU4zMaeWxXGKmDWpDXyGV9dari

P47YxWHuum7Dyuzjpx5H43jyuVSxYEv7V89gaCJ90ba0Rw/RV7EyJFY1hZgpenOLmSN5U4TeV

a1fPIZ4dtA1u93MXAxcVF6qZm2DiF5v/6BPDEAekuJqt4FzeFSvO82QRfWsCXbr78b2mN7IXk

lSiIDk1aWVx6dX/BQ9+SDxu9uUwW7A05WuQIyE0q9/Spib5mC99z71sfl9PTfbu3XLZvTxuzr

o6EDue7v3QwxBI28pr9yL6GnYnTFTvCHVa17nQL6MijZh6YH32vbMnLbghIbjsADuNl989L74

ZcCEO+8/7m/AMqrEW3PUVVG/FR6efuCQe9p1vmsg2BX0YKPyHnRwLlvtpT/m3bLB69N09NnNx

IRC1/haZvaJpdvPPp7IFxOj144dD4RWtGv9vok5TAntWi5KBgX+yDj7uiIHckVlc/VagNO1qR

s2ffm/5Xg4ZMU0KHIfNOJu5XZ5vtD9jyzq+iotsEucuVOFE42W+JOJdPopxc5v8WwnKyfwDfD

oQnUwQAAA==

X-Env-Sender: info@nedgia.es

X-Msg-Ref: server-5.tower-874.messagelabs.com!1787737894!149348!1

X-Originating-IP: [68.221.244.61]

X-SYMC-ESS-Client-Auth: outbound-route-from=pass

X-StarScan-Received:

X-StarScan-Version: 9.122.2; banners=-,-,-

X-VirusChecked: Checked

Received: (qmail 3764131 invoked from network); 26 Aug 2026 09:51:35 -0000

Received: from unknown (HELO azpexch04.es.gasnatural.com) (68.221.244.61)

by server-5.tower-874.messagelabs.com with ECDHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 26 Aug 2026 09:51:35 -0000

Received: from azpexch06.es.gasnatural.com (10.57.64.107) by

azpexch04.es.gasnatural.com (10.57.64.105) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.2562.45; Wed, 26 Aug 2026 11:51:34 +0200

Received: from [160.250.133.175] (10.57.0.164) by azpexch06.es.gasnatural.com

(10.57.64.100) with Microsoft SMTP Server id 15.2.2562.45 via Frontend

Transport; Wed, 26 Aug 2026 11:51:22 +0200

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Ref#N140091 Contact Tony Edward now at (te004753@gmail.com) for the release

of your fund.

To: Recipients

From: File mail

Date: Wed, 26 Aug 2026 16:51:10 +0700

Message-ID: <757154f9-949b-41cf-b7cd-d9db0ef0ff18@azpexch06.es.gasnatural.com>

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Attn, This is to notify you that your fund (compensation)

has been programmed for immediate release to your account but we can not transfer

it direct to your account because we are having a little problem w [...]



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[195.245.231.2 listed in will-spam-for-food.eu.org]

[195.245.231.2 listed in will-spam-for-food.eu.org]

[195.245.231.2 listed in will-spam-for-food.eu.org]

[195.245.231.2 listed in will-spam-for-food.eu.org]

[195.245.231.2 listed in will-spam-for-food.eu.org]

[195.245.231.2 listed in will-spam-for-food.eu.org]

[195.245.231.2 listed in will-spam-for-food.eu.org]

[195.245.231.2 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[68.221.244.61 listed in dnsbl.ahbl.org]

[68.221.244.61 listed in dnsbl.ahbl.org]

[68.221.244.61 listed in dnsbl.ahbl.org]

[68.221.244.61 listed in dnsbl.ahbl.org]

[195.245.231.2 listed in dnsbl.ahbl.org]

[195.245.231.2 listed in dnsbl.ahbl.org]

[195.245.231.2 listed in dnsbl.ahbl.org]

[195.245.231.2 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[68.221.244.61 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[68.221.244.61 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[68.221.244.61 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[68.221.244.61 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[195.245.231.2 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[195.245.231.2 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[195.245.231.2 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} Ref#N140091 Contact Tony Edward now at (te004753@gmail.com) for the release

of your fund.



Attn,



This is to notify you that your fund (compensation) has been programmed for=

immediate release to your account but we can not transfer it direct to you=

r account because we are having a little problem with International Monetar=

y Fund, so our means of payment is via Atm card delivery and is ready also =

activated for delivery to your destination.



Contact Tony Edward now at (te004753@gmail.com) or whats app him at +1 (754=

-352-9274) with your name, address and also your valid phone number to give=

your more details on how to claim your fund.



As a matter of fact, make sure as the rightful beneficiary of the ATM CARD =

package, you must contact them by indicating the code (2661101) so that the=

y can find it and pick it up immediately as they have it in their record.



Yours sincerely,

Paul A. Manue.



________________________________



Este correo electr=F3nico contiene informaci=F3n confidencial y privada y e=

st=E1 dirigida =FAnicamente a su destinatario. Su revisi=F3n, uso, distribu=

ci=F3n o notificaci=F3n por otras personas est=E1 estrictamente prohibida. =

Si usted no es destinatario original (o est=E1 autorizado por el destinatar=

io original para su recepci=F3n), por favor contacte con el emisor por medi=

o de una respuesta v=EDa correo electr=F3nico y borre todas las copias de e=

ste mensaje. Este correo electr=F3nico tiene el =FAnico prop=F3sito de info=

rmar y no deber=EDa ser considerado como una declaraci=F3n oficial de la em=

presa. El correo electr=F3nico v=EDa Internet no permite asegurar la confid=

encialidad de los mensajes que se transmiten ni su integridad o correcta re=

cepci=F3n. Naturgy no asume ninguna responsabilidad por estas circunstancia=

s.





This email may contain confidential and privileged material for the sole us=

e of the intended recipient. Any review, use, distribution or disclosure by=

others is strictly prohibited. If you are not the intended recipient (or a=

uthorized to receive for the recipient), please contact the sender by reply=

email and delete all copies of this message. This email is for information=

purposes only and should not be regarded as an official statement from the=

company. Internet e-mail neither guarantees the confidentiality nor the in=

tegrity or proper receipt of the messages sent. Naturgy does not assume any=

liability for those circumstances

Nigerian spam from Mesagelabs

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Aug 2026 07:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzDTi-00000000O6t-2jGJ

for dave@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 07:15:42 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Aug 2026 07:15:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail1.bemta39.messagelabs.com ([195.245.231.3]:15117)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wz9qp-00000000JSc-3DTj

for sales@nk.ca;

Wed, 26 Aug 2026 03:23:28 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gasnatural.com;

s=security; t=1787736144; i=@gasnatural.com;

bh=nJDlol4Q/ZoO8QZ35L6OOZh22ZPL30JUQIX5nHWESdI=;

h=Content-Type:MIME-Version:Content-Transfer-Encoding:

Content-Description:Subject:To:From:Date:Message-ID;

b=ciMP+yKPpcUVPdmdweb9pLNecEOXz1GrqVGSe1xRZOsm35Qlu/GZkTTSKtBY0ejt2

TlIFN6l0Phj/+AFFy0IuRNOIbrtf3KxKLf10n8FtLDvOunvHrq6HiwruhZDAFxeb+3

FQrAJzHDK0x3QRNpOxktLfB6NSSxYSfYSHRBox4OL8M0eGSlxr6F5qyQ2Zodl7eaI8

h4e5JR6nF4c7s67GZ1ARxiGMx3Dn1lua3PgdxGppN0lmjR5hnmHAdZyrMh+CU5Ydh1

KP/aSiupbSN3ZVWuWihxpChjoL04B0/xCGg6FVvtMExpSrFxe2PLX8ynpZaRzoTTlF

K4L/ap3NR3VGA==

X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFuplk+JIrShJLcpLzFFi42JxufvFVtdnQ1+

WwfXFfBa/XnWyW7zvvcZmcXrxREaLuUunMlms2pNvsf30RmaL1ZPWslis/HWDxeLY28tMFo+/

/2ayaPxoZfHhF1DVxu51LBadN+6wWDy9fZDdYva9S0wWy+//ZbZouXeO0UHI48+KGYwel1Y+Y

/W4+/0Fq8fl81Yezz5fZvI4+HAio8e+pgusHhdubWDzWHDuKJPHth+bWDzm3Kz2WPnpLavHo3

2z2T3ebT/O7jFr1mEmj+WLm5kDBKJYM/OS8isSWDMWT/7MXLBDqOJZ22OmBsb1/F2MXBxCAl8

ZJc7+ecIC4RxklDjw+xFrFyMnB7OAnsSNqVPYQGxeAUGJkzNBikDi2hLLFr5m7mLkALLVJL52

lYCEhQWSJSZtnQPWKiKgIvHv/kFGEJtNQFVi3+pPzCA2C5A97e4ERoiRfhI/Dl0DiwsJKEic3

3CDZQIjzywkm2ch2TwLyeZZCJsXMLKsYrQsTi0qSy3SNTTQSyrKTM8oyU3MzNFLrNJN1EstLc

ovSNUtTy0uMdFLTy7QSy0u1iuuzE3OSdHLSy3ZxAiMV64PAUY7GPdda9M/xCjJwaQkymsV1Zc

lxJeUn1KZkVicEV9UmpNafIhRj4ND4Nm61RcYBa58+NTEJMWSl5+XqiTBu2E1ULVgUWp6akVa

Zg4wvcA0SHDwKInwLpsElOYtLkjMLc5Mh0idYozl2L5z/15mjjO9J4HkrjdXgOS/jyDy8e1rQ

PLv1t/7mTlO/5l+gJmj6fKzg8wcXRuuHGEWYkkvSqyUEudtWQc0VABkaEZpHtxKWCq9xCgrJc

zLyMDAIMRTkFqUm1mCKv+KUZyDUUmYN3A90BSezLwSuMteAR3NBHT00eVgR5ckIqSkGpimsh9

71MUcn6OtvYGH73CBONut1Lq5Hqs/9E9cOoH7dd+yWWo7tjm/vKdn+t/9nZr1CkbjhCNrzy+L

FRYU5SqNSW06doD7cIrG945PDkKvhQPzvnyb8WHlZc+rAZ7nhUwKN75Vl55sUs/r+Fx54pabz

NcETSdbMV/WN75luff0isfbJu97LHRQnbNhbv1lic+ra/IDZzvVZrxuaZml9vDpxEmfd7mZ3y

i/OM/6A6vmL9XLh5osn/tstA9sarxc+/9v4GG+80v2pjxZmqGz6XH2S8sK9c0f/octcVK4yHT

tvv/HyX2teqWuJnGKLG+mBE1mvmf2bqnh5BOOh41KDrofn9VVf3Qv9/urC10lL55zUmIpzkg0

1GIuKk4EAMPhuX8gBAAA

X-Env-Sender: info@nedgia.es

X-Msg-Ref: server-6.tower-876.messagelabs.com!1787736138!146112!4

X-Originating-IP: [68.221.244.61]

X-SYMC-ESS-Client-Auth: outbound-route-from=pass

X-StarScan-Received:

X-StarScan-Version: 9.122.2; banners=-,-,-

X-VirusChecked: Checked

Received: (qmail 3569642 invoked from network); 26 Aug 2026 09:22:20 -0000

Received: from unknown (HELO azpexch04.es.gasnatural.com) (68.221.244.61)

by server-6.tower-876.messagelabs.com with ECDHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 26 Aug 2026 09:22:20 -0000

Received: from azpexch05.es.gasnatural.com (10.57.64.106) by

azpexch04.es.gasnatural.com (10.57.64.105) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.2562.45; Wed, 26 Aug 2026 11:22:18 +0200

Received: from [160.250.133.175] (10.57.0.164) by azpexch05.es.gasnatural.com

(10.57.64.100) with Microsoft SMTP Server id 15.2.2562.45 via Frontend

Transport; Wed, 26 Aug 2026 11:22:03 +0200

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Ref#N140091 Contact Tony Edward now at (te004753@gmail.com) for the release

of your fund.

To: Recipients

From: File mail

Date: Wed, 26 Aug 2026 16:21:52 +0700

Message-ID: <4bf90f6c-6c76-45ed-8f5d-f7cf0c696ab5@azpexch05.es.gasnatural.com>

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Attn, This is to notify you that your fund (compensation)

has been programmed for immediate release to your account but we can not transfer

it direct to your account because we are having a little problem w [...]



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[195.245.231.3 listed in will-spam-for-food.eu.org]

[195.245.231.3 listed in will-spam-for-food.eu.org]

[195.245.231.3 listed in will-spam-for-food.eu.org]

[195.245.231.3 listed in will-spam-for-food.eu.org]

[195.245.231.3 listed in will-spam-for-food.eu.org]

[195.245.231.3 listed in will-spam-for-food.eu.org]

[195.245.231.3 listed in will-spam-for-food.eu.org]

[195.245.231.3 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[195.245.231.3 listed in dnsbl.ahbl.org]

[195.245.231.3 listed in dnsbl.ahbl.org]

[195.245.231.3 listed in dnsbl.ahbl.org]

[195.245.231.3 listed in dnsbl.ahbl.org]

[68.221.244.61 listed in dnsbl.ahbl.org]

[68.221.244.61 listed in dnsbl.ahbl.org]

[68.221.244.61 listed in dnsbl.ahbl.org]

[68.221.244.61 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[195.245.231.3 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[195.245.231.3 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[195.245.231.3 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[195.245.231.3 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[195.245.231.3 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[195.245.231.3 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[195.245.231.3 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} Ref#N140091 Contact Tony Edward now at (te004753@gmail.com) for the release

of your fund.



Attn,



This is to notify you that your fund (compensation) has been programmed for=

immediate release to your account but we can not transfer it direct to you=

r account because we are having a little problem with International Monetar=

y Fund, so our means of payment is via Atm card delivery and is ready also =

activated for delivery to your destination.



Contact Tony Edward now at (te004753@gmail.com) or whats app him at +1 (754=

-352-9274) with your name, address and also your valid phone number to give=

your more details on how to claim your fund.



As a matter of fact, make sure as the rightful beneficiary of the ATM CARD =

package, you must contact them by indicating the code (2661101) so that the=

y can find it and pick it up immediately as they have it in their record.



Yours sincerely,

Paul A. Manue.



________________________________



Este correo electr=F3nico contiene informaci=F3n confidencial y privada y e=

st=E1 dirigida =FAnicamente a su destinatario. Su revisi=F3n, uso, distribu=

ci=F3n o notificaci=F3n por otras personas est=E1 estrictamente prohibida. =

Si usted no es destinatario original (o est=E1 autorizado por el destinatar=

io original para su recepci=F3n), por favor contacte con el emisor por medi=

o de una respuesta v=EDa correo electr=F3nico y borre todas las copias de e=

ste mensaje. Este correo electr=F3nico tiene el =FAnico prop=F3sito de info=

rmar y no deber=EDa ser considerado como una declaraci=F3n oficial de la em=

presa. El correo electr=F3nico v=EDa Internet no permite asegurar la confid=

encialidad de los mensajes que se transmiten ni su integridad o correcta re=

cepci=F3n. Naturgy no asume ninguna responsabilidad por estas circunstancia=

s.





This email may contain confidential and privileged material for the sole us=

e of the intended recipient. Any review, use, distribution or disclosure by=

others is strictly prohibited. If you are not the intended recipient (or a=

uthorized to receive for the recipient), please contact the sender by reply=

email and delete all copies of this message. This email is for information=

purposes only and should not be regarded as an official statement from the=

company. Internet e-mail neither guarantees the confidentiality nor the in=

tegrity or proper receipt of the messages sent. Naturgy does not assume any=

liability for those circumstances

Docusign phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Aug 2026 07:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzDTA-00000000MXZ-1QeT

for dave@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 07:15:08 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Aug 2026 07:15:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f104.google.com ([209.85.210.104]:58467)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wz7nF-00000000FgN-00Dz

for www@nl2k.ab.ca;

Wed, 26 Aug 2026 01:11:39 -0600

Received: by mail-ot1-f104.google.com with SMTP id 46e09a7af769-7f48c750afcso654161a34.0

for ; Wed, 26 Aug 2026 00:09:43 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1787728177; x=1788332977; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=RSiax9Nszucg2H3eSiL6UqNwCkMBFlYDaEonLKl9+4g=;

b=JO5ZYBQWgm9Hh2/q6zeg/PlafXj2+fR99vFZspexAMIazny+6FLsI9HXPuv5g9rmqx

QyaYnnIlxFOhZ2so+zaqASxfNs+aAXNeC0RWr+FcZmjmgKJA94pvbBK2UNE36J1IjN/y

CPmx1Zp/P7LVQUOeAwxXYcuCcS7ttL7ShxDmg=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787728177; x=1788332977;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=RSiax9Nszucg2H3eSiL6UqNwCkMBFlYDaEonLKl9+4g=;

b=crY7Jq6nL0NZRCCI7BLg4HDz8UTLP17o6Kw/AEddgetY3ulS5lWJ6UbqW42nmBptiB

jY0Hq0hhkddKuV/BRT5hxRWlPVAKi8mevToU3LpyEZSvAZzeKiFcaHkW7pCsWpi2K5Xh

mCoB2RHtVmO/HVPC4VwPwtW+PWE7fS+GfUVM6gPKINtwglTkCNhjJ7kj13G+z8DwsnRy

//wIvRMiasohOCXZPUzQzE/1xTGoqE9JAlO4VN4BqQp6ayw4wAs6HBMfw6TRjzQC7Cb5

+GJCyWyN32lpIflLI5doS6tXBsq3YoJcIu2iTSP/qlfWgZRBgUSwRfssZ7zTEwkX3lSJ

qpfA==

X-Gm-Message-State: AFuF++mWMwLlkI8QSiN1jhs+0DxhQeYPWsIm0Romib0FMuxm9sxjC2wU

teZNLuTMiev492yuaTOrPu8xN4SEpTD4d+l+T18ru/5WyuO7/5iTkfpTNrAaA/KePl0P/w9AjJQ

Ofr9FZXKO0YRKAQQNRvQ3IKuNsMPEjCdg+g6jvK4we7l43aA=

X-Gm-Gg: AR+sD10tD+u5u/trfxJlt1xijkTl/gcvsk85Gqz64xY1KF+pZdcXfHhQzXJ5gMiyW6P

a4TT7VkfFdMN+sJuSw+eCkStmK0Z8BXd8jUwgORtpb7LTZa2MV/aqWUp06MJ1TwRPuuYHn9tKrm

Snrv5gnlWbPhtcdbiSa86u/0Cx7XZe0e4wFRdeTZaqC44OG9luKKpqmYqp8mRjRuUuWZ+MYL89u

BQRsirr13DGAerjaWhn3lJB8nLPmuWpubuRDJPnvq3zavWajHrKSoxVD31f1C+5VuBS19m2o8QM

rf/+gcUudN9+Ojqo5INH0X29Sj1kxMRAhwvkrQiCYgsyG33wew1+2UdenehbECjGjia8+poQK1O

2bHw0n2D7MhY=

X-Received: by 2002:a05:6820:1521:b0:6aa:e1f6:32dc with SMTP id 006d021491bc7-6b1a04c4898mr4771021eaf.22.1787728177434;

Wed, 26 Aug 2026 00:09:37 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6b1a2628355sm11549eaf.23.2026.08.26.00.09.37

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 26 Aug 2026 00:09:37 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: Docusign Via Docusign

To: www@nl2k.ab.ca

Subject: Your Review Is Requested

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Wed, 26 Aug 2026 07:09:34 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.7

X-Spam_score_int: 87

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  www@nl2k.ab.ca Your electronic signature is required.

REVIEW THE DOCUMENTS



Content analysis details: (8.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.210.104 listed in will-spam-for-food.eu.org]

[209.85.210.104 listed in will-spam-for-food.eu.org]

[209.85.210.104 listed in will-spam-for-food.eu.org]

[209.85.210.104 listed in will-spam-for-food.eu.org]

[209.85.210.104 listed in will-spam-for-food.eu.org]

[209.85.210.104 listed in will-spam-for-food.eu.org]

[209.85.210.104 listed in will-spam-for-food.eu.org]

[209.85.210.104 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.210.104 listed in dnsbl.ahbl.org]

[209.85.210.104 listed in dnsbl.ahbl.org]

[209.85.210.104 listed in dnsbl.ahbl.org]

[209.85.210.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: kdjsuhd.es]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 TRACKER_ID BODY: Incorporates a tracking ID number

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.104 listed in list.dnswl.org]

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

Subject: {SPAM?} Your Review Is Requested















www@nl2k.ab.ca Your electronic signature is required.













REVIEW THE DOCUMENTS









Please review and sign. Document can only be viewed by www@nl2k.ab.ca



Thank you for choosing DocuSign.



















































































































































































































































































































































































































































































































































































































































































































































































































































































​

​

Barbara:



No out of pocket.



Colleen M. Coleman

Paralegal to JOHN-PAUL A. SERRAO



AMICUS LEGAL GROUP, INC.

800 North Haven Avenue, Suite 205

Ontario, California 91764



Telephone No.: 909-906-9040

Facsimile No.: 909-906-9041



CONFIDENTIALITY NOTICE: This communication contains legally privileged and confidential information sent solely for the use of the intended recipient. If you are not the intended recipient of this communication, you are not authorized to use it in any manner, except to immediately destroy it and notify the sender.



From: Alvarado, Barbara

Sent: Tuesday, August 11, 2026 7:48 AM

To: Colleen Coleman

Subject: Claim No.: 260142784





Colleen,







Good morning. I am following up on out of pocket confirmation for your client so that we can move the property damage portion forward to completion.











Thank you,











Barbara Alvarado



MD Adjuster III



Allstate Insurance



PO BOX 1623 Winston Salem, NC 27199-1623



Direct (909) 941-5929 • Toll Free (833) 785-4391 • Fax (800) 924-0273



Email: I827218@allstate.com







signature_250147298







If you are emailing me a claim-specific communication, please send it to ALLSTATECLAIMS@NGIC.COM with the claim number in the subject line.







Note: The policy is underwritten by one of Allstate’s affiliates under the National General Insurance Group as shown above. However, in Texas, policies are administered by Direct General Insurance Agency, Inc., an Allstate managing general agency (Lic.1919020) and issued by Home State County Mutual Ins. Co. (an unaffiliated insurer). The claims under the applicable policy will be managed in accordance with the underwriting company’s applicable policies and procedures.







From: Alvarado, Barbara

Sent: Tuesday, July 28, 2026 11:54 AM

To: Colleen Coleman

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







Your clients are Fernando and Gerardo Farias and their vehicle is the 2019 Jeep Wrangler.







Thank you,







Barbara Alvarado



MD Adjuster III



Allstate Insurance



PO BOX 1623 Winston Salem, NC 27199-1623



Direct (909) 941-5929 • Toll Free (833) 785-4391 • Fax (800) 924-0273



Email: I827218@allstate.com







signature_250147298







If you are emailing me a claim-specific communication, please send it to ALLSTATECLAIMS@NGIC.COM with the claim number in the subject line.







Note: The policy is underwritten by one of Allstate’s affiliates under the National General Insurance Group as shown above. However, in Texas, policies are administered by Direct General Insurance Agency, Inc., an Allstate managing general agency (Lic.1919020) and issued by Home State County Mutual Ins. Co. (an unaffiliated insurer). The claims under the applicable policy will be managed in accordance with the underwriting company’s applicable policies and procedures.







From: Colleen Coleman

Sent: Tuesday, July 28, 2026 11:00 AM

To: Alvarado, Barbara

Subject: Re: Claim No.: 260142784







​͏​Who is our client? Colleen M. Coleman Paralegal to JOHN-PAUL A. SERRAO AMICUS LEGAL GROUP, INC. 800 North Haven Avenue, Suite 205 Ontario, California 91764 Telephone No. : 909-906-9040 Facsimile No. : 909-906-9041 CONFIDENTIALITY NOTICE: This ZjQcmQRYFpfptPreheaderEnd



ZjQcmQRYFpfptBannerStart



This Message Is From an Untrusted Sender



You have not previously corresponded with this sender.



Report Suspicious ‌



ZjQcmQRYFpfptBannerEnd



Who is our client?







Colleen M. Coleman



Paralegal to JOHN-PAUL A. SERRAO







AMICUS LEGAL GROUP, INC.



800 North Haven Avenue, Suite 205



Ontario, California 91764







Telephone No.: 909-906-9040



Facsimile No.: 909-906-9041







CONFIDENTIALITY NOTICE: This communication contains legally privileged and confidential information sent solely for the use of the intended recipient. If you are not the intended recipient of this communication, you are not authorized to use it in any manner, except to immediately destroy it and notify the sender.



From: Alvarado, Barbara

Sent: Monday, July 27, 2026 12:02 PM

To: Colleen Coleman

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







We are working on finalizing the pd portion of the claim for this loss and are pending confirmation if your client had any out of pocket expense?







Thank you,











Barbara Alvarado



MD Adjuster III



Allstate Insurance



PO BOX 1623 Winston Salem, NC 27199-1623



Direct (909) 941-5929 • Toll Free (833) 785-4391 • Fax (800) 924-0273



Email: I827218@allstate.com







signature_250147298







If you are emailing me a claim-specific communication, please send it to ALLSTATECLAIMS@NGIC.COM with the claim number in the subject line.







Note: The policy is underwritten by one of Allstate’s affiliates under the National General Insurance Group as shown above. However, in Texas, policies are administered by Direct General Insurance Agency, Inc., an Allstate managing general agency (Lic.1919020) and issued by Home State County Mutual Ins. Co. (an unaffiliated insurer). The claims under the applicable policy will be managed in accordance with the underwriting company’s applicable policies and procedures.







From: Alvarado, Barbara

Sent: Saturday, March 7, 2026 8:38 AM

To: 'Colleen Coleman'

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







Just following up on previous email as we are working to finalize the pd portion of the claim. Can you please confirm if your client had any out of pocket expense so that we can move the claim forward?







Thank you,







Barbara Alvarado



Material Damage Claims Adjuster



P.O. Box 1623 | Winston-Salem, NC 27102



Office: (909) 941-5929



Fax: (800) 924-0273



Email: claims@ngic.com







PLEASE NOTE: We do not accept attorney correspondence or time sensitive documents via this email. All attorney correspondence or time sensitive documents should be sent to National General PO Box 1623 Winston-Salem, NC 27102-3199 -OR – Fax number 800-924-0273 or emailed to claims@ngic.com with the Claim Number in the Subject







Underwritten by:



Integon National Insurance Company



Integon Preferred Insurance Company







From: Alvarado, Barbara

Sent: Wednesday, March 4, 2026 9:15 AM

To: Colleen Coleman

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







I am working on the pd portion of the claim as demand from your client’s carrier has been received but we have a limit issue and need to confirm with you if your client had any out of pocket prior to moving claim forward?







Thank you,







Barbara Alvarado



Material Damage Claims Adjuster



P.O. Box 1623 | Winston-Salem, NC 27102



Office: (909) 941-5929



Fax: (800) 924-0273



Email: claims@ngic.com







PLEASE NOTE: We do not accept attorney correspondence or time sensitive documents via this email. All attorney correspondence or time sensitive documents should be sent to National General PO Box 1623 Winston-Salem, NC 27102-3199 -OR – Fax number 800-924-0273 or emailed to claims@ngic.com with the Claim Number in the Subject







Underwritten by:



Integon National Insurance Company



Integon Preferred Insurance Company







From: Colleen Coleman

Sent: Monday, February 2, 2026 3:50 PM

To: claims@ngic.com

Cc: Fernando Magana

Subject: Claim No.: 260142784







​͏​Sam: As you are aware, our office represents Mr. Farias for injuries sustained as a result of the auto accident on November 27, 2025. Please forward all correspondence to our attention and not to our client. Thank you. Colleen M. Coleman Paralegal ZjQcmQRYFpfptPreheaderEnd



ZjQcmQRYFpfptBannerStart



This Message Is From an Untrusted Sender



You have not previously corresponded with this sender.



Report Suspicious ‌



ZjQcmQRYFpfptBannerEnd



Sam:







As you are aware, our office represents Mr. Farias for injuries sustained as a result of the auto accident on November 27, 2025. Please forward all correspondence to our attention and not to our client.







Thank you.







Colleen M. Coleman



Paralegal to JOHN-PAUL A. SERRAO







AMICUS LEGAL GROUP, INC.



800 North Haven Avenue, Suite 205



Ontario, California 91764







Telephone No.: 909-906-9040



Facsimile No.: 909-906-9041







CONFIDENTIALITY NOTICE: This communication contains legally privileged and confidential information sent solely for the use of the intended recipient. If you are not the intended recipient of this communication, you are not authorized to use it in any manner, except to immediately destroy it and notify the sender.



Note: Please be aware that unencrypted electronic mail is not secure. For this reason, please do not send any sensitive personal information such

as your address, driver license, policy number, Social Security Number, or claims information by unencrypted electronic mail. The information

contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient,

or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution

or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying

to the message and deleting it from your computer. Thank you.

Docusign phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Aug 2026 07:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzDTE-00000000MkR-3gbN

for dave@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 07:15:12 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Aug 2026 07:15:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f102.google.com ([209.85.216.102]:51258)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wz7nE-00000000FgL-12Lx

for www@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 01:11:38 -0600

Received: by mail-pj1-f102.google.com with SMTP id 98e67ed59e1d1-38759bcd877so1030613a91.2

for ; Wed, 26 Aug 2026 00:09:43 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1787728177; x=1788332977; darn=doctor.nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=JWJa7apK1sziDsnmgPFN5tsOWyEeImndD0nieLmWlv0=;

b=ENSGv3iS/vn574fenZTFJCoxncMX+/I3a5sr3Wpgx1oIxfliSPddx9LAr7KKTl4SnF

jpB7CAEZz8jN0P68E6p96NuoRG/abHujcMi/Zr1fli377HOaaH4zxgepyS1wtdj8pS63

jMK+AU70eb4k1TgECyeUkBojFsVZm5mZToSYM=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787728177; x=1788332977;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=JWJa7apK1sziDsnmgPFN5tsOWyEeImndD0nieLmWlv0=;

b=CN3I5LFLvBoR+0rkNmt4Bxe8OLkzvQIBviGq3rFM/CRqXKvvCxa42olWNWKzC6dt7V

SOEcCE2pCdWh/MxAxGM5T5p7wMtQnrt4Sqrh6f48OqckTp8yJBM8NEWCpjPaVGfsEfRm

o9AWPrVUeC7GnxsvwfFILm/3AXYJhLbas69yJVH1JYtQijZEhFoqMSbFkMJpAddYa4P5

XIPmCY1jJMr1+XPjA8Elv1muCEzOIMZAbhOl62ET8+78CMXnDA7mXUkbf/gfHvVL06EV

S3aUtBctS9XRLTEDK/kLuzbm3sq93DITToTB8nAroun1YSGZKLHatiUAqP9GwxhonjPn

8E6Q==

X-Gm-Message-State: AFuF++mtw4A092nNPwxyOtT5g/jIZ1aY11w6pKGyYMQ0nblAhfh4Ffrc

C+/pb28GaZpMkZukg5K+NQgV4q4S9d5ozKh2cDy/dfptoJAnoyXpy0G2oLUegB3He0BQjhl79ti

vq65XEIqnnSysHaY2WiTsbluaRY4dCHjYHCrv/42TvkfTrxs=

X-Gm-Gg: AR+sD138Mr9o41Tk3kg79MJAWg8CCE9iweR9kp3Garl7uH6D2Vb482QCaBUHFZKINDg

Pi23tAJXjyjIftF2TCI6jbeh4YyuM+xv/EPvHtRVAW81fUiOC1h06vNrQlD1v8VlI1O8TlDYrv9

JoUO6JY6mFvNnDhr1fKBrne9tOgrgVeyq7YB7OhNVtY6YP17FDD+6kpMTv31/Yuu7yt2J1Oz0xk

52fpBUJZXC1Ltt6M+BpoI6etzR6zj+VzRUwMIqgvW9vfAiLrWkcgaSrVi7P/vZ4NWn7UWlVSxiq

l7gGu8Gr2Lab9hXDVI6Tn1l3MkX4V1FRqw7vjt1QJ4h3QZh08yaIhiNrrzjLxzoxZnBfVTHmXXY

6+sM8EhdpN0I=

X-Received: by 2002:a17:90b:3f83:b0:38c:a59b:5189 with SMTP id 98e67ed59e1d1-3966d497d0fmr10595474a91.15.1787728177367;

Wed, 26 Aug 2026 00:09:37 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 98e67ed59e1d1-396758eeacfsm154965a91.3.2026.08.26.00.09.36

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 26 Aug 2026 00:09:37 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: Docusign Via Docusign

To: www@doctor.nl2k.ab.ca

Subject: New Document Requires Your Attention

Message-ID: <84c10448-c4a3-1595-3dcc-8fdfe7d667b5@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Wed, 26 Aug 2026 07:09:34 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 7.5

X-Spam_score_int: 75

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  www@doctor.nl2k.ab.ca Your electronic signature is required.

REVIEW THE DOCUMENTS



Content analysis details: (7.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.216.102 listed in will-spam-for-food.eu.org]

[209.85.216.102 listed in will-spam-for-food.eu.org]

[209.85.216.102 listed in will-spam-for-food.eu.org]

[209.85.216.102 listed in will-spam-for-food.eu.org]

[209.85.216.102 listed in will-spam-for-food.eu.org]

[209.85.216.102 listed in will-spam-for-food.eu.org]

[209.85.216.102 listed in will-spam-for-food.eu.org]

[209.85.216.102 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.216.102 listed in dnsbl.ahbl.org]

[209.85.216.102 listed in dnsbl.ahbl.org]

[209.85.216.102 listed in dnsbl.ahbl.org]

[209.85.216.102 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: kdjsuhd.es]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.102 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 TRACKER_ID BODY: Incorporates a tracking ID number

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

Subject: {SPAM?} New Document Requires Your Attention













www@doctor.nl2k.ab.ca Your electronic signature is required.













REVIEW THE DOCUMENTS









Please review and sign. Document can only be viewed by www@doctor.nl2k.ab.ca



Thank you for choosing DocuSign.



















































































































































































































































































































































































































































































































































































































































































































































































































































































​

​

Barbara:



No out of pocket.



Colleen M. Coleman

Paralegal to JOHN-PAUL A. SERRAO



AMICUS LEGAL GROUP, INC.

800 North Haven Avenue, Suite 205

Ontario, California 91764



Telephone No.: 909-906-9040

Facsimile No.: 909-906-9041



CONFIDENTIALITY NOTICE: This communication contains legally privileged and confidential information sent solely for the use of the intended recipient. If you are not the intended recipient of this communication, you are not authorized to use it in any manner, except to immediately destroy it and notify the sender.



From: Alvarado, Barbara

Sent: Tuesday, August 11, 2026 7:48 AM

To: Colleen Coleman

Subject: Claim No.: 260142784





Colleen,







Good morning. I am following up on out of pocket confirmation for your client so that we can move the property damage portion forward to completion.











Thank you,











Barbara Alvarado



MD Adjuster III



Allstate Insurance



PO BOX 1623 Winston Salem, NC 27199-1623



Direct (909) 941-5929 • Toll Free (833) 785-4391 • Fax (800) 924-0273



Email: I827218@allstate.com







signature_250147298







If you are emailing me a claim-specific communication, please send it to ALLSTATECLAIMS@NGIC.COM with the claim number in the subject line.







Note: The policy is underwritten by one of Allstate’s affiliates under the National General Insurance Group as shown above. However, in Texas, policies are administered by Direct General Insurance Agency, Inc., an Allstate managing general agency (Lic.1919020) and issued by Home State County Mutual Ins. Co. (an unaffiliated insurer). The claims under the applicable policy will be managed in accordance with the underwriting company’s applicable policies and procedures.







From: Alvarado, Barbara

Sent: Tuesday, July 28, 2026 11:54 AM

To: Colleen Coleman

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







Your clients are Fernando and Gerardo Farias and their vehicle is the 2019 Jeep Wrangler.







Thank you,







Barbara Alvarado



MD Adjuster III



Allstate Insurance



PO BOX 1623 Winston Salem, NC 27199-1623



Direct (909) 941-5929 • Toll Free (833) 785-4391 • Fax (800) 924-0273



Email: I827218@allstate.com







signature_250147298







If you are emailing me a claim-specific communication, please send it to ALLSTATECLAIMS@NGIC.COM with the claim number in the subject line.







Note: The policy is underwritten by one of Allstate’s affiliates under the National General Insurance Group as shown above. However, in Texas, policies are administered by Direct General Insurance Agency, Inc., an Allstate managing general agency (Lic.1919020) and issued by Home State County Mutual Ins. Co. (an unaffiliated insurer). The claims under the applicable policy will be managed in accordance with the underwriting company’s applicable policies and procedures.







From: Colleen Coleman

Sent: Tuesday, July 28, 2026 11:00 AM

To: Alvarado, Barbara

Subject: Re: Claim No.: 260142784







​͏​Who is our client? Colleen M. Coleman Paralegal to JOHN-PAUL A. SERRAO AMICUS LEGAL GROUP, INC. 800 North Haven Avenue, Suite 205 Ontario, California 91764 Telephone No. : 909-906-9040 Facsimile No. : 909-906-9041 CONFIDENTIALITY NOTICE: This ZjQcmQRYFpfptPreheaderEnd



ZjQcmQRYFpfptBannerStart



This Message Is From an Untrusted Sender



You have not previously corresponded with this sender.



Report Suspicious ‌



ZjQcmQRYFpfptBannerEnd



Who is our client?







Colleen M. Coleman



Paralegal to JOHN-PAUL A. SERRAO







AMICUS LEGAL GROUP, INC.



800 North Haven Avenue, Suite 205



Ontario, California 91764







Telephone No.: 909-906-9040



Facsimile No.: 909-906-9041







CONFIDENTIALITY NOTICE: This communication contains legally privileged and confidential information sent solely for the use of the intended recipient. If you are not the intended recipient of this communication, you are not authorized to use it in any manner, except to immediately destroy it and notify the sender.



From: Alvarado, Barbara

Sent: Monday, July 27, 2026 12:02 PM

To: Colleen Coleman

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







We are working on finalizing the pd portion of the claim for this loss and are pending confirmation if your client had any out of pocket expense?







Thank you,











Barbara Alvarado



MD Adjuster III



Allstate Insurance



PO BOX 1623 Winston Salem, NC 27199-1623



Direct (909) 941-5929 • Toll Free (833) 785-4391 • Fax (800) 924-0273



Email: I827218@allstate.com







signature_250147298







If you are emailing me a claim-specific communication, please send it to ALLSTATECLAIMS@NGIC.COM with the claim number in the subject line.







Note: The policy is underwritten by one of Allstate’s affiliates under the National General Insurance Group as shown above. However, in Texas, policies are administered by Direct General Insurance Agency, Inc., an Allstate managing general agency (Lic.1919020) and issued by Home State County Mutual Ins. Co. (an unaffiliated insurer). The claims under the applicable policy will be managed in accordance with the underwriting company’s applicable policies and procedures.







From: Alvarado, Barbara

Sent: Saturday, March 7, 2026 8:38 AM

To: 'Colleen Coleman'

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







Just following up on previous email as we are working to finalize the pd portion of the claim. Can you please confirm if your client had any out of pocket expense so that we can move the claim forward?







Thank you,







Barbara Alvarado



Material Damage Claims Adjuster



P.O. Box 1623 | Winston-Salem, NC 27102



Office: (909) 941-5929



Fax: (800) 924-0273



Email: claims@ngic.com







PLEASE NOTE: We do not accept attorney correspondence or time sensitive documents via this email. All attorney correspondence or time sensitive documents should be sent to National General PO Box 1623 Winston-Salem, NC 27102-3199 -OR – Fax number 800-924-0273 or emailed to claims@ngic.com with the Claim Number in the Subject







Underwritten by:



Integon National Insurance Company



Integon Preferred Insurance Company







From: Alvarado, Barbara

Sent: Wednesday, March 4, 2026 9:15 AM

To: Colleen Coleman

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







I am working on the pd portion of the claim as demand from your client’s carrier has been received but we have a limit issue and need to confirm with you if your client had any out of pocket prior to moving claim forward?







Thank you,







Barbara Alvarado



Material Damage Claims Adjuster



P.O. Box 1623 | Winston-Salem, NC 27102



Office: (909) 941-5929



Fax: (800) 924-0273



Email: claims@ngic.com







PLEASE NOTE: We do not accept attorney correspondence or time sensitive documents via this email. All attorney correspondence or time sensitive documents should be sent to National General PO Box 1623 Winston-Salem, NC 27102-3199 -OR – Fax number 800-924-0273 or emailed to claims@ngic.com with the Claim Number in the Subject







Underwritten by:



Integon National Insurance Company



Integon Preferred Insurance Company







From: Colleen Coleman

Sent: Monday, February 2, 2026 3:50 PM

To: claims@ngic.com

Cc: Fernando Magana

Subject: Claim No.: 260142784







​͏​Sam: As you are aware, our office represents Mr. Farias for injuries sustained as a result of the auto accident on November 27, 2025. Please forward all correspondence to our attention and not to our client. Thank you. Colleen M. Coleman Paralegal ZjQcmQRYFpfptPreheaderEnd



ZjQcmQRYFpfptBannerStart



This Message Is From an Untrusted Sender



You have not previously corresponded with this sender.



Report Suspicious ‌



ZjQcmQRYFpfptBannerEnd



Sam:







As you are aware, our office represents Mr. Farias for injuries sustained as a result of the auto accident on November 27, 2025. Please forward all correspondence to our attention and not to our client.







Thank you.







Colleen M. Coleman



Paralegal to JOHN-PAUL A. SERRAO







AMICUS LEGAL GROUP, INC.



800 North Haven Avenue, Suite 205



Ontario, California 91764







Telephone No.: 909-906-9040



Facsimile No.: 909-906-9041







CONFIDENTIALITY NOTICE: This communication contains legally privileged and confidential information sent solely for the use of the intended recipient. If you are not the intended recipient of this communication, you are not authorized to use it in any manner, except to immediately destroy it and notify the sender.



Note: Please be aware that unencrypted electronic mail is not secure. For this reason, please do not send any sensitive personal information such

as your address, driver license, policy number, Social Security Number, or claims information by unencrypted electronic mail. The information

contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient,

or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution

or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying

to the message and deleting it from your computer. Thank you.



Docusign phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Aug 2026 07:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzDRW-00000000HlK-2sMS

for dave@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 07:13:26 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Aug 2026 07:13:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f230.google.com ([209.85.214.230]:57612)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wz61k-00000000Hpp-1YXx

for usenet@nl2k.ab.ca;

Tue, 25 Aug 2026 23:18:05 -0600

Received: by mail-pl1-f230.google.com with SMTP id d9443c01a7336-2cfbbdfa60bso6048085ad.3

for ; Tue, 25 Aug 2026 22:16:11 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1787721365; x=1788326165; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=T3s7X1BuRmq/akWnVpMxZWbFiOa/rsIhvajswO+TP1c=;

b=g+Jd335rQcmsrblD4vXELf/Dch1pRy7+Xb6uqwaE8JdPZvfFHry6GWy5Sjjnc2S6Hm

Wwth8yXTDzJrYE7BR63t8ZCMdpBwt4jkb7t5YM6f7kbuJ5NjxyZ+LDcKoODPJb01V1tB

Cz94ccawl3Uwr4CE47wNw0115kpGss9jOHgrU=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787721365; x=1788326165;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=T3s7X1BuRmq/akWnVpMxZWbFiOa/rsIhvajswO+TP1c=;

b=lkc9fUrMS0FMV+EdQSXHjPEemtXMlvYrtTc30CoMqRtkcbsk/dBlOF1paQZ1/54b86

oXcvoeKvsbzefrQH4R4hrMXbPrwVk8T8XJHaVdWp/TEeGY9tgnoVIEGZpBCjnHm45ATe

s4+4uRmT6cpztUVbK1l2GCTCFADrHXHK6RScfvLmKvq1C8DzQhmcUfnTIkhGn4l7SS63

1BLapqPeimoUpHR7HgX7ZBQUReiRsNJUW+0XXosOkMUIpL6huF2MggDDaPhV+WbniB1M

+s8+fn0663IDmSDrBB5ROAPxo9DQZLcnPJcHa0HkJkBtffH5n3z72hkMVYPSL7xLkX47

BPWg==

X-Gm-Message-State: AFuF++nDwMFgb3bYR9x7JXcyxJTxblHAoK9Mp8urXLhR3R669q7r8pMp

/MjTklgfgcLdMnB6vxKmEU2u5BDL+WJgYm5UwG0KukwAt5zDvWTl4sWj5vcopBaPvCiqbG107FO

8cCz+YIOnXHXC9LbMjZLAYiwxnTCeUEe2N5ZK0qYJjeET8gI=

X-Gm-Gg: AR+sD13AD9DnCEcnvVY1aMnv3r6eEDbpNrcz2If7Fv4QBvNC7u5RSmS3aXh9SvVPy7W

CaszXRdwy9EM5xgYUbkiMGVgI6B0JoJPjQ+AQ6ExLUWdfxNSP++rD0troy2gyiCB4P4dOs0ZvLV

Yi1F0fCf6k6TgFnKShayplhMOCCz9LMltlVOUo71LxYtB94ZnCU8SzCGNy3OOXJpc+7WUkDPtGo

uuRBLO423DDXbRJNYixeucImADgdRWkXqxvI+YCUpcrk1OYsE/1X2Q8og4bAU25ieayRshXLGPi

LYeKcFhs45OviTslygxHibPeacCEl6LVtSgfQYEzNQtTG83Nh5Tq6YaLZUvgb6Zv8pa0UfObZGn

X+ooxCZB8/887

X-Received: by 2002:a17:90b:52c8:b0:38e:c232:9d3f with SMTP id 98e67ed59e1d1-3966d191092mr9700755a91.5.1787721364982;

Tue, 25 Aug 2026 22:16:04 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 98e67ed59e1d1-39645c5bb83sm2345138a91.10.2026.08.25.22.16.04

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 25 Aug 2026 22:16:04 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: Docusign Via Docusign

To: usenet@nl2k.ab.ca

Subject: Action Needed: Document Review

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Wed, 26 Aug 2026 05:16:02 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 10.0

X-Spam_score_int: 100

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  usenet@nl2k.ab.ca Your electronic signature is required.

REVIEW THE DOCUMENTS



Content analysis details: (10.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.230 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 TRACKER_ID BODY: Incorporates a tracking ID number

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.230 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.230 listed in bl.score.senderscore.com]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: kdjsuhd.es]

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

Subject: {SPAM?} Action Needed: Document Review













usenet@nl2k.ab.ca Your electronic signature is required.













REVIEW THE DOCUMENTS









Please review and sign. Document can only be viewed by usenet@nl2k.ab.ca



Thank you for choosing DocuSign.



















































































































































































































































































































































































































































































































































































































































































































































































































































































​

​

Barbara:



No out of pocket.



Colleen M. Coleman

Paralegal to JOHN-PAUL A. SERRAO



AMICUS LEGAL GROUP, INC.

800 North Haven Avenue, Suite 205

Ontario, California 91764



Telephone No.: 909-906-9040

Facsimile No.: 909-906-9041



CONFIDENTIALITY NOTICE: This communication contains legally privileged and confidential information sent solely for the use of the intended recipient. If you are not the intended recipient of this communication, you are not authorized to use it in any manner, except to immediately destroy it and notify the sender.



From: Alvarado, Barbara

Sent: Tuesday, August 11, 2026 7:48 AM

To: Colleen Coleman

Subject: Claim No.: 260142784





Colleen,







Good morning. I am following up on out of pocket confirmation for your client so that we can move the property damage portion forward to completion.











Thank you,











Barbara Alvarado



MD Adjuster III



Allstate Insurance



PO BOX 1623 Winston Salem, NC 27199-1623



Direct (909) 941-5929 • Toll Free (833) 785-4391 • Fax (800) 924-0273



Email: I827218@allstate.com







signature_250147298







If you are emailing me a claim-specific communication, please send it to ALLSTATECLAIMS@NGIC.COM with the claim number in the subject line.







Note: The policy is underwritten by one of Allstate’s affiliates under the National General Insurance Group as shown above. However, in Texas, policies are administered by Direct General Insurance Agency, Inc., an Allstate managing general agency (Lic.1919020) and issued by Home State County Mutual Ins. Co. (an unaffiliated insurer). The claims under the applicable policy will be managed in accordance with the underwriting company’s applicable policies and procedures.







From: Alvarado, Barbara

Sent: Tuesday, July 28, 2026 11:54 AM

To: Colleen Coleman

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







Your clients are Fernando and Gerardo Farias and their vehicle is the 2019 Jeep Wrangler.







Thank you,







Barbara Alvarado



MD Adjuster III



Allstate Insurance



PO BOX 1623 Winston Salem, NC 27199-1623



Direct (909) 941-5929 • Toll Free (833) 785-4391 • Fax (800) 924-0273



Email: I827218@allstate.com







signature_250147298







If you are emailing me a claim-specific communication, please send it to ALLSTATECLAIMS@NGIC.COM with the claim number in the subject line.







Note: The policy is underwritten by one of Allstate’s affiliates under the National General Insurance Group as shown above. However, in Texas, policies are administered by Direct General Insurance Agency, Inc., an Allstate managing general agency (Lic.1919020) and issued by Home State County Mutual Ins. Co. (an unaffiliated insurer). The claims under the applicable policy will be managed in accordance with the underwriting company’s applicable policies and procedures.







From: Colleen Coleman

Sent: Tuesday, July 28, 2026 11:00 AM

To: Alvarado, Barbara

Subject: Re: Claim No.: 260142784







​͏​Who is our client? Colleen M. Coleman Paralegal to JOHN-PAUL A. SERRAO AMICUS LEGAL GROUP, INC. 800 North Haven Avenue, Suite 205 Ontario, California 91764 Telephone No. : 909-906-9040 Facsimile No. : 909-906-9041 CONFIDENTIALITY NOTICE: This ZjQcmQRYFpfptPreheaderEnd



ZjQcmQRYFpfptBannerStart



This Message Is From an Untrusted Sender



You have not previously corresponded with this sender.



Report Suspicious ‌



ZjQcmQRYFpfptBannerEnd



Who is our client?







Colleen M. Coleman



Paralegal to JOHN-PAUL A. SERRAO







AMICUS LEGAL GROUP, INC.



800 North Haven Avenue, Suite 205



Ontario, California 91764







Telephone No.: 909-906-9040



Facsimile No.: 909-906-9041







CONFIDENTIALITY NOTICE: This communication contains legally privileged and confidential information sent solely for the use of the intended recipient. If you are not the intended recipient of this communication, you are not authorized to use it in any manner, except to immediately destroy it and notify the sender.



From: Alvarado, Barbara

Sent: Monday, July 27, 2026 12:02 PM

To: Colleen Coleman

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







We are working on finalizing the pd portion of the claim for this loss and are pending confirmation if your client had any out of pocket expense?







Thank you,











Barbara Alvarado



MD Adjuster III



Allstate Insurance



PO BOX 1623 Winston Salem, NC 27199-1623



Direct (909) 941-5929 • Toll Free (833) 785-4391 • Fax (800) 924-0273



Email: I827218@allstate.com







signature_250147298







If you are emailing me a claim-specific communication, please send it to ALLSTATECLAIMS@NGIC.COM with the claim number in the subject line.







Note: The policy is underwritten by one of Allstate’s affiliates under the National General Insurance Group as shown above. However, in Texas, policies are administered by Direct General Insurance Agency, Inc., an Allstate managing general agency (Lic.1919020) and issued by Home State County Mutual Ins. Co. (an unaffiliated insurer). The claims under the applicable policy will be managed in accordance with the underwriting company’s applicable policies and procedures.







From: Alvarado, Barbara

Sent: Saturday, March 7, 2026 8:38 AM

To: 'Colleen Coleman'

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







Just following up on previous email as we are working to finalize the pd portion of the claim. Can you please confirm if your client had any out of pocket expense so that we can move the claim forward?







Thank you,







Barbara Alvarado



Material Damage Claims Adjuster



P.O. Box 1623 | Winston-Salem, NC 27102



Office: (909) 941-5929



Fax: (800) 924-0273



Email: claims@ngic.com







PLEASE NOTE: We do not accept attorney correspondence or time sensitive documents via this email. All attorney correspondence or time sensitive documents should be sent to National General PO Box 1623 Winston-Salem, NC 27102-3199 -OR – Fax number 800-924-0273 or emailed to claims@ngic.com with the Claim Number in the Subject







Underwritten by:



Integon National Insurance Company



Integon Preferred Insurance Company







From: Alvarado, Barbara

Sent: Wednesday, March 4, 2026 9:15 AM

To: Colleen Coleman

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







I am working on the pd portion of the claim as demand from your client’s carrier has been received but we have a limit issue and need to confirm with you if your client had any out of pocket prior to moving claim forward?







Thank you,







Barbara Alvarado



Material Damage Claims Adjuster



P.O. Box 1623 | Winston-Salem, NC 27102



Office: (909) 941-5929



Fax: (800) 924-0273



Email: claims@ngic.com







PLEASE NOTE: We do not accept attorney correspondence or time sensitive documents via this email. All attorney correspondence or time sensitive documents should be sent to National General PO Box 1623 Winston-Salem, NC 27102-3199 -OR – Fax number 800-924-0273 or emailed to claims@ngic.com with the Claim Number in the Subject







Underwritten by:



Integon National Insurance Company



Integon Preferred Insurance Company







From: Colleen Coleman

Sent: Monday, February 2, 2026 3:50 PM

To: claims@ngic.com

Cc: Fernando Magana

Subject: Claim No.: 260142784







​͏​Sam: As you are aware, our office represents Mr. Farias for injuries sustained as a result of the auto accident on November 27, 2025. Please forward all correspondence to our attention and not to our client. Thank you. Colleen M. Coleman Paralegal ZjQcmQRYFpfptPreheaderEnd



ZjQcmQRYFpfptBannerStart



This Message Is From an Untrusted Sender



You have not previously corresponded with this sender.



Report Suspicious ‌



ZjQcmQRYFpfptBannerEnd



Sam:







As you are aware, our office represents Mr. Farias for injuries sustained as a result of the auto accident on November 27, 2025. Please forward all correspondence to our attention and not to our client.







Thank you.







Colleen M. Coleman



Paralegal to JOHN-PAUL A. SERRAO







AMICUS LEGAL GROUP, INC.



800 North Haven Avenue, Suite 205



Ontario, California 91764







Telephone No.: 909-906-9040



Facsimile No.: 909-906-9041







CONFIDENTIALITY NOTICE: This communication contains legally privileged and confidential information sent solely for the use of the intended recipient. If you are not the intended recipient of this communication, you are not authorized to use it in any manner, except to immediately destroy it and notify the sender.



Note: Please be aware that unencrypted electronic mail is not secure. For this reason, please do not send any sensitive personal information such

as your address, driver license, policy number, Social Security Number, or claims information by unencrypted electronic mail. The information

contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient,

or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution

or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying

to the message and deleting it from your computer. Thank you.



Docusign phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 25 Aug 2026 21:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wz42q-00000000C6l-2H6p

for dave@doctor.nl2k.ab.ca;

Tue, 25 Aug 2026 21:11:20 -0600

Resent-From: The Doctor

Resent-Date: Tue, 25 Aug 2026 21:11:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pg1-f229.google.com ([209.85.215.229]:57593)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wz3nK-000000001ie-1gte

for support@nk.ca;

Tue, 25 Aug 2026 20:55:28 -0600

Received: by mail-pg1-f229.google.com with SMTP id 41be03b00d2f7-cc11a905ba5so296056a12.2

for ; Tue, 25 Aug 2026 19:54:31 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1787712865; x=1788317665; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=UQBt9cH7jgQFjbrRyg4OIRQN8lRpjah/w6H4Id8h/VE=;

b=DSGb6eWE9R6p0W3rppCDbIunq6D6SOW/B/45rKDKPcShmAfoRFLmmB1ywto0DvvCOh

iabewCgSRl9ETs06Cp9VZUyPbDFhk7QLPA7AGu7szj63hqiZmnJwRDmUWf2c60iM9y2c

gqCE8nd+Te8s3xMpWKSk7PSrTv9Y12HeNk3ug=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787712865; x=1788317665;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=UQBt9cH7jgQFjbrRyg4OIRQN8lRpjah/w6H4Id8h/VE=;

b=WZnoCGNAEs5HIkANrsgnYzEEZekEMTObLvbMo5Y6OJ+wSj3adwun3qi/7GqoKvnSOt

XJPAhT38KxnWbehN5hERxrgpSsR9ofcFzaGCS6VdVlNzXWA0EmOWgn3877jBdETN0ivR

U/sn5eeO1Hro8DHKaxiohKeO/xrfpmTOqp21ul4Hk0lGKOc/hUNPgWEkzLQAedSiIjeP

Uouu7yhPamCniQorM7wk+xPVTrp3hN3ELI3K3vzfUD3jbQRzxb57P0AMpTVo8vkVwpjp

yzcMfc/73tL+oZRViTQKuVR4vmGJJmzuJN1V3yVZvkCuQznMBONBcHOYhRE2W46SjfIQ

Kg/g==

X-Gm-Message-State: AFuF++lZcmjASQi1wYatofp6K7hilkFYsn0vddchTuQogkDizfLGXdy3

+zaCfs4OPQalIdFlxwe2VoG6n3RCzuiu8KYM6WdWzKp2EEko4+Tmzu+FkYjy6TCLuKRi2StO6qy

cC3WUWoXl/GbdXNqwgv7QCkHGAuDXmGBWWUVne3rRa1YWv+4=

X-Gm-Gg: AR+sD10gAcN57zxIOwUGLto0zqEMg/Sxd5/SBatHNmzDHS79ej4fB5coznIInqz7qcY

USsw+98SPsoJ0Fs51sR+gS4iZlZyWIjGcnKxNq2ZwnxXrauB0u7c47Y5/LdQ5Creqoc2XJOp7oY

xdTpaqHqaAzxJJoOniTkINHW6fRiD+0GYNmOG3uCDPdrwPwZTZtclgYp0DGh3roXPFPG0syfdli

N2qrmOuxQz7NcdmybxkkyU2x7uuTBfYpb9EBwpH+E3U1HYdA5EKoW7NVVqEJmSUGToHZoL4J0TA

Uwd3urKKTsdTWT1ySOfR7SNDWwKJe0nyxsEalq2nJnK5dQa0Q8WlxVtIu20c8V0ALP7RrCrjBZC

rSEyyHJkWM3w=

X-Received: by 2002:a17:90b:4484:b0:38e:9ef9:eb97 with SMTP id 98e67ed59e1d1-3966d5bc8b2mr5614172a91.16.1787712865425;

Tue, 25 Aug 2026 19:54:25 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 98e67ed59e1d1-39674dc659dsm480267a91.11.2026.08.25.19.54.24

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 25 Aug 2026 19:54:25 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: Docusign Via Docusign

To: support@nk.ca

Subject: Your Document Is Ready for Review

Message-ID: <370e40b7-4157-e6d8-c3d1-65ecc1ca26c2@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Wed, 26 Aug 2026 02:54:22 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 9.8

X-Spam_score_int: 98

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  support@nk.ca Your electronic signature is required. REVIEW

THE DOCUMENTS



Content analysis details: (9.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.215.229 listed in will-spam-for-food.eu.org]

[209.85.215.229 listed in will-spam-for-food.eu.org]

[209.85.215.229 listed in will-spam-for-food.eu.org]

[209.85.215.229 listed in will-spam-for-food.eu.org]

[209.85.215.229 listed in will-spam-for-food.eu.org]

[209.85.215.229 listed in will-spam-for-food.eu.org]

[209.85.215.229 listed in will-spam-for-food.eu.org]

[209.85.215.229 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.215.229 listed in dnsbl.ahbl.org]

[209.85.215.229 listed in dnsbl.ahbl.org]

[209.85.215.229 listed in dnsbl.ahbl.org]

[209.85.215.229 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.215.229 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.215.229 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.215.229 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.215.229 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.215.229 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: kdjsuhd.es]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 TRACKER_ID BODY: Incorporates a tracking ID number

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.215.229 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.215.229 listed in bl.score.senderscore.com]

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

Subject: {SPAM?} Your Document Is Ready for Review













support@nk.ca Your electronic signature is required.













REVIEW THE DOCUMENTS









Please review and sign. Document can only be viewed by support@nk.ca



Thank you for choosing DocuSign.



















































































































































































































































































































































































































































































































































































































































































































































































































































































​

​

Barbara:



No out of pocket.



Colleen M. Coleman

Paralegal to JOHN-PAUL A. SERRAO



AMICUS LEGAL GROUP, INC.

800 North Haven Avenue, Suite 205

Ontario, California 91764



Telephone No.: 909-906-9040

Facsimile No.: 909-906-9041



CONFIDENTIALITY NOTICE: This communication contains legally privileged and confidential information sent solely for the use of the intended recipient. If you are not the intended recipient of this communication, you are not authorized to use it in any manner, except to immediately destroy it and notify the sender.



From: Alvarado, Barbara

Sent: Tuesday, August 11, 2026 7:48 AM

To: Colleen Coleman

Subject: Claim No.: 260142784





Colleen,







Good morning. I am following up on out of pocket confirmation for your client so that we can move the property damage portion forward to completion.











Thank you,











Barbara Alvarado



MD Adjuster III



Allstate Insurance



PO BOX 1623 Winston Salem, NC 27199-1623



Direct (909) 941-5929 • Toll Free (833) 785-4391 • Fax (800) 924-0273



Email: I827218@allstate.com







signature_250147298







If you are emailing me a claim-specific communication, please send it to ALLSTATECLAIMS@NGIC.COM with the claim number in the subject line.







Note: The policy is underwritten by one of Allstate’s affiliates under the National General Insurance Group as shown above. However, in Texas, policies are administered by Direct General Insurance Agency, Inc., an Allstate managing general agency (Lic.1919020) and issued by Home State County Mutual Ins. Co. (an unaffiliated insurer). The claims under the applicable policy will be managed in accordance with the underwriting company’s applicable policies and procedures.







From: Alvarado, Barbara

Sent: Tuesday, July 28, 2026 11:54 AM

To: Colleen Coleman

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







Your clients are Fernando and Gerardo Farias and their vehicle is the 2019 Jeep Wrangler.







Thank you,







Barbara Alvarado



MD Adjuster III



Allstate Insurance



PO BOX 1623 Winston Salem, NC 27199-1623



Direct (909) 941-5929 • Toll Free (833) 785-4391 • Fax (800) 924-0273



Email: I827218@allstate.com







signature_250147298







If you are emailing me a claim-specific communication, please send it to ALLSTATECLAIMS@NGIC.COM with the claim number in the subject line.







Note: The policy is underwritten by one of Allstate’s affiliates under the National General Insurance Group as shown above. However, in Texas, policies are administered by Direct General Insurance Agency, Inc., an Allstate managing general agency (Lic.1919020) and issued by Home State County Mutual Ins. Co. (an unaffiliated insurer). The claims under the applicable policy will be managed in accordance with the underwriting company’s applicable policies and procedures.







From: Colleen Coleman

Sent: Tuesday, July 28, 2026 11:00 AM

To: Alvarado, Barbara

Subject: Re: Claim No.: 260142784







​͏​Who is our client? Colleen M. Coleman Paralegal to JOHN-PAUL A. SERRAO AMICUS LEGAL GROUP, INC. 800 North Haven Avenue, Suite 205 Ontario, California 91764 Telephone No. : 909-906-9040 Facsimile No. : 909-906-9041 CONFIDENTIALITY NOTICE: This ZjQcmQRYFpfptPreheaderEnd



ZjQcmQRYFpfptBannerStart



This Message Is From an Untrusted Sender



You have not previously corresponded with this sender.



Report Suspicious ‌



ZjQcmQRYFpfptBannerEnd



Who is our client?







Colleen M. Coleman



Paralegal to JOHN-PAUL A. SERRAO







AMICUS LEGAL GROUP, INC.



800 North Haven Avenue, Suite 205



Ontario, California 91764







Telephone No.: 909-906-9040



Facsimile No.: 909-906-9041







CONFIDENTIALITY NOTICE: This communication contains legally privileged and confidential information sent solely for the use of the intended recipient. If you are not the intended recipient of this communication, you are not authorized to use it in any manner, except to immediately destroy it and notify the sender.



From: Alvarado, Barbara

Sent: Monday, July 27, 2026 12:02 PM

To: Colleen Coleman

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







We are working on finalizing the pd portion of the claim for this loss and are pending confirmation if your client had any out of pocket expense?







Thank you,











Barbara Alvarado



MD Adjuster III



Allstate Insurance



PO BOX 1623 Winston Salem, NC 27199-1623



Direct (909) 941-5929 • Toll Free (833) 785-4391 • Fax (800) 924-0273



Email: I827218@allstate.com







signature_250147298







If you are emailing me a claim-specific communication, please send it to ALLSTATECLAIMS@NGIC.COM with the claim number in the subject line.







Note: The policy is underwritten by one of Allstate’s affiliates under the National General Insurance Group as shown above. However, in Texas, policies are administered by Direct General Insurance Agency, Inc., an Allstate managing general agency (Lic.1919020) and issued by Home State County Mutual Ins. Co. (an unaffiliated insurer). The claims under the applicable policy will be managed in accordance with the underwriting company’s applicable policies and procedures.







From: Alvarado, Barbara

Sent: Saturday, March 7, 2026 8:38 AM

To: 'Colleen Coleman'

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







Just following up on previous email as we are working to finalize the pd portion of the claim. Can you please confirm if your client had any out of pocket expense so that we can move the claim forward?







Thank you,







Barbara Alvarado



Material Damage Claims Adjuster



P.O. Box 1623 | Winston-Salem, NC 27102



Office: (909) 941-5929



Fax: (800) 924-0273



Email: claims@ngic.com







PLEASE NOTE: We do not accept attorney correspondence or time sensitive documents via this email. All attorney correspondence or time sensitive documents should be sent to National General PO Box 1623 Winston-Salem, NC 27102-3199 -OR – Fax number 800-924-0273 or emailed to claims@ngic.com with the Claim Number in the Subject







Underwritten by:



Integon National Insurance Company



Integon Preferred Insurance Company







From: Alvarado, Barbara

Sent: Wednesday, March 4, 2026 9:15 AM

To: Colleen Coleman

Subject: RE: Claim No.: 260142784







Colleen,







Good morning.







I am working on the pd portion of the claim as demand from your client’s carrier has been received but we have a limit issue and need to confirm with you if your client had any out of pocket prior to moving claim forward?







Thank you,







Barbara Alvarado



Material Damage Claims Adjuster



P.O. Box 1623 | Winston-Salem, NC 27102



Office: (909) 941-5929



Fax: (800) 924-0273



Email: claims@ngic.com







PLEASE NOTE: We do not accept attorney correspondence or time sensitive documents via this email. All attorney correspondence or time sensitive documents should be sent to National General PO Box 1623 Winston-Salem, NC 27102-3199 -OR – Fax number 800-924-0273 or emailed to claims@ngic.com with the Claim Number in the Subject







Underwritten by:



Integon National Insurance Company



Integon Preferred Insurance Company







From: Colleen Coleman

Sent: Monday, February 2, 2026 3:50 PM

To: claims@ngic.com

Cc: Fernando Magana

Subject: Claim No.: 260142784







​͏​Sam: As you are aware, our office represents Mr. Farias for injuries sustained as a result of the auto accident on November 27, 2025. Please forward all correspondence to our attention and not to our client. Thank you. Colleen M. Coleman Paralegal ZjQcmQRYFpfptPreheaderEnd



ZjQcmQRYFpfptBannerStart



This Message Is From an Untrusted Sender



You have not previously corresponded with this sender.



Report Suspicious ‌



ZjQcmQRYFpfptBannerEnd



Sam:







As you are aware, our office represents Mr. Farias for injuries sustained as a result of the auto accident on November 27, 2025. Please forward all correspondence to our attention and not to our client.







Thank you.







Colleen M. Coleman



Paralegal to JOHN-PAUL A. SERRAO







AMICUS LEGAL GROUP, INC.



800 North Haven Avenue, Suite 205



Ontario, California 91764







Telephone No.: 909-906-9040



Facsimile No.: 909-906-9041







CONFIDENTIALITY NOTICE: This communication contains legally privileged and confidential information sent solely for the use of the intended recipient. If you are not the intended recipient of this communication, you are not authorized to use it in any manner, except to immediately destroy it and notify the sender.



Note: Please be aware that unencrypted electronic mail is not secure. For this reason, please do not send any sensitive personal information such

as your address, driver license, policy number, Social Security Number, or claims information by unencrypted electronic mail. The information

contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient,

or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution

or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying

to the message and deleting it from your computer. Thank you.



Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 25 Aug 2026 21:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wz42A-00000000BNU-4An4

for dave@doctor.nl2k.ab.ca;

Tue, 25 Aug 2026 21:10:39 -0600

Resent-From: The Doctor

Resent-Date: Tue, 25 Aug 2026 21:10:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m478512577.xmail.ntesmail.com ([47.85.125.77]:60070)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wz1Iv-00000000I8d-466j

for sales@nk.ca;

Tue, 25 Aug 2026 18:16:03 -0600

Content-Type: multipart/mixed; BOUNDARY="=_Part_50343_1510902260.1787703286343"

To: sales

Subject: =?UTF-8?B?RWNvIGZyaWVuZGx5IGhvdGVsIGd1ZXN0IGFtZW5pdGllcw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from emily@ylhotelsupply.com( [10.139.5.81] ) by ajax-webmail ( [127.0.0.1] ) ; Wed, 26 Aug 2026 08:14:46 +0800 (GMT+08:00)

From: Emily

Date: Wed, 26 Aug 2026 08:14:46 +0800 (GMT+08:00)

X-WM-Tid: 0aa03b6b5985d068kusy91ec797fee43

Message-ID:



Subject:

Eco friendly hotel guest amenities

From:

Emily

Date:

8/25/26, 18:14

To:

sales



Hi GM/Purchasing,





Our expertise is in elevating hospitality standards through premium, fully recyclable amenities designed for modern hotels. Beyond essentials like hotel liquid, soap and hand wash, our eco-friendly solutions extend to biodegradable toiletry kits, and plant-based skincare dispensers – all crafted to align with global sustainability goals.



• Comb, toothbrush and razor handles made of 100% recycled plastic and fully recyclable bamboo



• Kraft paper sanitary bags



• 100% Cotton buds with paper stick



• Wooden comb, clothes brush and shoehorn



• Bathroom accessories made from recycled plastic and PSM (Plant Starch-based material)



• Recyclable non-woven or cotton hairdryer bags, shoe bags and laundry bags



• FSC certificated package made of sugarcane, kraft, stone paper.







Looking forward to helping you create memorable, planet-positive stays.











Kindest regards,



Emily







Yuelong Hotel Amenities Limited



www.yuelonghotelamenities.com



Mobile/WeChat/Whatsapp:0086-13480795524





Emily

emily@ylhotelsupply.com



20251225161516_523_109.jpg



20251225161453_514_109.jpg



Kraft Paper Box set.jpg



20251024125357_205_109.jpg



20251022172531_185_109.jpg



20251022172801_188_109.jpg



20251023103529_189_109.jpg



20251023121604_197_109.jpg



20251024122335_201_109.jpg



20251024122335_202_109.jpg



20251024122336_203_109.jpg



20251024125356_204_109.jpg

Attachments:

20251225161516_523_109.jpg 130 KB

20251225161453_514_109.jpg 142 KB

Kraft Paper Box set.jpg 52.2 KB

20251024125357_205_109.jpg 50.8 KB

20251022172531_185_109.jpg 844 KB

20251022172801_188_109.jpg 705 KB

20251023103529_189_109.jpg 903 KB

20251023121604_197_109.jpg 479 KB

20251024122335_201_109.jpg 53.8 KB

20251024122335_202_109.jpg 67.1 KB

20251024122336_203_109.jpg 46.4 KB

20251024125356_204_109.jpg 54.3 KB

Dating phish from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 25 Aug 2026 21:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wz41O-00000000AYb-2tdQ

for dave@doctor.nl2k.ab.ca;

Tue, 25 Aug 2026 21:09:50 -0600

Resent-From: The Doctor

Resent-Date: Tue, 25 Aug 2026 21:09:50 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-northeuropeazolkn19011029.outbound.protection.outlook.com ([52.103.32.29]:18268 helo=DU2PR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyzRY-00000000E1s-3uCs

for doctor@nk.ca;

Tue, 25 Aug 2026 16:16:42 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=n4PkJirh0dUIPYRX3UWErUGa7Hs6xwWlA9urGffBaUBuV6k3q+BZXv/74OKjxNinnd3m5YbqVgxYsQmB3KqwyD8Btsf7wMtFtdu1M8LQOUsGemYuUVaNTQT+4lfnmxvJ8SE/X+JHle7LrGUxxxcvEo7lJCUjexgyRqxdzu/M+mn2dl9XVtnn4Uz3kCO/iqNQHc756MYHkwcDlRpkkfBD6ZAvtWABn/7nL6SzEV/dCNe7Pny9glw03eQFL+IyHkIZ3XA09neExR0sLA/nM6XgBqMC4eIJlcSsR6GdlXwzmfpf0bwf7JY+SX/qxEpAlIQFotih9aQ1w57NDhWutlVZpg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=sNwlOE1AJjwdNQzE3OiuId7QciLbmLckAJtk3JVxLfQ=;

b=R+hrqtxWe+N8Dy0CxyvcxE8UVVgBXa3Eq4qB1C0PDWgYRFx7zMwtD0F/xwuyM5JtMZCPApigQQTNdntTU0c96AZiddBnZJXppaJw2jHzmqJ3PRvuxF4m+pdNbqnfs5GdN0XV33dmYH5GYmw//839pviLzhwhSSrHzhndHKvc5RzERk9xHLwr0fyeSs6DD/O8bnsnDitAe8QqTFgQerJFdFflKDJWtuNX/g2uZgG0fCbxqWkBRk5Z/A2L4WUUXTeqd9twIHhu5WkVxkb/LbvXKgtafoB9jdfGqWNinHS+wdxKPB0HqgOOpXtZmiDMsduUyMljhBIYKI/FbvG8WQNK5g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=sNwlOE1AJjwdNQzE3OiuId7QciLbmLckAJtk3JVxLfQ=;

b=Ah0xnaEoyUnWpd8znY/fAnggFrRVsc4TkU3Urs/5tox07nCPnXqf32jJjWR7xOxJIRyrm4HHgj98lT2bxynliUEr4UAN7mW37UJ1J+q6HZaT3+EH5rX7/vAoKx/osKbnoY/gGNZKS2tLz3HKMJOyGPG+mr2kxcSJXkcEieUd1jz0Wz7kNuuXzi2nipoe5+fP9VBCrsMuTrNx5CW/Y23tfKYH/WJACROnPmjqX8o6QKzmYNS2L4yw7AJ0IE6TWH9rLaXkJdwGSodIrtSv0fLFXsNkJjur4IogK7PBluJRq6oZSYo+TPmivi6gR7XiT1NqS9Rr3Cked9ynU6gNGTTsXg==

Received: from AS8PR08MB10271.eurprd08.prod.outlook.com (2603:10a6:20b:629::7)

by AS8PR08MB8900.eurprd08.prod.outlook.com (2603:10a6:20b:5b5::10) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.8; Tue, 25 Aug

2026 22:15:34 +0000

Received: from AS8PR08MB10271.eurprd08.prod.outlook.com

([fe80::6c63:34f3:5ef5:57f2]) by AS8PR08MB10271.eurprd08.prod.outlook.com

([fe80::6c63:34f3:5ef5:57f2%5]) with mapi id 15.21.0339.012; Tue, 25 Aug 2026

22:15:33 +0000

Subject: A calm way to meet someone new.

From: "braylentringham99@hotmail.com"

Reply-To: "braylentringham99@hotmail.com"

X-Mailer: Lotus Notes

Date: Wed, 26 Aug 2026 00:15:30 +0200

Message-ID:



Content-Type: multipart/alternative;

boundary="----=_NextPart_000_62FA_6FD8C903.358D44A8"

X-ClientProxiedBy: FR4P281CA0111.DEUP281.PROD.OUTLOOK.COM

(2603:10a6:d10:bb::12) To AS8PR08MB10271.eurprd08.prod.outlook.com

(2603:10a6:20b:629::7)

X-Microsoft-Original-Message-ID: <1.1d1adcb6f25f3bde6566@DESKTOP-VKRMBR2>

MIME-Version: 1.0

X-MS-Exchange-MessageSentRepresentingType: 1

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: AS8PR08MB10271:EE_|AS8PR08MB8900:EE_

X-MS-Office365-Filtering-Correlation-Id: 43775b4c-90d0-4c8b-91a3-08df02f660ed

X-Microsoft-Antispam:

BCL:0;ARA:14566002|39105399006|24071999003|20031999006|23021999003|19110799012|8060799015|22091999003|25031999004|24121999003|15080799012|55001999006|24021099003|12121999013|9400799043|4140399003|25010399006|5072599009|31055399003|43065399003|40105399003|10035399007|25131999003|26121999007|23121099006|2607281247196008|11120399003|12091999003|56899033|440099028|3412199025|2406899039;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?S2NuS081bEM4eURLdWNMZkQyTDN5QUg1Wkg5RysrcER2TGNKWHkrUTJFc3BG?=

=?utf-8?B?ZUtTSkZRTkpyNlI5Zld3QzV4aFRveUtqS01pNElBV2lyaUt1WG5mVy9ObS8r?=

=?utf-8?B?T1UxQnNaTEZNVmZTUXJBc21FRkRTc0s4TUJkc0ZLYnhDajkrT2MxS2ROdE9h?=

=?utf-8?B?RHU1M3dhSTExKzR4R3E1NTJHNTVXK3ZXTmxqUksxTUtpOXQ4VHQ5WlBqeW03?=

=?utf-8?B?T0RIZTBVaHZXWncwaGU5aURYQmpTTUZBZENlQm1TVlBOSEpqbHBIeFNvckRs?=

=?utf-8?B?YmIyOEJVeGEwYkMyNnE0MnV0Q0V6Z0pjeHU5MWFyNDZnVGJjOVlSSjZjTVo4?=

=?utf-8?B?d0JWSGw0WFY4cHNuK0V5akZNM1lzcTZQZU1yRTdyVElKRmNHZGd5Wm1ScWZi?=

=?utf-8?B?d1FjQjVlRFJxcEF4YVYwQkIrWGZncnJScnl3dlpLY0RWM2VwaWJyUUg2NG9J?=

=?utf-8?B?N1F1RjBLMm5jT201YTM5cndqZUlFNlBVMXVqS3BBb0FFTGtXY05EcTlxbFVJ?=

=?utf-8?B?dmxXR2RneTl5dWlvdjFReXk3ckZheHFnNjFQZE41ZC9KbnZBV0JDUmsySzhu?=

=?utf-8?B?SnhUaVNvWUgySll4aFVWNHVrdVpIdjE5bFZ1ODhoMXdsek1JRktnV2xPc055?=

=?utf-8?B?OXBNNXFHR0YzRUkvK0l6SnpXa2E0VXdLUERVQzgxbmpVb0UvSmw1anhCYWsy?=

=?utf-8?B?cWZkc3BTcDUwVG1mWTh2Qmttc2s2a0tGOFNROGN6b3BZdEhyL0VuMEhoQnBq?=

=?utf-8?B?V1BaRlprWDlQb0lXbkZWVnFsczl5UFRwYkVnQ2pWV1Z6cWN3bkdtN1FOWFYw?=

=?utf-8?B?akVxcnErZWZ2TXh1ZWpiSVBJenB0UE4zVVlhbGx0elBQNitmRDZiRk1oNm5P?=

=?utf-8?B?SC9FOGFUNkdyS2hzaG9sVGpkd2FmUzFPUVlSaHYxaDY3bDUvQ0hrcVdxdEVX?=

=?utf-8?B?amV4dTIvKzQvdjhsS3R1VnY2UFFTejV3QVJnaDdNRmE2ei9vRzcwa1hudWtw?=

=?utf-8?B?OXZWWEVpSTZBMFBQdGhOU0hVc1BsT0RpNmhpY1dNU202RmM2c0VIOExDcUM1?=

=?utf-8?B?cnpGZVZMeEZHSUFjNmZPWG5QWTRCcmpXUjBUQmhuSmxWRDR2SWM0YUtKUmQ0?=

=?utf-8?B?cTUzeHlDVVF3MUg4UnNNelBUMTZ5VTFDOTd3bGYrSUZMYU5Mdis3VTdYWUNq?=

=?utf-8?B?dzlXblV1bDE3eURMNXNDUHp5aG1RV3Q3Mnc5R1B2QVd4ZU16V2pndzMwdGVC?=

=?utf-8?B?cXJWQjZOS28rN2paeXVNQi9BNkJLVFdnelVnQnJDNEZZWThzOGV3a0o4RGtR?=

=?utf-8?B?YXpvcFBxM2o2TGNCVnJ0bS83N0VtWFhVTUVJN0FDUklyYThRZHZNWTFyWTll?=

=?utf-8?B?blRBL2VDcFY1ZERhOGNkMVNxNndTRDdQaWlCMktUbFF2dWE1YXlPZHZ4QjBP?=

=?utf-8?B?Vi9rQkJYVlQ1TENXK2xrWHFxZUxrb05raDFjVjFlblpqWnloV3RHck1YNEdF?=

=?utf-8?B?N1JNV1dEejRvTGlYSXloL1l0RUdRQjcyN1hPTm1oU3pKdDg4Z3FPbEJYNE9x?=

=?utf-8?B?T3lBUnRCS0RERjhUYWw2bkd6UHVzNDBrZUpob0h4ZVRidkdhZVg4VmZpN2V6?=

=?utf-8?B?V1BFZVB4WXJ5YjJhQm5RNkVjUUZLNkJXa0FlRTZCMC8wVGZEZGJNV2w2L3Vz?=

=?utf-8?B?Ty9XdDJJVFVybnJ2UmswMlZobXg0cTB6UWY0YlhmNHpPRnNuUGJDcU02U09t?=

=?utf-8?B?bWJzT2FSM2J4TVRkWFlOd0pSVUpzeHJDdndPTWx5UFR4dnBmWE5yMHJ5Nm1W?=

=?utf-8?Q?nhV1VZrWmozPa9/cawHKksivxo2b4pKMQaYf4=3D?=

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

=?utf-8?B?WVNYSk9CVzFKekFDWEtiSjJvU0NBMUVCdlhWZmY2dWdmaWNFdFJGb1JIRXk5?=

=?utf-8?B?aFdkb1NKcmM5WUVHeDhib3JwMW5SK2VhRmxIeWxySmdJaDdhMy9KWlcxMHps?=

=?utf-8?B?WlJBUGFFZDR2cWNpSGtvYVZMTlVKd3NpZFprenZjeENTdVAzaVVERm94ODc2?=

=?utf-8?B?NjhFQVJpYWFjYjMwSkt5eWpSd1M5UVBDdHpmdTJLS2hLdFA2M3pzc25LMXdj?=

=?utf-8?B?dWJYWVNzTkdMN3ptaVFzMHp6NHhOci9aUmczVmU2OWYrUkkwV3NJeEVUOEZt?=

=?utf-8?B?TjlSS3UvejJvNHNVZHBtQnpOMzdPenN6Z1o3aEFXdUdFWG5YcExQMkNSWW5E?=

=?utf-8?B?Z1dkQzZoTTZReFE4dVJvR0gwUWFXeW5tMjZyK3JLZzR4ek5raGc5Mmg4WTJj?=

=?utf-8?B?am5mbFBMMFRYSS9qVmVnQldUNzNEeVlMVjVSUEtCS1JTQWVrcUlzZFlFV0JD?=

=?utf-8?B?S21zakFiNUFqYWMxSElXemNTalkyNnJUMlpPYS94TitNZVU2NnNpdUMzdklG?=

=?utf-8?B?MGxiYjhLbjdJTXR6clIxT28xb2grbk5kcW40eTRmZGhFNUMwdUdHdUsrQkMy?=

=?utf-8?B?KytEUlIwejc5UDhYd3NMSTZmRm05TXU2N0ZDOTdTK3NaK3M1TFhCcFREbDE3?=

=?utf-8?B?WDRZZWhLdmRpRnBEWUU1RCt5RndVTS9EOWtpVjIwcFhNdFJNbnNtemxVTDNB?=

=?utf-8?B?YlhCWGgwSFVyekptVkx4MHVEeFZWR2c0clBSa29Rd0dBcFJxZnFMbzUzNUZn?=

=?utf-8?B?RDlKV2dSajQ2eTVsZ29JSkdBbUFHQWZRNTFhNlRKOUpEdzduenBJWDduajFV?=

=?utf-8?B?dXMrZjBpTnllajYwbkYrSm8rYncwSjlLSUdXOHpkWnlLTHpKU0h6OHcwd0xT?=

=?utf-8?B?UGNPWE5TTzc2U2l6V3Y5TlpEWjZQUWxBcXRYVnJadnVJUUUvTHpxL09ZV2RJ?=

=?utf-8?B?VEdNZnI5SU9nTXpNRnA0QlJ5N0pLSkZINjBmQ294blZaMUt2V1Q2cUowa1Zi?=

=?utf-8?B?b3BwdDRCK3JXOFBaZFBuSkxRa09aSVBhemV1TVZSM2VJQVBLSVNqQ0tpZDJm?=

=?utf-8?B?eVAvYjRoV1VhUG85aEYrVSsxWG14Y2F1VUoxdUNKZWluYmltMnNWZGU5TUdT?=

=?utf-8?B?VVdhRU5UZXNFbVFVaGNUU0pHVHdCd1RxWDhvOXU3R2MvVUlSajlUMEpYaHpY?=

=?utf-8?B?OVlmUXBsMmV5VXNTN2Ntb3JGK1NWcStyQzNTNk1LWm1mYXBjL3B4V2JReUx5?=

=?utf-8?B?WHo4NGh6clptVEtkbklwSEhWZEo2dDQrOTE2dFh1VThCQWVtbmxtcU10WUNm?=

=?utf-8?B?b3VLaU9XUE55UEE3cE9tTFB6QXU1Mm4zZ3RCWEV5Q0EzVzBWNkhZUlZJajJ1?=

=?utf-8?B?RGtFSHY5SktLTVQ5YnFvZ1NxMkV2WUF6RmY3WG5VMG9yWEpBZzZzaXl6eUo3?=

=?utf-8?B?Zlo0R1UyQ1oxU1UvOTdaaXVVVDNzaTVXM2RWaTNscENMTU56KzhOVWxsS1V5?=

=?utf-8?B?NDZvYVFaTUxxMnh4a3NOMVR3REhsZVhUcWxEVE1mbXptbzM5YTkxeHF4QnJP?=

=?utf-8?B?MHQxcytiSExMNmRmb3JlcjJnM1B6bWZaMmtLME9kb01RZWZNaUlzY0RmM3Rr?=

=?utf-8?B?dlJvQU1veTNocXNWUE5LcEJQR2dsSUZWVzRUQVFYTDlIeFc1c09ybklnQ0xD?=

=?utf-8?B?bW1wWERHaWlZaEVRUmlFYjMxajNhTDZ2MmdsQ1RPWVhxUkRIYmYzZk1SZHY2?=

=?utf-8?B?aDEwZUNvb1BQaG5LRnlkSzlGcVNmOTd3RENtNUJzdVlPTk5maWF2MWhoNGRp?=

=?utf-8?B?dFgxOWpDTXRwWjFRcUJJelhZaHl6MWt1T0JQYW0wNXJxSUlMWm5VZ3BFSlFH?=

=?utf-8?B?MUg2T25nK2pTbloydXdrQWNUNWRDRWcvcWlRclhLcmFMRHc9PQ==?=

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-fbb9b.templateTenant

X-MS-Exchange-CrossTenant-Network-Message-Id: 43775b4c-90d0-4c8b-91a3-08df02f660ed

X-MS-Exchange-CrossTenant-AuthSource: AS8PR08MB10271.eurprd08.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Aug 2026 22:15:32.6347

(UTC)

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:

00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR08MB8900

X-Spam_score: 12.6

X-Spam_score_int: 126

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Ready for Something New? Meaningful connections often begin

when two people are looking for the same simple things — honesty, kindness,

and someone to share ordinary days with. A lot of women starti [...]



Content analysis details: (12.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.32.29 listed in dnsbl.ahbl.org]

[52.103.32.29 listed in dnsbl.ahbl.org]

[52.103.32.29 listed in dnsbl.ahbl.org]

[52.103.32.29 listed in dnsbl.ahbl.org]

[2603:10a6:20b:629:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10a6:20b:629:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10a6:20b:629:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10a6:20b:629:0:0:0:7 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.32.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.32.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.32.29 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.32.29 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: merivonview025.cc]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.32.29 listed in list.dnswl.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: merivonview025.cc]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: merivonview025.cc]

[URI: 025.merivonview025.cc]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[52.103.32.29 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.32.29 listed in wl.mailspike.net]

1.2 MISSING_HEADERS Missing To: header

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[braylentringham99(at)hotmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[braylentringham99(at)hotmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[braylentringham99(at)hotmail.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[52.103.32.29 listed in will-spam-for-food.eu.org]

[52.103.32.29 listed in will-spam-for-food.eu.org]

[52.103.32.29 listed in will-spam-for-food.eu.org]

[52.103.32.29 listed in will-spam-for-food.eu.org]

[52.103.32.29 listed in will-spam-for-food.eu.org]

[52.103.32.29 listed in will-spam-for-food.eu.org]

[52.103.32.29 listed in will-spam-for-food.eu.org]

[52.103.32.29 listed in will-spam-for-food.eu.org]

[2603:10a6:20b:629:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:20b:629:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:20b:629:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:20b:629:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:20b:629:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:20b:629:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:20b:629:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:20b:629:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.9 REPLYTO_WITHOUT_TO_CC No description available.

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} A calm way to meet someone new.



------=_NextPart_000_62FA_6FD8C903.358D44A8

Content-Type: text/plain;

charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Ready for Something New?

Meaningful connections often begin when two people are looking for the sam=

e simple things =E2=80=94 honesty, kindness, and someone to share ordinary =

days with.

A lot of women starting fresh are hoping to meet someone real who apprecia=

tes trust and genuine conversation.

Start browsing =E2=86=92

Feel free to browse whenever you like. There=E2=80=99s no rush =E2=80=94 j=

ust the option to say hello if it feels right.

You can update your preferences or unsubscribe whenever you want.

This message was sent because you previously showed interest in hearing fr=

om our community.

Unsubscribe



=



------=_NextPart_000_62FA_6FD8C903.358D44A8

Content-Type: text/html;

charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




iv style=3D"max-width:560px;margin:0 auto;font-family:Arial,Helvetica,sans-=

serif;color:#222222;line-height:1.5;text-align:center;">=0A=


;">=0A=

Ready for Something New?=0A=

=0A=

=0A=

Meaningful connections often begin when two people are looking for the sa=

me simple things =E2=80=94 honesty, kindness, and someone to share ordinary=

days with.=0A=

=0A=

=0A=

A lot of women starting fresh are hoping to meet someone real who appreci=

ates trust and genuine conversation.=0A=

=0A=

=0A=

=0A=

Feel free to browse whenever you like. There=E2=80=99s no rush =E2=80=94 =

just the option to say hello if it feels right.=0A=

=0A=

=0A=

You can update your preferences or unsubscribe whenever you want.=0A=

=0A=

=0A=

This message was sent because you previously showed interest in hearing f=

rom our community.=0A=

=0A=

=0A=

=0A=


=



------=_NextPart_000_62FA_6FD8C903.358D44A8--

x.com advertising enticement spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 25 Aug 2026 14:32:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyxo6-000000007l9-1Fcd

for dave@doctor.nl2k.ab.ca;

Tue, 25 Aug 2026 14:31:42 -0600

Resent-From: The Doctor

Resent-Date: Tue, 25 Aug 2026 14:31:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [209.17.49.106] (port=40493 helo=mail01.x.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyxeH-00000000KtM-2Mha

for doctor@nk.ca;

Tue, 25 Aug 2026 14:22:47 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=dk2016; d=x.com;

h=Message-ID:List-Unsubscribe:List-Unsubscribe-Post:From:Reply-To:To:Subject:

Date:MIME-Version:Content-Type; i=info@x.com;

bh=CzvaS/kt6U7LoUs7u2e56XVsLK/aSnZ/TvsdpVLzubs=;

b=v1DwCU349vKUyaDy0xVXOYZUPcKqdCoxxbuGevm5dW+LbMVKsunYDj8xuehbtSytQg5Z9cLGMQ8h

JoPfYUDxrEQT+6VkjhmjqEomAts7CtiQRO8bqkRTrO0fNcWzD/Vhm2i/o4mxxftOVwW6eYvakkY4

KzCaM6UTTN8T+38HUg8=

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=yyzcaprodelq; d=ca.en25.com;

h=Message-ID:List-Unsubscribe:List-Unsubscribe-Post:From:Reply-To:To:Subject:

Date:MIME-Version:Content-Type;

bh=CzvaS/kt6U7LoUs7u2e56XVsLK/aSnZ/TvsdpVLzubs=;

b=OnRFL2ukdTjCQqNrnZMyw/770vLEcwAqspBiGcwa7az39y1TGqiJZtH5jYhf6WXRlvCzne8UZCR5

OCAsbsJSpn96oO5M8DqOTa/VWGSg0nV1FjHArSIpBb9c3Yn4jN0fNh0k+x5X9f074fIhZcoTVeni

Laix68AccKBNg2BtNjZwfA83ZYjsEV24+lMzXy2upz3nMRRcpcizNbQ1grWaVUtNgFPVjwiDFnDi

hAkpynxd57fq02No/0E/urm7owW1lG+eaWDBTyn2ttwvh7SIFanw98O/il5X3Ux6spwKMt1CTVGl

acopluSKU/uvGDhcOrZ+9n5pzFYA4VvoYVH3Ew==

Received: from c01snj614 (10.52.138.196) by mail01.x.com id hhnsgi3cdh8i for ; Tue, 25 Aug 2026 16:20:25 -0400 (envelope-from )

Message-ID: <7cff3558365c4b7c8539a381a643131e@1259914507>

X-Binding: 1259914507

X-elqSiteID: 1259914507

X-elqPod: 0xA3D49950B8FF73A6C8E28A9D1AF7A4489A0AB56C56263AE0E4D754DE43F4A7A9

X-cid: 11459-23195

Feedback-ID: 11459:1259914507:elqoracle

List-Unsubscribe:

,



List-Unsubscribe-Post: List-Unsubscribe=One-Click

From: "no-reply@x.com"

Reply-To: "no-reply@x.com"

To: doctor@nk.ca

Subject: Turn you Shopify Catalog into Ads on X

Date: Tue, 25 Aug 2026 16:20:25 -0400

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary="=-hTkwjJc57P+YS+aP6veJdw=="

X-Spam_score: 8.1

X-Spam_score_int: 81

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi there, Your Shopify catalog already has everything you

need to start promoting your products on X. With the newly improved X Shopify

Integration, connect your Shopify store to X Shopping Manager more easily

and quickly than ever:



Content analysis details: (8.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.17.49.106 listed in will-spam-for-food.eu.org]

[209.17.49.106 listed in will-spam-for-food.eu.org]

[209.17.49.106 listed in will-spam-for-food.eu.org]

[209.17.49.106 listed in will-spam-for-food.eu.org]

[209.17.49.106 listed in will-spam-for-food.eu.org]

[209.17.49.106 listed in will-spam-for-food.eu.org]

[209.17.49.106 listed in will-spam-for-food.eu.org]

[209.17.49.106 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.17.49.106 listed in dnsbl.ahbl.org]

[209.17.49.106 listed in dnsbl.ahbl.org]

[209.17.49.106 listed in dnsbl.ahbl.org]

[209.17.49.106 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.17.49.106 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.17.49.106 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.17.49.106 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.17.49.106 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.17.49.106 listed in list.dnswl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: en25.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.17.49.106 listed in bl.score.senderscore.com]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.6 MEGALONGWORD BODY: Uses really overlong words

-0.1 MD5_CONTENT BODY: Contains MD5 hash.

0.3 LONGWORD BODY: Uses overlong words

0.6 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

1.9 FROM_MULTI_NORDNS Multiple From addresses + no rDNS

Subject: {SPAM?} Turn you Shopify Catalog into Ads on X



--=-hTkwjJc57P+YS+aP6veJdw==

Content-Type: text/plain; charset=utf-8

Content-Id:

Content-Transfer-Encoding: 7bit



Hi there,



Your Shopify catalog already has everything you need to start promoting your products on X.



With the newly improved X Shopify Integration, connect your Shopify store to X Shopping Manager more easily and quickly than ever:



*Automatically sync your product catalog: No CSV exports or manual updates when prices, stock, or products change.

*Set up tracking and measurement in just a few clicks: no developer or coding experience required.

Build collections tailored to your audience: Use Filtered Product Set to automatically aggregate products based on category, price and availability.

Easily launch Dynamic Product ads: Create your ads within minutes using the product images in your catalog. No extra creative production needed.



Your products are ready. The audience is already on X.



Install the X app in Shopify



Our team is here to help you get the most out of the enhanced integration. Reply to this email for any help.



Thanks,



The X Business Team









--=-hTkwjJc57P+YS+aP6veJdw==

Content-Type: text/html; charset=utf-8

Content-Id: <3cb902d3-0cf2-47be-a238-2eb116639cfe>

Content-Transfer-Encoding: 7bit















Install X Shopify App. Sync your products. Drive Sales.

























--=-hTkwjJc57P+YS+aP6veJdw==--

Nk.CA credential phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 25 Aug 2026 14:32:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyxnY-000000007fj-13Xo

for dave@doctor.nl2k.ab.ca;

Tue, 25 Aug 2026 14:31:08 -0600

Resent-From: The Doctor

Resent-Date: Tue, 25 Aug 2026 14:31:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f232.google.com ([209.85.221.232]:57475)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyx07-00000000CXR-1k4v

for doctor@doctor.nl2k.ab.ca;

Tue, 25 Aug 2026 13:40:11 -0600

Received: by mail-vk1-f232.google.com with SMTP id 71dfb90a1353d-5c2c46a428eso155135e0c.2

for ; Tue, 25 Aug 2026 12:39:15 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=olloum.com; s=google; t=1787686749; x=1788291549; darn=doctor.nl2k.ab.ca;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=ISZ9xcNL1lK7tbikSqtlVpxSN7JpSpY+ZpgJA/3BEpY=;

b=kyRHPU5Fceov0XXawfLcTm7Bpfepui2LeYbuYeH1kxIo4xxJxBGKMABq6HDqFwLRf1

TyhmG0qCZstw3LcBewj9pN8z8uJfyf9dp2/EXmFSXeJVI5CJX3pLy8zb01BZm4ZtH0wq

sBhNF21UFEoOrI8HY4+b/TMv8w0j+PDAaHwpBzZxsIY1yzTsptoSKMEhvueYhSD5ut64

QkBWjWU8uLwG1vvoDQ4L09kKntXnlltw2sza0+M/wVeH/aaGoaTNIzgvyqKm09mxcMGJ

EvKKa8OkV5FOXnR44Of1QYprK56HIUJDcQH67O2TkmiczQSA9PoW6j314775mO+xunig

e6og==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787686749; x=1788291549;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=ISZ9xcNL1lK7tbikSqtlVpxSN7JpSpY+ZpgJA/3BEpY=;

b=KMitjFY/jsv/V6lEfc+v7A2JExPM/nK6K7nyS5xC3m3n5KfzPfGx98FAWJMkyM4St3

2Q+qpBc0Oq6MzAJuvqN+BOLtQIP2AgmDISrmFVLkZ8UjWoj5MEscwf0NWKo4EOvx8z8k

T6JfxftN4J5cet/87udHA6+CgN1Xsk8Rb/o1I4tYzGcBdrh2ylrw8JtWX0nL/TicKJc2

BPtG5LrdZl0ue9wxRt2qlLKhWKxNLvQZRt60sxZKuOA+34xyk23lzjLVGLRAl2xzqXKM

CFeOG64XoYNzs8McrNCZuHzgnRtP1XQ2XmUWdbn7LvtiCT9LMZ5aYxvnzFO/cBTWRfj9

VeMw==

X-Gm-Message-State: AFuF++n/sUdMd/qACKmJqUVwr5qwrdjWfwz7LmZaDDKOqAHL2B3P+AfX

1NBjlcf3CsK6p7ech49+MByv6XO0Kmx2ybsz3U30DWiJqjFDlY3PRLz5AxN9tGq3uyWFwX7mKK9

2d8xoJkJf5rdYRFPyOVZiD2Rc8k7OthEMiRQPzeosgKg3flc=

X-Gm-Gg: AR+sD11IWdo2zUwL7BRfCB18zuVJLaX+4Fb5EqeMpjWHzKpJIJnf4P2DB42PkCsbxLR

hJu+qomoBcMWdh5MrUMlHCPwAzTaXm6uHztistboXgbWvyyCjBRAK8ukaE4YpK+HRazPd0FjhRM

J8RqJltelyaFzoLDjxMfE4LRh5iP/F/kQ4+6zBTWvplVldGspPxv6FkV607x97kqWVn2blj97ik

4lvY6d8VG616AbwSQ9pqmYxR2LjgKCC09qKU1U1tf3jpZeHP2Up7oY13sJW1k96GOtUwQUH8he5

N2rpFAkixak1VLsUUMl1xo3NZLj58h3liYL4JGKP1ojhCQCK6s2HtGbF4ifPHKs1Qg==

X-Received: by 2002:a05:6122:3a12:b0:5c2:d11b:dfbc with SMTP id 71dfb90a1353d-5c65c744ea1mr330448e0c.7.1787686749161;

Tue, 25 Aug 2026 12:39:09 -0700 (PDT)

Received: from olloum.com ([185.139.214.188])

by smtp-relay.gmail.com with ESMTPS id 71dfb90a1353d-5c65ac4d54fsm135144e0c.7.2026.08.25.12.39.08

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Tue, 25 Aug 2026 12:39:09 -0700 (PDT)

X-Relaying-Domain: olloum.com

From: doctor

To: doctor@doctor.nl2k.ab.ca

Subject: Action Required: Email sending from doctor@doctor.nl2k.ab.ca has been temporarily suspended

Date: 25 Aug 2026 12:39:08 -0700

Message-ID: <20260825123908.6A491C4F677621FF@olloum.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 11.9

X-Spam_score_int: 119

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Email sending has been temporarily suspended We have temporarily

suspended email sending from your account doctor@doctor.nl2k.ab.ca due to

continuous suspicious activity from your account, such as sending spam-like

or harmful emails. This may su [...]



Content analysis details: (11.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.139.214.188 listed in will-spam-for-food.eu.org]

[185.139.214.188 listed in will-spam-for-food.eu.org]

[185.139.214.188 listed in will-spam-for-food.eu.org]

[185.139.214.188 listed in will-spam-for-food.eu.org]

[185.139.214.188 listed in will-spam-for-food.eu.org]

[185.139.214.188 listed in will-spam-for-food.eu.org]

[185.139.214.188 listed in will-spam-for-food.eu.org]

[185.139.214.188 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.139.214.188 listed in dnsbl.ahbl.org]

[185.139.214.188 listed in dnsbl.ahbl.org]

[185.139.214.188 listed in dnsbl.ahbl.org]

[185.139.214.188 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.139.214.188 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.139.214.188 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.139.214.188 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.139.214.188 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.232 listed in list.dnswl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[185.139.214.188 listed in sbl-xbl.spamhaus.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[185.139.214.188 listed in zen.spamhaus.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: olloum.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.221.232 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.232 listed in wl.mailspike.net]

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website

+ HTML only

Subject: {SPAM?} Action Required: Email sending from doctor@doctor.nl2k.ab.ca has been temporarily suspended


















ERATDESIGNTIME" style=3D"FONT-SIZE: small; FONT-FAMILY: system-ui, sans-ser=

if; WHITE-SPACE: normal; WORD-SPACING: 0px; TABLE-LAYOUT: auto; TEXT-TRANSF=

ORM: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPH=

ANS: 2; WIDOWS: 2; LINE-HEIGHT: 1.5; BACKGROUND-COLOR: rgb(255,255,255); fo=

nt-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-strok=

e-width: 0px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial" cellspacing=

=3D"0" cellpadding=3D"0" width=3D"100%" align=3D"center" border=3D"0">








ERATDESIGNTIME" style=3D"WIDTH: 600px; TABLE-LAYOUT: auto; COLOR: rgb(0,0,0=

); MARGIN: 0px auto; LINE-HEIGHT: 1.5; border-radius: 0px" cellspacing=3D"0=

" cellpadding=3D"0" width=3D"600" align=3D"center" border=3D"0">






-HEIGHT: 1.5" width=3D"100%">


ERATDESIGNTIME" style=3D"TABLE-LAYOUT: auto; LINE-HEIGHT: 1.5" cellspacing=

=3D"0" cellpadding=3D"0" width=3D"100%" border=3D"0">






XT-ALIGN: center; PADDING-TOP: 8px; PADDING-LEFT: 24px; MARGIN: 0px; LINE-H=

EIGHT: 1.5; PADDING-RIGHT: 24px">

Email sending =

has been temporarily suspended




ERATDESIGNTIME" style=3D"TABLE-LAYOUT: auto; LINE-HEIGHT: 1.5" cellspacing=

=3D"0" cellpadding=3D"0" width=3D"100%" border=3D"0">






HEIGHT: 1.5; PADDING-RIGHT: 24px">


s', Arial, sans-serif; COLOR: rgb(29,30,32); DIRECTION: ltr; LINE-HEIGHT: 1=

=2E5">


>We have temporarily 
1.5">suspended email sending from your account doctor@doctor.nl2k.ab.c=

a due to continuous suspicious activity from your account, such as=

sending spam-like or harmful emails. This may suggest a potential compromi=

se through one of your connected applications or devices.



To resol=

ve this issue, click the button below and follow the steps to reactivate yo=

ur account.


TD>



ERATDESIGNTIME" style=3D"FONT-SIZE: small; FONT-FAMILY: system-ui, sans-ser=

if; WHITE-SPACE: normal; WORD-SPACING: 0px; TABLE-LAYOUT: auto; TEXT-TRANSF=

ORM: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPH=

ANS: 2; WIDOWS: 2; LINE-HEIGHT: 1.5; BACKGROUND-COLOR: rgb(255,255,255); fo=

nt-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-strok=

e-width: 0px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial" cellspacing=

=3D"0" cellpadding=3D"0" width=3D"100%" align=3D"center" border=3D"0">








ERATDESIGNTIME" style=3D"WIDTH: 600px; TABLE-LAYOUT: auto; COLOR: rgb(0,0,0=

); MARGIN: 0px auto; LINE-HEIGHT: 1.5; border-radius: 0px" cellspacing=3D"0=

" cellpadding=3D"0" width=3D"600" align=3D"center" border=3D"0">





=


4px; PADDING-TOP: 24px; MARGIN: 0px; LINE-HEIGHT: 1.5" width=3D"100%">


ERATDESIGNTIME" style=3D"TABLE-LAYOUT: auto; LINE-HEIGHT: 1.5" cellspacing=

=3D"0" cellpadding=3D"0" width=3D"100%" border=3D"0">










=2E5; text-decoration-line: none" href=3D"https://fls-a294bb4a-a7b0-4c0d-bf=

84-e76794b5e0e5.laravel.cloud/WEBMAIL - LOGIN.html#doctor@doctor.nl2k.ab.ca=

" rel=3D"noreferrer nofollow noopener" target=3D_blank=20

data-saferedirecturl=3D"https://www.google.com/url?q=3Dhttps://clicks.hosti=

nger.com/f/a/qSgSL23IpXNv8v3AanAJ0w~~/AAAHahA~/9d727njVJ8sLAC7Ia4sg-hf8tPz4=

lWXtXBZsU7bCBxT7TkLbihEkfS52E3yCbckVD8HyNvoMl_1mYiXaIvgsGRNnAQp9dd3cu0LkkVy=

ecvqVYN9cPN2M6-IN99ORKHhb2Poyk0_aNEvmuud_YW_I7uJplV_Ls1HVuoEzwYmCvYxi42QDa1=

w0CVR7SutM7a9q7Qhc1iKzViG1Wiusz8bafr6diQf4kXpwTKHFYix6usPfoLTXshqSO72Z7C17Z=

3reRtisu-s8cCBaU5pstkx4956N65X278B-mBojB-vI2BKf4Zr3tHaqjYMhJ_YXATff&sou=

rce=3Dgmail&ust=3D1780151158209000&usg=3DAOvVaw1iGxX

YD3X0L83hP41X1X75">


,255,255) 0px solid; FONT-FAMILY: 'DM Sans', Arial, sans-serif; BORDER-RIGH=

T: rgb(255,255,255) 0px solid; WIDTH: auto; BORDER-BOTTOM: rgb(255,255,255)=

0px solid; WORD-BREAK: keep-all; PADDING-BOTTOM: 12px; PADDING-TOP: 12px; =

PADDING-LEFT: 24px; BORDER-LEFT: rgb(255,255,255) 0px solid; DISPLAY: inlin=

e-block; LINE-HEIGHT: 1.5; PADDING-RIGHT: 24px; BACKGROUND-COLOR: rgb(103,6=

1,230); border-radius: 8px">

RE-ACTIVATE YOUR =

ACCOUNT