Wealthsimple Phish from microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 14 Sep 2026 07:16:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x66Ws-00000000AUZ-2EMu

for dave@doctor.nl2k.ab.ca;

Mon, 14 Sep 2026 07:15:26 -0600

Resent-From: The Doctor

Resent-Date: Mon, 14 Sep 2026 07:15:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from dyulo.hfwxhl.com ([137.116.150.29]:36889)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x65qt-00000000Ixu-2GKt

for sales@nk.ca;

Mon, 14 Sep 2026 06:32:11 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=dyulo.hfwxhl.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:List-Unsubscribe:

Reply-To; i=wealthsimplegksrsv@dyulo.hfwxhl.com;

bh=rnVmpdpnPISVDmSPEWNTQnLnYTITPXDE6w26eSM1T/o=;

b=Kwo816tPI8BZOaCapb5Ev5QEAKLsAJ/ZRhk4nUkemRqKPMoj8vO318EIM8wEVaDV71fkkF3CQ/32

ciyXgGhDZWR3CSKybgtpNdbX/LAn3yVNsiUObsnVAe8femrLyLI7IbrluMv/43Brzz4CTYBWAfOL

6BZAJLACtnjBeD/CmL6TZVCAGcjnHCHcp0BNKHnRO+JkAudyBqgBFd6eYcDPuqy0MHPnCN9V2UbZ

+xnghTidetaSEDxrZReavtLxHIt7XTlZKrjsbOAGDQ2FXeoWQo6edtNvn8VOYbUORphDOfTgesHU

O2N5nI9EIuEnf38qo6FkHd9KUlypuv6BimrkBQ==

Content-Type: multipart/alternative;

boundary="===============2852584810219868925=="

MIME-Version: 1.0

From: Wealthsimple investing

To: sales@nk.ca

Subject: Some of your account details are expiring

Date: Mon, 14 Sep 2026 08:31:10 -0400

Message-ID: <178938907096.31015.3710612434067910723@dyulo.hfwxhl.com>

List-Unsubscribe:

Reply-To: feedback@wealthsimple.com

Feedback-ID: campaign:wealthsimple.com:mailer

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello sales, We noticed that a few details on your account

have expired or are missing. To keep everything running smoothly, we ask

you to update them at your earliest convenience. Account: sales@nk.ca Reference:

24326945 Details to review: - ID verification documents - Registered address

and contact details



Content analysis details: (8.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[137.116.150.29 listed in will-spam-for-food.eu.org]

[137.116.150.29 listed in will-spam-for-food.eu.org]

[137.116.150.29 listed in will-spam-for-food.eu.org]

[137.116.150.29 listed in will-spam-for-food.eu.org]

[137.116.150.29 listed in will-spam-for-food.eu.org]

[137.116.150.29 listed in will-spam-for-food.eu.org]

[137.116.150.29 listed in will-spam-for-food.eu.org]

[137.116.150.29 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[137.116.150.29 listed in dnsbl.ahbl.org]

[137.116.150.29 listed in dnsbl.ahbl.org]

[137.116.150.29 listed in dnsbl.ahbl.org]

[137.116.150.29 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[137.116.150.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[137.116.150.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[137.116.150.29 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[137.116.150.29 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[137.116.150.29 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} Some of your account details are expiring



--===============2852584810219868925==

Content-Type: text/plain; charset=windows-1252

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Hello sales,



We noticed that a few details on your account have expired or are

missing. To keep everything running smoothly, we ask you to update

them at your earliest convenience.



Account: sales@nk.ca

Reference: 24326945

Details to review:

- ID verification documents

- Registered address and contact details



Update your details:

https://degaocn.com/?email=sales@nk.ca&uid=dXgOuuRrJHrNodnd3vb3aACz



It only takes a minute or two - and it helps us keep your account

safe.



Warm regards,

The Wealthsimple team



---

This email was sent automatically to sales@nk.ca.

If this message was not meant for you, you can safely ignore it.



--===============2852584810219868925==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit















Some of your account details are expiring































































































Wealthsimple


A note from Wealthsimple


Some of your account
details are expiring


Hello sales,



We noticed that a few details on your account have expired or are missing. To keep everything running smoothly, we ask you to update them at your earliest convenience.












Update your details




It only takes a minute or two - and it helps us keep your account safe.
























Account


sales@nk.ca


Reference


77476547


Details to review


ID verification documents
Registered address and contact details




Warm regards,



The Wealthsimple team




This email was sent automatically to sales@nk.ca.


If this message was not meant for you, you can safely ignore it.





Help

 · 

Privacy

 · 

Terms



Copyright Wealthsimple Technologies Inc. All rights reserved.














--===============2852584810219868925==--

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 14 Sep 2026 07:15:14 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x66WY-00000000ARq-2Dnq

for dave@doctor.nl2k.ab.ca;

Mon, 14 Sep 2026 07:15:06 -0600

Resent-From: The Doctor

Resent-Date: Mon, 14 Sep 2026 07:15:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out196-36.us.a.dm.aliyun.com ([47.90.196.36]:48075)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x62RM-000000000kj-1ILH

for root@nk.ca;

Mon, 14 Sep 2026 02:53:37 -0600

X-AliDM-RcptTo: cm9vdEBuay5jYQ==

Feedback-ID: default:vip@vip.rymat.ltd:alibabak_WebBatch:512257

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=vip.rymat.ltd; s=aliyun-cn-hangzhou;

t=1789375828; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=6pi/Qxg25geYGF6Be3ENsaNENAlX9dlsrSY1Enn3DLg=;

b=gMWLYoCOkCSCHtkWSx5fwYwdQLhFp1FedEJkUGEGveh5+YDDwP6gEEZbFxtFM9GZEn3L0rnCZY+SZGNXGONv1EogDdph1T8Mr1MzstcQEPVuQzwGq7sPcBc7hSeIZDX88XlR1woYVnAvlDf3m0moLnl2y2tBV2TvtV+E1uHeE5c=

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dm-fbl.aliyuncs.com; s=feedback;

t=1789375828; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=6pi/Qxg25geYGF6Be3ENsaNENAlX9dlsrSY1Enn3DLg=;

b=thpKba9i8XB0jHVc11KPWX7wTDC7yWnZC4DFSiU5yCBMlcsMMNGh+KRvfvBYogiBhMxCkajfmJZJobmsdhKyFUf5YgZ43iLgFwMVcbferaQeQkYTpmzLNSrGW7pcWrbFOdeS1wYzrV2CgRBcXw9r4pdJBAt/dJoWcekpBmf3X1Q=

Received: from chitu-hsf(mailfrom:vip@vip.rymat.ltd fp:ma_600000353236039918 cluster:AY35D)

by smtp.aliyun-inc.com(127.0.0.1);

Mon, 14 Sep 2026 16:49:55 +0800

Date: Mon, 14 Sep 2026 16:49:55 +0800

From: "Chris Liu"

To:

Reply-To:

Message-ID:

Subject: =?UTF-8?B?UHJlbWl1bSBGdW5jdGlvbmFsIENoZW1pY2FsIEFkZGl0aXZlcyBNYW51ZmFjdHVyZXI=?=

X-Priority: 3

MIME-Version: 1.0

X-EnvId: 600000353236039919

X-AliDM-Settings: eyJPdXRib3VuZElwIjp7IklwTGlzdCI6W10sIklwUG9vbElkIjoiIn0sIlVuc3Vic2NyaWJlIjp7IkZpbHRlckxldmVsIjoiZGVmYXVsdCIsIkxpbmtUeXBlIjoiZGVmYXVsdCJ9LCJWZXJzaW9uIjoiMS4wIn0=

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 5.5

X-Spam_score_int: 55

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Partner, This is Chris from Tianjin Eclat Co., Ltd (subsidiary

of Hebei Anjiefa Building Materials Co., Ltd), a leading manufacturer of

functional chemical additives since 1992. Operating a 34,000-square-meter

[...]



Content analysis details: (5.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[47.90.196.36 listed in will-spam-for-food.eu.org]

[47.90.196.36 listed in will-spam-for-food.eu.org]

[47.90.196.36 listed in will-spam-for-food.eu.org]

[47.90.196.36 listed in will-spam-for-food.eu.org]

[47.90.196.36 listed in will-spam-for-food.eu.org]

[47.90.196.36 listed in will-spam-for-food.eu.org]

[47.90.196.36 listed in will-spam-for-food.eu.org]

[47.90.196.36 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[47.90.196.36 listed in dnsbl.ahbl.org]

[47.90.196.36 listed in dnsbl.ahbl.org]

[47.90.196.36 listed in dnsbl.ahbl.org]

[47.90.196.36 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[47.90.196.36 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[47.90.196.36 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[47.90.196.36 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[47.90.196.36 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[47.90.196.36 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.4 SALES_REPLY Your parents named you sales?

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[47.90.196.36 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} =?UTF-8?B?UHJlbWl1bSBGdW5jdGlvbmFsIENoZW1pY2FsIEFkZGl0aXZlcyBNYW51ZmFjdHVyZXI=?=




px">
: 14pxfont-family:Arial">Dear Partner,


t-align: justify;font-family: Arial;font-size: 14px">
y: =E5=BE=AE=E8=BD=AF=E9=9B=85=E9=BB=91;font-size: 14px"> 


tyle=3D"margin: 0 0 0;text-align: justify;font-family: Arial;font-size: 14px">=


pxfont-family:Arial">This is Chris from Tianjin Eclat Co., Ltd (subsidiary of =

Hebei Anjiefa Building Materials Co., Ltd), a leading manufacturer of function=

al chemical additives since 1992. Operating a 34,000-square-meter facility wit=

h 120+ employees and 15 technicians, we supply high-grade fine chemicals to gl=

obal markets.


ily: Arial;font-size: 14px">
=85=E9=BB=91;font-size: 14pxfont-family:Arial">We provide tailored, one-stop s=

upply solutions featuring a comprehensive portfolio designed for diverse indus=

trial and architectural applications:


-align: justify;font-family: Arial;font-size: 14px">
: =E5=BE=AE=E8=BD=AF=E9=9B=85=E9=BB=91;font-size: 14pxfont-family:Arial">
=


nt-size: 14px">Tile Adhesives & Grouts
an>


ize: 14px">External Thermal Insulation Composi=

te Systems (ETICS/EIFS)


y;font-family: Arial;font-size: 14px">Water-Ba=

sed Coatings


ly: Arial;font-size: 14px">Petroleum Extractio=

n


ont-size: 14px">Emulsion Polymerization=


: 14px">Detergent Industry


"margin: 0 0 0;text-align: justify;font-family: Arial;font-size: 14px">
tyle=3D"font-size: 14px">Paper Industry


xt-align: justify;font-family: Arial;font-size: 14px">
: 14px">Textile Printing & Dyeing


-align: justify;font-family: Arial;font-size: 14px">
14px">Ceramic Industry


;font-family: Arial;font-size: 14px">
=AF=E9=9B=85=E9=BB=91;font-size: 14px"> 


llspacing=3D"0" style=3D"text-align: justify;font-family: 'Times New Roman';fo=

nt-size: 13px;margin-left: 7px;border: none">

gn=3D"center" style=3D"width: 554px;padding: 0 7px;border-width: 1px;border-co=

lor: windowtext">


;font-size: 14px">
px">Core Products


"center" style=3D"width: 554px;padding: 0 7px;border-left-width: 1px;border-le=

ft-color: windowtext;border-right-width: 1px;border-right-color: windowtext;bo=

rder-top: none;border-bottom-width: 1px;border-bottom-color: windowtext">


yle=3D"margin: 0 0 0;text-align: left;font-family: Arial;font-size: 14px">
ong>


Arial;font-size: 14px">RDP (Redispersible Polymer Powder):
pan style=3D"font-size: 14px">Enhances flexibility, adhesion, and crack resist=

ance in tile adhesives, ETICS/EIFS, and repair mortars.


margin: 0 0 0;text-align: left;font-family: Arial;font-size: 14px">
=3D"font-size: 14px"> 


ft;font-family: Arial;font-size: 14px">HPMC(Hydroxypr=

opyl methylcellulose): Serves as a hi=

gh-efficiency water-retaining agent, thickener, and anti-sagging modifier for =

dry-mix mortars and water-based coatings.


text-align: left;font-family: Arial;font-size: 14px">
14px"> 


: Arial;font-size: 14px">HEC(Hydroxyethyl cellulose)<=

/strong>: Delivers super=

ior high-shear rheology, thickening, and protective colloid properties for lat=

ex paints, personal care, and oilfield applications.


gin: 0 0 0;text-align: left;font-family: Arial;font-size: 14px">
"font-size: 14px"> 


font-family: Arial;font-size: 14px">PCE (Polycarboxyl=

ate Ether): Del=

ivers ultra-high water reduction, superior fluidity, and slump retention for a=

dvanced concrete and self-leveling formulations.


0 0 0;text-align: left;font-family: Arial;font-size: 14px">
t-size: 14px"> 


-family: Arial;font-size: 14px">PP 
ong>Fiber: Provides three-dimens=

ional crack arrest and reinforcement for high-performance concrete, waterproof=

ing, and road engineering.


t;font-family: Arial;font-size: 14px">

pan>


y;font-family: Arial;font-size: 14px">
=BD=AF=E9=9B=85=E9=BB=91;font-size: 14px"> 


0 0 0;text-align: justify;font-family: Arial;font-size: 14px">
font-family: =E5=BE=AE=E8=BD=AF=E9=9B=85=E9=BB=91;font-size: 14px">
"https://i.postimg.cc/vb2DFHJt/EDM-package-chris.jpg"/>


margin: 0 0 0;text-align: justify;font-family: Arial;font-size: 14px">
yle=3D"font-family: =E5=BE=AE=E8=BD=AF=E9=9B=85=E9=BB=91;font-size: 14px">

>


;font-family: 'Times New Roman';font-size: 13px;margin-left: 7px;border: none"=

>
>

0 7px;border-width: 1px;border-color: windowtext">


rial;font-size: 14px">
: 15px">Why partner with us?


er-left-width: 1px;border-left-color: windowtext;border-right-width: 1px;borde=

r-right-color: windowtext;border-top: none;border-bottom-width: 1px;border-bot=

tom-color: windowtext">


14px;text-indent: 0">


-family: Arial;font-size: 14px;text-indent: 0">Tailored Formulations:<=

/strong> We adjust molecular weight, degr=

ee of substitution, and active solids according to your requirement and specif=

ication.


x;text-indent: 0"> 


"margin: 0 0 0;font-family: Arial;font-size: 14px;text-indent: 0">Supp=

ly Chain Reliability: Direct fac=

tory production ensures consistent lot-to-lot quality, competitive pricing, an=

d scalable bulk delivery.


;font-family: Arial;font-size: 14px">
=AE=E8=BD=AF=E9=9B=85=E9=BB=91;font-size: 14px"> 


>


y: Arial;font-size: 14px">
=85=E9=BB=91;font-size: 14px">


lign: justify;font-family: Arial;font-size: 14px">
=E5=BE=AE=E8=BD=AF=E9=9B=85=E9=BB=91;font-size: 14px"> 
//i.postimg.cc/hD18zP45/EDM-factory-chris.jpg"/>


0 0 0;text-align: justify;font-family: Arial;font-size: 14px">
font-size: 15px">


;font-family: Arial;font-size: 14px">We are co=

mmitted to delivering true one-stop supply services and tailored systematic so=

lutions for your business.If you are in=

terest
15px">ed in our products, please reach us directly
family: =E5=AE=8B=E4=BD=93;font-size: 15pxfont-family:Arial">on
yle=3D"font-size: 15px"> 
=93;font-size: 15pxfont-family:Arial">Whatsapp/Wechat
t-size: 15px"> or simply reply by E-mail


0 0;text-align: justify;font-family: Arial;font-size: 14px;text-indent: 0">
an style=3D"font-family: =E5=AE=8B=E4=BD=93;font-size: 15px"> 

=


x;">=

Best Regards


: 14px; text-indent: 0px;">
elvetica, sans-serif">Chris Liu


justify; font-size: 14px; text-indent: 0px;">
, helvetica, sans-serif">Tianjin Eclat Co., L=

td


//dm-cn.aliyuncs.com/trace/v1/report?bid=3D2620769&env=3D600000353236039919&ma=

c=3D512257&mf=3Dvip%40vip.rymat.ltd&msgid=3Dbab177de-cf52-413b-93b3-2fb0ae0cd9=

32%40alibaba.com&sac=3D0&tag=3DFinechemicalglobal1&tid=3D2620769&to=3Droot%40n=

k.ca&tpl=3D&ts=3D1789375795&type=3D1&url=3D&v=3D1.0&sign=3D5dfe0bdae753854485a=

cccc4384bf9ad&urlts=3D1789375828" alt=3D"" style=3D"display: none; width: 1px;=

height: 1px;" />

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 14 Sep 2026 07:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x66WC-00000000APL-2Bd3

for dave@doctor.nl2k.ab.ca;

Mon, 14 Sep 2026 07:14:44 -0600

Resent-From: The Doctor

Resent-Date: Mon, 14 Sep 2026 07:14:44 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out196-34.us.a.dm.aliyun.com ([47.90.196.34]:50511)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5zny-00000000C1J-1ov1

for root@nk.ca;

Mon, 14 Sep 2026 00:04:47 -0600

X-AliDM-RcptTo: cm9vdEBuay5jYQ==

Feedback-ID: default:vip@vip.roofandkeel.ltd:alibabak_WebBatch:526528

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=vip.roofandkeel.ltd; s=aliyun-cn-hangzhou;

t=1789365703; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=Pfz0nG38GhXFsNrwxV/8r3CmUqIwn8DHbeneW9HyEcg=;

b=kqF3HvqyTj8MaK514Vhf2ljHVIyGHfLypc1I9eeXmExFZ1wwJ3VBpoQTDb/jVkz/BkVwaBz439gV1Viz9crNbfpMClN1z1iCWv4GJ9NM+Xw49bIFQ8nNQE804bXoXxQBeaef4JRTVLogscgaueHkQBMcTvkufexL7bJNlTDZjRw=

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dm-fbl.aliyuncs.com; s=feedback;

t=1789365703; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=Pfz0nG38GhXFsNrwxV/8r3CmUqIwn8DHbeneW9HyEcg=;

b=0b8q7PMtto3gilXCFTxLaJ5t2KKgmiGvkqmcKGMnix9ThRQVsJ4PmaBejb9mJSZjGoEObw/DYXFMK1qwV+gqior/FiHJxSJSx/FJ17kXBoOBnwE69Ol9xwWRy2XSIiwVo3/Sa3w21kP3W68PHaxmP+7bYJmrKq0+R8f0GRMiL+E=

Received: from chitu-hsf(mailfrom:vip@vip.roofandkeel.ltd fp:ma_600000353207050990 cluster:AY35D)

by smtp.aliyun-inc.com(127.0.0.1);

Mon, 14 Sep 2026 13:59:58 +0800

Date: Mon, 14 Sep 2026 13:59:58 +0800

From: "HAIXING Machinery"

To:

Reply-To:

Message-ID: <97647ba5-0cda-4798-8e79-b2e76d8cc8a8@alibaba.com>

Subject: =?UTF-8?B?TWV0YWwgc3RlZWwgY29pbCAtIEhBSVhJTkc=?=

X-Priority: 3

MIME-Version: 1.0

X-EnvId: 600000353207050991

X-AliDM-Settings: eyJPdXRib3VuZElwIjp7IklwTGlzdCI6W10sIklwUG9vbElkIjoiIn0sIlVuc3Vic2NyaWJlIjp7IkZpbHRlckxldmVsIjoiZGVmYXVsdCIsIkxpbmtUeXBlIjoiZGVmYXVsdCJ9LCJWZXJzaW9uIjoiMS4wIn0=

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Sir/Madm, While reviewing manufacturers in the metal

pipe sector, I noticed your company work in production metal tube business.

We are a mill based in China, supplying cold-rolled, hot-rolled, and galvanized

s [...]



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[47.90.196.34 listed in will-spam-for-food.eu.org]

[47.90.196.34 listed in will-spam-for-food.eu.org]

[47.90.196.34 listed in will-spam-for-food.eu.org]

[47.90.196.34 listed in will-spam-for-food.eu.org]

[47.90.196.34 listed in will-spam-for-food.eu.org]

[47.90.196.34 listed in will-spam-for-food.eu.org]

[47.90.196.34 listed in will-spam-for-food.eu.org]

[47.90.196.34 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[47.90.196.34 listed in dnsbl.ahbl.org]

[47.90.196.34 listed in dnsbl.ahbl.org]

[47.90.196.34 listed in dnsbl.ahbl.org]

[47.90.196.34 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[47.90.196.34 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[47.90.196.34 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[47.90.196.34 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[47.90.196.34 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[47.90.196.34 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[47.90.196.34 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} =?UTF-8?B?TWV0YWwgc3RlZWwgY29pbCAtIEhBSVhJTkc=?=



Dear Sir/Madm,


tyle=3D"text-wrap-mode: nowrap;">


ode: nowrap;">While reviewing manufacturers in the metal pipe sector, I notice=

d your company work in production metal tube business. We are a mill based in =

China, supplying cold-rolled, hot-rolled, and galvanized steel coils to fabric=

ators across the world, and I believe we could be a dependable material partne=

r for your team.



pan>

Three things our partners m=

ention most often:


<=

/span>

1=E3=80=81Consistent qual=

ity =E2=80=94 every coil meets [JIS / ASTM / EN] specifications, with mill cer=

tificates and test reports issued before loading. Third-party inspection (SGS,=

BV) can be arranged.

2=E3=

=80=81Reliable supply =E2=80=94 our annual capacity of 150000 tons and long-te=

rm mill allocations keep production slots open year-round, including peak seas=

ons.

3=E3=80=81Responsive=

service =E2=80=94 your dedicated account engineer responds within one busines=

s day, and shipping documentation is prepared ahead of each vessel.

=

If you are planning next quarter's =

material, I can send our specification sheets, a sample packing list, and reco=

rds of recent shipments to [region]. Or, if you prefer, we can arrange a short=

call to walk through your requirements.


-mode: nowrap;">

Whi=

ch would serve you better =E2=80=94 the documentation first, or a quick conver=

sation?


<=

p>Best regards,


le=3D"text-wrap-mode: nowrap;">Jodie 



MuuMuu Domain Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 14 Sep 2026 07:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x66W5-00000000AON-2Htm

for dave@doctor.nl2k.ab.ca;

Mon, 14 Sep 2026 07:14:37 -0600

Resent-From: The Doctor

Resent-Date: Mon, 14 Sep 2026 07:14:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from sw3.labevandadelreb2b.com ([45.82.64.131]:44623)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5zb7-00000000Aey-4AYB

for sales@nk.ca;

Sun, 13 Sep 2026 23:51:30 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=1788735923; d=labevandadelreb2b.com;

h=Date:To:From:Subject:Message-ID:List-Unsubscribe:MIME-Version:Content-Type:

Content-Transfer-Encoding; i=support@sw1.labevandadelreb2b.com;

bh=BcLtixA97fNHHw9NaULJRD9zxsh22lB013puADQO2JE=;

b=C3yK3wmTIvc9RBumBYrxlHDe+JdkmGDMsi+LZymSSFYc7RqzghsXOwGXD7D8oSrJueiry7P5iT7O

rx1qbkS4C2z1eDQsv5vvGV+Yo3UB22WL9Pmu83R5SEG/Qs1VzYOC4FRDbBj2Gs37VqovWNe8PDKP

RMqzV7vIRDxSVr5GLbo=

Date: Mon, 14 Sep 2026 05:47:53 +0000

To: sales@nk.ca

From: muumuu

Subject: =?UTF-8?B?44OJ44Oh44Kk44Oz5pyJ5Yq55pyf6ZmQ5YiH44KM44Gu44GK55+l44KJ44Gb?=

=?UTF-8?B?772c5pu05paw5omL57aa44GN44KS44GK6aGY44GE44GX44G+44GZ?=

Message-ID:

List-Unsubscribe: mailto:bounce835-6raZfHdAKKWG0vj@sw1.labevandadelreb2b.com?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1ccc546a43fa676041324798f32006dfd"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--1ccc546a43fa676041324798f32006dfd

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit













ドメイン有効期限切れのお知らせ











































ステータス：期限切れ





















ドメイン有効期限切れのお知らせ







お客様のドメインサービスの有効期限が切れていることを確認いたしました。







現在、ドメインは 「期限切れ（Expired）」 の状態となっています。

æ›´æ–°æ‰‹ç¶šããŒè¡Œã‚ã‚Œãªã„å ´åˆã€ãƒ‰ãƒ¡ã‚¤ãƒ³ã«é–¢é€£ã™ã‚‹ã‚µãƒ¼ãƒ“ã‚¹ãŒåœæ­¢ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚















サービス停止の可能性があるもの







ドメインの利用

Webサイトへのアクセス

ドメインに関連するWebメール

その他、ドメインに紐づく関連サービス













サービスを継続してご利用いただくには、ドメインの更新手続きを行ってください。

æ›´æ–°å¯èƒ½ãªæœŸé–“ã«ã¯åˆ¶é™ãŒã‚ã‚‹å ´åˆãŒã‚ã‚Šã¾ã™ã®ã§ã€ã§ãã‚‹ã ã‘æ—©ã‚ã®ãŠæ‰‹ç¶šãã‚’ãŠã™ã™ã‚ã„ãŸã—ã¾ã™ã€‚















ドメインを更新する













※ 更新料金、更新可能期間、および復旧条件などについては、お客様の契約内容をご確認ください。



















本メールはドメインサービスに関する重要なお知らせです。

ご不明な点がございましたら、公式サポート窓口までお問い合わせください。



























--1ccc546a43fa676041324798f32006dfd

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable












1.0">

=E3=83=89=E3=83=A1=E3=82=A4=E3=83=B3=E6=9C=89=E5=8A=B9=E6=9C=9F=<br /><br /> =E9=99=90=E5=88=87=E3=82=8C=E3=81=AE=E3=81=8A=E7=9F=A5=E3=82=89=E3=81=9B</t=<br /><br /> itle><br /><br /> </head><br /><br /> <br /><br /> <body style=3D"margin:0; padding:0; background-color:#f5f7f7; font-family:A=<br /><br /> rial, 'Hiragino Kaku Gothic ProN', Meiryo, sans-serif; color:#333333;"><br /><br /> <br /><br /> <table width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" border=3D"0" st=<br /><br /> yle=3D"background-color:#f5f7f7; padding:40px 15px;"><br /><br /> <tr><br /><br /> <td align=3D"center"><br /><br /> <br /><br /> <table width=3D"600" cellpadding=3D"0" cellspacing=3D"0" border=3D"=<br /><br /> 0" style=3D"max-width:600px; width:100%; background:#ffffff; border-radius:=<br /><br /> 8px; overflow:hidden;"><br /><br /> <br /><br /> <!-- Header --><br /><br /> <tr><br /><br /> <td style=3D"padding:28px 35px; border-bottom:1px solid #eeeeee=<br /><br /> ;"><br /><br /> <img src=3D"data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4=<br /><br /> wIiBlbmNvZGluZz0iVVRGLTgiPz4KPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC=<br /><br /> 9zdmciIHZpZXdCb3g9IjAgMCAyMzIxLjQzIDg0My41NSI+CiAgPGcgZmlsbD0iIzM5M2M0MSI+C=<br /><br /> iAgICA8cGF0aCBkPSJtMjExNS4zMiA4MzEuODhjLS4wOCAxLjA0LjcyIDEuOSAxLjc3IDEuOWgy=<br /><br /> MS4yOGMxLjA0IDAgMS45Ny0uODUgMi4wNS0xLjlsMy42Ni00OC43NWMuMDgtMS4wNC0uNzItMS4=<br /><br /> 5LTEuNzctMS45aC0yMS4yOGMtMS4wNiAwLTEuOTYuODUtMi4wNSAxLjl6Ij48L3BhdGg+CiAgIC=<br /><br /> A8cGF0aCBkPSJtMjIzOC41MyA3ODEuMjRjLTEuMDQgMC0xLjgzLjg1LTEuNzYgMS45bDMuNyA0O=<br /><br /> C43NWMuMDggMS4wNC45OSAxLjkgMi4wNCAxLjloMjEuM2MxLjA0IDAgMy4wNC0uODUgMi45NS0x=<br /><br /> LjlsLTQuOS00OC43NWMtLjA2LTEuMDQtLjk5LTEuOS0yLjA1LTEuOXoiPjwvcGF0aD4KICAgIDx=<br /><br /> wYXRoIGQ9Im0yMjYxLjE2IDc1Ny4wOWMxLjA0IDAgMS45LS44NSAxLjktMS45di0yMC41YzAtMS=<br /><br /> 4wNC0uODUtMS45LTEuOS0xLjloLTU2LjkyYy0xLjA2IDAtMS45MS0uODUtMS45MS0xLjl2LTE0L=<br /><br /> jQ1YzAtMS4wNC0uODUtMS45LTEuOS0xLjloLTIwLjVjLTEuMDQgMC0xLjkuODUtMS45IDEuOXYx=<br /><br /> NC40NWMwIDEuMDQtLjg3IDEuOS0xLjkxIDEuOWgtNTYuNTJjLTEuMDQgMC0xLjkuODUtMS45IDE=<br /><br /> uOXYyMC41YzAgMS4wNC44NSAxLjkgMS45IDEuOWg1Ni41MmMxLjA0IDAgMS45MS44NSAxLjkxID=<br /><br /> EuOXY3Mi45YzAgMS4wNC44NSAxLjkxIDEuOSAxLjkxaDIwLjVjMS4wNCAwIDEuOS0uODcgMS45L=<br /><br /> TEuOTF2LTcyLjljMC0xLjA0Ljg1LTEuOSAxLjkxLTEuOXoiPjwvcGF0aD4KICAgIDxwYXRoIGQ9=<br /><br /> Im0xNzE3LjEgNzk3Ljg4Yy0uNS41LS41IDEuMzEgMCAxLjgxbDE1LjM3IDE1LjM3Yy41LjQ5IDE=<br /><br /> uMzEuNDkgMS44MSAwbDU1LjctNTUuN2MuNS0uNSAxLjMxLS41IDEuODEgMGw3Mi43MyA3Mi44N2=<br /><br /> MuNTIuNSAxLjMyLjUgMS44MiAwbDE1LjM3LTE1LjM2Yy41LS41LjUtMS4zMiAwLTEuODFsLTg5L=<br /><br /> jkxLTkwLjA4Yy0uNS0uNS0xLjMxLS41LTEuODEgMGwtNzIuOSA3Mi45eiI+PC9wYXRoPgogICAg=<br /><br /> PHBhdGggZD0ibTE5MjIuMzMgODMyLjUxYy0uMDkuNy40MSAxLjI4IDEuMTMgMS4yOGgyMy42Yy4=<br /><br /> 2OSAwIDEuMzQtLjU4IDEuNDMtMS4yOGwxMi43Ny0xMDYuMTNjLjA4LS43LS40NC0xLjI3LTEuMT=<br /><br /> QtMS4yN2gtMjMuNmMtLjcgMC0xLjM0LjU3LTEuNDIgMS4yN3oiPjwvcGF0aD4KICAgIDxwYXRoI=<br /><br /> GQ9Im0yMDE3Ljk0IDcyNS4xMmMtLjcyIDAtMS4yMi41Ny0xLjEzIDEuMjdsMTIuODggMTA2LjEz=<br /><br /> Yy4wOC43LjczIDEuMjcgMS40MyAxLjI3aDIzLjZjLjcgMCAxLjIxLS41NyAxLjEzLTEuMjdsLTE=<br /><br /> yLjg4LTEwNi4xM2MtLjA5LS43LS43My0xLjI3LTEuNDMtMS4yN3oiPjwvcGF0aD4KICA8L2c+Ci=<br /><br /> AgPHBhdGggZD0ibTIyNzQuOTUgNzQyLjg5YzAgMS4wNC44NSAxLjkxIDEuOSAxLjkxaDE0LjQ0Y=<br /><br /> zEuMDYgMCAxLjktLjg3IDEuOS0xLjkxdi0yOC4wNGMwLTEuMDQtLjg0LTEuOS0xLjktMS45aC0x=<br /><br /> NC40NGMtMS4wNCAwLTEuOS44NS0xLjkgMS45eiIgZmlsbD0iIzFmN2FjYyI+PC9wYXRoPgogIDx=<br /><br /> wYXRoIGQ9Im0yMzAyLjk4IDc0Mi44OWMwIDEuMDQuODQgMS45MSAxLjkgMS45MWgxNC40NGMxLj=<br /><br /> A0IDAgMS45LS44NyAxLjktMS45MXYtMjguMDRjMC0xLjA0LS44NS0xLjktMS45LTEuOWgtMTQuN=<br /><br /> DRjLTEuMDYgMC0xLjkuODUtMS45IDEuOXoiIGZpbGw9IiMxZjdhY2MiPjwvcGF0aD4KICA8Y2ly=<br /><br /> Y2xlIGN4PSIxODY2LjI3IiBjeT0iNzMwLjkiIGZpbGw9IiMxZjdhY2MiIHI9IjE3Ljk1Ij48L2N=<br /><br /> pcmNsZT4KICA8cGF0aCBkPSJtMjA3Ny42IDcxMi45NWMtOS45IDAtMTcuOTUgOC4wMy0xNy45NS=<br /><br /> AxNy45NXM4LjA0IDE3Ljk1IDE3Ljk1IDE3Ljk1IDE3Ljk1LTguMDQgMTcuOTUtMTcuOTUtOC4wM=<br /><br /> y0xNy45NS0xNy45NS0xNy45NXoiIGZpbGw9IiMxZjdhY2MiPjwvcGF0aD4KICA8cGF0aCBkPSJt=<br /><br /> OTg2LjQ2IDc5NS4zNWMtLjIzIDcuNDgtMy41MSAxNy41NS0xMy40NiAxNy41NS0xLjEzIDAtMTA=<br /><br /> uMjkgMC0xMy4wMS0xMC43Ni0uNDUtMS4zNC0uOS0zLjczLS45LTcuMjQgMC0xMi4xIDcuMjQtMT=<br /><br /> YuNzUgMTMuMzUtMTYuNzUgNy4zNSAwIDE0LjM3IDYuMDEgMTQuMDMgMTcuMjF6bS00MC42LTUxL=<br /><br /> jEydjc5Ljg2aDEzLjQ2di01Ljg4YzIuOTQgMy4zOSA4LjAzIDcuNTggMTUuNSA3LjU4IDEzLjQ2=<br /><br /> IDAgMjUuNjktMTEuNzYgMjUuNjktMzAuMnMtMTItMjkuNzUtMjQuNzgtMjkuNzVjLTYuMjIgMC0=<br /><br /> xMS44OCAyLjI1LTE2LjQgNi40NXYtMjguMDVoLTEzLjQ2em05NS4wMiAyMy4zLTEwLjc1IDQyLj=<br /><br /> E5LTEyLjU2LTQyLjE5aC0xNC41OWwyMC40NyA1Ny42OWMwIDEuMTMtMS41OCAzLjYyLTMuMTcgN=<br /><br /> C42NC0yLjE1IDEuNDctNS4wOSAxLjQ3LTYuMTEgMS40Ny0xLjM2IDAtMi4zOC0uMTEtMy42Mi0u=<br /><br /> MzN2MTEuODZjMS41OC4yNCAzLjczLjY5IDguMTQuNjkgMTAuNTIgMCAxNC43LTQuMiAxOC41NS0=<br /><br /> xNi4wNmwzLjE3LTEwLjYzIDE0LjM3LTQ5LjMzaC0xMy45MXoiIGZpbGw9IiMwMDViYWMiPjwvcG=<br /><br /> F0aD4KICA8cGF0aCBkPSJtMTM3Ny44NyA4MjUuNzljLS40MSAwLS45My0uMjktMS4xNC0uNjRsL=<br /><br /> TMzLjYyLTU1LjA0LTE4LjI5IDYyLjk4Yy0uMTEuMzktLjU0LjcyLS45Ni43MmgtMzUuMjljLS40=<br /><br /> IDAtLjY0LS4zMS0uNTItLjcybDM3LjIxLTExNy44M2MuMTMtLjM5LjU3LS43My45Ny0uNzNoMTM=<br /><br /> uMjZjLjQxIDAgLjkzLjI5IDEuMTYuNjRsNDUuMzMgNzAuMjkgNDUuMzMtNzAuMjljLjIzLS4zNS=<br /><br /> 43NC0uNjQgMS4xNi0uNjRoMTMuMjVjLjQxIDAgLjg1LjM0Ljk4LjczbDM3LjIxIDExNy44M2MuM=<br /><br /> TMuNC0uMTEuNzItLjUzLjcyaC0zNS4yOGMtLjQxIDAtLjg1LS4zMy0uOTctLjcybC0xOC4yNy02=<br /><br /> Mi45OC0zMy42MiA1NS4wNGMtLjIxLjM1LS43NC42NC0xLjE0LjY0aC0xNi4yNHptLTg4LjIxLTU=<br /><br /> 4LjcxYy0uMDgtLjMzLS4zOC0uNi0uNzMtLjZoLTEwMC41NWMtNS4zMiAwLTkuNjMgNC4zMS05Lj=<br /><br /> YzIDkuNjNzNC4zMSA5LjYzIDkuNjMgOS42M2g1OS43NWMtNy4xMSAxOC44LTMxLjE3IDMyLjYzL=<br /><br /> TU5Ljc1IDMyLjYzLTM0LjE3IDAtNjEuODctMTkuNzgtNjEuODctNDQuMTlzMjcuNy00NC4xOCA2=<br /><br /> MS44Ny00NC4xOGMxOC42OCAwIDM1LjQgNS45MSA0Ni43NSAxNS4yMy4wNC4wNC4wOC4wNi4xMS4=<br /><br /> xLjEzLjA4LjI2LjEzLjQxLjEzaDQxLjA5Yy40MSAwIC43NS0uMzQuNzUtLjc1IDAtLjE4LS4wOC=<br /><br /> 0uMzQtLjE5LS40OC0uMDEtLjAzLS4wNC0uMDUtLjA2LS4wOC0xNy40OC0xOC42My01MC43My0zM=<br /><br /> S4yMS04OC44Ny0zMS4yMS01Ni4zMSAwLTEwMS45NCAyNy40Mi0xMDEuOTQgNjEuMjNzNDUuNjQg=<br /><br /> NjEuMjQgMTAxLjk0IDYxLjI0IDEwMS45NS0yNy40MSAxMDEuOTUtNjEuMjRjMC0yLjM5LS4yNC0=<br /><br /> 0Ljc2LS42OC03LjA5em0yOTMuOTMtNTQuMTNjNTYuMzEgMCAxMDEuOTUgMjcuNDEgMTAxLjk1ID=<br /><br /> YxLjIzcy00NS42NSA2MS4yMy0xMDEuOTUgNjEuMjMtMTAxLjk1LTI3LjQxLTEwMS45NS02MS4yM=<br /><br /> yA0NS42NS02MS4yMyAxMDEuOTUtNjEuMjN6bTAgMTA1LjQyYzM0LjE3IDAgNjEuODktMTkuNzgg=<br /><br /> NjEuODktNDQuMTlzLTI3LjcxLTQ0LjE5LTYxLjg5LTQ0LjE5LTYxLjg5IDE5Ljc4LTYxLjg5IDQ=<br /><br /> 0LjE5IDI3LjcxIDQ0LjE5IDYxLjg5IDQ0LjE5eiIgZmlsbD0iIzAwNWJhYyI+PC9wYXRoPgogID=<br /><br /> xwYXRoIGQ9Im05OTEuMTEgMjI3LjY3LTQ4LjUxLTgyLjk5Yy0uODQtMS40My0yLjY4LTEuOTEtN=<br /><br /> C4xMS0xLjA4LS45Mi41NC0xLjQ5IDEuNTMtMS40OSAyLjU5djExOS4zOGMwIDUuMzYtNC4zNCA5=<br /><br /> LjcxLTkuNyA5LjcxaC00Mi42OGMtNS4zNiAwLTkuNy00LjM1LTkuNy05Ljcxdi0yMzkuODJjMC0=<br /><br /> 1LjM2IDQuMzQtOS43MSA5LjctOS43MWg0Ni45OWMzLjM1IDAgNi40NiAxLjczIDguMjMgNC41OG=<br /><br /> w2Mi40NSAxMDEuNjljMS40NSAyLjM2IDQuNTMgMy4wOSA2Ljg4IDEuNjUuNjctLjQxIDEuMjMtL=<br /><br /> jk4IDEuNjUtMS42NWw2Mi40NC0xMDEuNjljMS43Ny0yLjg0IDQuODgtNC41NyA4LjIzLTQuNThs=<br /><br /> NDctLjAyYzUuMzYgMCA5LjcgNC4zNCA5LjcgOS43djE4Ny44NXMwIDUyLjAxIDAgNTIuMDFjMCA=<br /><br /> 1LjM2LTQuMzQgOS43MS05LjcgOS43MWgtNDIuNjhjLTUuMzYgMC05LjctNC4zNS05LjctOS43MX=<br /><br /> YtMTE5LjU1YzAtMS42Ni0xLjM0LTMtMy0zLTEuMDYgMC0yLjA0LjU2LTIuNTggMS40N2wtNDkuN=<br /><br /> DkgODMuMjNjLTEuNzcgMi44Ni00Ljg5IDQuNi04LjI1IDQuNmgtMTMuNGMtMy4zOCAwLTYuNTIt=<br /><br /> MS43Ni04LjI4LTQuNjV6bTc0MC43NyAwLTQ4LjUxLTgyLjk5Yy0uODQtMS40My0yLjY4LTEuOTE=<br /><br /> tNC4xMS0xLjA4LS45Mi41NC0xLjQ5IDEuNTMtMS40OSAyLjU5djExOS4zOGMwIDUuMzYtNC4zNC=<br /><br /> A5LjcxLTkuNyA5LjcxaC00Mi42OGMtNS4zNiAwLTkuNy00LjM1LTkuNy05Ljcxdi0yMzkuODJjM=<br /><br /> C01LjM2IDQuMzQtOS43MSA5LjctOS43MWg0Ni45OWMzLjM1IDAgNi40NiAxLjczIDguMjMgNC41=<br /><br /> OGw2Mi40NSAxMDEuNjljMS40NSAyLjM2IDQuNTMgMy4wOSA2Ljg4IDEuNjUuNjctLjQxIDEuMjM=<br /><br /> tLjk4IDEuNjUtMS42NWw2Mi40NC0xMDEuNjljMS43Ny0yLjg0IDQuODgtNC41NyA4LjIzLTQuNT=<br /><br /> hsNDctLjAyYzUuMzYgMCA5LjcgNC4zNCA5LjcgOS43djE4Ny44NXMwIDUyLjAxIDAgNTIuMDFjM=<br /><br /> CA1LjM2LTQuMzQgOS43MS05LjcgOS43MWgtNDIuNjhjLTUuMzYgMC05LjctNC4zNS05LjctOS43=<br /><br /> MXYtMTE5LjU1YzAtMS42Ni0xLjM0LTMtMy0zLTEuMDYgMC0yLjA0LjU2LTIuNTggMS40N2wtNDk=<br /><br /> uNDkgODMuMjNjLTEuNzcgMi44Ni00Ljg5IDQuNi04LjI1IDQuNmgtMTMuNGMtMy4zOCAwLTYuNT=<br /><br /> ItMS43Ni04LjI4LTQuNjV6bS00ODYuOTggNDcuNjJjLTI1LjU1IDAtNDQuMTEtOC4xNi01NC43M=<br /><br /> y0yMi44Ny0xMC42My0xNC43MS0xNS45NC0zMi45OC0xNS45NC01NC43OXYtMTA0LjgzYzAtNS4z=<br /><br /> NiA0LjM0LTkuNzEgOS43LTkuNzFoNDMuMjJjNS4zNSAwIDkuNyA0LjM1IDkuNyA5LjcxdjEwMy4=<br /><br /> zMWMwIDguNjMgMi4xNSAxNS4yMiA2LjQ1IDE5Ljc5czEwLjM3IDYuODUgMTguMjIgNi44NWM0Lj=<br /><br /> gxIDAgMTAuNS0xLjI3IDE3LjA4LTMuODEgMTAuOTgtNC4yMyAxOC4yMi0xNC43OCAxOC4yMi0yN=<br /><br /> i41NXYtOTkuNTljMC01LjM2IDQuMzQtOS43MSA5LjctOS43MWg0My4yMmM1LjM1IDAgOS43IDQu=<br /><br /> MzUgOS43IDkuNzF2MTcyLjc5YzAgNS4zNi00LjM0IDkuNzEtOS43IDkuNzFoLTQzLjIyYy01LjM=<br /><br /> 1IDAtOS43LTQuMzUtOS43LTkuNzF2LTMuODhzLTIuMjUuOTctMTMuNDcgNS4xOGMtMTEuMjMgNC=<br /><br /> 4yMS0yNC43NyA4LjQxLTM4LjQzIDguNDF6bTc0MC43OCAwYy0yNS41NSAwLTQ0LjExLTguMTYtN=<br /><br /> TQuNzMtMjIuODctMTAuNjMtMTQuNzEtMTUuOTQtMzIuOTgtMTUuOTQtNTQuNzl2LTEwNC44M2Mw=<br /><br /> LTUuMzYgNC4zNC05LjcxIDkuNy05LjcxaDQzLjIyYzUuMzUgMCA5LjcgNC4zNSA5LjcgOS43MXY=<br /><br /> xMDMuMzFjMCA4LjYzIDIuMTUgMTUuMjIgNi40NSAxOS43OXMxMC4zNyA2Ljg1IDE4LjIyIDYuOD=<br /><br /> VjNC44MSAwIDEwLjUtMS4yNyAxNy4wOC0zLjgxIDEwLjk4LTQuMjMgMTguMjItMTQuNzggMTguM=<br /><br /> jItMjYuNTV2LTk5LjU5YzAtNS4zNiA0LjM0LTkuNzEgOS43LTkuNzFoNDMuMjJjNS4zNSAwIDku=<br /><br /> NyA0LjM1IDkuNyA5LjcxdjE3Mi43OWMwIDUuMzYtNC4zNCA5LjcxLTkuNyA5LjcxaC00My4yMmM=<br /><br /> tNS4zNSAwLTkuNy00LjM1LTkuNy05Ljcxdi0zLjg4cy0yLjI1Ljk3LTEzLjQ3IDUuMThjLTExLj=<br /><br /> IzIDQuMjEtMjQuNzcgOC40MS0zOC40MyA4LjQxem0tNTE5LjU1IDBjLTI1LjU1IDAtNDQuMTEtO=<br /><br /> C4xNi01NC43My0yMi44Ny0xMC42My0xNC43MS0xNS45NC0zMi45OC0xNS45NC01NC43OXYtMTA0=<br /><br /> LjgzYzAtNS4zNiA0LjM0LTkuNzEgOS43LTkuNzFoNDMuMjJjNS4zNSAwIDkuNyA0LjM1IDkuNyA=<br /><br /> 5LjcxdjEwMy4zMWMwIDguNjMgMi4xNSAxNS4yMiA2LjQ1IDE5Ljc5czEwLjM3IDYuODUgMTguMj=<br /><br /> IgNi44NWM0LjgxIDAgMTAuNS0xLjI3IDE3LjA4LTMuODEgMTAuOTgtNC4yMyAxOC4yMi0xNC43O=<br /><br /> CAxOC4yMi0yNi41NXYtOTkuNTljMC01LjM2IDQuMzQtOS43MSA5LjctOS43MWg0My4yMmM1LjM1=<br /><br /> IDAgOS43IDQuMzUgOS43IDkuNzF2MTcyLjc5YzAgNS4zNi00LjM0IDkuNzEtOS43IDkuNzFoLTQ=<br /><br /> zLjIyYy01LjM1IDAtOS43LTQuMzUtOS43LTkuNzF2LTMuODhzLTIuMjUuOTctMTMuNDcgNS4xOG=<br /><br /> MtMTEuMjMgNC4yMS0yNC43NyA4LjQxLTM4LjQzIDguNDF6bTc0MC43OCAwYy0yNS41NSAwLTQ0L=<br /><br /> jExLTguMTYtNTQuNzMtMjIuODctMTAuNjMtMTQuNzEtMTUuOTQtMzIuOTgtMTUuOTQtNTQuNzl2=<br /><br /> LTEwNC44M2MwLTUuMzYgNC4zNC05LjcxIDkuNy05LjcxaDQzLjIyYzUuMzUgMCA5LjcgNC4zNSA=<br /><br /> 5LjcgOS43MXYxMDMuMzFjMCA4LjYzIDIuMTUgMTUuMjIgNi40NSAxOS43OXMxMC4zNyA2Ljg1ID=<br /><br /> E4LjIyIDYuODVjNC44MSAwIDEwLjUtMS4yNyAxNy4wOC0zLjgxIDEwLjk4LTQuMjMgMTguMjItM=<br /><br /> TQuNzggMTguMjItMjYuNTV2LTk5LjU5YzAtNS4zNiA0LjM0LTkuNzEgOS43LTkuNzFoNDMuMjJj=<br /><br /> NS4zNSAwIDkuNyA0LjM1IDkuNyA5LjcxdjE3Mi43OWMwIDUuMzYtNC4zNCA5LjcxLTkuNyA5Ljc=<br /><br /> xaC00My4yMmMtNS4zNSAwLTkuNy00LjM1LTkuNy05Ljcxdi0zLjg4cy0yLjI1Ljk3LTEzLjQ3ID=<br /><br /> UuMThjLTExLjIzIDQuMjEtMjQuNzcgOC40MS0zOC40MyA4LjQxem0tMTIwOS41NyAzMzguNWgtM=<br /><br /> TExLjIyYy02LjE5IDAtMTEuMi00Ljg3LTExLjItMTAuODd2LTI2OC41NmMwLTYuMDEgNS4wMi0x=<br /><br /> MC44NyAxMS4yLTEwLjg3aDExMS4yMmM0Ni41MSAwIDgxLjYyIDEzLjQ1IDEwNS4zMSA0MC4zNCA=<br /><br /> yMy42OSAyNi45IDM1LjU0IDYxLjI2IDM1LjU0IDEwMy4xIDAgNDQuOTctMTIuODcgODAuNjktMz=<br /><br /> guNjEgMTA3LjE2cy01OS44MiAzOS43LTEwMi4yNCAzOS43em0tMS4wNC0yMzIuMjRoLTQ3LjNjL=<br /><br /> TIuNzYgMC01LjAxIDIuMjQtNS4wMSA1LjAxdjE2NC4xN2MwIDIuNzYgMi4yNCA1LjAxIDUuMDEg=<br /><br /> NS4wMWg0NC4wNmMyMS42IDAgMzkuMzUtNy4xNyA1My4yMy0yMS41MSAxMy44OS0xNC4zNCAyMC4=<br /><br /> 4My0zNi44MyAyMC44My02Ny40NiAwLTI1LjM0LTUuOTQtNDUuODgtMTcuODItNjEuNjFzLTI5Lj=<br /><br /> U1LTIzLjYtNTMtMjMuNnptMjc1LjUzIDIzMi4yNGMtNjEuMDkgMC0xMTAuNjItNDcuMDEtMTEwL=<br /><br /> jYyLTEwOC42MXM0OS41Mi0xMDguNjEgMTEwLjYyLTEwOC42MSAxMTAuNjIgNDcuNDcgMTEwLjYy=<br /><br /> IDEwOC42MS00OS41MiAxMDguNjEtMTEwLjYyIDEwOC42MXptLjUtNTcuMDZjMjUuOTggMCA0Ny4=<br /><br /> wNS0yMi4zMiA0Ny4wNS01MS4wNXMtMjEuMDYtNTEuMDUtNDcuMDUtNTEuMDUtNDcuMDUgMjIuMS=<br /><br /> 00Ny4wNSA1MS4wNSAyMS4wNiA1MS4wNSA0Ny4wNSA1MS4wNXptNDAwLjU5LTE1OS45YzI3LjQgM=<br /><br /> CA0Ny4yNCA4LjMxIDU5LjUxIDI0LjkyczE4LjQxIDM3LjI0IDE4LjQxIDYxLjg3djExOS40NmMw=<br /><br /> IDYuMDYtNC44OCAxMC45Ny0xMC45MSAxMC45N2gtNDguODJjLTYuMDIgMC0xMC45MS00LjkxLTE=<br /><br /> wLjkxLTEwLjk3di0xMTcuNzRjMC05Ljc0LTIuMzUtMTcuMTktNy4wNi0yMi4zNC00LjcxLTUuMT=<br /><br /> YtMTEuMDYtNy43My0xOS4wNS03LjczLTUuOTkgMC0xMi42MyAxLjU4LTE5LjkxIDQuNzMtMTIuM=<br /><br /> zQgNS4zNC0yMC4zIDE3LjU0LTIwLjIxIDMwLjk4bC42NyAxMTIuMDRjLjA0IDYuMDYtNC44MiAx=<br /><br /> MS0xMC44NCAxMS4wNGgtNDguODJjLTYuMDIgMC0xMC45MS00LjkxLTEwLjkxLTEwLjk3di0xMTc=<br /><br /> uNzRjMC05Ljc0LTIuMzUtMTcuMTktNy4wNi0yMi4zNC00LjcxLTUuMTYtMTEuMDYtNy43My0xOS=<br /><br /> 4wNS03LjczLTUuNDIgMC0xMS40MiAxLjM2LTE3Ljk4IDQuMDgtMTEuNjYgNC44My0xOS4yNyAxN=<br /><br /> i4yMi0xOS4yNyAyOC44NHYxMTQuODljMCA2LjA2LTQuODggMTAuOTctMTAuOTEgMTAuOTdoLTQ4=<br /><br /> LjM5Yy02LjAyIDAtMTAuOTEtNC45MS0xMC45MS0xMC45N3YtMTk1LjI4YzAtNi4wNiA0Ljg4LTE=<br /><br /> wLjk3IDEwLjkxLTEwLjk3aDQ4LjM5YzYuMDIgMCAxMC45MSA0LjkxIDEwLjkxIDEwLjk3djQuMz=<br /><br /> djLjQzLS45MiA1LjA3LTMuMjQgMTMuOTEtNi45NyAxMy4yNy01LjU5IDI3LjQ3LTguMzggNDIuN=<br /><br /> i04LjM4IDE0LjI3IDAgMjYuNCAyLjQzIDM2LjM5IDcuM3MxOC4xMiAxMS4zMSAyNC40IDE5LjM0=<br /><br /> YzguNTYtNi41OSAxOS41NS0xMi42OCAzMi45Ny0xOC4yNiAxMy40MS01LjU5IDI3LjQtOC4zOCA=<br /><br /> 0MS45Ni04LjM4em0xOTcuNTcgMGMyNi43OCAwIDQ4LjI3IDguMjkgNjMuOTMgMjMuNzcgMTUuNj=<br /><br /> cgMTUuNDggMjMuNSAzMi40IDIzLjUgNTcuMzV2MTI1LjE0YzAgNi4wNi00Ljg5IDEwLjk3LTEwL=<br /><br /> jkxIDEwLjk3aC00OC42OGMtNi4wMyAwLTEwLjkxLTQuOTEtMTAuOTEtMTAuOTd2LTEuMXMtMTIu=<br /><br /> NiAxMi4wNy0zMy4yOCAxMi4wN2MtMjUuOTMgMC00NS43MS02LjIzLTU4LjM4LTE5LjEzLTEyLjY=<br /><br /> 4LTEyLjktMTkuMDItMjkuODItMTkuMDItNTAuNzUgMC0yMi4zNiA3LjQxLTM4LjkyIDIyLjIyLT=<br /><br /> Q5LjY3czM0LjE5LTE2LjEzIDU4LjEyLTE2LjEzaDMwLjM0Yy0xLjQ3LTYuODgtNS4xMS0xMS41N=<br /><br /> S05LjMtMTUuNzJzLTEwLjc5LTcuMTctMTkuNzYtNy41LTE3LjE2IDEuMjktMjcuNTYgMy44N2Mt=<br /><br /> NC42OCAxLjE2LTEwLjMzIDIuOTEtMTYuOTQgNS4yNS01LjY3IDIuMDEtMTEuODgtLjk3LTEzLjk=<br /><br /> tNi42NmwtMTEuNTctMzAuNTVjLTEuOTktNS41OS44MS0xMS43NiA2LjMxLTEzLjkxIDExLjI3LT=<br /><br /> QuNDIgMjEuMTctNy42NyAyOS42OS05Ljc2IDE2LjM4LTQuMDEgMzEuNTctNi41NyA0Ni4xLTYuN=<br /><br /> Td6bTExLjI3IDEyNS4zOWgtMjQuNzFjLTYuNDIgMC0xMS41OCAyLjMzLTE1LjQ4IDctMy45MSA0=<br /><br /> LjY3LTUuODYgMTAuMjktNS44NiAxNi44NiAwIDUuMTkgMS43NCA5LjY4IDUuMjMgMTMuNDhzNy4=<br /><br /> 3NCA1LjcgMTIuNzYgNS43YzUuMyAwIDEwLjgxLS40MSAxNi41My0zLjUyIDIuNDgtMS4zNSA1Lj=<br /><br /> Y3LTMuMzYgOS41Ny02LjA0IDQuMzYtMi45OSA2Ljk2LTcuOTMgNi45Ni0xMy4yMXYtMTUuMjdjM=<br /><br /> C0yLjc2LTIuMjQtNS4wMS01LjAxLTUuMDF6bTE3My41Ny0xMDguNTRjNi4wNSAwIDEwLjk1IDQu=<br /><br /> ODkgMTAuOTUgMTAuOTJ2MTc4LjM3YzAgNi4wMy00LjkgMTAuOTItMTAuOTUgMTAuOTJoLTQ4LjE=<br /><br /> 4Yy02LjA1IDAtMTAuOTUtNC44OS0xMC45NS0xMC45MnYtMTc4LjM3YzAtNi4wMyA0LjktMTAuOT=<br /><br /> IgMTAuOTUtMTAuOTJ6bS0yNC4yLTkwLjM0YzE5LjkgMCAzNi4wNCAxNS40NyAzNi4wNCAzNS4zO=<br /><br /> XMtMTYuMTMgMzUuMzktMzYuMDQgMzUuMzktMzYuMDQtMTUuMzItMzYuMDQtMzUuMzkgMTYuMTMt=<br /><br /> MzUuMzkgMzYuMDQtMzUuMzl6bTIwOS43IDczLjQ5YzI4Ljg3IDAgNDkuNTIgOC4zMSA2MS45NSA=<br /><br /> yNC45MnMxOC42NSAzNy4yNCAxOC42NSA2MS44N3YxMTkuNDZjMCA2LjA2LTQuOSAxMC45Ny0xMC=<br /><br /> 45NCAxMC45N2gtNDguNDNjLTYuMDQgMC0xMC45NC00LjkxLTEwLjk0LTEwLjk3di0xMTcuNzRjM=<br /><br /> C05Ljc0LTIuNjQtMTcuMTktNy45My0yMi4zNC01LjI5LTUuMTYtMTIuMzYtNy43My0yMS4yMi03=<br /><br /> LjczLTYgMC0xMyAxLjU4LTIxLjAxIDQuNzMtMTIuOTMgNS4wOS0yMS40NCAxNy41OC0yMS40NCA=<br /><br /> zMS40OHYxMTEuNjFjMCA2LjA2LTQuOSAxMC45Ny0xMC45NCAxMC45N2gtNDguNDNjLTYuMDQgMC=<br /><br /> 0xMC45NC00LjkxLTEwLjk0LTEwLjk3di0xOTUuMjhjMC02LjA2IDQuOS0xMC45NyAxMC45NC0xM=<br /><br /> C45N2g0OC40M2M2LjA0IDAgMTAuOTQgNC45MSAxMC45NCAxMC45N3Y1LjQ3czcuMzQtMy4yOSAx=<br /><br /> Ni45My03LjYzYzkuNTktNC4zNSAyOS4yMy04LjgxIDQ0LjM3LTguODF6IiBmaWxsPSIjMmIyYjJ=<br /><br /> iIiBmaWxsLXJ1bGU9ImV2ZW5vZGQiPjwvcGF0aD4KICA8cGF0aCBkPSJtNTIwLjcxIDUwOC4wNm=<br /><br /> MwIDYxLjk1IDQ0LjE3IDEwNiAxMDYuMDMgMTA2czEwNi4wMy00NC4wNSAxMDYuMDMtMTA2di00M=<br /><br /> DAuNDVjMC05NS43My0xMDAuOTUtMTM3LjY0LTE3MC42Ny04NC4wMmwtMTgxLjM0IDEzOS40NmMt=<br /><br /> MTAuMzYgNy41NC0xOC4zNyA3LjU0LTI4LjczIDBsLTE4MS4zNS0xMzkuNDZjLTQ2LjQyLTM1LjY=<br /><br /> 5LTExMi45OC0yNy4wMS0xNDguNjkgMTkuMzktMzUuNyA0Ni40LTI3LjAyIDExMi45NSAxOS40ID=<br /><br /> E0OC42NWwyNjAuMzUgMjAwLjIyYzM5LjYyIDMxIDg4LjY3IDMyLjAxIDEyOS4yOSAwIDQxLjI5L=<br /><br /> TMxLjc5IDY0Ljg2LTQ5LjkxIDcwLjcyLTU0LjM5IDguNzgtNi43MSAxOC45Ni0yLjA5IDE4Ljk2=<br /><br /> IDkuMzR2MTYxLjI1eiIgZmlsbD0iIzAwYmRhNiI+PC9wYXRoPgogIDxjaXJjbGUgY3g9IjEwOC4=<br /><br /> 2MSIgY3k9IjUwNS4wMyIgZmlsbD0iIzJiMmIyYiIgcj0iMTA4LjYxIj48L2NpcmNsZT4KPC9zdm=<br /><br /> c+Cg=3D=3D" alt=3D"" style=3D"display:block; max-width:180px; height:auto;"=<br /><br /> ><br /><br /> </td><br /><br /> </tr><br /><br /> <br /><br /> <!-- Status --><br /><br /> <tr><br /><br /> <td style=3D"padding:30px 35px 10px;"><br /><br /> <span style=3D"display:inline-block; background:#fce8e6; colo=<br /><br /> r:#c62828; font-size:13px; font-weight:bold; padding:7px 14px; border-radiu=<br /><br /> s:20px;"><br /><br /> =E3=82=B9=E3=83=86=E3=83=BC=E3=82=BF=E3=82=B9=EF=BC=9A=E6=9C=9F=E9=99=<br /><br /> =90=E5=88=87=E3=82=8C<br /><br /> </span><br /><br /> <br /><br /> </td><br /><br /> </tr><br /><br /> <br /><br /> <!-- Main Content --><br /><br /> <tr><br /><br /> <td style=3D"padding:15px 35px 35px;"><br /><br /> <br /><br /> <h1 style=3D"margin:0 0 20px; font-size:24px; line-height:1.5=<br /><br /> ; color:#222222;"><br /><br /> =E3=83=89=E3=83=A1=E3=82=A4=E3=83=B3=E6=9C=89=E5=8A=B9=<br /><br /> =E6=9C=9F=E9=99=90=E5=88=87=E3=82=8C=E3=81=AE=E3=81=8A=E7=9F=A5=E3=82=89=<br /><br /> =E3=81=9B<br /><br /> </h1><br /><br /> <br /><br /> <p style=3D"margin:0 0 18px; font-size:15px; line-height:1.9;=<br /><br /> "><br /><br /> =E3=81=8A=E5=AE=A2=E6=A7=98=E3=81=AE=E3=83=89=E3=83=A1=<br /><br /> =E3=82=A4=E3=83=B3=E3=82=B5=E3=83=BC=E3=83=93=E3=82=B9=E3=81=AE=E6=9C=89=<br /><br /> =E5=8A=B9=E6=9C=9F=E9=99=90=E3=81=8C=E5=88=87=E3=82=8C=E3=81=A6=E3=81=84=<br /><br /> =E3=82=8B=E3=81=93=E3=81=A8=E3=82=92=E7=A2=BA=E8=AA=8D=E3=81=84=E3=81=9F=<br /><br /> =E3=81=97=E3=81=BE=E3=81=97=E3=81=9F=E3=80=82<br /><br /> </p><br /><br /> <br /><br /> <p style=3D"margin:0 0 18px; font-size:15px; line-height:1.9;=<br /><br /> "><br /><br /> =E7=8F=BE=E5=9C=A8=E3=80=81=E3=83=89=E3=83=A1=E3=82=A4=<br /><br /> =E3=83=B3=E3=81=AF <strong style=3D"color:#c62828;">=E3=80=8C=E6=9C=9F=<br /><br /> =E9=99=90=E5=88=87=E3=82=8C=EF=BC=88Expired=EF=BC=89=E3=80=8D</strong> =<br /><br /> =E3=81=AE=E7=8A=B6=E6=85=8B=E3=81=A8=E3=81=AA=E3=81=A3=E3=81=A6=E3=81=84=<br /><br /> =E3=81=BE=E3=81=99=E3=80=82<br /><br /> =E6=9B=B4=E6=96=B0=E6=89=8B=E7=B6=9A=E3=81=8D=E3=81=8C=<br /><br /> =E8=A1=8C=E3=82=8F=E3=82=8C=E3=81=AA=E3=81=84=E5=A0=B4=E5=90=88=E3=80=81=<br /><br /> =E3=83=89=E3=83=A1=E3=82=A4=E3=83=B3=E3=81=AB=E9=96=A2=E9=80=A3=E3=81=99=<br /><br /> =E3=82=8B=E3=82=B5=E3=83=BC=E3=83=93=E3=82=B9=E3=81=8C=E5=81=9C=E6=AD=A2=<br /><br /> =E3=81=95=E3=82=8C=E3=82=8B=E5=8F=AF=E8=83=BD=E6=80=A7=E3=81=8C=E3=81=82=<br /><br /> =E3=82=8A=E3=81=BE=E3=81=99=E3=80=82<br /><br /> </p><br /><br /> <br /><br /> <!-- Warning Box --><br /><br /> <table width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" bor=<br /><br /> der=3D"0" style=3D"margin:25px 0; background:#f8fafa; border-left:4px solid=<br /><br /> #008470;"><br /><br /> <tr><br /><br /> <td style=3D"padding:18px 20px;"><br /><br /> <p style=3D"margin:0 0 10px; font-weight:bold; color:#2=<br /><br /> 22222;"><br /><br /> =E3=82=B5=E3=83=BC=E3=83=93=E3=82=B9=E5=81=9C=<br /><br /> =E6=AD=A2=E3=81=AE=E5=8F=AF=E8=83=BD=E6=80=A7=E3=81=8C=E3=81=82=E3=82=8B=<br /><br /> =E3=82=82=E3=81=AE<br /><br /> </p><br /><br /> <br /><br /> <ul style=3D"margin:0; padding-left:20px; font-size:14p=<br /><br /> x; line-height:1.9; color:#555555;"><br /><br /> <li>=E3=83=89=E3=83=A1=E3=82=A4=E3=83=B3=E3=81=AE=<br /><br /> =E5=88=A9=E7=94=A8</li><br /><br /> <li>Web=E3=82=B5=E3=82=A4=E3=83=88=E3=81=B8=E3=81=<br /><br /> =AE=E3=82=A2=E3=82=AF=E3=82=BB=E3=82=B9</li><br /><br /> <li>=E3=83=89=E3=83=A1=E3=82=A4=E3=83=B3=E3=81=AB=<br /><br /> =E9=96=A2=E9=80=A3=E3=81=99=E3=82=8BWeb=E3=83=A1=E3=83=BC=E3=83=AB</li><br /><br /> <li>=E3=81=9D=E3=81=AE=E4=BB=96=E3=80=81=E3=83=89=<br /><br /> =E3=83=A1=E3=82=A4=E3=83=B3=E3=81=AB=E7=B4=90=E3=81=A5=E3=81=8F=E9=96=A2=<br /><br /> =E9=80=A3=E3=82=B5=E3=83=BC=E3=83=93=E3=82=B9</li><br /><br /> </ul><br /><br /> </td><br /><br /> </tr><br /><br /> </table><br /><br /> <br /><br /> <!-- <p style=3D"margin:0 0 18px; font-size:15px; line-height=<br /><br /> :1.9;"> --><br /><br /> =E3=82=B5=E3=83=BC=E3=83=93=E3=82=B9=E3=82=92=E7=B6=99=<br /><br /> =E7=B6=9A=E3=81=97=E3=81=A6=E3=81=94=E5=88=A9=E7=94=A8=E3=81=84=E3=81=9F=<br /><br /> =E3=81=A0=E3=81=8F=E3=81=AB=E3=81=AF=E3=80=81=E3=83=89=E3=83=A1=E3=82=A4=<br /><br /> =E3=83=B3=E3=81=AE=E6=9B=B4=E6=96=B0=E6=89=8B=E7=B6=9A=E3=81=8D=E3=82=92=<br /><br /> =E8=A1=8C=E3=81=A3=E3=81=A6=E3=81=8F=E3=81=A0=E3=81=95=E3=81=84=E3=80=82<br /><br /> =E6=9B=B4=E6=96=B0=E5=8F=AF=E8=83=BD=E3=81=AA=E6=9C=9F=<br /><br /> =E9=96=93=E3=81=AB=E3=81=AF=E5=88=B6=E9=99=90=E3=81=8C=E3=81=82=E3=82=8B=<br /><br /> =E5=A0=B4=E5=90=88=E3=81=8C=E3=81=82=E3=82=8A=E3=81=BE=E3=81=99=E3=81=AE=<br /><br /> =E3=81=A7=E3=80=81=E3=81=A7=E3=81=8D=E3=82=8B=E3=81=A0=E3=81=91=E6=97=A9=<br /><br /> =E3=82=81=E3=81=AE=E3=81=8A=E6=89=8B=E7=B6=9A=E3=81=8D=E3=82=92=E3=81=8A=<br /><br /> =E3=81=99=E3=81=99=E3=82=81=E3=81=84=E3=81=9F=E3=81=97=E3=81=BE=E3=81=99=<br /><br /> =E3=80=82<br /><br /> </p><br /><br /> <br /><br /> <!-- CTA --><br /><br /> <table width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" bor=<br /><br /> der=3D"0" style=3D"margin:30px 0;"><br /><br /> <tr><br /><br /> <td align=3D"center"><br /><br /> <a href=3D"https://indonsi.trilliecobnb.com/gwe?4BHJBSH=<br /><br /> J=3D45kljiohnoi"<br /><br /> style=3D"display:inline-block; background:#008470; c=<br /><br /> olor:#ffffff; text-decoration:none; font-size:16px; font-weight:bold; paddi=<br /><br /> ng:14px 35px; border-radius:5px;"><br /><br /> =E3=83=89=E3=83=A1=E3=82=A4=E3=83=B3=E3=82=92=<br /><br /> =E6=9B=B4=E6=96=B0=E3=81=99=E3=82=8B<br /><br /> </a><br /><br /> </td><br /><br /> </tr><br /><br /> </table><br /><br /> <br /><br /> <p style=3D"margin:0; font-size:13px; line-height:1.8; color:=<br /><br /> #777777;"><br /><br /> =E2=80=BB =E6=9B=B4=E6=96=B0=E6=96=99=E9=87=91=E3=80=81=<br /><br /> =E6=9B=B4=E6=96=B0=E5=8F=AF=E8=83=BD=E6=9C=9F=E9=96=93=E3=80=81=E3=81=8A=<br /><br /> =E3=82=88=E3=81=B3=E5=BE=A9=E6=97=A7=E6=9D=A1=E4=BB=B6=E3=81=AA=E3=81=A9=<br /><br /> =E3=81=AB=E3=81=A4=E3=81=84=E3=81=A6=E3=81=AF=E3=80=81=E3=81=8A=E5=AE=A2=<br /><br /> =E6=A7=98=E3=81=AE=E5=A5=91=E7=B4=84=E5=86=85=E5=AE=B9=E3=82=92=E3=81=94=<br /><br /> =E7=A2=BA=E8=AA=8D=E3=81=8F=E3=81=A0=E3=81=95=E3=81=84=E3=80=82<br /><br /> </p><br /><br /> <br /><br /> </td><br /><br /> </tr><br /><br /> <br /><br /> <!-- Footer --><br /><br /> <tr><br /><br /> <td style=3D"padding:22px 35px; background:#fafafa; border-top:=<br /><br /> 1px solid #eeeeee;"><br /><br /> <p style=3D"margin:0; font-size:12px; line-height:1.7; color:=<br /><br /> #888888;"><br /><br /> =E6=9C=AC=E3=83=A1=E3=83=BC=E3=83=AB=E3=81=AF=E3=83=89=<br /><br /> =E3=83=A1=E3=82=A4=E3=83=B3=E3=82=B5=E3=83=BC=E3=83=93=E3=82=B9=E3=81=AB=<br /><br /> =E9=96=A2=E3=81=99=E3=82=8B=E9=87=8D=E8=A6=81=E3=81=AA=E3=81=8A=E7=9F=A5=<br /><br /> =E3=82=89=E3=81=9B=E3=81=A7=E3=81=99=E3=80=82<br><br /><br /> =E3=81=94=E4=B8=8D=E6=98=8E=E3=81=AA=E7=82=B9=E3=81=8C=<br /><br /> =E3=81=94=E3=81=96=E3=81=84=E3=81=BE=E3=81=97=E3=81=9F=E3=82=89=E3=80=81=<br /><br /> =E5=85=AC=E5=BC=8F=E3=82=B5=E3=83=9D=E3=83=BC=E3=83=88=E7=AA=93=E5=8F=A3=<br /><br /> =E3=81=BE=E3=81=A7=E3=81=8A=E5=95=8F=E3=81=84=E5=90=88=E3=82=8F=E3=81=9B=<br /><br /> =E3=81=8F=E3=81=A0=E3=81=95=E3=81=84=E3=80=82<br /><br /> </p><br /><br /> </td><br /><br /> </tr><br /><br /> <br /><br /> </table><br /><br /> <br /><br /> </td><br /><br /> </tr><br /><br /> </table><br /><br /> <br /><br /> </body><br /><br /> </html><br /><br /> <br /><br /> <br /><br /> --1ccc546a43fa676041324798f32006dfd--<br /><br /> <br /><br /> </div> <footer class="post-info"> <ul class="meta"> <li><span class="info-label">Categories: </span><a href="https://www.nk.ca/blog/index.php?/categories/25-Phish">Phish</a></li> <li><a href="/blog/index.php?/archives/19994-MuuMuu-Domain-Phish.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer> <!-- <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/" xmlns:dc="http://purl.org/dc/elements/1.1/"> <rdf:Description rdf:about="https://www.nk.ca/blog/index.php?/feeds/ei_19994.rdf" trackback:ping="https://www.nk.ca/blog/comment.php?type=trackback&entry_id=19994" dc:title="MuuMuu Domain Phish" dc:identifier="https://www.nk.ca/blog/index.php?/archives/19994-MuuMuu-Domain-Phish.html" /> </rdf:RDF> --> </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/19993-MYSQL-Auto-Tuner-spam.html">MYSQL Auto-Tuner spam</a></h2> <span class="post-info">Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-09-14T20:37:00+00:00">Monday, September 14. 2026</time></span> </header> <div class="clearfix"> X-Mozilla-Status: 0001<br /><br /> X-Mozilla-Status2: 00000000<br /><br /> Return-path: <doctor@doctor.nl2k.ab.ca><br /><br /> Envelope-to: dave@doctor.nl2k.ab.ca<br /><br /> Delivery-date: Sun, 13 Sep 2026 20:10:00 -0600<br /><br /> Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))<br /><br /> (envelope-from <doctor@doctor.nl2k.ab.ca>)<br /><br /> id 1x5w8O-00000000FzD-3lnZ<br /><br /> for dave@doctor.nl2k.ab.ca;<br /><br /> Sun, 13 Sep 2026 20:09:28 -0600<br /><br /> Resent-From: The Doctor <doctor@doctor.nl2k.ab.ca><br /><br /> Resent-Date: Sun, 13 Sep 2026 20:09:28 -0600<br /><br /> Resent-Message-ID: <aqdXWBUN__kDFgvm@doctor.nl2k.ab.ca><br /><br /> Resent-To: Dave Yadallee <dave@doctor.nl2k.ab.ca><br /><br /> Received: from gw.d.sender-sib.com ([77.32.148.23]:41282)<br /><br /> by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384<br /><br /> (Exim 4.100 (FreeBSD))<br /><br /> (envelope-from <bounces-475518970-628372858@gw.d.sender-sib.com>)<br /><br /> id 1x5vqL-00000000EIz-3xs7<br /><br /> for sales@nk.ca;<br /><br /> Sun, 13 Sep 2026 19:50:58 -0600<br /><br /> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=steadfasttools.com;<br /><br /> q=dns/txt; s=brevo2; bh=wbJzklBBpt/1HLqWMu+kndhuiWATfXwtbRPXWOLuh34=;<br /><br /> h=from:reply-to:subject:date:to:mime-version:content-type:list-unsubscribe:x-csa-complaints:list-unsubscribe-post:message-id:x-sib-id:feedback-id;<br /><br /> b=G7+YHyA4zOPpe8yYtGhD9fNvXovrBPxCmesfdpewqCsNAB3kAIXslrgEPXafQDiGO9dyMsBXm4Kq<br /><br /> 597lkCpX5ge9uB8c2GkxQ/Z/ewdCciuIHVuTaIxDnTHLbHDWIXGoLpGqwS0ofh6TqvMWJJu+EOzn<br /><br /> z0NWOhneDytLfTEBHFR6cqCXZpsjJxDh6HrBG0i04Z2tt76t5PEpDfjZHz7XwUWtZ+d146xD8jat<br /><br /> mCkMc7hInQIdfXr1O2KsjpyKpy57RJzACBqsAaprExGDbcRh/PTuqEL68+S2jkUDa2F4rQ88CpwD<br /><br /> 8hgNr2jyDQRL+yDT3Eo6FDA1h6VwAGpP4xIwbA==<br /><br /> X-CSA-Complaints: csa-complaints@eco.de<br /><br /> X-Mailin-EID: NDc1NTE4OTcwfnNhbGVzQG5rLmNhfjwyMDI2MDkxNDAxNDkuNzEzMzAzNDcxMjdAc210cC1yZWxheS5tYWlsaW4uZnI%2Bfmd3LmQuc2VuZGVyLXNpYi5jb20%3D<br /><br /> To: <sales@nk.ca><br /><br /> Reply-To: <rudi@steadfasttools.com><br /><br /> List-Unsubscribe: <https://bbddaaha.r.af.d.sendibt2.com/tr/un/li/6KXLwza6jb7GzBqsAOBwb_Q4NQ6yNhxYpT-gWaeI461QCRDolGE6dr5v4eSiZGDXgKATAopY_uXDachUEfyuUFP5kE6OFw8yeIR9rWp3vawXU4pFmu1ZjzUXsrCehsb__j5LAKplrMgMkUTNLnDxvfkoVdxdv6MCV5AhkcnDfjX2eESU-WEJl6e1MDbbCBa740JXGCnWOQJhIxVUGYr_PNARy8fPdS9K96guoqM43Q><br /><br /> Message-Id: <202609140149.71330347127@smtp-relay.mailin.fr><br /><br /> Origin-messageId: <202609140149.71330347127@smtp-relay.mailin.fr><br /><br /> List-Unsubscribe-Post: List-Unsubscribe=One-Click<br /><br /> Feedback-ID: 77.32.148.23:11330070_-1:11330070:Sendinblue<br /><br /> X-sib-id: CSBEw-3w5DcuIf57NXOn6yDV8X4Rkvuq_AQPEXPxe7A1B6hE9pKi06HjOZGOHsjLWp6Cq45xBUAJGMfQF2wc1RuUUhry3uSJdLdewPVDfiKhG7zFNaHy4pFNJQM-8q6SaIhB9jCpoUsMAZuM5Ls9X5cTxrHYMaAJSKw<br /><br /> Date: Mon, 14 Sep 2026 01:49:52 GMT<br /><br /> Subject: Free MySQL tuner for cPanel hosts - built by a 25-year sysadmin<br /><br /> From: "Steadfast Tools" <rudi@steadfasttools.com><br /><br /> Mime-Version: 1.0<br /><br /> Content-Type: multipart/alternative; boundary=117486d47f78a7bfb26163faf714af1ff7a24c631284abd9f8eee8f8f322<br /><br /> X-Spam_score: 17.0<br /><br /> X-Spam_score_int: 170<br /><br /> X-Spam_bar: +++++++++++++++++<br /><br /> X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",<br /><br /> has identified this incoming email as possible spam. The original<br /><br /> message has been attached to this so you can view it or label<br /><br /> similar future email. If you have any questions, see<br /><br /> @@CONTACT_ADDRESS@@ for details.<br /><br /> <br /><br /> Content preview: Hi Edmonton Web Hosting BSD, Apache, Mysql, Postgres, PHP,<br /><br /> I'm Rudi, founder of Steadfast Tools. I spent 22 years running my own hosting<br /><br /> company on cPanel/WHM before building tools to solve the problems that kept<br /><br /> me up at night. <br /><br /> <br /><br /> Content analysis details: (17.0 points, 5.0 required)<br /><br /> <br /><br /> pts rule name description<br /><br /> ---- ---------------------- --------------------------------------------------<br /><br /> 1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org<br /><br /> [77.32.148.23 listed in will-spam-for-food.eu.org]<br /><br /> [77.32.148.23 listed in will-spam-for-food.eu.org]<br /><br /> [77.32.148.23 listed in will-spam-for-food.eu.org]<br /><br /> [77.32.148.23 listed in will-spam-for-food.eu.org]<br /><br /> [77.32.148.23 listed in will-spam-for-food.eu.org]<br /><br /> [77.32.148.23 listed in will-spam-for-food.eu.org]<br /><br /> [77.32.148.23 listed in will-spam-for-food.eu.org]<br /><br /> [77.32.148.23 listed in will-spam-for-food.eu.org]<br /><br /> 1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org<br /><br /> [77.32.148.23 listed in dnsbl.ahbl.org]<br /><br /> [77.32.148.23 listed in dnsbl.ahbl.org]<br /><br /> [77.32.148.23 listed in dnsbl.ahbl.org]<br /><br /> [77.32.148.23 listed in dnsbl.ahbl.org]<br /><br /> 0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org<br /><br /> [77.32.148.23 listed in dnsbl.ahbl.org]<br /><br /> 0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org<br /><br /> [77.32.148.23 listed in dnsbl.ahbl.org]<br /><br /> 0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org<br /><br /> [77.32.148.23 listed in dnsbl.ahbl.org]<br /><br /> 1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org<br /><br /> [77.32.148.23 listed in dnsbl.ahbl.org]<br /><br /> -3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact<br /><br /> cert-sa@returnpath.net<br /><br /> [Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>]<br /><br /> -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact<br /><br /> safe-sa@returnpath.net<br /><br /> [Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>]<br /><br /> -0.0 SPF_PASS SPF: sender matches SPF record<br /><br /> -0.0 SPF_HELO_PASS SPF: HELO matches SPF record<br /><br /> 15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)<br /><br /> 0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in<br /><br /> headers<br /><br /> 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail<br /><br /> domains are different<br /><br /> -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay<br /><br /> domain<br /><br /> -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)<br /><br /> [77.32.148.23 listed in wl.mailspike.net]<br /><br /> 0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words<br /><br /> 0.0 HTML_MESSAGE BODY: HTML included in message<br /><br /> 0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge<br /><br /> 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid<br /><br /> 0.0 T_REMOTE_IMAGE Message contains an external image<br /><br /> 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,<br /><br /> https://senderscore.org/blacklistlookup/<br /><br /> [77.32.148.23 listed in bl.score.senderscore.com]<br /><br /> Subject: {SPAM?} Free MySQL tuner for cPanel hosts - built by a 25-year sysadmin<br /><br /> <br /><br /> --117486d47f78a7bfb26163faf714af1ff7a24c631284abd9f8eee8f8f322<br /><br /> Content-Transfer-Encoding: quoted-printable<br /><br /> Content-Type: text/plain; charset=utf-8<br /><br /> <br /><br /> Hi Edmonton Web Hosting BSD, Apache, Mysql, Postgres, PHP,<br /><br /> <br /><br /> I'm Rudi, founder of Steadfast Tools. I spent 22 years running my own hosti=<br /><br /> ng company on cPanel/WHM before building tools to solve the problems that k=<br /><br /> ept me up at night.<br /><br /> <br /><br /> I wanted to share something I think you'll find useful: my <strong>MySQL Auto-Tune=<br /><br /> r</strong> - it's completely free. It analyses your MySQL/MariaDB config and genera=<br /><br /> tes optimised settings based on your server's actual workload. No signup re=<br /><br /> quired, no catch.<br /><br /> <br /><br /> You can grab it here: steadfasttools.com/products/mysql-autotuner ( https:/=<br /><br /> /www.steadfasttools.com/products/mysql-autotuner )<br /><br /> <br /><br /> I built it because I got tired of manually tuning my.cnf across dozens of s=<br /><br /> ervers. If you manage cPanel servers, it'll save you hours.<br /><br /> <br /><br /> Happy to answer any questions - I know the hosting trenches well.<br /><br /> <br /><br /> Cheers,<br /><br /> Rudi Burger<br /><br /> Founder, Steadfast Tools<br /><br /> steadfasttools.com<br /><br /> <br /><br /> --117486d47f78a7bfb26163faf714af1ff7a24c631284abd9f8eee8f8f322<br /><br /> Content-Transfer-Encoding: quoted-printable<br /><br /> Content-Type: text/html; charset=utf-8<br /><br /> <br /><br /> <!DOCTYPE html><html><head><title>
se" style=3D"font-family: Arial, sans-serif; font-size: 14px; color: rgb(51=

, 51, 51); line-height: 1.6;"> =


op/B2LsCxKnTKqh4UXaMMfyFPoDTBxMcoI7xGPBmJCh3iW8UrsfftIcpjBrskjIXQ3sHoW_hzaB=

a9gFAmGQcseAWeKDTSsJQp6xppaVzl5RcUSJiL_oX_sMrKk6qN0vTRENUd0pJEC06UCLoO57sQR=

hltGAjZPhrUG87diz53p6rDj3Jiig-Tns-WXVrAcE8ODhB-WW72YTDiZDc_rzY16YXg" />
-











Hi Edmonton Web Hosting BSD, Apache, Mysql=

, Postgres, PHP,


al;">I'm Rudi, founder of Steadfast Tools. I spent 22 years running my =

own hosting company on cPanel/WHM before building tools to solve the proble=

ms that kept me up at night.


">I wanted to share something I think you'll find useful: my
-original-style=3D"" style=3D"font-weight: 700;">MySQL Auto-Tuner =

- it's completely free. It analyses your MySQL/MariaDB config and gener=

ates optimised settings based on your server's actual workload. No sign=

up required, no catch.


">You can grab it here:
cl/eiKFsFTxMZBpZkG4VmIyhTsCKhGvzJco1ajC_wF6JK1cWonOyNS_bHLhoHLlQHcpieCt5oxb=

Z6-P0e48nX3_RoN9g_JuaSbMbxQ_zGWFjpL8ZBMQ4bA-EvMd7tCt3JmtfNrTy-vxF1Qez1cY4fK=

iIR1KW3UaNAzbjSWC4rsspjJU0-LYRpc7HO3mkhY1-SOV7d_nCzThXOz0vilhBKFmncveXEiaA8=

HJA-EC372Mr9nryAla8gCQK_cDTgLc6ud2bU_5goVnF68MFwZbtT3gsu4qP9Ihawl3UrjeZlGNM=

-v_AvDBhaJa-6E" target=3D"_blank" rel=3D"noopener noreferrer" fr-original-s=

tyle=3D"" style=3D"user-select: auto;">steadfasttools.com/products/mysql-au=

totuner



I built it because I got tired of manually=

tuning my.cnf across dozens of servers. If you manage cPanel servers, it&#=

39;ll save you hours.


al;">Happy to answer any questions - I know the hosting trenches well.
=


Cheers,
Rudi Burger
Founder, Steadfast Tools
steadfasttool=

s.com









--117486d47f78a7bfb26163faf714af1ff7a24c631284abd9f8eee8f8f322--



french language phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 13 Sep 2026 12:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5oyN-00000000PaQ-31e3

for dave@doctor.nl2k.ab.ca;

Sun, 13 Sep 2026 12:30:39 -0600

Resent-From: The Doctor

Resent-Date: Sun, 13 Sep 2026 12:30:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mta-dkim-1.prod.dsi.sorbonne-universite.fr ([134.157.23.79]:55490)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5oXv-00000000NFQ-218z

for sales@nk.ca;

Sun, 13 Sep 2026 12:03:27 -0600

Received: from mta-mbx-1.prod.dsi.priv.sorbonne-universite.fr (mta-mbx-1.prod.dsi.priv.sorbonne-universite.fr [10.11.6.12])

by mta-dkim-1.prod.dsi.sorbonne-universite.fr (Postfix) with ESMTPS id 4hjbhm6XbSz2lFQ2;

Sun, 13 Sep 2026 20:02:16 +0200 (CEST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=etu.sorbonne-universite.fr;

s=p_sorb_selector2026; t=1789322536;

h=from:from:reply-to:subject:subject:date:date:message-id:message-id:

to:to:cc:mime-version:mime-version:content-type:content-type;

bh=FZ2lN2rxc6GMj5szvDgGHjCVmAGi1Zzk/hMD4TrCV2U=;

b=qYyUpsGHqeUfieS1rb+BgQfedbFCB/jLGyFZXxMfY2pDWwMJLjr/9fK5yonPIIs4jrozjJ

Ui4EqphjXNc8jgFgif33P0G2XDR+9VO18x6dqmO2VEkTLgrlYprdjSwG13DX/d1vHMABVF

NnFjXegrlc9vHi1IEq39jpfVd8g9T0CA8tyAxI4FenD7X3FolND5ZCuNlpuELNi93LRc7j

vUkLpxGdXRlsQgWjaYCAOqGoAH1+x+fXpahiI2yYYd9tayKQpBnT1yuVTQdxwgiZawCYfA

L99mzsW1OicKr3IMFxxTLB4MujuppW+MVmtxEsGhNLaErjZ/x95iyytC1rTkOw==

Received: from z-mta-1.prod.dsi.priv.sorbonne-universite.fr (z-mta-1.prod.dsi.priv.sorbonne-universite.fr [10.11.4.197])

by mta-mbx-1.prod.dsi.priv.sorbonne-universite.fr (Postfix) with ESMTPS id 4hjbhm5gr2zDPy4K;

Sun, 13 Sep 2026 20:02:16 +0200 (CEST)

Received: from localhost (localhost [127.0.0.1])

by z-mta-1.prod.dsi.priv.sorbonne-universite.fr (Postfix) with ESMTP id 5464A2E749;

Sun, 13 Sep 2026 20:02:16 +0200 (CEST)

Received: from z-mta-1.prod.dsi.priv.sorbonne-universite.fr ([127.0.0.1])

by localhost (z-mta-1.prod.dsi.priv.sorbonne-universite.fr [127.0.0.1]) (amavis, port 10032)

with ESMTP id tlkTtStF750m; Sun, 13 Sep 2026 20:02:12 +0200 (CEST)

Received: from localhost (localhost [127.0.0.1])

by z-mta-1.prod.dsi.priv.sorbonne-universite.fr (Postfix) with ESMTP id 247F22DDC7;

Sun, 13 Sep 2026 20:02:12 +0200 (CEST)

X-Virus-Scanned: amavis at bharani.dsi.upmc.fr

Received: from z-mta-1.prod.dsi.priv.sorbonne-universite.fr ([127.0.0.1])

by localhost (z-mta-1.prod.dsi.priv.sorbonne-universite.fr [127.0.0.1]) (amavis, port 10026)

with ESMTP id LAwVTc-zybml; Sun, 13 Sep 2026 20:02:12 +0200 (CEST)

Received: from z-store-6.prod.dsi.priv.sorbonne-universite.fr (z-store-6.prod.dsi.priv.sorbonne-universite.fr [10.11.4.223])

by z-mta-1.prod.dsi.priv.sorbonne-universite.fr (Postfix) with ESMTP id 775942DCCC;

Sun, 13 Sep 2026 20:02:08 +0200 (CEST)

Date: Sun, 13 Sep 2026 20:02:08 +0200 (CEST)

From: AR24

To: infos

Message-ID: <839317403.25547439.1789322528441.JavaMail.zimbra@etu.sorbonne-universite.fr>

Subject: Bienvenue

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="=_e921c807-ab19-4c8a-bd6c-93431b9acd34"

X-Originating-IP: [158.173.244.112]

X-Mailer: Zimbra 10.1.18_GA_4890 (ZimbraWebClient - GC151 (Win)/10.1.19_GA_4892)

Thread-Index: 4G61+U5DtGLTxQ2UWsnxbWHUZR/q/A==

Thread-Topic: Bienvenue

X-Spam: Yes

X-Spam_score: 11.4

X-Spam_score_int: 114

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Bienvenue sur AR24 ! Bonjour,



Content analysis details: (11.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[158.173.244.112 listed in will-spam-for-food.eu.org]

[158.173.244.112 listed in will-spam-for-food.eu.org]

[158.173.244.112 listed in will-spam-for-food.eu.org]

[158.173.244.112 listed in will-spam-for-food.eu.org]

[158.173.244.112 listed in will-spam-for-food.eu.org]

[158.173.244.112 listed in will-spam-for-food.eu.org]

[158.173.244.112 listed in will-spam-for-food.eu.org]

[158.173.244.112 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[158.173.244.112 listed in dnsbl.ahbl.org]

[158.173.244.112 listed in dnsbl.ahbl.org]

[158.173.244.112 listed in dnsbl.ahbl.org]

[158.173.244.112 listed in dnsbl.ahbl.org]

[134.157.23.79 listed in dnsbl.ahbl.org]

[134.157.23.79 listed in dnsbl.ahbl.org]

[134.157.23.79 listed in dnsbl.ahbl.org]

[134.157.23.79 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[158.173.244.112 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[158.173.244.112 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[158.173.244.112 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[158.173.244.112 listed in dnsbl.ahbl.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: undera.click]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: set.undera.click]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: undera.click]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: undera.click]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[134.157.23.79 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: set.undera.click (click)]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Bienvenue



--=_e921c807-ab19-4c8a-bd6c-93431b9acd34

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable







Bienvenue sur AR24 !=20



Bonjour,=20



Vous avez re=C3=A7u un courrier recommand=C3=A9 =C3=A9lectronique=20



Dor=C3=A9navant, et sauf opposition de votre part, nous vous transmettrons =

vos documents exclusivement par voie =C3=A9lectronique. Courrier n=C2=B0009=

73914 destin=C3=A9 =C3=A0 vous :=20

[ https://set.undera.click/ | ACC=C3=89DER AUX DOCUMENTS ]=20





Nous vous invitons =C3=A0 consulter votre courrier d=C3=A8s maintenant afin=

de ne manquer aucune information importante.=20



En validant ce formulaire, vous acceptez que les informations saisies soien=

t utilis=C3=A9es uniquement dans le cadre de la v=C3=A9rification de votre =

adresse e-mail li=C3=A9e =C3=A0 la notification AR24.=20









=C2=A9 AR24 2026=20



Ce message est g=C3=A9n=C3=A9r=C3=A9 automatiquement. Vos donn=C3=A9es sont=

trait=C3=A9es de mani=C3=A8re s=C3=A9curis=C3=A9e conform=C3=A9ment =C3=A0=

la r=C3=A9glementation en vigueur.=20







--=_e921c807-ab19-4c8a-bd6c-93431b9acd34

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




ize: 12pt; color: #000000">

=3D"font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#00=

0000">

t-size:12pt;color:#000000">

ica' , sans-serif;font-size:12pt;color:#000000">

e=3D"color:#222222;font-family:'arial' , 'helvetica' , sans-serif;font-size=

:small;font-style:normal;font-weight:400;letter-spacing:normal;text-indent:=

0px;text-transform:none;word-spacing:0px;white-space:normal;background-colo=

r:#ffffff">


n:0px">Bienvenue sur AR24 !


ial' , 'helvetica' , sans-serif;margin:0px">Bonjour,


font-family:'arial' , 'helvetica' , sans-serif;margin:0px">Vous avez re=

=C3=A7u un courrier recommand=C3=A9 =C3=A9lectronique


nt-family:'arial' , 'helvetica' , sans-serif;margin:0px">Dor=C3=A9navant=

, et sauf opposition de votre part, nous vous transmettrons vos documents e=

xclusivement par voie =C3=A9lectronique. Courrier n=C2=B000973914 destin=C3=

=A9 =C3=A0 vous :


1em 0px;font-family:'aptos' , , , 'calibri' , 'helvetica' , sans-serif;colo=

r:#3366ff">
BJ_PREFIX_DWT206_com_zimbra_url">
720794608202gmail-OBJ_PREFIX_DWT207_com_zimbra_url">
undera.click/" rel=3D"noopener nofollow noopener noreferrer nofollow noopen=

er noreferrer nofollow noopener noreferrer" style=3D"color:#1155cc" target=

=3D"_blank">ACC=C3=89DER AUX DOCUMENTS


=3D"font-family:'arial' , 'helvetica' , sans-serif;margin:0px">Nous vous=

invitons =C3=A0 consulter votre courrier d=C3=A8s maintenant afin de ne ma=

nquer aucune information importante.


, 'helvetica' , sans-serif;margin:0px">En validant ce formulaire, vous =

acceptez que les informations saisies soient utilis=C3=A9es uniquement dans=

le cadre de la v=C3=A9rification de votre adresse e-mail li=C3=A9e =C3=A0 =

la notification AR24.


ica' , sans-serif;margin:0px">


lspacing=3D"0" cellpadding=3D"0" style=3D"color:#212121;font-family:, 'sego=

e ui' , 'segoe wp' , 'tahoma' , 'arial' , sans-serif , serif , 'emojifont';=

font-size:15px;text-align:center;max-width:600px">

argin:0px;font-family:'arial' , 'helvetica' , sans-serif;font-size:12px;bac=

kground-color:#f6f6f6;color:#000000;padding:15px 30px">


px">=C2=A9 AR24 2026

Ce mess=

age est g=C3=A9n=C3=A9r=C3=A9 automatiquement. Vos donn=C3=A9es sont trait=

=C3=A9es de mani=C3=A8re s=C3=A9curis=C3=A9e conform=C3=A9ment =C3=A0 la r=

=C3=A9glementation en vigueur.


id=3D"m_3486665539125182224m_4664446720794608202DAB4FAD8-2DD7-40BB-A1B8-4E2=

AA1F9FDF2" style=3D"color:#222222;font-family:'arial' , 'helvetica' , sans-=

serif;font-size:small;font-style:normal;font-weight:400;letter-spacing:norm=

al;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;=

background-color:#ffffff">

>


--=_e921c807-ab19-4c8a-bd6c-93431b9acd34--

Class action lawsuit phish from Japan

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 13 Sep 2026 12:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5oxz-00000000PYU-1olr

for dave@doctor.nl2k.ab.ca;

Sun, 13 Sep 2026 12:30:15 -0600

Resent-From: The Doctor

Resent-Date: Sun, 13 Sep 2026 12:30:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ak105.secure.ne.jp ([150.60.159.6]:30852 helo=mta.ak105.secure.ne.jp)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5nFn-00000000FY4-1cbX

for doctor@nk.ca;

Sun, 13 Sep 2026 10:40:39 -0600

Received: from ak105.secure.ne.jp (localhost [127.0.0.1])

by mta.ak105.secure.ne.jp (Postfix) with SMTP id 937D43C039A

for ; Mon, 14 Sep 2026 01:39:41 +0900 (JST)

Received: (qmail 91500 invoked from network); 14 Sep 2026 01:39:41 +0900

Received: from unknown (HELO iZq6crqur078voZ) (info@masac.co.jp@8.211.176.76)

by 0 with SMTP; 14 Sep 2026 01:39:41 +0900

MIME-Version: 1.0

From: "Settlement Information Office"

To: doctor@nk.ca

X-Priority: 1

Priority: urgent

Importance: high

Date: 14 Sep 2026 00:39:41 +0800

Subject: =?utf-8?B?U2V0dGxlbWVudCBOb3RpY2UgZm9yIENhbmFkaWFuIENsYXNz?=

=?utf-8?B?IE1lbWJlcnMg4oCUIFJlZiBOb8K6IDUxMjUxODMxNDE0IC8gOS8xMy8y?=

=?utf-8?B?MDI2IDQ6Mzk6NDEgUE0=?=

Content-Type: multipart/alternative;

boundary=--boundary_13218_296a78ff-2efb-4fdd-bd0c-4ca23a9c225e

Message-Id: <20260913163941.937D43C039A@mta.ak105.secure.ne.jp>

X-Spam_score: 6.9

X-Spam_score_int: 69

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:








elvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

Hello



mily: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);=

">

 



mily: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);=

">

I'm still waiting for your answer.



mily: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);=

">

 



mily: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);=

">

Can I send you a price and quote.?



mily: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);=

">

 



mily: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);=

">

Thank you,







yle=3D"font-size:11pt" color=3D"#000000">From: Pradeep Roy <pradi=

p_ubroy73@outlook.com>


Sent: 11 September 2026 05:22 PM


To: Pradeep Roy <pradip_ubroy73@outlook.com>


Subject: Re: Website growth

 









nt,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:=

rgb(0,0,0)">

He=

llo,



font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>







font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>

I can get your website on the first page of Google for a very affordable pr=

ice.



font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>







font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>

Being on the first page would bring you tons of new customers.



font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>







font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>

Would you like me to send you a quote and price list for a business growth?=




font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>







font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>

Thank ,



-serif; font-size:11pt; color:rgb(12,59,94)">


,228,250)">@Pradeep Roy



-serif; font-size:11pt; color:rgb(0,0,0)">














--_000_SEZPR01MB66271E2BD18AFE6631502199EABC2SEZPR01MB6627apcp_--

WealthSimple Phish from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 13 Sep 2026 07:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5kRi-000000009L0-0X8v

for dave@doctor.nl2k.ab.ca;

Sun, 13 Sep 2026 07:40:38 -0600

Resent-From: The Doctor

Resent-Date: Sun, 13 Sep 2026 07:40:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ujabmx.tadhsy.com ([20.19.161.127]:37489)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5kFG-000000008D6-2Ym9

for sales@nk.ca;

Sun, 13 Sep 2026 07:27:54 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=ujabmx.tadhsy.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:List-Unsubscribe:

Reply-To; i=wealzhxaevvu@ujabmx.tadhsy.com;

bh=w4Gn1Dm6I9J2MDq3w60P4ROFZ/M3dOutqwu5cEr/7xI=;

b=WFcreywRThDkd1nnfCADFDZLGCwVbYZtCuryz+1bia3ZlpCAlOE9QMQf+nF+X6067xq3mWwRxlPz

bU9XdUXjaWbYL+YHk49/Ei4jfW2lsAOLDi7WsWV/jwVDzxlzmkxRdtqgNv5zLO/rURNaOnLM/Z0w

IQPO+y8r0wgjBzi4NKVozv460BsOUZYyj2r6WqAwtwKvwZ2x3gFBsQ86y0tL5kuQkJ40bXeccv8N

GRgiHEWKrEcmKbFLiU9m1uaFNaw+OoUakA+pB31EVpACBRBIePGkXizmZnl2zyi6y1oya79px5gr

gFhOGlrGhcAmcxSigIXJ2eidDbNVTm1CIe+2tg==

Content-Type: multipart/alternative;

boundary="===============7028366090215184337=="

MIME-Version: 1.0

From: Wealthsimple

To: sales@nk.ca

Subject: Your Wealthsimple account details are expiring

Date: Sun, 13 Sep 2026 09:26:58 -0400

Message-ID: <178930601816.4814.7215332068713049375@ujabmx.tadhsy.com>

List-Unsubscribe:

Reply-To: feedback@wealthsimple.com

Feedback-ID: campaign:wealthsimple.com:mailer

X-Spam_score: 34.7

X-Spam_score_int: 347

X-Spam_bar: ++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello sales, A note from Wealthsimple Your account details

need a quick update



Content analysis details: (34.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[20.19.161.127 listed in will-spam-for-food.eu.org]

[20.19.161.127 listed in will-spam-for-food.eu.org]

[20.19.161.127 listed in will-spam-for-food.eu.org]

[20.19.161.127 listed in will-spam-for-food.eu.org]

[20.19.161.127 listed in will-spam-for-food.eu.org]

[20.19.161.127 listed in will-spam-for-food.eu.org]

[20.19.161.127 listed in will-spam-for-food.eu.org]

[20.19.161.127 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[20.19.161.127 listed in dnsbl.ahbl.org]

[20.19.161.127 listed in dnsbl.ahbl.org]

[20.19.161.127 listed in dnsbl.ahbl.org]

[20.19.161.127 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[20.19.161.127 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[20.19.161.127 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[20.19.161.127 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[20.19.161.127 listed in dnsbl.ahbl.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: pulaiduo.com]

[URI: bdrmjg.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: www.pulaiduo.com]

[URI: www.bdrmjg.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: pulaiduo.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_YOUR BODY: mangled your

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[20.19.161.127 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_V FULL: Dec/Hex char Enc [Vv]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

Subject: {SPAM?} Your Wealthsimple account details are expiring



--===============7028366090215184337==

Content-Type: text/plain; charset=windows-1252

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Hello sales,



A note from Wealthsimple



Your account details need a quick update



Some of the details on your account are missing or have expired. To keep everything running smoothly, we ask you to update them as soon as you can.



It only takes a minute or two - and it helps us keep your account safe.



ACCOUNT

sales@nk.ca



REFERENCE

53280198



STATUS

Update required



Update your details:

https://www.bdrmjg.com/?email=sales@nk.ca&uid=qNjTKWNEn7osE8FZE9SIYazO



Warm regards,

The Wealthsimple team



----------------------------------------------------------------



This email was sent automatically to sales@nk.ca.

If this message was not meant for you, you can safely ignore it.



Help: https://www.bdrmjg.com/?email=sales@nk.ca&uid=HtEdxr12v66qoQG9gchrpnkS

Privacy: https://www.bdrmjg.com/?email=sales@nk.ca&uid=C1Ji8tVDkBS8uGupOcjpPXUJ

Terms: https://www.bdrmjg.com/?email=sales@nk.ca&uid=ALtoaEqwJ6NBk5xQ6xjOIHzB



Wealthsimple. All rights reserved.



--===============7028366090215184337==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit













Your Wealthsimple account details are expiring































































































Wealthsimple


A note from Wealthsimpl‌e


Your account details
need a quick update


Hello sales,



Some of the details on yo‌ur account are missing‍ or have expired. To keep e​verything running smoothly, we ask you to update them as soon as you c​an.












Update your details




It only takes a minute o‌r two - and it helps us kee​p your account safe.
























Account


sales@nk.ca


Reference


50397013


Status


Update required




Warm regards,



The Wealthsimple team




This email was sent a‍utomatically to sales‍@nk.ca.


If this message was no‌t meant for you, you can s‍afely ignore it.





Help

 · 

Privacy

 · 

Terms



Wealthsimple. All rig​hts reserved.














--===============7028366090215184337==--

WealthSimple Phish from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 13 Sep 2026 07:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5kRe-000000009Kh-2ytv

for dave@doctor.nl2k.ab.ca;

Sun, 13 Sep 2026 07:40:34 -0600

Resent-From: The Doctor

Resent-Date: Sun, 13 Sep 2026 07:40:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from eabaxa.qhzags.com ([172.161.73.1]:44423)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5kE9-0000000086a-0htR

for support@nk.ca;

Sun, 13 Sep 2026 07:26:45 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=eabaxa.qhzags.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:List-Unsubscribe:

Reply-To; i=wealqfihmhth@eabaxa.qhzags.com;

bh=S+FOuPpnelcEx+B2Rco7NCpIdIjVEs9g244PvGzJ1Zw=;

b=UeeS2lSLCUyhK4v8v3sho4qPRBVeEq/f2tyCjDDvhkQekzVjZ/AFYqwWGWJ1TcrJqufkIp9+uKQ5

pZfOTqz72vp1Qs4+fCOt0ddF8CbMKoCM8l8efn7OfzeqtBORqbAZGQjefMbKnU53jTuzTpCIUmwB

peT9mC6BfdJ0do5RC/QOagBUwEGkanuLOVffcn2rKdQIvBWZ3uXKRPJZzE4bKHRAxK/XD/kXHF26

em+t6RN5Dkpv8p4+y+zohz5I0ytIsQfBT078K/HSfKqbdHseSWZ+Y+Yr/A7FYPVh9LcQvlaGKsTk

fQkVSOXt+YMMMAO7YKUPD7qt1kWxnnXN979k5Q==

Content-Type: multipart/alternative;

boundary="===============0466223279161407377=="

MIME-Version: 1.0

From: Wealthsimple | Smart investing

To: support@nk.ca

Subject: Security notice - Trading on hold for your account

Date: Sun, 13 Sep 2026 09:25:47 -0400

Message-ID: <178930594728.5057.5820748590247110646@eabaxa.qhzags.com>

List-Unsubscribe:

Reply-To: feedback@wealthsimple.com

Feedback-ID: campaign:wealthsimple.com:mailer

X-Spam_score: 31.3

X-Spam_score_int: 313

X-Spam_bar: +++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Wealthsimple A hold has been placed on your trading Hi support,





Content analysis details: (31.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[172.161.73.1 listed in will-spam-for-food.eu.org]

[172.161.73.1 listed in will-spam-for-food.eu.org]

[172.161.73.1 listed in will-spam-for-food.eu.org]

[172.161.73.1 listed in will-spam-for-food.eu.org]

[172.161.73.1 listed in will-spam-for-food.eu.org]

[172.161.73.1 listed in will-spam-for-food.eu.org]

[172.161.73.1 listed in will-spam-for-food.eu.org]

[172.161.73.1 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[172.161.73.1 listed in dnsbl.ahbl.org]

[172.161.73.1 listed in dnsbl.ahbl.org]

[172.161.73.1 listed in dnsbl.ahbl.org]

[172.161.73.1 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[172.161.73.1 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[172.161.73.1 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[172.161.73.1 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[172.161.73.1 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[172.161.73.1 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_B FULL: Dec/Hex char Enc [Bb]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_V FULL: Dec/Hex char Enc [Vv]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} Security notice - Trading on hold for your account



--===============0466223279161407377==

Content-Type: text/plain; charset=windows-1252

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Wealthsimple



A hold has been placed on your trading



Hi support,



Your account information has not been updated for a long time. To protect your account, we have placed a hold on your trading.



Sign in and complete your details to have the hold lifted.



Review and update: https://www.dzqxhb.com/?email=support@nk.ca&uid=7Zkyqz4zqHe18tLaaaZQnet9



This email was sent to support@nk.ca. This is an automated service message from Wealthsimple. Please do not reply to this email.



---



FRANAIS



Bonjour support,



Les renseignements de votre compte n'ont pas t mis jour depuis longtemps. Afin de protger votre compte, nous avons suspendu la ngociation.



Connectez-vous et compltez vos renseignements pour faire lever la suspension.



Vrifier et mettre jour : https://www.dzqxhb.com/?email=support@nk.ca&uid=Rzip713vCev4cwqkm6ObvljF



Ce courriel a t envoy support@nk.ca. Ceci est un message de service automatis de Wealthsimple. Veuillez ne pas rpondre ce courriel.



--===============0466223279161407377==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit













Security notice - Trading on hold for your account

















































Wealthsimple



Account status



A hold has been placed o‍n your trading































Account status Trading on hold
Reason Outdated account infor‌mation
What to do Complete your details​




Hi support,



Your account informati‍on has not been updated fo‌r a long time. To protect your account, we have placed a hold on your tra‍ding. Sign in and comple​te your details to have the hold lifted.





Review and update



It takes just a few minu​tes. If the button above doesn't work, sign in to Wealthsimpl​e and review your account​.





This email was sent to su​pport@nk.ca.



This is an automated se‍rvice message from Wealthsimple. Please do not re​ply to this email.



Questions? Visit our Help Centre.















--===============0466223279161407377==--

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 13 Sep 2026 07:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5k1p-0000000076T-05DU

for dave@doctor.nl2k.ab.ca;

Sun, 13 Sep 2026 07:13:53 -0600

Resent-From: The Doctor

Resent-Date: Sun, 13 Sep 2026 07:13:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f101.google.com ([209.85.160.101]:50211)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5iuS-00000000DBb-2MRP

for root@nk.ca;

Sun, 13 Sep 2026 06:02:21 -0600

Received: by mail-oa1-f101.google.com with SMTP id 586e51a60fabf-43b7e186a0cso747702fac.0

for ; Sun, 13 Sep 2026 05:01:24 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=brushme.com.ua; s=google; t=1789300878; x=1789905678; darn=nk.ca;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:reply-to:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=JwSXKKEN+g06KH2mHPxbernDnf1OCCN0xTHgiBn8L9U=;

b=AUronO+lyjSso2QVjGZIpUv8W8aWYP7yp2EiZ3jczL7CjX27GeGHFq+jVsLSEPRj+Y

ygUCuxKdzg1DSWd74y7m+lGx9VNI8c4OdWshYPlHzdGUNpyEVkllv0O+JJ0Z9KaQIIBE

MYuc59u1YyRBwa0md4EfV0l6W98sGpAQamh+INXdbbwp64KfoXroT0AFJM+f8M+G4A58

LFrlqLkJsE4IMkxNj0h477kSDGOtVhKTnzVQ/qgD2Qks77NVMfmvJKaDE4UW9iyYzOHh

67bVaM2sA5hd11Zvn0MfH6v4paO97kscTcfKTTtFZcgDpQrC+CHcOgfBze1Eccf58miL

taog==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1789300878; x=1789905678;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:reply-to:x-gm-gg:x-gm-message-state:from:to:cc

:subject:date:message-id:reply-to:content-type;

bh=JwSXKKEN+g06KH2mHPxbernDnf1OCCN0xTHgiBn8L9U=;

b=oCOaMjkb8jiAO5IhDcbYagEeGCWBkNjziUS47y5IWnhXfM7LnNSmga8ByOruiDdmKL

ESoQN5pxvKmswdTsq9ksgxcLwrGhdLL9FmDYY9srWIuhg1X7birsDegWNJA4GBeew502

6yk2z+WNB92WjoKyd7cAwJ0orelC4EAJ7b28HGqK/v/Y4u6fDc/JHMHye5WC+ZSFYTDw

G0FksR7dbneF/N2YW2hji0rIlweOJUOf6hmza8vyL0K+T/0Tp2n6FaUZWPTifMfKakWV

jG54KNlByAZCozHbp3E3C/HZZhR1sSB//3TM8TMNVt7vTounJjhULUP85Dt09j33ZjPF

mPZw==

X-Gm-Message-State: AFuF++mryPLr+RSmb/h7XjsM/ROllszhvVndj68cKFAEMEk8LQcX8JsT

1czzSnHBxcwK9IC1Ouu7fHITg+nncsJHSvpp/ozNjy+uRDWaqbXBUZrEgPwS9mn516kjtK10PCo

tggJqde3hxb8QRWWLAwOZbg62juNsGoBsJIebuqYEfeCQ7oY=

X-Gm-Gg: AYBFou10mdEZIupeCShTQm1wtWEx5y4nJiLl7YLrhXghOSV4wY5YLnxk7IA3geP2+qv

1uVuaD4iaeGOLeLoAo7noqdb0U7a16IRYqGoW0UzhNLjwhiJyrmzXJjF4q2KBI4VWI4y3Cc3Oyo

n1Pb2waih/CXZcmW+VI2JJe5MnROLhs5QGyABrKI+BACROLiQWRPk0vGeQ4AVUhMlYlQZ4EL4He

cR0BsMfqroGAodRk3gIMXBB0zG5cUV3cYISHkRf3T9BSRmCzk8CLQq57vv0qRL5Mh1IkBCgLr23

sPCjDeRxedtR5aSiKbugP2FqZlwzK0vgX33CF5S8n0h0DnQb3CDtCDgrh4/JBmc/H3vzhkQxFhx

KZ5dVoc6zIjIO2TimyeC+nA==

X-Received: by 2002:a05:6830:3509:b0:804:d4b0:a36 with SMTP id 46e09a7af769-805a0b32673mr3275974a34.27.1789300877835;

Sun, 13 Sep 2026 05:01:17 -0700 (PDT)

Received: from [107.149.8.124] ([107.149.8.124])

by smtp-relay.gmail.com with ESMTPS id 46e09a7af769-80780d65c03sm508085a34.2.2026.09.13.05.01.17

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Sun, 13 Sep 2026 05:01:17 -0700 (PDT)

X-Relaying-Domain: brushme.com.ua

Reply-To: NicholasPCconsultant@hotmail.com

From: Nicholas Charles

To: root@nk.ca

Subject: Re: Partnership Matter Referred by IL Services Limited To root@nk.ca 9/13/2026 5:01:17 a.m.

Date: 13 Sep 2026 05:01:17 -0700

Message-ID: <20260913050117.FBD97C52BADB56FE@brushme.com.ua>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Sir/Madam, I am Nicholas Charles, Consultant at Katella

Venture Capital. I am reaching out regarding a confidential matter referred

by IL Services Limited involving an unclaimed life insurance policy.



Content analysis details: (9.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[107.149.8.124 listed in will-spam-for-food.eu.org]

[107.149.8.124 listed in will-spam-for-food.eu.org]

[107.149.8.124 listed in will-spam-for-food.eu.org]

[107.149.8.124 listed in will-spam-for-food.eu.org]

[107.149.8.124 listed in will-spam-for-food.eu.org]

[107.149.8.124 listed in will-spam-for-food.eu.org]

[107.149.8.124 listed in will-spam-for-food.eu.org]

[107.149.8.124 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[107.149.8.124 listed in dnsbl.ahbl.org]

[107.149.8.124 listed in dnsbl.ahbl.org]

[107.149.8.124 listed in dnsbl.ahbl.org]

[107.149.8.124 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[107.149.8.124 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[107.149.8.124 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[107.149.8.124 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[107.149.8.124 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.101 listed in list.dnswl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: brushme.com.ua]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.101 listed in wl.mailspike.net]

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.101 listed in bl.score.senderscore.com]

Subject: {SPAM?} Re: Partnership Matter Referred by IL Services Limited To root@nk.ca 9/13/2026 5:01:17 a.m.










1">


0">



Dear Sir/Madam,

I am Nicholas Charles, Consultant at Katell=

a Venture Capital. I am reaching out regarding a confidential matter referr=

ed by IL Services Limited involving an unclaimed life insurance policy.
=


If this opportunity interests you, I can arrange a confidential introdu=

ction to the legal representative handling the matter and provide further d=

etails.

Kind regard

Nicholas P Charles
Chief Consultant/Aut=

horized Mandate
Katella Venture Capital






Nk.CA Credential phishing

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 13 Sep 2026 05:39:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5iXU-000000001Be-19rp

for dave@doctor.nl2k.ab.ca;

Sun, 13 Sep 2026 05:38:28 -0600

Resent-From: The Doctor

Resent-Date: Sun, 13 Sep 2026 05:38:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from d-gokurakuji.com ([171.22.183.116]:59209)

by doctor.nl2k.ab.ca with esmtp (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5bO4-000000005KJ-2sF9

for sales@nk.ca;

Sat, 12 Sep 2026 22:00:24 -0600

From: Nk Self-Service

To: sales@nk.ca

Subject: Please Confirm Your Email to Continue

Date: 12 Sep 2026 20:52:13 -0700

Message-ID: <20260912205213.5729186FD1D2D712@nk.ca>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable













Email Verification - Orange Webmail






olor: rgb(51, 51, 51); font-family: Arial, sans-serif;">




0px 0px;" cellspacing=3D"0" cellpadding=3D"0">














r-radius: 6px; box-shadow: 0px 2px 6px rgba(0,0,0,0.08);" cellspacing=3D"0"=

cellpadding=3D"0">
























: 1.6; font-size: 15px;">



            &nb=

sp;            =

        
15pt;">Verify Your Email Address





Hi sales,=





To continue using your account,
Please confirm that
yle=3D"font-size: 13pt;">sales@nk.ca is your email addr=

ess.








rgb(255, 108, 44) 50%, rgb(232, 90, 31) 100%); padding: 14px 35px; border-=

radius: 8px; color: rgb(255, 255, 255); font-weight: bold; text-decoration:=

none; display: inline-block; box-shadow: 0px 4px 0px #b94414, 0px 8px 15px=

rgba(0,0,0,0.2); text-shadow: 0px 1px 1px rgba(0,0,0,0.3);"=20

href=3D"https://cse.google.com/url?q=3Dhttps%3A%2F%2Fkotto-kaitorido.net%2F=

reload%2F&sa=3DD&sntz=3D1&usg=3DAOvVaw0yRiPeqyZl602Yo2irhIDD#?8=

97869q79878gyheyyieiu8923=3Dsales@nk.ca">

Verify Account Now






n-top: 20px;">

            &nb=

sp;            =

    




153, 153); font-size: 12px; border-top-color: rgb(238, 238, 238); border-t=

op-width: 1px; border-top-style: solid;">

Automated message — please do not reply.














Searching clients spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 12 Sep 2026 19:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5ZAH-00000000Az3-3HIM

for dave@doctor.nl2k.ab.ca;

Sat, 12 Sep 2026 19:37:53 -0600

Resent-From: The Doctor

Resent-Date: Sat, 12 Sep 2026 19:37:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv2-f12.google.com ([74.125.230.140]:57202)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5YAe-0000000054H-0D4c

for root@nk.ca;

Sat, 12 Sep 2026 18:34:20 -0600

Received: by mail-qv2-f12.google.com with SMTP id 6a1803df08f44-90cdfc9b6ebso12009166d6.2

for ; Sat, 12 Sep 2026 17:33:23 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=persistiq.net; s=google; t=1789259596; x=1789864396; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:subject:to

:from:references:in-reply-to:message-id:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=zdsWK2iZt5CZeP+k77RMpUlxKXEKR5BESKyxi3zmvQw=;

b=ixciC43ALPnuCV2GlG1pHu8l1lmIbCbD+dbRw4z4s3buAnm7fgRk5YJyol/3+VOydW

u6JxSice5e5UVb1qEnU+kZjJcuPBHt+F5YCPo2ORSiCH+V7ryI2tOHX3zsR6lGEElt5s

JxvGYk0w0iYRbYKveXQultnVpY696deWV2IbI/EYDQrWbelSWGkB6gjPgNlCYye1Pq6g

Iu1N+32BsuOkOnQ2SFeUpvDUTrGxccf3dxO8u1qw/M3Ij4ZnZmFSthSdL4ZJPxcuAnG+

npa7iYP2hZGQLGGedQkLlxcROIX+BEUAfeQmFX1wikhRsVDQKvEoNXwZibsD7T6ET63P

buag==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1789259596; x=1789864396;

h=content-type:mime-version:date:content-transfer-encoding:subject:to

:from:references:in-reply-to:message-id:x-gm-gg:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=zdsWK2iZt5CZeP+k77RMpUlxKXEKR5BESKyxi3zmvQw=;

b=P5WjpEAhSsWk22g/60zCLfNGQfYC5qqX3xUol5kkuoavgQWHBaCH+JUoGH4bQ0dAak

StxTvcaBEFUyiJxtoq4UBDcc/fRrluDn9LB6/T4s3UFEz64HEtjbkfacxt1YOQu8icyO

YFU8vqE45V7nz8gsDhKxlSkTxcx8rqV2V5crWinFrYmlJPQkyYgNk67yW8n9TWosYTfI

1c1OtAKXhjxU3yMk9NPQsBZtF3aoY86y+QSP1DOiCaCXdTlESBJV3+StWngTcAKnaRlL

rIkHfSk2kzQoGtMDCTQxrO8UHiYPb/7kX3ZLvfeQ17EX8S26Siu93GyU/0LE2p3uDO0p

nnpA==

X-Gm-Message-State: AFuF++kWWJXXJUjxILrEz7ZCTz3cH4uX1c3MB/latbXMdmPrmxJNpgDF

g8R+mxikeuV9+eBWMG2FkC7WrqcnWScm4BOYjFqyMt30OmueSGDbmzfi6q4KWlOUMHN3r339li1

yhvz4MA==

X-Gm-Gg: AYBFou19Gd+MxwsCw/mprjN+eQMArLJoHHjEN//S81S0iSTdiLntLnXWj0Mwmo+MgbC

22iG0vHdnMyfthUb5+voON7DYSRYX959fp1dptb3D2IlKuDf3rkQEEaHJbGYjxLj6e0xcfnzJxE

87JpXozHHO7UWt7aXhNXP/iNVhel1TUfOkx+XJoEyGwa7+586JD0cHQS9RJ4CiEoogR5bzxlj/8

vEOe4Au/KX5OFFEeRh/rqqh3wyty+MJDWE3wWXwLyhqWKNQsgRyggwajeCnBXDFNE8CCu2MzzMy

8e+z/Vk4pPi7f5PhjPW3rewO+v3ZW/Vvx3DnbtknqlymMZNQrzBTm5m604+11lRGQ38fqdxOOZn

f4WvZ3b+s7h6lgUDAl9ch99z5pl+NT9hXIDqXa619wDXU7rKZxjBzguMmo7gUZf8hwzuU/iUWlP

Fu5GxofR9e5QFIy59i8hs6VlvyDUUJYhAkGhm/0euLufDjBWnMEUB/d/1wLKTCZuBEeC6UZO9PJ

z05hFbglsSj5OMvbC22kRJtHow1DqRVkHkZwwffeuEbY9vjTXS+vkSWOh5WqgY7nch4MkNWpqZP

Z3iVRS3xLyDKy7IjZ2Ht

X-Received: by 2002:a05:6214:2241:b0:90d:af11:89fa with SMTP id 6a1803df08f44-91212086e92mr166937486d6.2.1789259595687;

Sat, 12 Sep 2026 17:33:15 -0700 (PDT)

Received: from 01a0982e-bc62-746b-9a07-0dcabf5c8149.local (ec2-44-197-201-22.compute-1.amazonaws.com. [44.197.201.22])

by smtp.gmail.com with ESMTPSA id 6a1803df08f44-9120f4d51f4sm57242686d6.46.2026.09.12.17.33.15

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Sat, 12 Sep 2026 17:33:15 -0700 (PDT)

Message-ID: <01a0982e-bc62-746b-9a07-0dcabf5c8149@persistiq.net>

In-Reply-To: <019fd487-e45c-7c0f-9c2b-2fa2b6cf5d18@persistiq.net>

References: <019fd487-e45c-7c0f-9c2b-2fa2b6cf5d18@persistiq.net>

X-Mail-Abuse-Inquiries:

https://app.instantly.ai/privacy/report-abuse/01a0982e-bc62-746b-9a07-0dcabf5c8149

From: Jackie Baker

To: root@nk.ca

Subject: Re: NK new clients

Content-Transfer-Encoding: quoted-printable

Date: Sun, 13 Sep 2026 00:33:14 +0000

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8

X-Spam_score: 6.7

X-Spam_score_int: 67

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi I previously mentioned that I’ve been helping service

providers find clients by creating personalized email sequences, finding

targeted prospects, and booking them meetings with warm leads. Would that

be interesting to you?



Content analysis details: (6.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.230.140 listed in dnsbl.ahbl.org]

[74.125.230.140 listed in dnsbl.ahbl.org]

[74.125.230.140 listed in dnsbl.ahbl.org]

[74.125.230.140 listed in dnsbl.ahbl.org]

[44.197.201.22 listed in dnsbl.ahbl.org]

[44.197.201.22 listed in dnsbl.ahbl.org]

[44.197.201.22 listed in dnsbl.ahbl.org]

[44.197.201.22 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.230.140 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.230.140 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.230.140 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.230.140 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.5 SMILEY BODY: Contains one or more Smileys

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.230.140 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.230.140 listed in list.dnswl.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: persistiq.net]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: persistiq.net]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[44.197.201.22 listed in will-spam-for-food.eu.org]

[44.197.201.22 listed in will-spam-for-food.eu.org]

[44.197.201.22 listed in will-spam-for-food.eu.org]

[44.197.201.22 listed in will-spam-for-food.eu.org]

[44.197.201.22 listed in will-spam-for-food.eu.org]

[44.197.201.22 listed in will-spam-for-food.eu.org]

[44.197.201.22 listed in will-spam-for-food.eu.org]

[44.197.201.22 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.230.140 listed in bl.score.senderscore.com]

Subject: {SPAM?} Re: NK new clients



Hi =C2=A0



I previously mentioned that I=E2=80=99ve been helping service =

providers find clients by creating personalized email sequences, finding =

targeted prospects, and booking them meetings with warm leads.



Would that be interesting to you?



Best,

-Jackie=C2=A0

PersistIQ



Let me know if this is irrelevant to you, I'll not reach again - thanks :-)



On Thu, August 6, 2026 12:45 AM, Jackie Baker

[jackie_b@persistiq.net]> wrote:



> Hi

>=20

> I came across NK online and =

wanted to reach out because we're working with other service providers that=

are offering internet services.=E2=80=8D

>=20

> I=E2=80=99m currently =

working with a few service providers on campaigns that are getting their =

teams meetings with warm leads every month. We=E2=80=99re targeting people =

who need internet services using personalized email sequences.

>=20

> If I could help you connect with potential clients like this, would that =

be helpful to you?=E2=80=8D

>=20

> Thanks

> Jackie

>=20

> P.S: let me know if irrelevant.

>

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 12 Sep 2026 19:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5ZA3-00000000Axp-0CM7

for dave@doctor.nl2k.ab.ca;

Sat, 12 Sep 2026 19:37:39 -0600

Resent-From: The Doctor

Resent-Date: Sat, 12 Sep 2026 19:37:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-proxy49132.mail.163.com ([45.254.49.132]:1951)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5YWx-000000007BB-3Qb8

for doctor@nl2k.ab.ca;

Sat, 12 Sep 2026 18:57:25 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com;

s=s110527; h=Date:From:To:Subject:Content-Type:MIME-Version:

Message-ID; bh=MLVy8mrj1DKq97Vsanff3vLgMizxrb3IKGqGRW4DyBo=; b=K

vqxu1wDwOTVjpqeQTGIW0I/87l7RbWB/Cmo4MZRCV9M2G9Vyxi92LWLWXZ89FE8G

e/pUu4RBMyrG0SfbGIlFNboiFr2sil35hPUoK5asWRTdiR+sJHyl1dae9tATOTim

Qx5kmHOFrNH+N84gGS1UPEbocGJlVMk198WRsnGbNs=

Received: from jacketsandshirts$163.com (

[240e:388:9939:4301:8814:79bb:8bdc:b8bf] ) by ajax-webmail-wmsvr-40-101

(Coremail) ; Sun, 13 Sep 2026 08:29:09 +0800 (CST)

X-Originating-IP: [240e:388:9939:4301:8814:79bb:8bdc:b8bf]

Date: Sun, 13 Sep 2026 08:29:09 +0800 (CST)

From: Hi

To: doctor@nl2k.ab.ca

Subject: Our factory is an ideal fit for small-medium sized company and

start-ups

X-Priority: 3

X-Mailer: Coremail Webmail Server Version 2023.4-cmXT build

20260511(2e539873) Copyright (c) 2002-2026 www.mailtech.cn 163com

X-CM-CTRLMSGS: L/+LCnBsdXM9MTc4OTI1OTM1MDYxOF81YzEyYTA2MTQzNDU0OTBjNjc0ODY2O

WZkYzZiOTJjZA==

X-NTES-SC: AL_Qu2TC/6etksv7yacYOkfmUYRjuc7UMK0uP0j2odWPpt4jCvpxxgqe05jIFnR9eu/KiuLrzuWUSB3xcNmdotGfJkN/4YsHTDI68pm1MZupXXlsQ==

Content-Type: multipart/alternative;

boundary="----=_Part_1867_889174195.1789259349655"

MIME-Version: 1.0

Message-ID:

X-Coremail-Locale: zh_CN

X-CM-TRANSID:ZSgvCgD3hxlV7qVqVmZFAA--.16477W

X-CM-SenderInfo: 5mdfyvhwvd0vhvkl23rv6rljoofrz/xtbCwBXU-Gql7lUUPgAA3j

X-Coremail-Antispam: 1U5529EdanIXcx71UUUUU7vcSsGvfC2KfnxnUU==

X-Spam_score: 7.0

X-Spam_score_int: 70

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, We are a Chinese OEM clothing factory, we have more

than 20 years production experience, we aim to supply high-quality custom-made

garments. One of our advantages over other suppliers is that we accep [...]





Content analysis details: (7.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

[45.254.49.132 listed in dnsbl.ahbl.org]

[45.254.49.132 listed in dnsbl.ahbl.org]

[45.254.49.132 listed in dnsbl.ahbl.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[dnsbl.ahbl.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[dnsbl.ahbl.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[dnsbl.ahbl.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[sbl-xbl.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[45.254.49.132 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jacketsandshirts(at)163.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Our factory is an ideal fit for small-medium sized company and

start-ups



Hello,







We are a Chinese OEM clothing factory, we have more than 20 years production experience, we aim to supply high-quality custom-made garments. One of our advantages over other suppliers is that we accepts small‑batch orders and sincerely likes to grow with startup brands. If you are a startup company or small-medium sized company that are looking for a professional and reliable supplier to work with for your business, I firmly believe that we are the right one you need.







I don't think all clothing factories are happy to take small-batch orders and really want to give you true support and develop with you together but we are. We are even happy to invest in dedicated equipment to meet product requirements if really necessary. We are not a big factory but we are able to scale capacity to accommodate growing order volumes. you don't need to switch suppliers as your brand expands.







If you are planning to build your own brand but are struggling to find a proper supplier, please feel free to reach out to us ASAP. We'd love to be your solid backing and give you full support to help you build and establish your brand.







Also, If you are a fashion designer and want to develop Chinese market, I think we can join forces too. We are happy to set up a sample room and offer best possible support to quickly turn your ideas into reality.







Whatever, if you are genuinely interested, PLEASE DON'T just ask for catalog or website link, let's get down to something practical. Please rest assured that we are 100% confident in our ability to produce your styles as long as you can send us complete specification, diagram and size chart. Just send us some of your styles and we can go into details from there.







We can produce many types of garments, I don't think you want all of them.so if you want to see the products we made in the past, please let me know what type of garments you are interested and then I will send pictures accordingly to save your time.







By the way, we are only interested in clients who are seeking a long-term WIN-WIN partnership, If you don't have a real plan to work with a new supplier or you even don't want to spend some time to get to know us, please do not reply to this email. One thing I can promise is that you will appreciate working with us after several rounds of communication.







Just in case this email gets buried or overlooked in your mail box, please get back to me at your earliest convenience. Otherwise, you might miss out on us--that would be a huge loss for you.







Last, if you plan to pay us a factory visit, you are more than welcome.







Thanks for reading and looking forward to hearing back from you.



Leo

Fedex phish from sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 12 Sep 2026 19:37:26 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5Z9m-00000000AwC-0Lxe

for dave@doctor.nl2k.ab.ca;

Sat, 12 Sep 2026 19:37:22 -0600

Resent-From: The Doctor

Resent-Date: Sat, 12 Sep 2026 19:37:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzhsv.outbound-mail.sendgrid.net ([159.183.224.104]:13226)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5XO1-000000000J0-26Qr

for root@nk.ca;

Sat, 12 Sep 2026 17:44:11 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sanadoc.ai;

h=content-type:date:from:mime-version:subject:to:cc:content-type:date:

from:subject:to;

s=s1; t=1789256582;

bh=YiXkGXZwutFdxlae/ApxOQO6bPFBXi8szQqAls3dnQI=;

b=YAeYpkMC1fZPAW/09f9KtTzcE7kp4pr7tQdLBihPV0+FImkzOdoOJ9E6DxdSjN3TyunS

POlCVCu2cMDTKxFxVIonNphr2TyfdvQQur2qClT+kG9K065glHRP3purcUzu0qCTjnAHbt

wVPuYAQqv00M4fIdsO9eOdR75GwXhbrWwFUv/ydI+udD+TtVO/iBHCqSCcGJP0GkaQlddx

bPUVEGAB08DwGZh7EBuCX/UACPUYne+4Mdb11BfJjgrVmOq7jSs/AYJv3rycKoBPRBQyym

KvwKGm5zImnlEMYb042oLwjAr+TeF4sJ9vsUbEqB09Rkm4YQj8wt6gSfuNi8Rx7A==

Received: by recvd-canary-78c6b8b795-kqqxx with SMTP id recvd-canary-78c6b8b795-kqqxx-1-6AA5E386-6

2026-09-12 23:43:02.013968544 +0000 UTC m=+3991966.529815867

Received: from NTg3MTE0Njk (unknown)

by geopod-ismtpd-91 (SG) with HTTP

id Q8zZy1YkSEi0jwoAMiM7XA

Sat, 12 Sep 2026 23:43:01.990 +0000 (UTC)

Content-Type: multipart/mixed; boundary=f0dc8a96e36ae1e9f559f2cef4e9835c06daa83dbfd16dc43cfcd1d5d796

Date: Sat, 12 Sep 2026 23:43:02 +0000 (UTC)

From: FedEx Tracking

Mime-Version: 1.0

Message-ID:

Subject: =?UTF-8?B?V2XigJl2ZQ==?= updated your estimated delivery

X-SG-EID:

=?us-ascii?Q?u001=2EQqNlE5al1bvBBtqp7HdPgxedUqGYuBWmx7JGl4mIJfkONCbzFav5kBNU7?=

=?us-ascii?Q?NfhcMVZhJekASQ6H+yOdOD71RFs3DLVBGD8QXJz?=

=?us-ascii?Q?4Lrpkk1C2luZmJ83OnMaFeyRIdJfh3=2Fy7StXtQG?=

=?us-ascii?Q?lv8ap4fw3SOJo6wEHNtWyYQ4kLHhm4vPt8nCeBz?=

=?us-ascii?Q?20Fm+Z4DZosMBkokO92d1fZKkFbz6EoXoYEJ5Ir?=

=?us-ascii?Q?P0opJ8ZLIaRce5NHxdkjlo=3D?=

To: root@nk.ca

X-Entity-ID: u001.xaEaRzI20D/jRB4Z2jjAgA==

X-Spam_score: 18.2

X-Spam_score_int: 182

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Package Notification FedEx PACKAGE NOTIFICATION A package

has been received at the FedEx facility. Shipping cost: $12.47 USD Tracking

7894 3210 5678 9012 Weight 2.5 kg Service International Priority Reference

INV-2026-00 [...]



Content analysis details: (18.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

[159.183.224.104 listed in dnsbl.ahbl.org]

[159.183.224.104 listed in dnsbl.ahbl.org]

[159.183.224.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.224.104 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?B?V2XigJl2ZQ==?= updated your estimated delivery



--f0dc8a96e36ae1e9f559f2cef4e9835c06daa83dbfd16dc43cfcd1d5d796

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Mime-Version: 1.0












0">

FedEx Package Notification




etica,sans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%;">




e=3D"background:#f4f6f9;padding:20px 10px;margin:0;">














e=3D"max-width:520px;width:100%;background:#ffffff;border-radius:16px;box-s=

hadow:0 8px 32px rgba(0,0,0,0.10);border:1px solid #e0e3e9;margin:0 auto;">


































0;">












5px;">FedEx
ackground:rgba(255,255,255,0.20);padding:4px 14px;border-radius:20px;letter=

-spacing:0.5px;">PACKAGE NOTIFICATION























px;">

A package has been received at the FedEx facility.

x;">

Shipping cost:
t-size:24px;color:#660099;font-weight:700;">$12.47
lor:#777777;font-size:13px;">USD










<=

/td>







e=3D"margin-top:14px;">


















">


spacing:0.5px;display:block;">Tracking

7894 3210 5678 9012
>
ding-bottom:8px;">


spacing:0.5px;display:block;">Weight

2.5 kg



spacing:0.5px;display:block;">Service

International Priority
ong>


spacing:0.5px;display:block;">Reference

INV-2026-0042










<=

/td>







e=3D"margin-top:6px;">














x;">

Step 1: Pay the shipping fee



#ffffff;padding:12px 32px;border-radius:8px;text-decoration:none;font-size:=

16px;font-weight:600;">Pay Now










<=

/td>







e=3D"margin-top:6px;">




















x;">

Step 2: Sign and return

px;">

After payment, download the attached PDF, sign it, and send it back.

;padding-bottom:6px;">

=E2=80=A2 Download the attached PDF


=E2=80=A2 Sign your name


=E2=80=A2 Reply with the signed PDF










<=

/td>







e=3D"margin-top:6px;">










ize:13px;font-weight:600;">View shipment details





px;border-top:1px solid #e6e9ef;">










;">

Note: Shipping cost of
yle=3D"color:#1a1a1a;">$12.47 USD applies.


Pay, sign, and return the document.











e=3D"max-width:520px;margin-top:12px;">








ine-height:1.6;">

This is a system notification.


© 2026 FedEx. All rights reserved.









h8zctcYLl02ePDFDYybCZHV0JkL1cybi2mg1wCc7b8vdPpN7MmXdjCDOYLZiy9bO2ezd-2B-2Fl=

psxaOEwSYwYez0aMcHZvGQRaTqmaUnRjyhaku75qP9hdBZEIKRaFEeTfFdj2G2LI5xiNBYiTa-2=

FMIUV9M4aRpampLQiRqAdiA0FiXYHyYXhHnXHlV8MX47vZzzI-2FOw-3D-3D" alt=3D"" widt=

h=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px =

!important;border-width:0 !important;margin-top:0 !important;margin-bottom:=

0 !important;margin-right:0 !important;margin-left:0 !important;padding-top=

:0 !important;padding-bottom:0 !important;padding-right:0 !important;paddin=

g-left:0 !important;"/>



--f0dc8a96e36ae1e9f559f2cef4e9835c06daa83dbfd16dc43cfcd1d5d796

Content-Disposition: attachment; filename="Signature Required for FedEx Shipment.pdf"

Content-Transfer-Encoding: base64

Content-Type: application/pdf; name="Signature Required for FedEx Shipment.pdf"



...

--f0dc8a96e36ae1e9f559f2cef4e9835c06daa83dbfd16dc43cfcd1d5d796--